Keywords: Cryptographie quantique, Modèles de sécurité, Chiffrement, Preuves à divulgation nulle de connaissance, Cryptographie non clonable Quantum Cryptography, Security Models, Encryption, Zero-Knowledge Proofs, Unclonable Cryptography Constructions and Applications [ACEM+22] . . . . . . . . . . . . . . .

La cryptographie moderne a un ennemi de taille à l'horizon : la montée inévitable des ordinateurs quantiques. Cependant, cette même puissance de calcul permettrait également de trouver des solutions sur des tâches cryptographiques qui sont tout simplement impossibles à réaliser avec la technologie actuelle. Dans cette thèse, nous mettons les pieds dans un univers où le quantique est omniprésent en y présentant notamment deux principales contributions.

Nous mettons en avant à la fois des nouveaux modèles et de nouvelles analyses de sécurité pour deux primitives cryptographiques : les chiffrements et les preuves à divulgation nulle de connaissance non interactives. Les définitions usuelles de sécurité de ces primitives requièrent intrinsèquement la capacité d'enregistrer et de comparer des chaînes classiques. Cependant, les tâches d'enregistrement et de comparaison sont extrêmement difficiles dans le monde quantique en raison du principe d'incertitude. Nous proposons deux alternatives afin de surmonter cette barrière. De plus, nos notions de sécurité sont les premières à prendre pleinement en compte les attaques quantiques dans lesquelles les attaquants peuvent interagir avec les utilisateurs finaux sur des canaux quantiques.

D'autre part, nous montrons que la disponibilité des ordinateurs quantiques se révèle être également à l'avantage des cryptographes, même lorsque les utilisateurs finaux n'utilisent que des communications classiques. En particulier, nous présentons un protocole interactif entre une Alice classique et un Bob quantique. Ce dispositif permet à Alice d'envoyer un état quantique caché non clonable à Bob par des canaux classiques. En outre, cet état quantique non clonable établit une forte propriété dite de monogamie de l'intrication, qui décrit les limites de la force des corrélations multipartites quantiques. Enfin, nous appliquons notre protocole et nous donnons les premiers schémas semi-quantiques de protection contre la copie.

Cryptography, the science dedicated to studying the protection of information, has become prevalent within a few decades. Protection has multiple meanings, in which the most basic protection mechanism is achieved by means of encryption. Encryption schemes are further divided into two categories: symmetric encryption and public-key encryption. The latter concept was originally put forth by Diffie and Hellman [START_REF] Diffie | New Directions in Cryptography[END_REF], and since then, has become ubiquitous. In practice, for example, with the Transport Layer Security (TLS) protocol, which has widespread use on the Internet, hybrid approaches are used, with public-key cryptography establishing a shared secret key to be used to encrypt the messages with a symmetric encryption. Beyond these basic notions, many other advanced cryptographic primitives have also been proposed to address more complex requirements of protection. Unfortunately, the security of all currently widely-used cryptosystems is threatened by the potential advent of full-scaled quantum computers.

History of Quantum Computing

The field of quantum computing originated in the 1980s as a subfield of quantum physics. Some physicists and mathematicians, including notably Richard Feynman [START_REF] Richard P Feynman | Simulating physics with computers[END_REF] and Yuri Manin [START_REF] Manin | Computable and Uncomputable[END_REF], had remarked that the task of simulating quantum mechanical systems would pose a challenge to classical computers, and proposed the idea of quantum models of computation. In 1985, David Deutsch formalized this idea under the notion of universal quantum Turing machine [START_REF] Deutsch | Quantum theory, the Church-Turing principle and the universal quantum computer[END_REF], and raised the question whether quantum computers might have a strict advantage over classical computers at solving problems. A few early quantum algorithms were developed: for example, Deutsch-Jozsa's [START_REF] Deutsch | Rapid solution of problems by quantum computation[END_REF], and the theory of quantum complexity appeared [START_REF] Bernstein | Quantum complexity theory[END_REF]. Soon after, David Simon showed that a quantum computer could achieve an exponential speedup in solving an idealized version of the problem of finding the period of function [START_REF] Daniel | On the Power of Quantum Computation[END_REF]. Though Simon's problem had no obvious applications, it inspired Peter Shor [START_REF] Peter | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] who formulated an efficient quantum algorithm for computing discrete logarithms and factoring large numbers. This breakthrough did not only challenge the strong Church-Turing thesis, but also the widely-used cryptosystems based on these (classically) difficult problems.

Cryptography Meets Quantum Computers

On the one hand, Shor's discovery, and its obvious implications for cryptanalysis, caused interest in quantum computing to skyrocket. (Post-)Quantum security of classical cryptosystems was born with the prospect of finding the strengths and weaknesses of this new attacker, thereby finding new secure designs for an era of quantum computers.

On the other hand, quantum information can arguably be used as an advantage for designing cryptosystems. If we go back a bit further, the relationship between quantum information and cryptography is almost half-a-century old: in a remarkable 1968 manuscript that first pioneered the idea of conjugate coding [START_REF] Wiesner | Conjugate coding[END_REF], Stephen Wiesner also proposed a scheme for quantum money, a cryptographic primitive that would be unimaginable without quantum mechanics. Indeed, this paper is "arguably the foundational document of the entire field of quantum information science". 1 Wiesner's ideas have led to the first scheme for quantum key distribution [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF] -what we now call BB84, and created a new branch of cryptography: quantum cryptography (also called unclonable cryptography). These bewildering possibilities in the quantum world are only possible thanks to one simple but deep difference between classical and quantum information, that is, classical information can in principle always be copied and quantum information cannot. This principle is called the quantum no-cloning theorem [WZ82], formulated as:

There is no procedure |ψ⟩ → |ψ⟩ ⊗ |ψ⟩, for an arbitrary quantum state |ψ⟩.

In short, while quantum information opens up the cryptographic landscape to allow functionalities that do not exist classically, the availability of quantum computing to cryptography also hands us unique challenges and limitations, some of them are seemingly trivial in the classical setting. 2 In a few decades, quantum information and quantum computation have both become: (i) a bogeyman of classical cryptography; and (ii) a friend of quantum cryptography. These two directions of studying quantum security and quantum cryptography are therefore the main motivation of our work. 3

Quantum Security of Classical Cryptosystems

As a starting point, let us exemplify classical security notions for encryption. The security of encryption schemes is defined formally as a game between an adversary that tries to win, that is, to trigger a particular event, or learn some particular information (for instance, the adversary wins if it can recover the encrypted message only knowing the public information), and a challenger that interacts with the adversary. The game specifies which messages are sent by the challenger depending on the adversary's behavior, and the winning condition for the adversary. The security game is defined in such a way that the adversary's capabilities encompass all possible attacks that could reasonably occur in a real-life scenario.

Defining security is a challenging task that has prompted fundamental research papers, such as [START_REF] Goldwasser | Probabilistic Encryption[END_REF], which defined the notions of semantic security and indistinguishabilitybased security for encryption. Before the age of quantum computers, many fundamental results were proven secure in a model where attackers are limited to efficient classical computation. In the age of quantum computers, the security model changes dramatically: the adversary can always perform local quantum computations, but the way it accesses the data plays an important role, leading to the following scenarios:

• Post-Quantum Security. This security level is against an adversary who wants to attack a classical cryptosystem by using a quantum computer they have in their basement, that is, the adversary can perform offline quantum computations, but it can only access the private oracles (e.g., decryption, authentication) through classical queries. For instance, in the security game for encryption, it means that the communication between the adversary and the challenger is completely classical.

The prototypical example is simply downloading a public key for RSA off the Internet and then running Shor's algorithm on it to recover the secret key. Another example is the security of schemes requiring the use of public hash functions, which is usually captured in the quantum random oracle model [START_REF] Boneh | Random Oracles in a Quantum World[END_REF].

This attack setting is certainly the most meaningful. It will be applicable to all classical cryptosystems once a scalable quantum architecture is built, but it also concerns today's encrypted traffic, if an attacker can record it and wait patiently for a quantum computer to appear.

• Quantum Security. This second category is very different from the first. In this setting, the adversary is significantly stronger: besides having a quantum computer in their basement, they also have the ability to interface quantumly with portions of the cryptosystem that involve our private key. For instance, in the security game for encryption, the adversary can ask for encryption of messages, or decryption of ciphertexts of its choice in superposition. This corresponds to the quantum query model in the literature on provable quantum security, for instance in [Zha12a; BZ13a; BZ13b; DFNS14; KLLN16a].

Unlike the case of public hash functions, there is no clear generic mechanism for how an adversary could gain this kind of access. While it is not yet clear whether there are settings in which this model is directly, practically relevant, there is arguably no question about the desirability of quantum security for several reasons:

-Theoretical interest. The quantum security of cryptographic primitives (beyond random oracles) is an active area of research with many exciting results, such as quantum secure pseudorandom functions [START_REF] Zhandry | How to Construct Quantum Random Functions[END_REF], digital signatures [BZ13a; BZ13b; AMRS20], encryption schemes [BZ13b; GHS16], zero-knowledge proofs [START_REF] Bitansky | Post-quantum Resettably-Sound Zero Knowledge[END_REF]. These primitives have also led to unexpected applications, such as pseudorandom quantum states [JLS18; AQY22; MY22].

-Composability. This security model ensures that classical cryptosystems retain their security even if executed on a quantum computer, possibly in complex environments or protocols where composition should be taken into account.

-Security proof concerns. Security reductions might require more that just postquantum security of underlying primitives. An example is the need of quantumsecure pseudorandom functions in order to simulate a quantum random oracle. Another example is the case of code obfuscation (see [START_REF] Sahai | How to use indistinguishability obfuscation: deniable encryption, and more[END_REF]), in which the obfuscated program will be run on the adversary's quantum computers. For example if the adversary is given a public encryption key which is generated by hardcoding a symmetric key into an obfuscated encryption program, in which the adversary has access to a full description of the oracle with a secret key and can implement a quantum embedding of it.

-Device-independent security. This model ensures security in a world where even end-users are using quantum devices, and hence can potentially interact with the adversary using quantum communication. Even if the end-users are not running full-fledged quantum computers, their devices may exhibit some quantum effects. For example, modern processors have reached the point where quantum tunneling is an important consideration [START_REF] Zhandry | Cryptography in the Age of Quantum Computers[END_REF]. Other settings include the case where a quantum computer is used to run a classical algorithm, but an adversary manages to have control over the measurement devices of the victim. In this setting, classicalization is burden on hardware designers, and it mounts to a hardware assumption, which, from the security point of view, is undesirable.

-Security in the worst-case. In this model, we achieve security in the worstcase scenario where the adversary is controlling the hardware. So it can be thought of as a more conservative security notion, since proving security of a construction with respect to a stronger security notion will give more confidence in using it.

Thus, an important goal towards understanding whether cryptographic protocols will resist quantum attacks is Question 1: Upgrade security models for classical cryptosystems to handle quantum attackers.

Terminology. These two security models are also referred to as the Q1 (for postquantum security), and Q2 (for quantum security) models in literature ([KLLN16a; KLLN16b; HS18a; HS18b]).

Unclonable Cryptography

On the other hand, properties of quantum mechanics have enabled the emergence of quantum cryptographic protocols achieving important goals which are proven to be impossible classically, with credits given to the no-cloning principle. Looking beyond the notion of quantum money [START_REF] Wiesner | Conjugate coding[END_REF], quantum encoding can further achieve richer levels of applicability, which defines a hierarchy of "unclonable" objects corresponding to different variants of the no-cloning principle [AGKZ20; BJLP+21]. Wiesner's quantum money [START_REF] Wiesner | Conjugate coding[END_REF] is a direct application of the no-cloning principle in cryptography, where the adversary obtains truly unknown quantum states. Public-key quantum money [START_REF] Aaronson | Quantum money from hidden subspaces[END_REF] can be seen as a strengthening, where no-cloning still holds even for parties that have the ability to verify the state. Quantum lightning [START_REF] Zhandry | Quantum Lightning Never Strikes the Same State Twice[END_REF] is then a further strengthening, where no-cloning holds even for parties that devised the original state themselves. Tamper-evident encryption [START_REF] Gottesman | Uncloneable Encryption[END_REF], unclonable encryption [START_REF] Broadbent | Uncloneable Quantum Encryption via Oracles[END_REF] and certified deletion [BI20; HMNY21; HMNY22] apply no-cloning to information, meaning that there is some underlying data that can be decoded, but there are limitations on the possibility of copying this data while it is encoded. And yet another extremely strong variant of the no-cloning principle is where the unclonable state has been endowed with some functionality. The functionality level of this hierarchy was first discussed in terms of quantum copy-protection by Aaronson [START_REF] Aaronson | Quantum copy-protection and quantum money[END_REF]: here, a quantum encoding allows the evaluation of a function on a chosen input, but in a way that the number of simultaneous evaluations is limited. A related concept to quantum copy-protection is the notion of secure software leasing [AL21; BJLP+21; KNY21]: where the unclonable state allows evaluation of a circuit, while also enabling the originator to verify that the software is returned. There are several other application-specific notions, also at the functionality level of the hierarchy, including: single-decryptor encryption [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF], which can be seen as quantum copy-protection of the decryption algorithm, and tokenized digital signatures [BS17; AGKZ20], which is a quantum one-time program [START_REF] Broadbent | Quantum One-Time Programs -(Extended Abstract)[END_REF] for digital signatures.

By standard definition, these quantum primitives can be seen as a two-party protocol requiring quantum communication to transfer the quantumly encoded program between parties, and of course, local quantum computation from both parties. Ideally, for both theoretical and practical reasons, we might want to minimize the required model and use local quantum computation and only classical communication. With only classical communication, however, these notions become unusable. This then leads to the following natural question Question 2: Achieve quantum unclonable functionalities with classical communication.

Terminology. In this thesis, we will use the term quantum protocols to mean cryptographic protocols requiring quantum computation and quantum communication, and semi-quantum protocols to mean cryptographic protocols requiring quantum computation and classical communication. a a This is called hybrid quantum cryptography in [START_REF] Amos | One-shot signatures and applications to hybrid quantum/classical authentication[END_REF].

Contributions of the Thesis

Part I Quantum Security. There has been towards this goal extensive research works that consider this scenario of quantum superposition attacks for different classical cryptographic constructions such as random oracles [START_REF] Boneh | Random Oracles in a Quantum World[END_REF], pseudorandom functions [START_REF] Zhandry | How to Construct Quantum Random Functions[END_REF], encryption [BZ13b; GHS16] and signatures [BZ13a; AMRS20] and give corresponding new security definitions. With this wide program, in this thesis, we focus, in particular, on two basic cryptographic primitives: encryption and non-interactive zero-knowledge.

On Security Notions for Encryption in a Quantum World [START_REF] Chevalier | On Security Notions for Encryption in a Quantum World[END_REF].

The results of this paper are presented in Chapter 3. Indistinguishability against adaptive chosen-ciphertext attacks (IND-CCA2) is usually considered the most desirable security notion for classical encryption. The security of quantum-secure classical encryption has first been studied by Boneh and Zhandry [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF], but they restricted the adversary to classical challenge queries, which makes the indistinguishability only hold for classical messages (denoted as IND-qCCA2). We extend their work by giving the first security notions for fully quantum indistinguishability under quantum adaptive chosen-ciphertext attacks, where the indistinguishability holds for superposition of plaintexts (denoted as qIND-qCCA2). We then show that our notions are strictly stronger than previous notions with classical challenge queries, and achieve composability as the classical definitions. We also provide constructions satisfying these security notions. For the symmetric-key setting, our construction follows the classical Encrypt-then-MAC paradigm, in which we use a pseudorandom function in the role of the MAC scheme. For the public-key setting, we propose a compiler that unconditionally lifts any secure encryption scheme in the sense of [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF] to an encryption scheme secure in the sense of our notions. In fact, our feasibility results show that quantum security can be achieved for free, without any new assumptions rather than ones needed for post-quantum security. Finally, we show that in the quantum setting, one-bit encryption schemes are necessary and sufficient to build many-bit encryption schemes, similar to the classical setting [START_REF] Myers | Bit Encryption Is Complete[END_REF].

This paper has been presented at QCrypt in 2020, and published in the proceedings of the conference INDOCRYPT in 2022.

Part II Quantum Cryptography. Quantum cryptography is known for enabling functionalities that are unattainable using classical information alone. Perhaps the most striking example of quantum primitives is the notion of quantum copy-protection, introduced by Aaronson [START_REF] Aaronson | Quantum copy-protection and quantum money[END_REF]. Informally, quantum copy-protection allows for a program to be encoded in a quantum state in such a way that the program can be evaluated, but not copied. Unfortunately, this usually comes at the cost of needing quantum power from every party in the protocol, while arguably a more realistic scenario would be a network of classical clients, classically interacting with a quantum server. An emerging field of "dequantizing" quantum cryptographic protocols has shown that it is possible to use local quantum computation and classical communication to obtain cryptographic constructions which are otherwise classically impossible [BCMV+18; Mah18b; AGKZ20; RS20; HMNY21; KNY21; GMP22; Shm22a; Shm22b]. We continue this research direction in the second part of the thesis.

Semi-Quantum Copy-Protection and More [START_REF] Chevalier | Semi-Quantum Copy-Protection and More[END_REF].

The results of this paper are presented in Chapter 5. In this paper, we focus on copy-protection, which is a quantum primitive that allows a program to be evaluated, but not copied, and has shown interest especially due to its links to other unclonable cryptographic primitives. Our main contribution is to show how to dequantize existing quantum copy-protection from hidden coset states: we give a construction for classically-instructed remote state preparation for coset states, based on the existence of indistinguishability obfuscation for classical circuits and the Learning With Errors [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] problem. Our protocol is a multi-round protocol between classical Alice and quantum polynomial-time Bob that allows Alice to delegate the construction of hidden coset states to Bob. Furthermore, Alice knows the description of the constructed coset states (which reside on Bob's device), while Bob himself does not, and no-cloning also applies to these states. Hence, the situation at the end of this protocol is equivalent to one where Alice sent hidden coset states to Bob, allowing us to dequantize existing quantum copy-protection from coset states in a generic and modular way. To broaden the applicability of our semi-quantum protocol, we also present in this work a copy-protection for point functions in the plain model, to which our dequantizer could be applied.

In fact, our copy-protection scheme is almost identical to that for pseudorandom functions given in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF]. We observe that by making few modifications to their proof, we obtain a copy-protection scheme for point functions with a non-trivial challenge distribution in the security definition. We note that before this paper, no copy-protection scheme for point functions in the plain model with negligible security was known.

Other contributions. The recent NIST call for post-quantum encryption and signature schemes has revived the interest for designing post-quantum advanced cryptographic protocols such as oblivious transfer and non-interactive zero-knowledge proof systems. We give below a brief description of our contributions in this direction, which are not included in this manuscript.

Post-Quantum UC-Secure Oblivious Transfer in the Standard Model with Adaptive Corruptions [START_REF] Blazy | Post-quantum UC-secure oblivious transfer in the standard model with adaptive corruptions[END_REF].

We describe in this paper an oblivious transfer (OT) scheme which is post-quantum, universal-composability-secure, and deals with adaptive corruptions assuming reliable erasures. Since the seminal result of Kilian [START_REF] Kilian | Founding Cryptography on Oblivious Transfer[END_REF], oblivious transfer has proven to be a fundamental primitive in cryptography. In such a scheme, a user is able to gain access to an element owned by a server, without learning more than this single element, and without the server learning which element the user has accessed. This primitive has received a lot of study in the literature, among which very few schemes are based on lattices. To the best of our knowledge, this is the first post-quantum OT scheme with such a high level of security. Our methodology relies on the generic construction of [START_REF] Blazy | Generic Construction of UC-Secure Oblivious Transfer[END_REF]. In order to instantiate the necessary building blocks, we replace the use of the smooth projective hash functions (SPHFs) construction of [START_REF] Katz | Smooth Projective Hashing and Password-Based Authenticated Key Exchange from Lattices[END_REF] by a chameleon hash function, an IND-CCA2 encryption scheme and an SPHF construction from [START_REF] Benhamouda | Hash Proof Systems over Lattices Revisited[END_REF]. This allows us to give an SPHFfriendly commitment scheme based on the Learning with Errors problem [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF], which can be seen as a side contribution of the paper. Furthermore, we propose concrete parameters and an implementation of our scheme.

This paper has been published in the proceedings of the conference ARES in 2019.

zkSNARKs from Codes with Rank Metrics [START_REF] Do | zkSNARKs from Codes with Rank Metrics[END_REF].

Zero-knowledge succinct arguments of knowledge (zkSNARKs) are non-interactive proof systems enabling efficient privacy-preserving proofs of membership for NP languages. A large body of work has studied candidate constructions that are secure against quantum attackers, which are based on either lattice assumptions, or post-quantum collision-resistant hash functions. In this paper, we propose a code-based zkSNARK scheme, whose security is based on the Rank Support Learning (RSL) problem, a variant of the random linear code decoding problem in the rank metric. Our construction follows the general framework of Gennaro et al. [START_REF] Gennaro | Lattice-Based zk-SNARKs from Square Span Programs[END_REF], which is based on Square Span Programs (SSPs). Due to the fundamental differences between the hardness assumptions, our proof of security cannot apply the techniques from the lattice-based constructions, and indeed, it distinguishes itself by the use of techniques from coding theory. We also provide the scheme with a set of concrete parameters.

Road-map. The rest of this thesis is organized as follows. In Chapter 2, we introduce the notation, the relevant background on quantum information and computation, as well as notions of cryptographic primitives that will be used throughout this thesis.

In Chapter 3, we present our definitions of quantum indistinguishability for encryption. Then, in Chapter 4, we present our notions of quantum simulation-sound non-interactive zero-knowledge. Finally, in Chapter 5, we exhibit our work on copy-protection. We also give in the appendices several additional results about tokenized digital signatures (Appendix A) and password-based key exchange protocols (Appendix B) which have been done during the preparation of this thesis.

notion of the relative Hamming weight of q, defined as ω(q) := wt(q)/n. By convention, the relative Hamming weight of the empty string ⊥ is set to ω(⊥) := 0. For a set I = {i 1 , . . . , i ℓ } ⊆ 1, n and a n-bit string x ∈ Ω n , we write x| I := x i 1 • • • x i ℓ , and I as the complement I := 1, n \ I of I.

When sampling uniformly at random a value a from a set U, we employ the notation a $ ← U. When sampling a value a from a probabilistic algorithm A, we employ the notation a ← A. Let |•| denote either the length of a string, or the cardinal of a finite set, or the absolute value. By PPT we mean a polynomial-time non-uniform family of probabilistic circuits, and by QPT we mean a polynomial-time family of quantum circuits. For a probabilistic algorithm f , we write f (x; r) to denote the computation of f on input x with randomness r drawn uniformly at random. We sometimes omit the randomness and just write f (x). Finally, let δ x,x ′ denote the Kronecker delta function of x and x ′ .

Sub-exponential Security. A system is sub-exponentially secure if there is an adversary of (quantum) polynomial size that breaks the system with sub-exponentially small probability. Typically, this probability is upper bounded by 2 -λ ε , for some constant 0 < ε < 1.

Quantum Information and Computation

We use H to denote an arbitrary finite-dimensional Hilbert space, and use indices to differentiate between distinct spaces. We let |ϕ⟩ denote an arbitrary pure quantum state, and |x⟩ denote an element in the standard (computational) basis. A mixed state will be denoted by lowercase Greek letters, e. A pure state |ϕ⟩ can be manipulated by performing a unitary transformation U to the state |ϕ⟩, which we denote U |ϕ⟩. The identity on a n-bit quantum system is denoted I n . Given two quantum systems A, B, with corresponding Hilbert spaces H A , H B , let |ϕ⟩ := |ϕ 0 , ϕ 1 ⟩ be a state of the joint system. We write U A |ϕ⟩ to denote that we act with U on register A, and with identity I on register B, and we write U AB to denote that we act with U on both registers A, B simultaneously, that is

U AB = U A ⊗ U B .
An observable on H is a Hermitian linear operator on H. A binary observable is an observable that only has eigenvalues in {-1, 1}. For a binary observable O and b ∈ {0, 1}, we denote by O (b) the projector onto the (-1) b -eigenspace of O. For any procedure which takes a quantum state as input and produces a bit (or more generally an integer) as output, e.g., by measuring the input state, we denote the probability distribution over outputs b on input state ψ by Pr [ b | ψ ].

Quantum Computation

Quantum gates. We refer to the following well-known unitary gates:

• Pauli gates: X : |a⟩ → |1 -a⟩, Z : |a⟩ → (-1) a |a⟩ and Y := iXZ, for each a ∈ {0, 1}.

• Hadamard gate:

H : |a⟩ → 1 √ 2 |0⟩ + (-1) a √ 2 |1⟩
, for each a ∈ {0, 1}.

• Rotation gates: R ϕ : |a⟩ → e iaϕ |a⟩, for each a ∈ {0, 1}. We obtain the T gate where ϕ = π 4 , the phase gate P where ϕ = π 2 . • Controlled gates: for any k-qubit unitary quantum gate U, we define the controlled-U as: Ctrl-U : |a⟩ |x⟩ → |a⟩ U a |x⟩, for each a ∈ {0, 1} and x ∈ {0, 1} k . In particular, we write the controlled-NOT gate as CNOT : |a⟩ |b⟩ → |a⟩ |b ⊕ a⟩.

• Toffoli gates: CCNOT : |a, b, c⟩ → |a, b, c ⊕ (a • b)⟩ for each (a, b, c) ∈ {0, 1} 3 .

Quantum Fourier transform. Let Q be a n-bit quantum system over Z q for some integer q.

The Quantum Fourier transform QFT performs the following operation efficiently:

QFT |x⟩ := 1 √ q n y∈{0,1} n ω x•y q |y⟩ ,
where ω q := exp( 2πi q ), and x • y denotes the dot product. In this thesis, we usually consider q = 2, so that ω q = (-1).

Oracle access to an interactive quantum machine. We say that a quantum algorithm A has oracle access to an interactive quantum machine M (and we write this as A M if A can only make classical queries to M , or A |M ⟩ to emphasize that M is a quantum machine and that oracle access includes the ability to make queries in superposition and apply the inverse of M ) to mean the following. Besides the security parameter and its own classical input x, we allow A to execute the quantum circuit U specifying M , and its inverse (recall that these act on the internal register and on the network register of M ). Moreover, we allow A to provide and read messages from M (formally, we allow A to act freely on the network register). We do not allow A to act on the internal register of M , except via U or its inverse.

Given a function f : X → Y, we model a quantum-accessible oracle O for f as a unitary transformation O f as follows.

• The standard oracle model: O f acts on three registers X, Y, Z with the property that O f : |x, y, 0⟩ → |x, y ⊕ f (x), 0⟩, where ⊕ is some involutive group operation.

• The minimal oracle model: O f acts on two registers X, Y with the property that O f : |x, 0⟩ → |f (x), 0⟩. This model is implementable if and only if f is a bijective function.

Randomness. If an oracle O implements a classical randomized algorithm, there are several choices for how the randomness is used in each query if the oracle is queried in superposition. One option is to choose fresh randomness for each message in the superposition. Another option is to choose a single randomness value for each query, and generate output in the superposition with that randomness. We note that there is a simple transformation that converts an oracle requiring independent randomness for every message into a scheme that is secure when a single randomness value is used for an entire query: for each query, choose a fresh random key k for a quantum pseudorandom function (QPRF) (see Definition 2.7). This will be the single per-query randomness value. Each message m in the superposition will be answered using randomness obtained by applying the QPRF to m using the key k. From the adversary's point of view, this is indistinguishable from choosing independent randomness for each message. Indeed, Zhandry [START_REF] Zhandry | Secure Identity-Based Encryption in the Quantum Random Oracle Model[END_REF] shows that we can replace the QPRF with a function drawn from a pairwise independent function family, which allows us to achieve perfect simulability. For this reason, requiring global randomness per query does not change the oracle from the adversary's point of view, but greatly simplifies its implementation. In this work, we choose the second approach and all randomized oracles are implemented this way.

Efficiency in the Quantum Setting Definition 2.1 -Efficiency

Efficient unitaries: a family of unitaries {U λ ∈ U(H λ )} λ∈N is efficient if there exists a (classical) polynomial-time Turing machine M that, on input 1 λ , outputs a description of a circuit (with a fixed gate set) that implements the unitary.

Efficient isometries: a family of isometries {V λ : H A λ → H B λ } λ∈N is efficient if there exists an efficient family of unitaries

{U λ ∈ U(H B λ )} λ∈N such that V λ = U λ (I A λ ⊗ |0 k(λ) ⟩), where k(λ) = dim(H B λ ) -dim(H A λ ).
Efficient observables: a family of binary observables {Z λ : Herm(H A λ )} λ∈N is efficient if there exists a family of Hilbert spaces H B λ with dim(H B λ ) = poly(λ), and a family of efficient unitaries {U λ ∈ U(H A λ ⊗ H B λ )} λ∈N such that for any

|ψ⟩ A ∈ H A : U † (σ Z ⊗ I)U λ (|ψ⟩ A |0⟩ B ) = (Z λ |ψ⟩ A ) ⊗ |0⟩ B . (2.1)
Efficient measurements: a family of measurements {M λ = {M

(i) λ ∈ L(H A λ )} i∈A } λ∈N is efficient if the isometry |ψ⟩ → i∈A |i⟩ ⊗ M (i) λ |ψ⟩ (2.2)
is efficient.

Distance Measures

Definition 2.2 -Norms Let A ∈ L(H) with singular values λ 1 , . . . , λ n ≥ 0. Then, the trace norm is defined as

∥A∥ 1 := i λ i .

Definition 2.3 -Trace Distance

For two quantum states ρ, σ ∈ Pos(H), the trace distance between them is ∆ (ρ, σ) := 1 2 ∥ρ -σ∥ 1 .

Definition 2.4 -Approximate Equality, [MV21, Definition 2.8 and Definition 2.14] We overload the symbol "≈" in the following ways (leaving the dependence on the security parameter implicit in the quantities on the left):

Complex numbers: For a, b ∈ C we define:

a ≈ ε b ⇐⇒ |a -b| = O(ε) + negl(λ) .
Operators: For A, B ∈ L(H), we define:

A ≈ ε B ⇐⇒ ∥A -B∥ 2 1 = O(ε) + negl(λ) .
(We will most frequently use this for (possibly subnormalised) quantum states A, B ∈ Pos(H).)

Operators on a state: For A, B ∈ L(H) and ψ ∈ Pos(H), we define:

A ≈ ε,ψ B ⇐⇒ Tr (A -B) † (A -B)ψ = O(ε) + negl(λ) .
Computationally indistinguishable states: For two (families of not necessarily normalised) states ψ, ψ ′ ∈ Pos(H) which are computationally indistinguishable up to δ (i.e., no QPT distinguisher has advantage exceeding δ in distinguishing ψ from ψ ′a ), we write:

ψ c ≈ δ ψ ′ .
We can also define computational indistinguishability with respect to non-uniform QPT algorithms with quantum advice, denoted by A := {A λ , ϕ λ } λ∈N , where each A λ is the classical description of a poly(λ)size quantum circuit, and ϕ λ is some (not necessarily efficiently computable) non-uniform poly(λ)-qubit quantum advice. In this thesis, we implicitly consider computational indistinguishability with respect to non-uniform QPT adversaries with quantum advice, unless stated explicitly otherwise.

If we write ≈ 0 , we mean that the quantities are negligibly close. All asymptotic statements are understood to be in the limits ε → 0 and λ → ∞.

a A distinguisher D is a completely positive and trace-preserving map from the input state to a classical single-qubit state (i.e. a distribution over {0, 1}). The distinguishability is the trace distance between D(ψ) and D(ψ ′ ).

We include a copy of some technical lemmas on state-dependent operator relations using computational indistinguishability from [START_REF] Metger | Self-Testing of a Single Quantum Device Under Computational Assumptions[END_REF] below for the reader's convenience.

Properties of the State-Dependent Distance

A feature of the state-dependent distance is that if two operators are close in the statedependent distance, we can replace one operator by the other acting on either side of the state.

Lemma 2.1 (Replacement lemma [MV21, Lemma 2.21]). Let ψ ∈ Pos(H), and A, B, C ∈ L(H). If A ≈ ε,ψ B and ∥C∥ ∞ = O(1), then Tr[CAψ] ≈ ε 1/2 Tr[CBψ] ,
(2.3)

Tr[ACψ] ≈ ε 1/2
A ≈ ε,ψ B =⇒ A ψ C ≈ ε B ψ C and C ψ A † ≈ ε C ψ B † . (2.5)
The following lemma allows us to replace computationally indistinguishable states with one another in the state-dependent distance. This means that if two states are computationally indistinguishable and a state-dependent operator relation holds for one of the states, we can "lift" this relation to the other state, provided the operators are efficient.

Lemma 2.3 (Lifting lemma [MV21, Lemma 2.25]). Let H, H ′ Hilbert spaces with dim(H ′ ) ≥ dim(H). Let ψ, ψ ′ ∈ D(H ′ ) such that ψ c ≈ δ ψ ′ .
Let A be an efficient binary observable on H, B an efficient binary observable on H ′ , and V : H → H ′ an efficient isometry. Then:

V AV † ≈ ε, ψ B =⇒ V AV † ≈ ε 1/4 +δ,ψ ′ B . (2.6)
Finally, we recall some further miscellaneous properties of the state-dependent distance.

Lemma 2.4 ([MV21, Lemma 2.18]). Let ψ i ∈ Pos(H) for i ∈ {1, . . . , n} with constant n, and A, B ∈ L(H). Define ψ = i ψ i . Then:

∀i ∈ 1, n : A ≈ ε,ψ i B iff A ≈ ε,ψ B (2.7) Lemma 2.5 ([MV21, Lemma 2.24]). Let H 1 , H 2 be Hilbert spaces with dim(H 1 ) ≤ dim(H 2 )
and V : H 1 → H 2 an isometry. Let A and B be binary observables on H 1 and H 2 , respectively, ψ ∈ Pos(H 1 ), and ε ≥ 0. Then for any b ∈ {0, 1}:

V † BV ≈ ε,ψ A =⇒ V † B (b) V ≈ ε,ψ A (b) , (2.8) B ≈ ε,V ψV † V AV † =⇒ B (b) ≈ ε,V ψV † V A (b) V † .
(2.9) For more details on the description of the compressed random oracle, we refer the reader to [START_REF] Zhandry | How to Record Quantum Queries, and Applications to Quantum Indifferentiability[END_REF][START_REF] Don | Online-Extractability in the Quantum Random-Oracle Model[END_REF]. For the purposes of this thesis, we will only use the fact that the compressed random oracle CStO is a certain unitary matrix, indistinguishable from a real random oracle. We give here some technical lemmas that are used later.

We denote D = ⊗ x∈X D x be the compressed random oracle registers, which corresponds to its database (denoted as D). The state space of D x is generated with vectors |y⟩ for y ∈ Y ∪ {⊥}. The initial state of the register D is ⊗ x∈X |⊥⟩. For a fixed relation R ⊂ X × Y, Γ R is the maximum number of y's that fulfill the relation R where the maximum is taken over all x ∈ X :

Γ R = max x∈X |{y ∈ Y|(x, y) ∈ R}|.

We define a projector Π x

Dx that checks if the register D x contains a value y ̸ =⊥ such that (x, y) ∈ R:

Π x Dx := y:(x,y)∈R |y⟩⟨y| Dx . Let Πx Dx = I Dx -Π x Dx .
We define the measurement M to be the set of projectors {Σ x } x∈X∪{⊥} where

Σ x := x ′ <x Πx ′ D x ′ ⊗ Π x Dx for x ∈ X and Σ ⊥ := I - x Σ x .
(2.10)

Informally, the measurement M checks for the smallest x for which D x contains a value y ̸ =⊥ such that (x, y) ∈ R. If no register D x contains a value y ̸ =⊥ such that (x, y) ∈ R, the outcome of M is ⊥. We define a purified measurement M DP corresponding to M that XORs the outcome of the measurement to an ancillary register:

M DP |ϕ, z⟩ DP → x∈X∪{⊥} Σ x |ϕ⟩ D |z ⊕ x⟩ P .
The following lemma states that the compressed random oracle and M DP almost commute if Γ R is small proportional to the size of Y.

Lemma 2.6 ([DFMS22, Theorem 3.1]). For any relation R and Γ R defined above, the commutator [CStO, M DP ] is bounded as follows:

∥[CStO, M DP ]∥ ≤ 8 • 2 -n/2 2Γ R .
The following lemma says that the output of the adversary when making queries to a random oracle is identical to the one obtained by measuring the compressed database, except with negligible probability. Lemma 2.7 ([Zha19a, Lemma 5]). Let p be the probability that an adversary making queries to a random oracle H : {0, 1} m → {0, 1} n and outputting a tuple (⃗ a, ⃗ b, c) such that |⃗ a| = ⃗ b = k and H(a i ) = b i for each i ∈ k . Let R be a collection of such tuples. Now consider running the adversary with the compressed oracle, and we measure the database D after the adversary procedures its output. Let p ′ be the probability that there exists a tuple

(⃗ a ′ , ⃗ b ′ , c ′ ) ∈ R such that D(a ′ i ) = b ′ i for each i ∈ k . Then √ p ≤ √ p ′ + k/2 n .

Sampling in a Quantum Population

In this section, we describe a generic framework presented in [START_REF] Niek | Sampling in a Quantum Population, and Applications[END_REF] for analyzing cut-and-choose strategies applied to quantum states.

Classical Sampling Stratiegies

Let q := (q 1 , . . . , q n ) ∈ Ω n be a string of length n. We consider the problem of estimating the relative Hamming weight of a substring ω(q| t ) by only looking at the substring q| t of q, for a subset t ⊂ 1, n . We consider sampling strategies Ψ := (P T , P S , f ), where P T is an (independently sampled) distribution over subsets t ⊆ 1, n , P S is a distribution over seeds s ∈ S, and f :

{(t, v) : t ⊂ 1, n , v ∈ Ω t } × S →
R is a function that takes the subset t, the substring v, and a seed s, and outputs an estimate for the relative Hamming weight of the remaining string. For a fixed subset t, seed s, and a parameter δ, define

B δ t,s (Ψ) ⊆ Ω n as B δ t,s := {b ∈ Ω n : |ω(b| t ) -f (t, b| t , s)| < δ}.
Then we define the classical error probability of strategy Ψ as follows.

Definition 2.5 -Classical Error Probability

The classical error probability of a sampling strategy Ψ := (P T , P S , f ) is defined as the following value, parameterized by 0 < δ < 1:

ε δ classical (Ψ) := max q∈Ω n Pr t←P T ,s←P S q / ∈ B δ t,s (Ψ) .

Quantum Sampling Strategies

Now, let A := A 1 , . . . , A n be an n-partite quantum system where the state space of each system A i equals Definition 2.6 -Quantum Error Probability The quantum error probability of a sampling strategy Ψ := (P T , P S , f ) is defined as the following value, parameterized by 0 < δ < 1:

H A i = C d with d = |Ω|,
ε δ quantum (Ψ) := max H E max |ψ⟩ AE min ρ T SAE ∆ (ρ T SAE , ρ T SAE ) ,
where the first max is over all finite-dimensional registers E, the second max is over all state |ψ⟩ AE and the min is over all ideal state ρ T SAE of the form described above.

Finally, we relate the classical and quantum error probabilities.

Theorem 2.1 ([BF10]

). For any sampling strategy Ψ and δ > 0,

ε δ quantum (Ψ) ≤ ε δ classical (Ψ).
Remark 2.1. The results presented here immediately generalize from the all-zero reference state |0⟩ . . . |0⟩ to an arbitrary reference state |φ⟩ A of the form

|φ⟩ A = U 1 |0⟩ . . . U n |0⟩
for unitary operators U i acting on C d . Indeed, the generalization follows simply by a suitable change of basis, defined by the U i 's.

In this work, we will only need to analyze one simple sample-and-estimate strategy Ψ uniform := (P T , P S , f ), where P T is the uniform distribution over subsets t ⊆ 1, n , P S is empty and f (t, q| t ) = ω(q| t ). That is, f receives a uniformly random subset q| t of q, and outputs the relative Hamming weight of q| t as its guess for the relative Hamming weight of q| t . The classical error probability of this strategy can be bound using Hoeffding inequalities, which is done in [START_REF] Niek | Sampling in a Quantum Population, and Applications[END_REF]Appendix B.3], where it is shown to be bounded by 4 exp( -nδ 2 32 ) for parameter δ. Thus, we have the following corollary of Theorem 2.1. Corollary 2.1. The quantum error probability of Ψ uniform with parameter δ is

ε δ quantum (Ψ uniform ) ≤ 2 exp( -nδ 2 64
).

Cryptographic Primitives

In this section, we give formal definitions of cryptosystems and their security notions that will be used in subsequent chapters. By default, the security of these notions are defined with respect to QPT adversaries (if we are in the computational setting).

Puncturable Pseudorandom Function

A pseudorandom function (PRF) system [START_REF] Goldreich | How to Construct Random Functions[END_REF] consists of a keyed function F and a set of keys K such that for a randomly chosen key k ∈ K, the output of the function F (k, x) for any input x in the input space X "looks" random to a QPT adversary, even when given polynomially many evaluations of F (k, •). Puncturable PRFs have an additional property that some keys can be generated punctured at some point, so that they allow to evaluate the PRF at all points except for the punctured points. Furthermore, even with the punctured key, the PRF evaluation at a punctured point still looks random. Punctured PRFs are originally introduced in [BW13; KPTZ13; BGI14], who observed that it is possible to construct such puncturable PRFs for the construction from [START_REF] Goldreich | How to Construct Random Functions[END_REF], which can be based on any one-way function [START_REF] Håstad | A Pseudorandom Generator from any One-way Function[END_REF].

Definition 2.7 -Puncturable Pseudorandom Function

A pseudorandom function PRF : K × X → Y is a puncturable pseudorandom function if there is an additional key space K p and three PPT algorithms pPRF := ⟨KeyGen, Puncture, Eval⟩ such that:

k ← KeyGen(1 λ ).
The key generation algorithm KeyGen takes the security parameter 1 λ as input and outputs a random key k ∈ K.

k{x} ← Puncture(k, x). The puncturing algorithm Puncture takes as input a PRF key k ∈ K and x ∈ X , and outputs a key k{x} ∈ K p .

y ← Eval(k{x}, x ′ ). The evaluation algorithm takes as input a (possibly punctured) key k{x} ∈ K p and x ′ ∈ X , and outputs a classical string y ∈ Y.

We require the following properties of pPRF.

Functionality preserved under puncturing. For all λ ∈ N, for all x ∈ X ,

Pr   ∀x ′ ∈ X \ {x} : Eval(k{x}, x ′ ) = Eval(k, x ′ ) k $ ← KeyGen(1 λ ) k{x} $ ← Puncture(k, x)   = 1.
Pseudorandomness at punctured points. For every QPT adversary A := (A 1 , A 2 ), and every λ ∈ N, the following holds:

Pr        1 ← A 2 (k{x * }, y, τ ) (x * , τ ) ← A 1 (1 λ , τ ) k $ ← KeyGen(1 λ ) k{x * } $ ← Puncture(k, x * ) y ← Eval(k, x * )        -Pr        1 ← A 2 (k{x * }, y, τ ) (x * , τ ) ← A 1 (1 λ , τ ) k $ ← KeyGen(1 λ ) k{x * } $ ← Puncture(k, x * ) y $ ← Y        ≤ negl(λ),
where the probability is taken over the randomness of KeyGen, Puncture, and A 1 .

Denote the above probability as Adv pPRF (λ, A). We further say that pPRF is δ-secure, for some concrete negligible function δ(λ), if for all QPT adversaries A, the advantage Adv pPRF (λ, A) is smaller than δ(λ) Ω (1) .

We also consider several variants as follows.

Definition 2.8 -Invertible Pseudorandom Functions An invertible pseudorandom function (IPRF) with key-space K, domain X , and range Y consists of two functions iPRF : K ×X → Y and iPRF -1 : K ×Y → X ∪{⊥}. An IPRF can also include a setup algorithm iPRF.Setup(1 λ ) that on input the security parameter λ, outputs a key k ∈ K. The functions iPRF and iPRF -1 satisfy the following properties:

• Both iPRF and iPRF -1 can be computed by deterministic polynomial-time algorithms.

• For all security parameters λ and all keys k output by iPRF.Setup(1 λ ), the function iPRF(k, •) is an injective function from X to Y. Moreover, the function iPRF -1 (k, •) is the (generalized) inverse of iPRF(k, •).

• (Weak) Quantum Pseudorandomness. An IPRF iPRF : K × X → Y is secure if for all QPT adversaries A, Pr k $ ←iPRF.Setup(1 λ ) A |iPRF(k,•)⟩ (1 λ ) = 1 - Pr R $ ←InjFuncs[X ,Y] A |R(•)⟩ (1 λ ) = 1 ≤ negl(λ),
where InjFuncs[X , Y] is the set of all injective functions from X to Y.

Definition 2.9 -Statistically Injective Pseudorandom Functions A statistically injective (puncturable) PRF family with (negligible) failure probability ε(•) is a (puncturable) PRF family PRF such that with probability 1 -ε(λ) over the random choice of key k ← KeyGen(1 λ ), we have that PRF(k, •) is injective. Definition 2.10 -Extracting Pseudorandom Functions An extracting (puncturable) PRF with error ε(•) for min-entropy k(•) is a (puncturable) PRF PRF mapping n(λ) bits to m(λ) bits such that for all λ, if X is any distribution over n(λ) bits with min-entropy greater than k(λ), then the statistical distance between (k, PRF(k, X)) and (k, r

$ ← {0, 1} m(λ) ) is at most ε(•), where k ← KeyGen(1 λ ).

Symmetric-key Encryption

Definition 2.11 -Symmetric-key Encryption A symmetric-key cryptosystem SE := ⟨K, SymEnc, SymDec⟩ consists of three PPT algorithms.

K(1 λ

) is a probabilistic key generation algorithm which takes as input a security parameter λ and outputs a secret key k.

SymEnc(k, x; r) is a probabilistic encryption algorithm which takes as input a secret key k, a plaintext x ∈ X (where X is some fixed message space), a random coin r ∈ R (where R is the randomness space), and outputs a ciphertext y.

SymDec(k, y) is a deterministic decryption algorithm which takes as input a secret key k and a ciphertext y, and outputs a message x ∈ X ∪ {⊥}, where ⊥ is a distinguished symbol indicating decryption failure.

The standard correctness requirement is that for all λ ∈ N, for any key k ← K(1 λ ), any random coin r of SymEnc and any x ∈ X , we have SymDec(k, SymEnc(k, x; r)) = x.

Security Definitions. For completeness, we give here a modified version of the Real-or-Random security definition in the classical setting. In this notion, the security game starts with a first learning phase, followed by a challenge phase where A sends a challenge query (a message x to encrypt) and receives a challenge ciphertext, which is encryption of either x if b = 1 or some random message x ′ if b = 0. Note that encrypting a random message x ′ is equivalent to applying a random function h to x and then encrypting h(x). Afterwards, a second learning phase follows, and finally, A outputs a solution (its guess for the bit b).

In the standard IND-CCA2 security definition, the decryption oracle in the second learning phase would return ⊥ if the query is a challenge ciphertext (in both games). However, this is completely equivalent to returning the original plaintext (which was sent to the challenge oracle by the adversary) in both games. We note that the challenger could do that in the classical setting, as it could keep both the challenge plaintext and the challenge ciphertext. We formalize this modified notion below.

We let the string atk be instantiated by any of the formal symbols cpa, cca1, cca2, while atk is the corresponding formal symbol from CPA, CCA1, CCA2. When we say O i := ∅ where i ∈ {1, 2}, we mean O i is the function which, on any input, returns ⊥. For a random function h, h 0 is identity, and h 1 := h. Definition 2.12 -Real-or-Random IND-CPA, IND-CCA1, IND-CCA2 Let SE := ⟨K, SymEnc, SymDec⟩ be a symmetric-key encryption scheme and let A := (A 1 , A 2 ) be a classical adversary. Let F be the family of all functions over X . For atk ∈ [cpa, cca1, cca2], we define the following game, where the oracles O 1 , O 2 are defined according to atk:

Experiment Expt ind-atk-b SE (λ, A): 1 : k $ ← K(1 λ ) 2 : (x, state) ← A O SymEnc(k,•) ,O 1 1 (1 λ ) 3 : h $ ← F 4 : y * ← SymEnc(k, h 1-b (x)) 5 : b ′ ← A O SymEnc(k,•) ,O 2 2 (y * , state) 6 : return b ′ atk cpa cca1 cca2 Oracle O 1 ∅ SymDec(k, •) SymDec(k, •) Oracle O 2 ∅ ∅ SymDec * (k, •)
Here, SymDec * (k, y) returns x if y = y * , otherwise it decrypts normally. We define A's advantage by

Adv ind-atk A,SE (λ) := Pr Expt ind-atk-1 SE (λ, A) = 1 -Pr Expt ind-atk-0 SE (λ, A) = 1 .
We say SE is secure in the sense of IND-atk if A being PPT implies that Adv ind-atk A,SE (λ) is negligible.

Next, we give the definition (in the Find-then-Guess style) in the quantum setting, proposed by Boneh and Zhandry [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF]. In the following, we let the string qatk be instantiated by any of the formal symbols qcpa, qcca1, qcca2, while qatk is the corresponding formal symbol from qCPA, qCCA1, qCCA2.

Definition 2.13 -IND-qCPA, IND-qCCA1, IND-qCCA2 [BZ13b]
Let SE := ⟨K, SymEnc, SymDec⟩ be a symmetric-key encryption scheme and let A := (A 1 , A 2 ) be a quantum adversary. For qatk ∈ [qcpa, qcca1, qcca2], we define the following game, where the oracles O 1 , O 2 are defined according to qatk:

Experiment Expt ind-qatk-b SE (λ, A): 1 : k $ ← K(1 λ ) 2 : |x 0 , x 1 ⟩ |ϕ⟩ ← A |O SymEnc(k,•) ⟩,|O 1 ⟩ 1 (1 λ ) 3 : if |x 0 | ̸ = |x 1 | then return 0 4 : y * ← SymEnc(k, x b ) 5 : b ′ ← A |O SymEnc(k,•) ⟩,|O 2 ⟩ 2 (|y * ⟩ |ϕ⟩) 6 : return b ′ qatk qcpa qcca1 qcca2 Oracle O 1 ∅ SymDec(k, •) SymDec(k, •) Oracle O 2 ∅ ∅ SymDec * (k, •)
Here, SymDec * (k, y) returns ⊥ if y = y * , otherwise it decrypts normally. We define A's advantage by

Adv ind-qatk A,SE (λ) := Pr Expt ind-qatk-1 SE (λ, A) = 1 -Pr Expt ind-qatk-0 SE (λ, A) = 1 .
We say SE is secure in the sense of

IND-qatk if A being QPT implies that Adv ind-qatk A,SE (λ
) is negligible.

Public-key Encryption

Definition 2.14 -Public-key Encryption A public-key cryptosystem E := ⟨KeyGen, Enc, Dec⟩ consists of three PPT algorithms.

KeyGen(1 λ ) is a probabilistic key generation algorithm which takes as input the security parameter λ and outputs a pair (pk, sk) of matching public and secret keys.

Enc(pk, x; r) is a probabilistic encryption algorithm which takes as input a public key pk, a plaintext x ∈ X (where X is some fixed message space), a random coin r ∈ R (where R is the randomness space), and outputs a ciphertext y.

Dec(sk, y) is a deterministic decryption algorithm which takes as input a secret key sk and a ciphertext y, and outputs a message x ∈ X ∪ {⊥}, where ⊥ is a distinguished symbol indicating decryption failure.

The following correctness definition is taken from [START_REF] Hofheinz | A Modular Analysis of the Fujisaki-Okamoto Transformation[END_REF]. We call a public-key encryption scheme E δ-correct if

E max x∈X Pr r∈R [ Dec(sk, Enc(pk, x; r)) ̸ = x ] ≤ δ,
where the expectation is taken over (pk, sk) ← KeyGen(1 λ ).

Security Definitions. Similar to the symmetric setting, we first give a Real-or-Random security definition for public-key encryption in the classical setting, then Boneh-Zhandry's definitions [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF].

Definition 2.15 -Real-or-Random IND-CPA, IND-CCA1, IND-CCA2
Let E := ⟨KeyGen, Enc, Dec⟩ be a public-key encryption scheme and let A := (A 1 , A 2 ) be a classical adversary. Let F be the family of all functions over X . For atk ∈ [cpa, cca1, cca2], we define the following game, where the oracles O 1 , O 2 are defined according to atk:

Experiment Expt ind-atk-b E (λ, A): 1 : (pk, sk) ← KeyGen(1 λ ) 2 : (x, state) ← A O Enc(pk,•) ,O 1 1 (pk) 3 : h $ ← F 4 : y * ← Enc(pk, h 1-b (x)) 5 : b ′ ← A O Enc(pk,•) ,O 2 2 (y * , state) 6 : return b ′ atk cpa cca1 cca2 Oracle O 1 ∅ Dec(sk, •) Dec(sk, •) Oracle O 2 ∅ ∅ Dec * (sk, •)
Here, Dec * (sk, y) returns x if y = y * , otherwise it decrypts normally. We define A's advantage by

Adv ind-atk A,E (λ) := Pr Expt ind-atk-1 E (λ, A) = 1 -Pr Expt ind-atk-0 E (λ, A) = 1 . We say E is secure in the sense of IND-atk if A being PPT implies that Adv ind-atk A,E (λ) is negligible. Definition 2.16 -IND-qCPA, IND-qCCA1, IND-qCCA2 [BZ13b]
Let E := ⟨KeyGen, Enc, Dec⟩ be a public-key encryption scheme and let A := (A 1 , A 2 ) be a quantum adversary. For qatk ∈ [qcpa, qcca1, qcca2], we define the following game, where the oracles O 1 , O 2 are defined according to qatk:

Experiment Expt ind-qatk-b E (λ, A): 1 : (pk, sk) ← KeyGen(1 λ ) 2 : |x 0 , x 1 ⟩ |ϕ⟩ ← A |O 1 ⟩ 1 (pk) 3 : if |x 0 | ̸ = |x 1 | then return 0 4 : y * ← Enc(pk, x b ) 5 : b ′ ← A |O 2 ⟩ 2 (|y * ⟩ |ϕ⟩) 6 : return b ′ qatk qcpa qcca1 qcca2 Oracle O 1 ∅ Dec(sk, •) Dec(sk, •) Oracle O 2 ∅ ∅ Dec * (sk, •)
Here, Dec * (sk, y) returns ⊥ if y = y * , otherwise it decrypts normally. We define A's advantage by

Adv ind-qatk A,E (λ) := Pr Expt ind-qatk-1 E (λ, A) = 1 -Pr Expt ind-qatk-0 E (λ, A) = 1 .
We say E is secure in the sense of

IND-qatk if A being QPT implies that Adv ind-qatk A,E (λ
) is negligible.

