1. Collapse-binding quantum commitments without random oracles
Dominique Unruh
University of Tartu

2. Example: a commitment scheme
Consider a horse race
“Spicy Spirit” wins…
Player
Bookie
𝐻("𝑠𝑝𝑖𝑐𝑦 𝑠𝑝𝑖𝑟𝑖𝑡", )
Player
Bookie
231632
$$$
Commitments and hashes

3. Surprises with hash functions
Consider a cheating player
“Wallopping Waldo” wins…
Player
Bookie
Some fake ℎ
𝐻("𝑠𝑝𝑖𝑐𝑦 𝑠𝑝𝑖𝑟𝑖𝑡", )
Player
Bookie
𝑟 with 𝐻 𝑤𝑎𝑙𝑙𝑜𝑝,𝑟 =ℎ
$$$
Commitments and hashes

4. Surprises with hash functions (II)
Player
Bookie
Classical crypto: 𝐻 is collision-resistant (infeasible to find 𝑥, 𝑥 ′ with 𝐻 𝑥 =𝐻( 𝑥 ′ )) Consequence: Can open ℎ to one horse only. Surprise: Does not hold for quantum adv (𝐻 might be coll.-res., and attack still works) [Unruh, Eurocrypt 16]
Commitments and hashes

5. Surprises with hash functions (III)
Player
Bookie
Some fake ℎ
𝑟 with 𝐻 𝑤𝑎𝑙𝑙𝑜𝑝,𝑟 =ℎ
|Ψ〉
|Ψ〉 used up!
Commitments and hashes

6. Solution: Quantum binding-definitions [Unruh 16]
Forbids “Waldo-attack”
Composes in parallel
“Rewinding-friendly”
Definition: Collapse-binding commitment
Do collapsing hash functions exist in the standard model?
Simple
constructions
Strengthening of collision-resistance
Exist in random oracle model
Definition: Collapsing hash
Commitments and hashes

7. Collapsing hash functions
Strengthening of “collision-resistance” for quantum setting Adv. A messages 𝑚 (in superposition) Def: Collapsing = A cannot distinguish A
|𝑚〉 A
|𝑚〉 or
Measure 𝑯(𝒎)
Measure 𝒎
Commitments and hashes

8. Collapsing hash funs – constructions?
Lossy function (LF):
Indistinguishable whether injective, or highly non-injective (“lossy”)
message
… long …
hash LF
universal hash func
looks injective
⇒ is collapsing
injective on im(𝐿𝐹)
Commitments and hashes

9. Commitments and hashes
Hashing long messages?
Prior construction: Fixed compression factor (e.g., 2)
For long messages: Merkle-Damgård
Conclusion: measure hash ≈ measure input
𝑖𝑛𝑖𝑡
𝑣𝑒𝑐
measure 𝐻
measure 𝐻
measure 𝐻
measure 𝐻
ℎ𝑎𝑠ℎ
measure
𝑚𝑠𝑔 1
𝑚𝑠𝑔 2
𝑚𝑠𝑔 3
𝑝𝑎𝑑𝑑𝑖𝑛𝑔
measure
measure
measure
measure
Commitments and hashes

10. Commitments and hashes
One more result
Collapse-binding implies “sum-binding”
Shows relationship to existing defs
Can be used to show that collapse-binding bit commitments give secure coin-tosses
Commitments and hashes

11. Commitments and hashes
Summary
Classical definitions for commitments & hashes: insufficient! New definitions: collapse-binding / collapsing Constructions from lossy functions / lattice-assumptions Question: Collapsing hashes from OWF / coll.-resistance?
Commitments and hashes

12. I thank for your attention
This research was supported by European Social Fund’s Doctoral Studies and Internationalisation Programme DoRa

13. New definitions needed
Classical def of computationally binding:
“Walloping Waldo” attack still possible!
Collision-resistance
Weaker than expected
Stronger def? (NIST post-quantum competition?)
Our proposal: “Collapse-binding” commitments
Our proposal: “Collapsing” hash functions
Commitments and hashes

14. Collapse-binding commitments
Adv. A outputs commitment 𝑐 (classically), and valid openings 𝑚,𝑢 (in superposition) Def: Collapse-binding = A cannot distinguish
|𝑚〉 A
|𝑚〉
|𝑢〉 𝑐
measure A A or
|𝑢〉 𝑐
Commitments and hashes

15. Commitments and hashes
Why this def?
Intuition:
Adversary cannot produce several openings in superposition
If he could, he’d notice measurement
Formally:
Weaker than “non-existence of two openings” (perfect)
Stronger than “hard to find two openings” (class.-style)
kind of… A
|𝑚〉
|𝑢〉 𝑐 or
measure
Commitments and hashes