Simultaneous Haar Indistinguishability with Applications to Unclonable Cryptography

We give a technical overview in Section 1.3. In Section 2 we formally define simultaneous state indistinguishability and give basic facts about it. In Section 3, we show SSI for Haar states. In Section 4 we show cryptographic applications of our result. For a full list of preliminaries and a list of missing proofs, please refer to the full version of the paper.

Now we generalize our argument to the case when Bob and Charlie each get $t$ copies of their input. Similar to the $t=1$ case, we can write the projection onto the symmetric subspace over $t$ registers as

where $P_{\sigma }$ is a register-wise permutation operator. Using this identity for Bob’s and Charlie’s registers alike, the independent case yields a sum of terms of the form $P_{{\sigma }_B}\otimes P_{{\sigma }_C}$. On the other hand, the identical case will give us a sum of $P_{\sigma }$ for $\sigma \in S_{2t}$. We can match the coefficients up to $O(t^2/d)$ error, and thus we can approximate the advantage as

where $S_{2t}^{\ast }$ is the set of permutations over $2t$ registers that cannot be expressed as a product of two permutations over $t$ registers. A natural idea would be to bound this expression separately for each $P_{\sigma }$, but it would yield a factor of $\mathrm{𝗉𝗈𝗅𝗒}(t!)$ which blows up very fast. Our idea instead is to group permutations based on how far they are from a product permutation. In more detail, we define $S_{2t}^{(s)}$ as the set of permutations $\sigma$ which obeys the identity

for some permutations ${\sigma }_1,{\sigma }_2,{\sigma }_3,{\sigma }_4$ over $t$ registers, where ${\sigma }_s$ is a fixed permutation that swaps $t$ of Bob’s registers with $t$ of Charlie’s registers. Indeed, $S_{2t}^{(s)}$ is the set of permutations $\sigma$ that make $s$ swaps across Bob’s and Charlie’s registers. Moreover, by a combinatorial argument, we can compute the average of $P_{\sigma }$ by averaging the identity above over ${\sigma }_1,{\sigma }_2,{\sigma }_3,{\sigma }_4$, so that

where $C_s$ is a constant that depends on $s,t$, and ${\mathrm{\Pi }}_B^t,{\mathrm{\Pi }}_C^t$ are projections onto the symmetric subspace over Bob’s and Charlie’s $t$ registers, respectively. Using the generalization of Equation 1 we show that

and summing this over $s=1,2,\mathrm{\dots },t$ gives us a bound of $O(t^2/d)$. Keep in mind that $s=0$ is excluded from the sum because it corresponds to product permutations.

Now suppose the entangled state $|\mathrm{\Omega }⟩$ shared between Bob and Charlie is arbitrary. Intuitively, we don’t expect this relaxation to help the adversary a lot since the number of EPR pairs above was unbounded, yet it requires a proof to show this. Recall that $|\mathrm{\Omega }⟩$ can be written as

for some choice of bases $(u_i),(v_i)$ for the registers of Bob and Charlie, known as the Schmidt decomposition. An equivalent way to write this is⁹⁹9Here we are implicitly assuming that the dimensions of Bob and Charlie’s registers both equal the same power of 2. This is merely for convenience and does not affect the analysis.

for some density matrix $\sigma$, unitary $V$, and integer $r$. The unitary $V$ can be safely ignored by changing the basis of Charlie’s projection $N$. Using the cyclicity of trace we can absorb ${\sigma }^{1/2}$ in $M$ and get a similar expression for the distinguishing advantage as the maximally entangled state, where $M$ is replaced with $({\sigma }^{1/2}\otimes \mathrm{𝗂𝖽})M({\sigma }^{1/2}\otimes \mathrm{𝗂𝖽})/2^r$, with $d^{\prime }$ being the dimension of Bob’s share of the entangled state. Following the same analysis as the EPR case results in a bound that scales with $\sqrt{d^{\prime }}$. In order to get a bound that does not depend on the amount of entanglement we perform a more refined and involved analysis coupled with a more careful application of Cauchy-Schwarz, which yields a bound of $O(t^2/\sqrt{d})$ on the distinguishing advantage. An interesting open question is whether the gap between the EPR and non-EPR cases is inherent.

The search (weak) security of unclonable encryption (UE) was known since its formal introduction [17], yet strong (CPA-style/indistinguishability) security has been an open problem. There are fundamental reasons why this problem has been difficult, including the following:

1. 1.

   Because the adversary learns the secret key in the challenge phase of the unclonable security experiment, it is hard to leverage traditional cryptographic tools – wherein revealing the secret key tantamounts to the compromise of security – in the construction of unclonable encryption.

2. 2.

   There is a lack of straightforward equivalence between unpredictability and indistinguishability in the unclonability setting. The former is used to define CPA-style security and is not transitive, hence unfriendly to hybrid arguments.