One-time Signatures

Definition 2.17 -Digital Signatures A signature scheme Sig := ⟨KeyGen, Sign, Verif⟩ consists of three PPT algorithms .

(pk, sk) ← KeyGen(1 λ ) is a randomized procedure that takes as input the security parameter λ and produces a secret key and public key pair (pk, sk).

σ ← Sign(sk, m) takes as input the secret key and a message m ∈ X (where X is some fixed message space), and produces a signature σ.

b ← Verif(pk, m, σ) is a deterministic decryption algorithm which takes as input a public key pk, a message m, and a supposed signature σ on m, and outputs a bit b.

A signature scheme is correct if Verif accepts signatures outputted by Sign such that

Pr Verif(pk, m, σ) = 1 (sk, pk) ← KeyGen(1 λ ) σ ← Sign(sk, m) ≥ 1 -negl(λ).
For security, we will for simplicity only consider one-time signature schemes where the adversary only receives a single superposition of messages. Furthermore, for simplicity we assume that the signing function is a deterministic function of the secret key and message; this can be made without loss of generality by using a pseudorandom function to generate the randomness.

Boneh-Zhandry security. Boneh and Zhandry [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF] give the following definition of security for signatures in the presence of quantum adversaries.

Definition 2.18 -(n+1)-Unforgeability [BZ13b]

Let A be a quantum adversary, and consider the following experiment between A and a challenger:

• The challenger runs (sk, pk) ← KeyGen(1 λ ), and gives pk to A.

• A makes a quantum superposition query to the function Sign(sk, •) as |m, u⟩ → |m, u ⊕ Sign(sk, m)⟩.

• A outputs two classical message/signature pairs ((m 0 , σ 0 ), (m 1 , σ 1 )).

• The challenger accepts and outputs 1 if and only if (1) m 0 ̸ = m 1 , and ( 2)

Verif(pk, m b , σ b ) for both b ∈ {0, 1}. Denote this output by W-BZ-Exp(λ, A).
A signature scheme is one-time weakly BZ-secure if, for any quantum polynomial time adversary A, W-BZ-Exp(λ, A) is negligible.

Non-interactive Zero-knowledge Proof Systems

For a NP relation R ⊆ X × W, we let L(R) := {x : ∃w, (x, w) ∈ R}.

Definition 2.19 -Non-interactive Zero-knowledge Proof Systems A non-interactive zero-knowledge (NIZK) proof system for an NP relation R in the common reference string (CRS) model consists of three PPT algorithms NIZK := ⟨Setup, P, V⟩:

crs ← Setup(1 n , 1 λ ).
On input a statement of length n and the security parameter λ, the setup algorithm Setup outputs a common reference string crs.

π ← P(crs, x, w). On input the common reference string crs, an instance x and a witness w such that (x, w) ∈ R, the proving algorithm P outputs a proof π.

b ← V(crs, x, π). On input the common reference string crs, an instance x and a proof π, the verification algorithm V outputs a bit b ∈ {0, 1}. If b = 1, we say that V accepts, otherwise we say that V rejects.

The proof system NIZK must satisfy the following requirements for all λ ∈ N.

Completeness. For every (x, w) ∈ R, we have that

Pr V(crs, x, P(crs, x, w)) = 1 | crs ← Setup(1 |x| , 1 λ ) = 1,
where the probability is taken over the randomness of Setup and P.

Statistical soundness. There exists a negligible function negl(λ) such that for any n ∈ N,

Pr crs←Setup(1 n ,1 λ ) [∃(x, π * ) s.t. V(crs, x, π * ) = 1 ∧ x / ∈ L] ≤ negl(λ).
(Adaptive) post-quantum computational zero-knowledge. There exists a QPT simulator S := (S 1 , S 2 ) such that for any QPT malicious verifier

V * := (V * 1 , V * 2 ), for any n ∈ N, Pr     V * 2 (crs, x, π, ζ) = 1 ∧ x ∈ L crs ← Setup(1 n , 1 λ ) (x, w, ζ) ← V * 1 (crs) π ← P(crs, x, w)     -Pr     V * 2 (crs, x, π, ζ) = 1 ∧ x ∈ L (crs, td) ← S 1 (1 λ ) (x, w, ζ) ← V * 1 (crs) π ← S 2 (td, x)     ≤ negl(λ).

Definition 2.20 -Unbounded Simulation-Soundness

A zero-knowledge proof system is said to be (unbounded) simulation-sound if it has the property that an adversary cannot provide a convincing proof for any false statement, even if it has seen simulated proofs of arbitrary statements (including false statements). More precisely, an NIZK proof is simulation sound if for all QPT adversaries A, we have:

Pr (x i , π i ) ̸ ∈ Q ∧ x ̸ ∈ L ∧ V(crs, x, π) = 1 (crs, td) ← S 1 (1 λ ) (x, π) ← A S 2 (td,•) (crs) ≤ negl(λ),
where Q is the list of simulation queries and responses (x i , π i ).

Definition 2.21 -NIZKs in the (quantum) random oracle model A definition for NIZK proof systems in the (quantum) random oracle model can be defined similarly as in Definition 2.19, except that the setup algorithm Setup outputs an empty string, and all parties have (quantum) access to a random oracle O H . Completeness, soundness, zero-knowledge and simulation-soundness can be defined similarly with respect to this change in the model.

Indistinguishability Obfuscation Definition 2.22 -Indistinguishability Obfuscator [BGIR+01]

A uniform PPT machine iO is called an indistinguishability obfuscator for a classical circuit class {C λ } if the following conditions are satisfied:

• For all security parameters λ ∈ N, for all C ∈ C λ , for all input x, we have that

Pr[C ′ (x) = C(x) | C ′ ← iO(λ, C)] = 1.
• For any (not necessarily uniform) QPT distinguisher D, for all security parameters λ ∈ N, for all pairs of circuits C 0 , C 1 ∈ C λ , we have that if C 0 (x) = C 1 (x) for all inputs x, then

Adv iO (λ, A) := |Pr[D(iO(λ, C 0 )) = 1] -Pr[D(iO(λ, C 1 )) = 1]| ≤ negl(λ).
We further say that iO is δ-secure, for some concrete negligible function δ(λ), if for all QPT adversaries A, the advantage Adv iO (λ, A) is smaller than δ(λ) Ω (1) .

Quantum-secure instantiations. There has been recent progress in constructing quantumsecure indistinguishability obfuscation schemes [BDGM20; GP20] from cryptographic assumptions that conjecturally hold against quantum adversaries. In [START_REF] Zhandry | Quantum Lightning Never Strikes the Same State Twice[END_REF][START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF], it is shown that indistinguishability obfuscation schemes have the property of subspace hiding. Lemma 2.8 ([Zha19b;[START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF]). Let iO an indistinguishability obfuscation scheme, and assume that injective one-way functions exist. Let S := {S λ } λ∈N a subspace S ⊆ F λ 2 . For a subspace S ′ , denote by C S ′ a classical circuit that checks membership in S ′ . Then, for every constant δ ∈ (0, 1] we have the following indistinguishability:

{iO(C S λ )} λ∈N c ≈ 0 {iO(C T ) | T $ ← S S λ } λ∈N ,
where S S λ is the set of all subspaces of dimension λ -λ δ that contain S λ .

Leveled Hybrid Quantum Fully Homomorphic Encryption

We give a definition of quantum fully homomorphic encryption of a specific structure, which was defined in [START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF].

Definition 2.23 -Leveled Hybrid Quantum Fully Homomorphic Encryption

A hybrid leveled quantum fully homomorphic encryption scheme is given by QFHE := ⟨KeyGen, Encrypt, QOTP, Eval, Decrypt⟩ with the following syntax:

(pk, sk) ← KeyGen(1 λ , 1 ℓ ). A PPT algorithm that given a security parameter λ ∈ N and target circuit bound ℓ ∈ N, outputs a classical key pair (pk, sk).

|ψ⟩ (x,z) ← QOTP((x, z), |ψ⟩). A QPT algorithm that takes as input an n-qubit quantum state |ψ⟩ and classical strings as quantum one-time pads (QOTPs)

x, z ∈ {0, 1} n and outputs its QOTP transformation

|ψ⟩ (x,z) := (⊗ i∈ n Z z i ) • (⊗ i∈ n X x i ) |ψ⟩.
We often call these one-time pads (x, z) the Pauli keys. Furthermore, if |ψ⟩ is a classical string m, we ignore the Pauli key z and write QOTP(x, m) whose output is x ⊕ m.

ct ← Encrypt(pk, x). A PPT algorithm that takes as input a classical string x ∈ {0, 1} * and the public key pk and outputs a classical ciphertext ct.

x ← Decrypt(sk, ct). A PPT algorithm that takes as input a classical ciphertext ct and the secret key sk and outputs a classical string x.

(|ϕ⟩ (x ′ ,z ′ ) , ct x ′ ,z ′ ) ← Eval(pk, (|ψ⟩ (x,z) , ct x,z ), C).
A QPT algorithm that takes as input a general quantum circuit C, a quantum one-time pad encrypted state |ψ⟩ (x,z) and a classical ciphertext ct x,z of the pads. The evaluation outputs a QOTP encryption of some quantum state |ϕ⟩ encrypted under new keys (x ′ , z ′ ) and a classical ciphertext ct x ′ ,z ′ .

The scheme satisfies the following properties.

Semantic Security. For every polynomials m(•), ℓ(•), and QPT algorithm

A := {A λ , ρ λ } λ∈N there exists a negligible function negl(•) such that Pr        1 ← A 2 (m 0 ⊕ x, ct x ) (m 0 , m 1 ) ← A 1 (1 λ ) (pk, sk) $ ← KeyGen(1 λ , 1 ℓ(λ) ) x $ ← {0, 1} m(λ) ct x ← Encrypt(pk, x)        -Pr        1 ← A 2 (m 1 ⊕ x, ct x ) (m 0 , m 1 ) ← A 1 (1 λ ) (pk, sk) $ ← KeyGen(1 λ , 1 ℓ(λ) ) x $ ← {0, 1} m(λ) ct x ← Encrypt(pk, x)        ≤ 1 2 + negl(λ),
where λ ∈ N and m 0 , m 1 ∈ {0, 1} m(λ) .

Denote the above probability as Adv QFHE (λ, A). We further say that QFHE is δ-secure, for some concrete negligible function δ(λ), if for all QPT adversaries A, the advantage Adv QFHE (λ, A) is smaller than δ(λ) Ω (1) .

Homomorphism. For every polynomial ℓ := ℓ(λ) there is a negligible function negl(•) such that the following holds. Let (pk, sk) ← KeyGen(1 λ , 1 ℓ ), let x, z equallength strings, let ct x,z ← Encrypt(pk, (x, z)), let C a quantum circuit of size ≤ ℓ, let |ψ⟩ a |x|-qubit state input for C. Then, ∆ (D 0 , D 1 ) ≤ negl(λ), where D 0 , D 1 are defined as follows.

• D 0 : The output state is |ϕ⟩ ← C(|ψ⟩).

• D 1 : The output state generated by first evaluating

(|ϕ⟩ (x ′ ,z ′ ) , ct x ′ ,z ′ ) ← Eval pk, (|ψ⟩ (x,z) , ct x,z ), C ,
and then decrypting

(x ′ , z ′ ) ← Decrypt(sk, ct x ′ ,z ′ ), and |ϕ⟩ ← QOTP (x ′ , z ′ ), |ϕ⟩ (x ′ ,z ′ ) .
Quantum-secure instantiations. Quantum leveled fully-homomorphic encryption with the hybrid structure follows from the work of Mahadev [START_REF] Mahadev | Classical Homomorphic Encryption for Quantum Circuits[END_REF] and Brakerski [START_REF] Brakerski | Quantum FHE (Almost) As Secure As Classical[END_REF], and can be based on the quantum hardness of Learning with Errors [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. Consequently, constructing QFHE that has hybrid structure, leveled, and has sub-exponential advantage security can be based on assuming LWE with sub-exponential indistinguishability.

Extended Trapdoor Claw-free Functions

In this section, we recall the definition of extended noisy trapdoor claw-free function family (ENTCF family), which was introduced in [START_REF] Mahadev | Classical Verification of Quantum Computations[END_REF]. An ENTCF family consists of two families F and G of function pairs. A function pair (f k,0 , f k,1 ) ∈ F is called a claw-free pair and is indexed by a public key k. Similarly, an injective pair is a pair of functions (f k,0 , f k,1 ) ∈ G, also indexed by a public key k. Informally, the most important properties are the following:

1. For fixed k ∈ K 1 , f k,0 and f k,1 are bijections with the same image, i.e., for every y in their image there exists a unique pair (x 0 , x 1 ), called a claw, such that f k,0

(x 0 ) = f k,1 (x 1 ) = y.
2. Given a key k ∈ K 1 for a claw-free pair, it is quantum-computationally intractable (without access to trapdoor information) to compute both a preimage x i and a single generalized bit of x 0 ⊕ x 1 (i.e., d • (x 0 ⊕ x 1 ) for any non-trivial bit string d), where (x 0 , x 1 ) forms a valid claw. This is called the adaptive hardcore bit property.

3. For fixed k ∈ K 0 , f k,0 and f k,1 are injective functions with disjoint images.

4. Given a key k ∈ K 1 ∪ K 0 , it is quantum-computationally hard (without access to trapdoor information) to determine the "function type", i.e., to decide whether k is a key for a claw-free or an injective pair. This is called injective invariance.

5.

For every key k ∈ K 1 ∪ K 0 , there exists a trapdoor t k , which can be sampled together with k and with which (ii) and (iv) are computationally easy.

A formal definition follows.

Definition 2.24 -Noisy Trapdoor Claw-Free Functions Let λ be a security parameter. Let X and Y be finite sets. Let K 1 be a finite set of keys. A family of functions

F := f k,b : X → D Y k∈K 1 ,b∈{0,1}
is called a noisy trapdoor claw-free (NTCF) family if the following conditions hold:

Efficient Function Generation. There exists an efficient probabilistic algorithm Gen F which generates a key k ∈ K 1 together with a trapdoor t k :

(k, t k ) ← Gen F (1 λ ) .
Trapdoor Injective Pair. For all keys k ∈ K 1 the following conditions hold.

1.

Trapdoor : For all b ∈ {0, 1} and

x ̸ = x ′ ∈ X , Supp(f k,b (x)) ∩ Supp(f k,b (x ′ )) = ∅.
Moreover, there exists an efficient deterministic algorithm Inv F such that for all b ∈ {0, 1}, x ∈ X and

y ∈ Supp(f k,b (x)), Inv F (t k , b, y) = x.

2.

Injective pair : There exists a perfect matching R k ⊆ X × X such that f k,0 (x 0 ) = f k,1 (x 1 ) if and only if (x 0 , x 1 ) ∈ R k .

Efficient Range Superposition. For all keys k ∈ K 1 and b ∈ {0, 1} there exists a function

f ′ k,b : X → D Y such that 1. For all (x 0 , x 1 ) ∈ R k and y ∈ Supp f ′ k,b (x b ) , Inv F (t k , b, y) = x b and Inv F (t k , b ⊕ 1, y) = x b⊕1 .
2. There exists an efficient deterministic procedure Chk F that, on input k, b ∈ {0, 1}, x ∈ X and y ∈ Y, returns 1 if y ∈ Supp f ′ k,b (x) and 0 otherwise. Note that Chk F is not provided the trapdoor t k .

For every k and b

∈ {0, 1}, E x $ ←X H 2 (f k,b (x), f ′ k,b (x)) ≤ µ(λ) ,
for some negligible function µ(•). Here H 2 is the Hellinger distance defined between two densities f 1 and f 2 over the same finite domain X as:

H 2 (f 1 , f 2 ) := 1 - x∈X f 1 (x)f 2 (x).
Moreover, there exists an efficient procedure Samp F that on input k and b ∈ {0, 1} prepares the state

1 |X | x∈X ,y∈Y (f ′ k,b (x))(y) |x⟩ |y⟩ . (2.11)
Adaptive Hardcore Bit. For all keys k ∈ K 1 the following conditions hold, for some integer w that is a polynomially bounded function of λ.

1. For all b ∈ {0, 1} and x ∈ X , there exists a set G k,b,x ⊆ {0, 1} w such that Pr

d $ ←{0,1} w [ d / ∈ G k,b,x
] is negligible, and moreover there exists an efficient algorithm that checks for membership in G k,b,x given k, b, x and the trapdoor t k .

2. There is an efficiently computable injection J : X → {0, 1} w , such that J can be inverted efficiently on its range, and such that the following holds. If

H k := (b, x b , d, d • (J(x 0 ) ⊕ J(x 1 ))) | b ∈ {0, 1}, (x 0 , x 1 ) ∈ R k , d ∈ G k,0,x 0 ∩ G k,1,x 1 , H k := {(b, x b , d, c) | (b, x, d, c ⊕ 1) ∈ H k ,
then for any quantum polynomial-time procedure A there exists a negligible function µ(•) such that

Pr (k,t k )←Gen F (1 λ ) [A(k) ∈ H k ] - Pr (k,t k )←Gen F (1 λ ) [A(k) ∈ H k ] ≤ µ(λ) .
(2.12) Definition 2.25 -Trapdoor Injective Function Family Let λ be a security parameter. Let X and Y be finite sets. Let K 0 be a finite set of keys. A family of functions

G := g k,b : X → D Y b∈{0,1},k∈K 0
is called a trapdoor injective family if the following conditions hold: Efficient Function Generation. There exists an efficient probabilistic algorithm Gen G which generates a key k ∈ K 0 together with a trapdoor t k :

(k, t k ) ← Gen G (1 λ ) .
Disjoint Trapdoor Injective Pair. For all keys k ∈ K 0 , for all b, b ′ ∈ {0, 1} and x,

x ′ ∈ X , if (b, x) ̸ = (b ′ , x ′ ), Supp(g k,b (x)) ∩ Supp(g k,b ′ (x ′ )) = ∅.
Pr (k,t k )←Gen F (1 λ ) [A(k) = 0] - Pr (k,t k )←Gen G (1 λ ) [A(k) = 0] ≤ µ(λ) (2.14)
Definition 2.27 -Extended Trapdoor Claw-Free Family A noisy trapdoor claw-free family F is an extended trapdoor claw-free family if:

1. It is injective invariant.

2. For all k ∈ K 1 and d ∈ {0, 1} w , let:

H ′ k,d = {d • (J(x 0 ) ⊕ J(x 1 ))|(x 0 , x 1 ) ∈ R k } (2.15)
For all quantum polynomial-time procedures A, there exists a negligible function µ(•) and a string d ∈ {0, 1} w such that

Pr (k,t k )←Gen F (1 λ ) [A(k) ∈ H ′ k,d ] - 1 2 ≤ µ(λ) (2.16)
In addition, we also define the following functions for convenience: The above decoding maps applied to vector inputs are understood to act in an element-wise fashion. For example, for ⃗ k ∈ K

Copy-Protection

In the following, we assume that F is a family of functions such that each function f in the family has the same domain X and the same codomain Y and has a classical description d f (of size polynomial in λ) that allows for an efficient computation of f . Definition 2.29 -Copy-Protection Scheme of a Family F A copy-protection scheme is a tuple of algorithms ⟨Protect, Eval⟩ with the following properties:

ρ f ← Protect(1 λ , d f ). On input the description d f of a function f ∈ F, the quantum
protection algorithm outputs a quantum state ρ f . y ← Eval(1 λ , ρ f , x). On input a quantum state ρ f and an input x ∈ X , the quantum evaluation algorithm outputs an image y ∈ Y.

We ask a copy-protection scheme to have correctness and anti-piracy security. A copy-protection scheme has correctness if the quantum protection of a function f computes f on every x with overwhelming probability, that is for any λ ∈ N, for all f ∈ F and for all x ∈ X , the following holds:

Pr Eval(1 λ , ρ f , x) = f (x) | ρ f ← Protect(1 λ , d f ) ≥ 1 -negl(λ).
Definition 2.30 -Anti-Piracy Game for Copy-Protection In order to define anti-piracy security, we define a piracy game for copy-protection of a family F with respect to distributions D f and {X f } f ∈F . This game is between a challenger and an adversary represented by three algorithms (A 0 , A 1 , A 2 ), where A 1 and A 2 cannot communicate during the game. It is parameterized by a distribution D f over {d f : f ∈ F} and a family of distributions {X f } f ∈F over X × X . The challenger and the adversary proceed in the following way:

(1) Setup phase. The challenger samples d f ← D f and sends

ρ f ← Protect(1 λ , d f ) to A 0 .
(2) Splitting phase. A 0 prepares a bipartite quantum state σ 12 , and sends σ 1 to A 1 and σ 2 to A 2 .

(3) Challenge phase. The challenger samples (x 1 , x 2 ) ← X f and sends x 1 to A 1 and x 2 to A 2 .

(4) Answer phase. A 1 returns y 1 and A 2 returns y 2 .

The adversary wins the game if y 1 = f (x 1 ) and y 2 = f (x 2 ). We denote the random variable that indicates whether an adversary (A 0 , A 1 , A 2 ) wins the game or not as APGame Protect,Eval

D f ,{X f } f ∈F (1 λ , (A 0 , A 1 , A 2 )).
As noted in [START_REF] Coladangelo | Quantum copy-protection of compute-and-compare programs in the quantum random oracle model[END_REF] and [START_REF] Ananth | On the Feasibility of Unclonable Encryption, and More[END_REF], an adversary can always win the game with a trivial probability (that we define formally next) by applying the following strategy: A 0 forwards the quantum protection state to either A 1 or A 2 and nothing to the other one. The one who receives the state can answer the challenge with probability close to 1 using the Eval algorithm, and the other one returns the optimal answer given their challenge.

Thus, given a family F, and distributions D f and {X f } f ∈F , we define the trivial probability of winning the piracy game as

p trivial D f ,{X f } f ∈F := max i∈{1,2} E d f ∈D f max y∈Y Pr[y | x i ]
Definition 2.31δ-Anti-Piracy Security of a Copy-Protection Scheme A copy-protection scheme of a family F has δ-anti-piracy security with respect to the distributions D f and {X f } f ∈F if no QPT adversary (A 0 , A 1 , A 2 ) can win the piracy game for F with respect to the distributions D f and {X f } f ∈F with a probability significantly greater than 1 -δ(λ). More precisely, for any QPT adversary

(A 0 , A 1 , A 2 ) Pr APGame Protect,Eval D f ,{X f } f ∈F (1 λ , (A 0 , A 1 , A 2 )) = 1 ≤ 1 -δ(λ) + negl(λ)
When δ(λ) = 1 -p trivial D f ,{X f } f ∈F , we simply say that the copy-protection scheme has anti-piracy security.

For ease of notations, we will use f and d f indifferently, and we will not write the dependence on λ in the following when clear from the context.

Part I

Quantum Security

Chapter 3

Quantum Security for Classical Encryption

In this chapter, we present quantum security definitions for classical encryption schemes in both symmetric-key and public-key settings, as well as their characterizations. These notions were introduced in [CEV20], and are the first quantum chosen-ciphertext security notions for classical encryption with quantum challenge queries.

Chapter content Indistinguishability-based security definitions are modeled as a game between a challenger and an adversary A. In the Find-Then-Guess style, the game starts with a first learning phase (with access to some oracles), followed by a challenge phase where A sends a challenge query (two messages x 0 and x 1 to be encrypted) and receives a challenge ciphertext (encryption of x b ). Afterwards, a second learning phase follows, and finally, A outputs a solution (its guess for the bit b). The security reduction consists in constructing a new adversary which simulates A and solves some hard underlying problem. The learning phases define the type of attacks: chosen-plaintext attacks (CPA) if the adversary has access to an encryption oracle in both learning phases, and chosen-ciphertext attacks (CCA) in case it also has access to a decryption oracle in the learning phases (nonadaptive or CCA1 if it is restricted to the first learning phase, and adaptive or CCA2 otherwise). Indistinguishability against adaptive chosen-ciphertext attack (IND-CCA2) is usually considered the most desirable security notion for encryption. In the CCA2 games, the adversary is restricted not to ask for decryption of the challenge ciphertext, otherwise, this would lead to a trivial guess of the bit b. It is the role of the challenger to ensure that the adversary obeys this rule, which intrinsically requires the ability to copy, store and compare classical strings.

Boneh-Zhandry's Security Notions [BZ13b]

Boneh and Zhandry propose the first definition of IND-CCA for both symmetric and public-key encryption schemes against quantum adversaries allowed to make quantum encryption and decryption queries. But they show that the natural translation of the classical Find-then-Guess paradigm to the quantum setting is unachievable, even for IND-CPA security. To overcome this impossibility, they resort to considering quantum queries during the learning phases only, and classical queries during the challenge phase. In addition to looking artificial, this inconsistency between the learning phases and the challenge phase may lead to a cryptographic construction that fulfills this security notion (IND-qCPA or IND-qCCA) while being subject to an attack.

For instance, in [START_REF] Vivekanand Anand | Post-Quantum Security of the CBC, CFB, OFB, CTR, and XTS Modes of Operation[END_REF], the authors verify IND-qCPA security of XTS mode of operation (with quantum learning queries and classical challenge queries). They design a block cipher such that an encryption scheme in XTS mode, instantiated with that block cipher, can be attacked during the learning phase using quantum learning queries. However, this attack cannot be used to violate the IND-qCPA security definition. The explanation for this inconsistency is that this attack cannot be implemented in the challenge phase due to the classical restriction imposed on the adversary. This example supports our claim that the inconsistency between the learning phases and the challenge phase can be problematic and should be overcome.

Quantum IND-CCA2 Security Notions

To date, defining the CCA2 security with quantum challenge queries remains unsolved. In [START_REF] Gagliardoni | Semantic Security and Indistinguishability in the Quantum World[END_REF], the authors address the inconsistency described above for the case of symmetric encryption, but only for IND-CPA, and leave as an open problem the IND-CCA definitions.

The main obstacle is to define how the challenger should reply to the quantum decryption queries after the adversary has made the quantum challenge queries. When the challenge queries are classical, they can be stored and later the challenger can return ⊥ if the adversary submits one of them as a decryption query. Although it is trivial and inherent to store the challenge ciphertext in the classical setting, it is highly non-trivial to store ciphertexts in the quantum world, due to a number of technical obstacles, all of which can be traced to quantum no-cloning [START_REF] William | A single quantum cannot be cloned[END_REF] and the destructiveness of quantum measurements [START_REF] Christopher | Quantum-state disturbance versus information gain: Uncertainty relations for quantum information[END_REF].

Our Approach

Towards resolution, we start from a recent groundbreaking technique that allows for on-the-fly simulation of random oracles in the quantum setting: Zhandry's compressed oracles [START_REF] Zhandry | How to Record Quantum Queries, and Applications to Quantum Indifferentiability[END_REF]. The goal of his work is to overcome the recording barrier, by allowing the reduction to record information about the adversary's queries, which is a key feature of many classical ROM proofs.

Zhandry's key observations are threefold. First, instead of considering a random function h being chosen beforehand, one can purify the adversary's mixed state by putting h in uniform superposition h |h⟩. This observation is a technicality that allows us to fulfill the two next points. Then, the next observation is that, by doing the queries in the Fourier basis, the data will be written to the oracle's registers instead of writing to the opposite direction. This enables the simulator to get some information about the adversary's queries. Finally, the last and most important one is that the simulator needs to be ready to forget some point it simulated previously, by performing a particular test on the database after answering the query. In particular, Zhandry defines a test computation that maps |+⟩ → |+⟩ |1⟩ and |ϕ⟩ → |ϕ⟩ |0⟩ for any |ϕ⟩ orthogonal to |+⟩, where |+⟩ = x |x⟩ is the uniform superposition state. The "test-and-forget" procedure can be implemented by first performing the query in the Fourier basis and then doing the test operation on the output registers (of the simulator). This test determines whether the adversary has any information from the oracle at some input. If not, that pair will be removed from the database so that the adversary cannot detect that it is interacting with a simulated oracle.

This technique has been extended from random oracles to lazy-sampling of nonuniform random functions in [START_REF] Czajkowski | Quantum Lazy Sampling and Game-Playing Proofs for Quantum Indifferentiability[END_REF]. The intuition is almost the same, except that now one starts from the all-zero state, performs an efficient sampling operation that computes the function f (x) according to some non-uniform distribution -it is the quantum Fourier transform (QFT) operation in the uniform setting. One then performs the query in the Fourier basis, transforms back to the computational basis and applies the "test-and-forget" operation (which is defined similarly as in the uniform setting). For this to work, the two important requirements are that: i) the sampling operation must be efficient; ii) the function distribution must be independent for every input.

To define security for encryption, we choose the real-or-random paradigm to work with. This is because partially, the real-or-random paradigm does not suffer from Boneh-Zhandry's impossibility (discussion below). Furthermore, it is actually possible to define quantum chosen-ciphertext security for this paradigm using the quantum lazy-sampling technique we just described. In what follows, let us focus on the random world of the paradigm. For each challenge query in the random world, the challenger applies a random function to the plaintext registers before encrypting, all aforementioned requirements are met: the encryption of each submitted plaintext is actually an encryption of another uniformly random plaintext, and since the encryption algorithm is efficient, the sampling operation can also be efficiently constructed.

The above idea gives us a reasonable way to define adaptive chosen ciphertext security against quantum challenge queries: by instantiating the encryption oracle with this lazysampling technique, we are able to keep track of the information needed to formulate the CCA2 notions, namely the challenge queries the adversary has made, and the challenge ciphertexts it has received. However, applying Zhandry's framework directly to our setting does not work, and more efforts are needed. For example, one main difference is that in our setting, when making queries to the random oracle, there is no response register (from the adversary). In Zhandry's framework, this response register is essential for the technique, as the "test-and-forget" procedure works based on the value of this register. Another problem is how to implement the oracle with an one-shot call to the encryption algorithm: this is necessary when defining "one-time" security, or when doing security reductions. We refer the reader to Section 3.2 for technical details.

Discussion

This line of work on defining security for encryption in the quantum world started by Boneh and Zhandry in [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF]. They show that quantizing the notion of classical "left-or-right" indistinguishability is unachievable, even for chosen-plaintext security. In more details, the adversary sends two input-message registers for the challenge phase:

x 0 ,x 1 ,y α x 0 ,x 1 ,y |x 0 , x 1 , y⟩ → x 0 ,x 1 ,y α x 0 ,x 1 ,y |x 0 , x 1 , y ⊕ Encrypt(x b )⟩ . (3.1)
For any classical encryption scheme, the adversary can perform an efficient attack which allows it to get the bit b with overwhelming probability. Follow-up works [GHS16; MS16; GKS21] manage to bypass this impossibility and give security definitions that allow the adversary to send quantum challenge queries. These works use different approaches, we give a discussion on these approaches and relate them to ours below.

On the query models. In [START_REF] Vincent Carstens | Relationships Between Quantum IND-CPA Notions[END_REF], all possible qIND-qCPA security notions for symmetrickey encryption have been studied. It was proven that "real-or-random" in the standard oracle model and "left-or-right" in the minimal oracle model are among the strongest ones we could achieve, and at the same time, the two notions are provably incomparable 45 . We believe that the standard oracle model is a more realistic query model, and thus security notions defined in this model might be a better one, for several reasons:

• In the symmetric-key setting, [START_REF] Gagliardoni | Semantic Security and Indistinguishability in the Quantum World[END_REF] shows that with the decryption oracle, minimal oracles can be efficiently simulated by standard oracles. However, we stress that in general, unlike the symmetric setting, in the public-key setting, the

We note that in [START_REF] Vincent Carstens | Relationships Between Quantum IND-CPA Notions[END_REF], instead of "real-or-random" (as we are considering here), they consider "real-or-permuted" notion. However, their results translate directly to "real-or-random" notions, and also to the public-key setting (using the hybrid encryption approach). requirement of having the decryption key simultaneously with the public key is unrealistic in most of the cases. The encryption machine should not hold the secret key for practical use. Thus, defining security for public-key encryption in the minimal oracle model is not possible in general.

• Implementing queries in the minimal oracle model is only applicable to injective functions, which definitely does not include decryption. Thus, one still needs the standard oracle model to define chosen-ciphertext security: the minimal oracle model for encryption queries, and the standard oracle model for the decryption queries. This type of notions is not consistent in our opinion.

• The standard oracle model captures the quantum fault attacks while the minimal oracle model does not (see [START_REF] Gagliardoni | Semantic Security and Indistinguishability in the Quantum World[END_REF]).

• Oracles implemented in the minimal oracle model require extra quantum computation. That is, the challenger has to use its secret information/randomness twice in the computation (once for encryption and once for recovering the message).

In the standard oracle model, the second computation is not needed. (We note that in our notion, in the real game, the challenger implements the encryption oracle straightforwardly in the standard oracle model and does not need any extra computation.) This might limit some quantum attacks. For example, consider the smartcard frozen attacks [START_REF] Gagliardoni | Semantic Security and Indistinguishability in the Quantum World[END_REF], here if the adversary wants to make an encryption query in superposition, it is arguably better to "use" the standard oracle model, as the minimal oracle model requires a longer coherent time of the device, otherwise, the attacks might not work at all.

One might also ask whether the adversary can only prepare one message register per challenge query in the "real-or-random" notion is somehow limiting. [START_REF] Vincent Carstens | Relationships Between Quantum IND-CPA Notions[END_REF] shows that the currently known way to have 2 message registers per challenge query (as in the "left-or-right" paradigm) seems to be to consider the minimal oracle model if one wants to achieve a strong notion. Combining with Boneh-Zhandry's impossibility on defining "left-or-right" security in the standard model [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF], our notions might be the best we can hope for.

Semantic Security in the Quantum World. In the classical setting, semantic security [START_REF] Goldwasser | Probabilistic Encryption[END_REF], the computational complexity analogue to perfect security, is considered as the strongest possible security notion and is shown to be equivalent to all indistinguishability notion. Semantic security formulates that whatever can be efficiently computed (represented by a target function f target (•)) from the ciphertext and additional partial information about the plaintext (represented by a function f aux (•)) can be efficiently computed given only the length of the plaintext and the same partial information. Quantum semantic security was first studied in [START_REF] Gagliardoni | Semantic Security and Indistinguishability in the Quantum World[END_REF]. Albeit with some restrictions on the adversary, this notion is equivalent to the "left-or-right" indistinguishability notion in the minimal oracle model. However, we note that this equivalence does not imply that this "left-or-right" indistinguishability notion in the minimal oracle model is the strongest one, as we explained above (essentially, this follows from the results given in [START_REF] Vincent Carstens | Relationships Between Quantum IND-CPA Notions[END_REF]).

In the following, we show that a natural translation of semantic security to the quantum setting in the standard oracle model is unachievable. The impossibility follows essentially from the nature of the standard oracle model, in which each query is modeled as |x, y⟩ → |x, y ⊕ f (x)⟩. The crucial point here is that the adversary receives in the challenge phase not only the ciphertext but also the plaintext, that is (a superposition of) |x, y ⊕ Encrypt(x)⟩. This allows the adversary to output any value f target (x) for some target function f target (•). In the simulation, the simulator receives no encryption, but only the auxiliary state α on |x, y⟩, computed by some quantum circuit C aux on the plaintext state. We note that since the quantum circuit C aux is given by the adversary, C aux does not necessarily preserve the input registers |x⟩ (for example, take C aux a quantum circuit tracing out the input registers and outputting a constant). As such, the simulator has no information on the plaintext, while the adversary does. Thus there is no simulator that can simulate the adversary efficiently. This gives us some hints that defining a generic quantum semantic security might not be possible.

Quantum Encryption Approaches [START_REF] Alagic | Unforgeable Quantum Encryption[END_REF]. Since we now consider the adversary's challenge queries as quantum states, it may be tempting to think that the approaches from the literature on quantum encryption (that is, the problem of encrypting quantum data) would work here. The notorious "recording barrier" that we face in this work has arisen previously in the literature on quantum encryption. In particular, devising the notions of quantum ciphertext indistinguishability under adaptive chosen-ciphertext attack and quantum authenticated encryption [START_REF] Alagic | Unforgeable Quantum Encryption[END_REF] requires circumventing similar obstacles. However, [START_REF] Alagic | Unforgeable Quantum Encryption[END_REF] defines IND-CCA2 security for quantum encryption, which inherently requires the users to have quantum computers, while in this work, we focus on classical encryption that can be implemented on classical computers and only needs to be secure against quantum adversaries. We show below that indeed the approach of [START_REF] Alagic | Unforgeable Quantum Encryption[END_REF] would not help.

On a high level, an adversary A has negligible probability in distinguishing between two experiments: in the real one, it has access to encryption and decryption oracles with no restrictions, whereas in the random one, the challenge encryption oracle replaces A's queried plaintexts by random ones (half of a maximally-entangled state), and the decryption oracle answers with the originally queried plaintexts if the adversary asked for decryption of a challenge ciphertext (which can be done by first decrypting the ciphertext and applying a measurement on the entangled state), otherwise it answers normally. It is tempting to say that this approach resolves the problem of defining chosen-ciphertext security for the symmetric-key setting in the minimal oracle model. However, as explained above, the minimal oracle model does not support decryption queries, and it is not clear if this approach is compatible with the standard oracle model. In the context of standard oracles, this approach does not work unfortunately. The adversary can then use the same strategy to detect the random experiment's simulation: it prepares a maximally-entangled state |ϕ + ⟩ XX ′ and uses half of it (the registers X) as the challenge plaintext, and keeps X ′ . After receiving the challenge ciphertext, it measures the plaintext registers and X ′ , and trivially distinguishes whether it is in the random experiment. We note that this attack cannot be performed without relaying, that is the plaintext registers X need to be available to A after the challenge encryption. However, non-relaying is indistinguishable from being traced out the plaintext registers (from A's perspective). This inherently reduces to a definition with classical challenge queries, which defeats our goals.

How to Record Encryption Queries in the Random World?

The starting point towards our goal of defining indistinguishability-based security notions for encryption is to explain how the challenger should reply to quantum decryption queries in the second learning phase after the adversary has made the quantum encryption queries in the challenge phase. This implies explaining how it could record these quantum challenge queries. In this section, we show how this can be done in the random world.

Ciphertext Decomposition

For simplicity, let we denote the encryption algorithm as a function f that takes as input a plaintext x ∈ X , a randomness r ∈ R and outputs a ciphertext y ← f (x; r) ∈ Y. We also assume that the domain of f is X = {0, 1} m , its range is Y = {0, 1} n , and the randomness space R = {0, 1} ℓ . We make a convention that f (⊥) = 0, where ⊥ denotes some symbol outside the domain X and the range Y. We define ciphertext decomposition as follows.

Definition 3.1 -Ciphertext Decomposition

For a function f , for all messages x ∈ X , we write y := (y 1 ∥y 2 ) ← f (x; r) and define:

Message-independent: y 1 is message-independent if for all randomness r, there exists a function g such that y 1 := g(r). In other words, the message-independent component of the ciphertext can be computed solely from the randomness r, independent of the message x. Furthermore, we require that 0 ≤ |y 1 | ≤ |y|.

Message-dependent: y 2 is message-dependent if for all randomness r, there exists no function g such that y 2 := g(r). In other words, the message-dependent component of the ciphertext can not be computed solely from the randomness r. Furthermore, we require that 1 ≤ |y 2 | ≤ |y|.

We will also write f := f 2 • f 1 , where f 1 acts only on the randomness, and f 2 acts on both the randomness and the plaintext.

Remark 3.1. Our definition above can be defined for any encryption scheme, without losing of generality. Furthermore, it also does not exclude some artificial encryption scheme such that the encryption is deterministic when the plaintext x is some special value (for example, the secret key), that is, there exists a function g such that y 2 := g(x).

Remark 3.2. The definition of ciphertext decomposition is merely served as a technical step towards constructing the compressed encryption oracle in the random world in subsequent sections. We note that in an actual proof of security of an encryption scheme, one usually needs not to pay attention to this decomposition definition.

Oracle Variations

Here, we describe some oracle variations which will be used later in subsequent sections, the so-called standard oracle and Fourier oracle. These oracles and their equivalence are proven in much of literature on quantum-accessible oracles (e.g., see [KKVB02; CMSZ19; Zha19a]).

Standard oracles. For any function f with domain X = {0, 1} m and range Y = {0, 1} n , the standard oracle for f is a unitary defined as

StdO f x,y α x,y |x, y⟩ XY → x,y α x,y |x, y ⊕ f (x)⟩ XY . (3.2)
The standard oracle can also be implemented in the truth table form: for each query, the oracle's internal state consists of n2 m -qubit F registers containing the truth table of the function. For short, we write |f (0)∥ . . . ∥f (2 m -1)⟩ as |D⟩. Then, StdO f performs the following map (on the adversary's basis states):

StdO f |x, y⟩ XY ⊗ |D⟩ F → |x, y ⊕ D(x)⟩ XY |D⟩ F = |x, y ⊕ f (x)⟩ XY |D⟩ F (3.3)
The equivalence of these two oracle variations follows directly from the fact that for each query, if we trace out the oracle's internal registers, the mixed state of the adversary in both cases will be identical.

Fourier oracles. The Fourier oracle model FourierO f , while technically provides a different interface to the adversary, can be mapped to the standard oracle by QFT operations. The initial state of FourierO f is

QFT F |D⟩ F = 1 √ 2 n2 m E (-1) E•F |E⟩ F . ( 3.4)
On the basis states, the Fourier oracle FourierO f is defined as follows.

FourierO f |x, z⟩ XY ⊗ 1 √ 2 n2 m E (-1) E•D |E⟩ F → 1 √ 2 n2 m E (-1) E•D |x, z⟩ XY |E ⊕ P x,z ⟩ F . ( 3.5)
where P x,z is the point function that outputs z on x and 0 everywhere else. Intuitively, with the Fourier oracle, instead of adding data from the oracle's registers to the adversary's registers, it adds in the opposite direction.

Lemma 3.1 ([KKVB02; Zha19a]). For any adversary A making queries to StdO f , let B be the adversary that is identical to A, except it performs the Fourier transformation to the response registers before and after each query. Then

Pr A StdO f () = 1 = Pr B FourierO f () = 1 .
Proof. Each oracle can be constructed by an f -independent quantum circuit containing just one copy of the other, that is

QFT Y F • StdO f • QFT †Y F = FourierO f , (3.6) QFT †Y F • FourierO f • QFT Y F = StdO f . (3.7)

Recording Queries in the Random World

As we have explained in Section 3.1, to define chosen-ciphertext security, we follow the real-or-random paradigm. In this section, we show how to process queries and record them in the random world, in which before applying the encryption algorithm f , the challenger chooses a random function h and applies it to the plaintext registers. As such, we also denote the encryption procedure in the random world as f • h. In what follows, we abuse the notation and write f • h in the subscript of the oracle's notation with this meaning: for each query, a random function h is chosen uniformly by the oracle, so that h is not a pre-defined function. We note that the function f is known to the adversary though.

Single-query setting. We first start describing the oracle operations handling a single query and describe the general case later. Without loss of generality, we assume that the query's response register Y can be decomposed into two parts Y 1 , Y 2 , in which the first part corresponds to the messageindependent component, and the second part corresponds to the message-dependent component. Let

|Y 1 | := n 1 and |Y 2 | := n 2 where n 1 + n 2 = n.
In the standard oracle model, the encryption oracle is implemented by first sampling a randomness r, a function h : X → X uniformly at random, and then applying the encryption algorithm f on the input (h(x); r). From the adversary's point of view, this is equivalent to h being in uniform superposition h |h⟩ and performing the following map:

|x, y⟩ XY ⊗ |r⟩ R h |h⟩ H → h |x, y ⊕ f ((h(x)); r)⟩ XY |r⟩ R |h⟩ H . (3.8)
Augmenting the joint system with a uniform superposition register H is a purification of the adversary's mixed state, and tracing out H (i.e., projecting onto the one-dimensional subspace spanned by |h⟩) recovers the original mixed state. Moreover, this projection, which is outside of the adversary's view, is undetectable by any adversary A.

Using ciphertext decomposition definition, we can write Equation (3.8) as follows.

|x,

y 1 ∥y 2 ⟩ XY 1 Y 2 ⊗ |r⟩ R h |h⟩ H → h |x, (y 1 ∥y 2 ) ⊕ f (h(x); r)⟩ XY 1 Y 2 ⊗ |r⟩ R |h⟩ H = h |x, y 1 ⊕ f 1 (r), y 2 ⊕ f 2 (h(x); r)⟩ XY 1 Y 2 ⊗ |r⟩ R |h⟩ H .
(3.9)

We further note that, since the same randomness r is used for all "slots" in superposition, f 1 (r) is also the same for all "slots". In other words, f 1 (r) is just a classical value, which can be computed independently of the adversary's query. As a result, only the message-dependent registers are needed for recording queries. From now on to the rest of this section, we only consider the message-dependent parts in the adversary's response registers as well as the oracle's registers. These parts are denoted with index 2 in subscript (e.g., y 2 , z 2 , f 2 , . . .). Now we describe our compressed encryption oracles. We first introduce some local procedures acting on the oracle's side, possibly controlled by the adversary's registers. Let Decomp x be the identity operator except for

Decomp x   |r⟩ |x⟩ 1 √ 2 m u∈{0,1} m |u⟩ 1 √ 2 n 2 v (-1) f 2 (u;r)•v |v⟩   = |r⟩ |⊥⟩ |0⟩ |0⟩ , ( 3.10)
and

Decomp x (|r⟩ |⊥⟩ |0⟩ |0⟩) = |r⟩ |x⟩ 1 √ 2 m u∈{0,1} m |u⟩ 1 √ 2 n 2 v (-1) f 2 (u;r)•v |v⟩ . (3.11)
It is clear that Decomp x is a unitary operator. Furthermore, applying it twice results in the identity, thus Decomp x is an involution. Using the notion similar to the description of Zhandry's compressed random oracle in [START_REF] Zhandry | How to Record Quantum Queries, and Applications to Quantum Indifferentiability[END_REF], we introduce the notion of a database D that is maintained by the oracle as follows. A database D will be a collection of tuples (x, (x ′ , y)), where (x, (x ′ , y)) ∈ D corresponds to D(x) = (x ′ , y). We say D(x) = ⊥ if there is no such pair for an input x. For a database D with D(x) ̸ = ⊥, we also write D = {x, u, v} ∪ D ′ where D ′ (x) = ⊥. D consists of all the oracle's registers, except the randomness registers R. Decomp is then defined as the related unitary acting on the joint quantum system as follows.

Decomp |x, z 2 ⟩ ⊗ |r⟩ |D⟩ = |x, z 2 ⟩ ⊗ Decomp x |r⟩ |D⟩ .
(3.12)

Let Init be the procedure that samples a random r uniformly and initializes a new register |r⟩ |⊥, 0, 0⟩. Let FourierO ′ be unitary defined on the adversary's basis states as:

FourierO ′ |x, z 2 ⟩ ⊗ |r⟩ |D⟩ = FourierO ′ |x, z 2 ⟩ ⊗ |r⟩ 1 √ 2 m 1 √ 2 n 2 u,v (-1) v•f 2 (u;r) |{x, u, v} ∪ D ′ ⟩ = |x, z 2 ⟩ ⊗ |r⟩ 1 √ 2 m 1 √ 2 n 2 u,v (-1) v•f 2 (u;r) |{x, u, v ⊕ z 2 } ∪ D ′ ⟩ . (3.13)
Finally, we define the CFourierO f 2 •h oracle6 :

CFourierO f 2 •h := Decomp • FourierO ′ • Decomp • Init. (3.14)
We state the following lemma:

Lemma 3.2. In the single-query setting, the compressed Fourier oracle CFourierO f 2 •h acts on a basis state |x, z 2 ⟩ where x ∈ X and z 2 ∈ {0, 1} n 2 , as follows.

• If z 2 = 0, then CFourierO f 2 •h |x, z 2 ⟩ → |x, z 2 ⟩ ⊗ |r⟩ |⊥, 0, 0⟩. • If z 2 ̸ = 0, then CFourierO f 2 •h |x, z 2 ⟩ → |x, z 2 ⟩ ⊗ |ϕ x,z 2 ⟩, where |ϕ x,z 2 ⟩ := |r⟩ 1 √ 2 m+n 2 u v (-1) f 2 (u;r)•v |x, u, v ⊕ z 2 ⟩ .
Furthermore, for any adversary A making a single query to StdO f 2 •h , let B be the adversary that is identical to A, except it performs the Hadamard transformation H ⊗n to the response registers before and after the query. Then

Pr A StdO f 2 •h () = 1 = Pr B CFourierO f 2 •h () = 1 .
Proof. To prove the lemma, it is enough to show that CFourierO f 2 •h and FourierO f 2 •h are perfectly indistinguishable.

We prove this through a sequence of games. In what follows, we ambiguously denote QFT |f 2 (x; r)⟩ by |η x ⟩ for each x ∈ {0, 1} m . We will also take y ⊕ ⊥ = y, y • ⊥ = 0. When the adversary's response register is |+⟩ (which corresponds to |0⟩ in the Fourier basis), we can write, on the truth table of the oracle (for both FourierO f 2 •h and StdO f 2 •h ), the column with index x where x is the query's input as ⊥.

Game G 0 : In this game, the adversary interacts with the Fourier oracle FourierO

f 2 •h , whose initial state is |r⟩ 1 √ 2 m2 m h |(h(0), η h(0) )∥ • • • ∥(h(2 m-1 ), η h(2 m -1) )⟩.
Game G 1 : In this game, we represent the oracle in the form:

|r⟩ 1 √ 2 m2 m h |(0, h(0), η h(0) )∥ • • • ∥(2 m -1, h(2 m-1 ), η h(2 m -1) )⟩ .
The update procedure for a query is then simply FourierO ′ . G 1 is identical to G 0 , since we have inserted the input points 0, . . . , 2 m -1 into the oracle's state, which is independent of the adversary's state.

Game G 2 : In this game, the oracle starts out as the "zero" database:

|r⟩ |(⊥, 0, 0)∥ • • • ∥(⊥, 0, 0)⟩ .
Then a query is implemented as

Decomp ′ † • FourierO ′ • Decomp ′ , where Decomp ′ := 2 m -1 i=0 Decomp i .
At the beginning, Decomp ′ is applied to the "zero" database, which maps it to the complete database

|r⟩ 1 √ 2 m2 m h |(0, h(0), η h(0) )∥ • • • ∥(2 m -1, h(2 m-1 ), η h(2 m -1) )⟩ .
Then FourierO ′ is applied and the output state of G 2 in this stage will be exactly the output state of G 1 . Since Decomp ′ † is a unitary that only operates on the oracle's register, its applications is undetectable to the adversary. So G 2 is perfectly indistinguishable from G 1 .

Game G 3 : In this final game, we use the compressed oracle CFourierO f 2 •h . Let x be the query's input. We note that FourierO ′ and Decomp x ′ commute for any x ′ ̸ = x. Thus, we can move the computation of Decomp x ′ to come after FourierO ′ , consequently, its applications cancel out. We then have:

Decomp ′ † • FourierO ′ • Decomp ′ (|x, z⟩ ⊗ |r⟩ |D⟩) = Decomp † x • FourierO ′ • Decomp x (|x, z⟩ ⊗ |r⟩ |D⟩) = Decomp † • FourierO ′ • Decomp(|x, z⟩ ⊗ |r⟩ |D⟩).
We are left with a database D whose support has at most 1 defined point after the query in G 2 . The remaining ≥ 2 m -1 points are all (⊥, 0, 0). So we may end up with a superposition of databases that have at most one defined point. We then can move this defined point in the database to the first register (this is a unitary operator and is undetectable to the adversary) and obtain a superposition of databases that have a defined point only in the first register. Therefore we can discard all but the first register, without affecting the adversary's state. This shows that G 3 and G 2 are identical.

The compressed Fourier encryption oracle in the random world CFourierO f •h is straightforwardly obtained by running the message-independent function f 1 on the randomness r, transforming it to the Fourier basis and then composing it with

CFourierO f 2 •h . Formally, CFourierO f •h := (QFT F 1 U R f 1 ) • CFourierO f 2 •h .
We then have Lemma 3.3. For any adversary A making a single query to StdO f •h , let B be the adversary that is identical to A, except it performs the Hadamard transformation H ⊗n to the response registers before and after the query. Then Pr

A StdO f •h () = 1 = Pr B CFourierO f •h () = 1 .
Compressed standard encryption oracles. By applying Hadamard to the adversary's response registers before and after the query, and to the oracle's register F after the query, we also obtain the compressed standard encryption oracle CStO f •h . The oracle's state after the query is (in superposition of) |r, x, u, f

(u; r)⟩. Formally, CStO f •h := QFT Y F • CFourierO f •h • QFT Y .
By applying the same argument as in Lemma 3.1 to CFourierO f •h and CStO f •h , and combining with Lemma 3.3, the following lemma follows:

Lemma 3.4. CStO f •h and StdO f •h are perfectly indistinguishable. That is, for any adversary A, we have that Pr A StdO f •h () = 1 = Pr A CStO f •h () = 1 .
Many-query setting. We denote CStO f •H as the following oracle: for each query, CStO f •H invokes a new instance of CStO f •h with uniformly and independently randomness r. Similarly, StdO f •H denote the following oracle: for each query, StdO f •H samples uniformly and independently a randomness r and a random function h, and then answers that query using StdO f •h . By the standard hybrid argument, it is easy to verify that: Lemma 3.5. CStO f •H and StdO f •H are perfectly indistinguishable, in the many-query setting.

For each i-th query, its oracle's database is

|D i ⟩ := |x i , u i , f (u i ; r i )⟩.
Overall, the oracle's database D will be a collection of many tuples (x, (x ′ , y)) where (x, (x ′ , y)) ∈ D means f (x ′ ; r) = y and h(x) = x ′ for different random functions h.

