Quantum Tokens for Digital Signatures

Abstract

The fisherman caught a quantum fish. "Fisherman, please let me go", begged the fish, "and I will grant you three wishes". The fisherman agreed. The fish gave the fisherman a quantum computer, three quantum signing tokens and his classical public key. The fish explained: "to sign your three wishes, use the tokenized signature scheme on this quantum computer, then show your valid signature to the king, who owes me a favor". The fisherman used one of the signing tokens to sign the document "give me a castle!" and rushed to the palace. The king executed the classical verification algorithm using the fish's public key, and since it was valid, the king complied. The fisherman's wife wanted to sign ten wishes using their two remaining signing tokens. The fisherman did not want to cheat, and secretly sailed to meet the fish. "Fish, my wife wants to sign ten more wishes". But the fish was not worried: "I have learned quantum cryptography following the previous story (The Fisherman and His Wife by the brothers Grimm). The quantum tokens are consumed during the signing. Your polynomial wife cannot even sign four wishes using the three signing tokens I gave you". "How does it work?" wondered the fisherman. "Have you heard of quantum money? These are quantum states which can be easily verified but are hard to copy. This tokenized quantum signature scheme extends Aaronson and Christiano's quantum money scheme, which is why the signing tokens cannot be copied". "Does your scheme have additional fancy properties?" the fisherman asked. "Yes, the scheme has other security guarantees: revocability, testability and everlasting security. Furthermore, if you're at sea and your quantum phone has only classical reception, you can use this scheme to transfer the value of the quantum money to shore", said the fish, and swam away.

Obfuscation of Pseudo-Deterministic Quantum Circuits

“…Proof. This follows by a slight tweak to arguments in [BS16]. We first note that by a union bound, it suffices to show that each of the following three cases happens with negligible probability: (1) A λ outputs σ 0 , σ 1 such that σ 0 is a valid signature of 0 and σ 1 is a valid signature of 1, (2) A λ outputs σ 0 = σ ′ 0 that are both valid signatures of 0, and (3) A λ outputs σ 1 = σ ′ 1 that are both valid signatures of 1.…”

“…Can signature tokens help? Before coming to our solution, we discuss one promising but flawed attempt at upgrading to reusable soundness via the primitive of signature tokens [BS16]. A signature token consists of a quantum signing |sk that can be used to sign a single arbitrary message x, and then becomes useless.…”

“…First, since the prover has superposition access to the verifier, they never have to actually output a classical signature σ. Moreover, in known signature token schemes [BS16], the public parameters can be used to implement a projection |sk sk| onto the original signing key. Thus, even though a prover may "damage" its state |sk by querying Ver[sp] in superposition in order to learn a single bit of information about h, they could then project back onto |sk via amplitude amplification.…”

“…Note that this actually requires the signature token scheme to be strongly unforgeable. That is, the adversary shouldn't even be able to produce a different signature σ ′ on the same message (x, c), since then (x, c, σ ′ ) could be used to generate a fresh set of parameters with different h. While this notion was not proven explicitly in [BS16], we note that it follows easily from their proof strategy.…”

“…[AC12, BS16, AGKZ20]). Indeed, the condition is neither that |ψ A is some fixed state (as in [AC12]), or that measuring |ψ A in the standard basis yields a classical string in some well-defined set (as in [BS16,AGKZ20]). Rather, the condition involves reasoning about the overlap between two projectors, where one is defined via an arbitrary rotation U.…”