Certified Everlasting Zero-Knowledge Proof for QMA

Zero-knowledge [GMR89], which roughly states that the verifier cannot learn anything beyond the validity of the statement, is one of the most important concepts in cryptography and computer science. The study of zero-knowledge has a long history in classical cryptography, and recently there have been many results in quantum cryptography. In known constructions of classical zero-knowledge protocols for NP, either of zero-knowledge or soundness holds only against computationally bounded adversaries. Indeed, achieving both statistical zero-knowledge and statistical soundness at the same time with classical verifier is impossible for NP unless the polynomial-time hierarchy collapses [For87]. It is also believed to be impossible even with a quantum verifier [MW18].

Broadbent and Islam [BI20] recently suggested an idea of the novel compromise: realizing “everlasting zero-knowledge” by using quantum encryption with certified deletion. The everlasting security defined by Unruh [Unr13] states that the protocol remains secure as long as the adversary runs in polynomial-time during the execution of the protocol. Quantum encryption with certified deletion introduced by Broadbent and Islam [BI20] is a new quantum cryptographic primitive where a classical message is encrypted into a quantum ciphertext, and the receiver in possession of a quantum ciphertext can generate a classical certificate that shows that the receiver has deleted the quantum ciphertext. If the certificate is valid, the receiver can no longer decrypt the message even if it receives the secret key. Broadbent and Islam’s idea is to use quantum commitment with a similar certified deletion security to encrypt the first message from the prover to the verifier in the standard $\Sigma$-protocol. Once the verifier issues the deletion certificate for all commitments that are not opened by the verifier’s challenge, even an unbounded verifier can no longer access the committed values of the unopened commitments. They left the formal definition and the construction as future works.

There are many obstacles to realizing their idea. First, their quantum encryption with certified deletion cannot be directly used in a $\Sigma$-protocol because it does not have any binding property. Their ciphertext consists of a classical and quantum part. The classical part is $m\oplus u\oplus H(r)$, where $m$ is the plaintext, $u$ and $r$ are random bit strings, and $H$ is a hash function. The quantum part is a random BB84 states whose computational basis states encode $r$. The decryption key is $u$ and the place of computational basis states that encode $r$, and therefore it is not binding: by changing $u$, a different message can be obtained. We therefore need to extend quantum encryption with certified deletion in such a way that the statistical binding property is included.

Second, defining a meaningful notion of “everlasting zero-knowledge proof” itself is non-trivial. In fact, everlasting zero-knowledge proofs for QMA or even for NP in the sense of Unruh’s definition [Unr13] are unlikely to exist.¹¹ 1 We mention that everlasting zero-knowledge arguments, which only satisfy computational soundness, can exist. Indeed, any statistical zero-knowledge argument is everlasting zero-knowledge argument. One may think that the computational soundness is fine since that ensures everlasting soundness in the sense of Unruh’s definition [Unr13]. For practical purposes, this may be true. On the other hand, we believe that it is theoretically interesting to pursue (a kind of) everlasting zero-knowledge without compromising the soundness as is done in this paper. To see this, recall that the definition of quantum statistical zero-knowledge [Wat09, MW18] requires a simulator to simulate the view of a quantum polynomial-time malicious verifier in a statistically indistinguishable manner. Therefore, everlasting zero-knowledge in the sense of Unruh’s definition [Unr13] is actually equivalent to quantum statistical zero-knowledge. On the other hand, as already mentioned, it is believed that quantum statistical zero-knowledge proofs for NP do not exist [MW18]. In particular, Menda and Watrous [MW18] constructed an oracle relative to which quantum statistical zero-knowledge proofs for (even a subclass of) NP do not exist.

However, we notice that this argument does not go through for certified everlasting zero-knowledge, where the verifier can issue a classical certificate that shows that the verifier has deleted its information. Once a valid certificate has been issued, even unbounded malicious verifier can no longer learn anything beyond the validity of the statement. The reason is that certified everlasting zero-knowledge does not imply statistical zero-knowledge since it does not ensure any security against a malicious verifier that refuses to provide a valid certificate of deletion. Therefore, we have the following question.

Is it possible to define and construct a certified everlasting zero-knowledge proof for QMA?

In this work, we define and construct the certified everlasting zero-knowledge proof for QMA. This goal is achieved in the following four steps.

1. 1.

   We define a new quantum cryptographic primitive, which we call commitment with statistical binding and certified everlasting hiding. In this new commitment scheme, binding is statistical but hiding is computational. However, the hiding property becomes statistical once the receiver has issued a valid certificate that shows that the receiver has deleted the committed information.