A Technical Observation

Notice that from the proof of Lemma 3.2 above, we implement this compressed encryption oracle with at least two computations of f 2 (and so f ) via two applications of Decomp. However, as we will see in later sections, it is crucial for our security reductions to simulate CFourierO f •h with only one computation of f , which allows us to "outsource" f computations to other oracles. We now give an intuition why we can reduce many computations of f to one computation. Let's consider the following cases.

• The z 2 registers are all-zero. Note that since the initial state of the oracle database D is also all-zero, applying the first Decomp and then XORing the adversary's registers to the oracle's (i.e., the application of FourierO ′ ) does not change the database's state. Finally, the second application of Decomp brings it back to all-zero state, which can be discarded. At the end of this step, D is empty. In this case, we see that we can skip FourierO ′ , and two applications of Decomp cancel out, leaving us no applications of f .

• The z 2 registers are not zero. By a similar argument, we have that the second application of Decomp has no effects on the joint system, leaving us only one application of f in the first application of Decomp.

We describe a quantum circuit in Figure 3 The bit b will be discarded after the computation.

How to Answer Decryption Queries?

We now describe how to answer decryption queries in the random world using the database constructed above. Generally, we will consider any δ-correct encryption scheme (see Definition in Section 2.3.3).

We will start with a technical lemma, in which the decryption will answer "naively", that is if the ciphertext is f (x ′ ; r) for some x ′ , the decryption oracle is expected to return x ′ , even if x ′ was the output of a random function. (Roughly speaking, this decryption oracle mimics a standard decryption oracle with no restrictions on the adversary.) We call this decryption oracle the naive decryption oracle.

In the following, we abuse the notation and denote f -1 as the decryption algorithm. We then give the adversary access to a new oracle denoted CInvO f -1 (this is our naive decryption oracle) which acts on the database, instead of StdO f -1 . Given access to CInvO f -1 , the bound on the distinguishing probability of the adversary when interacting with the compressed oracle CStO f •H is stated in Lemma 3.6.

We define a classical procedure FindImage ′ which takes as input a ciphertext y ∈ Y, and a database D. Then, it looks for a tuple (x, (x ′ , y)) ∈ D. If found, it outputs (b = 1, w = x ′ ), otherwise, it outputs (b = 0, w = 0). Notice that there may be many tuples with the same y in D, but since an encryption scheme must be injective (for decryption to work), these pairs must have the same x ′ .

We define the unitary operation CInvO f -1 for the inverse queries which maps the basis state |y, z⟩ ⊗ |D⟩ to:

   U f -1 |y, z⟩ ⊗ |D⟩ = |y, z ⊕ f -1 (y)⟩ ⊗ |D⟩ if FindImage ′ (y, D) = (0, 0), |y, z ⊕ w⟩ ⊗ |D⟩ if FindImage ′ (y, D) = (1, w).
This unitary is implemented by a single call to f -1 , controlled by the output bit b of FindImage ′ recorded in some ancilla registers.7

Lemma 3.6. For any (unbounded) oracle algorithm A, and any δ-correct encryption scheme:

Pr A StdO f •H ,StdO f -1 () = 1 -Pr A CStO f •H ,CInvO f -1 () = 1 ≤ O(q i • δ), (3.15)
where q i is the number of inverse queries.

Proof. We prove this lemma through a sequence of games.

Game G 0 : This is the game where A interacts with the standard oracles

StdO f •H and StdO f -1 .
Game G 1 : This is identical to G 0 , except that now the oracle StdO f •H is simulated using the compressed oracle CStO f •H . Notice that StdO f -1 operation does not touch the database registers, thus it commutes with any

CStO f •h operation. Since CStO f •H is equivalent to the standard oracle StdO f •H , A cannot distinguish G 1 and G 0 . Game G 2 : This is identical to G 1 , except that now the oracle StdO f -1 is replaced by the oracle CInvO f -1 .
Let |Ψ⟩ be the joint system state of the adversary and the oracle before making any inverse query. Denote ∆ := StdO f -1 -CInvO f -1 . For each query |y, z⟩ to the inverse oracle, we consider the registers y, z, D. We now examine three cases.

(a) Let D be such that y / ∈ D, that is, FindImage(y, D) = (0, 0). Let P 1 be the projection onto the registers y, D such that y / ∈ D. In this case, the inverse oracle in both games applies the unitary mapping |y, z⟩

⊗ |D⟩ → |y, z ⊕ f -1 (y)⟩ ⊗ |D⟩. Thus, ∆P 1 |Ψ⟩ = 0.
(b) Let D be such that y ∈ D, that is, FindImage(y, D) = (1, w). Let P 2 be the projection onto the registers y, D such that y ∈ D and f -1 (y) = w. In this case, we also have

∆P 2 |Ψ⟩ = 0.
(c) Let D be such that y ∈ D. Let P 3 be the projection onto the registers y, D such that y ∈ D but f -1 (y) ̸ = w. Thus ∥P 3 |Ψ⟩∥ 2 is the probability of measuring y, D and get y ∈ D such that f -1 (y = f (x)) ̸ = x for some pre-image x of y. In this case, we have ∥∆P 3 |Ψ⟩∥ 2 ≤ δ, by the definition that the encryption scheme is δ-correct.

Notice that P 1 + P 2 + P 3 = I. Therefore, we have

∥∆ |Ψ⟩∥ 2 = 3 i=1 ∆P i |Ψ⟩ 2 ( * ) ≤ 3 i=1 ∥∆P i |Ψ⟩∥ 2 ≤ δ, ( 3.16)
where ( * ) uses triangle inequality. Then the same holds true for any mixed state since any mixed state is in the convex hull of pure states. If A makes at most q i inverse queries, the trace distance of the mixed state of the adversary in games G 2 and G 1 is at most O(q i • δ). This completes the proof. Now we describe our actual decryption oracle in the random world. Instead of using FindImage ′ which returns (1, x ′ ), we use an identical FindImage except that it returns (b = 1, w = x) when (x, (x ′ , y)) ∈ D. The oracle CInvO f -1 is redefined using FindImage as follows. It maps the basis state |y, z⟩ ⊗ |D⟩ to:

   U f -1 |y, z⟩ ⊗ |D⟩ = |y, z ⊕ f -1 (y)⟩ ⊗ |D⟩ if FindImage(y, D) = (0, 0), |y, z ⊕ w⟩ ⊗ |D⟩ if FindImage(y, D) = (1, w).

Notation

From now on to the rest of this chapter, we will use the following notation:

• O to denote the standard encryption and decryption oracles StdO (which are distinguished by subscript, e.g., O SymEnc for encryption and O SymDec for decryption) in the real world.

• R to denote the compressed encryption and decryption oracles (which are distinguished by subscript, e.g., R SymEnc for encryption and R SymDec for decryption) in the random world. In particular, the encryption one will be implemented using CStO, and the decryption one using CInvO.

3.3 Quantum-Secure Symmetric Encryption

Definitions of Security

In this section, we use the compressed oracle technique defined above to define quantum real-or-random indistinguishability security notions.

High-level view. During the learning phases, A has access to the encryption standard oracle O SymEnc(k,•) . In the CCA case, it also has access to O SymDec(k,•) in the first learning phase. We describe informally how we handle the challenge phase and the decryption queries in the second learning phase. The goal is to mimic the (purely) classical CCA security game in which: A gives a challenge plaintext and receives either encryption of it or encryption of a random message; during the second learning phase, if A makes a decryption query on the challenge ciphertext, it is given back the challenge plaintext in both games.

In the real-world (b = 1), the adversary has no restrictions on the use of the decryption oracle (in particular, A can freely decrypt the challenge ciphertext -getting back the challenge plaintext, as in the classical case), so that the encryption oracle is simply implemented as the standard encryption oracle O SymEnc(k,•) and the decryption oracle as the standard decryption oracle O SymDec(k,•) .

In the random-world (b = 0), the challenger implements the challenge encryption oracle using a compressed encryption oracle R SymEnc(k,•) , and the decryption oracle in the second phase R SymDec(k,•) as described in Section 3.2.5. As in the real-world, this decryption oracle always returns the original plaintext (x) if the query is a challenge one, using the database. Otherwise, it just decrypts normally.

Formal definitions. Formally, denote A = (A 1 , A 2 ). In both games, A 1 outputs an internal state |Φ⟩ after the first phase (i.e., the first learning phase), which will be given to A 2 in the second phase (including the challenge and the second learning phase). We define a "real-or-random" oracle RR allowing A 2 to make quantum challenge queries. For learning queries, A 2 has access to O SymEnc(k,•) and potentially a decryption oracle DEC defined as follows.

RR(b) =    O SymEnc(k,•) if b = 1 R SymEnc(k,•) if b = 0 , and DEC(b) =    O SymDec(k,•) if b = 1 R SymDec(k,•) if b = 0 .
Definition 3.2 -Quantum Indistinguishability for Symmetric Encryption Let SE := ⟨K, SymEnc, SymDec⟩ be a symmetric encryption scheme and let A := (A 1 , A 2 ) be a quantum adversary. For qatk ∈ [qcpa, qcca1, qcca2], we define the following game, where the oracles O 1 , O 2 are defined according to qatk:

Experiment Expt qind-qatk-b SE (λ, A): 1 : k $ ← K(1 λ ) 2 : |Φ⟩ ← A |O SymEnc(k,•) ⟩,|O 1 ⟩ 1 (1 λ ) 3 : b ′ ← A |RR(b)⟩,|O SymEnc(k,•) ⟩,|O 2 ⟩ 2 (|Φ⟩) 4 : return b ′ qatk qcpa qcca1 qcca2 Oracle O 1 ∅ O SymDec(k,•) O SymDec(k,•) Oracle O 2 ∅ ∅ DEC(b)
We define A's advantage by

Adv qind-qatk A,SE (λ) := Pr Expt qind-qatk-1 SE (λ, A) = 1 -Pr Expt qind-qatk-0 SE (λ, A) = 1 .
We say SE is secure in the sense of qIND-qatk if A being QPT implies that Adv qind-qatk

A,SE (λ) is negligible.
Equivalence with Boneh-Zhandry's notions. To justify our notions, we show that when restricting our definitions to classical challenge queries, they are equivalent to Boneh-Zhandry's notions (IND-qatk). If we denote our restricted notions by

IND-qatk ′ , a scheme SE is IND-qatk ′ secure iff it is IND-qatk secure.
Indeed, because the challenge queries are classical, the simulator can store the challenge plaintexts and the challenge ciphertexts. Any simulator that returns ⊥ if the adversary submits a challenge ciphertext in the sense of IND-qatk can be turned to a simulator that returns the original plaintext x in the sense of IND-qatk ′ , and vice versa. More precisely, we have that:

Adv ind-qatk A,SE (λ) ≤ 2 • Adv ind-qatk ′ A,SE (λ), and Adv ind-qatk ′ A,SE (λ) ≤ Adv ind-qatk A,SE (λ).
(3.17)

This follows from the standard argument (see [START_REF] Bellare | A Concrete Security Treatment of Symmetric Encryption[END_REF]).

Single-message versus many-message security. We have presented definitions which allow the adversary to make q(λ)-many challenge queries to the real-or-random oracle. A scheme satisfying the definitions in the case when q(λ) = 1 is said to be single-message secure. The question of whether single-message security implies many-message security is the question of composability of the definitions, which is answered affirmatively below.

Theorem 3.1. A symmetric encryption scheme SE is many-message qIND-qatk secure iff it is single-message qIND-qatk secure.

Proof. The forward implication follows directly.

For the reverse direction, we use the standard hybrid argument that uses an adversary

A = (A 1 , A 2 ) with advantage ε to construct a new adversary B = (B 1 , B 2 ) which breaks the single-message security with advantage ε/q 2 .
Define a sequence of games G 0 , . . . , G q in which B runs A and returns A's output as follows: For any game G i , 1. B 1 simulates A's i -1 first challenge queries as learning queries, that is, B just forwards A's directly to its encryption oracle.

2. B uses A's i-th challenge query as its challenge query.

3. For all A's other challenge queries, B 2 treats them as encryption queries in the random world. In particular, it implements the encryption oracle for A using the compressed oracle R SymEnc , except that it queries to its own encryption oracle as a learning query during the oracle implementation. We note that this is possible as explained in Section 3.2.3.

In the case of CCA2 security, B 2 needs to be able to record A's (i + 1, . . . , q)-th challenge queries, since it needs to simulate the decryption correctly. This is done by using our recording technique as described. B 2 also uses a slightly different decryption oracle in the random world in the second phase as follows. Let R ′ SymDec be the decryption oracle of B 2 in the random world in the second phase, D be its database for the challenge query, and R SymDec be B 2 simulated decryption oracle for A. Then

R SymDec |y, z⟩ |D⟩ =    R ′ SymDec |y, z⟩ |D⟩ if FindImage(y, D) = (0, 0 m ), |y, z ⊕ w⟩ |D⟩ if FindImage(y, D) = (1, w).
This oracle can be implemented identically as described in Section 3.2.5, except that instead of applying f -1 , it sends a decryption query on the y, z registers to

R ′ SymDec . Note that G 0 = Expt qind-qatk-1 SE (λ, A) and G q = Expt qind-qatk-0 SE (λ, A). Because A is able to distinguish Expt qind-qatk-1 SE from Expt qind-qatk-0

SE

, there exists some g ∈ 1, q such that A distinguishes G g from G g+1 with advantage at least ε/q. B can guess g correctly with probability 1/q, thus B's overall advantage in breaking the single-message security is ε/q 2 .

A Separation Example

We show that upgrading from classical challenge queries to quantum challenge queries gives the adversary more power. In particular, we show that the IND-qCCA2 secure symmetric encryption scheme given by Boneh and Zhandry [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF] is insecure once the adversary can make even a single quantum challenge query in the sense of chosen plaintext security (qIND-qCPA). Our attack can be considered as an impossibility to achieve quantum indistinguishability for encryption schemes which follow the stream cipher-like paradigm (such as stream ciphers, block cipher modes of operation including CFB, OFB, CTR, or even some most widely used modes like GCM for authenticated encryptions). Theorem 3.2. Under the assumption that quantum-secure pseudorandom functions exist, there is an encryption scheme SE which is IND-qCCA2 secure, but qIND-qCPA insecure.

Proof. We recall Boneh-Zhandry construction as follows.

Construction 3.1 -Boneh-Zhandry's construction [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF] Let F and G be quantum-secure pseudorandom functions. We construct the following encryption SE := ⟨K, SymEnc, SymDec⟩ where:

K(1 λ ) : 1 : k 1 $ ← {0, 1} λ 2 : k 2 $ ← {0, 1} λ 3 : return k 1 ∥k 2 SymEnc(k 1 ∥k 2 , x) : 1 : r $ ← {0, 1} λ 2 : c 1 ← F (k 1 , r) ⊕ x 3 : c 2 ← G(k 2 , (r, x)) 4 : return r∥c 1 ∥c 2 SymDec(k 1 ∥k 2 , r∥c 1 ∥c 2 ) : 1 : x ← c 1 ⊕ F (k 1 , r) 2 : c ′ 2 ← G(k 2 , (r, x)) 3 : if c 2 ̸ = c ′ 2 then 4 :
return ⊥ To show the qIND-qCPA insecurity of this scheme, we establish the following quantum computation. Let U OTP be the unitary implementing the one-time pad encryption, but using the same classical randomness r (which is uniformly chosen beforehand) in superposition. For fixed x 0 , x 1 ∈ {0, 1} m , we prepare the following state:

|ψ 1 ⟩ := 1 √ 2 (|x 0 ⟩ + |x 1 ⟩) |0 m ⟩ . (3.18)
Applying U OTP yields:

|ψ 2 ⟩ := 1 √ 2 b∈{0,1} |x b , x b ⊕ r⟩ . (3.19)
Then we apply a Hadamard transform to 2m qubits in all the registers. This yields the state:

|ψ 3 ⟩ := 2 -2m+1 2 b u∈{0,1} m (-1) x b •u |u⟩ v∈{0,1} m (-1) (x b ⊕r)•v |v⟩ = 2 -2m-1 2 u,v δ u•(x 0 ⊕x 1 ),v•(x 0 ⊕x 1 ) (-1) x 0 •u⊕(x 0 ⊕r)•v |u, v⟩ . (3.20)
If we measure |ψ 3 ⟩, with probability 1, we get a random pair (u, v) such that

u • (x 0 ⊕ x 1 ) = v • (x 0 ⊕ x 1 ). (3.21)
If we apply a random function h to the first registers x b of |ψ 1 ⟩ before applying U OTP and then un-compute it, we get the following state:

|ψ ′ 2 ⟩ := 1 √ 2 b∈{0,1} |x b , h(x b ) ⊕ r⟩ . (3.22)
Continue with the Hadamard transform as above yields:

|ψ 3 ⟩ := 2 -2m-1 2 u,v δ u•(x 0 ⊕x 1 ),v•(h(x 0 )⊕h(x 1 )) (-1) x 0 •u⊕(h(x 0 )⊕r)•v |u, v⟩ . (3.23) Measuring |ψ ′ 3 ⟩ yields a random pair (u, v) such that u • (x 0 ⊕ x 1 ) = v • (h(x 0 ) ⊕ h(x 1
)) where h(x b ) are random m-bit strings. Thus, Equation (3.21) satisfies with probability at most 1 2 . It is now easy to see that: Lemma 3.8. SE is qIND-qCPA insecure.

Proof. In the challenge phase, the adversary A chooses two fixed messages x 0 , x 1 , and prepares the following state as its challenge:

|ψ⟩ := 1 √ 2 b |x b ⟩ |0⟩ R |0⟩ F |+⟩ G . (3.24)
The challenge ciphertext state will be:

|ψ 0 ⟩ = 1 √ 2 b |x b ⟩ |r⟩ F |x b ⊕ F (k 1 , r)⟩ F |+⟩ G if b = 0, (3.25)
or

|ψ 1 ⟩ = 1 √ 2 b |x b ⟩ |r⟩ R |h(x b ) ⊕ F (k 1 , r)⟩ F |+⟩ G if b = 1. (3.26)
Since r is a classical value, A can discard two registers R and G, which are separate from the others. A then applies the Fourier sampling (i.e., Hadamard transform followed by a measurement as described above), and outputs 1 if Equation (3.21) is satisfied, otherwise it outputs 0. We have Pr Expt qind-qcpa-1

SE (λ, A) = 1 = 1 and Pr Expt qind-qcpa-0 SE (λ, A) = 1 ≤ 1 2 , thus Adv qind-qcpa A,SE (λ) ≥ 1 2
, which is certainly not negligible.

Feasibility of Quantum CCA2 Security

The classical Encrypt-then-MAC paradigm [START_REF] Bellare | Chanathip Namprempre: Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm[END_REF] shows that an IND-CPA secure symmetric encryption scheme can be made IND-CCA2 secure if combined with an EUF-CMA MAC scheme. However, it is not obvious how to prove security in the quantum setting, as the reduction algorithm has no way to tell which ciphertexts the adversary received as the result of an encryption query in the learning phases, and no way to decrypt the ciphertexts if it has received them. To remedy these problems, we choose a specific type of MAC scheme in the construction (that is, any quantum-secure PRF) and leave the general security proof as an open question. The encryption scheme can be instantiated with any qIND-qCPA encryption scheme. In the proof, we simulate the MAC with random oracle and use Zhandry's compressed oracles technique to efficiently check if the adversary has seen a particular ciphertext as a result of an encryption query, and to decrypt in this case.

Construction 3.2 -Encrypt-then-MAC

Let SE := ⟨K, SymEnc, SymDec⟩ be a symmetric encryption scheme and qPRF be a family of quantum-secure pseudorandom functions. A composition of base schemes SE and qPRF is the symmetric encryption scheme SE ′ := ⟨K ′ , SymEnc ′ , SymDec ′ ⟩ whose constituent algorithms are defined as follows.

K ′ (1 λ ) :

1 : k 1 $ ← K(1 λ ) 2 : k 2 $ ← {0, 1} λ 3 : return k 1 ∥ k 2 SymEnc ′ (k 1 ∥ k 2 , x) : 1 : c ← SymEnc(k 1 , x) 2 : τ ← qPRF(k 2 , c∥x) 3 : return c ∥ τ SymDec ′ (k 1 ∥ k 2 , c ∥ τ ) : 1 : x ← SymDec(k 1 , c) 2 : if qPRF(k 2 , c∥x) ̸ = τ then 3 : return ⊥ 4 : return x Theorem 3.3.
Let SE be a qIND-qCPA secure symmetric encryption scheme. Let qPRF be a family of quantum-secure pseudorandom functions. Then the encryption scheme SE ′ defined in Construction 3.2 is qIND-qCCA2 secure.

Remark 3.3. As shown in [START_REF] Zhandry | How to Construct Quantum Random Functions[END_REF], quantum-secure PRFs can be constructed from quantum-secure one-way functions. In addition, [START_REF] Gagliardoni | Semantic Security and Indistinguishability in the Quantum World[END_REF][START_REF] Vincent Carstens | Relationships Between Quantum IND-CPA Notions[END_REF] shows how to construct qIND-qCPA secure encryption schemes from quantum-secure pseudorandom permutations.

Proof. We proceed using hybrid games. Let A be a QPT adversary. For any game G index , we denote by Game G 1 : This is identical to G 0 , except that we use, in the role of qPRF, a random function H. (Imagine that the reduction has oracle access to H and uses it in the role of qPRF, notice that the key k 2 is chosen uniformly at random and hidden from A.) By security of qPRF, we have that

Pr[G index ] := |Pr[G index (A) = 1 | b = 1] -Pr[G index (A) = 1 | b = 0]|.
|Pr[G 1 ] -Pr[G 0 ]| ≤ negl(λ).
Game G 2 : This is identical to G 1 , except that now we consider H as being implemented in Zhandry's compressed standard random oracle.

We give a description of how this compressed random oracle is implemented. A query to the compressed random oracle is in (superposition of) the form |c∥x⟩ |y 2 ⟩ where the second register is the second part of the adversary's response registers. Furthermore, since the compressed oracle for the encryption makes only one black-box call to the unitary implementing the encryption algorithm for each challenge query, there is also only a single call to the compressed random oracle for each challenge query.

Let E denote the database of this compressed random oracle. In more details, E will be a collection of (c∥x, τ ) pairs. For a pair (c, τ ) such that there is a pair (c∥x, τ ) ∈ E, we call w = x an associated input of (c, τ ).

Since the compressed random oracle is equivalent to the standard random oracle, this does not affect the adversary's success probability. We have that Pr

[G 2 ] = Pr[G 1 ].
Game G 3 : This is identical to G 2 , except now we make the following modification to the decryption oracle in the random world.

In the following, we take the notation as in Lemma 2.6. We define the relation R H c to be the set of all (x, τ ) such that x = SymDec(c) ∧ H(c∥x) = τ . Since SymEnc has perfect correctness, for each c there is only one decryption x, and thus Γ R H c = 1. Given the relation R H c , the projectors Σ x c for x ∈ X and Σ ⊥ c are defined as in Lemma 2.6. Now the measurement M := {Σ x c } x∈X ∪{⊥} checks whether there exists a pair in the database E satisfying the relation R H c or not. (Note that there is at most one pair satisfying the relation for each c.) Let M c E,P be the following purified measurement corresponding to M:

M c E,P |y, z⟩

→ x∈X ∪{⊥} Σ x c |y⟩ E |z ⊕ x⟩ P ,
where E is the registers of the database E and P is some ancilla registers. We define the unitary M E,P that operates on the ciphertext, the registers E and P as:

M E,P |c∥τ ⟩ |y, z⟩ E,P → |c∥τ ⟩ ⊗ M c E,P |y, z⟩ E,P .
Note that M E,P is an evolution.

The modification is as follows. For each decryption query, if FindImage D returns (0, 0) the decryption oracle in the random world R 3 SymDec ′ (k,•) first applies the unitary M E,P with the ancilla register P initialized to 0. Then it executes SymDec ′ (k, •). Finally it applies M E,P again.

R 3 SymDec ′ (k,•) |y, z⟩ |D⟩ |E⟩ :=    M E,P • SymDec ′ • M E,P |y, z⟩ |D⟩ |E⟩ if FindImage D (y, D) = (0, 0), |y, z ⊕ w⟩ |D⟩ |E⟩ if FindImage D (y, D) = (1, w),
By Lemma 2.6, we have that M E,P and SymDec ′ almost commute: their commutator is bounded by 8

√ 2 • 2 -ℓ 2
, where ℓ is the output's length of qPRF, which is polynomial in the security parameter. Hence, we can swap M E,P and SymDec ′ in the implementation of R 3 SymDec ′ (k,•) and recover R 2 SymDec ′ (k,•) (note that M E,P is an evolution). The distinguishing probability of this modification is exactly the commutator's bound, and thus the two hybrids are distinguishable to the adversary with probability at most 8

√ 2 • 2 -ℓ 2 . This shows that |Pr[G 3 ] -Pr[G 2 ]| ≤ negl(λ).
Game G 4 : This is identical to G 3 , except we change how decryption queries are answered in the random world when FindImage D returns (0, 0). In this case, the oracle first applies M E,P with the register P initialized to 0. Then, it XORs the value of P to the response register. It finally applies M E,P again.

R 4 SymDec ′ (k,•) |y, z⟩ |D⟩ |E⟩ :=    M E,P U k M E,P |y, z⟩ |D⟩ |E⟩ if FindImage D (y, D) = (0, 0), |y, z ⊕ w⟩ |D⟩ |E⟩ if FindImage D (y, D) = (1, w),
where U k is defined as

U k |y, z⟩ |D⟩ |E⟩ E |x⟩ P :=    |y, z ⊕ ⊥⟩ |D⟩ |E⟩ E |x⟩ P if x = ⊥, |y, z ⊕ x⟩ |D⟩ |E⟩ E |x⟩ P if x ̸ = ⊥.
The only difference between G 4 and G 3 is the definition of R SymDec ′ (k,•) , and that the adversary can distinguish between the two hybrids if and only if it sends a query in which y ∈ E \ D or y / ∈ D ∪ E with non-negligible weight. This is because if y ∈ D then in both hybrids, the original plaintext x was returned.

(i) We first consider the case in which y ∈ E \ D. First, we notice that for challenge queries, the challenger only queries the compressed random oracle H if it can record the query (see Figure 3.1). Thus, if y ∈ E \ D, in G 3 , SymDec ′ is used to answer the queries, while in G 4 , M E,P is used to answer the queries. However, SymDec ′ and M E,P return the same output in this case.

(ii) Consider the case in which y / ∈ D ∪ E. The query is answered with ⊥ in G 4 and using SymDec ′ in G 3 . If SymDec ′ returns x ̸ = ⊥, then the two hybrids are distinguishable. However, this means that the adversary must be able to procedure a ciphertext c∥τ ̸ ∈ E such that SymDec ′ (k, c∥τ ) ̸ = ⊥. Since the underlying encryption scheme SE never outputs ⊥, it means that the adversary was able to produce a pair ( c∥ x, τ ) ̸ ∈ E such that H( c∥ x) = τ . Let Forge be the event that at least one of the decryption queries in the random world contains some pairs ( y = c∥ τ ) with overall non-negligible weight such that H( c∥ x) = τ / ∈ E. A could distinguish the two games if and only if Pr[Forge] is non-negligible. We construct a QPT adversary C from A that breaks Lemma 2.7 if Forge happens with non-negligible probability. Assume that the adversary A makes at most q queries to the random oracle (by making queries to the encryption and decryption oracle). C runs A as its subroutine, and randomly measures one of A's decryption queries in the second phase. C would then obtain a pair that is not in E with probability p in Lemma 2.7 such that p = Pr [Forge] q . Since the obtained pair is not in E, the probability p ′ is 0. If Pr[Forge] is non-negligible, p is also non-negligible. This breaks the bound given in Lemma 2.7.

Overall, the two hybrids are identical except for the last case in which y / ∈ D∪E. However, in this case, the two hybrids are distinguishable with at most negligible probability. This shows that:

|Pr[G 4 ] -Pr[G 3 ]| ≤ negl(λ).
Game G 5 : We define a procedure FindImage E over the database E similar to the one defined over D, except that it takes as input a pair ((c, τ ), E), searches over the database E and returns (1, w) where w is the associated input of (c, τ ) if τ ∈ E and (0, 0) otherwise. This hybrid is identical to G 4 , except that in the random world, the decryption oracle in the second phase R SymDec ′ (k,•) is implemented as follows.

R 5 SymDec ′ (k,•) |y, z⟩ |D⟩ |E⟩ :=                        |y, z ⊕ w⟩ |D⟩ |E⟩ if FindImage D (y, D) = (1, w), |y, z ⊕ ⊥⟩ |D⟩ |E⟩ if FindImage D (y, D) = (0, 0) ∧ FindImage E (y, E) = (0, 0), |y, z ⊕ w ′ ⟩ |D⟩ |E⟩ if FindImage D (y, D) = (0, 0) ∧ FindImage E (y, E) = (1, w ′ ).
By the correctness of SE ′ , it must be the case that if FindImage E returns (1, w ′ ), M E,P should have the same w ′ in the register P . Similarly, if FindImage E returns (0, 0), M E,P should have ⊥ in P . Therefore, these two hybrids are identical, that is

Pr[G 5 ] = Pr[G 4 ].
Game G 6 : This is identical to G 5 , except that in the real world, the decryption oracle in the second phase O SymDec ′ (k,•) is implemented as follows.

O 6 SymDec ′ (k,•) |y, z⟩ |E⟩ :=    |y, z ⊕ ⊥⟩ |E⟩ if FindImage E (y, E) = (0, 0), |y, z ⊕ w⟩ |E⟩ if FindImage E (y, E) = (1, w).
We can consider intermediate hybrids that make similar changes as in G 3-6 for the real world. By the same argument (except that now we do not have the database D in the real world, hence the arguments in G 4 is simplified), we also have that

|Pr[G 6 ] -Pr[G 5 ]| ≤ negl(λ).
Note that from this hybrid, the decryption algorithm SymDec ′ is no longer needed. Game G 7 : This is identical to G 6 , except that in the random world, for each challenge encryption query, instead of applying the random oracle H on c∥x ′ (where c = SymEnc(k 1 , x ′ ) for some random x ′ ∈ X ), we apply H on c∥x, where x is the original plaintext. Formally, the challenge encryption oracle R SymEnc ′ implements the following mapping:

|x, y 1 ∥y 2 ⟩ → |x, (y 1 ⊕ c)∥(y 2 ⊕ H(c∥x))⟩ ⊗ |x, x ′ , c∥H(c∥x)⟩ D , where c = SymEnc(k 1 , x ′ ) for some random x ′ ∈ X .
We note that the implementation of this oracle is similar to its implementation in G 6 (as described in Figure 3.1), except that the unitary U f 2 (corresponding to the unitary of the encryption procedure) acts on four registers (including the original plaintext register): instead of using c∥x ′ (for some random x ′ where c = SymEnc(k 1 , x ′ )) as the input to the compressed random oracle H, we use c∥x (where x comes from the adversary's input registers).

Precisely, the function f 2 in Figure 3.1 (which denotes the encryption algorithm) is implemented (privately in the oracle's side) as follows.

U f 2 |x⟩ |x ′ ⟩ |r⟩ |0⟩ → |x⟩ |x ′ ⟩ |r⟩ |c∥H(c∥x ′ )⟩ for c = SymEnc(k 1 , x ′ ; r) in G 6 ,
and

U f 2 |x⟩ |x ′ ⟩ |r⟩ |0⟩ → |x⟩ |x ′ ⟩ |r⟩ |c∥H(c∥x)⟩ for c = SymEnc(k 1 , x ′ ; r) in G 7 .
The difference between G 6 and G 7 is that in G 6 , the adversary receives H(c∥x ′ ) for some random x ′ while in G 7 , the adversary receives H(c∥x) where x is its input and c is an encryption of some random plaintext. Since H is a random oracle, the two distributions are perfectly indistinguishable. Thus

Pr[G 7 ] = Pr[G 6 ].
Game G 8 : This is identical to G 7 , except that we remove the uses of the database D in the decryption oracle in the random world. In particular, the decryption oracle in the random world R SymDec ′ is implemented as follows:

R 8 SymDec ′ (k,•) |y, z⟩ |E⟩ :=    |y, z ⊕ ⊥⟩ |E⟩ if FindImage E (y, E) = (0, 0), |y, z ⊕ w⟩ |E⟩ if FindImage E (y, E) = (1, w).
The adversary can distinguish between the two hybrids if and only if it sends a query in which y ∈ D \ E with non-negligible weight. This is because if y ∈ D ∩ E then in both hybrids, the original plaintext x was returned. In the case of y ∈ D \ E, the query is answered with ⊥ in G 8 and x ̸ = ⊥ in G 7 . However if the adversary can obtain x ̸ = ⊥ in G 7 for this case, it means that it has obtained a pair (c, τ ) such that τ / ∈ E and H(c∥x) = τ for some x.

By a similar argument as in Item (ii), any distinguisher for these two hybrids can be used to construct an adversary breaking the bound given in Lemma 2.7. Thus, we also have that |Pr

[G 8 ] -Pr[G 7 ]| ≤ negl(λ).
We note that in this final hybrid, the database D is no longer needed. Furthermore, the advantage of A in this hybrid can be reduced to its advantage against SE. To see that, we construct a QPT adversary B from A as follows: B runs A as its subroutine. For each encryption or challenge query, B implements the compressed random oracle for the MAC. It first sends the plaintext registers to its challenger and receives back a ciphertext, it then tags the received ciphertext and the plaintext registers with the MAC using its compressed random oracle and forwards them to A.

Notice in this hybrid, B can always answer decryption queries, without needing to query to SE decryption oracle, by using its own compressed random oracle's database. The advantage of B against SE is exactly the advantage of A in this hybrid, showing that Pr[G 8 ] ≤ Adv qind-qcpa A,SE (λ). Putting everything together, we finish the proof of the theorem.

Quantum-Secure Public-key Encryption

Definitions of Security Indistinguishability Security

The indistinguishability notions can be defined analogously to the ones given in Section 3.3. We define a real-or-random oracle allowing quantum queries and the decryption oracle in the second learning phase as follows.

RR(b) =    O Enc(pk,•) if b = 1 R Enc(pk,•) if b = 0 , and DEC(b) =    O Dec(sk,•) if b = 1 R Dec(sk,•) if b = 0 . Definition 3.
3 -Quantum Indistinguishability for Public-key Encryption Let E := ⟨KeyGen, Enc, Dec⟩ be a public-key encryption scheme and let A := (A 1 , A 2 ) be a quantum adversary. For qatk ∈ [qcpa, qcca1, qcca2], we define the following game, where the oracles O 1 , O 2 are defined according to qatk:

Experiment Expt qind-qatk-b E (λ, A): 1 : (pk, sk) ← KeyGen(1 λ ) 2 : |Φ⟩ ← A |O 1 ⟩ 1 (pk) 3 : b ′ ← A |RR(b)⟩,|O 2 ⟩ 2 (|Φ⟩) 4 : return b ′ qatk qcpa qcca1 qcca2 Oracle O 1 ∅ O Dec(sk,•) O Dec(sk,•) Oracle O 2 ∅ ∅ DEC(b)
We define A's advantage by

Adv qind-qatk A,E (λ) := Pr Expt qind-qatk-1 E (λ, A) = 1 -Pr Expt qind-qatk-0 E (λ, A) = 1 .
We say E is secure in the sense of qIND-qatk if A being QPT implies that Adv qind-qatk

A,E (λ) is negligible.
Similarly as in Section 3.3, our definitions, restricted to classical challenge queries, are equivalent to Boneh-Zhandry's notions (IND-qatk). Furthermore, the following theorem shows that our notions are closed under composition. Theorem 3.4. An encryption scheme E is many-message qIND-qatk secure iff it is single-message qIND-qatk secure.

Proof. The forward implication follows directly. For the reverse direction, we use the standard hybrid argument that uses an adversary A := (A 1 , A 2 ) with advantage ε to construct a new adversary B := (B 1 , B 2 ) which breaks the single-message security with advantage ε/q 2 . Define a sequence of games G 0 , . . . , G q in which B runs A and returns A's output as follows: For any game G i , 1. B 1 simulates A's i -1 first challenge queries on its own, as in the experiment Expt qind-qatk-1 E .

2. B uses A's i-th challenge query as its challenge query.

3. B 2 simulates all A's other challenge queries on its own using the compressed encryption oracle, as in the experiment Expt qind-qatk-0 E , obtaining a database D.

In the case of CCA2 security, B 2 uses a slightly different decryption oracle in the second phase as follows. Let R ′ Dec(sk,•) be the decryption oracle of B 2 and R Dec be B 2 simulated decryption oracle for A. Then

R Dec |y, z⟩ |D⟩ =    (R ′ Dec(sk,•) |y, z⟩) |D⟩ if FindImage(y, D) = (0, 0 m ), |y, z ⊕ w⟩ |D⟩ if FindImage(y, D) = (1, w). Note that G 0 = Expt qind-qatk-1 E (λ, A) and G q = Expt qind-qatk-0 E (λ, A). Because A is able to distinguish Expt qind-qatk-1 E from Expt qind-qatk-0 E
, there exists some g ∈ 1, q such that A distinguishes G g from G g+1 with advantage at least ε/q. B can guess g correctly with probability 1/q, thus B's overall advantage in breaking the single-message security is ε/q 2 . We also give a separation construction showing that our notions are strictly stronger than Boneh-Zhandry's notions. The idea is to install a backdoor that only a quantum adversary can use, by doing some quantum computation. We need to ensure that the backdoor is useless even if the adversary has quantum access to the decryption oracle in the learning phases. Our construction follows the hybrid encryption paradigm combining a CCA2-secure public-key encryption and a one-time CCA2-secure symmetric encryption. The attack is similar in spirit to that for symmetric encryption. Theorem 3.5. If there exists an encryption scheme E which is IND-qCCA2 secure against QPT adversaries, then there exists an encryption scheme E ′ which is also IND-qCCA2 secure, but qIND-qCPA insecure.

Proof. Assume there exists some IND-qCCA2 secure encryption scheme E := ⟨KeyGen, Enc, Dec⟩. Let H := {h k } k be a family of pairwise independent hash functions with the key space K. The new encryption scheme E ′ := ⟨KeyGen ′ , Enc ′ , Dec ′ ⟩ is defined as follows.

KeyGen ′ (1 λ ) :

1 : (pk, sk) $ ← KeyGen 1 λ 2 : return (pk, sk) Enc ′ (pk, x) : 1 : r $ ← X , k $ ← K 2 : c 1 ← Enc(pk, r∥k) 3 : c 2 ← x ⊕ r 4 : σ ← h k (c 2 ) 5 : return c 1 ∥c 2 ∥σ
Dec ′ (sk, c 1 ∥c 2 ∥σ) :

1 : r∥k ← Dec(sk, c 1 ) 2 : if h k (c 2 ) ̸ = σ then 3 : return ⊥ 4 : x ← c 2 ⊕ r 5 : return x
The proof is completed by establishing that E ′ is IND-qCCA2 secure but vulnerable to a qIND-qCPA attack.

Lemma 3.9. E ′ is IND-qCCA2 secure.
Proof. Fix the adversary A and λ. For the purpose of this separation, it is sufficient to assume that E is perfectly correct. We prove security through a sequence of games. Let Pr[G i ] be the probability the adversary wins game G i .

Game G 0 : This is the standard attack game. Let the challenge ciphertext be (c * 1 , c * 2 , σ * ), and K * = (r * , k * ) be the randomness used during the encryption process. Then, the decryption oracle in the second phase can be written as Dec ′ * (sk, •) which rejects decryption when the ciphertext is (c * 1 , c * 2 , σ * ). We denote the set of ciphertexts that will be rejected by Dec ′ * is D 0 . In this game,

D 0 = {(c * 1 , c * 2 , σ * )}.
Game G 1 : This is identical to G 0 , except that whenever a ciphertext (c * 1 , •, •) ∈ D 0 is submitted to the decryption oracle in the second phase, the decryption oracle does not apply Dec(sk, c * 1 ), but instead uses K * produced in the challenge phase to perform steps 2 -5.

This change is just conceptual, since we assume that E is perfectly correct. Thus,

Pr[G 1 ] = Pr[G 0 ]. Game G 2 : This is identical to G 1 , but now the challenger computes c * 1 by encrypting a completely random value K + = (r + , k + ) instead of K * . That is, c * 1 = Enc(pk, r + ∥k + ), but c * 2 = x ⊕ r * and σ * = h k * (c * 2 ).
Notice that in games G 1 and G 2 , the ciphertext c * 1 need not be submitted for decryption. We show how to turn any distinguisher A of games G 1 and G 2 into an adversary A ′ against the security of the underlying scheme E: A ′ runs A using its oracles to answer A, outputs (K * , K + ) as its challenge pair. Finally, A ′ outputs whatever A outputs. It is easy to see that we have:

|Pr[G 2 ] -Pr[G 1 ]| ≤ Adv ind-qcca2 A ′ ,E (λ).
Game G 3 : We further modify G 2 and now change the set D 0 to be D

0 := {(c * 1 , •, •)}. In other words, it rejects any ciphertext (c 1 , c 2 , σ) such that c 1 = c * 1 .
Let Forge be the event that some ciphertext is rejected in game G 3 , but would not have been rejected in the game G 2 . Since games G 2 and G 3 are identical until event Forge,

we have |Pr[G 3 ] -Pr[G 2 ]| ≤ Pr[Forge].
Notice that in the construction of E ′ , the use of pairwise independent hash functions acts as a one-time secure message authentication code, thus Pr[Forge] = 0.

In this final game, the component c * 2 is one-time padded of the message x * b using a random string r * chosen uniformly and independently of all other variables, including b.

Thus, Pr[G 3 ] = 0.
By the security of the underlying building blocks, we have the security of E ′ . Lemma 3.10. E ′ is qIND-qCPA insecure.

Proof. In the challenge phase, the adversary A chooses two fixed messages x 0 , x 1 , and prepares the following state as its challenge:

|ψ⟩ := 1 √ 2 b |x b ⟩ |+⟩ |0⟩ |+⟩ .
The challenge ciphertext state will be:

|ψ 0 ⟩ = 1 √ 2 b |x b ⟩ |+⟩ |x b ⊕ r⟩ |+⟩ if b = 0, or |ψ 1 ⟩ = 1 √ 2 b |x b ⟩ |+⟩ |h(x b ) ⊕ r⟩ |+⟩ if b = 1.
A then applies the Fourier sampling (as described in Section 3.3.2) and breaks the security of E ′ with non-negligible probability.

Non-Malleability Security

Intuitively, the classical definitions [BDPR98; BS06] involve having an adversary play a challenge-response game. In the challenge phase, the adversary is given an encryption y of a message x it produced itself. It must then output a vector of ciphertexts ⃗ y (whose components can be y -in this case, the decryption returns ⊥) called adversarial ciphertexts, together with an arbitrary string. The security definitions require that the distribution of the adversary's output and the decryptions of the adversarial ciphertexts is indistinguishable from the distribution when the adversary receives an encryption of some random message x instead of x. The non-malleability property can be established by saying that when an encryption of x given to the adversary is replaced with an encryption of a random x, even the contents of encryption messages that the adversary sends cannot change in any computationally noticeable way.

A closer look at the adversarial ciphertexts distribution gives us different classical definitions, which leads to different composability properties. As pointed out by Pass, shelat and Vaikuntanathan [START_REF] Pass | Relations Among Notions of Non-malleability for Encryption[END_REF], indistinguishability-based definitions of encryption may or may not compose in the context of non-malleability, depending on how we treat an "invalid adversary" that outputs invalid ciphertexts as part of its adversarial output. In the quantum setting, the adversary can output a superposition of adversarial ciphertexts, which might include invalid ciphertexts, even if it is "hard" to generate invalid ciphertexts. This leaves us no choice but to incorporate invalid adversaries into the definitions. The definitions given here are syntactically close to the classical definitions of [BS06, Definition 4.1]. Definition 3.4 -Quantum Non-Malleability for Public-key Encryption Let E := ⟨KeyGen, Enc, Dec⟩ be a public-key encryption scheme and let A := (A 1 , A 2 , A 3 ) be a quantum adversary. For qatk ∈ [qcpa, qcca1, qcca2] and r ∈ N, we define the following game, where the oracles O 1 , O 2 are defined according to qatk:

Experiment Expt qnme-qatk-b E (λ, A): 1 : (pk, sk) ← KeyGen(1 λ ) 2 : |Ψ 1 ⟩ ← A |O 1 ⟩ 1 (pk) 3 : |Ψ 2 ⟩ := ⃗ y,⃗ z α ⃗ y,⃗ z |⃗ y, ⃗ z⟩ |ϕ ⃗ y,⃗ z ⟩ ← A |RR(b)⟩,|O 2 ⟩ 2 (|Ψ 1 ⟩) where |⃗ y| = |⃗ z| = r 4 : |Ψ 3 ⟩ ← R Dec(sk,•) |Ψ 2 ⟩ 5 : b ′ ← A |O 2 ⟩ 3 (|Ψ 3 ⟩) 6 : return b ′ qatk qcpa qcca1 qcca2 Oracle O 1 ∅ O Dec(sk,•) O Dec(sk,•) Oracle O 2 ∅ ∅ DEC(b)
We define A's advantage by

Adv qnme-qatk A,E (λ) := Pr Expt qnme-qatk-1 E (λ, A) = 1 -Pr Expt qnme-qatk-0 E (λ, A) = 1 .
We say E is secure in the sense of qNME-qatk if A being QPT implies that Adv qnme-qatk

A,E (λ) is negligible.
The following theorem shows that our notions are closed under composition. Theorem 3.6. An encryption scheme E is many-message qNME-qatk secure iff it is single-message qNME-qatk secure.

The proof is similar to that of Theorem 3.4; we omit the details.

Relating Indistinguishability and Non-Malleability

A full characterization of fully-quantum indistinguishability and non-malleability notions is summarized in Figure 3.2. These results are identical as in the classical setting [START_REF] Bellare | Relations Among Notions of Security for Public-Key Encryption Schemes[END_REF]. We use slightly modified constructions of [START_REF] Bellare | Relations Among Notions of Security for Public-Key Encryption Schemes[END_REF]: the attacks carry in the classical manner, only the security proofs need to be adapted, which are given below. Theorem 3.7 (qIND-qCCA1 ⇏ qNME-qCPA). If there exists an encryption scheme E that is qIND-qCCA1 secure, then there exists an encryption scheme E ′ that is qIND-qCCA1 secure but qNME-qCPA insecure. Proof. Assume there exists some qIND-qCCA1 secure encryption scheme E := ⟨KeyGen, Enc, Dec⟩. The new encryption scheme E ′ := ⟨KeyGen ′ , Enc ′ , Dec ′ ⟩ is defined as follows.

KeyGen ′ (1 λ ) :

1 : (pk, sk) $ ← KeyGen 1 λ 2 : return (pk, sk)
Enc ′ (pk, x) :

1 : b $ ← {0, 1} 2 : y ← Enc(pk, x) 3 : return y∥b
Dec ′ (sk, y∥b) :

1 : x ← Dec(sk, y) 2 : return x Claim 3.1. E ′ is qNME-qCPA insecure.
Proof Sketch. The scheme is malleable because given a ciphertext y∥b of a plaintext x, it is trivial to create another ciphertext of x by just outputting y∥b.

Claim 3.2. E ′ is qIND-qCCA1 secure.
Proof Sketch. It is easy to see that any adversary A against E ′ can be used to construct an adversary B that attacks E as follows. B runs A using its own oracle O 1 , and uses A's challenge queries as its own challenge queries. Whenever B receives a challenge ciphertext, it samples a random bit b and appends it to the challenge ciphertext before forwarding it to A. B outputs whatever A outputs. One can verify that Adv B,E (λ) = Adv A,E ′ (λ).

Thus, the security of E ′ follows from the security of E.

Theorem 3.8 (qNME-qCPA ⇏ qIND-qCCA1). If there exists an encryption scheme E that is qNME-qCPA secure, then there exists an encryption scheme E ′ that is qNME-qCPA secure but qIND-qCCA1 insecure.

Proof. Assume there exists some qNME-qCPA secure encryption scheme E := ⟨KeyGen, Enc, Dec⟩. Fix a family qPRF := {qPRF : {0, 1} ℓ → {0, 1} ℓ } of quantum-secure pseudorandom functions. The new encryption scheme E ′ := ⟨KeyGen ′ , Enc ′ , Dec ′ ⟩ is defined as follows.

KeyGen ′ (1 λ ) :

1 : (pk, sk) $ ← KeyGen 1 λ 2 : k $ ← {0, 1} λ 3 : sk ′ ← sk∥k 4 : return (pk, sk ′ )
Enc ′ (pk, x) :

1 : y ← Enc(pk, x)

2 : return 0∥y

Dec ′ (sk∥k, b∥y) :

1 : if b = 0 : 2 :
return Dec(sk, y)

3 : else if y = qPRF(k, 0) :

4 : return sk 5 : else return qPRF(k, y) Claim 3.3. E ′ is qIND-qCCA1 insecure.
Proof Sketch. The adversary queries Dec ′ (sk∥k, •) at 1∥0 to get v = qPRF(k, 0), and then queries it at the point 1∥v to get sk. At this point, the adversary can obviously break the security of E ′ .

Claim 3.4. E ′ is qNME-qCPA secure.

Proof. Fix A and λ. We prove security through a sequence of games.

Game G 0 : This is the standard attack game.

Game G 1 : Replace qPRF with a truly random function H.

Since qPRF is a quantum-secure pseudorandom function, A cannot distinguish G 1 from G 0 , except with negligible probability.

Game G 2 : This is identical to G 1 . The only change is to the decryption algorithm, in which instead of returning sk when y = H(0), it returns H(H(0)) which is a random value independent of the secret key sk.

Games G 1 and G 2 proceed identically unless A successfully outputs H(H(0)) with a single query. To bound the distinguishing probability, we invoke the following lemma. Lemma 3.11 ([Unr14, Theorem 6.6]). Let A be any quantum oracle algorithm making a single query to a random function H, with r inputs in the query. Then

Pr x = H(H(0)) : H $ ← ({0, 1} ℓ → {0, 1} ℓ ), x ← A H () ≤ 2 -Ω(ℓ) O(r).
This probability is negligible for polynomially-bounded r (number of inputs per query, which corresponds to the number of adversarial ciphertexts in a qNME security game).

Finally, we design an adversary B := (B 1 , B 2 , B 3 ) attacking E in the qNME-qCPA sense from the adversary A := (A 1 , A 2 , A 3 ) in this last game. B runs A as its subroutine and simulates a random oracle H itself. B 1 and B 3 output whatever A 1 and A 3 output, respectively. The algorithm B 2 is defined as follows. B 2 receives a vector (in superposition) of adversarial ciphertexts from A 2 .

• If the basis state is |1∥y, z, ϕ y,z ⟩, then it maps this basis state to |Enc(H(y)), z, 1∥ϕ ′ y,z ⟩ by allocating new ancilla registers (with proper padding), computing Enc(H(y)) and then swapping these newly created registers with the y registers. The y registers are now included in the auxiliary registers |ϕ ′ y,z ⟩. • Otherwise, it keeps the basis state the same, re-organizes the state to |y, z⟩ |0∥ϕ y,z ⟩. B 2 then outputs the resulting state as its adversarial ciphertexts.

Let D be the database of B's challenge queries. Consider B 2 's adversarial ciphertexts state, let Dup be the event that this state has a non-negligible weight on ciphertexts Enc(H(y)) such that Enc(H(y)) ∈ D. The simulation is indistinguishable if this happens with negligible probability. To see that, imagine that in the real-world experiment, A 3 would receive exactly H(y). The only difference is in the random-world experiment: Enc(H(y)) ∈ D means that H(y) is a random message obtained by apply a random function h. A 3 would receive a pre-image of h(H(y)) (by the definition of the qNME decryption oracle), which is different from H(y) with overwhelming probability. This is only detectable if Dup happens with non-negligible probability. Indeed, we show that Pr[Dup] must be negligible, otherwise it would violate the security of E even in the qIND-qCPA. This is a standard argument, we omit the details. The security of E ′ now follows by the security of E. Theorem 3.9 (qNME-qCCA1 ⇏ qNME-qCCA2). If there exists an encryption scheme E that is qNME-qCCA1 secure, then there exists an encryption scheme E ′ that is qNME-qCCA1 secure but qNME-qCCA2 insecure.

Proof. Assume there exists some qNME-qCCA1 secure encryption scheme E := ⟨KeyGen, Enc, Dec⟩. Fix a family qPRF of quantum-secure pseudorandom functions. The new encryption scheme E ′ := ⟨KeyGen ′ , Enc ′ , Dec ′ ⟩ is defined as follows.

KeyGen ′ (λ) :

1 : (pk, sk) $ ← KeyGen (λ) 2 : k $ ← {0, 1} λ 3 : sk ′ ← sk∥k 4 : return (pk, sk ′ )
Enc ′ (pk, x) :

1 : y ← Enc(pk, x) 2 : return 0∥y∥0
Dec ′ (sk∥k, b∥y∥z) :

1 : if b = 0 ∧ z = 0 : 2 :
return Dec(sk, y)

3 : else if b = 1 : 4 : return qPRF(k, y) 5 : else if b = 2 ∧ z = qPRF(k, y) : 6 : return Dec(sk, y) 7 : else return ⊥ Claim 3.5. E ′ is qNME-qCCA2 insecure.
Proof Sketch. Let 0∥y∥0 be the classical challenge ciphertext. The adversary first queries Dec ′ (sk∥k, •) at 1∥y∥0 (which is not the challenge ciphertext) to get v = qPRF(k, y), and then queries it at the point 2∥y∥v to get the decryption of y, which is exactly the decryption of the challenge ciphertext. This helps the adversary to break the indistinguishability in the sense of qNME-qCCA2.

Claim 3.6. E ′ is qNME-qCCA1 secure.

Proof. The proof is similar to that of Claim 3.4: first the pseudorandom function qPRF is replaced by a truly random function H, and for any decryption query of the form 2∥y∥z, we return ⊥ where y is the challenge ciphertext. The extra step is that we need to consider the case in which the adversary happens to query to the random function involving the challenge ciphertext. However, such event is unlikely since otherwise the scheme E would not be secure even in the sense of qIND-qCCA1. We formally prove the security through a sequence of games. Fix A and λ.

Game G 0 : This is the standard attack game.

Game G 1 : Replace qPRF with a truly random function H.

Since qPRF is a quantum-secure pseudorandom function, A cannot distinguish G 1 from G 0 , except with negligible probability.

