Feasibility and Completeness of Cryptographic Tasks in the Quantum World Hong-Sheng Zhou (U. Maryland) Joint work with Jonathan Katz (U. Maryland) Fang Song (Penn. State U.) Vassilis Zikas (U. Maryland)

How would classical cryptography change in a quantum world?

Take advantage of quantum to break protocols o Factoring and Discrete Logarithm-based protocols are no longer secure [Shor94] Use quantum to build protocols o Quantum Key Distribution (QKD)[BB84] Use classical authenticated channel to build statistically secure channel Impossible in the classical setting How would quantum change classical crypto?

Secure Multi-Party Computation over the Internet o Allow mutually distrustful parties to carry out a crypto task over the Internet o E.g., coin-tossing, jointly evaluating a function, playing online poker, commitment, oblivious transfer,…. o Security model: Universal Composition (UC) framework [Canetti01, Unruh10] Computational vs Information Theoretical o A notable distinction: [BBCS91] Using quantum, Oblivious Transfer(OT) can be implemented from Commitment (COM) Universally Composable, Statistical Security [DFLSS09,Unruh10] Impossible in the classical setting How would quantum change classical crypto? Question: are there more distinctions that quantum brings about?

Secure Multi-Party Computation over the Internet o OT is complete [Kilian88] in the sense that it can be used to implement other crypto tasks. o Analogous to Computational Complexity, crypto tasks have different strength: Complete vs Feasible o The classical landscape is well studied [MPR10,MPR09,KMQ11] How would quantum change classical crypto? Feasible Complete P NP Complete Question: How would the landscape differ in the quantum setting?

Our Contribution Identify another distinction: OT from Cut-and- Choose (CC) Application: systematical characterization of a set of tasks in quantum UC Feasible Complete Computational Setting Information Theoretical Setting Feasible Complete

Derive the quantum landscape

How useful is F as a trusted setup? assuming basic secure communication is given Feasible Intermediate Complete in the classical setting Possible “levels of power” for F Feasible/Useless/Trivial : access to F is equivalent to no trusted setup (e.g., secure channel) Intermediate: some level of power between the two extremes Complete : all tasks have UC-secure protocols in presence of F (e.g., OT)

How useful is F as a trusted setup? Adversaries with quantum power o Some feasible F becomes infeasible o Some complete F becomes not complete Feasible Intermediate Complete Feasible Intermediate Complete in the quantum setting Honest Players with quantum power o Some infeasible (including complete) F becomes feasible o Some incomplete (including feasible) F becomes complete

2-party, finite, deterministic tasks We next show how to draw the `cryptographic complexity’ landscape in the quantum setting o for an interesting class of tasks: 2-party finite deterministic task including OT, COM, CC,…. SFE f Input(x 1 ) Input(x 2 ) Output(f 2 (x 1,x 2 ) ) Output(f 1 (x 1,x 2 ) ) Reactiv e 2PC Reactiv e 2PC Input(x’ 1 ) Input(x’ 2 ) Output(y’ 2 ) Output(y’ 1 ) Input(x 1 ) Input(x 2 ) Output(y 2 ) Output(y 1 ) Input(x’’ 1 ) Input(x’’ 2 ) Output(y’’ 2 ) Output(y’’ 1 ) input/output domains are in poly-size

How useful is F as a trusted setup? in the classical setting Feasible COM CC XOR OT Information Theoretical Setting [MPR09, KMQ11/08] Feasible COM OT CC XOR Computational Setting [MPR10]

Feasible COM OT CC XOR What about quantum setting? Quantum landscape [This work] Feasible COM OT CC XOR Classical landscape [MPR10] [Unruh10, IPS08] [HSS11, CLOS02] + suitable computational assumption Computational Setting Rewinding used in the security proof

Feasible COM OT CC XOR What about quantum setting? Quantum landscape [This work] Feasible COM OT CC XOR Classical landscape [MPR10] [Unruh10, IPS08] [HSS11, CLOS02] + suitable computational assumption Computational Setting This work Rewinding used in the security proof

Feasible COM OT CC XOR What about quantum setting? Quantum landscape [This work] Feasible COM OT CC XOR Classical landscape [MPR10] [Unruh10, IPS08] [HSS11, CLOS02] + suitable computational assumption Computational Setting This work Rewinding used in the security proof Warning: it might be the case that all tasks in the set is feasible.

Feasible COM CC XOR OT Feasible COM CC XOR OT Classical landscape [MPR09, KMQ11/08] What about quantum setting? Quantum landscape [This work] [Unruh10, IPS08] [Unruh10,BBCS91] Information Theoretical Setting This work

Feasible COM OT CC XOR What about quantum setting? Computational Setting Feasible COM CC XOR OT Information Theoretical Setting

Design OT from CC

Main Result: CC  OT OT Input(b 0, b 1 ) Input(s) Output(b s ) Output( ) CC Input(x 1 ) Input(x 2 ) Output(x 1 ) Output(x 1  x 2 ) Theorem: There is a quantum protocol UC securely realizing OT in the CC-hybrid world against all statistical quantum adversaries. COM Commit( ) Commit(x) Open( )Open(x)

OT from COM [BBCS91] I 0, I 1 COM i C All i in [ n ] All i in C b 0, b 1 s bsbs

OT from CC I 0, I 1 All i in [ n ] b 0, b 1 s bsbs CC i Abort if

Security Definition Universal Composition (UC) framework [Canetti01] (cf. DM00, PW01,…) Z Z π π π π A A Protocol π UC securely realize task F if: for every real world A there is an ideal world S two worlds are indistinguishable to all environment Z Real world F F Z Z Ideal world ≈ S S

Quantum UC Quantum UC [Unruh10] (cf. Unruh04,BOM04, HSS11) Protocol π UC securely realize task F if: for every real world A there is an ideal world S two worlds are indistinguishable to all environment Z QUC We only consider classical F F F Z Z Ideal world Z Z π π π π A A Real world ≈ S S

OT from CC I 0, I 1 All i in [ n ] b 0, b 1 s bsbs CC i Abort if Design simulator: Extracting (b 0,b 1 ) when Alice is corrupted Extracting s when Bob is corrupted Statistically close communication transcript

OT from CC I 0, I 1 All i in [ n ] b 0, b 1 s bsbs CC i Abort if

OT Z Z Ideal world I 0, I 1 All i in [ n ] bsbs CCiCCi CCiCCi Abort if (b0,b1)(b0,b1) s bsbs S

OT from CC I 0, I 1 All i in [ n ] b 0, b 1 s bsbs CC i Abort if

OT Z Z Ideal world (b0,b1)(b0,b1) s bsbs I 0, I 1 CCiCCi CCiCCi All i in [ n ] S

Summary and Open questions Feasible COM OT CC XOR Computational Setting Feasible COM CC XOR OT Information Theoretical Setting Main Result: CC  OT Open questions:  Much larger set: randomized tasks, infinite tasks, multi-party….  Quantum tasks