3. 3.

   Due to the simultaneous nature of the security experiment, extraction techniques that work for a single party often fail against two or more entangled parties.

To elaborate on the third bullet further, one can hope to deploy classical techniques for search-to-decision reductions in this setting. For instance, it has been shown that random oracles can be used to go from weak security to strong security in UE [6, 7]. In the plain model, a common classical tool is the Goldreich-Levin extraction technique [34], using which one can try the following folklore construction of UE:

1. 1.

   The key consists of $(k,r)$, where $k$ is a key for a weakly secure UE scheme and $r\in {\{0,1\}}^n$ is a random string.

2. 2.

   To encrypt a single-bit message $m\in \{0,1\}$, sample a random message $x\in {\{0,1\}}^n$, then output encryption of $x$ using $k$, as well as $⟨r,x⟩\oplus m$.

3. 3.

   To decrypt, first use $k$ to recover $x$ using the decryption procedure of the weakly secure UE scheme and then recover $m$.

To prove unclonable security of this construction, one needs the identical-challenge version of simultaneous Goldreich-Levin, where Bob and Charlie will get the same $r$ as challenge. This is unknown even though the independent-challenge version is known [44, 7].

Our main insight is to make the string $r$ in the key come in superposition, i.e. from a quantum state $\sum {\alpha }_r|r⟩$. Intuitively, if Bob and Charlie were to measure $r$ in the computational basis, then they would effectively receive independent values of $r$, meaning that we can hope to use independent-challenge Goldreich-Levin. Accordingly, we look for a state $\sum {\alpha }_r|r⟩$ such that (1) Bob and Charlie cannot simultaneously distinguish whether or not this state has been measured in the computational basis, and (2) the computational basis measurement results in a uniform value of $r$.

Perhaps the most natural candidate for this task is to pick a Haar random state. This allows us to apply our simultaneous Haar indistinguishability result. Nonetheless, there still remain some technical challenges in the application of this concept. To begin with, we need to adapt the construction slightly to incorporate the newly acquired quantumness of $r$. Our solution is as follows:

1. 1.

   The key is partially quantum:

   • $\mathrm{■}$

     The (classical) encryption key consists of $(k,x,\tilde{b})$, where $x$ is a random message and $\tilde{b}\in \{0,1\}$ is a single-bit one-time-pad.

   • $\mathrm{■}$

     The (quantum) decryption key consists of $k$ and a state $\sum {\alpha }_r|r⟩|⟨r,x⟩\oplus \tilde{b}⟩$, where $\sum {\alpha }_r|r⟩$ is a Haar random state.

2. 2.

   To encrypt a single-bit message $m\in \{0,1\}$, output encryption of $x$ using $k$, as well as $\tilde{b}\oplus m$.

3. 3.

   To decrypt, first use $k$ to recover $x$, then coherently recover $\tilde{b}$ followed by $m$.

Using the simultaneous Haar indistinguishability, we can show that our construction is secure via the hybrid method. Note that we can do this because our notion of simultaneous-state-indistinguishability is strong enough that it is amenable to the use of hybrids.

In more detail, we reach an indistinguishable hybrid experiment where the Bob and Charlie get keys which use independently generated Haar random states. Equivalently, Bob gets $(r,⟨r,x⟩\oplus \tilde{b})$ and Charlie gets $(r^{\prime },⟨r^{\prime },x⟩\oplus \tilde{b})$ for independent $r,r^{\prime }$.

Next, we move to a hybrid which is the weak security (i.e. search security) experiment of the underlying unclonable encryption scheme, so that Bob and Charlie need to output $x$ each given the key $k$. Unfortunately, even though $r$ and $r^{\prime }$ are independent in the previous hybrid, independent-challenge simultaneous Goldreich-Levin [44, 7] is insufficient due to the correlation between the bits $b=⟨r,x⟩\oplus \tilde{b}$ and $b^{\prime }=⟨r^{\prime },x⟩\oplus \tilde{b}$, namely $b\oplus b^{\prime }=⟨r,x⟩\oplus ⟨r^{\prime },x⟩$. To overcome this issue, we prove exactly what we need, which we call correlated simultaneous quantum Goldreich-Levin¹⁰¹⁰10As a side note, this lemma resolves an open question in [44], implying that their construction achieves a more desirable notion of security. ¹¹¹¹11Previously, the work of [3] explicitly stated the correlated Goldreich-Levin problem over large finite fields as a conjecture. (Lemma 30), which can be summarized as follows:

Correlated Goldreich-Levin: Suppose that Bob is given input $(r,b)$ and Charlie is given input $(r^{\prime },b^{\prime })$, where $r,r^{\prime }$ are independent strings and $b,b^{\prime }$ are uniform bits satisfying the correlation $b\oplus b^{\prime }=⟨r,x⟩\oplus ⟨r^{\prime },x⟩$. If (Bob, Charlie) can output $(⟨r,x⟩,⟨r^{\prime },x⟩)$ with probability $1/2+1/\mathrm{𝗉𝗈𝗅𝗒}$, then there is an extractor $(\text{ExtBob},\text{ExtCharlie})$ that extracts $(x,x)$ from (Bob, Charlie) with probability $1/\mathrm{𝗉𝗈𝗅𝗒}$.