Game G 2 : This is identical to G 1 , except that now we will consider the encryption oracle and the decryption oracle where the random function H is involved as being implemented in the compressed oracle. Since these are equivalent to the standard oracles, these changes do not affect the adversary's success probability. We have Pr

[G 2 ] = Pr[G 1 ].
Game G 3 : This is identical to G 2 . Let D be the database of the challenge queries. The only change is to the decryption algorithm which is used in the last phase after the adversary has output its adversarial ciphertexts: if the ciphertext is 2∥y∥H(y) where y ∈ D (in the form of 0∥y∥0), then it returns ⊥.

The intuition is that the adversary cannot make such a query (i.e., to put a nonnegligible weight on inputs 2∥y∥H(y) where y ∈ D), except with negligible probability. Thus, the change is undetectable by the adversary. We formally bound the distinguishing probability between G 2 and G 3 by considering the two following events.

• Let ForgeOffline be the event that A 1 (in the first phase) has a non-negligible query weight on inputs containing some y ∈ D in its queries to H. Lemma 2.7 shows that the success probability of a quantum adversary in a standard oracle game is close to its success probability in the corresponding compressed oracle game. We now show that if ForgeOffline happens with non-negligible probability, we could design an adversary B that break E in the sense of qIND-qCCA1.

-In the first stage, B implements a compressed random oracle and provides a simulation of the decryption oracle of A using its decryption oracle. Let D H is the database kept by B. -When A outputs its challenge, B measures its database D H and gets many pairs D H = {(y, H(y))}. B then submits these y values to its decryption oracle, which are legitimately counted as decryption in the first phase, and gets back their plaintexts x. Only at this point, B outputs A's challenge as its challenge.

After receiving back the challenge ciphertexts, B measures its challenge query, and checks if there is any value in D H . If it does then it outputs a bit b depending on whether their plaintexts are the same, otherwise it decides by flipping a coin. Observe that the success of B is exponentially close to one half the probability of ForgeOffline (by Lemma 2.7 and the standard argument).

Thus, we have Pr[ForgeOffline] must be negligible.

• Let ForgeOnline be the event that the adversary correctly computes H(H(y)) for some y ∈ D using only a single query to H in the last phase. By a similar argument to Lemma 3.11, we have that Pr[ForgeOnline] is negligible.

Therefore, we have that

|Pr[G 3 ] -Pr[G 2 ]| ≤ Pr[ForgeOffline] + Pr[ForgeOnline],
which is negligible.

Finally, we construct an adversary B = (B 1 , B 2 , B 3 ) that attacks E in the sense of qNME-qCCA1 from any adversary A = (A 1 , A 2 , A 3 ) of this last game. This can be argued analogously to the argument in Claim 3.4. We omit the details.

A Lifting Theorem: From IND-qCCA2 to qIND-qCCA2

We present a compiler transforming IND-qatk security to qIND-qatk security. Our compiler follows the classical hybrid encryption paradigm. The message is encrypted under a random symmetric key each time, and the key is encrypted by the public-key encryption scheme. Since the same randomness is used for each query in superposition, we can use the same random symmetric key in superposition each time. This means that the adversary never has quantum access to the encryption algorithm of the public-key scheme, only the symmetric encryption needs to be secure against quantum queries, which we know how to construct from one-way functions (Theorem 3.3).

Construction 3.3 -qIND-qatk Secure Encryption Scheme

Let E := ⟨KeyGen, Enc, Dec⟩ be a public-key encryption scheme which is IND-qatk secure and δ-correct. Let SE := ⟨K, SymEnc, SymDec⟩ be a one-time qIND-qatk secure symmetric-key encryption scheme. We construct a new public-key encryption scheme E ′ := ⟨KeyGen ′ , Enc ′ , Dec ′ ⟩ as follows.

KeyGen ′ (1 λ ) :

1 : (pk, sk) $ ← KeyGen 1 λ 2 : return (pk, sk)
Enc ′ (pk, x) :

1 : k $ ← K(1 λ ) 2 : c 1 ← Enc(pk, k) 3 : c 2 ← SymEnc(k, x) 4 : return c 1 ∥c 2 Dec ′ (sk, c 1 ∥c 2 ) : 1 : k ← Dec(sk, c 1 ) 2 : x ← SymDec(k, c 2 )
3 : return x Remark 3.4. In this construction, we make no extra assumptions. We know that the existence of IND-qatk secure encryption implies the existence of quantum-secure oneway functions. IND-qatk secure public-key encryption can be constructed based on quantum-resistant assumptions (e.g., Learning With Errors) [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF].

We give the security proof for adaptive chosen-ciphertext security below, the other cases can be treated similarly.

Theorem 3.10. The encryption scheme E ′ defined in Construction 3.3 is qIND-qCCA2 secure, if E is IND-qCCA2 secure, and SE is one-time qIND-qCCA2 secure. In particular, for any QPT adversary A, there exist QPT adversaries B, C such that

Adv qind-qcca2 A,E ′ (λ) ≤ O(q d • δ) + 2 • Adv ind-qcca2 B,E (λ) + Adv qind-qcca2 C,SE (λ),
where q d is the number of decryption queries in the second phase.

Proof. We prove this theorem using hybrid games. Since our definitions are closed under composition, it is sufficient to prove for the single-message security.

Let A be a QPT adversary. For any game G index , we denote by

Pr[G index ] := |Pr[G index (A) = 1 | b = 1] -Pr[G index (A) = 1 | b = 0]|.
Also, by event G index (A), we mean the output of the experiments (defined as in Definition 3.3) in game G index when interacting with A.

Game G 0 : This is the standard attack game. Let k * denote the symmetric key used during the encryption process within the oracle.

Game G 1 : Notice that the same symmetric key k * sampled during the encryption process within the challenger's oracle is used for all classical states of the superposition, the ciphertext state of the challenge query would be: This game is identical to G 0 , except that now the real-or-random oracle RR(b) will store the first component c 1 of the challenge ciphertext in its local database D ′ . Since c 1 is classical, this action is undetectable. Thus, we have:

Pr[G 0 ] = Pr[G 1 ].
Game G 2 : We define FindImage ′ that takes as input a tuple ((c 1 , •), D ′ ) and returns 1 if c 1 ∈ D ′ and 0 otherwise. This is identical to G 1 , except that in the real world we change the decryption oracle O Dec ′ in the second phase to

O 2 Dec ′ |y, z⟩ |D ′ ⟩ =    |y, z ⊕ Dec ′ (sk, y)⟩ |D ′ ⟩ if FindImage ′ (y, D ′ ) = 0, |y, z ⊕ SymDec(k * , c 2 )⟩ |D ′ ⟩ if FindImage ′ (y, D ′ ) = 1,
where FindImage ′ parses its input component y as y = (c 1 , c 2 ).

Essentially, in the second phase of this game, the decryption oracle in the real world does not apply algorithm Dec ′ to obtain the symmetric key, but instead just uses the key k * produced by the challenge encryption oracle, if the query contains c 1 ∈ D ′ . (Notice that the database D ′ is classical.) This change is slightly more than just conceptual, since KeyGen ′ may generate a bad key pair. Let DecFail be the event that Dec ′ (sk, Enc ′ (pk, x)) = x ′ ̸ = x. This event happens if and only if Dec(sk, Enc(pk, k * )) ̸ = k * . Unless this event occurs, G 2 and G 1 proceed identically. Since SE is perfectly correct (by definition), any decryption failure of E ′ is a decryption failure of E. Thus E ′ is also δ-correct. We thus have

|Pr[G 2 ] -Pr[G 1 ]| ≤ Pr[DecFail] ≤ O(q d • δ),
where the last inequality follows from the definition of correctness.

Game G 3 : This is identical to G 2 , except that in the real-or-random oracle, we encrypt a complete random value k + in place of the symmetric key k * , that is we compute c 1 = Enc(pk, k + ), but we still use k * for symmetric encryption and decryption.

It is straightforward to see that any adversary A that distinguishes games G 3 from G 2 can be turned to an adversary B attacking the underlying scheme E, whose running time is essentially the same as that of A. To be more precise, we can define two intermediate hybrids G 3.0 and G 3.1 = G 3 , in which this change is applied to the real world in G 3.0 and then to the random world in G 3.1 . In each hybrid, the adversary B just runs the adversary A, and uses (k * , k + ) as its challenge pair. Note that in two consecutive hybrids (G 2 and G 3.0 , G 3.0 and G 3.1 ), the challenge ciphertext of B is c 1 , which is classical, as argued above, and that B never query to the decryption oracle on the challenge ciphertext, but instead uses k * to answer the query (if it is simulating the game in the real world), and its compressed encryption oracle's database (if it is simulating the game in the random world). We have

|Pr[G 3 ] -Pr[G 2 ]| ≤ 2 • Adv ind-qcca2 B,E (λ).
Furthermore, notice the fact that in this final game, k + is independent of the adversary's view and b, we now turn any distinguisher A of this game to an adversary C that breaks the one-time security of SE. C runs A, when it receives the challenge query from A, it first generates a random string k + and encrypt it with the public key pk to get c 1 , and sends A's challenge query directly to its challenger. After receiving the answer back, C appends |c 1 ⟩ to the result and forwards it to A. In the second phase, for any decryption query, C removes the first component from the ciphertext and forwards the query to its challenger.

By the security of SE we have

|Pr[G 3 ] -Pr[G 2 ]| ≤ Adv qind-qcca2 C,SE (λ).
Putting everything together, by the security of the underlying building blocks, we have the security of E ′ .

Bit Encryption Is Complete

In this section, we summarize our result for a fundamental question:

Is bit encryption in the quantum world complete as in the classical world?

We will show that the answer is affirmative, and give a construction for string encryption from bit encryption.

Bit-by-bit Encryption Is Insecure

We note that the question above is not trivial even for simpler cases of CPA and CCA1 security. In the classical setting, under CPA and CCA1 attacks, a secure bit encryption scheme can be applied bit-by-bit to construct a secure many-bit encryption scheme. However, the same construction fails in the quantum setting. This result for the symmetric-key setting was observed in [BBCL+21; CETU21]. Indeed, the same attack is also applicable to the public-key setting.

We will denote the encryption function as f , since the attack applies to both the symmetric-key and the public-key setting. Furthermore, we will show a stronger version of the result, which is bit-by-bit encryption of a qIND-qCCA2-secure scheme is insecure even in the sense of qIND-qCPA.

Theorem 3.11 ([BBCL+21; CETU21]

). Bit-by-bit encryption of a qIND-qCCA2 scheme is qIND-qCPA insecure. It holds in both symmetric-key and public-key settings.

Proof. It is sufficient to show the attack for 2-bit encryption. The adversary A sends the following query as its challenge:

|ϕ⟩ = |0∥+⟩ X |0∥+⟩ Y .
Informally, the adversary inserts 0 to the first input register (the first qubit), and |+⟩ to the second input register (the second qubit), and sets the response registers to be |0∥+⟩. The challenge ciphertext state will be:

|ϕ 0 ⟩ = |0∥+⟩ X |f (0)∥+⟩ Y if b = 0,
and |ϕ 1 ⟩ = x,y∈{0,1} |0∥x⟩ X | 0∥y ⊕ f (h(0∥x)| 0 )∥f (h(0∥x)| 1 ) ⟩ if b = 1,
where h : {0, 1} 2 → {0, 1} 2 is a random function, and we write h(z)| 0 to denote its first output bit, and h(z)| 1 to denote its last output bit.

Measuring the second input register in the Hadamard basis in the case b = 0 returns 0 with probability 1, while in the case b = 1, this register will be entangled with the response registers with high probability due to the application of h. Thus measuring the second input register in the Hadamard basis in the case b = 1 returns 0 with small probability only.

Completeness of Bit-Encryption

We answer the aforementioned question using our Theorem 3.3 and Theorem 3.10. In particular, we show the following theorem: Theorem 3.12. Many-bit qIND-{qCPA, qCCA1, qCCA2}-secure encryption schemes exist if and only if 1-bit qIND-{qCPA, qCCA1, qCCA2}-secure encryption scheme exists.

Proof (Sketch). We give a sketch of the proof for the claim below.

For the symmetric-key encryption. From our Theorem 3.3, we conclude that if we can construct many-bit qCPA-secure encryption from 1-bit qCPA-secure encryption, then we are done. The steps to achieve this goal are as follows.

• Many-bit qCPA-secure encryption can be constructed from quantum-secure pseudorandom permutations (qPRPs) [CETU21, Theorem 44]. We note that the construction given in [CETU21, Theorem 44] is proven to be secure with respect to real-or-permuted security, but the proof also holds for real-or-random security which is used in our notions.

• qPRPs can be constructed from quantum-secure pseudorandom functions qPRFs [START_REF] Zhandry | A Note on Quantum-Secure PRPs[END_REF] (which uses function to permutation converters), or [START_REF] Hosoyamada | 4-Round Luby-Rackoff Construction is a qPRP[END_REF] (which uses the fourround Luby-Rackoff construction).

• qPRFs with one input bit implies qPRFs with many input bit (for example, via the GGM construction [START_REF] Zhandry | How to Construct Quantum Random Functions[END_REF]).

• The existence of one input bit qPRFs is implied by our assumptions that 1-bit encryption scheme exists: the existence of encryption implies the existence of quantum-secure one-way functions, and quantum-secure one-way functions implies quantum-secure pseudorandom number generators [START_REF] Håstad | A Pseudorandom Generator from any One-way Function[END_REF], which in turn gives us one input bit qPRFs [START_REF] Zhandry | How to Construct Quantum Random Functions[END_REF].

For the public-key encryption. From our lifting theorem Theorem 3.10, we know that if we can construct many-bit encryption from 1-bit encryption for public-key schemes which only need to be secure against classical challenge queries, armed with the results in the symmetric-key setting, we are also done. For IND-qCPA, IND-qCCA1 security (with classical challenge queries), this follows directly from the bit-by-bit construction. For IND-qCCA2 security, it is not difficult to adapt the classical security proof of [START_REF] Hohenberger | Detecting Dangerous Queries: A New Approach for Chosen Ciphertext Security[END_REF] to the quantum setting. In particular, the construction and proof in [START_REF] Hohenberger | Detecting Dangerous Queries: A New Approach for Chosen Ciphertext Security[END_REF] involve defining detectable-CCA2 security and some "bad events" when the adversary submits a decryption query. Fortunately, all these notions are defined relatively to the adversary's challenge queries which are classical. Thus they can be defined similarly for the IND-qCCA2 security and the proof carries through.

Chapter

4
Quantum Simulation-Sound Non-Interactive Zero-Knowledge

In this chapter, continuing the line of work on defining quantum security for classical cryptographic primitives, we describe quantum security notions for non-interactive zero-knowledge systems in which the adversary can make quantum queries to the zeroknowledge simulator. We then use these new notions to prove quantum chosen-ciphertext security (as defined previously in Chapter 3) of (a variant of) the classical Naor-Yung encryption scheme.

Chapter content We give below the definition for quantum zero-knowledge in both the common reference string model and the quantum random oracle model. Our definition is a quantum counterpart of the classical definition for post-quantum zero-knowledge: the only difference is that now the adversary can query the simulator in superposition.

Definition 4.1 -Quantum Zero-Knowledge Let L be a language in NP. A proof system NIZK := ⟨Setup, P, V⟩ for L is (adaptive) quantum zero-knowledge if there exists a QPT simulator S = (S 1 , S 2 ) such that for all QPT distinguisher D * = {D * λ , ρ λ } λ∈N , for every n ∈ N, and for every λ ∈ N:

Pr D * λ (ρ λ , param) |P O (param,•,•)⟩,|O⟩ = 1 param ← Setup(1 n , 1 λ ) -Pr D * λ (ρ λ , param) |S 2 (td,•)⟩ = 1 (param, td) ← S 1 (1 λ ) ≤ negl(λ),
where -D * can make quantum queries to the oracles.

param is an empty string if we consider NIZK in the quantum random oracle model, or crs in the common reference string model.

-O is an empty oracle if we consider NIZK in the common reference string model, or a random oracle O H in the quantum random oracle model.

-P(param, •, •) is the prover algorithm and S 2 (td, •) only acts on its private trapdoor td, the input statement x ∈ L yes ∩ {0, 1} n and its private random tape.

Construction

We note that any perfect adaptive post-quantum zero-knowledge proof system is also (perfect) quantum zero-knowledge proof system. Therefore, in this section, we consider the notion of quantumly computational zero-knowledge. We will briefly show that some known non-interactive zero-knowledge proof systems in literature, in particular the one given by Bitansky and Paneth in [START_REF] Bitansky | ZAPs and Non-Interactive Witness Indistinguishability from Indistinguishability Obfuscation[END_REF], satisfy this notion. At a high-level overview, the Bitansky-Paneth construction is a concrete instantiation of the Goldwasser-Ostrovsky transformation [START_REF] Goldwasser | Invariant Signatures and Non-Interactive Zero-Knowledge Proofs are Equivalent (Extended Abstract)[END_REF] which gives NIZKs from invariant signatures.

Informally, invariant signatures are digital signatures where all valid signatures of any message are either identical, or share a common property. Concretely, we say that a signature scheme is invariant if there is some efficiently computable property P of signatures such that for any message m * and any verification key vk there is a unique value P vk (m * ) such that P (σ) = P vk (m * ) for any valid signature σ with respect to vk. Furthermore, it is required that for every message m * , for an honestly generated verification key (sampled independently of m * ), the property value P vk (m * ) is pseudorandom, even given the verification key and a signature oracle on messages m ̸ = m * . We can also consider a relaxed notion of invariant signatures in the common random string model (CRS).

The Goldwasser-Ostrovsky transformation is based on the construction of Feige, Lapidot and Shamir [START_REF] Feige | Multiple Non-Interactive Zero Knowledge Proofs Based on a Single Random String (Extended Abstract)[END_REF] of NIZKs in the hidden-bits model. In this model, a random hidden string is available to the prover but is hidden from the verifier. The prover can reveal to the verifier specific bits of the hidden string in the locations of its choice, but it cannot change the value of these bits. Very briefly, the transformation is as follows: we interpret the CRS (available to both prover and verifier) as containing a CRS for the invariant signature, as well as a sequence of messages {m i } and one-time pad bits {s i } where every (m i , s i ) will be used to obtain a single hidden bit b i . The prover will sample keys (vk, sk) for the invariant signature and send the verification key vk to the verifier as part of the proof. The hidden bit b i is then defined as the bit P vk (m i ), the property value of the message m i , XORed with the one-time pad bit s i . To reveal the bit b i , the prover sends to the verifier a signature σ i on m i . The verifier can compute b i by computing P (σ) = P vk (m i ).

The simulator can be defined based on this strategy, where first we run the simulator of the proof system in the hidden model to obtain a proof π and a set of revealing bits {b i }. The CRS will be generated exactly as in the real execution, except that the one-time pad bits {s i } are computed as

P vk (m i ) ⊕ b i .
The proof of zero-knowledge is essentially based on pseudo-randomness property of the signature, so that each hidden bit in the simulation is computationally indistinguishable from a uniformly random bit as in the real execution.

There are two important points that make the proof also works in the quantum setting:

• A NIZK proof system in the hidden-bit model can achieve both perfect soundness and perfect zero-knowledge [START_REF] Hofheinz | Dual-Mode NIZKs from Obfuscation[END_REF].

• The computational indistinguishability only appears in the proof of the CRS generation in the real execution and the simulation, which is classical and independent of the adversary's queries.

Since perfect zero-knowledge implies quantum zero-knowledge, the classical proof also carries to the quantum setting, when the building blocks are post-quantumly secure.

For more details, we refer the reader to the (classical) proof given in [START_REF] Bitansky | ZAPs and Non-Interactive Witness Indistinguishability from Indistinguishability Obfuscation[END_REF].

Quantum Simulation-Soundness

Informally, a zero-knowledge proof system is said to be simulation-sound if it has the property that an adversary cannot provide a convincing proof for any false statement, even if it has seen simulated proofs of arbitrary statements (including false statements).

In the classical setting, simulation-soundness is defined with respect to a zero-knowledge simulator. The simulator would keep a list of statements and simulated proofs, and the adversary is asked to output a new pair of statement and proof that is outside of the list. The classical definition for simulation-soundness thus inherently implies recording and comparison of queries. Translating this definition into the quantum setting can be tricky, mainly because of quantum measurement and the no-cloning theorem, which prevent the simulator to keep such a list when the adversary can make queries quantumly. The same barrier also appears in different context of defining quantum indistinguishability for encryption (see Chapter 3), or defining quantum unforgeability for digital signatures [BZ13b; AMRS20].

To define quantum-simulation-soundness, we take advantage of the fact that the randomness to compute a proof is chosen by the simulator and can be classical, and we assume that the simulator picks a fresh randomness for each query. For each query, we thus ask the simulator to record the randomness used to respond the query in a list R. At the end, the adversary returns two pairs (x 1 , π 1 ), (x 2 , π 2 ) and wins if either of the two following statements is true:

1. None of the randomnesses in R matches with one of the pairs (x 1 , π 1 ), (x 2 , π 2 ) with x 1 or x 2 being a false statement.

2. There exists a randomness r ∈ R that matches with these two pairs and one of the statements x 1 or x 2 is a false statement.

We note that restricting to classical queries, this definition is stronger than the classical simulation-sound definition. An adversary that breaks the classical definition outputs a new pair (x, π) where x is a false statement. If x has not been queried before, the adversary can break one of the two cases above. If x has been queried before but π is a new proof, the randomness to generate π should not be in R and the adversary breaks case 1.

The formal definition follows.

Definition 4.2 -Quantum-Simulation-Soundness (QSS-NIZK) Let L be a language in NP. Consider a proof system ⟨Setup, P, V⟩ for L with zero-knowledge simulator S := (S 1 , S 2 ). In each query, S 2 stores the randomness used to answer the query in a list R. A QPT adversary A after making polynomial numbers of quantum queries to S 2 outputs two pairs {(x i , π i )} 2 i=1 . The adversary A wins if either of the following two cases hold:

1. There exists i ∈ 1, 2 such that x i / ∈ L, for all r ∈ R, S 2 (x i , r) ̸ = π i and V(crs, x i , π i ) = 1.
2. There exists a randomness r ∈ R such that S 2 (x 1 , r) = π 1 and S 2 (x 2 , r) = π 2 and at least one of x 1 or x 2 is not in L.

Formally, we say an NIZK proof is quantum-simulation-sound if for all λ ∈ N, for all QPT adversaries A, i, j ∈ 1, 2 we have:

Pr          V(crs, x i , π i ) = 1 ∀ i ∧ ∃ i : x i / ∈ L ∧ (S 2 (td, x i , r) ̸ = π i ∀ r ∈ R)∨ (∃ r ∈ R : S 2 (td, x j , r) = π j ∀ j) (crs, td) ← S 1 (1 λ ) {(x i , π i )} 2 i=1 ← A |S 2 (td,•)⟩ (crs)          ≤ negl(λ).

Some Technical Discussions

We now remark on a few details on the notion of quantum-simulation-soundness. First, it might seem that our definition does not capture all possible quantum attacks. Consider the following adversary A. A makes a quantum query to the simulator and obtains a superposition of statements and proofs as x̸ =x 0 ,y α x,y |x, y ⊕ π⟩, where x 0 / ∈ L. We assume that the simulator answered the query with a classical randomness r, that is hidden from A. (Note that, if r is not hidden, there is a trivial attack.) A then performs some quantum computation to come up with a proof for x 0 , with the same randomness r, and during the process, A also destroys the original state, thus A cannot procedure two pairs of {(x i , π i )} 2 i=1 that are computed using the same randomness. Essentially, the adversary makes one or more quantum queries but then must consume the post-query states completely in order to make a single, but convincing, forgery. Obviously, if such an adversary A exists, this might consider a quantum attack against quantum-simulation-soundness, but Definition 4.2 does not capture this. However, this so-called attack is inherited from the nature of quantum queries and can be applied in similar scenarios, for instance, the (n + 1)-definition proposed in [START_REF] Boneh | Quantum-Secure Message Authentication Codes[END_REF][START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF] or the blind-unforgeability proposed in [START_REF] Alagic | Quantum-Access-Secure Message Authentication via Blind-Unforgeability[END_REF] for classical digital signatures. The second condition in Definition 4.2 is thus used to capture classical attacks rather than quantum attacks. We leave this as an open problem, either to find a concrete example for this type of attack, or to show that (in most of the cases) this is not possible.

Secondly, our definition also captures some "malleability" attack that is not captured by the classical definition. In particular, imagine that if the adversary makes a query to the simulator for a statement x 1 / ∈ L, and outputs a proof for a statement x 2 ∈ L with the same randomness used by the simulator. This attack does not violate the classical simulation-soundness, but it is captured by our definition. This is because it is not possible in general to distinguish which statement was queried by the adversary in the quantum setting. We note that the "inverse" case (that is, x 1 ∈ L and x 2 / ∈ L) is obviously an attack and it is captured in both classical and quantum notions.

Separation Between Post-Quantum and Quantum Security

In this section, we introduce a new notion of quantum-query advantage functions, which are functions that can be used to demonstrate advantages of quantum queries over classical queries. Our definition and construction of quantum-query advantage functions follows those of quantum advantage functions given in [START_REF] Lombardi | Post-Quantum Insecurity from LWE[END_REF]. The main difference between the two objects is that:

• Quantum advantage functions in [START_REF] Lombardi | Post-Quantum Insecurity from LWE[END_REF] demonstrate a quantum advantage with only classical queries, showing separations between classical security and post-quantum security.

• Our quantum-query advantage functions demonstrate a quantum advantage with quantum queries, showing separations between post-quantum security and quantum security.

We give the definition and construction for quantum-query advantage functions in Section 4.3.2 and use it to show a separation between quantum simulation-sound NIZKs and classical simulation-sound NIZKs in Section 4.3.3.

Remark 4.1. Our quantum-query advantage functions can be constructed trivially from periodic pseudorandom functions (which was used to show separation between quantumquery security and classical-query security for digital signatures and chosen-ciphertext security in [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF]). Informally, for appropriate parameters, the period finding algorithm of Boneh and Lipton [START_REF] Boneh | Quantum Cryptanalysis of Hidden Linear Functions (Extended Abstract)[END_REF] allows to recover the secret period of the pseudorandom function with a single quantum query, but the function is computationally indistinguishable from a random function if the adversary only has classical access. In this thesis, we present another construction based on recent interactive proofs of quantumness [START_REF] Brakerski | A Cryptographic Test of Quantumness and Certifiable Randomness from a Single Quantum Device[END_REF]. The advantage of our approach is that it allows us to define more properties for the quantum-query advantage function, which we believe to be useful to show separations in other settings.

Preliminaries: Interactive Proof of Quantumness

We first recall the definition of interactive proof of quantumness protocols with 4 messages in total, which corresponds to the best round complexity known for interactive proofs of quantumness in the plain model [START_REF] Brakerski | A Cryptographic Test of Quantumness and Certifiable Randomness from a Single Quantum Device[END_REF]. Definition 4.3 -Interactive Proof of Quantumness An interactive proof of quantumness is an interactive protocol Π ipq between a prover P and a verifier V using classical communication, with the following properties:

Quantum completeness: there exists a QPT quantum prover P such that for all λ ∈ N:

Pr (P, V)(1 λ ) = 1 ≥ 1 -negl(λ).
Classical soundness: for any PPT classical prover P * , for all λ ∈ N:

Pr[(P * , V) = 1] ≤ negl(λ).
In a 4-round interactive proof of quantumness protocol, the first message is sent by the verifier to the prover. Let v 1 , v 2 (resp. p 1 , p 2 ) denote the messages sent by the verifier (resp. the prover) during the execution of an interactive proof of quantumness Π ipq . An interactive proof of quantumness Π ipq can furthermore satisfy the following optional property:

Public-coin second verifier message: the second verifier message v 2 consists of uniformly and independently sampled random coins.

Semi-quantum soundness: for any QPT quantum prover P * , for all λ ∈ N:

Pr (P * , V semi )(1 λ ) ≤ negl(λ),
where the verifier V semi is defined as follows.

• Let P denote the efficient quantum prover for Π ipq such that

Pr (P, V)(1 λ ) ≥ 1 -negl(λ).
• V semi runs V to obtain the first verifier message v 1 .

• Whenever V semi receives a classical message x from P * , it runs P on (v 1 , x) and obtains a classical message p 1 .

• P * is allowed to send a classical message x to V semi and receive back a tuple of classical message (p 1 , v 2 ) where v 2 is the second verifier message.

Then it outputs a classical message p 2 .

• V semi outputs the output of V on (v 1 , p 1 , v 2 , p 2 ).

Intuitively, semi-quantum soundness guarantees that no efficient quantum prover can cheat when the first prover message is generated by a classical prover.

The Quantum Certification Protocol from [START_REF] Brakerski | A Cryptographic Test of Quantumness and Certifiable Randomness from a Single Quantum Device[END_REF] This protocol relies on a post-quantum secure trapdoor claw-free (TCF) family of functions with adaptive hard-core bit property f 0 , f 1 : {0, 1} n → {0, 1} m . A TCF pair is a pair of functions which are injective, with the same image, and satisfy the following property. With knowledge of a secret trapdoor it is possible to efficiently (classically) compute the two pre-images x 0 and x 1 of a given y (f 0 (x 0 ) = f 1 (x 1 ) = y), but without the trapdoor, there is no efficient quantum algorithm that can compute such a triple (x 0 , x 1 , y), referred to as a claw, for any y. The adaptive hardcore bit property states that it is also hard to hold both a single pre-image x b , as well as a string d ∈ {0, 1} b \ {0 b } and a bit c such that c = d • (x 0 ⊕ x 1 ). We note that while the quantum device cannot compute a claw or break the adaptive hard-core bit property, nevertheless it can simultaneously hold an image y as well as a superposition 1 √ 2 (|0, x 0 ⟩ + |1, x 1 ⟩) over the two pre-images of y, simply by evaluating f on a uniform superposition over all inputs and measuring the image register y. Then by either measuring the state in the computational basis or the Hadamard basis, the device can obtain either a random pre-image x b of y, or a pair (c, d) such that c = d • (x 0 ⊕ x 1 ).

A high-level description of the [START_REF] Brakerski | A Cryptographic Test of Quantumness and Certifiable Randomness from a Single Quantum Device[END_REF] protocol is given below. 4. The prover measures in the computational or Hadamard basis to return the requested output and the verifier checks the validity by using the trapdoor to compute the two pre-images x 0 , x 1 of y.

Based on this protocol, we obtain the following lemma.

Lemma 4.1. Under the LWE assumption, there exists a 4-message interactive proof of quantumness protocol satisfying: (1) public-coin second verifier message and (2) semi-quantum soundness.

Proof. The protocol we use in the proof is the n-fold parallel repetition of Protocol 4.1. Protocol 4.1 has soundness error 1/2, and parallel repetition amplifies the soundness of this protocol, which has been shown in [START_REF] Radian | Semi-Quantum Money[END_REF]. By inspecting Protocol 4.1, we note that the verifier's second message is public coin. What remains is to argue that the protocol is also semi-quantum sound: in Protocol 4.1, the crucial point is that the prover can compute a quantum state to obtain its first message p 1 on its own, and later this quantum state will be either measured in the computational basis or the Hadamard basis to answer the challenge from the verifier. Now consider the security game of semi-quantum soundness: the prover can only compute p 1 via sending a classical query to V semi . Furthermore, this computation of y 1 is done by V semi , which acts exactly as a honest prover in Protocol 4.1 (except that the prover is now classical). Since this is a classical query, no efficient quantum prover can give a valid answer in the Hadamard basis for a fixed pair (v 1 , p 1 ). Formally, we can construct a simulator S which simulates the malicious semi-quantum prover P * and plays the role of the prover in Protocol 4.1. S makes a copy of (v 1 , x, p 1 ) (where x is the input of P * 's query) and later sends (v 1 , p 1 , v 2 ) to P * . Finally S outputs whatever P * outputs. One can see that now if P * breaks the semi-quantum soundness, S breaks the "adaptive hard-core bit" property of Protocol 4.1. (pp, sk) ← Setup(1 λ ). On input a security parameter λ, the setup algorithm Setup outputs a public parameter pp and a secret key sk. Without loss of generality, we will consider that the secret key sk includes the public parameter pp.

Quantum Advantage with Quantum Query Algorithms

QAF(sk, x). On input a secret key sk and a message x, the (randomized) evaluation algorithm QAF outputs either a message y, or a special "accept" symbol denoted accept, or a special "reject" symbol denoted reject. For our applications later, we require that by default QAF(sk, •) is stateless.

We additionally require the following properties:

q-Quantum-query easiness. For any λ ∈ N, there exists a QPT oracle algorithm A |QAF(sk,•)⟩ (pp) such that:

Pr QAF(sk, x) = accept | x ← A |QAF(sk,•)⟩ (pp) = 1 -negl(λ),
where A |QAF(sk,•)⟩ makes q quantum queries in total to QAF(sk, •) before outputting x, and the probability is taken over (pp, sk) ← Setup(1 λ ).

Classical-query hardness. For any λ ∈ N, for all QPT oracle algorithm A QAF(sk,•) (pp) such that:

Pr QAF(sk, x) = accept | x ← A QAF(sk,•) (pp) ≤ negl(λ), over (pp, sk) ← Setup(1 λ ).
Construction. Let Π ipq be a 4-message interactive proof of quantumness, in the form of Definition 4.3 in Section 4.3.1 with public-coin second verifier message and semiquantum soundness properties. We define our quantum-query advantage function as follows.

Lemma 4.3 (Classical-query hardness). Suppose Π ipq has public-coin second verifier messages and has semi-quantum soundness (Lemma 4.1). Then Construction 4.1 satisfies classical hardness.

Proof. Let A(pp) denote a QPT adversary with classical oracle access to QAF(sk, •). Without loss of generality, we assume that A queries its output x * to QAF(sk, •) before halting, and that A outputs the first x * it queries such that QAF(sk, x * ) = accept, if such a query exists. Let Q denote the number of oracle queries A makes. We define the following hybrid experiments, where we change the input-output behavior of QAF(sk, •):

Game G 0 : This is the classical-query hardness experiment (Definition 4.4) where A has classical oracle access to O 0 (sk, •) := QAF(sk, •), where (pp, sk) ← Setup(1 λ ). We say that the adversary wins the experiment if it outputs x * such that O 0 (sk, x * ) = accept.

Game G 1 : We do not change the behavior of the oracle (i.e., O 1 := O 0 ), but we change the winning condition of the experiment. We now guess a uniformly random index j ∈ Q . We now say that A wins if and only if the following conditions hold:

(a) the j-th oracle query from A, on input x j is of the form 1∥p 1 ∥p 2 ;

(b) O 1 (sk, x j ) = accept, and for all prior oracle queries x, O 1 (sk, x) ̸ = accept.

Game G 2 : We change how oracle queries are handled and define O 2 (sk, •) as follows. On any query i ̸ = j of the form

x i = 1∥p 1 ∥p 2 , O 2 rejects.
Claim 4.1. For all classical-query QPT adversaries A:

Pr A O 1 (sk,•) (pp) = 1 = 1 Q Pr A O 0 (sk,•) (pp) = 1 .
Proof. For any execution of the experiment in G 0 such that A(pp) outputs x * = 1∥p * 1 ∥p * 2 such that O 0 (sk, x * ) = accept, recall that we assume without loss of generality that A queries the oracle on x * , and that x * corresponds to the first query from A such that O 0 (sk, x * ) = accept. Let j * denote the index corresponding to the first query A makes on x * . Since j is chosen uniformly at random from Q , the probability of A winning in G 1 is the probability that j = j * , which is 1 Q . The claim follows. Claim 4.2. For all classical-query QPT adversaries A:

Pr A O 2 (sk,•) (pp) = 1 = Pr A O 1 (sk,•) (pp) = 1 .
Proof. By definition of the winning condition in G 1 , A loses in the experiment if its i-th oracle query on input x i satisfies i < j and O 1 (sk, x i ) = accept. Furthermore, the queries made by A after querying its first accepting input x * , if such an x * exists, do not affect its output (as we assume A would then output x * ). Therefore the winning probability of A in both G 1 and G 2 are exactly identical. Claim 4.3. For all classical-query QPT adversaries A:

Pr A O 2 (sk,•) (pp) wins in G 2 ≤ negl(λ).
Proof. Let A be a classical-query QPT algorithm such that A wins with probability ε in G 2 . We build a prover P * that breaks semi-quantum soundness of Π ipq with probability ε as follows:

1. Make a guess j

$ ← Q . Run A.
2. To answer the i-th query, if x i is of the form 0∥u, send u to the verifier to obtain (p

(i) 1 , v (i)
2 ). Store the pair (p

(i) 1 , v (i)
2 ) in a list R. Otherwise parse x i = 1∥p 1 ∥p 2 and respond to the query according to the following cases:

• If i = j, check that p 1 = p j 1 , set p j 2 := p 2 and send p j 2 as the second prover message in Π ipq .

• Otherwise, response to the query from A with reject.

Our reduction perfectly simulates the view of A in G 2 , and if A wins G 2 , we have that the pair (p j 1 , p j 2 ) is an accepting input for Π ipq in the semi-quantum soundness experiment.

Overall these claims show that the probability of A winning in G 0 is negligible, and finishes the proof of Lemma 4.3.

Separation for QSS-NIZK

In this section, we use our quantum-query advantage functions to give an example of a NIZK proof system that is classically simulation-sound but not quantumly simulationsound. Our separation is constructed by carefully embedding instances of interactive quantum-query advantage into the simulator of the NIZK system. The key conceptual insight is that although we are considering non-interactive proof systems, the security game for simulation-soundness is interactive, allowing us to use a quantum adversary that makes the quantum-query advantage function accept to also break the simulationsoundness: an efficient quantum adversary given classical oracle access to QAF cannot cause it to ever output accept, while it can do so by only making 2 quantum queries. Construction 4.2 -Separation for QSS-NIZK Let L ′ be a language in NP, with the associated relation R ′ . Let L denote the NP language defined in Equation (4.1). Let Π = ⟨Setup, P, V⟩ be a postquantum simulation-sound non-interactive zero-knowledge proof system for L, and ⟨Setup, QAF⟩ be a quantum-query advantage function. We define the following NIZK proof system Π = ⟨Setup, P, V⟩ for L as follows.

Setup(1 λ ): Output pp ← Π.Setup(1 λ ). (We note that pp = crs in the CRS model, and pp is a token that allow the parties to make quantum queries to the random oracle in the QROM.)

P(pp, x, w): Compute (pp ′ , sk) ← Setup(1 λ ).
Compute y ← QAF(sk, x). Generate a proof π using Π for the statement (x, y) ∈ L. Output (y∥π).

V(pp, x, π): Parse (y∥π) ← π. Output V(pp, (x, y), π).

We define the following augmented language L of R ′ :

L := {(x, y) : ∃ (sk, r, w) : R ′ (x, w) = 1 ∧ (y = reject ∨ y = QAF(sk, x; r))}. (4.1)
It is easy to see that completeness and soundness of Π follow directly from those of Π.

We now construct a simulator S for zero-knowledge property of Π, which is later on also used in the proofs of simulation-soundness. Let S := (S 1 , S 2 ) be a zero-knowledge simulator of Π. The simulator S := (S 1 , S 2 ) works as follows.

• S 1 : Output S 1 .

• S 2 : Initialize an empty list Q. On the input a statement x,

-For each pair (pp ′ i , sk i ) ∈ Q, compute y i ← QAF(sk i , x). * If y i = reject ∀ i, set y = reject.
* If there exists an index i such that y i = accept, set y = accept. * Otherwise, compute (pp ′ , sk) ← Setup(1 λ ), store (pp ′ , sk) in Q and compute y ← QAF(sk, x).

-Run S 2 on input (x, y) to obtain a simulated proof π.

-If y = accept, generate a simulated proof π ′ for a random false statement x ′ ∈ L (by sampling x ′ ∈ {0, 1} n uniformly at random, where n is the length of a statement in L) and output (π, (x ′ , π ′ )). Otherwise, output (y∥π).

Claim 4.4. Assume that ⟨Setup, QAF⟩ satisfies classical-query hardness (Definition 4.4), then Π is zero-knowledge.

Proof. We define the following hybrid experiment:

Game G 1 : We modify the behavior of the simulator S 2 . It computes y and π as normal.

However, if y = accept, it aborts. Otherwise, it outputs y∥π.

For any classical-query QPT adversary P * , the probability of P * making a query with some input x that makes the simulator S 2 abort in G 1 is negligible by classical-query hardness of ⟨Setup, QAF⟩. Therefore the output of the simulator for Π is indistinguishable from its output in G 1 . Now the zero-knowledge property in G 1 follows directly from the zero-knowledge property of Π, where the reduction samples (pp, sk) ← Setup(1 λ ), computes y ← QAF(sk, x) on its own and efficiently generates a proof π for the statement (x, y) for each query.

Using the simulation S, we show that our definition is strictly stronger than the classical one below. Claim 4.5. Assume that ⟨Setup, QAF⟩ satisfies quantum-query easiness (Definition 4.4), then Π is not quantum-secure simulation-sound.

Proof. Let A be the QPT algorithm associated to the quantum-query easiness of ⟨Setup, QAF⟩. Define P * as follows.

1. Run A by first making a query to S 2 . Note that the response registers of the query have two component: one to record the output of QAF, the other to record the output of S 2 . The first component is initialized as the all-zero string |0⟩, while the second component is initialized as the uniform superposition state |+⟩ to remove the entanglement between the two registers so that after the query, the second response register can be discarded.

2. Continue the execution of A (with an input x) and obtain a triple (π, (x ′ , π ′ )).

Output two pairs (x, π) and (x ′ , π ′ ).

By definition of S 2 and the quantum-query easiness of ⟨Setup, QAF⟩, both two pairs output by P * are valid, and furthermore x ′ is a false statement, showing that Π is not quantum-simulation-sound.

Claim 4.6. Assume that ⟨Setup, QAF⟩ satisfies classical-query hardness (Definition 4.4), then Π is classically simulation-sound.

Proof. The proof of this claim follows in an almost identical manner as that of Claim 4.4.

Constructions of QSS-NIZK

We devote this section to show that • In the common reference string model, Sahai's construction of unbounded simulationsound NIZK [DDOP+01; Sah01], when instantiating with quantum-secure onetime signature scheme (Definition 2.18), is also quantumly simulation-sound (Section 4.4.1).

• In the quantum random oracle model, the Fiat-Shamir transformation [DFMS19; LZ19] is quantumly simulation-sound, if the underlying Sigma protocol satisfies a strong property that we call randomness collision-resistance (Section 4.4.2).

Construction in the Common Reference String Model

The Naor commitment scheme. We first recall the bit commitment protocol of Naor [START_REF] Naor | Bit Commitment Using Pseudo-Randomness[END_REF] based on pseudorandom generators, which will be used later in the construction. Let PRG be a pseudorandom generator stretching λ bits to 3λ bits. The Naor commitment procedure commits to a bit b as follows, using randomness r ∈ {0, 1} 3λ and s ∈ {0, 1} λ .

Commit(b; (r, s)) =    (r, PRG(s)) if b = 0, (r, PRG(s) ⊕ r) if b = 1.
We note that if PRG is post-quantumly secure (against QPT adversaries with classical access to PRG) then the Naor commitment scheme is also post-quantumly computationally hiding and statistically binding.

Sahai's construction. Let PRF be a family of pseudorandom functions mapping {0, 1} * to {0, 1} λ . Let Sig := ⟨KeyGen, Sign, Verif⟩ be a one-time signature scheme. Finally, let Π ′ be a single-theorem adaptive NIZK systems for a language L ′ described below, associated with a QPT simulator S ′ := (S ′ 1 , S ′ 2 ). The construction for a simulation-sound NIZK system Π for some NP language L is given in Construction 4.3. Theorem 4.2. If Π ′ is a single-theorem quantum NIZK proof system for L ′ , Sig is a quantum-secure one-time signature scheme and quantum-secure one-way functions exist, the proof system Π described above is an unbounded quantum-simulationsound NIZK proof system for L.

S 1 (1 λ ) s $ ← {0, 1} λ r i $ ← {0, 1} 3λ , a i $ ← {0, 1} λ for i ∈ 1, λ g i ← Commit(s i ; r i , a i ) for i ∈ 1, λ crs 1 := {g 1 , • • • , g λ } crs 2 $ ← {0, 1} 3λ crs 3 ← Π ′ .Setup(1 λ ) crs := (crs 1 , crs 2 , crs 3 ) td := (s, a 1 , • • • , a λ ) return (crs, td) S 2 (crs, td, x) (vk, sk) ← Sig.KeyGen(1 λ ) u ← PRF(s, vk) π ′ ← Π ′ .S ′ 2 crs 3 , (x, u, vk, crs 1 , crs 2 ), (s, a 1 , • • • , a λ ) σ ← Sig.Sign(sk, x, u, π ′ ) return (vk, x, u, π ′ , σ)
Proof. Completeness follows by inspection. Soundness follows by the fact that if crs is chosen uniformly at random, then the probability that crs 1 can be interpreted as a commitment to any string is exponentially small, and likewise the probability that crs 2 is in the image of the pseudorandom generator PRG is exponentially small. For the proof of adaptive unbounded zero-knowledge, we note that the only difference in the common random string crs between the real protocol and the simulation is crs 1 . However, by post-quantum security of the commitment scheme, the two are computationally indistinguishable. (We note that the commitments are classical.) Thus, since the simulator for Π uses only a different witness to prove the same statement, the view of the adversary in the simulator experiment is computationally indistinguishable from the view of the adversary in the modified prover experiment. Thus, adaptive unbounded zero-knowledge follows.

Quantum simulation-soundness proof. The proof of simulation-soundness follows almost identical as the one in the classical setting [START_REF] Sahai | Simulation-Sound Non-Interactive Zero Knowledge[END_REF], except for some small modifications on the reductions to quantum security of building blocks. We give the full proof as follows.

Let A be a QPT adversary. The proof proceeds by a sequence of games where G 0 is defined in which A can make quantum queries to S 2 (defined in Figure 4.1), and the winning condition is defined as in Definition 4.2. For any game G i , we denote by Adv i (A) the advantage of A in G i , that is, Pr G i (1 λ , A) = 1 , where the probability is taken over the random coins of G i and A.

Game G 0 : This is the actual adversary experiment, in which A can make quantum queries to the simulator S 2 and outputs two pairs {(x i , π i )} 2 i=1 . Let R be the list of all classical randomness S 2 used to answer each adversarial query during the experiment. We say A wins if either of the following holds: (a) There exists i ∈ 1, 2 such that x i / ∈ L, for all r ∈ R, S 2 (x i , r) ̸ = π i and V(crs, x i , π i ) = 1.

(b) There exists a randomness r ∈ R such that S 2 (x 1 , r) = π 1 and S 2 (x 2 , r) = π 2 and at least one of x 1 or x 2 is not in L.

Game G 1 : In this game, we change the winning condition. The winning condition is now defined as:

(a) There exists i ∈ 1, 2 such that Proof. We show that the probability that the adversary wins by the second condition is negligible, otherwise it must be able to break the unforgeability of the one-time signature. Assume that A wins by the second condition with non-negligible probability ε.

x i / ∈ L, for all r ∈ R, S 2 (x i , r) ̸ = π i and V(crs, x i , π i ) = 1.
Let T be the list of verification keys output by the simulator. We note that since verification keys (as well as signing keys) are classically and independently of the adversary's queries, T is well-defined as a list of classical strings. Furthermore, with all but exponentially small probability, these verification keys will all be distinct. First, we note that if the output of the adversary can be computed from the same randomness r ∈ R, it means that the verification keys vk 1 and vk 2 (as parts of the proofs) output by the adversary also in T , and furthermore it must be the case that vk 1 = vk 2 , and at least one of the two proofs is a forgery of the signature scheme. Denote this verification key as vk * , and the forge as (m, t).

We show how to use A to break the (weak) unforgeability of Sig (the security game W-BZ-Exp as defined in Definition 2.18). Specifically, assume that the adversary A makes at most q queries to the simulator. The reduction algorithm picks a random index i ∈ 1, q and uses A's i-th query in the game W-BZ-Exp. With probability 1/q, this verification key returned by the challenger in the game W-BZ-Exp is vk * . In this case, the reduction just returns A's output pairs

{(x i , π i = (vk * , x i , u i , π ′ i , σ i ))} 2 i=1 . If follows that with probability ε/q, {((x i , u i , π ′ i ), σ i )} 2 i=1
are valid forges of Sig (with respect to vk * ). We note that x 1 ̸ = x 2 by the assumption. This probability is non-negligible if ε is non-negligible. The proof of the claim follows.

Game G 2 : In this game, we continue changing the winning condition, as follows: (a) There exists i ∈ 1, 2 such that for all r ∈ R, S 2 (x i , r) ̸ = π i and V(crs, x i , π i ) = 1 and u = PRF(s, vk) where (u, vk) is parts of the output of the proof π i and s is a part of the trapdoor information td.

We note that now this game can be implemented in quantum-polynomial-time. Proof. Since crs 2 is a uniformly random string, there is a string d such that crs 2 = PRG(d) with only negligible probability. By the definition of the language L ′ and the fact that Π ′ is a proof system for L ′ , we conclude that if x / ∈ L, the only way the adversary's proof can be accepted is if PRF(s, vk) = u with overwhelming probability. This is because the adversary never sees a valid proof for a false statement of L ′ (the simulator is generating the simulated proofs using the commitment witness), thus any adversary that outputs a valid proof for a false statement of L ′ (which means x / ∈ L ∧ PRF(s, vk) ̸ = u) would break the soundness of Π ′ . Therefore, the winning conditions in G 1 and G 2 are exponentially close.

Game G 3 : In this game, we make crs 2 to be pseudorandom. That is, instead of sampling crs 2 uniformly at random, we compute crs 2 by using a pseudorandom generator PRG. The change is described in Figure 4.2. Proof. The indistinguishability between G 2 and G 3 follows directly from post-quantum security of PRG.

S 1 (1 λ ) d $ ← {0, 1} λ s $ ← {0, 1} λ r i $ ← {0, 1} 3λ , a i $ ← {0, 1} λ for i ∈ 1, λ g i ← Commit(s i ; r i , a i ) for i ∈ 1, λ crs 1 := {g 1 , • • • , g λ } crs 2 $ ← PRG(d) crs 3 ← Π ′ .Setup(1 λ ) crs := (crs 1 , crs 2 , crs 3 ) td := (s, a 1 , • • • , a λ ) return (crs, td) S 2 (crs, td, x) (vk, sk) ← Sig.KeyGen(1 λ ) u ← PRF(s, vk) π ′ ← Π ′ .S ′ 2 crs 3 , (x, u, vk, crs 1 , crs 2 ), (s, a 1 , • • • , a λ ) σ ← Sig.Sign(sk, x, u, π ′ ) return (vk, x, u, π ′ , σ)
Game G 4 : In this game, the trapdoor information also includes the seed d of PRG. Furthermore, the simulator S ′ 2 , instead of using the witness of the commitments (that is, (s, a 1 , • • • , a λ )), uses the seed d for crs 2 to generate the proof π ′ . The change is described in

1 (1 λ ) d $ ← {0, 1} λ s $ ← {0, 1} λ r i $ ← {0, 1} 3λ , a i $ ← {0, 1} λ for i ∈ 1, λ g i ← Commit(s i ; r i , a i ) for i ∈ 1, λ crs 1 := {g 1 , • • • , g λ } crs 2 $ ← PRG(d) crs 3 ← Π ′ .Setup(1 λ ) crs := (crs 1 , crs 2 , crs 3 ) td := (s, a 1 , • • • , a λ , d ) return (crs, td) S 2 (crs, td, x) (vk, sk) ← Sig.KeyGen(1 λ ) u ← PRF(s, vk) π ′ ← Π ′ .S ′ 2 crs 3 , (x, u, vk, crs 1 , crs 2 ), (d)
σ ← Sig.Sign(sk, x, u, π ′ ) return (vk, x, u, π ′ , σ) Game G 5 : In this game, we make crs 1 independent of s: we choose two independent uniformly random strings s, s ′ and make crs 1 into a commitment to s ′ rather than s. The change is described in Proof. The indistinguishability between G 4 and G 5 follows the computational hiding property of the Naor's commitment scheme.

Game G 6 : In this game, we replace PRF with a truly random function H (lazy-sampling).

The change is described in Figure 4.5.

Claim 4.12. For any QPT adversary A, |Adv 5 (A) -Adv 6 (A)| ≤ negl(λ).

Proof. The indistinguishability between G 5 and G 6 follows pseudorandomnesss of PRF.

Note that here since vk is classical, we only need classical pseudorandomess of PRF against quantum adversaries.

Claim 4.13. For any adversary A, Adv 6 (A) ≤ 2 -λ .

Proof. Since we only consider the case where vk * / ∈ T , for any vk * output by A, H(vk * ) will be a uniformly selected value that is totally independent of everything the adversary sees. Denote this value as u ′ . Then the probability that the proof output by A having u = u ′ is exactly 2 -λ . The claim follows.

Overall, we conclude the proof of the theorem.

S 1 (1 λ ) d $ ← {0, 1} λ s, s ′ $ ← {0, 1} λ r i $ ← {0, 1} 3λ , a i $ ← {0, 1} λ for i ∈ 1, λ g i ← Commit( s ′ i ; r i , a i ) for i ∈ 1, λ crs 1 := {g 1 , • • • , g λ } crs 2 $ ← PRG(d) crs 3 ← Π ′ .Setup(1 λ ) crs := (crs 1 , crs 2 , crs 3 ) td := (s, a 1 , • • • , a λ , d) return (crs, td) S 2 (crs, td, x) (vk, sk) ← Sig.KeyGen(1 λ ) u ← PRF(s, vk) π ′ ← Π ′ .S ′ 2 crs 3 , (x, u, vk, crs 1 , crs 2 ), (d) σ ← Sig.Sign(sk, x, u, π ′ ) return (vk, x, u, π ′ , σ)
S 1 (1 λ ) d $ ← {0, 1} λ s, s ′ $ ← {0, 1} λ r i $ ← {0, 1} 3λ , a i $ ← {0, 1} λ for i ∈ 1, λ g i ← Commit(s ′ i ; r i , a i ) for i ∈ 1, λ crs 1 := {g 1 , • • • , g λ } crs 2 $ ← PRG(d) crs 3 ← Π ′ .Setup(1 λ ) crs := (crs 1 , crs 2 , crs 3 ) td := (s, a 1 , • • • , a λ , d) return (crs, td) S 2 (crs, td, x) (vk, sk) ← Sig.KeyGen(1 λ ) u $ ← {0, 1} λ π ′ ← Π ′ .S ′ 2 crs 3 , (x, u, vk, crs 1 , crs 2 ), (d) σ ← Sig.Sign(sk, x, u, π ′ ) return (vk, x, u, π ′ , σ)

Construction in the Quantum Random Oracle Model Interactive Proof Systems

In this section, we are mainly interested in a specific class of public-coin interactive proof systems for NP languages, called Σ-protocols. Σ-protocols have a 3-move shape where the first message α, called commitment, is sent by the prover and then, alternatively, the parties exchange the other messages β and γ, called (respectively) challenge and response. Furthermore, the challenge β is public-coin. A formal definition is given below.