2. 2.

   We construct commitment with statistical binding and certified everlasting hiding. We use secret-key quantum encryption with certified deletion as the building block in a black box way . This construction is secure in the quantum random oracle model [BDF+11].

3. 3.

   We define a new notion of zero-knowledge proof, which we call the certified everlasting zero-knowledge proof for QMA. It is a computational zero-knowledge proof for QMA with the following additional property. A verifier can issue a classical certificate that shows that the verifier has deleted its information. If the certificate is valid, even unbounded malicious verifier can no longer learn anything beyond the validity of the statement.

4. 4.

   We apply commitment with statistical binding and certified everlasting hiding to the quantum $\Sigma$-protocol for QMA by Broadbent and Grilo [BG20] to construct the certified everlasting zero-knowledge proof for QMA.

We have three remarks on our results. First, although our main results are the definition and the construction of the certified everlasting zero-knowledge proof for QMA, our commitment with statistical binding and certified everlasting hiding itself is also of independent interest. There will be many other useful applications beyond zero-knowledge. In fact, it is known that binding and hiding cannot be made statistical at the same time even in the quantum world [LC97, May97], and therefore our new commitment scheme provides a nice compromise.

Second, our new commitment scheme and the new zero-knowledge proof are the first cryptographic applications of symmetric-key quantum encryption with certified deletion. Although certified deletion is conceptually very interesting, there was no concrete construction of cryptographic applications when it was first introduced [BI20]. One reason why the applications are limited is that in cryptography it is not natural to consider the case when the receiver receives the private key later. Hiroka et al. [HMNY21] recently extended the symmetric-key scheme by Broadbent and Islam [BI20] to a public-key encryption scheme, an attribute-based encryption scheme, and a publicly verifiable scheme, which have opened many applications. However, one disadvantage is that their security is the computational one unlike the symmetric-key scheme [BI20]. Therefore it was open whether there is any cryptographic application of the information-theoretically secure certified deletion scheme. Our results provide the first cryptographic applications of it. Interestingly, the setup of the symmetric-key scheme [BI20], where the receiver does not have the private key in advance, nicely fits into the framework of the $\Sigma$-protocol, because the verifier (receiver) in the $\Sigma$-protocol does not have the decryption key of the first encrypted message from the prover (sender).

Finally, note that certified everlasting zero-knowledge and certified everlasting hiding seem to be impossible in the classical world, because a malicious adversary can copy its information. In particular, certified everlasting zero-knowledge against classical verifiers clearly implies honest-verifier statistical zero-knowledge since an honest verifier runs in polynomial-time.²² 2 A similar argument does not work for quantum verifiers since the honest-verifier quantum statistical zero-knowledge [Wat02] requires a simulator to simulate honest verifier’s internal state at any point of the protocol execution. This is not implied by certified everlasting zero-knowledge, which only requires security after generating a valid deletion certificate. Moreover, it is known that $\textbf{{HVSZK}}=\textbf{{SZK}}$ where HVSZK and SZK are languages that have honest-verifier statistical zero-knowledge proofs and (general) statistical zero-knowledge proofs, respectively [GSV98]. Therefore, if certified everlasting zero-knowledge proofs for NP with classical verification exist, we obtain $\textbf{{NP}}\subseteq\textbf{{HVSZK}}=\textbf{{SZK}}$, which means the collapse of the polynomial-time hierarchy [For87]. Though the above argument only works for protocols in the standard model, no construction of honest-verifier statistical zero-knowledge proofs for NP is known in the random oracle model either. Our results therefore add novel items to the list of quantum cryptographic primitives that can be achieved only in the quantum world.

Here we introduce basic notations we will use. In this paper, $x\leftarrow X$ denotes selecting an element from a finite set $X$ uniformly at random, and $y\leftarrow A(x)$ denotes assigning to $y$ the output of a probabilistic or deterministic algorithm $A$ on an input $x$. When we explicitly show that $A$ uses randomness $r$, we write $y\leftarrow A(x;r)$. When $D$ is a distribution, $x\leftarrow D$ denotes sampling an element from $D$. Let $[n]$ be the set $\{1,\dots,n\}$. Let $\lambda$ be a security parameter, and $y\coloneqq z$ denotes that $y$ is set, defined, or substituted by $z$. For a bit string $s\in\{0,1\}^{n}$, $s_{i}$ denotes the $i$-th bit of $s$. QPT stands for quantum polynomial time. PPT stands for (classical) probabilistic polynomial time. For a subset $S\subseteq W$ of a set $W$, $\overline{S}$ is the complement of $S$, i.e., $\overline{S}\coloneqq W\setminus S$. A function $f:\mathbb{N}\rightarrow\mathbb{R}$ is a negligible function if for any constant $c$, there exists $\lambda_{0}\in\mathbb{N}$ such that for any $\lambda>\lambda_{0}$, $f(\lambda)<\lambda^{-c}$. We write $f(\lambda)\leq{\mathsf{negl}}(\lambda)$ to denote $f(\lambda)$ being a negligible function.