To prove this lemma we first tackle the correlation between $b$ and $b^{\prime }$. Consider $\widetilde{\text{Bob}}$ who takes as input $r$, samples $b$ himself uniformly, and runs Bob on input $(r,b)$ to obtain $b_B$; similarly consider $\widetilde{\text{Charlie}}$ who takes $r^{\prime }$ as input, samples $b^{\prime }$ and runs Charlie on input $(r^{\prime },b^{\prime })$ to obtain $b_C$. Now that the input bits $b,b^{\prime }$ are uncorrelated, ($\widetilde{\text{Bob}},\widetilde{\text{Charlie}}$), who output $(b_B,b_C)$, are expected to have worse success probability than (Bob, Charlie). However, we can in turn relax the success criterion for ($\widetilde{\text{Bob}},\widetilde{\text{Charlie}}$) to merely output bits $(b_B,b_C)$ that satisfy $b_B\oplus b_C=⟨r,x⟩\oplus ⟨r^{\prime },x⟩$ in order to counteract this lack of correlation. In other words, now ($\widetilde{\text{Bob}},\widetilde{\text{Charlie}}$) are additionally allowed to be both incorrect. Indeed, we show that the success probability of ($\widetilde{\text{Bob}},\widetilde{\text{Charlie}}$) in this case is at least that of (Bob, Charlie), i.e. $1/2+1/\mathrm{𝗉𝗈𝗅𝗒}$. To show this fact, we define $E$ as the event that $b\oplus b^{\prime }=⟨r,x⟩\oplus ⟨r^{\prime },x⟩$. Conditioned on $E$, Bob and Charlie will output $(⟨r,x⟩,⟨r^{\prime },x⟩)$ with probability $1/2+1/\mathrm{𝗉𝗈𝗅𝗒}$ by our assumption. In addition, the event $E$ is independent of Bob’s (or Charlie’s) marginal output due to the fact that the players’ correlation satisfies no-signalling. To see this, notice that the bits $b$ and $b^{\prime }$ can each independently control the event $E$. We utilize this important observation to show the desired result. Another way to interpret this reduction is as follows: the correlation that (Bob, Charlie) require in order to output $(⟨r,x⟩,⟨r^{\prime },x⟩)$ appears as a correlation in the output of ($\widetilde{\text{Bob}},\widetilde{\text{Charlie}}$), who take uncorrelated bits as input.

After this reduction, it seems that we still cannot use the original independent-challenge simultaneous Goldreich-Levin because of the relaxed success criterion above. Luckily, by examining the proof of [7] we see that this condition is sufficient without additional work for the existence of (ExtBob, ExtCharlie) who can extract $(x,x)$ simultaneously.

For $t$-copy security, where Bob and Charlie get $t$ copies of the decryption key in the unclonable security experiment, we need $t$ to be at most linear in $n$, for otherwise Bob and Charlie can learn $x$ using Gaussian elimination. In the proof, we similarly reach a hybrid where the Haar random states given to Bob and Charlie are independent. Then, we need an extra step where we switch to a hybrid in which Bob gets as input $(r_i,⟨r_i,x⟩\oplus \tilde{b})$ for independent samples $r_1,\mathrm{\dots },r_t$ (instead of $(r_1,\mathrm{\dots },r_t)$ being generated from $t$ copies of a Haar random state) and similarly Charlie gets $(r_i^{\prime },⟨r_i^{\prime },x⟩\oplus \tilde{b})$ for independently generated $r_1^{\prime },\mathrm{\dots },r_t^{\prime }$. We show that the success probability of Bob and Charlie does not decrease from this change. To show this, we argue that that given $(r_i,⟨r_i,x⟩\oplus \tilde{b})$ Bob can prepare

where $|\phi ⟩={\sum }_r{\alpha }_r|r⟩$ is a Haar random state. In the expression above, $|r⟩$ corresponds to the register that holds Goldreich-Levin samples, which are generated from $t$ copies of a Haar random state rather than $t$ independent samples. Recall that ${\phi }^{\otimes t}$ can be written as a random vector in the type basis. Using this fact, Bob can coherently apply a random permutation $\sigma \in S_t$ to the values $|r_i,⟨r_i,x⟩\oplus \tilde{b}⟩$, after which he can uncompute the permutation $\sigma$. We can argue similarly for Charlie, since their inputs originate from independent Haar distributions. This argument in fact requires the strings $r_i$ to be distinct, which fortunately holds with high probability by the birthday bound.