Definition 4.5 -Σ-protocols A Σ-protocol Σ = (P, V) for an NP language L is a three-round public-coin interactive proof system where P = (P 0 , P 1 ) and V = (V 0 , V 1 ) are PPT algorithms, with the following additional properties:

Completeness. If x ∈ L, any proper execution of the protocol between P and V ends with the verifier accepting P's proof.

Honest-verifier zero knowledge (HVZK).

There exists a QPT algorithm S, called zeroknowledge simulator, such that for any QPT distinguisher D = (D 0 , D 1 ) and for any (x, w) ∈ R L , the view of the following two experiments, real and simulated, are computationally indistinguishable:

Expt 0 Σ (1 λ , D) (x, w, state) ← D 0 (1 λ ) π ← ⟨P(1 λ , x, w), V(1 λ , x)⟩ b ← D 1 (π, state) Expt 1 Σ (1 λ , D) (x, w, state) ← D 0 (1 λ ) π ← S(1 λ , x) b ← D 1 (π, state)
where ⟨P(x, w), V(x)⟩ denotes the verdict returned at the end of the interaction between P and V on common input x and private input w.

Soundness. If x / ∈ L then any malicious (even unbounded) prover P * is accepted only with negligible probability.

We say (P, V) is non-trivial if the first message α is computationally indistinguishable from a uniformly random string [START_REF] Faust | On the Non-malleability of the Fiat-Shamir Transform[END_REF].

In this section, we also consider a non-standard property of Σ-protocols that we call randomness collision-resistance property, which requires that a QPT adversary A who runs the simulator S in superposition, cannot extract two pairs of {(x i , π i )} 2 i=1 such that they are both computed using the same randomness from the simulator. The definition is formally given as follows.

Definition 4.6 -Randomness collision-resistance In the following, for each query, the simulator S stores the (classical) randomness used to answer the query in a list R. For any QPT adversary A, we require that:

Pr ∃ r ∈ R : S(1 λ , x i ; r) = π i ∀ i ∈ 1, 2 {(x i , π i )} 2 i=1 ← A |S(1 λ ,•)⟩ (1 λ ) ≤ negl(λ).
Remark 4.2. If the zero-knowledge property of the Σ-protocol requires its simulator to use independent randomness for every statement, there is a simple transformation that converts that simulator into another simulator that is secure when a single randomness value is used for an entire query: for each query, choose a fresh random key k for a quantum pseudorandom function (PRF). This will be the single per-query randomness value. To answer a query in superposition, answer each statement x in the superposition using randomness obtained by applying the PRF to x using the key k. From the adversary's point of view, this is indistinguishable from choosing independent randomness for each statement.

Removing Interaction

The Fiat-Shamir paradigm [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF] applies to any Σ-protocol (and more generally to any three-round public-coin proof system): we start from an interactive protocol (P, V) and remove the interaction between P and V by replacing the challenge, chosen at random by the verifier, with a hash value H(α, x) computed by the prover, where H is a hash function modeled as a random oracle, and α is the prover's first message. Thus, the interactive protocol (P, V) is turned into a non-interactive one: The resulting protocol, denoted (P H , V H ), is called Fiat-Shamir proof system. In this section, we will assume the existence of Σ-protocols with randomness collisionresistance, and prove that the corresponding Fiat-Shamir proof system is quantum simulation-sound. The construction of Σ-protocols with randomness collision-resistance is given in Section 4.4.2.

We note that the security of the Fiat-Shamir transformation in the quantum random oracle model has been proven in [START_REF] Don | Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model[END_REF][START_REF] Liu | Revisiting Post-quantum Fiat-Shamir[END_REF]. We refer the reader to [START_REF] Don | Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model[END_REF] for the description of the Fiat-Shamir simulator, for now let us call this simulator the canonical simulator.

Notation. Let H : X ′ → C is a hash function with a domain X ′ that contains all pairs (x, α) with x ∈ {0, 1} n and α produced by P, and the range C is the challenge space of the Σ-protocol. A proof of a Fiat-Shamir system for a statement x ∈ L is of the form π := (α, H(x, α), γ). Theorem 4.3 (Quantum simulation soundness of the Fiat-Shamir transform). Consider a non-trivial three-round public-coin HVZK interactive proof system (P, V) for a language L ∈ NP, with randomness collision-resistance property and superpolynomially sized challenge space. In the quantum random oracle model, the proof system (P H , V H ) derived from (P, V) via the Fiat-Shamir transform is a quantum simulation-sound NIZK (as defined in Definition 4.2) with respect to its canonical simulator S.

Proof. Completeness, soundness and post-quantum zero-knowledge of the Fiat-Shamir transformation in the quantum random oracle have been proven in [START_REF] Don | Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model[END_REF][START_REF] Liu | Revisiting Post-quantum Fiat-Shamir[END_REF].

Here, we prove the quantum simulation-soundness. We first recall the measure-andreprogram in the quantum random oracle lemma introduced in [DFMS19].

Lemma 4.4 ([DFMS19, Theorem 2]

). Let X , Y be finite non-empty sets. There exists a black-box quantum polynomial-time two-stage quantum algorithm S with the following property. Let A be an arbitrary oracle quantum algorithm that makes q queries to a uniformly random H : X → Y and that outputs some x ∈ X and a (possibly quantum) output z. Then, the two-stage algorithm S A outputs some x ∈ X in the first stage and, upon a random Θ ∈ Y as input to the second stage, a (possibly quantum) output z, so that for any x ⋆ ∈ X and any predicate V :

Pr Θ x = x ⋆ ∧ V (x, Θ, z) = 1 | (x, z) ← ⟨S A , Θ⟩ ≥ 1 O(q 2 ) Pr H x = x ⋆ ∧ V (x, H(x), z) = 1 | (x, z) ← A H -ε x ⋆ ,
where the additive error term ε x ⋆ is equal to 1 2q|Y| when summed over all x ⋆ . Suppose there exists a QPT adversary A that breaks the quantum simulationsoundness of the non-interactive protocol with non-negligible probability ε. Let {(x i , π i )} 2 i=1 be the output pairs of A. For simplicity, we denote the canonical simulator S as (S 1 , S 2 ), in which S 1 simulates answers to the random oracle H, and S 2 generates simulated proofs. Let q be the number of queries that A makes to S 1 . Without loss of generality, we assume that whenever A succeeds and outputs two accepting proofs {(α i , γ i )} 2 i=1 , it has previously queried the oracle S 1 on input (x i , α i ). The argument for this is that it is straightforward to transform any adversary that violates this condition into an adversary that makes two additional classical queries to S 1 and wins with the same probability.

Recall that A wins if its output satisfies either one of the two conditions defined in Definition 4.2. If A wins by the first condition, we denote this event as con 1 , and similarly the second by the event con 2 . Apparently, we have that ε

:= Pr [ A wins ] = Pr [ A wins ∧ con 1 ] + Pr [ A wins ∧ con 2 ].
When con 1 happens. This is the case where at least one of the output of A is computed from a fresh new randomness that were not used by the simulator S 2 . Denote this pair as (x ⋆ , π ⋆ ). We will use this adversary A to build an adversary that breaks the soundness of the underlying Σ protocol.

We fix a family H of 2(q + 2)-wise independent hash functions and let S 1 simulates the random oracle by choosing a random function H ∈ H. Furthermore, we observe that, for any fixed x o , the family {H * Θx o | H ∈ H, Θ ∈ C}, is a family of 2(q + 2)-wise independent hash functions as well, where H * Θx o denotes the following function:

(H * Θx o )(x) =    H(x) if x ̸ = x o , Θ if x = x o .
We will use the fact that (even computationally unbounded) q-query adversary A cannot distinguish a random function H * Θx o in that family from a truly random function H [START_REF] Zhandry | How to Construct Quantum Random Functions[END_REF]. Now, we can apply Lemma 4.4 and make a reduction to the standard definition of soundness of the underlying Σ protocol. Formally, recall that (x ⋆ , π ⋆ = (α ⋆ , γ ⋆ )) such that V(x ⋆ , H(x ⋆ , α ⋆ ), γ ⋆ ) = 1. We will use (x ⋆ , α ⋆ ) in the execution with the verifier V of the Σ-protocol. In order to do that, we apply Lemma 4.4, with (x ⋆ , α ⋆ ) playing the role of what is referred to as x in the lemma statement, the verifier V is as the predicate V , to obtain the existence of a simulator S A that produces (x ⋆ , α ⋆ ) in a first stage, and upon receiving a random challenge β ⋆ (from the verifier V of the Σ-protocol) produces γ ⋆ , such that:

Pr β ⋆ x = x ⋆ ∧ V(x, α ⋆ , β ⋆ , γ ⋆ ) = 1 | (x, α ⋆ , β ⋆ , γ ⋆ ) ← ⟨S A , β ⋆ ⟩ ≥ 1 O(q 2 ) Pr H x = x ⋆ ∧ V(x, α ⋆ , H(x, α ⋆ ), γ ⋆ ) = 1 | (x, α ⋆ , γ ⋆ ) ← A H -ε x ⋆ .
This can be written as

Pr x = x ⋆ ∧ v = accept | (x, v) ← ⟨S A , V⟩ ≥ 1 O(q 2 ) Pr H x = x ⋆ ∧ V H (x, π ⋆ ) = 1 | (x, π ⋆ ) ← A H -ε x ⋆ , ( 4.2)
where v denote the verifier's output.

We build a reduction P * breaking the soundness of the underlying interactive scheme as follows. P * uses S A (which uses A as a black-box) to simulate S 1 . Whenever A makes queries to S 2 , P * runs the HVZK simulator of the interactive protocol (in superposition). It is easy to see that P * perfectly simulates the canonical simulator S. Finally, P * outputs whatever S A outputs.

We note that by the assumption that the Σ-protocol is non-trivial, the probability that in when simulating S 2 , the probability that P * returns (x ⋆ , α ⋆ , •) to A is negligible. (Note that this is true even when x ⋆ is the input of the query sent by A.) This means that (x ⋆ , π ⋆ ) must have been computed using a fresh randomness which was not used by P * . From Equation (4.2), it thus follows that Pr [ A wins ∧ con 1 ] is negligible.

When con 2 happens. This is the case where both pairs are computed by the same randomness that were used by the simulator S 2 . We will reduce this case to the randomness collision-resistance property of the underlying Σ protocol. Specifically, consider a QPT algorithm P * which runs A internally as a black-box. The description of P * is as follows.

• P * answers the queries to S 1 using a random 2(q + 2)-wise independent hash function H.

• P * keeps a list R of all randomness used to answer queries to S 2 . Note that except with exponentially small probability, all the randomess will be distinct.

• Whenever A outputs fake proofs {(x i , π i = (α i , γ i ))} 2 i=1 , P * checks if there exists a randomness r ∈ R such that S 2 (x i , r) = π 2 for i ∈ 1, 2 . It then computes

β i = H(x i , α i ). • P * outputs {x i , (α i , β i , γ i )} 2 i=1 .
Game G 0 : This is the real-world experiment. In particular, the challenge encryption oracle and the decryption oracle are implemented as follows. Game G 1 : This is identical to G 0 , except that now in the decryption oracle, instead of using sk 0 , we use sk 1 , combining with the fact that iPRF is invertible for the decryption.

RR

Claim 4.14. For any adversary A, Adv 1 (A) = Adv 0 (A).

Proof. The proof of the claim follows directly from the correctness of encryption schemes E, E ′ and the fact that iPRF is invertible.

Game G 2 : This is identical to G 1 , except that now in the challenge encryption oracle, we use the simulator S of Π to generate the proof instead of using the real prover P. Proof. We note that in G 2 and G 3 , the secret key sk 0 is not used at all. The indistinguishability between G 2 and G 3 follows immediately from qIND-qCPA security of E.

We note that starting from G 3 , the challenge encryption oracle can be implemented as a compressed encryption oracle (sine we are now in the random world of E). Concretely, the challenge encryption oracle implements the following map:

x,y α x,y |x, y⟩ → x,y u α x,y |x, E.Encrypt(pk 0 , u)∥E ′ .Encrypt(pk 1 , k)∥iPRF(k, x)∥π⟩ ⊗ |D⟩
where D is the database of the compressed random encryption oracle for E. In particular, D will be in superposition of tuples (x, u, y 0 ) (if D(x) ̸ = ⊥). Furthermore, we note that if D(x) ̸ = ⊥, we can re-compute (y 1 , y 2 , π) and also store these values in the corresponding slot in D. The reason is that from x ∈ D, these values can be computed with the classical randomness used in the challenge encryption oracle of E.

Game G 4 : This is identical to G 3 , except that now instead of using sk 1 in the decryption oracle, we use sk 0 and D. Claim 4.17. For any QPT adversary A, |Adv 4 (A) -Adv 3 (A)| ≤ negl(λ).

Proof. We show that if A can distinguish the two games G 3 and G 4 with non-negligible probability ε, then we can construct a QPT adversary B that runs A internally as a black-box and breaks the quantum simulation-soundness of Π with non-negligible probability. Notice that the only way A can distinguish G 3 and G 4 is to submit an "invalid" decryption query in which the proof π if of a false statement but the verification passes.

Formally, B runs A and randomly measure one of A's decryption queries to obtain a tuple y * = (y * 0 , y * 1 , y * 2 , π * ). If A makes at most q decryption queries, then with probability at least ε/q, y * will be a pair of statement and proof such that the statement is a false statement but π * passes the verification of Π. Then B measure its own database D to obtain another tuple y = (y 0 , y 1 , y 2 , π) which is supposed to be generated by the simulator of Π. By the definition of Decrypt 5 , we have that y ̸ = y * . Thus by outputting (y, y * ), B breaks the quantum simulation-soundness of Π with probability ε/q, which completes the proof of the claim.

We note that from starting from this game, the secret key sk 1 is not used anymore.

Game G 5 : This is identical to G 4 , except that now in the challenge encryption oracle, we change the encryption E ′ .Encrypt(pk 1 , k) for some random key k by an encryption E ′ .Encrypt(pk 1 , 0). Proof. The indistinguishability between G 4 and G 5 follows immediately from IND-qCPA security of E ′ . Note that since here the encryption is a classical encryption of a classical random key k (which is independent of A's query), we only need qCPA security against classical challenge query of E ′ .

Game G 6 : This is identical to G 5 , except that now in the challenge encryption oracle, instead of computing y 2 as iPRF(k, x), we compute y 2 ← iPRF(k, u) where u is extracted from the database D (note that u ∈ D(x)). We abuse the notation and write D(x) = u. Furthermore, for consistency, we also allow E's encryption algorithm to take as input the database D. Proof. The indistinguishability between G 5 and G 6 follows immediately from (weak) quantum-pseudorandomness of iPRF. We note that here we only need weak security notion, since iPRF -1 is never invoked in the decryption oracle.

Game G 7 : This is identical to G 6 , except that now in the challenge encryption oracle, instead of computing y 1 as an encryption of 0, we change it back to encryption of a random key k, that is Proof. The indistinguishability between G 6 and G 7 follows immediately from IND-qCPA security of E ′ .

y 1 ← E ′ .Encrypt(pk 1 , k).
Game G 8 : This is identical to G 7 , except that now in the challenge encryption oracle, we use the real prover P of Π to generate the proof instead of using the simulator. Proof. The indistinguishability between G 7 and G 8 follows from zero-knowledge property of Π.

In this final game G 8 , we have the challenge encryption oracle implements exactly as the one in the random-world of E. Overall, we complete the proof of the theorem.

G 1 : Decrypt(sk, (y 0 , y 1 , y 2 , π)) b ← Π.V(crs, (y 0 , y 1 , y 2 ), π) if b = 0 then return ⊥ k ← E ′ .Decrypt(sk 1 , y 1 ) return iPRF -1 (k, y 2 ) G 2 : Encrypt(pk, x) k $ ← iPRF.Setup(1 λ ) y 0 ← E.Encrypt(pk 0 , x; r 0 ) y 1 ← E ′ .Encrypt(pk 1 , k; r 1 ) y 2 ← iPRF(k, x) π ← Π.S(crs, (y 0 , y 1 , y 2 )) return (y 0 , y 1 , y 2 , π) G 3 : Encrypt(pk, x) k $ ← iPRF.Setup(1 λ ) y 0 ← R Encrypt(pk 0 ,•) (x) y 1 ← E ′ .Encrypt(pk 1 , k; r 1 ) y 2 ← iPRF(k, x) π ← Π.S(crs, (y 0 , y 1 , y 2 )) return (y 0 , y 1 , y 2 , π) G 4 : Decrypt(sk, (y 0 , y 1 , y 2 , π), D) b ← Π.V(crs, (y 0 , y 1 , y 2 ), π) if b = 0 then return ⊥ if ∃(x, (y 0 , y 1 , y 2 , π)) ∈ D then return x return E.Decrypt(sk 0 , y 0 ) G 5 : Encrypt(pk, x) k $ ← iPRF.Setup(1 λ ) y 0 ← R Encrypt(pk 0 ,•) (x) y 1 ← E ′ .Encrypt(pk 1 , 0; r 1 ) y 2 ← iPRF(k, x) π ← Π.S(crs, (y 0 , y 1 , y 2 )) return (y 0 , y 1 , y 2 , π) G 6 : Encrypt(pk, x, D) u ← D(x) k $ ← iPRF.Setup(1 λ ) y 0 ← R Encrypt(pk 0 ,•) (x) y 1 ← E ′ .Encrypt(pk 1 , 0; r 1 ) y 2 ← iPRF(k, u) π ← Π.S(crs, (y 0 , y 1 , y 2 )) return (y 0 , y 1 , y 2 , π) G 7 : Encrypt(pk, x, D) u ← D(x) k $ ← iPRF.Setup(1 λ ) y 0 ← R Encrypt(pk 0 ,•) (x) y 1 ← E ′ .Encrypt(pk 1 , k; r 1 ) y 2 ← iPRF(k, u) π ← Π.S(crs, (y 0 , y 1 , y 2 )) return (y 0 , y 1 , y 2 , π) G 8 : Encrypt(pk, x, D) u ← D(x) k $ ← iPRF.Setup(1 λ ) y 0 ← R Encrypt(pk 0 ,•) (x; r 0 ) y 1 ← E ′ .Encrypt(pk 1 , k; r 1 ) y 2 ← iPRF(k, u)
π ← Π.P(crs, (y 0 , y 1 , y 2 ), (x, r 0 , r 1 )) return (y 0 , y 1 , y 2 , π)

Quantum Cryptography From Coset States

Given a subspace A ⊆ F n 2 , the corresponding subspace state is defined as a uniform superposition over all vectors in the subspace A, i.e., |A⟩ := 1 √ |A| v∈A |v⟩. The idea of using hidden subspace state to construct quantum cryptographic primitives was first proposed by Aaronson and Christiano in [START_REF] Aaronson | Quantum money from hidden subspaces[END_REF] in the oracle model where the parties have access to some membership checking oracles. This idea was realized subsequently in the plain model using indistinguishability obfuscation by Zhandry [START_REF] Zhandry | Quantum Lightning Never Strikes the Same State Twice[END_REF]. The subspace state idea was later generalized to coset states in [CLLZ21; VZ21], which can be seen as quantum one-time pad encrypted subspace states. Formally, for a subspace A ⊆ F n 2 and two vectors s, s ′ ∈ F n 2 , the corresponding coset state is defined as

|A s,s ′ ⟩ := 1 √ |A| x∈A (-1) ⟨x,s ′ ⟩ |x + s⟩.
The coset state idea has shown a broad range of applications to signature tokens, unclonable decryptors, copy-protection [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF], classical proof of quantum knowledge [START_REF] Vidick | Classical Proofs of Quantum Knowledge[END_REF], public semi-quantum money [START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF], semiquantum signature tokens [START_REF] Shmueli | Semi-quantum Tokenized Signatures[END_REF], and unclonable encryption [START_REF] Ananth | On the Feasibility of Unclonable Encryption, and More[END_REF]. Indeed, to the best of our knowledge, all known provably secure copy-protection schemes with standard malicious security are based on hidden coset states [CLLZ21; AKLL+22]. In these protocols, the basic ground is to encode the program into random hidden coset states and send these states as copy-protection of the program to the receiver.

(Semi-)Quantum Cryptography From BB84 States

In a breakthrough result [START_REF] Mahadev | Classical Verification of Quantum Computations[END_REF], Mahadev introduced a protocol that allows a classical verifier to verifiably delegate a quantum computation to an untrusted quantum prover. The key ingredient of Mahadev's protocol is a measurement protocol, which allows the client to delegate single-qubit measurements in the standard or Hadamard basis to a quantum prover, and be able to efficiently verify the measurement outcome, assuming that the prover cannot break certain cryptographic assumptions.8 This yields the first kind of semi-quantum protocols, so-called prepare-and-measure protocols. These protocols involve a quantum prover preparing and sending a quantum state to the verifier and the verifier performing single-qubit measurements on this state. One can use Mahadev's measurement protocol to delegate these quantum measurements to the prover itself. This is in contrast to the other type of quantum protocols: prepare-and-send protocols, in which the verifier prepares and sends quantum states to the prover.

It turns out that replacing the quantum communication of prepare-and-send protocols is significantly harder than doing so for prepare-and-measure protocols. At a high level, the main difference is the following: Mahadev's measurement protocol shows that there exists a quantum state that is consistent with the distribution of measurement outcomes reported by the prover. (One can think about this similarly as the proof of membership in an interactive proof system.) In contrast, if we want to replace the step of the verifier sending a physical quantum state to the prover, we need to show that the prover has actually constructed a certain quantum state, not just that such a quantum state exists. This is done by establishing a rigidity argument. The idea of rigidity, first formally introduced by Mayers and Yao [START_REF] Mayers | Self Testing Quantum Apparatus[END_REF], is that certain games can be used to "self-test" quantum states: if such a game is won with high enough probability, then the self-test property tells us that the players must hold some quantum state, up to local isometry. In our context, a game is a model of the protocol under consideration, and the game is won if the prover passes the client's verification.

Lying strictly between the two notions of "there exists" and "actually constructed" is the notion of classical proof of quantum knowledge formalized in [START_REF] Vidick | Classical Proofs of Quantum Knowledge[END_REF]. They also show that indeed Mahadev's measurement protocol achieves this stronger notion of proof of knowledge, in the sense that the prover "knows" the state it is measuring, not just that it exists mathematically. The same property also holds for a coset states prepare-and-send protocol: if the verifier sends a hidden coset state to the prover, later on the prover can prove that it "knows" the received coset state. Although this setting seems close to our protocol, we note that the proof given in [START_REF] Vidick | Classical Proofs of Quantum Knowledge[END_REF] does not directly carry to our setting, where we replace quantum communication by classical communication. 9The first semi-quantum protocol that provably forces a quantum prover to prepare a certain quantum state is the single-qubit remote state preparation protocol of [START_REF] Gheorghiu | Computationally-Secure and Composable Remote State Preparation[END_REF] (see also [START_REF] Cojocaru | QFactory: Classically-Instructed Remote Secret Qubits Preparation[END_REF] for a related result). [START_REF] Metger | Self-Testing of a Single Quantum Device Under Computational Assumptions[END_REF] gives a protocol that allows a classical verifier to certify that a quantum prover must have prepared and measured a Bell state, i.e., an entangled 2-qubit quantum state. Finally, [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF], by developing new techniques to show a n-fold parallel rigidity proof, gives the first parallel remote BB84 state preparation protocol. Recall that BB84 states are the four states:

{|0⟩ , |1⟩ , |+⟩ , |-⟩} where |±⟩ := 1 √ 2 (|0⟩ ± |1⟩).
Their proof technique is the backbone of our soundness proof presented later in Section 5.5. The most interesting point of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol is that it allows us to dequantize a number of BB84 states-based quantum cryptographic primitives, yielding a generic and modular way of translating these protocols to a setting where only classical communication is used. The downside of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol is that it only achieves inverse polynomial soundness, which means that their dequantized protocols can only achieve inverse polynomial security at most, even if the original quantum protocols have negligible security.

We remark that the main distinction between random BB84 states and coset states is the (un)learnability with verification oracles: when the verification oracles are accessible, the former is learnable while the latter is unlearnable. This explains why coset states have more applications, mostly in the public-key setting.

Application-specific Approaches for Semi-Quantum Protocols

In addition to this line of work focused on rigidity statements, application-specific semiquantum protocols were considered for private-key quantum money [START_REF] Radian | Semi-Quantum Money[END_REF], certifiable deletion of quantum encryption [START_REF] Hiroka | Quantum Encryption with Certified Deletion, Revisited: Public Key, Attribute-Based, and Classical Communication[END_REF], secure software leasing [START_REF] Kitagawa | Secure Software Leasing from Standard Assumptions[END_REF], public-key quantum money [START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF] and tokenized signature [START_REF] Shmueli | Semi-quantum Tokenized Signatures[END_REF]. The common points of these protocols are that (i) their approaches are less generic and modular than the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol and the protocol we presented in this thesis; (ii) new analysis are required for each application. However, we note that all these application-specific semi-quantum protocols achieve negligible security, as they do not prove that the prover in their protocol behave in a certain way, but only that the output of the prover at the end satisfies certain properties.

Technical Overview

Our Semi-Quantum Copy Protection Protocol

Security Requirements. We first start with security analysis of known coset states-based quantum protocols. In particular, we focus on the copy-protection point pseudorandom functions scheme in the plain model and the single-decryptor scheme in the plain model presented in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF]. The security of these constructions reduce to a monogamy of entanglement property of coset states [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF][START_REF] Culf | A monogamy-of-entanglement game for subspace coset states[END_REF]. Informally, this property states that for a triple of quantum algorithms Alice, Bob and Charlie cannot cooperatively win the following monogamy game with a challenger, except with negligible probability. The challenger first prepares a uniformly random coset state |A s,s ′ ⟩ and gives the state to Alice. Alice outputs two (possibly entangled) quantum states and sends them to Bob and Charlie respectively. No communication is allowed between Bob and Charlie. Finally, Bob and Charlie both get the description of the subspace A. The game is won if Bob outputs a vector in A + s and Charlie outputs a vector in A ⊥ + s ′ , where A ⊥ denote the dual subspace of A.

If our goal is to design a semi-quantum protocol for preparing coset states such that it can be used in a plug-and-play manner for the aforementioned protocols, our protocol needs to have the following properties:

• Completeness. If the prover is honest, at the end of the protocol execution, the prover must have a hidden coset state |A s,s ′ ⟩ in its registers.

• Soundness. Any (computationally bounded) prover after interacting with the classical verifier in the protocol, cannot win the monogamy of entanglement game described above (with a single modification in the first step of the game: instead of sending the coset state to the prover, we run the protocol). For a formal definition of the soundness, see Definition 5.12. We note that the soundness property also implies the blindness property: a untrusted prover cannot know the description of A and s, s ′ through the interaction.

The first attempt. Having described all requirements needed, we now turn into our protocol construction. Our starting point is the recent public semi-quantum money in the plain model introduced by Shmueli in [START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF], which uses hybrid quantum homomorphic encryption (QFHE) 10 and indistinguishability obfuscation (iO) as the building blocks. The scheme is as follows.

1. The classical verifier V samples a random λ 2 -dimensional subspace A ⊆ F λ 2 (represented by a matrix M A ∈ {0, 1} λ 2 ×λ ), and sends to the prover P (M px A , ct px ), an encryption of the matrix M A under QFHE.

2. P homomorphically evaluates the circuit C, which is a quantum circuit that gets as input the classical description of a subspace A ⊆ F λ 2 and generates a uniform superposition over A. P obtains a homomorphically evaluated ciphertext

(|A x,z ⟩ , ct x,z ) ← QFHE.Eval pk, (M px A , ct px ), C ,
10 Recall that a hybrid QFHE scheme is one where every encryption of a quantum state |ψ⟩ consists of a quantum one-time pad encryption of |ψ⟩ with Pauli keys (x, z) ∈ {0, 1} * , and ct x,z which is a classical FHE encryption of the Pauli keys. and sends the classical part ct x,z to V.

3. V decrypts (x, z) ← QFHE.Decrypt(sk, ct x,z ) and sends obfuscated membership check programs iO(A + x), iO(A ⊥ + z) to P.

Unfortunately, there is an efficient "splitting" attack that breaks the monogamy game described above (even if the adversary does not receive the description of A in the question phase) (see [START_REF] Shmueli | Semi-quantum Tokenized Signatures[END_REF] for the description of the attack). Indeed, in the construction of semi-quantum tokenized signatures [START_REF] Shmueli | Semi-quantum Tokenized Signatures[END_REF], which also based on the [START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF] construction above, the author also needs to overcome this problem by carefully changing the security property required for the signature setting. We forego the details of his approach, but we note that his approach is unlikely to be applicable in our setting. The main difference is that in our setting, there are two simultaneous non-communicating adversaries that also receive the description of A in the monogamy game.

The second attempt: running self-testing protocol under QFHE. We make an important observation: in the semi-quantum protocol for preparing BB84 states (also called a self-testing protocol) of [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF], instead of asking the prover P to prepare his own states (which are polynomially many |+⟩ states if P is honest), the verifier V can send the input to P using QFHE. In particular, V sends encryption of M 0 , which is the all-zero matrix. P homomorphic evaluates a quantum circuit C on the received ciphertext such that if the input matrix is all-zero, C evaluates to a uniform superposition over F λ 2 , which is exactly product of |+⟩ states. Under QFHE encryption, the quantum part of the evaluated ciphertext is product of random |±⟩ states. P then uses this in the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] self-testing protocol. We will see that an honest prover P using product of |+⟩ states as in the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol or P using product of |±⟩ states does not change the completeness of the protocol, while its soundness is maintained (since the soundness does not depend on which input the prover has been used in the protocol execution).

We now briefly give a description of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol, and refer the reader to their paper and Section 5.4.1 for more details. The verifier first runs a number of test rounds, where the prover is asked to measure its entire quantum state. These test rounds are used by the verifier to check whether the prover behaves as intended. Once the verifier is convinced of this, the verifier runs a preparation round. Test and preparation rounds are indistinguishable from the point of view of the prover, except that unlike in a test round, in a preparation the prover is not asked to measure its final state. Essentially, the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol can be seen as a 1-over-n cut-and-choose protocol, in which the verifier run n rounds of testing, and 1 round of preparation from n + 1 indistinguishable instances. The soundness statement for the test rounds is a self-testing statement, which characterizes which states and measurements the prover used in the protocol. The soundness of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol follows from that of the test rounds via a statistical cut-and-choose argument. In the following, we focus on the test sub-protocol.

The main cryptographic primitive underlying the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol (as well as other self-testing protocols [GV19; MV21]) is the so-called extended noisy trapdoor claw-free function (ENTCF) family, which can be constructed assuming the quantum hardness of LWE [START_REF] Mahadev | Classical Verification of Quantum Computations[END_REF]. Recall that an ENTCF family is a family of functions indexed by a set of keys K 0 ∪ K 1 . K 0 and K 1 are disjoint sets of keys with the property that the two sets are computationally indistinguishable.

We first describe the single-qubit remote preparation protocol from [START_REF] Gheorghiu | Computationally-Secure and Composable Remote State Preparation[END_REF], as the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] test protocol is a n-fold parallel of [START_REF] Gheorghiu | Computationally-Secure and Composable Remote State Preparation[END_REF].

1. For a given basis choice θ ∈ {0, 1} (where "0" corresponds to the computational and "1" to the Hadamard basis), the verifier V samples a key k ∈ K θ , alongside some trapdoor information t. V sends k to the prover P and keeps t private.

2. The verifier and prover then interact classically.

3. For us, the most relevant part is the last round of the protocol, i.e., the last message from the verifier to the prover and back. Before the last round, the remaining quantum state of an honest prover is the single-qubit state |v⟩ θ for v ∈ {0, 1}, where |v⟩ θ is a conjugate encoding of v in the basis θ:

if θ = 0, |v⟩ θ = |v⟩, otherwise |v⟩ θ = 1 √ 2 (|0⟩ + (-1) v |1⟩).
From the transcript and the trapdoor information, the verifier can compute v; in contrast, the prover, who does not know the trapdoor, cannot efficiently compute θ or v. In the last round, the verifier sends θ to the prover, who returns v ′ ∈ {0, 1}; the verifier then checks whether v ′ = v. The honest prover would generate v ′ by measuring its remaining qubit |v⟩ θ in the basis θ and therefore always pass the verifier's check.

In the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] test protocol, V runs n independent copies of [START_REF] Gheorghiu | Computationally-Secure and Composable Remote State Preparation[END_REF] in parallel, except that the basis choice θ i is the same for each copy. Next, from the [GMP22] protocol, we describe a self-testing protocol for coset states.

Assume that now the verifier has private input which is a description of a coset state (A, x, z). We modify the verification procedure of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] test protocol in the last round as follows. Let ⃗ v be the last message sent by P to V in the protocol above. If θ = 0 (note that the basis choice is the same for n copies), V checks if ⃗ v ∈ A + x, otherwise, it decodes11 ⃗ v to get a vector ⃗ v ′ and checks if ⃗ v ′ ∈ A ⊥ + z. An honest prover would use the coset state |A x,z ⟩, which it obtains after running the [Shm22a] protocol described above, as the input to this self-testing protocol. The honest prover would have measured its state in the computational basis when θ = 0, and in the Hadamard basis when θ = 1. Thus, any honest prover would pass this self-testing protocol for coset states with probability 1.

The crucial point is that, since the prover's input in both the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] self-testing protocol and the self-testing protocol for coset states described above is encrypted under QFHE, and the fact that the two protocols are identical from the prover point's of view (except the last verification procedure, which is hidden from the prover), the two protocols are computationally indistinguishable. In other words, any computationally bounded prover cannot distinguish if it is playing in the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] self-testing protocol or the coset-state self-testing protocol. This allows us to carry the rigidity argument of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol to our setting. We elaborate more on this later in Section 5.2.2. For time being, let's say we have showed that if the prover P passes the verification, it must have "used" a coset state in the self-testing protocol (with inverse polynomial soundness).

However, our ultimate goal is to perform a remote state preparation protocol (and not just self-testing). Our final step would be to run this coset-state self-testing protocol in the n-over-2n cut-and-choose fashion: the verifier first sends 2n encrypted coset states and |+⟩ to the prover, and it picks n instances uniformly at random for the self-testing protocol. The remaining n instances are used as the output of the final protocol. Building on the simple but powerful "quantum cut-and-choose" formalism of Bouman and Fehr [START_REF] Niek | Sampling in a Quantum Population, and Applications[END_REF], we can show that if the prover passes all the test instances, it must have at least 1 coset state in its registers at the end of the protocol (with inverse polynomial soundness). Notably, we will show that even if we only obtain inverse polynomial soundness at this step, our final protocol still achieves negligible security for a monogamy of entanglement game, which is the main property used in many copy-protection schemes.

Our final protocol. Our final protocol (Protocol 5.5) works as follows:

(1) The verifier first sends homomorphic encryption that allows the prover to either construct coset states or BB84 states.

(2) The prover is asked to homomorphically evaluate the instructed circuits and return classical encryption of the one-time pads of the homomorphic encryption, and keep the quantum parts.

(3) Next, the prover and the verifier run a number of self-testing rounds (Protocol 5.3), in which each test round consists of testing either BB84 states (Protocol 5.1) or coset states (Protocol 5.2), forming several test blocks. (In particular, a test block consists of a number of BB84 states testing rounds, and one coset states testing round.) All the BB84 states are consumed after this step, while only half of the coset states are consumed.

(4) Once the verifier is convinced, the verifier runs the coset states generation round on the remaining half of the coset states, in which the verifier sends back to the prover obfuscation of the membership checking programs. The final state of the prover can then be used in coset states based constructions. To be more precise, the output state of a single run of our protocol would satisfies the monogamy of entanglement property that we described above. If a quantum copy-protection scheme requires n random coset states, we can simply run our protocol n times (with independent randomness for each instance).

Soundness Proof

We now give a brief intuition for the soundness of the protocol.

Rigidity argument for the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] self-testing protocol. Since the soundness proof uses the rigidity argument of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol as the backbone, we first give a short sketch of it. Recall that the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol is a n-fold parallel of [START_REF] Gheorghiu | Computationally-Secure and Composable Remote State Preparation[END_REF]. The main technical challenge and the bulk of [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] work is to establish that the prover must treat all the parallel copies of the protocol independently, that is, to show that its (a priori uncharacterized) Hilbert space can be partitioned into n identical subspaces, one for each copy of the protocol.

Consider the last round of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] self-testing protocol: at the start, the prover has a state σ (θ,⃗ v) , which it produced as a result of the previous rounds of the protocol. Upon receiving θ ∈ {0, 1} the prover measures a binary observable Z i (if θ = 0) or X i (if θ = 1) and returns the outcome v ′ i , one for each copy. Let Z(⃗ a) := Z a 1 1 • • • Z an n , similarly for X( ⃗ b). The main goal of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] soundness proof is to show that when acting on the prover's (unknown) state σ (θ) (where σ (θ) is like σ (θ,⃗ v) , but averaged over all ⃗ v), the operators {Z(⃗ a)X( ⃗ b)} behave essentially like Pauli operators. Formally, this means showing that on average over ⃗ a, ⃗ b ∈ {0, 1} n ,

Tr Z(⃗ a)X( ⃗ b)Z(⃗ a)X( ⃗ b)σ (θ) ≈ (-1) ⃗ a• ⃗ b . (5.1)
This is done through the following steps12 :

(1) Defining inefficient observables Xi = (-1) v i X i , where v i is the i-th bit of the verifier's string ⃗ v (Definition 5.8). This observable depends on v i , which requires the trapdoor information to be computed efficiently. Intuitively, while X i describes the prover's answer, Xi describes whether that answer is accepted by the verifier. Later in the proof, we will show Equation (5.1) with X instead of X. We note that the Z observable can be efficiently implemented without the trapdoor, and the verifier can also use Z to verify the answer of the prover.

(2) Extending the family of states {σ (θ) } θ∈{0,1} to a larger family of "counterfactual states" {σ ( ⃗ θ) } ⃗ θ∈{0,1} n , which are defined as the states the prover would have prepared if the verifier had sent keys k i ∈ K θ i for different θ i . The key point here is that the states {σ ( ⃗ θ) } ⃗ θ are computationally indistinguishable by the properties of ENTCF families. (3) Showing various commutation and anti-commutation relations for the observables Z(⃗ a) and X( ⃗ b) using the counterfactual states σ ( ⃗ θ) . For example, to show that Z i and Xj commute, we would choose a ⃗ θ with θ i = 0 and θ j = 1 since the verifier can check the outcomes of "Z-type observables" for θ = 0 and "X-type observables" for θ = 1. Then, we can relate these statements back to the prover's actual states σ (θ) using the computational indistinguishability of {σ ( ⃗ θ) }.

(4) Combining the commutation and anti-commutation statements from the previous step to show that the observables {Z(⃗ a) X( ⃗ b)} behave like Pauli observables on σ (θ=1) (Lemma 5.4).

(5) Explicitly defining an isometry Ṽ which can be shown to map {Z(⃗ a) X( ⃗ b)} to the corresponding Pauli observables (Definition 5.10). Furthermore, by using this Ṽ , we can also define a modified isometry V that maps the efficient observables {Z(⃗ a)X( ⃗ b)} to the corresponding Pauli observables (Lemma 5.5). This proves Equation (5.1) and finishes the proof.

Rigidity argument for our coset-state self-testing protocol. Using the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] rigidity argument, we now turn into our coset-state self-testing protocol. Crucially, since the two protocols are identical from the prover's point of view, and the fact that the input of the prover is encrypted, Equation (5.1) also carries to the coset-state self-testing. Specifically, it means that under the isometry V , the prover's observables in the coset-state self-testing protocol also behave like Pauli observables (Lemma 5.8). Roughly speaking, the isometry "teleport" the prover's state into a "concrete" state by means of EPR pairs. In our case, the concrete state would be (close to) a mixed state of a vector v ∈ A + x if θ = 0, or a vector v ′ ∈ A ⊥ + z if θ = 1 (up to some classical post-processing), for a coset state instance (A, x, z) (Lemma 5.10).

This means that we can fix a prover P and consider a "hypothetical" quantum verifier, which run the protocol in superposition with P, that is, we do not measure to get the prover's classical message as in the original protocol, but only do a projective measurement at the end for the verification. Then under the isometry V , if θ = 0, we should obtain a state that is close to |A + x⟩, and if θ = 1, a state that is close to |A ⊥ + z⟩. In other words, consider that we run P with θ = 0 in superposition, check the obtained state is |A + z⟩, then undo the prover computation (described by a unitary), then run P with θ = 1 in superposition, check the obtained state is |A ⊥ + x⟩. If both checks passed, it is easy to see that the prover must have a coset state |A z,x ⟩ in its registers.

Note that this does not constitute a classical verification of QFHE. What it says is that after the evaluation and if P passes verification with overwhelming probability it is necessary that it must have a coset state in its register up to an isometry.

We stress that the above rigidity statement has 1/poly(n) closeness, due to the 1/poly(n) closeness in the rigidity argument of the [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] protocol.

Going from self-testing to remote state preparation. We then simply run the self-testing protocol sequentially in the cut-and-choose style. Say we have 2N coset state instances, and we run the self-testing protocol over N instances, chosen uniformly at random. The remaining N instances are the output of the protocol. By a particular "quantum sampleand-estimate" strategy defined in [START_REF] Niek | Sampling in a Quantum Population, and Applications[END_REF], it means that after running the self-testing rounds, the prover has at least one coset state |A x,z ⟩ among N remaining coset state instances in its registers, with inverse polynomial closeness. We can write the prover's state at this step as (inverse polynomially δ-close to) |A x,z ⟩ ⊗ ρ, where ρ can depend on the protocol's transcript and the encryption of (A, x, z) (Proposition 5.2).

Establishing a monogamy of entanglement property. In this final step, we want to show that now if the prover involves in a monogamy of entanglement game, it would have negligible probability of winning. The security game is defined as follows (Definition 5.12).

1. The prover and the verifier jointly execute our semi-quantum protocol to obtain (supposedly) N coset states, which are hidden but kept by the prover.

2. The prover and the verifier play the monogamy game using the output of the semi-quantum protocol:

(a) The prover splits its state into a bipartite state and sends each part to Bob and Charlie, respectively. No communication is allowed between Bob and Charlie.

(b) The verifier sends the description of the subspace to both Bob and Charlie.

(c) Bob and Charlie are asked to output N vectors belonging to N cosets (for Bob), and N dual cosets (for Charlie).

However, our current situation is different from the standard monogamy game setting in which the prover only has the coset state, while here the prover also have an auxiliary state that depends on the coset state description. (Even worse, it might be possible that the prover can have two copies of the coset state after the interactive protocol.) The proof of the standard monogamy game does not carry over directly. Hence, for our monogamy of entanglement proof, new ideas are needed.

Injecting quantumness into the reduction. Our idea is to consider an intermediate game as follows.

1. The prover and the verifier jointly execute our semi-quantum protocol.

2. After finishing the protocol execution, the verifier asks the prover to send it a coset state among the remaining coset state instances uniformly at random.

3. Upon receiving a quantum state from the prover, the verifier verifies whether the received state is indeed the expected coset state, then it sends it back unmodified to the prover.

4. The prover and the verifier play the monogamy game.

Here we make few notes. First, with probability 1 N the coset state instance that the verifier asked is (A, x, z). It is easy to see that with probability (1-δ) N , which is nonnegligible, any adversary for the original security experiment can be turned into an adversary for this experiment with identical winning probability. Secondly, defining this intermediate game is possible because of our rigidity argument above. Indeed, only in this step we inject quantumness into the reduction and make it a quantum verifier.

The proof continues with the following steps (which are formally described as a series of hybrids in the proof Theorem 5.2).

• We make another important observation is that now when considering only the coset instance (A, x, z), it is exactly the same as the public-key semi-quantum protocol introduced by Shmueli in [START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF]. We then follow proof strategies in previous works and carefully modify the experiment to remove the QFHE secret key (corresponding to this coset instance (A, x, z)) from the reduction. This is essentially done by changing the obfuscated membership checking programs sent to the prover in the last step of the protocol, using the following two techniques: subspace-hiding obfuscation [START_REF] Zhandry | Quantum Lightning Never Strikes the Same State Twice[END_REF], and complexity leveraging to blindly sample the obfuscations [START_REF] Shmueli | Public-key quantum money with a classical bank[END_REF]. To use Shmueli's complexity leveraging technique, we will need sub-exponential security of the building blocks (which include the QFHE and the indistinguishability obfuscation).

• Then we make a final change in the reduction: upon receiving the coset state from the prover and if the check is passed, the verifier keeps the received coset state in its internal memory, and send back to the prover another random coset state |A ′ x ′ ,z ′ ⟩. In the monogamy game, instead of sending a description of A (as a basis matrix), the verifier sends a description of A ′ . Note that now the winning condition is also changed subject to this change in the challenge coset. We can think of |A ′

x ′ ,z ′ ⟩ as the challenge of the original monogamy of entanglement game (with quantum communication).

• In this final experiment, if the prover managed to win the monogamy game, it means that Bob has successfully output a vector v ∈ A ′ + x ′ , and Charlie has successfully output a vector w ∈ A ′⊥ + z ′ . The verifier then outputs v, w and wins the monogamy game with quantum communication. We conclude that no efficient prover can win this experiment except with negligible probability.

• The last part of the proof is to show that this final experiment is computationally indistinguishable from the previous experiment (in which the QFHE secret key was removed). We do this by invoking the security of the QFHE. However, there is a subtlety that needs to be taken care of. That is, even if we do not use the QFHE secret key in the reduction at this step, the adversary still receives predicate programs on the ciphertext, which are the obfuscated membership checking programs. Thus, we cannot simply send a uniformly random coset state |A ′ x ′ ,z ′ ⟩ to the prover. In the protocol, we change the obfuscation programs so that both |A x,z ⟩ and |A ′

x ′ ,z ′ ⟩ make the programs accept. We refer to the formal construction and proof for the description of how these obfuscation programs are generated. Once this is shown, we can complete the proof.

Coset States

For any subspace

A ⊆ F n 2 , its complement is A ⊥ := {b ∈ F n 2 | ⟨a, b⟩ = 0, ∀a ∈ A}.
We have that dim(A) + dim(A ⊥ ) = n. We also let |A| := 2 dim(A) denote the size of the subspace A.

Definition 5.1 -Subspace States

For any subspace A ⊆ F n 2 , the subspace state |A⟩ is defined as

|A⟩ := 1 |A| a∈A |a⟩ .
Note that given A, the subspace state |A⟩ can be constructed efficiently.

Definition 5.2 -Coset States For any subspace

A ⊆ F n 2 , vectors s, s ′ ∈ F n 2 , the coset state |A s,s ′ ⟩ is defined as |A s,s ′ ⟩ := 1 |A| a∈A (-1) ⟨a,s ′ ⟩ |a + s⟩ .
Note that given |A⟩ and s, s ′ , the coset state |A s,s ′ ⟩ can be constructed efficiently. Furthermore, for a subspace A and vectors s, s ′ , we define A + s := {v + s | v ∈ A}, and

A ⊥ + s ′ := {w + s ′ | w ∈ A ⊥ }.
When it is clear from the context, for ease of notation, we will write A + s to mean the program that checks membership in A + s. For example, we will often write iO(A + s) to mean an indistinguishability obfuscation of the program that checks membership in A + s.

Strong Monogamy-of-Entanglement Property

Coset states satisfy the following strong monogamy-of-entanglement property, which will be used as the main tool in our construction for copy-protection.

Definition 5.3 -Coset-Monogamy Game [CLLZ21; CV22]

The coset monogamy game between a challenger and a QPT adversary (A 0 , A 1 , A 2 ) is defined as follows.

(1) Preparation. The challenger picks a uniformly random subspace A ⊆ F λ 2 of dimension λ 2 , and two uniformly random vectors s, s ′ ∈ F n 2 . It sends |A, s, s ′ ⟩ , iO(A + s), iO(A ⊥ + s ′ ) to the adversary A 0 .

(2) Splitting. The adversary applies a quantum channel: Φ :

H A → H B ⊗ H C where H A = (C 2 ) ⊗λ and H B , H C are arbitrary. It then computes ρ BC := Φ(|A s,s ′ ⟩⟨A s,s ′ | ⊗ |iO(A + s), iO(A ⊥ + s ′ )⟩⟨iO(A + s), iO(A ⊥ + s ′ )|). It sends registers B to A 1 and C to A 2 , respectively.
(3) Question. The challenger sends the description of A, in the form of a basis for it, to both A 1 and A 2 .

(4) Answer.

A 1 returns s 1 ∈ F n 2 and A 2 returns s 2 ∈ F n 2 .
The adversary (A 0 , A 1 , A 2 ) wins if and only if s 1 ∈ A + s and s 2 ∈ A ⊥ + s ′ . Let CosetMonogamy((A 0 , A 1 , A 2 ), λ) be a random variable which takes the value 1 if the game above is won by adversary (A 0 , A 1 , A 2 ), and takes the value 0 otherwise.

Semi-Quantum Copy-Protection

In this section, we introduce our protocol for semi-quantum copy-protection from hidden coset states in Section 5.4.1, followed by proof of correctness in Section 5.4.2 and proof of soundness in Section 5.5.

Construction

Notation. Our Protocol 5.1 and Protocol 5.2 will be (almost) a parallel repetition of a sub-protocol. We make use of vector notation to denote tuples of items corresponding to the different copies of the sub-protocol. For example, if each of the n parallel subprotocols requires a key k i , we denote ⃗ k = (k 1 , . . . , k n ). A function that takes as input a single value can be extended to input vectors in the obvious way: for example, if f takes as input a single key k, then we write f ( ⃗ k) for the vector (f (k 1 ), . . . , f (k n )). We will also use ⃗ 0 and ⃗ 1 for the bit strings consisting only of 0 and 1, respectively (and whose length will be clear from the context), and ⃗ 1 i ∈ {0, 1} n for the bit string whose i-th bit is 1 and whose remaining bits are 0. Let n the length of a vector in a coset state (i.e., if v ∈ A then |v| = n). In our constructions below, we set n := 2λ.

Ingredients. Our constructions use the following building blocks:

• A quantum hybrid fully homomorphic encryption scheme QFHE := ⟨KeyGen, QOTP, Encrypt, Eval, Decrypt⟩, with sub-exponential advantage security.

• A post-quantum secure indistinguishability obfuscation scheme iO.

• A post-quantum secure extended noisy trapdoor claw-free function (ENTCF) family (F, G).

Our main protocol's construction is given in Protocol 5.5. The protocol involves two parties: a QPT prover (or receiver, denoted as P), and a PPT verifier (or sender, denoted as V).

Protocol 5.1: Semi-Quantum Copy Protection: BB84 Test Round Input. The verifier initially receives Pauli keys (α, β) with α, β ∈ {0, 1} n as private inputs.

1. The verifier selects a uniformly random basis θ $ ← {0, 1}, where 0 corresponds to the computational and 1 to the Hadamard basis.

The verifier samples keys and trapdoors

{(k i , t i )} n i=1 by computing (k i , t i ) ← Gen K θ (1 λ
). The verifier then sends {k i } n i=1 to the prover (but keeps the trapdoors {t i } n i=1 private).

3. The verifier receives {y i } n i=1 where y i ∈ Y from the prover.

4. The verifier selects a round type ∈ {pre-image round, Hadamard round} uniformly at random and sends the round type to the prover.

(a) For a pre-image round: the verifier receives {(b i , x i )} n i=1 from the prover, with b i ∈ {0, 1}, and x i ∈ X . The verifier sets flag bb84 ← flag Pre and aborts if Chk(k i , t i , b i , x i ) = 0 for any i ∈ 1, n .

(b) For a Hadamard round: the verifier receives {d i } n i=1 from the prover with d i ∈ {0, 1} w (for some w depends on the security parameter λ). The verifier sends q = θ to the prover, and receives answers {v i } n i=1 with v i ∈ {0, 1}. The verifier performs the following: 1. The verifier selects a uniformly random basis θ $ ← {0, 1}, where 0 corresponds to the computational and 1 to the Hadamard basis.

• If q = θ = 0, set flag bb84 ← flag Had and abort if b(k i , y i ) ̸ = v i for some i ∈ 1, n . • If q = θ = 1, set flag bb84 ← flag Had and abort if û(k i , y i , d i ) ̸ = v i ⊕β i for some i ∈ 1, n .

The verifier samples keys and trapdoors

{(k i , t i )} n i=1 by computing (k i , t i ) ← Gen K θ (1 λ
). The verifier then sends {k i } n i=1 to the prover (but keeps the trapdoors {t i } n i=1 private).

3. The verifier receives {y i } n i=1 where y i ∈ Y from the prover.

4. The verifier sends "Hadamard round" as the round type to the prover.

5. The verifier receives {d i } n i=1 from the prover with d i ∈ {0, 1} w (for some w depends on the security parameter λ). The verifier sends q = θ to the prover, and receives answers {v i } n i=1 with v i ∈ {0, 1}. The verifier performs the following:

• If q = θ = 0, let ⃗ v := v 1 . . . v n . Set flag coset ← flag Had and abort if ⃗ v / ∈ A + α. • If q = θ = 1, let s i ← v i ⊕ û(k i , y i , d i ) and let s := s 1 . . . s n . Set flag coset ← flag Had and abort if ⃗ s / ∈ A ⊥ + β.
Protocol 5.3: Semi-Quantum Copy Protection: Self-Testing Let M 2 the maximum number of test rounds (for M ∈ N).

