Semi-quantum Copy-Protection and More

Abstract

Properties of quantum mechanics have enabled the emergence of quantum cryptographic protocols achieving important goals which are proven to be impossible classically. Unfortunately, this usually comes at the cost of needing quantum power from every party in the protocol, while arguably a more realistic scenario would be a network of classical clients, classically interacting with a quantum server.In this paper, we focus on copy-protection, which is a quantum primitive that allows a program to be evaluated, but not copied, and has shown interest especially due to its links to other unclonable cryptographic primitives. Our main contribution is to show how to dequantize quantum copy-protection schemes constructed from hidden coset states, by giving a construction for classically-instructed remote state preparation for coset states, which preserves hardness properties of hidden coset states. We then apply this dequantizer to obtain semi-quantum cryptographic protocols for copy-protection and tokenized signatures with strong unforgeability. In the process, we present the first secure copy-protection scheme for point functions in the plain model and a new direct product hardness property of coset states which immediately implies a strongly unforgeable tokenized signature scheme.⋆ Work done while at CRED and DIENS. 1 This is called hybrid quantum cryptography in [AGKZ20]. Technical Overview Our Remote Coset State Preparation Protocol and Its Application toCopy-ProtectionIn this section, we give an overview of our remote coset state preparation protocol and its proof of soundness. To give the reader a glimpse of the functionality of our protocol and how it can be used as a generic compiler to obtain semi-quantum copy-protection, we first start by analysing security requirements for several existing quantum copy-protection schemes based on coset states.Security Requirements. For our discussion, we focus on the copy-protection of pseudorandom functions scheme in the plain model and the single-decryptor scheme in the plain model presented in [CLLZ21]. The common point is that security of these constructions all reduce to a monogamy-ofentanglement property of coset states [CLLZ21, CV22]. Informally, this property states that a triple of quantum algorithms Alice, Bob and Charlie cannot cooperatively win the following monogamy game with a challenger, except with negligible probability. The challenger first prepares a uniformly random coset state |A s,s ′ ⟩ and gives the state to Alice. Alice outputs two (possibly entangled) quantum states and sends them to Bob and Charlie respectively. No communication is allowed between Bob and Charlie. Finally, Bob and Charlie both get the description of the subspace A. The game is won if Bob outputs a vector in A + s and Charlie outputs a vector in A ⊥ + s ′ , where A ⊥ denote the dual subspace of A.If our goal is to design a semi-quantum protocol for preparing coset states such that it can be used in a plug-and-play manner for the aforementioned protocols, our protocol needs to have the fo...