We assume the familiarity with basics of quantum computation, and use standard notations. Let us denote $\mathcal{Q}$ be the state space of a single qubit. $I$ is the two-dimensional identity operator. For simplicity, we often write $I^{\otimes n}$ as $I$ for any $n$ when the dimension of the identity operator is clear from the context. For any single-qubit operator $O$, $O_{i}$ means an operator that applies $O$ on the $i$-th qubit and applies $I$ on all other qubits. $X$ and $Z$ are the Pauli $X$ and $Z$ operators, respectively. For any $n$-bit strings $x\coloneqq(x_{1},x_{2},\cdots,x_{n})\in\{0,1\}^{n}$ and $z\coloneqq(z_{1},z_{2},\cdots,z_{n})\in\{0,1\}^{n}$, $X^{x}\coloneqq\prod_{i\in[n]}X_{i}^{x_{i}}$ and $Z^{z}\coloneqq\prod_{i\in[n]}Z_{i}^{z_{i}}$. For any subset $S$, $\Tr_{S}$ means the trace over all qubits in $S$. For any quantum state $\rho$ and a bit string $s\in\{0,1\}^{n}$, $\rho\otimes s$ means $\rho\otimes|s\rangle\langle s|$. The trace distance between two states $\rho$ and $\sigma$ is given by $\frac{1}{2}\norm{\rho-\sigma}_{\tr}$, where $\norm{A}_{\tr}\coloneqq\Tr\sqrt{{\it A}^{\dagger}{\it A}}$ is the trace norm. If $\frac{1}{2}\norm{\rho-\sigma}_{\tr}\leq\epsilon$, we say that $\rho$ and $\sigma$ are $\epsilon$-close. If $\epsilon={\mathsf{negl}}(\lambda)$, then we say that $\rho$ and $\sigma$ are statistically indistinguishable.

Let $C_{0}$ and $C_{1}$ be quantum channels from $p$ qubits to $q$ qubits, where $p$ and $q$ are polynomials. We say that they are computationally indistinguishable, and denote it by $C_{0}\approx_{c}C_{1}$ if there exists a negligible function ${\mathsf{negl}}$ such that $|\Pr[D((C_{0}\otimes I)(\sigma))=1]-\Pr[D((C_{1}\otimes I)(\sigma))=1]|\leq{\mathsf{negl}}(\lambda)$ for any polynomial $k$, any $(p+k)$-qubit state $\sigma$, and any polynomial-size quantum circuit $D$ acting on $q+k$ qubits. We say that $C_{0}$ and $C_{1}$ are statistically indistinguishable, and denote it by $C_{0}\approx_{s}C_{1}$, if $D$ is an unbounded algorithm.

A complexity class of $k$-SimQMA is introduced, and proven to be equal to QMA in [BG20].

In this section, we review cryptographic tools used in this paper.

The following lemma will be used in the construction of the certified everlasting zero-knowledge proof for QMA in Section 4. It is shown with the standard hybrid argument (see Appendix D). It is also easy to see that a similar lemma holds for computational hiding.

Let $\lambda$ be the security parameter, and let $p$, $q$, $r$, $s$, $t$ and $u$ be some polynomials. We construct commitment with certified everlasting hiding and classical-extractor-based binding, $\Sigma_{\mathsf{ccd}}=(\mathsf{Commit},\mathsf{Verify},\mathsf{Del},\mathsf{Cert})$, with message space $\mathcal{M}=\{0,1\}^{n}$, commitment space $\mathcal{C}=\mathcal{Q}^{\otimes p(\lambda)}\times\{0,1\}^{q(\lambda)}\times\{0,1\}^{r(\lambda)}$, decommitment space $\mathcal{D}=\{0,1\}^{s(\lambda)}\times\{0,1\}^{t(\lambda)}$, key space $\mathcal{K}=\{0,1\}^{r(\lambda)}$ and deletion certificate space $\mathcal{E}=\{0,1\}^{u(\lambda)}$ from the following primitives:

• •

  Secret-key encryption with certified deletion, $\Sigma_{\mathsf{skcd}}=\mathsf{SKE}.(\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec},\mathsf{Del},\mathsf{Verify})$, with plaintext space $\mathcal{M}=\{0,1\}^{n}$, ciphertext space $\mathcal{C}=\mathcal{Q}^{\otimes p(\lambda)}$, key space $\mathcal{K}=\{0,1\}^{r(\lambda)}$, and deletion certificate space $\mathcal{E}=\{0,1\}^{u(\lambda)}$.