Input. The verifier initially receives a subspace

A ⊆ F n 2 and Pauli keys (α ′ , β ′ ) and {(α i , β i )} M 2 i=1 with α ′ , β ′ , α i , β i ∈ {0, 1} n as private inputs. Note that (A, α ′ , β ′ ) corresponds to one coset-state instance, and {(α i , β i )} M 2 i=1 corresponds to M 2 BB84 instances.
1. The verifier privately samples B $ ← 1, M -1 (this determines the number of BB84 test rounds that will be performed).

2. The verifier performs BM executions of Protocol 5.1 (with corresponding private inputs {(α i , β i )}) with the prover. The verifier aborts if Protocol 5.1 aborts for some execution.

The verifier privately samples R

$ ← 1, M and executes Protocol 5.1 with the prover R -1 times (with corresponding private inputs {(α i , β i )}). Then the verifier executes Protocol 5.2 with the prover (with private inputs (A, α ′ , β ′ )) and aborts if Protocol 5.2 aborts. Protocol 5.4: Semi-Quantum Copy Protection: Self-Testing (with Soundness Amplification) Let N := λ the number of iterations.

Input. The verifier initially receives

{(A i , α ′ i , β ′ i )} N i=1 and {(α i , β i )} N M 2 i=1
as private inputs. Each tuple in the first set corresponds to a coset-state instance, and each tuple in the second set corresponds to a BB84 instance. The verifier and the prover sequentially run Protocol 5.3 N times as follows.

1. For each run, the verifier and the prover interactively run Protocol 5.3 with one coset state instance

(A i , α ′ i , β ′ i ) and M 2 BB84 instances {(α i , β i )} M 2 i=1 , each
is picked uniformly at random from the input sets. (If some instance has been picked before, it will be excluded).

2. The verifier aborts unless Protocol 5.3 does not abort in all N iterations.

Protocol 5.5: Semi-Quantum Copy Protection: Main Protocol Verifier's preparation.

1. Coset-state instances. For each i ∈ 1, 2N , the verifier samples a random

n 2 -dimensional subspace S i ⊆ F n 2 , described by a matrix M S i ∈ {0, 1} n 2 ×n . Samples Pauli keys p α i $ ← {0, 1} n 2 2 to encrypt M pα i S i ← QFHE.QOTP(p α i , M S i ), and then (pk i , sk i ) ← QFHE.KeyGen(1 λ , 1 ℓ(λ) ) for some polynomial ℓ(•), ct i ← QFHE.Encrypt(pk i , p α i ).
2. n-qubit BB84 instances. For each i ∈ 1, N M 2 , the verifier samples Pauli keys

p α i $ ← {0, 1} n 2 2 to encrypt M pα i 0 ← QFHE.QOTP(p α i , M 0 ) (here, M 0 is the all-zero vector of length n 2
2 ), and then

(pk i , sk i ) ← QFHE.KeyGen(1 λ , 1 ℓ(λ) ), ct i ← QFHE.Encrypt(pk i , p α i ).
3. For each index i ∈ 1, 2N + N M 2 , the verifier picks uniformly at random one instance from either the set of (encrypted) coset states or the set of (encrypted) n-qubit BB84 states prepared above. For each index i, denote the i-th instance as (pk i , M pα i , ct i ) with secrets (sk i , S i ). (If this instance is from the set of n-qubit BB84 states, we understand that S i = M 0 .)

The verifier sends {pk

i , M pα i , ct i } 2N +N M 2 i=1
to the prover.

Prover's homomorphic evaluation.

5.

Let C the quantum circuit that for an input matrix M ∈ {0, 1} n 2 ×n , outputs a uniform superposition of its row span, except that if M = M 0 , it outputs a uniform superposition of all vectors in the space F n 2 . The prover homomorphically evaluates

C for each i ∈ 1, 2N + N M 2 : (|S i,α i ,β i ⟩ , ct i,α i ,β i ) ← QFHE.Eval pk i , (M pα i , ct i ), C , saves the quantum part |S i,α i ,β i ⟩ and sends the classical part ct i,α i ,β i to the verifier.
Self-testing for the prover.

For each

i ∈ 1, 2N + N M 2 , the verifier decrypts (α i , β i ) ← QFHE.Decrypt(sk i , ct i,α i ,β i ). For all coset-state instances, if α i ∈ S i , the proto- col is terminated.
7. The verifier then runs Protocol 5.4 with these N M 2 prepared BB84 instances and N coset-state instances, where each coset-state instance is picked uniformly at random among 2N prepared instances. (If some instance has been picked before, it will be excluded). It aborts if Protocol 5.4 aborts.

Coset-state generation.

8. The verifier samples a random n 2 -dimensional coset ( Ŝ, α, β) ⊆ F n 2 independently. a Let M Ŝ , M Ŝ⊥ ∈ {0, 1} n 2 ×n bases for Ŝ and Ŝ⊥ , respectively. 9. Let T the set of indexes of the remaining N instances of the coset-states which have not been used in the self-testing protocol above. For each i ∈ T , the verifier does the following:

(a) Let M S ⊥ i ∈ {0, 1}
n 2 ×n a basis for S ⊥ i (as a matrix). Compute indistinguishability obfuscations

P 0,i ← iO (iO(M S i + α i ) ∨ iO(M Ŝ + α)) and P 1,i ← iO iO(M S ⊥ i + β i ) ∨ iO(M Ŝ⊥ + β) , all with appropriate padding. b (b) Record {(α i , β i , S i )} i∈T .
(c) Send T and {P 0,i , P 1,i } i∈T to the prover.

The output of the prover is {P 0,i , P

1,i , |S i,α i ,β i ⟩} i∈T where |T | = N .
a This step is merely an artifact that we will need later for the security proof. b Here, we understand that for any two programs C, C ′ with binary output, iO

(C ∨ C ′ )(x) outputs C(x) ∨ C ′ (x).
Notation. For each execution of Protocol 5.5, we abuse the notation and denote (|A s,s ′ ⟩ , R 0 , R 1 ) the state obtained by the receiver, where R b the obfuscated membership checking programs, computed by concatenating all the obfuscated programs P b,i in Protocol 5.5, and (A, s, s ′ ) the "coset" (which in fact consists of polynomial many different real cosets) obtained by the sender. That is, we consider the whole output state of the protocol as a single unclonable state (which we also call "coset state"). This notation will only be used later when we describe the applications of our protocol in the context of semi-quantum copy-protection. 13

Proof of Completeness

Proposition 5.1. There exists a QPT prover that is accepted in Protocol 5.5 with probability negligibly close to 1 in the security parameter λ. Furthermore, the final quantum state of such a prover at the end of Protocol 5.5 is (negligibly close to) a product of N hidden coset states:

i∈T |S i,α i ,β i ⟩ , ( 5.2)
where {(S i , α i , β i )} i∈T are recorded by the verifier at the end of Protocol 5.5.

Proof. The proof of correctness includes three steps: (1) If the prover ran honestly then its output after the homomorphic evaluation step has negligible trace distance to (QOTP encrypted of) BB84 states and coset states; (2) The self-test protocol passes (that is, the protocol does not terminate at this step) with probability negligibly close to 1;

In the last step of coset-state generation, after discarding all BB84 states, the output of the prover at the end of Protocol 5.5 has negligible trace distance to the state described in Equation (5.2). We describe the honest strategy. By the statistical correctness of the homomorphic encryption, at the end of step 5 of Protocol 5.5, the i-th quantum state that an honest prover holds in its quantum-evaluated registers has negligible trace distance to either n j=1 |(-1) β i,j ⟩ (if the corresponding instance is a n-qubit BB84 state) or |S i,α i ,β i ⟩ (if the corresponding instance is a coset state). That is, this negligible distance holds with probability 1 over the previous messages of the protocol.

For each coset-state instance i, we claim that the probability for such honest prover to have α i ∈ S i is negligible. It follows from the fact that if α i ∈ S i , we have that

|S i,α i ,β i ⟩ = |S i,0,β i ⟩.
By just measuring this state in the computational basis, we get a non-zero vector s ∈ S i with overwhelming probability, even without knowing S i or the QFHE secret key. This violates the semantic security of the QFHE, because S i is a subspace of dimension n 2 chosen uniformly at random, for any vector s ∈ F n 2 , the probability that s ∈ S i is negligible. It means that Protocol 5.5 terminates at step 6 with negligible probability.

Next, we show that an honest prover succeeds in the self-test rounds of Protocol 5.5 with probability negligibly close to 1. An honest prover behaves the same way in each execution of Protocol 5.1 and Protocol 5.2. Hence, to show that an honest prover succeeds in Protocol 5.3 with probability negligibly close to 1, it suffices to describe honest strategies for Protocol 5.1 and Protocol 5.2 that succeed with probability negligibly close to 1. We note that Protocol 5.4 is N sequential repetition of Protocol 5.3, and thus the completeness of Protocol 5.4 is also negligibly close to 1.

Claim 5.1. There exists a QPT prover that is accepted in Protocol 5.1 with probability negligibly close to 1.

Proof. In Protocol 5.1, the prover receives n keys k 1 , . . . , k n and returns answers for each key k j individually. Since the verifier's checks are independent for each j, we only need to describe an honest procedure for one key k j that succeeds in the verifier's checks for that j with probability negligibly close to 1. The honest strategy for a single key k j is adapted from the one in [GV19; MV21; GMP22]. We spell out the details below.

From now on, for simplicity, we drop the subscript i and understand that we are considering the i-th instance. First, note that at the beginning of Protocol 5.1, for a given key k j ∈ K θ , the prover is having the state |(-) β j ⟩ = Z β j |(-) 0 ⟩ in his quantum registers. The prover then adjoins a uniform superposition over all x ∈ X , evaluate f k j in superposition to obtain the following state:

1 2 |X | b∈{0,1} x∈X ,y∈Y f k j ,b (x)(y)Z β j |b⟩ |x⟩ |y⟩
Preparing this state can be efficiently done (up to negligible error) using the Samp procedure from the definition of ENTCF families ([BCMV+18, Definition 3.1] and [Mah18b, Definition 4.2]). The prover then measures the "image register" (i.e., the register that stores y) to obtain an image y j ∈ Y and sends this back to the verifier. The post-measurement state for each j is

   | b(k j , y j )⟩ |x(k j , y j )⟩ if k j ∈ K 0 , 1 √ 2 |0⟩ |x 0 (k j , y j )⟩ + (-1) β j |1⟩ |x 1 (k j , y j )⟩ if k j ∈ K 1 . (5.3)
If the verifier selects a "pre-image round", the prover measures both registers in the computational basis and returns the result. From the states in Equation ( 5.3) it is clear that the prover succeeds with probability negligibly close to 1 in the pre-image round.

If the verifier selects a "Hadamard round", the prover measures the "x-register" in the Hadamard basis to obtain d j and returns this to the verifier. We introduce the shorthand b j := b(k j , y j ) and u j := û(k j , y j , d j ). At this point, the prover's state for each j is (up to a global phase):

   |b j ⟩ if k j ∈ K 0 , |(-) u j ⊕β j ⟩ if k j ∈ K 1 .
(

The prover now receives a question q = θ and measures the remaining qubit in the computational basis if q = 0 and in the Hadamard basis if q = 1. Then it is clear from the expression for the prover's remaining qubit in Equation (5.4) that the prover will pass the verifier's check.

Claim 5.2. There exists a QPT prover that is accepted in Protocol 5.2 with probability negligibly close to 1.

Proof. At the beginning of each instance of Protocol 5.2, the prover is having the state |A α,β ⟩ with α, β ∈ {0, 1} n . The honest strategy for the prover in Protocol 5.2 is similar to the honest strategy for Protocol 5.1 described in Claim 5.1: the prover uses the ENTCF family to commits to each qubit of the state |A α,β ⟩ using the corresponding function key. A formal description of the commitment process is given in [Mah18b, Section 5.1].

In the last round, if q = θ = 0, the prover measures each qubit in the computational basis and in the Hadamard basis if q = θ = 1. It equivalents to either measure the state |A α,β ⟩ in the computational basis if q = 0 and in the Hadamard basis if q = 1.

Since the prover applies the same strategy for each qubit in the state, here we describe the state commitment process for the j-th qubit of the state |A α,β ⟩. For a given key k j ∈ K θ , we can write the prover's coset state as

b j ∈{0,1} γ b j |b j ⟩ |ψ b j ⟩
The prover then adjoins a uniform superposition over all x ∈ X , evaluate f k j in superposition to obtain

1 |X | b j ∈{0,1} x∈X ,y∈Y γ b j f k j ,b j (x)(y) |b j ⟩ |ψ b j ⟩ |x⟩ |y⟩ (5.5)
The prover then measures the "y-register" to obtain an image y j ∈ Y and sends this back to the verifier. The post-measurement state for each j is

   | b(k j , y j )⟩ |ψ b j ⟩ |x(k j , y j )⟩ if k j ∈ K 0 , b j ∈{0,1} γ b j |b j ⟩ |ψ b j ⟩ |x b j (k j , y j )⟩ if k j ∈ K 1 .
(5.6)

We note that the verifier always sends "Hadamard round" as the round type in Protocol 5.2. The prover measures the "x-register" in the Hadamard basis to obtain d j and returns this to the verifier. The prover now receives a question q = θ and measures the j-th qubit in the computational basis if q = 0 and in the Hadamard basis if q = 1. Recall that we denote u j := û(k j , y j , d j ). At this point, the prover's state (before the measurement) is (up to a global phase):

   |b j ⟩ |ψ b j ⟩ if k j ∈ K 0 , (X u j H ⊗ I) |b j ⟩ |ψ b j ⟩ if k j ∈ K 1 .
(5.7)

The prover measures the j-th qubit and returns a bit v j to the verifier. It is clear from Equation (5.7) that: (1) if the coset state is measured in the computational basis (corresponding to the case q = 0), the verifier obtains a vector v ∈ A + α; or (2) the coset state is measured in the Hadamard basis (corresponding to the case q = 1), the verifier obtains a vector s ∈ A ⊥ + β. This concludes the proof of the claim.

Having described the honest behavior for the self-test step, we finish the proof of completeness.

Proof of Soundness

In this section, we prove soundness of Protocol 5.5, following the steps outlined in Section 5.2.2:

1. First, we show a ridigity argument (with inverse polynomial soundness) for our self-testing protocol (Protocol 5.3) in Section 5.5.1.

2. We show that any malicious prover in our remote state preparation protocol must have also constructed a hidden random coset state up to some inverse polynomial error. This final step reduces to a particular "quantum sample-and-estimate strategy", which is a quantum counterpart of the classical "cut-and-choose" as defined by Bouman and Fehr [START_REF] Niek | Sampling in a Quantum Population, and Applications[END_REF].

3. We then show the soundness of our final protocol (Protocol 5.5), which is stated as a monogamy of entanglement game, in Section 5.5.2. Notably, even if our rigidity statement achieves only inverse polynomial soundness, we show that our protocol achieves negligible security in this monogamy game.

Informally, a prover that succeeds in Protocol 5.5 has negligible probability of winning a monogamy of entanglement game for coset states, which is formally stated as Theorem 5.2. This means that if we consider the output of our final protocol as a single unclonable state, the situation at the end of Protocol 5.5 is essentially identical to one in which the verifier has sent a hidden coset state to the prover via a quantum channel, whose security is based on the monogamy of entanglement of coset states defined in Definition 5.3.

Self-Testing Protocol Soundness

We denote this section to prove the following proposition, whose proof is given at the end of this section.

Proposition 5.2. For any λ ∈ N, there exist choices M = poly(λ) and δ = 1/poly(λ) such that if the verifier executes Protocol 5.5 with an efficient quantum prover whose success probability is lower-bounded by an inverse polynomial, the following holds. We denote by ϕ T SV P the verifier and prover's joint final state at the end of Protocol 5.5, where T is the set of coset states obtained by the verifier, S is set to |⊥⟩⟨⊥| by the verifier if the protocol aborts and |⊤⟩⟨⊤| otherwise, V is the register in which the verifier records the set T , and P is the prover's registers. Then, denoting the probability of success as Pr[⊤], and writing

ϕ T SV P = Pr[⊤]|⊤⟩⟨⊤| S ⊗ ϕ T V P |⊤ + (1 -Pr[⊤])|⊥⟩⟨⊥| ⊗ ϕ T V P |⊥ .
Then there exists a coset instance (A, α, β) in T such that the state ϕ T V P |⊤ conditioned on acceptance satisfies:

ϕ T V P |⊤ c ≈ 1/poly(λ) |T ⟩⟨T | V ⊗ |A α,β ⟩⟨A α,β | ⊗ ρ, ( 5.8)
for some auxiliary state ρ.

In order to prove Proposition 5.2, we first show a rigidity argument for our self-testing protocol (Protocol 5.3). The rigidity argument we establish in this section for Protocol 5.3 will be based on the n-fold parallel rigidity proof from [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF]. We will make frequent use of some technical lemmas from the proof of that paper.

Devices

We model the actions of a general prover by a "device". This formalizes all possible actions that can be taken by the prover to compute his answers to the verifier in Protocol 5.1 and Protocol 5.2. By Naimark's theorem, up to adding dimensions to the prover's Hilbert space, we can assume without loss of generality that the prover only performs projective measurements (instead of more general POVMs).

Definition 5.4 (Devices [GMP22]

). A device D := (S, Π, M, P ) is specified by the following:

1. A set S = {ψ ( ⃗ θ) } ⃗ θ∈{0,1} n of states ψ ( ⃗ θ) ∈ D(H D ⊗ H Y ),
where dim(H Y ) = |Y| n and the states are classical on H Y :

ψ ( ⃗ θ) = ⃗ y∈Y n ψ ( ⃗ θ) ⃗ y ⊗ |⃗ y⟩⟨⃗ y| Y .
(5.9)

In the context of Protocol 5.1 and Protocol 5.2, ψ ( ⃗ θ) is the prover's state after returning ⃗ y for the case where the verifier makes basis choices ⃗ θ. 14 Each ψ ( ⃗ θ) also implicitly depends on the specific keys chosen by the verifier (not just the basis choice ⃗ θ); all the statements we make hold on average over key choices (for a fixed basis choice ⃗ θ). Furthermore, since Protocol 5.1 and Protocol 5.2

14 In Protocol 5.1, the only two basis choices are ⃗ θ = ⃗ 0 and ⃗ θ = ⃗ 1. However, ψ ( ⃗ θ) is still well-defined as the state that the prover (who is defined in terms of the quantum circuits he runs on a given input) would prepare if given keys of basis choice ⃗ θ, even though this never occurs in Protocol 5.1. This is different from Protocol 5.2, as it is crucial for the verifier's procedure in Protocol 5.2 to use only ⃗ 0 or ⃗ 1 as the basis choice. Otherwise the protocol would be "undefined".

are actually used as sub-protocols in a bigger protocol (Protocol 5.5), ψ ( ⃗ θ) also depends on all messages exchanged (before the executions of these subprotocols) in Protocol 5.5; for clarity we suppress this dependence from the notation, as we will see later these dependencies do not affect the rigidity proofs of these sub-protocols.

2. In the case of Protocol 5.1, a projective measurement Π on H D ⊗ H Y :

Π =    Π ( ⃗ b,⃗ x) = ⃗ y Π ( ⃗ b,⃗ x) ⃗ y ⊗ |⃗ y⟩⟨⃗ y| Y    ⃗ b∈{0,1} n ; ⃗ x∈X n .
(5.10) This is the measurement used by the prover to compute his answer ( ⃗ b, ⃗ x) in the pre-image challenge.

3. In the case of Protocol 5.2, Π is the identity operator I on H D ⊗ H Y . This is because in Protocol 5.2, there is no pre-image challenge.

A projective measurement M on

H D ⊗ H Y : M =    M ( ⃗ d) = ⃗ y M ( ⃗ d) ⃗ y ⊗ |⃗ y⟩⟨⃗ y| Y    ⃗ d∈{0,1} w×n . (5.11)
This is the measurement used by the prover to compute his answer ⃗ d in the Hadamard challenge. We use an additional Hilbert spaces H R to record the outcomes of measuring M and write the post-measurement state after applying M to ψ ( ⃗ θ) as

σ ( ⃗ θ) := ⃗ y, ⃗ d M ( ⃗ d) ⃗ y ψ ( ⃗ θ) ⃗ y M ( ⃗ d) ⃗ y ⊗ |⃗ y, ⃗ d⟩⟨⃗ y, ⃗ d| Y R .
(5.12)

5. A set P = {P q }, where for each q ∈ {0, 1}, P q is a projective measurement on

H D ⊗ H Y ⊗ H R : P q =      P (⃗ v) q = ⃗ y, ⃗ d P (⃗ v) q,⃗ y, ⃗ d ⊗ |⃗ y, ⃗ d⟩⟨⃗ y, ⃗ d| Y R      ⃗ v∈{0,1} n . (5.13)
In the context of Protocol 5.1 and Protocol 5.2, given question q, the prover will measure {P (⃗ v) q } and return the outcome ⃗ v as his answer.

Definition 5.5 (Efficient devices). A device is called efficient if the states ψ ( ⃗ θ) can be prepared efficiently and the measurements Π, M , and P q can be performed efficiently (in the sense of Definition 2.1).

Success Probabilities of a Device

During the self-testing protocol (Protocol 5.3), the verifier applies certain checks to the answers given by the prover. If the prover fails these checks, the verifier sets a flag to flag Pre or flag Had then aborts. Here, we define the probabilities that the prover passes these checks and relate these probabilities in both protocols Protocol 5.1 and Protocol 5.2. The following lemma says that for any device in Protocol 5.1 that has a non-negligible failure probability in the pre-image test, there is another perfect device that is "close" to the original one in the sense that its measurements are the same as for the original device and its states only differ by O(γ P (D)). By using this lemma, for the rest of the rigidity proof, it suffices to only consider perfect devices: for any arbitrary device, we can first make a reduction to the corresponding perfect device at the cost of incurring an approximation error of O(γ P (D)), and then apply our soundness proof to the perfect device.

Lemma 5.1 ([GMP22, Lemma 4.9]). Let D = (S, Π, M, P ) be an efficient device in Protocol 5.1 with γ P (D bb84 ) < 1, where S = ψ ( ⃗ θ) . Then there exists an efficient perfect device D ′ = (S ′ , Π, M, P ), which uses the same measurements Π, M, P and whose states S ′ = ψ ′( ⃗ θ) satisfy for any ⃗ θ ∈ {0, 1} n : θ) .

ψ ′( ⃗ θ) ≈ γ P (Dbb84) ψ ( ⃗
(5.17)

Proof. The proof of this lemma uses essentially the same technique to that of [MV21, Lemma 4.13], which in turn based on [START_REF] Mahadev | Classical Verification of Quantum Computations[END_REF]Claim 7.2]. We give a sketch of the proof for completeness. A construction of D ′ is as follows. D ′ first prepares the states ψ ( ⃗ θ) as D does, then applies the efficient unitary U Π associated with the measurement Π:

|0⟩⟨0| R ⊗ ψ ( ⃗ θ) U Π -→ | ⃗ b, ⃗ x⟩⟨ ⃗ b, ⃗ x| R ⊗ Π ( ⃗ b,⃗ x) ψ ( ⃗ θ) Π ( ⃗ b,⃗ x) .
(5.18)

Now D ′ coherently evaluates the (efficient) Chk-function on the Y -register of Π ( ⃗ b,⃗ x) ψ ( ⃗ θ) Π ( ⃗ b,⃗ x) and the new register containing (b i , x i ) for all i ∈ 1, n . If Chk succeeds, D ′ applies U † Π to the state, traces out the ancillary register R, and uses this as ψ ′( ⃗ θ) . Otherwise, D ′ repeats the process up to polynomially (in the security parameter) many times, and aborts if the Chk procedure never succeeds. Since γ P (D bb84 ) is defined as the maximum failure probability of the pre-image test, and the Chk procedure fails if the pre-image check fails on any qubit, the probability of the Chk procedure failing is at most n • γ P (D bb84 ) = O(γ P (D bb84 )) by a union bound.

If 1-γ P (D bb84 ) is negligible, the trace distance bound between ψ ( ⃗ θ) and ψ ′( ⃗ θ) is trivially satisfied. If 1 -γ P (D bb84 ) is non-negligible, the probability that Chk fails polynomially many times is negligible. Furthermore, by definition of the ENTCF family, the Chk procedure requires only the function key and not the trapdoor, which implies that it can be computed efficiently by the prover D ′ . It means that D ′ is efficient and perfect.

Fix ⃗ θ. By Definition 2.4, we need to show ψ ′( ⃗ θ) -ψ ( ⃗ θ) 1

≈ γ P (Dbb84) 1/2 0. Since the probability of the Chk to succeed is at least 1 -O(γ P (D bb84 )), by the gentle measurement lemma ( [START_REF] Mark | From classical to quantum Shannon theory[END_REF]), the post-measurement state after Chk has succeeded is O(γ

P (D bb84 ) 1/2 )- close in trace distance to U Π (|0⟩⟨0| R ⊗ ψ ( ⃗ θ) )U † Π .
Because the trace distance is unitarily invariant, this implies that the state ψ ′( ⃗ θ) is also O(γ P (D bb84 ) 1/2 )-close in trace distance to ψ ( ⃗ θ) .

Rigidity Proof of Protocol 5.1

The rigidity proof of Protocol 5.1 follows identically from that of [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF]. In this section, we recall definitions and related technical lemmas from [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] that are needed for our proof later. The main difference lies in the last verification procedure, in which our verification procedure also involves the Pauli keys from the QFHE. However, one can easily inspect their proof and see that this difference does not change most part of the proof. This essentially follows from the fact that the one-time pads (and generally, the homomorphic enryption) are independent of all the messages and verifier's secrets in the execution of Protocol 5.1, it only is used in the verification of the verifier as its secret input. When the difference appears, we will re-prove the lemma with respect to our protocol.

Definition 5.8 (Observables). For a device D := (S, Π, M, P ) with projective measurements as in Definition 5.4 and ⃗ β ∈ {0, 1} n , we define the following binary observables:

Z i = ⃗ v (-1) v i P (⃗ v) 0 ,
(5.19)

X i = ⃗ v (-1) v i P (⃗ v)
1 , (5.20)

Xi = ⃗ v,⃗ y, ⃗ d (-1) β i ⊕v i ⊕û(k i ,y i ,d i ) P (⃗ v) 1,⃗ y, ⃗ d ⊗ |⃗ y, ⃗ d⟩⟨⃗ y, ⃗ d| Y R .
(5.21)

We further use the following notation for products of observables: for ⃗ a ∈ {0, 1} n , we define

Z(⃗ a) := Z a 1 1 . . . Z an n = ⃗ v (-1) ⃗ a•⃗ v P (⃗ v) 0 , (5.22)
and likewise for X(⃗ a) and X(⃗ a). It is easy to see that

X(⃗ a) ⃗ y, ⃗ d = (-1) ⃗ a•( ⃗ β⊕û( ⃗ k,⃗ y, ⃗ d)) X(⃗ a) ⃗ y, ⃗ d .
(5.23) Remark 5.1. Xi is not an observable that an efficient prover can implement because it depends on û(k, y, d), which requires the trapdoor information to be computed efficiently, and the Pauli key β, which the prover only has an encryption of it. Intuitively, while X i describes the prover's answer, Xi describes whether that answer is accepted by the verifier.

Definition 5.9 (Partial post-measurement states). For k ∈ K 0 ∪ K 1 , v ∈ {0, 1} and β ∈ {0, 1} define the set V β,k,v ⊆ Y × {0, 1} w by the following condition:

(y, d) ∈ V β,k,v iff    b(k, y) = v if k ∈ K 0 , û(k, y, d) = v ⊕ β if k ∈ K 1 .
(5.24) (5.25)

Then for ⃗ β, ⃗ k, ⃗ θ, ⃗ v we define σ ( ⃗ β, ⃗ θ,⃗ v) = y 1 ,d 1 ∈V β 1 ,k 1 ,v
Further for ⃗ a ∈ {0, 1} n we define

σ ( ⃗ β, ⃗ θ,v,⃗ a) := ⃗ v: ⃗ v•⃗ a=v σ ( ⃗ β, ⃗ θ,⃗ v) .
(5.26) Remark 5.2. In the following, once ⃗ β is fixed, we can drop ⃗ β from these notations and simply write σ ( ⃗ θ,⃗ v) and σ ( ⃗ θ,v,⃗ a) . The reason is that as we explained above, the involvement of ⃗ β is primarily a technicality needed because of our protocol construction, but does not affect the modular proofs we present here. Another way to see it is to consider ⃗ β as a part of the trapdoor information ⃗ t. Then we can write û′ (k, y, d)

:= û(k, y, d) ⊕ β and define (y, d) ∈ V k,v if û′ (k, y, d) = v when k ∈ K 1 .
For any statement involving these states, we understand that there is some ⃗ β known by the verifier and these states are defined with respect to this ⃗ β.

Intuitively, when ⃗ θ = ⃗ 0, then for any ⃗ a ∈ {0, 1} n , σ ( ⃗ 0,v,⃗ a) is that part of the state σ ( ⃗ 0) for which the honest device would receive outcome v when measuring the observable Z(⃗ a). The following lemma shows what outcomes a successful device must produce when measuring the observables from Definition 5.8 on the partial post-measurement states from Definition 5.9. 1. For any ⃗ θ, ⃗ a ∈ {0, 1} n such that θ i = 0 if a i = 1, then:

Z(⃗ a) ≈ γ H (Dbb84),σ ( ⃗ θ,v,⃗ a) (-1) v I . (5.27) 2. For any ⃗ θ, ⃗ a ∈ {0, 1} n such that θ i = 1 if a i = 1, then: X(⃗ a) ≈ γ H (Dbb84),σ ( ⃗ θ,v,⃗ a) (-1) v I .
(5.28)

Next, we define isometries Ṽ , V which can be shown to map the prover's observables to the corresponding Pauli observables. is distributed between A and Q such that every EPR pair has one qubit in either system. We can combine the different V y,d into one isometry

Ṽ := ⃗ y, ⃗ d Ṽ⃗ y, ⃗ d ⊗ |⃗ y, ⃗ d⟩⟨⃗ y, ⃗ d| : H D ⊗ H Y ⊗ H R → H D ⊗ H Y ⊗ H R ⊗ H A ⊗ H Q .
(5.30)

We similarly define

V ⃗ y, ⃗ d |φ⟩ D := E ⃗ a, ⃗ b∈{0,1} n X(⃗ a) ⃗ y, ⃗ d Z( ⃗ b) ⃗ y, ⃗ d D ⊗ σ X (⃗ a)σ Z ( ⃗ b) A |φ⟩ D ⊗ |Φ + ⟩ ⊗n AQ (5.31)
and

V := ⃗ y, ⃗ d V ⃗ y, ⃗ d ⊗ |⃗ y, ⃗ d⟩⟨⃗ y, ⃗ d| .
(5.32)

The following lemma relates Ṽ and V .

Lemma 5.3. For any keys ⃗ k ∈ K n 1 and ⃗ β ∈ {0, 1} n :

V ⃗ y, ⃗ d = σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β A ⊗ σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β Q Ṽ⃗ y, ⃗ d .
(5.33)

Proof. For any state |φ⟩ D , we have:

σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β A ⊗ σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β Q Ṽ⃗ y, ⃗ d |φ⟩ D = E a,b∈{0,1} n X(⃗ a) ⃗ y, ⃗ d Z( ⃗ b) ⃗ y, ⃗ d D |φ⟩ D ⊗ σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β σ X (⃗ a)σ Z ( ⃗ b) A ⊗ σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β Q |Φ + ⟩ ⊗n AQ Repeatedly using that (σ Z ) A |Φ + ⟩ AQ = (σ Z ) Q |Φ + ⟩ AQ : = E a,b∈{0,1} n X(⃗ a) ⃗ y, ⃗ d Z( ⃗ b) ⃗ y, ⃗ d D |φ⟩ D ⊗ σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β σ X (⃗ a)σ Z ( ⃗ b)σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β A |Φ + ⟩ ⊗n AQ Since σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β σ X (⃗ a)σ Z ( ⃗ b)σ Z û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ β = (-1) ⃗ a•(û( ⃗ k,⃗ y, ⃗ d)⊕ ⃗ β) σ X (⃗ a)σ Z ( ⃗ b): = E a,b∈{0,1} n (-1) ⃗ a•(û( ⃗ k,⃗ y, ⃗ d)⊕ ⃗ β) X(⃗ a) ⃗ y, ⃗ d Z( ⃗ b) ⃗ y, ⃗ d D |φ⟩ D ⊗ σ X (⃗ a)σ Z ( ⃗ b) A |Φ + ⟩ ⊗n AQ Recalling from Definition 5.8 that (-1) ⃗ a•(û( ⃗ k,⃗ y, ⃗ d)⊕ ⃗ β) X(⃗ a) ⃗ y, ⃗ d = X(⃗ a) ⃗ y, ⃗ d : = E a,b∈{0,1} n X(⃗ a) ⃗ y, ⃗ d Z( ⃗ b) ⃗ y, ⃗ d D |φ⟩ D ⊗ σ X (⃗ a)σ Z ( ⃗ b) A |Φ + ⟩ ⊗n AQ = V |φ⟩ D .
We then show that the isometry Ṽ maps the observables X(⃗ a)Z( ⃗ b) to the corresponding Pauli observables.

Lemma 5.4 ([GMP22, Lemma 4.28]). For an efficient perfect device D = (S, Π, M, P ) and any ⃗ a, ⃗ b ∈ {0, 1} n we have

Tr Ṽ † σ X (⃗ a)σ Z ( ⃗ b) † Q Ṽ X(⃗ a) DY R Z( ⃗ b) DY R σ ( ⃗ 1) DY R ≈ n 1/2 γ H (Dbb84) 1/8 1 .
(5.34)

By combining Lemma 5.3 and Lemma 5.4 we can show that the isometry V maps the observables X(⃗ a)Z( ⃗ b) to the corresponding Pauli observables.

V X(⃗ a)Z( ⃗ b)V † ≈ n 1/2 γ H (Dbb84) 1/8 ,V σ ( ⃗ 1) V † σ X (⃗ a)σ Z ( ⃗ b) Q ⊗ I Y RDA .
(5.35)

Rigidity Proof of Protocol 5.2
Having established a characterization of the prover's observables X(⃗ a)Z( ⃗ b) in Protocol 5.1, we now use this to characterize the prover's behavior in Protocol 5.2.

Step 1: Modeling. First, we introduce the corresponding notion of post-measurement states for an efficient device of Protocol 5.2. Note that the two protocols are identical from the prover's point of view when the round type is the Hadamard round, and the marginal observables from Definition 5.8 are defined for Hadamard round. Thus we can use the same notation of marginal observables from Definition 5.8 (in particular, we only need the efficient observables X(⃗ a) and Z( ⃗ b)) for an efficient device in Protocol 5.2.

Definition 5.11.

For ⃗ k ∈ (K 0 ∪ K 1 ) n , ⃗ v ∈ {0, 1} n and A ⊆ F n 2 , ⃗ α, ⃗ β ∈ {0, 1} n define the set V A,⃗ α, ⃗ β, ⃗ k,⃗ v ⊆ Y n × {0, 1}
w×n by the following condition:

(⃗ y, ⃗ d) ∈ V A,⃗ α, ⃗ β, ⃗ k,⃗ v iff    b( ⃗ k, ⃗ y) = ⃗ v ∈ A + ⃗ α if ⃗ k ∈ K n 0 , û( ⃗ k, ⃗ y, ⃗ d) ⊕ ⃗ v ∈ A ⊥ + ⃗ β if ⃗ k ∈ K n 1 .
(5.36)

Then for ⃗ α, ⃗ β, ⃗ k, ⃗ θ ∈ { ⃗ 0, ⃗ 1}, ⃗ v we define σ (A,⃗ α, ⃗ β, ⃗ θ,⃗ v) = ⃗ y, ⃗ d∈V A,⃗ α, ⃗ β, ⃗ k,⃗ v σ ( ⃗ θ) ⃗ y, ⃗ d ⊗ |⃗ y, ⃗ d⟩⟨⃗ y, ⃗ d| .
(5.37)

By the same argument as in Remark 5.2, we can write σ ( ⃗ θ,⃗ v) for simplicity.

We note that different from Definition 5.9, we only consider two basis choices ⃗ θ = ⃗ 0 or ⃗ θ = ⃗ 1, whereas the post-measurement states in Definition 5.9 can be defined with respect to any basis choice. Similar to Lemma 5.2, we analyze what outcomes a successful device must produce when measuring the observables from Definition 5.8 on the postmeasurement states from Definition 5.11. Lemma 5.6. For any efficient device D = (S, Π, M, P ), a coset state description (A, α, β):

⃗ v∈S 0 Tr Z (v i ) i σ ( ⃗ 0,⃗ v) ≈ γ H (Dcoset) 1 , (5.38) ⃗ v∈S 1 Tr X (v i ) i σ ( ⃗ 1,⃗ v) ≈ γ H (Dcoset) 1 , (5.39)
where S 0 := A + α and S 1 :

= A ⊥ + β -û( ⃗ k, ⃗ y, ⃗ d).
Proof. We first prove Equation (5.38). Since the case q = θ = 0 occurs with probability 1/2 in Protocol 5.2, the device's failure probability in this case can be at most 2γ H (D coset ). Furthermore, since the device only succeeds if v i = b(k i , y i ) and ⃗ v ∈ A+α for all i ∈ 1, n in the protocol, it means that the device succeeds with probability at least 1 -2γ H (D). Now comparing the definition of σ ( ⃗ 0,⃗ v) with the verifier's checks in the protocol, this means that for all i ∈ 1, n :

v∈S 0 Tr Z (v i ) i σ ( ⃗ 0,⃗ v) ≥ 1 -2γ H (D) .
For the inequality in the other direction, we note that since Z

(v i ) i
is a projector, we immediately have

⃗ v∈S 0 Tr Z (v i ) i σ ( ⃗ 0,⃗ v) ≤ ⃗ v∈S 0 Tr σ ( ⃗ 0,⃗ v) = Tr σ ( ⃗ 0) = 1,
finishing the proof of Equation (5.38).

The proof of Equation (5.39) is completely analogous, combining with the fact that if

⃗ v + û( ⃗ k, ⃗ y, ⃗ d) ∈ A ⊥ + β iff ⃗ v ∈ A ⊥ + β -û( ⃗ k, ⃗ y, ⃗ d).
Step 2: Relating Protocol 5.1 and Protocol 5.2. We relate the prover's operators and states in Protocol 5.1 and Protocol 5.2 by the following lemmas. θ) , σ ( ⃗ θ) ) and D ′ is a device of Protocol 5.2 with corresponding states (ψ ≈ 0 σ ( ⃗ θ ′ ) .

′( ⃗ θ ′ ) , σ ′( ⃗ θ ′ ) ). Then ψ ( ⃗ θ) c ≈ 0 ψ ′( ⃗ θ ′ ) , ( 5
(5.41)

Proof. At the beginning of each protocol's execution: in Protocol 5.1, the device's state is (encrypted) BB84 states, while in Protocol 5.2, the device's state is (encrypted) coset states. Furthermore, note that executing Protocol 5.1 or Protocol 5.2 does not require the secret key of the QFHE encryption scheme. Equation (5.40) then follows directly from semantic security of the QFHE encryption scheme. In Protocol 5.2, the verifier never sends a "pre-image round" challenge. In Protocol 5.1, the round type is chosen uniformly at random, so with probability 1 2 , the round type is "Hadamard round". In this case, the execution of two protocols are identical from the prover's point of view. Since the prover is efficient, Equation (5.41) also follows.

We then obtain the following relation between the success probabilities of devices in Protocol 5.1 and Protocol 5.2.

Corollary 5.1. For any efficient device D := (S, Π, M, P ):

γ H (D bb84 ) c ≈ 0 2γ H (D coset ).
(5.42)

Remark 5.3. Due to the relation in Equation (5.42) and the definition of the "≈"-notation (Definition 2.4), from now on, we drop the subscript and simply write γ H (D) when it is clear from the context.

Combining Corollary 5.1 and Lemma 5.7, using the same isometry V defined in Definition 5.10, we can "lift" the approximate-equality relations described in Lemma 5.5 for an efficient device in Protocol 5.1 to an efficient device in Protocol 5.2. Lemma 5.8. For an efficient perfect device D = (S, Π, M, P ) in Protocol 5.2 and any ⃗ a, ⃗ b ∈ {0, 1} n we have

V X(⃗ a)Z( ⃗ b)V † ≈ n 1/8 γ H (D) 1/32 ,V σ ( ⃗ 1) V † σ X (⃗ a)σ Z ( ⃗ b) Q ⊗ I Y RDA .
(5.43)

Proof. The lemma follows directly from the lifting lemma (Item 6 of Lemma 2.3) and the fact that the isometry V and the operators X, Z are efficient. Using the notation from Lemma 2.3, we have

δ = 0, ε = n 1/2 γ H (D) 1/8 , the isometry is V , the observable A is X(⃗ a)Z( ⃗ b), the observable B is σ X (⃗ a)σ z ( ⃗ b) ⊗ I.
The two states are V σ ′( ⃗ 1) V † of a device in Protocol 5.1 and V σ ( ⃗ 1) V † of a device in Protocol 5.2.

Step 3: Rigidity. We first prove the following technical lemma.

Lemma 5.9. For an efficient device D = (S, Π, M, P ), a coset state description (A, α, β):

⃗ v∈S 0 |⃗ v⟩⟨⃗ v| ⊗ (σ (v i ) Z,i ) Q ≈ ε, ⃗ v ′ ∈S 0 |⃗ v ′ ⟩⟨⃗ v ′ |⊗V σ ⃗ 0,⃗ v ′ V † I , (5.44) ⃗ v∈S 1 |⃗ v⟩⟨⃗ v| ⊗ (σ (v i ) X,i ) Q ≈ ε, ⃗ v ′ ∈S 1 |⃗ v ′ ⟩⟨⃗ v ′ |⊗V σ ⃗ 1,⃗ v ′ V † I , ( 5.45)
where

S 0 = A + α, S 1 = A ⊥ + β -û( ⃗ k, ⃗ y, ⃗ d)
and the approximation factor ε will be clarified later in the proof.

Proof. We first prove the first statement. It is easy to check that ⃗ v∈V |⃗ v⟩⟨⃗ v| ⊗ σ

(v i ) Z,i Q
is a projector, so we can expand the definition of the state-dependent distance and compute:

Tr      ⃗ v∈S 0 |⃗ v⟩⟨⃗ v| ⊗ σ (v i ) Z,i Q -I   †   ⃗ v∈S 0 |⃗ v⟩⟨⃗ v| ⊗ σ (v i ) Z,i Q -I   ⃗ v ′ ∈S 0 |⃗ v ′ ⟩⟨⃗ v ′ | ⊗ V σ ( ⃗ 0,⃗ v ′ ) V †    = Tr     I - ⃗ v∈S 0 |⃗ v⟩⟨⃗ v| ⊗ σ (v i ) Z,i Q   ⃗ v ′ ∈S 0 |⃗ v ′ ⟩⟨⃗ v ′ | ⊗ V σ ( ⃗ 0,⃗ v ′ ) V †   = 1 - ⃗ v∈S 0 Tr   |⃗ v⟩⟨⃗ v| ⊗ σ (v i ) Z,i Q ⃗ v ′ ∈S 0 |⃗ v ′ ⟩⟨⃗ v ′ | ⊗ V σ ( ⃗ 0,⃗ v ′ ) V †   = 1 - ⃗ v∈S 0 Tr σ (v i ) Z,i Q V σ ( ⃗ 0,⃗ v) V † ,
To show the first part of the lemma, we need to show that

⃗ v∈S 0 Tr σ (v i ) Z,i Q V σ ( ⃗ 0,⃗ v) V † ≈ ε 1 . (5.46)
For this, recall from Lemma 5.8 that we have

V Z i V † ≈ n 1/8 γ H (D) 1/32 ,V σ ( ⃗ 1) V † (σ Z,i ) Q ⊗ I Y RDA .
(5.47)

For shorthand, write γ := n 1/8 γ H (D) 1/32 . Since V and Z i are efficient, by the lifting lemma (Lemma 2.3) and the fact that σ ( ⃗ 0) c ≈ 0 σ ( ⃗ 1) , this implies that:

V Z i V † ≈ γ 1/4 ,V σ ( ⃗ 0) V † (σ Z,i ) Q ⊗ I Y RDA .
(5.48) Using Lemma 2.4 and Lemma 2.5, we get:

⃗ v∈S 0 V Z (v i ) i V † ≈ γ 1/4 , ⃗ v∈S 0 V σ ( ⃗ 0,⃗ v) V † ⃗ v∈S 0 σ (v i ) Z,i Q ⊗ I Y RDA .
(5.49)

Using the replacement lemma (Lemma 2.1), we obtain

⃗ v∈S 0 Tr σ (v i ) Z,i Q V σ ( ⃗ 0,v i , ⃗ 1 i ) V † ≈ γ 1/8 ⃗ v∈S 0 Tr V Z (v i ) i V † V σ ( ⃗ 0,⃗ v) V † (5.50) = ⃗ v∈S 0 Tr Z (v i ) i σ ( ⃗ 0,⃗ v) (5.51) ≈ γ H (D) 1 , (5.52)
where the last line follows from Equation (5.38). Set ε := γ 1/8 , this finishes the proof of the first statement.

For the second statement, we can perform the same calculation, but use Equation (5.39). Lemma 5.10. For an efficient perfect device D = (S, Π, M, P ), a coset state description (A, α, β) and ⃗ θ ∈ { ⃗ 0, ⃗ 1}, there exists a set of subnormalized states {ρ

( ⃗ θ,⃗ v) i
} ⃗ v∈S i where S i for i ∈ {0, 1} are defined as in Lemma 5.9 such that

⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ V σ ( ⃗ θ,⃗ v) V † ≈ 2nε ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ (H ⊗n ) i |⃗ v⟩⟨⃗ v|(H ⊗n ) i Q ⊗ ρ ( ⃗ θ,⃗ v) i ,
(5.53)

where i = 0 if ⃗ θ = ⃗ 0 and i = 1 if ⃗ θ = ⃗ 1.
Proof. We define the shorthand

M (θ) =    Z if θ = 0 , X if θ = 1 .
Applying Lemma 5.9 and Lemma 2.2 to get

⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ V σ ( ⃗ θ,⃗ v) V † ≈ ε   ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ σ (v 1 ) M (θ 1 ),1 Q   ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ V σ ( ⃗ θ,⃗ v) V †   ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ σ (v 1 ) M (θ 1 ),1 Q  
We repeat this for the remaining indices j = 2, . . . , n. Since there are in total n steps, the total approximation error will be nε. We then have

⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ V σ ( ⃗ θ,⃗ v) V † ≈ nε   ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ σ (v 1 ) M (θ 1 ),1 Q   . . .   ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ σ (vn) M (θn),n Q   ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ V σ ( ⃗ θ,⃗ v) V †   ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ σ (v 1 ) M (θ 1 ),1 Q   . . .   ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ σ (vn) M (θn),n Q   = ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗   j σ (v j ) M (θ j ),j   Q V σ ( ⃗ θ,⃗ v) V †   j σ (v j ) M (θ j ),j   Q . Now noting that j σ (v j )
M (θ j ),j = (H ⊗n ) i |⃗ v⟩⟨⃗ v|(H ⊗n ) i , we obtain

= ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ (H ⊗n ) i |⃗ v⟩⟨⃗ v|(H ⊗n ) i Q ⊗ ⟨v| (H ⊗n ) i Q V σ ( ⃗ θ,⃗ v) V † (H ⊗n ) i |v⟩ Q = ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ (H ⊗n ) i |⃗ v⟩⟨⃗ v|(H ⊗n ) i Q ⊗ Tr Q (H ⊗n ) i |⃗ v⟩⟨⃗ v|(H ⊗n ) i Q V σ ( ⃗ θ,⃗ v) V † (H ⊗n ) i |⃗ v⟩⟨⃗ v|(H ⊗n ) i Q
Analogously to how we added the factors j σ

(v j )
M (θ j ),j in a previous step, we can now replace the factors ((H ⊗n ) i |⃗ v⟩⟨⃗ v|(H ⊗n ) i ) Q inside the partial trace by identity, resulting in

≈ 2nε ⃗ v∈S i |⃗ v⟩⟨⃗ v| ⊗ (H ⊗n ) i |⃗ v⟩⟨⃗ v|(H ⊗n ) i Q ⊗ Tr Q V σ ( ⃗ θ,⃗ v) V † .
We then obtain the desired statement by defining

ρ ( ⃗ θ,⃗ v) i := Tr Q V σ ( ⃗ θ,⃗ v) V † , (5.54) with i = 0 if ⃗ θ = ⃗ 0 and i = 1 if ⃗ θ = ⃗ 1.
What Lemma 5.10 says is that up to an isometry, with inverse polynomial error, the device's state must be (information-theoretically) close to a mixed state of vectors in S i , tensored with an auxiliary state ρ

( ⃗ θ,⃗ v) i
. We note that it is not hard to show that

ρ ( ⃗ 0,⃗ v) 0 c ≈ 0 ρ ( ⃗ 1,⃗ v) 1
. (Though it is not necessary for our soundness proof.) Furthermore, from the statement of Lemma 5.10, for a fixed efficient device D, if we run Protocol 5.2 "coherently" in superposition, then (i) when ⃗ θ = ⃗ 0, the device's state must be in superposition of all vectors in S 0 , that is |A + α⟩, (ii) when ⃗ θ = ⃗ 0, the device's state must be in superposition of all vectors in S 1 . By applying a correction (XOR-ing the register Q with û( ⃗ k, ⃗ y, ⃗ d)), the state would be |A ⊥ + β⟩.

Thus, with the verifier in Protocol 5.2, we obtain efficient projective measurements to characterize the prover's initial state. Formally, let O 0 be the following process: run Protocol 5.2 in superposition (without measuring any intermediate messages such as y, d, v) with the basis choice ⃗ θ = ⃗ 1 and check if the register Q at the end of the protocol is |A + α⟩. O 1 is defined analogously for ⃗ θ = ⃗ 1, and it applies a correction by XORing the register Q with û( ⃗ k, ⃗ y, ⃗ d) and check if the register Q at the end is |A ⊥ + β⟩. We obtain the main technical lemma. Lemma 5.11. For any efficient device D, the initial state of the device ψ must be close to (up to some inverse polynomial error) |A α,β ⟩ ⊗ ρ:

ψ ≈ 4nε |A α,β ⟩ ⊗ ρ.
(5.55)

Proof. Let U 0 and U 1 be the efficient unitaries corresponding to operators O 0 and O 1 defined above. Fix a device D. We first apply U 0 ψ and record the output to an ancilla register. If the output is 1, apply the inverse U † 0 to obtain ψ ′ . Finally apply U 1 ψ ′ . If the output is 1, by the definition of U i (and O i ), the lemma follows. Note that for each application of U i , the approximation error is 2nε which comes from Lemma 5.10.

Rigidity Proof of Protocol 5.3

We are now ready to prove the rigidity of Protocol 5.3, namely that any efficient quantum prover that does not cause the protocol to abort must have the initial state close to a hidden coset state. Lemma 5.12. For any λ ∈ N, there exist choices M = poly(λ) and δ = 1/poly(λ) such that if the verifier executes Protocol 5.3 with an efficient quantum prover whose success probability is lower-bounded by an inverse polynomial, the following holds. Let (A, α, β) the private input of the verifier for the coset instance. Denoting the probability that the protocol does not abort as Pr [ ⊤ ], and let ψ the initial state of the prover. Then, with probability Pr [ ⊤ ], we have

ψ c ≈ ε |A α,β ⟩ ⊗ ρ, ( 5.56)
for some auxiliary state ρ, and the approximation error ε is inverse polynomial on the security parameter λ.

Proof. Essentially, we can see Protocol 5.3 as a cut-and-choose protocol in which the number of evaluation instances is 1 and the number of check instances is M 2 -1. We then can reduce this lemma to Lemma 5.11 using the same argument as in [GMP22, Theorem 4.33]. We omit the details.

Remark 5.4. We make few comments on the inverse polynomial soundness. 15 First of all, what the soundness lemma (Lemma 5.12) says is effectively the same as a typical self-testing statement, which is that: if the prover succeeds with probability 1 -ε in the protocol, the state it used in the protocol must be, up to an isometry, poly(ε)-close to ideal (in our setting, the closeness is measured by computational distinguishability rather than trace distance, as in typical self-testing settings). Now, in practice, we would have to estimate ε by doing many runs of the protocol. In particular, we would need about 1/ε 2 repetitions to have high (that is, 1 -negl(λ)) confidence that the prover's success probability is 1 -ε. This implies that if we want ε to be negligible, we would have to do superpolynomial-many repetitions of the protocol and since this is not efficient, we are limited to ε = 1/poly(λ). It is from doing this 1/ε 2 repetitions that we go from the original self-testing statement (Lemma 5.11) to the statement that characterizes the prover's state in the actual protocol.

We now finish this section with the proof of Proposition 5.2.

Proof of Proposition 5.2. Since in the final protocol (Protocol 5.5), we run N instances over 2N possible instances of the self-testing protocol (Protocol 5.3) (in the cut-andchoose fashion), we can invoke techniques developed in [START_REF] Niek | Sampling in a Quantum Population, and Applications[END_REF] to relate quantum sampling to classical sampling and conclude Proposition 5.2.

In particular, consider the following interaction between a quantum prover P and a challenger V.

1. P and V jointly execute Protocol 5.5. Let T be the set of N indices chosen uniformly at random by V in N runs of the self-testing protocol.

2. Let X i be the outcome of each of N runs of the self-testing protocol. V verifies that X i = accept for all i ∈ T , and aborts otherwise.

This is a natural quantum analogue of the following classical sampling experiment ([BF10, Example 1]) on a length-2N bitstring X to test if X is close to the all-zero string:

1. randomly select a size-N subset T ⊂ 1, 2N , 2. compute ω(X| T ), and accept if the estimate vanishes and else reject.

Noting that this sample-and-estimate strategy is exactly the Ψ uniform strategy described at the end of Section 2.2.5, we have by Corollary 2.1 that the quantum error probability of this strategy is bounded by 2 exp( -nδ 2 64 ), for δ = 1/2. By the definition of quantum error probability (Definition 2.6), this means that, with overwhelming probability over T , the state of the prover P in the remaining set T also satisfies Equation (5.55). Indeed, by changing of basis, this reduces to the question of testing if the state of the prover before running the self-testing protocol is close to the all-zero state. Then the quantum sample-and-estimate technique tells us that the state of the prover must be supported on vectors with relative Hamming distance < 1/2, and it means there must be at least 1 bit in string which is 0. If this is the case, it corresponds (up to some inverse polynomial error) to the coset state |A α,β ⟩ in Equation (5.55). This completes the proof of the proposition.

