Secure Identity-Based Encryption in the Quantum Random Oracle Model

Abstract

We give the first proof of security for an identity-based encryption scheme in the quantum random oracle model. This is the first proof of security for any scheme in this model that requires no additional assumptions. Our techniques are quite general and we use them to obtain security proofs for two random oracle hierarchical identity-based encryption schemes and a random oracle signature scheme, all of which have previously resisted quantum security proofs, even using additional assumptions. We also explain how to remove the extra assumptions from prior quantum random oracle model proofs. We accomplish these results by developing new tools for arguing that quantum algorithms cannot distinguish between two oracle distributions. Using a particular class of oracle distributions, so called semi-constant distributions, we argue that the aforementioned cryptosystems are secure against quantum adversaries.

Quantum-Secure Message Authentication Codes

“…If q = 0, then this theorem is trivial, since the c classical outputs A sees are distributed randomly. If c = 0, then the theorem reduces to that of Zhandry [Zha12a]. By adapting the proof of the c = 0 case to the general case, we get the lemma.…”

“…We first generalize a theorem of Zhandry [Zha12a] Proof. The complete proof is given in the full version [BZ13].…”

On Finding Quantum Multi-collisions

“…Even more, the techniques involved are often closely related to proof techniques in post-quantum cryptography. For example, bounds for the quantum query complexity of finding collisions in random functions [Zha15a], as well as more general functions [EU17, BES17], were developed from techniques for proving security in the quantum random oracle model [BDF + 11, Zha12,TU16]. Similarly, the lower bounds in this work build on techniques for proving quantum indifferentiability [Zha18].…”

A Post-quantum Digital Signature Scheme Based on Supersingular Isogenies

“…The main idea of the proof is that, since the random oracle G has the same domain and range, it is indistinguishable from a random permutation [38], thus it can be replaced by an efficiently invertible function which is indistinguishable from a random oracle (for example, a random polynomial of high enough degree [37]). This allows the hashes in the proof to be inverted Algorithm 1 Prover: P OE on input (x, w) // Create t · c proofs and hash each response for i = 1 to t do…”