• •

  Classical non-interactive commitment, $\Sigma_{\mathsf{com}}=\mathsf{Classical}.\mathsf{Commit}$, with plaintext space $\{0,1\}^{s(\lambda)}$, randomness space $\{0,1\}^{t(\lambda)}$, and commitment space $\{0,1\}^{q(\lambda)}$.

• •

  A hash function $H$ from $\{0,1\}^{s(\lambda)}$ to $\{0,1\}^{r(\lambda)}$ modeled as a quantumly-accessible random oracle.

The construction is as follows.

$\mathsf{Commit}(1^{\lambda},m)$:

• •

  Generate $\mathsf{ske.sk}\leftarrow\mathsf{SKE}.\mathsf{KeyGen}(1^{\lambda})$, $R\leftarrow\{0,1\}^{s(\lambda)}$, $R^{\prime}\leftarrow\{0,1\}^{t(\lambda)}$, and a hash function $H$ from $\{0,1\}^{s(\lambda)}$ to $\{0,1\}^{r(\lambda)}$.

• •

  Compute $\mathsf{ske}.\mathsf{CT}\leftarrow\mathsf{SKE}.\mathsf{Enc}(\mathsf{ske}.\mathsf{sk},m)$, $f\leftarrow\mathsf{Classical}.\mathsf{Commit}(R;R^{\prime})$, and $h\coloneqq H(R)\oplus\mathsf{ske}.\mathsf{sk}$.

• •

  Output $\mathsf{com}\coloneqq(\mathsf{ske}.\mathsf{CT},f,h)$, $\mathsf{d}_{1}\coloneqq R$, $\mathsf{d}_{2}\coloneqq R^{\prime}$, and $\mathsf{ck}\coloneqq\mathsf{ske}.\mathsf{sk}$.

$\mathsf{Verify}_{1}(\mathsf{com},\mathsf{d}_{1},\mathsf{d}_{2})$:

• •

  Parse $\mathsf{com}=(\mathsf{ske}.\mathsf{CT},f,h)$, $\mathsf{d}_{1}=R$, and $\mathsf{d}_{2}=R^{\prime}$.

• •

  Output $\top$ if $f=\mathsf{Classical}.\mathsf{Commit}(R;R^{\prime})$, and output $\bot$ otherwise.

$\mathsf{Verify}_{2}(\mathsf{com},\mathsf{d}_{1})$:

• •

  Parse $\mathsf{com}=(\mathsf{ske}.\mathsf{CT},f,h)$ and $\mathsf{d}_{1}=R$.

• •

  Compute $\mathsf{ske}.\mathsf{sk}^{\prime}\coloneqq H(R)\oplus h$.

• •

  Output $m^{\prime}\leftarrow\mathsf{SKE}.\mathsf{Dec}(\mathsf{ske}.\mathsf{sk}^{\prime},\mathsf{ske}.\mathsf{CT})$.

$\mathsf{Del}(\mathsf{com})$:

• •

  Parse $\mathsf{com}=(\mathsf{ske}.\mathsf{CT},f,h)$.

• •

  Compute $\mathsf{ske}.\mathsf{cert}\leftarrow\mathsf{SKE}.\mathsf{Del}(\mathsf{ske}.\mathsf{CT})$.

• •

  Output $\mathsf{cert}\coloneqq\mathsf{ske}.\mathsf{cert}$.

$\mathsf{Cert}(\mathsf{cert},\mathsf{ck})$:

• •

  Parse $\mathsf{cert}=\mathsf{ske}.\mathsf{cert}$ and $\mathsf{ck}=\mathsf{ske}.\mathsf{sk}$.

• •

  Output $\top/\bot\leftarrow\mathsf{SKE}.\mathsf{Verify}(\mathsf{ske}.\mathsf{sk},\mathsf{ske}.\mathsf{cert})$.