Soundness of Protocol 5.5

We now formally define the notion of soundness for our protocol, which is described as a coset monogamy game similar to Definition 5.3. G 1 is successful with probability at least ε. From now on, we only consider this coset instance in later hybrids, and all the changes are only applied to this instance.

Game G 2 : Injecting quantum communication into the interaction between the prover and the verifier. This hybrid is identical to G 1 except that now we consider the verifier as a QPT algorithm instead of a PPT algorithm, and we make an additional round of interaction using quantum communication in the protocol. (Think about the verifier now as a QPT challenger of the experiment.) In particular, right after the last step of Protocol 5.5 (step 9c), we ask the prover to send the coset state |S α,β ⟩ to the verifier. Denote this state as |$⟩. The verifier then does the following:

• Verify the received coset state: • If any of these checks returns 0, abort and declare the game as a failure.

• Execute H ⊗λ again on |$ ′ ⟩ to obtain |$ ′′ ⟩ and send |$ ′′ ⟩ back to the prover.

From Proposition 5.2, it follows that with probability at least 1/ |T |, the adversary's output state ϕ is inverse polynomially ϵ-close to |S α,β ⟩ ⊗ ρ for some auxiliary state ρ. It means that when it is asked, the adversary can always send a state |$⟩ that is inverse polynomially ϵ-close to |S α,β ⟩ to the challenger.

Note that the quantum verification described above executes only on the register containing |$⟩ and thus commutes with any other quantum operation on a register entangled with it at the point where P finishes executing the real protocol Protocol 5.5. Thus after finishing the above additional interaction, the adversary's state is unchanged, if the verification passed.

The probability that the adversary does not fail in the experiment is 1 -ϵ. It is then clear that, for any adversary that wins the G 1 with probability ε, it wins G 2 with probability at least ε ′ := ε(1 -ϵ)/ |T |. Thus, the success probability of G 2 is ε ′ for some non-negligible ε ′ .

Game G 3 : Removing subspace information from obfuscated circuits. This hybrid is identical to G 2 , with the only difference is that when the verifier returns the obfuscations P 0 , P 1 in the last step of Protocol 5.5 (Step 9c), the obfuscations are changed: We sample two random (λ -λ δ )-dimensional subspaces T 0 , T 1 ⊆ F λ 2 subjected to T ⊥ 1 ⊆ S ⊆ T 0 . The verifier uses iO(T 0 + α) instead of iO(S + α), and iO(T 1 + β) instead of iO(S ⊥ + β).

It is easy to see that any QPT distinguisher between G 2 and G 3 can be transformed into a QPT distinguisher between obfuscations of the original functions S + α, S ⊥ + β and obfuscations of T 0 + α, T 1 + β. By the subspace hiding property of indistinguishability obfuscators (Lemma 2.8), the success probabilities of G 2 and G 3 are thus negligibly close. Thus the successful probability of G 3 is at least ε ′ -negl(λ).

We are running a classical function on a quantum input, which can be interpreted as running a classical function in superposition.

Game G 4 : Lowering the need to fully know α, β in order to compute the obfuscations. This hybrid is identical to G 3 , with a modification in the way we check membership in each of the cosets: Let B 0 a basis for T 0 , and B 1 a basis for T ⊥ 1 , and let y α , y β ∈ {0, 1} λ-λ δ defined as y α := B 0 • α and y β := B 1 • β. iO(T 0 + α) is changed to be an obfuscation of a circuit that for an input u ∈ {0, 1} λ checks whether B 0 • u = y α . iO(T 1 + β) is changed to be an obfuscation of a circuit that for an input u ∈ {0, 1} λ checks whether B 1 • u = y β .

One can verify that the functionality of the obfuscated circuits iO(T 0 + α), iO(T 1 + β) did not change, and thus by the security of the indistinguishability obfuscation schemes, the distributions are indistinguishable and the success probability of G 4 is ε ′ -negl(λ).

Game G 5 : Changing the order of sampling the subspaces S, T 0 , T 1 . This hybrid is identical to G 4 , except that we change the order of the subspaces sampling process. In the previous hybrid, we sample a random λ 2 -dimensional subspace S ⊆ F λ 2 then two random (λ-λ δ )-dimensional subspaces T 0 , T 1 subjected to T ⊥ 1 ⊆ S ⊆ T 0 . In the current hybrid, we first sample two random (λ -λ δ )-dimensional subspaces

T 0 , T 1 ⊆ F n 2 subjected to T ⊥ 1 ⊆ T 0 , then sample a random λ 2 -dimensional subspace S ⊆ F n 2 subjected to T ⊥ 1 ⊆ S ⊆ T 0 .
Since the distribution of (S, T 0 , T 1 ) in both hybrids are identical, the success probability of G 5 is ε ′ -negl(λ).

Game G 6 : Fixing the subspace T 0 , T 1 .

In the subspace sampling process described in the previous hybrid, T 0 and T 1 are sampled before everything else. Thus we can perform an averaging argument on the sampling of T 0 , T 1 to take the samples that maximize the success probability of the previous hybrid. Fix these samples of T 0 , T 1 and define G 6 with respect to these samples. It is clear that the success probability of G 6 is ε ′ -negl(λ).

Game G 7 : Losing the QFHE secret key. This hybrid is identical to G 6 with one change: In step 6, when the verifier decrypts the QFHE classical part to get the Pauli keys α, β, the current hybrid does not decrypt to get α, β and instead it samples uniformly random α ′ , β ′ ∈ {0, 1} λ and computes y

′ α := B 0 • α ′ , y ′ β := B 1 • β ′ .
The verifier then use these strings as y α , y β in the construction of the obfuscations iO(T 0 + α), iO(T 1 + β), respectively. We note that this change is only done for the specific coset instance under the consideration, for the other instances, the verifier still decrypts normally using the corresponding QFHE secret key.

Since α ′ , β ′ are chosen uniformly at random, for fixed bases B 0 , B 1 , y ′ α , y ′ β are also uniformly random. Observe that conditioned on the probabilistic event y ′ α = y α and y ′ β = y β (for which to happen, the probability is exactly 2 -2λ δ ), the current and previous hybrids distribute identically. It follows that the success probability in G 7 is at least

2 -2λ δ • (ε ′ -negl(λ)) > 2 -3λ δ .
Game G 8 : Clearing all given knowledge on S and reducing to the original monogamy of entanglement game defined in Definition 5.3. This hybrid is identical to G 7 , except that we make two additional changes as follows.

-In the additional quantum communication round that we added after the end of Protocol 5.5 (see hybrid G 2 ), instead of sending back the original state |$⟩, the verifier send | Ŝα, β ⟩. Recall that the coset ( Ŝ, α, β) is the one the verifier sampled independently in step 8.

-In the step 2 in the monogamy game (Definition 5.12), when the challenger (i.e., the verifier) sends the description of the subspace S to both adversaries B, C, it sends Ŝ instead.

-Consequently, the winning condition is changed to be that B outputs a vector in Ŝ + α and C outputs a vector in Ŝ⊥ + β.

We make few observations on the distribution in the current hybrid. First, in order to execute G 8 , there is no need to know the secret key (corresponding to the coset instance under the consideration) of the QFHE scheme. However, one needs to care when invoking the semantic security of the QFHE, because even there is no need for the secret key, the adversary is still given a "predicate" check on the ciphertext, that is the obfuscation. Thus, to use the security of the QFHE, it is necessary to use two plaintexts such that the obfuscation evaluation on the ciphertext of these two plaintexts are identical. Our obfuscations (P 0,i , P 1,i ) were generated so that this condition is satisfied.

Secondly, the obfuscation distribution does not change from the description above, and we can see that in the previous hybrid, the adversary obtains a quantum one-time pad encryption of |S⟩, while in the current hybrid, the adversary obtains a quantum one-time pad of | Ŝ⟩. More precisely, the adversary in the current hybrid receives an encryption of | Ŝ⟩ that is | Ŝα, β ⟩ and an encryption of some Pauli keys (α, β) that are different from (α, β) with overwhelming probability. But because of the semantic security of QFHE.Encrypt (see Definition 2.23), this is indistinguishable from having | Ŝα, β ⟩ and an actual encryption of (α, β).

From these observations, it follows that we can invoke the security of the QFHE to argue the indistinguishability of the current and previous hybrids, and in particular the indistinguishability between their success probabilities. Using the sub-exponentialadvantage security of the QFHE, we have the success probability of

G 8 is > 2 -3λ δ -2 -2λ δ ′ > 2 -3λ δ -1 .
At this point of the proof, we can reduce the success probability of an adversary in G 8 to the monogamy of entanglement game defined in Definition 5.3. We note that the coset game in Definition 5.3 can achieve sub-exponentially negligible security, say 2 -4λ δ , if we assume sub-exponential security of the building blocks (i.e., the indistinguishability obfuscation scheme). Now, any QPT adversary of G 8 can be used to construct a QPT adversary for the coset game defined in Definition 5.3 as follows. Specifically, the reduction receives a challenge coset state | Ŝα, β ⟩ and the obfuscated membership checking programs iO( Ŝ + α), iO( Ŝ⊥ + β) from its challenger in the coset game in Definition 5.3. The reduction runs Protocol 5.5 with the adversary. Note that the reduction (playing the role of the verifier in Protocol 5.5) only needs iO( Ŝ + α) and iO( Ŝ⊥ + β) to perfectly simulate the protocol with the adversary. Furthermore, it uses | Ŝα, β ⟩ in the experiment described above instead of generating the state on its own, when it needs to send a coset state back to the adversary. When the reduction receives Ŝ from its challenger, it sends Ŝ to B, C, and finally the reduction outputs whatever B and C output. (Formally, the reduction now consists of two non-communicating reductions, each interacts with B and • Compute z := PRF 1 (k 1 , y).

• Return ρ y := {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , P, z . m ← PF.Eval(ρ y , x):

• Parse ρ y = {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , P, z . • Parse x as x := x 0 ∥x 1 ∥x 2 .
• For each i ∈ 1, ℓ 0 , if x 0,i = 1, apply H ⊗n to |A i,u i ,u ′ i ⟩; if x 0,i = 0, leave the state unchanged.

• Let σ be the resulting state (which can be interpreted as a superposition over tuples of ℓ 0 vectors). Run P coherently on input x and σ, and measure the final output register to obtain z ′ .

• Return 1 if z ′ = z, otherwise return 0.

The semi-quantum copy-protection scheme for point functions is presented in Construction 5.2. Construction 5.2 -Semi-Quantum Copy-Protection of Point Functions PF.Protect(y): PF.Protect(y) is now an interactive protocol between a sender and a receiver. The sender does the following:

• Run Protocol 5.5 ℓ 0 times with the receiver to obtain

{A i , s i , s ′ i } i∈ 1,ℓ 0 , {(R 0 i , R 1 i )} i∈ 1,ℓ 0 .
The receiver obtains the corresponding {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 . • Sample PRF keys k i for PRF i with i ∈ {1, 2, 3}.

• Prepare the program P ← iO(P), where P is described in Figure 5.2.

• Compute z := PRF 1 (k 1 , y).

• Send P, z to the receiver. m ← PF.Eval(ρ y , x):

• Parse ρ y = {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , P, z . • Parse x as x := x 0 ∥x 1 ∥x 2 . • For each i ∈ 1, ℓ 0 , if x 0,i = 1, apply H ⊗n to |A i,u i ,u ′ i ⟩; if x 0,i = 0, leave the state unchanged.
• Let σ be the resulting state (which can be interpreted as a superposition over tuples of ℓ 0 vectors). Run P coherently on input x and σ, and measure the final output register to obtain z ′ .

• Return 1 if z ′ = z, otherwise return 0.

Theorem 5.3. Assuming the existence of post-quantum indistinguishability obfusca- Hardcoded: tion, one-way functions, and compute-and-compare obfuscation for the class of unpredictable distributions, the scheme of Construction 5.1 and Construction 5.2 have correctness and anti-piracy security.

• Sample ℓ 0 subspaces of F n 2 of dimension n/2 {A i } i∈ 1,ℓ 0 . • For each coset A i , sample two vectors s i , s ′ i ← {0, 1} n . • Prepare the ℓ 0 coset states {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 . • For each coset state |A i,s i ,s ′ i ⟩, prepare the obfuscated membership programs R 0 i = iO(A i + s i ) and R 1 i = iO(A ⊥ i + s ′ i ). • Return {A i , s i , s ′ i } i∈ 1,ℓ 0 , {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , {(R 0 i , R 1 i )} i∈ 1,ℓ 0 .
Keys (k 1 , k 2 , k 3 ) ∈ K 1 × K 2 × K 3 , programs R 0 i , R 1 i for all i ∈ 1, ℓ 0 . On input x = x 0 ∥x 1 ∥x 2 and vectors v 0 , v 1 , • • • , v ℓ 0 where each v i ∈ F n 2 , do the following: 1. (Hidden Trigger Mode) If PRF 3 (k 3 , x 1 ) ⊕ x 2 = x 0 ∥Q ′ and x 1 = PRF 2 (k 2 , x 0 ∥Q ′ ): treat Q ′ as a classical circuit and output Q ′ (v 1 , • • • , v ℓ 0 ). 2. (Normal Mode) If for all i ∈ 1, ℓ 0 , R x i i (v i ) = 1, then output PRF 1 (k 1 , x). Otherwise, output ⊥.
The correctness of our protocols follows directly from the correctness of the copyprotection of PRF's construction of [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF]Lemma 7.13].

The security of our protocols rely on a new security notion for single-decryptors, which is a cryptographic primitive first defined in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF]. We recall the definition of singledecryptors and introduce this new security notion, which we call Real-or-Random CPA anti-piracy in Section 5.6.3. We show that the [CLLZ21]'s single-decryptor's construction also achieves this new security definition. The security proof of our constructions then follow the same strategy as that of copy-protection for PRFs given in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF], except that we reduce security to our new single-decryptor definitions. We refer the reader to Section 5.6.4 for a detailed proof. Indeed, the reductions of security from our constructions (Construction 5.1 and Construction 5.2) are identical, except that the latter reduces to a semi-quantum version of the single-decryptor scheme that we present in Section 5.6.3. Thus we only include the proof for Construction 5.1 in Section 5.6.4.

Single-Decryptors

In this section, we present the definition of single-decryptors, as defined in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF]. We also introduce a new security property for single-decryptors, namely anti-piracy security of single-decryptors in the real-or-random style. A variant of semi-quantum single-decryptors will be also introduced.

Definition Definition 5.13 -Single-Decryptor Encryption Scheme [CLLZ21]

A single-decryptor encryption scheme is a tuple of algorithms E = ⟨Setup, QKeyGen, Encrypt, Decrypt⟩ with the following properties:

(sk, pk) ← Setup(1 λ ). On input a security parameter λ, the classical setup algorithm Setup outputs a classical secret key sk and a public key pk.

(ρ sk ) ← QKeyGen(sk). On input a classical secret key sk, the quantum key generation algorithm QKeyGen outputs a quantum secret key ρ sk .

y ← Encrypt(pk, x). On input a public key pk, a message x in the message space M, the classical encryption algorithm Encrypt outputs a classical ciphertext y.

x/⊥ ← Decrypt(ρ sk , y). On input a quantum secret key ρ sk , a classical ciphertext y, the quantum decryption algorithm Decrypt outputs a classical message x or a decryption failure symbol ⊥.

Correctness. There exists a negligible function negl(•), such that for all λ ∈ N, for all x ∈ M, the following holds:

Pr     Decrypt(ρ sk , y) = x (sk, pk) ← Setup(1 λ ) ρ sk ← QKeyGen(sk) y ← Encrypt(pk, x)     ≥ 1 -negl(λ).
Note that correctness implies that a honestly generated quantum decryption key can be used to decrypt correctly polynomially many times, from the gentle measurement lemma [START_REF] Mark | From classical to quantum Shannon theory[END_REF].

Anti-Piracy Game of Single-Decryptor (Real-or-Random Style)

We present below an anti-piracy game of single-decryptors in the real-or-random CPA style, parameterized by a single-decryptor scheme E = ⟨Setup, QKeyGen, Encrypt, Decrypt⟩, a security parameter λ. This game is between a challenger and an adversary represented by three QPT algorithms (A 0 , A 1 , A 2 ).

• Setup phase:

-The challenger samples (sk, pk) ← Setup(1 λ ).

-The challenger samples ρ sk ← QKeyGen(sk).

-The challenger sends (pk, ρ sk ) to A 0 .

• Splitting phase:

-A 0 prepares a bipartite quantum state σ 12 .

-A 0 sends σ 1 to A 1 and σ 2 to A 2 .

-A 0 sends a challenge message m to the challenger.

• Challenge phase:

-The challenger samples two uniformly random messages (m ′ , m ′′ ).

- -The challenger sends c 1 to A 1 and c 2 to A 2 .

• Answer phase:

-For i ∈ {1, 2}: A i outputs a bit b ′ i . The adversary wins the game if A 1 and A 2 both make a correct guess, that is b

′ i = b i for i ∈ {1, 2}.
We denote the random variable that indicates whether an adversary (A 0 , A 1 , A 2 ) wins the game or not as SD-AP-RoR E D (1 λ , (A 0 , A 1 , A 2 )).

Hardcoded: Keys k 1 , k 2 , k 3 , programs R 0 i , R 1
i for all i ∈ 1, κ . On input vectors u 1 , u 2 , . . . , u κ , do the following:

1. If for all i ∈ 1, κ , R r i i (u i ) = 1, then output m.
2. Otherwise, output ⊥. Semi-Quantum Single-Decryptor

Alternatively, in the definition of single-decryptors above, we can combine the Setup and QKeyGen algorithms to be a single interactive protocol with classical communication.

The security definition is defined analogously, in which the setup phase is now an interactive setup phase where the challenger obtains the the secret key and the adversary obtains the quantum unclonable secret key. This defines a notion of semi-quantum single-decryptors.

Remark 5.5. Of course, now if the sender wants to generate a new quantum secret key, it needs to run the interactive protocol again, which effectively also generates a new classical secret key sk and a new classical public key pk. To recover the original setting where there are only one classical secret/public key pair and possibly many quantum secret keys, the sender can use any post-quantum semantic-secure public-key encryption scheme to encrypt the new classical secret key sk generated by the semi-quantum protocol, and send this encryption of sk to the receiver. This encryption of sk will also be included in the ciphertext, which the sender can decrypt using its "master" secret key and perform the original decryption algorithm. We note that for our construction of semi-quantum copy-protection, this is not necessary though.

A construction of semi-quantum single-decryptors is identical to Construction 5.3, except now we replace the Setup and QKeyGen algorithms by polynomially many runs of Protocol 5.5. Security proof of Construction 5.3 also carries over this semi-quantum setting directly, with only a small change as follows. In the reduction showing that an adversary A that breaks the anti-piracy game of single-decryptors can be used to construct an adversary A ′ breaking the monogamy of entanglement game (defined in Definition 5.12), A ′ simulates the security game for A (in which A ′ runs polynomially many executions of Protocol 5.5 with A), A ′ then picks one execution uniformly at random and lets A runs the protocol with A ′ 's challenger. The rest of the reduction is identical as the one given in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF], we omit the full details here.

Proof of Anti-Piracy Security of Construction 5.1

We now prove the anti-piracy security of our copy-protection of points functions scheme. For easy of reading, we present here the proof for the quantum protocol, but we note that the same proof can be used for the semi-quantum protocol.

We first define the GenTrigger procedure (see Figure 5.4) which, given an input's prefix x 0 and a PRF image y returns a so-called trigger input x ′ that: passes the "Hidden Trigger" condition of the program P. The following lemma follows from [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF].

• The challenger prepares the program P ← iO(P).

• The challenger samples a random point y ∈ {0, 1} n . • The challenger computes z := PRF 1 (k 1 , y).

• The challenger sends ρ y := {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , P, z to A 0 . (b) Splitting phase

• A 0 prepares a (possibly entangled) bipartite state σ 12 and sends σ 1 to A 1 and σ 2 to A 2 .

(c) Challenge phase

• The challenger samples (b 1 , b 2 ) $ ← D 1/3 . • For i ∈ {1, 2}:
-If b i = 0: the challenger sets x i := y.

-Otherwise, the challenger samples x i ← {0, 1} n . • The challenge sends x 1 to A 1 and x 2 to A 2 .

(d) Answer phase

• A 1 returns b ′ 1 and A 2 returns b ′ 2 . • The adversary wins if b ′ 1 = b 1 and b ′ 2 = b 2 .
Game G 1 : In this game, we replace x 1 , x 2 by trigger inputs. The trigger's inputs lemma (Lemma 5.13) implies that G 1 is negligibly close to G 0 .

(a) Setup phase

• The challenger samples {A i , s i , s ′ i } i∈ 1,ℓ 0 , {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , {(R 0 i , R 1 i )} i∈ 1,ℓ 0 ← SampleCoset(1 λ ). • The challenger samples k i ← PRF i .KeyGen(1 λ ) for i ∈ {1, 2, 3}.
• The challenger prepares the program P ← iO(P).

• The challenger samples a random point y ∈ {0, 1} n . • The challenger computes z := PRF 1 (k 1 , y).

• The challenger sends ρ y := {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , P, z to A 0 . (b) Splitting phase

• A 0 prepares a (possibly entangled) bipartite state σ 12 and sends σ 1 to A 1 and σ 2 to A 2 .

(c) Challenge phase

• The challenger samples (b 1 , b 2 ) $ ← D 1/3 . • For i ∈ {1, 2}:
-If b i = 0: the challenger sets x i := y and z i := z.

-Otherwise, the challenger samples x i ← {0, 1} n and z i ← {0, 1} m .

-In both case, the challenger computes

x ′ i ← GenTrigger(x i,0 , z i , k 2 , k 3 , {A i,s i ,s ′ i } i∈ 1,ℓ 0 ). • The challenge sends x ′ 1 to A 1 and x ′ 2 to A 2 . (d) Answer phase • A 1 returns b ′ 1 and A 2 returns b ′ 2 .
• The adversary wins if b

′ 1 = b 1 and b ′ 2 = b 2 .
Game G 2 : In this game, we replace z by a random string and change the challenges accordingly. Because PRF 1 is extracting, G 2 is negligibly close to G 1 .

(a) Setup phase

• The challenger samples {A i , s i , s ′ i } i∈ 1,ℓ 0 , {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , {(R 0 i , R 1 i )} i∈ 1,ℓ 0 ← SampleCoset(1 λ ). • The challenger samples k i ← PRF i .KeyGen(1 λ ) for i ∈ {1, 2, 3}.
• The challenger prepares the program P ← iO(P).

• The challenger samples a random point y ∈ {0, 1} n . • The challenger samples z ← {0, 1} m .

• The challenger sends ρ := {|A i,s i ,s ′ i ⟩} i∈ 1,ℓ 0 , P, z to A 0 . (b) Splitting phase

• A 0 prepares a (possibly entangled) bipartite state σ 12 and sends σ 1 to A 1 and σ 2 to A 2 .

(c) Challenge phase

• The challenger samples (b 1 , b 2 ) $ ← D 1/3 . • For i ∈ {1, 2}:
-If b i = 0: the challenger sets x i := y and z i := z.

-Otherwise, the challenger samples x i ← {0, 1} n and z i ← {0, 1} m .

-In both case, the challenger computes

x ′ i ← GenTrigger(x i,0 , z i , k 2 , k 3 , {A i,s i ,s ′ i } i∈ 1,ℓ 0 ). • The challenge sends x ′ 1 to A 1 and x ′ 2 to A 2 . (d) Answer phase • A 1 returns b ′ 1 and A 2 returns b ′ 2 . • The adversary wins if b ′ 1 = b 1 and b ′ 2 = b 2 .
Game G 3 : In this game, we recast the experiment using the notation of single-decryptor. The probability of winning this game is the same as for the previous one.

(a) Setup phase

• The challenger samples {A i,s i ,s ′ i } i∈ 1,ℓ 0 , ρ sk , pk ← SampleCoset(1 λ ). • The challenger samples k i ← PRF i .KeyGen(1 λ ) for i ∈ {1, 2, 3}.
• The challenger prepares the program P ← iO(P).

• The challenger samples a random point y ∈ {0, 1} n . • The challenger samples z ← {0, 1} m .

• The challenger sends ρ := ρ sk , P, z to A 0 .

(b) Splitting phase

• A 0 prepares a (possibly entangled) bipartite state σ 12 and sends σ 1 to A 1 and σ 2 to A 2 .

(c) Challenge phase indistinguishability obfuscation implies subspace-hiding obfuscation. The proof of the computational direct product problem is done in the following way. We assume that A ⊆ F n 2 has dimension n 2 . • Replace iO(P A+s ) by iO(P B+s ) for a uniformly random superspace B of A, where dim(B) = 3n 4 . Similarly, replace iO(P A ⊥ +s ′ ) by iO(P C ⊥ +s ′ ) for a uniformly random superspace C ⊥ of A ⊥ , where dim(C ⊥ ) = 3n 4 . • Argue that the task of finding a pair of vectors in (A + s) × (A ⊥ + s ′ ) given |A s,s ′ ⟩ , B, C for a uniformly random subspace C ⊆ A ⊆ B is as hard as the task of finding a pair of vectors in ( Ã+z)×( Ã+z ′ ) given | Ãz,z ′ ⟩ for some uniformly random subspace à of dimension n 4 . The crucial observation is that, since B + s = B + s + t for any vector t ∈ B, the programs P B+s and P B+s+t are functionally equivalent. So, an adversary who receives iO(P B+s ) cannot distinguish this from iO(P B+s+t ) for any t. We can think of t as a randomizing masking of s, which removes the adversary's knowledge about the membership programs.

• The latter task of finding such a pair of vectors corresponding to Ã, z, z ′ is information-theoretically hard (it would even be hard with black-box access to the membership checking oracles for à + z and Ã⊥ + z ′ ).

To construct strongly unforgeable tokenized digital signatures, we would need a stronger version of the computational direct product theorem, where the task is now to find a pair of vectors (v, w)

∈ (A + s) × (A + s) or (v, w) ∈ (A ⊥ + s ′ ) × (A ⊥ + s ′ ) such that v ̸ = w.
Applying the same reduction above allows us to reduce this task to the task of finding a pair of different vectors v, w

∈ A + s given |A s,s ′ ⟩ , B, C such that C ⊆ A ⊆ B.
Unfortunately, we cannot directly reduce this task to the information-theoretic direct product theorem. The reason is that the adversary can just measure the state in the computational basis (or in the Hadamard basis if the task is to find a pair of different vectors in A ⊥ + s ′ ) to obtain a random vector v ∈ A + s, sample a non-zero vector c ∈ C and output (v, c + v). Since c ∈ C ⊆ A, we have that c + v is also in A + s. This shows that the adversary can win the game without violating any complexity-theoretic arguments. Overcoming this technical hurdle requires a more involved analysis. We refer to subsequent sections for a formal description and proofs.

The outline of this section is as follows. We first recall some required definitions in Appendix A.1. A variant of the computational direct product theorem is given in Appendix A.2. The construction of strongly unforgeable tokenized digital signatures based on this variant and its proof of security are given in Appendix A.3.

A.1 Preliminaries: Tokenized Digital Signature

A formal definition of tokenized digital signature is given below.

Definition A.1 -Tokenized Digital Signature [BS17]

A tokenized digital signature scheme consists of four QPT algorithms TDS := ⟨KeyGen, TokenGen, Sign, TokenVerif, Verif⟩ with the following properties:

(vk, sk) ← KeyGen(1 λ ). On input the security parameter λ, the key generation algorithm KeyGen outputs a classical verification key vk and a secret key sk.

sig ← TokenGen(sk). On input the secret key sk, the token generation algorithm TokenGen outputs a signing token sig. We emphasize that if TokenGen is called ℓ times, it outputs different states sig 1 , . . . , sig ℓ .

σ ← Sign(m, sig). On input a message m ∈ {0, 1} * and a signing token sig, the signing algorithm Sign outputs a classical signature σ ∈ {0, 1} p(λ) .

(b, sig ′ ) ← TokenVerif(vk, sig). On input the verification key vk, and a signing token sig, the token verification TokenVerif outputs a single bit b ∈ {0, 1}, and a post-verified token sig ′ .

b ← Verif(vk, m, σ). On input the verification key vk, a message m and a classical signature σ, the verification algorithm outputs a bit b ∈ {0, 1}.

A tokenized digital signature scheme TDS must satisfy the following requirements for all λ ∈ N.

Correctness. For every message m ∈ {0, 1} * , we have that

Pr Verif(vk, Sign(m, sig)) = 1 | (vk, sk) ← KeyGen(1 λ ); sig ← TokenGen(sk) = 1,
where the probability is taken over randomness of KeyGen and TokenGen.

(Strong) Unforgeability. We introduce the algorithm Verif k which takes as input the verification key vk and k pairs (m 1 , σ 1 ), . . . , (m k , σ k ) and returns 1 if and only if: (1) all the messages are distinct, that is, m i ̸ = m j for all 1 ≤ i ̸ = j ≤ k; and (2) all the pairs pass the verification, that is, Verif(vk, m i , σ i ) = 1 for all i ∈ 1, k . For every ℓ ∈ N, no QPT adversary A can sign ℓ + 1 different messages by using the verification key and ℓ signing tokens, except with negligible probability:

Adv TDS (λ, A) := Pr Verif ℓ+1 (vk, A(vk, sig 1 ⊗ • • • ⊗ sig ℓ )) ≤ negl(λ).
We also say that TDS is strongly unforgeable if we only require that k pairs of message/signature are distinct, that is (m i , σ i ) ̸ = (m j , σ j ) for all 1 ≤ i ̸ = j ≤ k. We further say that TDS is δ-secure, for some concrete negligible function δ(λ), if for all QPT adversaries A, the advantage Adv TDS (λ, A) is smaller than δ(λ) Ω (1) .

Testability. The token testing algorithm TokenVerif, unlike the signing algorithm, does not consume the signing token. If a signing token passes this test, the post-verified token also passes the test, and it can be used to sign a document. That is,

Pr TokenVerif(sig) = (1, sig) | (vk, sk) $ ← KeyGen(1 λ ); sig $ ← TokenGen(sk) = 1.
Furthermore, for any QPT adversary A with access to a verification key vk and polynomially many signing tokens, which generates a message m and a state sig, we have that:

Pr Verif(vk, m, Sign(m, sig ′ )) = 1 | (1, sig ′ ) ← TokenVerif( sig) ≥ 1 -negl(λ), Pr TokenVerif(vk, sig ′ ) = 1 | (1, sig ′ ) ← TokenVerif( sig) ≥ 1 -negl(λ).

A.2 Direct Product Hardness

Informally, the computational direct product hardness [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF] states that given |A s,s ′ ⟩ and programs iO(P A+s ) and iO(P A ⊥ +s ′ ) for uniformly random A ⊆ F n 2 , s, s ′ ∈ F n 2 , no QPT adversary can produce a pair (v, w) ∈ (A + s) × (A ⊥ + s ′ ), except with negligible probability in n, where P A+s and P A ⊥ +s ′ are programs that check membership in the cosets A + s and A ⊥ + s ′ , respectively. We refer the reader to [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF] for more details.

In the following, we introduce a variant of the direct product problem, which very roughly states that it is also hard to produce a pair (v, w)

∈ (A + s) × (A + s) or (v, w) ∈ (A ⊥ + s ′ ) × (A ⊥ + s ′ ) such that v ̸ = w. A.2.1 Information-Theoretic Direct Product Hardness -A Variant Theorem A.1. Let A ⊆ F n
2 be a uniformly random subspace of dimension n/2, and s, s ′ be uniformly random in

F n 2 . Let ε > 0 such that 1/ε = o 2 n/2 . Let Λ(A, s) := (A + s) × (A + s),
and

Λ(A ⊥ , s ′ ) := (A ⊥ + s ′ ) × (A ⊥ + s ′ ).
Given one copy of |A s,s ′ ⟩ and quantum membership oracles for A + s and A ⊥ + s ′ , an adversary needs Ω √ ε2 n/2 queries to output a pair (v, w) such that v ̸ = w and (v, w) ∈ Λ(A, s) with probability at least ε.

The same number of queries is also required to output a pair (v, w) ∈ Λ(A ⊥ , s ′ ) satisfying v ̸ = w with probability at least ε.

The proof of this theorem is similar to the proof of the original information-theoretic direct-product hardness [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF], which is a random self-reduction to the statement from Ben-David and Sattath [START_REF] Ben | Quantum Tokens for Digital Signatures[END_REF]. We first present the theorem from [START_REF] Ben | Quantum Tokens for Digital Signatures[END_REF].

Theorem A.2 ([BS17, Theorem 28]). Let A ⊆ F n 2 be a uniformly random subspace of dimension n/2, and let ε > 0 such that 1/ε = o 2 n/2 . Given one copy of |A⟩ and quantum membership oracles for A and A ⊥ an adversary needs Ω √ ε2 n/2 queries to output a pair (v, w) such that v ̸ = w and (v, w) ∈ (A \ {0}) × (A \ {0}) with probability at least ε.

The same number of queries is also required to output a pair (v, w) ∈ (A ⊥ \ {0}) × (A ⊥ \ {0}) satisfying v ̸ = w with probability at least ε.

Proof of Theorem A.1. We note that finding such a pair of elements in A and finding such a pair in A ⊥ are essentially the same task; thus it suffices to prove the result for a pair in A \ {0}, and the result for the other case will follow by symmetry.

Let A be an adversary for Theorem A.1 who suceeds with probability p, we construct an adversary B for Theorem A.2 with almost the same success probability making the same number of queries. B proceeds as follows.

• B receives |A⟩ for some A ⊆ F n 2 . Sample s, s ′ ∈ F n 2 uniformly at random, and create the state |A s,s ′ ⟩.

• B gives |A s,s ′ ⟩ as input to A. B simulates the membership oracles A + s and A ⊥ + s ′ as follows. If it is a query to the oracle A + s, B receives v from A, and sends a query as v -s to its membership oracle for A. It forwards the answer to A. The other case is handled similarly, using its membership oracle for A ⊥ and s ′ .

• Finally, B receives (v, w) in return from A. B then outputs (v -s, w -s).

With probability

p, A outputs (v, w) ∈ Λ(A, s) such that v ̸ = w. Thus the output of B is (v -s, w -s) such that (v -s, w -s) ∈ A × A and v -s ̸ = w -s.
Next, we argue that with overwhelming probability, we have that v -s ̸ = 0 and w -s ̸ = 0. This is equivalent to show that the probability that v -s = 0 or w -s = 0 is negligible. Note that there are 2 n/2 values of s such that |A s,s ′ ⟩ = |A s,s ′ ⟩, since translating s by an element s of A does not affect the state. Since s is sampled uniformly at random, the probability that v -s = 0 or w -s = 0 is equal to the probability that v -s = 0 or w -s = 0. This probability is 2 • 1 2 n/2 , which is negligible.

A.2.2 Computational Direct Product Hardness -A Variant

In this section, we prove a computational version of the direct product problem, in which the adversary is given obfuscations of the subspace membership checking programs, but is restricted to be computationally bounded. Our computational version extends the original statement given in [CLLZ21, Theorem 4.6] to include the computational version of Theorem A.1.

Theorem A.3. Assume the existence of quantum-secure indistinguishability obfuscation and quantum-secure injective one-way functions. Let A ⊆ F n 2 be a uniformly random subspace of dimension n/2, and s, s ′ be uniformly random in F n 2 . Given one copy of |A s,s ′ ⟩, iO(P A+s ) and iO(P A ⊥ +s ′ ), any QPT adversary outputs a pair (v, w) such that either

(i) (v, w) ∈ Λ(A, s) and v ̸ = w; (ii) or (v, w) ∈ Λ(A ⊥ , s ′ ) and v ̸ = w; (iii) or (v, w) ∈ (A + s) × (A ⊥ + s ′ );
with negligible probability.

We first state the two lemmas required to prove Theorem A.3, and then assume correctness of these lemmas to prove Theorem A.3. In the subsequent section, we prove the required lemmas.

A.2.3 Proof of Lemma A.1

Before presenting the proof of Lemma A.1, we recall below the notion of subspace hiding obfuscation for the reader's convenience.

Subspace Hiding Obfuscation

Subspace-hiding obfuscation was introduced by Zhandry [Zha19b] as a key component in constructing public-key quantum money. This notion requires that the obfuscation of a circuit that computes membership in a subspace A is indistinguishable from the obfuscation of a circuit that computes membership in a uniformly random superspace of A (of dimension sufficiently far from the full dimension). The formal definition is as follows.

Definition A.2 -Subspace Hiding Obfuscation [Zha19b]

A subspace hiding obfuscator for a field F and dimensions d 0 , d 1 is a PPT algorithm shO such that:

Input. shO takes as input the description of a linear subspace S ⊆ F n of dimension d ∈ {d 0 , d 1 }. For concreteness, we will assume S is given as a matrix whose rows form a basis for S.

Output. shO outputs a circuit Ŝ that computes membership in S. Precisely, let S(x) be the function that decides membership in S. Then

Pr Ŝ(x) = S(x) ∀ x | Ŝ ← shO(S) ≥ 1 -negl(λ).

In the following, we will write shO A as shorthand for shO(A).

Security. For security, consider the following game between an adversary and a challenger.

• The adversary submits to the challenger a subspace S 0 of dimension d 0 .

• The challenger samples a uniformly random subspace S 1 ⊆ F n of dimension d 1 such that S 0 ⊆ S 1 . It then runs Ŝ ← shO(S b ), and gives Ŝ to the adversary.

• The adversary makes a guess b ′ for b.

shO is secure if all QPT adversaries have negligible advantage in this game. We will represent the advantage of the adversary in this game by Adv shO (λ, A).

Zhandry [START_REF] Zhandry | Quantum Lightning Never Strikes the Same State Twice[END_REF] gives a construction of a subspace hiding obfuscator based on one-way functions and indistinguishability obfuscation. Proof. We note that both P A ⊥ +s ′ and P A ⊥ (• -s ′ ) compute the same functionality, since any vector v ∈ A ⊥ + s ′ if and only if v -s ′ ∈ A ⊥ . By security of iO, the two games are computationally indistinguishable.

Game G 5 : This is identical to G 4 , except that now the challenger samples uniformly at random a superspace C ⊥ of A ⊥ of dimension 7n 8 , and the obfuscation iO(P A ⊥ (• -s ′ )) is replaced by iO(P C ⊥ (• -s ′ )). Proof. Since C ⊥ is a superspace of A ⊥ of dimension 7n 8 , by security of subspace hiding obfuscation, the two games are computationally indistinguishable.

Game G 6 : This is identical to G 5 , except that now the challenger samples uniformly at random an element w C ⊥ from C ⊥ , and the obfuscation iO(P C ⊥ (• -s ′ ) is replaced by iO(P C ⊥ (• -t ′ )), where t ′ = s ′ + w C ⊥ .

Claim A.6 (From G 5 to G 6 ). For any QPT adversary A, we have that |Adv 5 (A) -Adv 6 (A)| ≤ Adv iO (λ, A).

Proof. We note that both P C ⊥ (• -t ′ ) and P C ⊥ (• -s ′ ) compute the same functionality, since for any vector w C ⊥ ∈ C ⊥ , we have C ⊥ + w C ⊥ is the same as C ⊥ . By security of iO, the two games are computationally indistinguishable.

Game G 7 : This is identical to G 6 , except that now we change the winning condition of the hybrid: instead of asking the adversary to output two vectors v, w ∈ Λ(A, s) such that v| T ̸ = w| T , we ask the adversary to output two vectors v, w ∈ Λ(A, s) such that v| T ̸ = w| T and v -w ∈ (A \ C), where C, the dual subspace of C ⊥ , is of dimension n 8 . Claim A.7 (From G 6 to G 7 ). For any QPT adversary A, if Adv 6 (A) is non-negligible, then there exists a non-negligible function ε = ε(λ) such that Adv 7 (A) ≥ ε.

Proof. Due to our choice of dimension of subspaces B, C, we can apply the anticoncentration of the subspace obfuscator to prove the claim. Formally, we invoke the following lemma from [START_REF] Shmueli | Semi-quantum Tokenized Signatures[END_REF], which states that any adversary, given an obfuscation iO(P C ⊥ ) where C ⊥ is a random high-dimensional superspace of A ⊥ and outputting a vector in A, has to accidentally hit the subspace A \ C with a noticeable probability.

Lemma A.3 ([Shm22b, Lemma 5.1]). Let S = {S λ } λ∈N a subspace S λ ⊆ F λ 2 of dimension d = {d λ } λ∈N . Let t = {t λ } λ∈N such that there is some constant δ ∈ (0, 1) with ∀λ ∈ N : t λ ≥ λ δ and λ-d λ -2•t λ ≥ Ω(λ). Let iO a quantum-secure indistinguishability obfuscation scheme for classical circuits and assume that post-quantum injective one-way functions exist. Then, there is no quantum polynomial-time algorithm A = {A λ,ρ λ } λ∈N , a negligible function negl and a non-negligible function η such that where {S ⊆ λ-t } λ∈N is the uniform distribution over subspaces of dimension λ -t λ that contain S.

By applying the anti-concentration lemma above with λ = n, t = n 8 and d = n 2 , we have that if Adv 6 (A) is non-negligible, then the probability that v -w ∈ (A \ C) is at least Adv 6 (A) -negl(λ), concluding the claim.

Game G 8 : This is identical to G 7 , except that now instead of sending obfuscations of membership checking programs, the challenger sends B, C, t, t ′ in clear to A.

Claim A.8 (From G 7 to G 8 ). For any QPT adversary A for G 7 , there exists an adversary B for G 8 such that Adv 7 (A) ≤ Adv 8 (B).

Proof. This is immediate.

Claim A.9. For any (possibly unbounded) adversary A, we have that Adv 8 (A) ≤ negl(λ).

Proof. We will follow the proof of [CLLZ21, Lemma 4.13]. Suppose there exists a QPT adversary A for G 8 that wins with probability p.

We first show that, without loss of generality, one can take B to be the subspace of vectors such that the last n/8 entries are zero (and the rest are free), and one can take C to be such that the last 7n/8 entries are zero (and the rest are free). We construct the following adversary B for the game where B and C have the special form above with trailing zeros, call these B * and C * , from an adversary A for the game of G 8 . • B receives (v, w) from A, and outputs (T -1 (v), T -1 (w))). Furthermore, notice that T (A) is a uniformly random subspace between C and B, and that z and z ′ are uniformly random vectors in F n 2 . We argue that:

(i) T (t) is distributed as a uniformly random element of B + z.

(ii) (T -1 ) T (t ′ ) is distributed as a uniformly random element of C ⊥ + z ′ .

For (i), notice that So, we can now assume that B is the space of vectors such that the last n 8 entries are zero, and C is the space of vectors such that the last 7n 8 entries are zero. Then, the sampled subspace A is a uniformly random subspace subject to the last n 8 entries being zero, and the first n 8 entries being free. From an adversary A for G 8 with such B and C, we will construct an adversary B for the information-theoretic direct product problem described in Theorem A.1, where the ambient subspace is F m 2 where m = 3n 4 . B works as follows. where z = s∥s∥ŝ, z ′ = s′ ∥s ′ ∥ŝ ′ , and à is the subspace in which the first n/8 entries are free, the middle 3n/4 entries belong to the subspace A, and the last n/8 entries are zero.

T (t
Notice that the subspace Ã, when averaging over the choice of A, is distributed precisely as in the game G 8 (with B and C of special form with trailing zeros); z, z ′ are uniformly random in F n 2 ; t is uniformly random from B + z and t ′ is uniformly random from C ⊥ + z ′ . Thus, with probability p, A returns to B a pair (v, w) ∈ Λ( Ã, z) such that v| T ̸ = w| T and v -w ∈ Ã \ C. Furthermore, we note that if (v, w) ∈ Λ( Ã, z), the last n/8 entries of both v and w must be ŝ. It follows that, if v| T ̸ = w| T , we have that v ′ ̸ = w ′ . Overall, we have that with probability p, the answer (v ′ , w ′ ) returned by B is such that (v ′ , w ′ ) ∈ Λ(A, s) satisfying v ′ ̸ = w ′ . By Theorem A.1, we deduce that p must be negligible.

Therefore we show that the advantage of distinguishing G 0 and G 6 is negligible, and the success probability in G 7 is at most the success probability in G 8 , which is negligible. We finish the proof by invoking Claim A.7, which concludes that the success probability in G 6 must also be negligible.

A.3 Strongly Unforgeable Tokenized Digital Signatures

In this section, we show how to construct strongly unforgeable tokenized digital signatures from indistinguishability obfuscation.

Following [START_REF] Ben | Quantum Tokens for Digital Signatures[END_REF], we first define a notion of one-bit one-time strongly unforgeable tokenized digital signatures. Then, using the construction given in [START_REF] Ben | Quantum Tokens for Digital Signatures[END_REF], one can obtain a full-fledged strongly unforgeable scheme by combining a one-bit one-time strongly unforgeable scheme with any classical strongly unforgeable digital signature scheme against quantum attacks. Definition A.3 -One-bit One-time Strongly Unforgeable Tokenized Digital Signatures A tokenized digital signature scheme TDS is one-bit one-time strongly unforgeable if for every λ, for every QPT adversary A, we have that Furthermore, let Adv 1-TDS (λ, A) denote the above probability. We say that TDS is δ-strongly unforgeable, for some concrete negligible function δ(λ), if for all QPT adversary A, the advantage Adv 1-TDS (λ, A) is smaller than δ(λ) Ω (1) .

The following theorem, whose proof is given in [START_REF] Ben | Quantum Tokens for Digital Signatures[END_REF], says that one-bit one-time strong unforgeability is sufficient to achieve a full-fledged strong unforgeability.

Theorem A.6 (Adapted from [BS17, Theorem 13] 18 ). A one-bit one-time strongly unforgeable tokenized digital signature scheme implies a full-fledged strongly unforgeable tokenized digital signature scheme, assuming the existence of a strongly unforgeable quantum-secure digital signature scheme.

Construction. Next, we give a construction of one-bit one-time strongly unforgeable digital signatures from hidden coset states in Proof. The proof of this theorem follows immediately from Theorem A.3.

Since one-way functions imply digital signatures, we have the following corollary:

Corollary A.1. Assuming the existence of quantum-secure indistinguishability obfuscation and quantum-secure injective one-way functions, there exists a strongly unforgeable tokenized digital signature scheme.

Proof. This follows immediately from Theorem A.6 and Theorem A.7.

18

While the statement of [BS17, Theorem 13] only applies to weak unforgeability, the same proof extends to strong unforgeability. graphic tasks. For instance, several attempts have been made to achieve unconditionally secure quantum bit-commitments, until Mayers and Lo and Chau independently showed that statistically hiding and binding quantum commitments are impossible [START_REF] Lo | Is quantum bit commitment really possible?[END_REF][START_REF] Mayers | Unconditionally secure quantum bit commitment is impossible[END_REF]. The impossibility of quantum cryptography was further extended to oblivious transfer (OT) by Lo [START_REF] Lo | Insecurity of quantum secure computations[END_REF], and finally extended to non-trivial two-party computation protocols by Salvail et al. and Buhrman et al. [SSS09;[START_REF] Buhrman | Complete insecurity of quantum protocols for classical two-party computation[END_REF]. Intuitively, the insecurity of two-party quantum protocols follows from the fact that the protocol itself allows parties to input a superposed state rather than a classical one, and perform an appropriate measurement on the outcome state. At the end of the protocol, one party can always gain more information on the input of the other than that gained using any honest strategy.

In this appendix, we study the security of password-based key exchange protocols with quantum communication and establish several impossibilities in different security models. This is a joint work with Céline Chevalier and Marc Kaplan in 2018.

B.1 Security Models

We provide a brief overview of security models for multi-party computation (MPC), in which n players interact in order to compute securely a given function of their inputs. Formally, consider n players P i , each owning an input x i , and a classical n-input function f . The goal is to compute (y 1 , . . . , y n ) = f (x 1 , . . . , x n ) such that each player P i learns y i , and cheating players cannot change the outcome of the computation (apart by choosing a different input) and do not learn more about the input (and possibly the output) of honest players than what can be derived from their own input and their output of the function evaluation.

B.1.1 The Simulation-based Paradigm

The first step towards the solution for this security definition is the simulation-based paradigm. Instead of introducing different notions for each security property, we consider for each protocol, the "ideal behavior" it should have. Intuitively, we introduce the notion of "ideal world" where there is a trusted party who collects the inputs from all players, computes the output and distributes the output to the players. A real protocol is compared to an ideal protocol, and the real protocol is said to be at least as secure as the ideal protocol if the real protocol and the ideal protocol have an indistinguishable input-output behavior. The level of security reached thus also depends on the specification of the ideal protocol.

B.1.2 Universal Composability

However, as being pointed out in the literature, the simulation-based paradigm does not play well with composition and in fact, it only achieves Sequential Composition, i.e., a protocol that is secure under sequential composition maintains its security when run multiple times, as long as the executions are run sequentially (meaning that each execution concludes before the next execution begins). In the case of Concurrent Composition in which many instances of the same protocol with correlated inputs are run concurrently, some problems may occur. For example, the messages from one protocol could be fed into another, or a message from one sub-protocol of a larger application is fed into another sub-protocol and the overall application becomes insecure. In order to solve this inherent problem, the so-called UC (for Universal Composability) framework was introduced. We give a high-level overview of the model below and refer the reader to [START_REF] Canetti | Universally Composable Security: A New Paradigm for Cryptographic Protocols[END_REF] for more details on the classical version and [START_REF] Unruh | Universally Composable Quantum Multi-party Computation[END_REF] for the quantum version.

Ideal World and Real World. We define in the ideal world an entity that one can never corrupt, called the ideal functionality and usually denoted as F. The players privately send their inputs to this entity, and receive their corresponding output the same way. There is no communication between the different players. F is assumed to behave in a perfectly correct way, without revealing information other than required, and without being possibly corrupted by an adversary. Once F is defined, the goal of a protocol π, executed in a real world in the presence of an adversary, is then to create a situation equivalent to that obtained with F.

Protocol, Adversary, and Environment. Apart from the protocol participants which are specified by the protocol, there are two more machines taking part in the protocol execution. The adversary A (or S in the ideal model) is the machine coordinating all corrupted participants analogous to the simulation-based model. The environment machine Z, playing the role of the distinguisher, models "everything that is outside the protocol being executed". It chooses the inputs, sees the outputs, and may communicate with the adversary at any time. The adversary has access to the communication between players, but not to the inputs and outputs of the honest players (it completely controls the dishonest or corrupted players). On the contrary, the environment has access to the inputs and outputs of all players, but not to their communication, nor to the inputs and outputs of the subroutines they can invoke.

A protocol π securely realizes a functionality F if for every real-world adversary A there exists an ideal-world adversary S, called the simulator, such that no environment can distinguish whether it is witnessing the real-world execution with adversary A or the idealworld execution with simulator S, with a non-negligible advantage. Depending on the assumed computing power of the adversary and the environment we distinguish between computational security, where they are all considered to be polynomially bounded machines, and statistical security, where they are assumed to be computationally unbounded. Furthermore, in [START_REF] Unruh | Everlasting Multi-party Computation[END_REF], Unruh introduces the notion of everlasting security, where the adversary is considered to be a polynomial-time machine but the environment is assumed to have unbounded computational power.

In addition, the notion of "hybrid models" is also introduced to model the concept of set-up assumptions. A protocol π is said to be realized "in the F-hybrid model" if π can invoke the ideal functionality F as a subroutine multiple times. We note that the environment can never interact directly with F, and thus, F is usually never invoked at all in the ideal world, and the implementation of F is simulated solely by the ideal adversary S. The model with no trusted set-up is called plain model.

Ideal Functionalities. We denote F CRS the common reference string functionality and F OT the oblivious transfer functionality. The definitions of these functionalities are given as follows.

The common reference string (CRS) model is modeled by the functionality F D CRS , which was presented in [START_REF] Barak | Universally Composable Protocols with Relaxed Set-Up Assumptions[END_REF]. At each call of F D CRS , it sends back the same reference string, chosen by itself, following a known public distribution D. We recall it here in • Upon receiving a value (CRS, sid) from a player, send (CRS, sid, r) to this player. Oblivious Transfer (OT) is a very powerful tool and is sufficient to realize any secure computation functionality [START_REF] Kilian | Founding Cryptography on Oblivious Transfer[END_REF]. Informally, OT is a two-party functionality, involving a sender S with input x 0 , x 1 and a receiver R with an input σ ∈ {0, 1}. The receiver R learns x σ (and nothing else), and the sender learns nothing at all. These requirements are captured by the specification of the OT functionality F OT from [START_REF] Canetti | Universally composable two-party and multi-party secure computation[END_REF], given in

Functionality F OT

The functionality F OT interacts with a sender S, a receiver R and an adversary S.

• Upon receiving a message (sender, sid, x 0 , x 1 ) from S, where each x i ∈ {0, 1} ℓ , store (x 0 , x 1 ). (The length ℓ of the strings is fixed and known to all parties).

• Upon receiving a message (receiver, sid, σ) from R, check if a sender message was previously sent. If yes, send (sid, x σ ) to R and sid to the adversary S and halt.

If not, send nothing to R (but continue running).

B.2 Reduction from PAKE to EQUALITY

We show our impossibilities by reducing the problem of constructing a scheme for the PAKE functionality to the problem of constructing a scheme for an equality-testing functionality. In particular, we consider an explicit mutual authentication PAKE functionality F e-pwKE whose description is given in We then define an equality-testing functionality F EQ (Figure B.4) that, roughly speaking, takes inputs from two parties and does the following:

• if the inputs are equal, outputs the value 1 to both parties; moreover, if either party is corrupted, the adversary is allowed to set the output.

The functionality F e-pwKE The functionality F e-pwKE is parameterized by a security parameter λ and a "dictionary" D. It interacts with an adversary A and a set of parties via the following queries:

Upon receiving a query (NewSession, sid, P i , P j , π) from party P i :

Send (NewSession, sid, P i , P j ) to A. In addition, if this is the first NewSession query, or if this is the second NewSession query and there is a record (sid, P j , P i , π ′ ), then record (sid, P i , P j , π) and mark this record fresh. In the latter case, also record (sid, ready), and send it to A.

