We give a new class of security definitions for authentication in the quantum setting. These definitions capture and strengthen existing definitions of security against quantum adversaries for both classical message authentication codes (MACs) and well as full quantum state authentication schemes. The main feature of our definitions is that they precisely characterize the effective behavior of any adversary when the authentication protocol accepts, including correlations with the key. Our definitions readily yield a host of desirable properties and interesting consequences; for example, our security definition for full quantum state authentication implies that the entire secret key can be re-used if the authentication protocol succeeds.Next, we present several protocols satisfying our security definitions. We show that the classical Wegman-Carter authentication scheme with 3-universal hashing is secure against superposition attacks, as well as adversaries with quantum side information. We then present conceptually simple constructions of full quantum state authentication.Finally, we prove a lifting theorem which shows that, as long as a protocol can securely authenticate the maximally entangled state, it can securely authenticate any state, even those that are entangled with the adversary. Thus, this shows that protocols satisfying a fairly weak form of authentication security automatically satisfy a stronger notion of security (in particular, the definition of Dupuis, et al (2012)).

A matrix M : A × X → {−1, 1} corresponds to the following learning problem: An unknown element x ∈ X is chosen uniformly at random. A learner tries to learn x from a stream of samples, (a 1 , b 1 ), (a 2 , b 2 ) . . ., where for every i, a i ∈ A is chosen uniformly at random and b i = M (a i , x).Assume that k, ℓ, r are such that any submatrix of M of at least 2 −k · |A| rows and at least 2 −ℓ · |X| columns, has a bias of at most 2 −r . We show that any learning algorithm for the learning problem corresponding to M requires either a memory of size at least Ω (k · ℓ), or at least 2 Ω(r) samples. The result holds even if the learner has an exponentially small success probability (of 2 −Ω(r) ).In particular, this shows that for a large class of learning problems, any learning algorithm requires either a memory of size at least Ω ((log |X|) · (log |A|)) or an exponential number of samples, achieving a tight Ω ((log |X|) · (log |A|)) lower bound on the size of the memory, rather than a bound of Ω min (log |X|) 2 , (log |A|) 2 obtained in previous works [R17,MM17b].Moreover, our result implies all previous memory-samples lower bounds, as well as a number of new applications.Our proof builds on [R17] that gave a general technique for proving memory-samples lower bounds.

No abstract

No abstract

No abstract