Note that the input above given to Bob can be thought of as $(r,⟨r,x⟩\oplus \tilde{b})$ alongside $t-1$ random samples of $(r_i,⟨r_i,x⟩)$. In the final step, we apply our correlated Goldreich-Levin result in the presence of this extra information to reach the search security experiment for the weakly secure UE scheme. In this experiment, the extra information can be guessed by Bob and Charlie, hence if $t$ is bounded by a linear function of $n$ the security still holds.

Single-decryptor encryption is a primitive that closely resembles unclonable encryption. It is an encryption scheme in which the decryption key is unclonable. In the security experiment, Alice tries to clone a quantum decryption key and split it between Bob and Charlie, who then try to decrypt a ciphertext they receive using their shares of the key. Depending on the correlation of these ciphertexts, one can define identical-challenge or independent-challenge security. We adapt our construction of unclonable encryption with quantum decryption keys to construct single-decryptor encryption with quantum ciphertexts. Our construction can be summarized as follows:

1. 1.

   The encryption key consists of a key $k$ as well as a random message $x$ for a weakly secure UE scheme. The quantum decryption key contains $k$ and encryption of $x$ using $k$.

2. 2.

   To encrypt a one-bit message $m$, output $k$ as well as $\sum {\alpha }_r|r⟩|⟨r,x⟩\oplus m⟩$, where $\sum {\alpha }_r|r⟩$ is a Haar random state.

3. 3.

   To decrypt, first recover $x$ and then coherently compute $m$.

We can show that this construction is secure if Bob and Charlie are given $t$ copies of the same ciphertext for $t=O(|x|)$. The proof is nearly identical to the security proof of our UE construction above. For more clear exposition, in the technical sections we first present our construction of single-decryptor encryption (Section 4.1), followed by that of unclonable encryption (Section 4.2).

As another application of simultaneous Haar indistinguishability, we construct a 2-out-of-$n$ quantum secret-sharing scheme for a single-bit classical message. The construction is as follows:

1. 1.

   The shares of bit $b=0$ are identical Haar random states $|\psi ⟩$ and the shares of $b=1$ are independent Haar random states $|{\psi }_i⟩$. In addition, we give $t$ copies of their share to all parties $1,2,\mathrm{\dots },n$.

2. 2.

   Any two parties $i,j$ can recover the message by applying $t$ SWAP tests between their secrets. If $m=0$, then all the tests will succeed. On the other hand, if $m=1$, then with high probability the independent Haar random states held by $i$ and $j$ will be almost orthogonal, therefore the number of SWAP tests that pass will be concentrated near $t/2$ by a Chernoff bound.

Formally, we show that $m$ remains hidden in the presence of $\mathrm{\ell }$-bits of classical leakage from each party. This amounts to showing a many-party and many-bit generalization of simultaneous Haar indistinguishability (SHI), that is, either all parties get (copies of) the same Haar random state or they get (copies of) independent Haar random states. Firstly, we go from 1-bit SHI to $\mathrm{\ell }$-bit SHI for 2 parties. This can be achieved by a union bound, which incurs a multiplicative loss of $2^{2\mathrm{\ell }}$ in security. And then we show an equivalence between SHI in the cases of (1) $2$ parties each getting $O(nt)$ copies and (2) $O(n)$ parties each getting $t$ copies. This can be seen as distributing a fixed number of Haar random states among more parties. In the proof we use $O(\log n)$ hybrids, doubling the number of parties at each hybrid. We show by an additional hybrid argument that we incur a multiplicative loss of $O(1)$ at each step, hence a multiplicative loss of $O(n)$ in total after $O(\log n)$ steps. Putting everything together, we show that we can allow $\mathrm{\ell }=O(\log d/n)$ bits of leakage from each party, where $\log d$ is the number of qubits of each copy of a share. The number of copies ($t$) given to each party can be an arbitrary polynomial, which lets us amplify the correctness of the scheme. An interesting open question is to get rid of the exponential dependence on the number of bits leaked ($\mathrm{\ell }n$), which would imply that our construction tolerates unbounded polynomial leakage.

For any non-local adversary $𝒜=(ℬ,𝒞,\rho )$ and any $y,y^{\prime }\in {\{0,1\}}^n$, we have

by $(\epsilon ,𝒟)$-SSI. This is because $ℬ$ ($𝒞$) can associate $y$ (respectively, $y^{\prime }$) with 0 and every other string with 1. By summing over all $y,y^{\prime }$ and dividing by $2$ we get the desired result. $◀$