Upon receiving a query (TestPwd, sid, P, π ′ ) from A:

If P ∈ {P i , P j }, and there is a record of the form (sid, P, * , π) which is fresh, then do: If π = π ′ , mark the record compromised and reply to A with "correct guess". If π ̸ = π ′ , mark the record interrupted and reply to A with "wrong guess".

Upon receiving a query (NewKey, sid, P i , P j , sk) from A, where |sk| = λ :

If there is a record (sid, ready), and there is a record of the form (sid, P, * , π) where P ∈ {P i , P j } then:

• If this record is fresh, and there is a record (sid, * , P, π ′ ) marked fresh with π = π ′ , pick a new random key sk ′ of length λ and set out = sk ′ .

• If this record is compromised, or either P i or P j is corrupted, then set out = sk.

• In any other case, set out =⊥.

Either way, mark both record (sid, P, * , π) and (sid, * , P, π ′ ) as completed.

Upon receiving a query (Deliver, sid, P ) from A:

If P ∈ {P i , P j }, and there is a record of the form (sid, P, * , π) which is completed, then send (deliver, sid, out) to P . Ignore all subsequent (Deliver, P ) queries for the same player P . F e-pwKE functionality already implements the F EQ . Though this seems to be folklore, we also give a proof of this lemma for completeness.

Lemma B.1.

There is a protocol that perfectly implements the F EQ functionality in the F e-pwKE hybrid model, tolerating adaptive corruptions and without assuming authenticated channels.

Proof. The protocol that implements F EQ simply forwards the parties' messages to the F e-pwKE functionality. In particular, on input (sid, π i ) from the environment, the party P i sends a message (NewSession, sid, P i , P j , π) to F e-pwKE . When P i receives a message (deliver, sid, out) back from F e-pwKE , if out ̸ =⊥, P i outputs 1, otherwise, it outputs ⊥ and terminates. Similarly, P j does the same. We simply show how to simulate the adversary A ′ s messages.

Simulating a (Test, sid, P, π) query from A: If A already sent a (Deliver, P ) query before, ignore this query. Otherwise, send a query (TestPwd, sid, P, π) to F e-pwKE , and record the response from F e-pwKE (either "correct guess" or "wrong guess").

Simulating a (Output, sid, γ) query from A: If A already sent a (Deliver, P ) query before, ignore this query. Otherwise, send a query (NewKey, sid, P i , P j , γ) to F e-pwKE .

Simulating a (Deliver, sid, P ) query from A: If A already sent a (Deliver, P ) query before, ignore this query. Otherwise, send a query (Deliver, sid, P ) to F e-pwKE .

It is easy to see that the simulation is perfect, and the view of the environment is identical in the real execution of A in the protocol (in the F e-pwKE -hybrid model) and the simulated ideal-model execution with F EQ .

B.3.1 Implicit or Explicit Authentication

We recall an important property of a PAKE protocol: it guarantees that if the same password was entered, the generated session key is the same for both parties, but they might not know at the end of the protocol whether it is so. This property is known as implicit authentication, as opposed to explicit authentication, in which the parties know whether they share the same session key at the end of the protocol. In both cases, the protocol should guarantee that if the passwords were different, the session keys are independent and random.

The line of work for impossibility results that we continue here focuses on non-trivial protocols19 with explicit authentication. It is known at least since [BPR00, Section 5] that explicit authentication can be added at no security cost to any protocol with implicit authentication, using a key confirmation technique. The obtained key K would be used as the key for a PRF secure for 3 queries, one of the players would send P RF K [START_REF]Generate a key pair for the one-time signature scheme: (sk, vk) ← Sig[END_REF] to the other, the other would send P RK K (2) to the first one, and both would end up using P RF K (0) as the final session key20 . This implies that the following results also hold for protocols with implicit authentication.

B.3.2 Impossibility in the Simulation-Based Model

Theorem B.1. There is no statistically simulation-based secure PAKE protocol with explicit authentication in the plain model. Proof. To prove the theorem, we employ a general result which proves that for the class of deterministic, two-sided functionalities including the equality-testing function, the security for one party implies complete insecurity for the other in the simulation-based model.

Lemma B.2 ([BCS12, Theorem 2]

). If a protocol π for the evaluation of a deterministic two-sided function F is ε-correct and ε-secure against Bob, then there is a cheating strategy for Alice (where she uses input u 0 and Bob has input v) which gives her ṽ distributed according to some distribution Q(ṽ|u 0 , v) such that for all u: Pr [ ṽ ← Q : F (u, v) = F (u, ṽ) ] ≥ 1 -28ε.

First we note that the reduction from F EQ to F e-pwKE in Lemma B.1 holds unconditionally in the UC model, which implies perfect security in the simulation-based model. We then prove by contradiction, if there is a statistically secure PAKE protocol in the plain model, then by Lemma B.1, that protocol is also a statistically secure protocol for F EQ in the plain model, which violates Lemma B.2.

quantiques. Cependant, cette même puissance de calcul permettrait également de trouver des solutions sur des tâches cryptographiques qui sont tout simplement impossibles à réaliser avec la technologie actuelle. Dans cette thèse, nous mettons les pieds dans un univers où le quantique est omniprésent en y présentant notamment deux principales contributions.

Nous mettons en avant à la fois des nouveaux modèles et de nouvelles analyses de sécurité pour deux primitives cryptographiques : les chiffrements et les preuves à divulgation nulle de connaissance non interactives. Les définitions usuelles de sécurité de ces primitives requièrent intrinsèquement la capacité d'enregistrer et de comparer des chaînes classiques. Cependant, les tâches d'enregistrement et de comparaison sont extrêmement difficiles dans le monde quantique en raison du principe d'incertitude. Nous proposons deux alternatives afin de surmonter cette barrière. De plus, nos notions de sécurité sont les premières à prendre pleinement en compte les attaques quantiques dans lesquelles les attaquants peuvent interagir avec les utilisateurs finaux sur des canaux quantiques.

D'autre part, nous montrons que la disponibilité des ordinateurs quantiques se révèle être également à l'avantage des cryptographes, même lorsque les utilisateurs finaux n'utilisent que des communications classiques. En particulier, nous présentons un protocole interactif entre une Alice classique et un Bob quantique. Ce dispositif permet à Alice d'envoyer un état quantique caché non clonable à Bob par des canaux classiques. En outre, cet état quantique non clonable établit une forte propriété dite de monogamie de l'intrication, qui décrit les limites de la force des corrélations multipartites quantiques. Enfin, nous appliquons notre protocole et nous donnons les premiers schémas semi-quantiques de protection contre la copie.

Descripteurs : Cryptographie quantique, Modèles de sécurité, Chiffrement, Preuves à divulgation nulle de connaissance, Cryptographie non clonable.

Abstract: Modern cryptography has a major foe on the horizon: the inevitable rise of quantum computers.

However, the same computing power will also unlock solutions to cryptographic tasks that are simply impossible to achieve with the current technology. This thesis sets foot in a ubiquitous quantum world, where everyone will be running quantum computers, with two main contributions.

Firstly, we put forth new security models and security analyses for two cryptographic primitives: encryption and non-interactive zero-knowledge proofs. Classical security definitions of these primitives inherently require the ability to record and compare classical strings. However, the tasks of recording and comparing are highly non-trivial in the quantum setting, due to the quantum uncertainty principle. We propose two different ways to overcome this recording barrier. Our security notions are the first to fully capture quantum attacks in which the codebreakers can interact with the end-users over quantum channels.

Secondly, we show that the availability of quantum computers turns out to be also the advantage of codemakers, even when the end-users only use classical communication. In particular, we exhibit an interactive protocol between a classical Alice and a quantum Bob which allows Alice to send a hidden unclonable quantum state to Bob through classical channels. Furthermore, the constructed unclonable quantum state establishes a strong monogamy-of-entanglement property, which describes the limitations on the strength of quantum multipartite correlations. We further apply our protocol to quantum copy-protection and give the first semi-quantum copy-protection schemes.

Keywords: Quantum Cryptography, Security Models, Encryption, Zero-Knowledge Proofs, Unclonable Cryptography.

Nota : cette page, dernière de couverture, sera retournée avant reliure.

1 √ 2 (

 12 g., ρ. The map Tr : L(H) → C denotes the trace, and Tr B : L(H A ⊗ H B ) → L(H A ) is the partial trace over subsystem B. Pos(H) denotes the set of positive semidefinite operators on H, and D(H) := {A ∈ Pos(H) | Tr[A] = 1} is the set of density matrices on H. The single qubit Pauli operators are σ X := ( 0 1 1 0 ) and σ Z := ( 1 0 0 -1 ). The Hadamard basis states are written as |(-) b ⟩ := |0⟩ + (-1) b |1⟩). We also sometimes write |+⟩ for |(-) 0 ⟩ and |-⟩ for |(-) 1 ⟩.

Definition 2 .

 2 28 -Decoding Maps 1. For a key k ∈ K 0 and a y ∈ Y, we define b(k, y) by the condition y ∈ ∪ x Supp f k, b(k,y) (x) . (This is well-defined because f k,0 and f k,1 form an injective pair.) 2. For a key k ∈ K 0 ∪ K 1 and a y ∈ Y, we define xb (k, y) by the condition y ∈ Supp(f k,b (x b (k, y))), and xb (k, y) = ⊥ if y / ∈ ∪ x Supp(f k,b (x)). For k ∈ K 0 , we also use the shorthand x(k, y) := xb (k,y) (k, y).

3 .

 3 For a key k ∈ K 1 , a y ∈ Y, and a d ∈ {0, 1} w , we define û(k, y, d) by the condition d • (x 0 (k, y) ⊕ x1 (k, y)) = û(k, y, d).

5 : return x

  Lemma 3.7 ([BZ13b, Theorem 4.10]). The encryption scheme SE in Construction 3.1 is IND-qCCA2 secure.

  Also, by event G index (A), we mean the output of the experiments (defined as in Definition 3.2) in game G index when interacting with A.Game G 0 : This is the standard attack game. In what follows, let k := k 1 ∥k 2 ← K ′ ().

Figure 3 . 2 :

 32 Figure 3.2: An arrow is an implication. There is a path from A to B if and only if A implies B. The bold arrows represent non-trivial separations we actually prove in this section.

  y |x, y⟩ → |Enc(pk, k * )⟩ x,y α x,y |x, y ⊕ SymEnc(k * , x b )⟩ , where x b denotes the actual encrypted plaintext, depending on whether it is the realworld (b = 1) or the random-world (b = 0) (but the key k * is independent of b). Notice that the first component c 1 of the ciphertext is a classical value.

Protocol 4 . 1 : 4 - 2 . 3 .

 41423 round Interactive Proof of Quantumness by [BCMV+18] 1. The verifier generates a TCF pair, along with a trapdoor, and sends just the function pair to the prover. The prover returns an image y of the TCF pair. The verifier challenges the prover by randomly asking for either a pre-image of y, or a bit c and an n-bit string d such that d • (x 0 ⊕ x 1 ) = c.

Definition 4 . 4 -

 44 Quantum-Query Advantage FunctionsA quantum-query advantage function is a pair of PPT algorithms ⟨Setup, QAF⟩ with the following properties:

Figure 4 . 1 :

 41 Figure 4.1: The simulator of Π.

Claim 4 . 7 .

 47 For any QPT adversary A, |Adv 0 (A) -Adv 1 (A)| ≤ negl(λ).

Claim 4 . 8 .

 48 For any QPT adversary A, |Adv 1 (A) -Adv 2 (A)| ≤ negl(λ).

Figure 4 . 2 :

 42 Figure 4.2: The simulator of game G 3 .

Figure 4 . 3 .

 43 Claim 4.10. For any QPT adversary A, |Adv 3 (A) -Adv 4 (A)| ≤ negl(λ).

S

Figure 4 . 3 :

 43 Figure 4.3: The simulator of game G 4 .

Figure 4 . 4 .

 44 Claim 4.11. For any QPT adversary A, |Adv 4 (A) -Adv 5 (A)| ≤ negl(λ).

Figure 4 . 4 :

 44 Figure 4.4: The simulator of game G 5 .

Figure 4 . 5 :

 45 Figure 4.5: The simulator of game G 6 .

  Encrypt(pk,•) |x, y⟩ → |x, y ⊕ Encrypt(pk, x)⟩ , and O Decrypt(sk,•) |y, x⟩ → |z, x ⊕ Decrypt(sk, y)⟩ .

Claim 4 .Game G 3 :

 43 15. For any QPT adversary A, |Adv 2 (A) -Adv 1 (A)| ≤ negl(λ).Proof. The indistinguishability between G 1 and G 2 follows from zero-knowledge property of Π. This is identical to G 2 , except now in the challenge encryption oracle, instead of encrypting using the actual encryption algorithm E.Encrypt, we use the encryption oracle in the random world of E. Denote this oracle as R Encrypt(pk 0 ,•) . Claim 4.16. For any QPT adversary A, |Adv 3 (A) -Adv 2 (A)| ≤ negl(λ).

Claim 4 .

 4 18. For any QPT adversary A, |Adv 5 (A) -Adv 4 (A)| ≤ negl(λ).

Claim 4 .

 4 19. For any QPT adversary A, |Adv 6 (A) -Adv 5 (A)| ≤ negl(λ).

Claim 4 .

 4 20. For any QPT adversary A, |Adv 7 (A) -Adv 6 (A)| ≤ negl(λ).

Claim 4 .

 4 21. For any QPT adversary A, |Adv 8 (A) -Adv 7 (A)| ≤ negl(λ).

Figure 4 . 6 :

 46 Figure 4.6: Description of the changes in games G i for i ∈ 1, 8 . In each program, the changes relative to the previous program are highlighted in light gray.

Theorem 5 . 1 (

 51 [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF] Theorem 4.18]). Assuming the existence of post-quantum indistinguishability obfuscation and one-way functions, then there exists a negligible function negl(•), for any QPT adversary (A 0 , A 1 , A 2 ), Pr [ CosetMonogamy((A 0 , A 1 , A 2 ), λ) ] ≤ negl(λ).

Protocol 5 . 2 :

 52 Semi-Quantum Copy Protection: Coset-state Test Round Input. The verifier initially receives a subspace A ⊆ F n 2 and Pauli keys (α, β) with α, β ∈ {0, 1} n as private inputs.

Definition 5 . 6 ( 1 .

 561 Success probabilities). For any device D := (S, Π, M, P ) we define γ P (D bb84 ) as the device's failure probability in a pre-image round, γ H (D bb84 ) as the failure probability in a Hadamard round in Protocol 5.1 and γ H (D coset ) as the failure probability in a Hadamard round in Protocol 5.2: γ P (D bb84 ) := Pr [ flag bb84 = flag Pre | round type = pre-image round ] , (5.14) γ H (D bb84 ) := Pr [ flag bb84 = flag Had | round type = Hadamard round ] , (5.15) γ H (D coset ) := Pr [ flag coset = flag Had ] . (5.16)Next, we give the definition of a perfect prover in Protocol 5.1. Informally, a perfect prover is accepted by the verifier in a pre-image round with probability negligibly close to Definition 5.7 (Perfect device in Protocol 5.1). We call a device D perfect if γ P (D bb84 ) = negl(λ).

Lemma 5 . 2 (

 52 [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] Corollary 4.18]). Consider an efficient device D = (S, Π, M, P ) and a bit v ∈ {0, 1}.

Definition 5 .

 5 10 (Rounding isometries[START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF]). For a device D with associated Hilbert space H D and ⃗ y ∈ Y ×n , d ∈ {0, 1} w×n , we define the isometry Ṽy,d :H D → H D ⊗ H A ⊗ H Qby the following action on an arbitrary state |φ⟩ D :Ṽ⃗ y, ⃗ d |φ⟩ D := E ⃗ a, ⃗ b∈{0,1} n X(⃗ a) ⃗ y, ⃗ d Z( ⃗ b) ⃗ y, ⃗ d D ⊗ σ X (⃗ a)σ Z ( ⃗ b) A |φ⟩ D ⊗ |Φ + ⟩ ⊗n AQ , (5.29) where |Φ + ⟩ = |00⟩+|11⟩ √ 2 denotes an EPR pair, and |Φ + ⟩ ⊗n AQ

Lemma 5 . 5 (

 55 [START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF] Proposition 4.29]). For an efficient perfect device D = (S, Π, M, P ) and any ⃗ a, ⃗ b ∈ {0, 1} n we have

Lemma 5 . 7 .

 57 For any efficient devices D, D ′ with the notation given in Definition 5.4. Assume that D is a device of Protocol 5.1 with corresponding states (ψ ( ⃗

  (a) Checks that the output qubit of the computation iO(S + α)(|$⟩) 17 is 1. (b) Execute Hadamard transform H ⊗λ on |$⟩ to obtain |$ ′ ⟩ and then check the output qubit of the computation iO(S ⊥ + β)(|$ ′ ⟩) is 1.

Figure 5 . 1 :

 51 Figure 5.1: SampleCoset procedure.

Figure 5 . 2 :

 52 Figure 5.2: Program P.

  The challenger then generates ciphertexts c 1 , c 2 as follows. * c 1 = Encrypt(pk, z) and c 2 = Encrypt(pk, z ′ ) with probability 1/3. Set b 1 = 0 and b 2 = 1. * c 1 = Encrypt(pk, z ′ ) and c 2 = Encrypt(pk, z) with probability 1/3. Set b 1 = 1 and b 2 = 0. * c 1 = Encrypt(pk, z ′ ) and c 2 = Encrypt(pk, z ′′ ) with probability 1/3. Set b 1 = 1 and b 2 = 1.

Figure 5 . 3 :

 53 Figure 5.3: Program Q m,r .

Theorem A. 5 (

 5 [START_REF] Zhandry | Quantum Lightning Never Strikes the Same State Twice[END_REF] Theorem 6.3]). If injective one-way functions exist, then any indistinguishability obfuscator, appropriately padded, is also a subspace hiding obfuscator for field F and dimensions d 0 , d 1 as long as |F| n-d 1 is exponential.

Claim A. 4 (

 4 From G 3 to G 4 ). For any QPT adversary A, we have that|Adv 3 (A) -Adv 4 (A)| ≤ Adv iO (λ, A).

Claim A. 5 (

 5 From G 4 to G 5 ). For any QPT adversary A, we have that|Adv 4 (A) -Adv 5 (A)| ≤ Adv iO (λ, A).

Pr

  A λ (ρ λ , iO(P T )) ∈ T ⊥ | T $ ← S ⊆ λ-t ≥ η(λ),andPr A λ (ρ λ , iO(P T )) ∈ (S ⊥ \ T ⊥ ) | T $ ← S ⊆ λ-t ≤ negl(λ),

First, notice that U(- 1 )

 that1 T |A s,s ′ ⟩ = U T v∈A (-1) ⟨v,s ′ ⟩ |v + s⟩ = v∈A ⟨v,s ′ ⟩ |T (v) + T (s)⟩ = w∈T (A) (-1) ⟨T -1 (w),s ′ ⟩ |w + T (s)⟩ = w∈T (A) (-1) ⟨w,(T -1 ) T (s ′ )⟩ |w + T (s)⟩ = |T (A) z,z ′ ⟩ ,where z = T (s) and z ′ = (T -1 ) T (s ′ ).

  ) = T (s + w B * ) = T (s) + T (w B * ) = z + T (w B * ),where w B * is uniformly random in B * . Since T is an isomorphism with T (B * ) = B, T (w B * ) is uniformly random in B. Thus, T (t) is distributed as a uniformly random element in B + z.For (ii), notice that(T -1 ) T (t ′ ) = (T -1 ) T (s ′ + w C ⊥ * ) = (T -1 ) T (s ′ ) + (T -1 ) T (w C ⊥ * ) = z ′ + (T -1 ) T (w C ⊥ * ), where w C ⊥ * is uniformly random in C ⊥ * . Let x ∈ C, then ⟨(T -1 ) T (w C ⊥ * ), x⟩ = ⟨w C ⊥ * , T -1 (x)⟩ = 0, where the last equality follows because w C ⊥ * ∈ C ⊥ * and T -1 (C) = C * . Thus (T -1 ) T (w C ⊥ * ) belongs to C ⊥ . Since (T -1 ) T is a bijection, (T -1 ) T (w C ⊥ * ) is uniformly random in C ⊥ . It follows that (T -1 ) T (t ′ ) is distributed as a uniformly random element in C ⊥ + z ′ .Hence, A receives the correct distribution, and thus, with probability p, A returns a pair (v, w) ∈ Λ(T (A), z) satisfying v| T ̸ = w| T and v -w ∈ (T (A) \ C).Notice that:• If v ∈ T (A) + z, where z = T (s), then T -1 (v) ∈ A + s. • If v -w ∈ (T (A) \ C), then v -w / ∈ C. Thus, we have T -1 (v) -T -1 (w) = T -1 (v -w) / ∈ T -1 (C) = C * .Since C * is the subspace of vectors such that the last 7n/8 entries are zero, we also have that T-1 (v)| T ̸ = T -1 (w)| T .Thus, with the same probability p, B returns a pair (v ′ , w ′ ) ∈ Λ(A, s) such that v ′ | T ̸ = w ′ | T and v ′ -w ′ ∈ (A \ C * ), as desired.

=

  x∈{0,1} n/8 ,v∈A(-1) ⟨x,s ′ ⟩ (-1) ⟨v,s ′ ⟩ |(x + s)∥(v + s)∥ŝ⟩ = x∈{0,1} n/8 ,v∈A (-1) ⟨(x∥v∥0 n/8 ),(s ′ ∥s ′ ∥ŝ ′ )⟩ (x∥v∥0 n/8 + s∥s∥ŝ) = w∈ Ã(-1) ⟨w,z ′ ⟩ |w + z⟩ = | Ãz,z ′ ⟩ ,

  m 1 ∈ {0, 1} ∧ Verif 2 (vk, m 0 , σ 0 , m 1 , σ 1 ) = 1 ∧ (m 0 , σ 0 ) ̸ = (m 1 , σ 1 ) (vk, sk) $ ← KeyGen(1 λ ) sig $ ← TokenGen(sk) (m 0 , σ 0 , m 1 , σ 1 ) ← A(vk, sig)

Figure A. 1 .

 1 This construction is identical to the one for weak unforgeability in[START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF].Theorem A.7. Assuming the existence of quantum-secure indistinguishability obfuscation and quantum-secure injective one-way functions, the scheme given in Figure A.1 is a one-bit one-time strongly unforgeable tokenized digital signature scheme.

Figure B. 1 .

 1 Functionality F D CRS The functionality F D CRS is parameterized by a distribution D. It interacts with a set of players and an adversary in the following way: • Choose a value r $ ← D.

Figure B. 1 :

 1 Figure B.1: The functionality F D CRS .

Figure B. 2 .

 2

Figure B. 2 :

 2 Figure B.2: The oblivious transfer functionality F OT .

Figure B. 3 .

 3 The description of the functionality is a modified version of the description in [ACCP09; CDVW12].

Figure B. 3 :

 3 Figure B.3: The password-based key-exchange functionality F e-pwKE with explicit mutual authentication.

  2.2.4 Quantum Random Oracle ModelA random oracle is a function H : {0, 1} m → {0, 1} n sampled from Funcs[m, n], the uniform distribution over functions from {0, 1} m to {0, 1} n . The standard method to encode a random function H as a quantum operation is the unitary matrix O H , which acts as |x, y⟩ → |x, y ⊕ H(x)⟩. Another way to do it is to use the compressed random oracle CStO formalism of Zhandry[START_REF] Zhandry | How to Record Quantum Queries, and Applications to Quantum Indifferentiability[END_REF].

  and let {|a⟩} a∈Ω be a fixed orthonormal basis of C d . A may be entangled with another system E, and we write the purified state on A and E as |ψ⟩ AE . We consider the problem of testing whether the state on A is close to the all-zero reference state |0⟩ A 1 . . . |0⟩ An . There is a natural way to apply any sampling strategy Ψ = (PP T S (t, s) |t, s⟩ ⟨t, s| T S ⊗ |ψ⟩ ⟨ψ| AE .Next, we compare this state to an ideal state, parameterized by 0 < δ < 1, of the formP T S (t, s) |t, s⟩ ⟨t, s| T S ⊗ | ψ ts ⟩ ⟨ ψ ts | AE with |ψ ts ⟩ AE ∈ span B δ t,s ⊗ H E , That is, ρ T SAE isa state such that it holds with certainty that the state on registers A| t E, after having measured A| t and observing q| t , is in a superposition of states with relative Hamming weight δ-close to f (t, q| t , s). This leads us to the definition of the quantum error probability of strategy Ψ.

	t,s
	ρ T SAE :=
	t,s
	where
	span B δ t,

T , P S , f ) to this setting: sample t, s according to P T , P S , measure subsystems A i for i ∈ 1, t in basis {|a⟩} a to observe q| t ∈ Ω |t| , and compute an estimate f (t, q| t , s).

In order to analyze the effect of this strategy, we first consider the mixed state on registers T (holding the subset t), S (holding the seed s), and A, E that results from sampling t and s according to P T S := P T P S ρ T SAE := s := span {|b⟩ : b ∈ B δ t,s } = span ({|b⟩ : |ω(b| t ) -f (t, b| t , s)| < δ}) .

  Efficient Range Superposition. For all keys k ∈ K 0 and b ∈ {0, 1}1. There exists an efficient deterministic procedure Chk G that, on input k, b ∈ {0, 1}, x ∈ X and y ∈ Y, outputs 1 if y ∈ Supp(g k,b (x)) and 0 otherwise. Note that Chk G is not provided the trapdoor t k . The algorithms Chk F and Samp F are the same as the algorithms Chk G and Samp G .

	2. There exists an efficient procedure Samp G that on input k and b ∈ {0, 1}
	returns the state
	1 |X | x∈X ,y∈Y	(g k,b (x))(y) |x⟩ |y⟩ .	(2.13)
	Definition 2.26 -Injective Invariance
	A noisy trapdoor claw-free family F is injective invariant if there exists a trapdoor
	injective family G such that:
	1. 2. For all quantum polynomial-time procedures A, there exists a negligible
	function µ(•) such that
		Moreover, there exists
	an efficient deterministic algorithm Inv F such that for all b ∈ {0, 1}, x ∈ X
	and y ∈ Supp(g k,b (x)), Inv G (t k , y) = (b, x).

  .1, which applies a single computation of f 2 (denoted as a unitary U f 2 ), implementing our compressed encryption oracle in the random world. Let Test be the unitary defined as Test |0⟩ |b⟩ → |0⟩ |b⟩ and Test |ϕ⟩ |b⟩ → |ϕ⟩ |b ⊕ 1⟩ for any |ϕ⟩ orthogonal to |0 n 2 ⟩ and b ∈ {0, 1}. One can easily verify that this circuit outputs the same quantum state as stated in Lemma 3.2.

		|x⟩
	Oracle's registers	|z 2 ⟩ |0⟩ |⊥⟩ |0⟩ |r⟩ |0⟩	Test	QFT	U f 2	QFT	Test

Figure 3.1: A quantum circuit implementing our CFourierO f 2 •h oracle. Depending on the control bit b which is the output of Test, if b = 1, we apply U f 2 , otherwise, we apply the identity.

•

  B receives a state |A s,s ′ ⟩ together with t, t ′ , for some C * ⊆ A ⊆ B * , where t = s+w B * for w B * , and t ′ = s ′ + w C ⊥ * for w C ⊥ * B picks uniformly at random subspaces B and C of dimension 7n/8 and n/8 respectively, such that C ⊆ B. B also picks a uniformly random isomorphism T mapping C * to C and B * to B. B applies to |A s,s ′ ⟩ the unitary U T which acts as T on the standard basis elements. B gives U T |A s,s

	$ ← C ⊥ * .
	•

$ ← B * ′ ⟩ to A together with B, C, T (t), (T -1 ) T (t ′ ).

  • B receives |A s,s ′ ⟩ for uniformly random A ⊆ F m 2 of dimension m 2 and uniformly random s, s ′ ∈ F m 2 . B samples s, s′ , ŝ, ŝ′ $ ← F (-1) ⟨x,s ′ ⟩ |x + s⟩. B creates the state |W ⟩ = |ϕ⟩ ⊗ |A s,s ′ ⟩ ⊗ |ŝ⟩ .B gives to A as input the state |W ⟩, together with t = 0 7n/8 ∥ŝ + w B for w B and t′ = ŝ′ ∥0 7n/8 + w C ⊥ , for w C ⊥ $ ← C ⊥ . • A returns a pair (v, w) ∈ F n 2 × F n 2 . Let v ′ = v| n Notice that |W ⟩ = |ϕ⟩ ⊗ |A s,s ′ ⟩ ⊗ |ŝ⟩

		n
		8 2 .
	Let |ϕ⟩ = 1 2 n/16	x∈{0,1} n/8 8 , 7n 8 -1 ∈ F m 2 be the "middle" 3n

$ ← B, 4 entries of v. Let w ′ = w| n 8 , 7n 8 -1 . B outputs (v ′ , w ′ ).

Recall that in the standard oracle model, the query is implemented as |x, y⟩ → |x, y ⊕ f (x)⟩. In the minimal oracle model, the query is implemented as |x⟩ → |f (x)⟩.

For notation consistency, we use the same subscript in compressed oracles as for standard oracles. However, we note that there is no real function h in the implementation of CFourierO and its variants.

The oracle first computes FindImage ′ , records the output in some ancilla register, performs the CNOT operation controlled on the output and finally un-compute FindImage ′ .

These cryptographic assumptions can be based on the quantum hardness of the Learning with Errors problem[START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF].

Even if we can prove security for the dequantized protocol, it is not clear if it is applicable (with little efforts) to other cryptographic constructions of interest.

We omit the details of this decoding procedure, and refer the reader to Section 5.4.1. We note that with the trapdoor t, this procedure can be implemented efficiently by the verifier.

This sketch is described in[START_REF] Gheorghiu | Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more[END_REF], we briefly recall it here, and refer the reader to that paper for more details.

We thank an anonymous reviewer for pointing out this approach, so that our protocol is indeed applicable to copy-protection in a plug-and-play manner.

We thank Alexandru Gheorghiu for providing us this insightful comments.

As explained for instance in [CHKL+05, Section 7], the results are only interesting for what they call non-trivial protocols, in which two parties agree on a shared secret key at the end of the execution of the protocol (except perhaps with negligible probability), if 1) they use the same password and 2) the adversary passes all messages between the parties without modifying them or inserting any messages of its own. This is required since otherwise the empty protocol in which parties do nothing would securely realize any PAKE functionality.

A trivial construction of such a (perfect) PRF would be to split the key into three parts, use the two first parts as key confirmations and the last one as the real session key.

10.1007/978-3-030-84242-0_20 (cited on pages 5, 7, 103, 105, 113, 141, 143-145, 149, 152-154, 158, 161).

• Run the first verifier message for Π ipq to obtain (v 1 , r), where v 1 is the first verifier message and r is the private coin of the verifier of Π ipq .

• Sample a uniformly random string v 2 $ ← {0, 1} * as the second verifier message for Π ipq .

• Set pp as an empty string and sk := (pp, k, v 1 , v 2 , r) and output (pp, sk). QAF(sk, •): on input a message x, we consider several distinguished cases (all cases are considered with appropriate input length):

• If x is of the form (0∥u): compute the semi-quantum verifier message for Π ipq on (v 1 , u) and obtain (v 1 , p 1 , v 2 ). Output (p 1 , v 2 ).

• If x is of the form (1∥p 1 ∥p 2 ): if the verifier of Π ipq accepts the transcript (v 1 , p 1 , v 2 , p 2 ) with the secret state r, output accept, otherwise output reject.

• Otherwise output ⊥. The proof of Theorem 4.1 follows from Lemma 4.2 and Lemma 4.3 stated below.

Lemma 4.2 (Quantum-query easiness). Suppose Π ipq satisfies quantum completeness (Definition 4.3). Then Construction 4.1 satisfies quantum-query easiness.

Proof. Let P denote the efficient quantum prover for Π ipq such that

Define the following QPT algorithm P:

• Make a (quantum) query x |0∥x, 0⟩ to QAF(sk, •).

• Measure the response register to get a classical string p 1 .

• Run P on p 1 , v 2 and the post-measurement state to obtain p 2 .

• Output p 1 ∥p 2 .

By the completeness of Π ipq , QAF(sk, •) outputs accept with probability 1 -negl(λ).

Construction 4.3 -QSS-NIZK in the CRS Model [START_REF] De Santis | Robust Non-interactive Zero Knowledge[END_REF] Common random string. The random reference string consists of three parts crs 1 , crs 2 and crs 3 .

• crs 1 is of length 6λ 2 , and breaks up into λ pairs (r 1 , c 1 ), . . . , (r λ , c λ ).

• crs 2 is of length 3λ.

• crs 3 is a common random string of Π ′ .

Prover. We define the language L ′ to be the set of tuples (x, u, v, crs 1 , crs 2 ) such that at least one of the following three conditions hold:

• x ∈ L

• crs 1 consists of commitments to the bits of the λ bit string s: formally, there exists s = s 1 • • • s λ with s i ∈ {0, 1} for all i ∈ 1, λ , and there exists a 1 , . . . , a λ ∈ {0, 1} λ such that (r i , c i ) = Commit(s i ; r i , a i ). Furthermore, u = PRF(s, v).

• There exists d ∈ {0, 1} λ such that crs 2 = PRG(d).

On input a statement x, a witness ω and the common random string CRS := (crs 1 , crs 2 , crs 3 ), the prover P does the following:

Observe that P * perfectly simulates A, and thus P * breaks the randomness collisionresistance property of the Σ protocol with the same probability that con 2 happens. We obtain Pr [ A wins ∧ con 2 ] ≤ negl(λ). Overall we have shown that ε is negligible, completing the proof.

Randomness Collision-resistance Σ-protocols

In this section, we give a compiler that transform any Σ-protocol into a randomness collision-resistance Σ-protocol. Our compiler makes use of quantum-secure one-time signature schemes and is very simple. In the first prover message, the prover also generates a key pair of the signature scheme, and in last message, the prover uses the signing key and signs all the messages that have been exchanged so far (including the one from the original protocol in the last round). The proof of the compiler is almost identical to that of Claim 4.7, we omit the details.

Application to the Naor-Yung Construction with Quantum CCA Security

In this section, we present and prove quantum security of a simple modification of the classical Naor-Yung scheme [START_REF] Naor | Public-key Cryptosystems Provably Secure against Chosen Ciphertext Attacks[END_REF][START_REF] Sahai | Non-Malleable Non-Interactive Zero Knowledge and Adaptive Chosen-Ciphertext Security[END_REF]. That is, we show how to construct quantum chosen-ciphertext secure encryption schemes from quantum chosen-plaintext secure schemes and quantum-simulation-sound NIZK proof systems.

Quantum-Secure Invertible Pseudorandom Functions

We first show a construction for invertible pseudorandom functions from standard pseudorandom functions, which will be used later as a building block for our quantum CCA encryption scheme. The construction is the one given in [START_REF] Boneh | Constrained Keys for Invertible Pseudorandom Functions[END_REF].

Define the following invertible iPRF on domain X using a key k : Proof. We note that in the weak pseudorandom security, the adversary has only quantum access to an evaluation oracle iPRF, and not an inversion oracle iPRF -1 . The proof of the theorem follows from the standard hybrid argument, where we first replace PRF 1 with a truly random function, and then we replace PRF 2 with another truly random function. We omit the details.

Construction of Our Quantum CCA Encryption Scheme

Our construction uses the following ingredients:

• Let E = ⟨KeyGen, Encrypt, Decrypt⟩ be a qIND-qCPA encryption scheme.

• Let E ′ = ⟨KeyGen, Encrypt, Decrypt⟩ be an IND-qCPA encryption scheme.

• Let iPRF be a family of invertible pseudorandom functions.

• Let Π = ⟨Setup, P, V, S = (S 1 , S 2 )⟩ be a quantum-simulation-sound NIZK proof system for the language L of consistent pairs of encryptions, defined formally in Equation (4.3).

L := {(pk 0 , pk 1 , y 0 , y 1 , y 2 ) : ∃ (x, k, r 0 , r 1 ) :

3)

We construct a new encryption scheme E as follows.

Construction 4.5 -Our Quantum CCA Encryption Scheme

KeyGen(1 λ ) :

4 : pk = (crs, pk 0 , pk 1 )

5 : sk = (crs, sk 0 , sk 1 )

6 : return (pk, sk)

Encrypt(pk, x) :

2 : y 0 ← E.Encrypt(pk 0 , x; r 0 )

5 : π ← Π.P(crs, (y 0 , y 1 , y 2 ), (x, k, r 0 , r 1 ))

6 : return (y 0 , y 1 , y 2 , π)

Decrypt(sk, (y 0 , y 1 , y 2 , π)) :

Theorem 4.5. The encryption E described in Construction 4.5 above is qIND-qCCA2 secure.

Proof. Let A be a QPT adversary. For any game G i , we denote by

, where the probability is taken over the random coins of G i and A. The changes in each game are depicted in Figure 4.6.

"

When it's classically impossible, that really just means it's quantumly interesting. "

In this chapter, we present a generic compiler that translates many known constructions of quantum copy-protection to semi-quantum copy-protection. This particularly allows us to obtain (the first) semi-quantum copy-protection for digital signatures, public-key decryption, pseudorandom functions and point functions.

Definition 5.12 -Soundness For any QPT prover P = {P λ , ρ λ } λ∈N interacting with a PPT verifier V in Protocol 5.5, after which V outputs {S i , α i , β i } i∈T and P outputs a state ψ, let ({S i , α i , β i } i∈T , ψ) ← ⟨P λ (ρ λ ), V(1 λ )⟩ denote this interaction. The prover (now modeled as a triple algorithm (P, B, C)) then interacts with the verifier in the following monogamy game.

(1) Splitting. The prover applies a CPTP map to split ψ into a bipartite state ψ BC ; it sends the register B to B and the register C to C. No communication is allowed between B and C after this phase.

(2) Question. The verifier sends the description of {S i } i∈T , to both B and C.

(3) Answer. B returns s

The prover (P, B, C) wins if and only if s

2 ∈ S ⊥ i + β i for all i ∈ T . Let SMCosetMonogamy(P, λ) be a random variable which takes the value 1 if the game above is won by the prover (P, B, C), and takes the value 0 otherwise. The protocol is secure if the winning probability of any QPT adversary is negligible. Formally, for any QPT malicious prover, the protocol is computationally sound if we have

Pr[SMCosetMonogamy(P, λ) = 1] ≤ negl(λ).

Theorem 5.2. Protocol 5.5 is computationally sound, according to Definition 5.12.

Proof. Let P = {P λ , ρ λ } λ∈N a quantum polynomial time adversary that succeeds in the game SMCosetMonogamy with some non-negligible probability ε = {ε λ } λ∈N . Let

This means that P = (P, B, C) is able to output a pair (s

for all i ∈ T in the monogamy game defined in Definition 5.12.

Let δ ′ ∈ (0, 1] the sub-exponential security level of the QFHE (that is, any QPT adversary cannot break the semantic security of the QFHE with advantage bigger than 2 λ δ ′ ), and denote δ := δ ′ 2 . We next describe a sequence of hybrid experiments. 16 Game G 0 : This is the original experiment.

We define G 0 as the original attack, where P interacts with the verifier in Protocol 5.5 and wins the monogamy game SMCosetMonogamy. We say G 0 is successful if SMCosetMonogamy(P, λ) = 1. The experiment G 0 is thus successful with probability ε.

Game G 1 : Changing the success definition of the experiment.

Pick a random index i ∈ T , for shorthand, denote this coset instance as (S, α, β), and the adversary's corresponding output in the monogamy game is (s 1 , s 2 ). In the current hybrid, the experiment is defined to be successful if s 1 ∈ S + α and s 2 ∈ S ⊥ + β. In particular, in the current hybrid, we only consider the monogamy game for a random instance among |T | coset instances. (The other instances are not considered). Apparently, C respectively.) This is exactly in contradiction to strong monogamy of entanglement security as we presented above.

Copy-Protection of Point Functions

In this section, we present a construction of (semi-quantum) copy-protection for point functions, as an example for demonstrating our semi-quantum copy-protection protocol (Protocol 5.5).

Anti-Piracy Security Definition

Recall that a point functions family {PF y } y∈X is indexed by points y ∈ X and a point function PF y returns 1 on input y and 0 on any other input.

Following [START_REF] Coladangelo | Quantum copy-protection of compute-and-compare programs in the quantum random oracle model[END_REF], we give a security definition for copy-protection for point functions by instantiating the general definition of copy-protection (see Section 2.3.9) with the following challenge distribution. We set D f as the uniform distribution over {0, 1} n and, for each function f = PF y , we set X f as the distribution that returns:

• (x, y) with probability 1 3 ; • (y, x) with probability 1 3 ; • (x, x ′ ) with probability 1 3 ; where x, x ′ are sampled uniformly at random. These distributions yield p trivial D f ,{X f } f ∈F = 2/3. For a clarity purpose, we will use the notations D y instead of D f and X y instead of X f .

Construction

Let {PF y } y∈{0,1} n be the family to be copy-protected, where n := n(λ) is a polynomial in λ. We define ℓ 0 , ℓ 1 , ℓ 2 such that n = ℓ 0 + ℓ 1 + ℓ 2 and ℓ 2 -ℓ 0 ≥ is large enough. For this construction, we need three pseudorandom functions (PRFs):

• A puncturable extracting PRF (Definition 2.10)

, where m is a polynomial in λ and n ≥ m + 2λ + 4;

• A puncturable injective PRF (Definition 2.9)

Construction 5.1 -Copy-Protection of Point Functions ρ y ← PF.Protect(y):

), where SampleCoset is described in Figure 5.1.

• Sample PRF keys k i for PRF i with i ∈ {1, 2, 3}.

• Prepare the program P ← iO(P), where P is described in Figure 5.2. Definition 5.14 -Anti-Piracy Security, Real-or-Random style A single-decryptor scheme has anti-piracy security (real-or-random style) if no QPT adversary (A 0 , A 1 , A 2 ) can win the anti-piracy game (real-or-random style) with a probability significantly greater than 1/2. More precisely, for any QPT adversary

We observe that the construction of single-decryptor given in [CLLZ21] also satisfies our definition of anti-piracy in the real-or-random style. For completeness, we recall their construction below.

Construction 5.3 -[CLLZ21]'s Single-Decryptor Scheme

Given a security parameter λ, let n = λ and κ be polynomial in λ.

(sk, pk) ← Setup(1 λ ):

ρ sk ← QKeyGen(sk):

m/⊥ ← Decrypt(ρ sk , c):

sk be the resulting state, run iO(Q m,r ) coherently on ρ ′ k and measure the final register to get m;

Figure 5.4: GenTrigger procedure.

Lemma 5.13 ([CLLZ21, Lemma 7.17]). Assuming post-quantum iO and one-way functions, any efficient QPT algorithm A cannot win the following game with nonnegligible advantage:

) and prepares a quantum key

• The challenger samples challenges x 1 , x 2 according to the following distribution:

- • The challenger parses the inputs x i as

• The challenger flips a coin b, and sends either x 1 , x 2 or x ′ 1 , x ′ 2 to respectively Bob and Charlie, depending on the value of the coin. A wins if it guesses b.

We are now ready to prove the anti-piracy security of our Construction 5.1. We proceed with the proof via a sequence of hybrids. For any pair of hybrids (G i , G j ), we say that G i is negligibly close to G j if for every QPT adversary A = (A 0 , A 1 , A 2 ), the probability that A wins in G i is negligibly close to the probability that it wins in G j . For the sake of simplicity, we denote the uniform distribution over {(0, 1), (1, 0), (1, 1)} as D 1/3 . Game G 0 : This is the original anti-piracy game of our copy-protection scheme.

(a) Setup phase

-If b i = 0: the challenger sets z i := z.

-Otherwise, the challenger samples z i ← {0, 1} m .

-In both case, the challenger computes (x i , Q) ← SD.Encrypt(pk, z i ).

-Finally, the challenger computes x ′ i as in GenTrigger using x i,0 and Q.

Reduction to Single-Decryptor's Anti-Piracy Game. Assume that there exists a QPT adversary (A 0 , A 1 , A 2 ) who wins G 3 with advantage δ. We construct an adversary (B 0 , B 1 , B 2 ) who wins the anti-piracy game, real-or-random style, of the single-decryptor scheme with the same advantage δ.

Setup phase

• The challenger samples (sk, pk) ← Setup(1 λ ).

• The challenger prepares ρ sk ← SD.QKeyGen(sk).

• The challenger sends (pk, ρ sk ) to B 0 .

Splitting phase

• B 0 samples three keys k 1 , k 2 , k 3 and an image z ← {0, 1} m . • B 0 constructs the program P (based on k 1 , k 2 , k 3 , pk) as in Protect and sets P ← iO(P).

• B 0 sends (ρ sk , P, z) to A 0 to get σ 12 .

to B 2 and z as the challenge message to the challenger.

Challenge phase:

• The challenger samples two uniformly random messages (z ′ , z ′′ ) and two ciphertexts (c 1 , c 2 ) as follows.

c 1 = Encrypt(pk, z) and c 2 = Encrypt(pk, z ′ ) with probability 1/3.

c 1 = Encrypt(pk, z ′ ) and c 2 = Encrypt(pk, z) with probability 1/3.

c 1 = Encrypt(pk, z ′ ) and c 2 = Encrypt(pk, z ′′ ) with probability 1/3. • The challenger sends c 1 to B 1 and c 2 to B 2 .

Answer phase

• For i ∈ {1, 2}:

and returns the outcome b ′ i . The adversary (B) perfectly simulates A, and thus B breaks the anti-piracy security of the single-decryptor scheme with the same probability δ, which completes the proof.

A Tokenized Digital Signatures

We report in this chapter a construction of tokenized digital signatures with strong unforgeability security. The notion of quantum tokens for digital signatures was initiated by Ben-David and Sattath [START_REF] Ben | Quantum Tokens for Digital Signatures[END_REF]. In a tokenized digital signature scheme, a signer who gets one copy of the signing token sig can sign a single bit b using a QPT algorithm Sign(b, sig) whose output is a classical signature. The correctness guarantees that the verification will accept the result as a signature on b. We note that the signing algorithm is a unitary and will produce a superposition of all valid signatures of b; to obtain a classical signature, a destructive measurement to the state is necessary which leads to a collapse of the token state. Thus, a signing token sig can only be used to produce one classical signature of a single bit and any attempt to produce a classical signature of the other bit would fail.

Ben-David and Sattath [START_REF] Ben | Quantum Tokens for Digital Signatures[END_REF] show how to construct a strongly unforgeable tokenized digital signature scheme relative to a classical oracle (a subspace membership oracle). This construction is then successfully instantiated in the plain model due to Coladangelo et al. in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF], albeit their construction is only weakly unforgeable. In this chapter, we improve [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF]'s results and show that their construction is indeed strongly unforgeable. [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF] construction is based on hidden coset states, whose security is reduced to a computational direct product hardness of coset states. We then show another version of the direct product hardness of coset states, which allows us to show strong unforgeability for [CLLZ21]'s construction. Our contribution is thus the proof, not the construction. This is a joint work with Thomas Vidick in 2021, in a failed attempt to construct non-interactive zero-knowledge proof systems for any language in QMA, the quantum analog of the class NP.

Before going into details, we give some intuition behind the construction of weakly unforgeable tokenized digital signatures in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF], which our construction is based on. [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF] establishes the following computational direct product theorem for coset states: a computationally bounded adversary who receives |A s,s ′ ⟩ and programs iO(P A+s ), iO(P A ⊥ +s ′ ) for uniformly random A, s, s ′ , cannot produce a pair (v, w) such that v ∈ A+s and w ∈ A ⊥ + s ′ , except with negligible probability. From this computational direct product problem, they give the first instantiation of (weakly unforgeable) tokenized digital signatures based on classical cryptographic assumptions. Very roughly, the signing token is |A s,s ′ ⟩, one can measure the state in the computational basis to obtain a signature for 0, and measure the state in the Hadamard basis to obtain a signature for 1.

To prove this computational direct product theorem, the authors invoke the notion of subspace-hiding obfuscators, introduced by Zhandry in [START_REF] Zhandry | Quantum Lightning Never Strikes the Same State Twice[END_REF]. A subspace hiding obfuscator shO has the property that any computationally bounded adversary who chooses a subspace A cannot distinguish between shO(P A ) and shO(P B ) for a uniformly random superspace B of A (of not too large dimension). Zhandry further shows that The first required lemma (proven in Appendix A.2.3) shows that the first and the second requirement (i)-(ii) are provably satisfied, except that we strengthen these requirements to require that the output vectors differ in the last 7n/8 positions.

Lemma A.1. Let T := n 8 , n -1 . Under the same assumptions as Theorem A.3, given one copy of |A s,s ′ ⟩, iO(P A+s ) and iO(P A ⊥ +s ′ ) any QPT adversary outputs a pair (v, w) such that either (i) (v, w) ∈ Λ(A, s) and v| T ̸ = w| T ;

(ii) or (v, w) ∈ Λ(A ⊥ , s ′ ) and v| T ̸ = w| T ; with negligible probability.

The second required lemma is identical to the first lemma, except that now we require the output vectors to be different in the first 7n/8 positions. The proof of this lemma is trivially adapted from that one of Lemma A.1.

Lemma A.2. Let T := 0, 7n 8 -1 . Under the same assumptions as Theorem A.3, given one copy of |A s,s ′ ⟩, iO(P A+s ) and iO(P A ⊥ +s ′ ), any QPT adversary outputs a pair (v, w) such that either (i) (v, w) ∈ Λ(A, s) and v| T ̸ = w| T ;

(ii) or (v, w) ∈ Λ(A ⊥ , s ′ ) and v| T ̸ = w| T ; with negligible probability.

We also recall the original computational direct product hardness stated in [START_REF] Coladangelo | Hidden Cosets and Applications to Unclonable Cryptography[END_REF] for completeness.

Theorem A.4 ([CLLZ21, Theorem 4.6]). Assume the existence of quantum-secure indistinguishability obfuscation and injective one-way functions. Let A ⊆ F n 2 be a uniformly random subspace of dimension n/2, and s, s ′ be uniformly random in F n 2 . Given one copy of |A s,s ′ ⟩, iO(P A+s ) and iO(P A ⊥ +s ′ ), any QPT adversary outputs a pair v, w such that v ∈ A + s and w ∈ A ⊥ + s ′ with negligible probability.

Assuming Lemma A.1 and Lemma A.2, we prove Theorem A.3 as follows.

Proof of Theorem A.3. We note that the third item (iii) is proven by Theorem A.4, and that finding such a different pair of vectors in Λ(A, s) and finding such a pair in Λ(A ⊥ , s ′ ) are essentially the same task. Thus, it suffices to prove the first item (i), and the second item (ii) will follow by symmetry.

We prove item (i) by contrapositive. Suppose it is false. Then there exists a QPT adversary A that given |A s,s ′ ⟩ , iO(P A+s ) and iO(P A ⊥ +s ′ ) for a uniformly random A ⊆ F n 2 and uniformly random vectors s, s ′ ∈ F n 2 , returns (v, w) ∈ Λ(A, s) such that v ̸ = w with non-negligible probability ϵ.

Let T 1 := 0, 7n 8 -1 and T 2 := n 8 , n -1 . For any pair v ̸ = w, it must be the case that v| T 1 ̸ = w| T 1 or v| T 2 ̸ = w| T 2 . Let p 1 be the probability that A returns (v, w) such that v| T 1 ̸ = w| T 1 , and p 2 be the probability that A A returns (v, w) such that v| T 2 ̸ = w| T 2 . (These probabilities are taken over everything: the randomness of the challenger and of the adversary.) Then, by the union bound, we have that p 1 + p 2 ≥ ϵ. Since ϵ is non-negligible, at least one of p 1 or p 2 must be non-negligible. If p 2 is non-negligible, then the adversary A contradicts Lemma A.1. Similarly, if p 1 is non-negligible, A contradicts Lemma A.2.

Proof of Lemma A.1

Proof. We note that finding such a pair of elements in Λ(A, s) and finding such a pair in Λ(A ⊥ , s ′ ) are essentially the same task; thus it suffices to prove the result for a pair in Λ(A, s), and the result for the other case will follow by symmetry.

Let A be a QPT adversary for the direct product game of Lemma A.1. The proof of the lemma proceeds by a sequence of hybrids. For any hybrid G i , we denote by Adv i (A) the advantage of A in G i , where the probability is taken over the random coins of G i and A.

Game G 0 : This is the direct product game of Lemma A.1.

Game G 1 : This is identical to G 0 , except that now the obfuscation iO(P A+s ) is replaced by iO(iO(P A )(• -s)). For simplicity, in the following, we abuse the notation and write iO(iO(P A )(• -s)) as iO(P A (• -s)).

Claim A.1 (From G 0 to G 1 ). For any QPT adversary A, we have that

Proof. We note that both P A+s and P A (• -s) compute the same functionality, since any vector v ∈ A + s if and only if v -s ∈ A. By security of iO, the two games are computationally indistinguishable.

Game G 2 : This is identical to G 1 , except that now the challenger samples uniformly at random a superspace B of A of dimension 7n 8 , and the obfuscation iO(P A (• -s)) is replaced by iO(P B (• -s)).

Claim A.2 (From G 1 to G 2 ). For any QPT adversary A, we have that

Proof. Since B is a superspace of A of dimension 7n 8 , by the subspace hiding property of iO (Lemma 2.8), the two games are computationally indistinguishable.

Game G 3 : This is identical to G 2 , except that now the challenger samples uniformly at random an element w B from B, and the obfuscation iO(P B (• -s) is replaced by iO(P B (• -t)), where t = s + w B .

Claim A.3 (From G 2 to G 3 ). For any QPT adversary A, we have that

Proof. We note that both P B (• -t) and P B (• -s) compute the same functionality, since for any vector w B ∈ B, we have B + w B is the same as B. By security of iO, the two games are computationally indistinguishable.

Game G 4 : This is identical to G 3 , except that now the obfuscation iO(P A ⊥ +s ′ ) is replaced by iO(P A ⊥ (• -s ′ )).

KeyGen(1 λ ) : Set n = poly(λ).

• Sample uniformly

• Output sk := (A, s, s ′ ) (where by A we mean a description of the subspace A), and vk := (iO(P A+s ), iO(P A ⊥ +s ′ )).

TokenGen(sk) : Take as input sk of the form (A, s, s ′ ).

• Output sig := |A s,s ′ ⟩.

Sign(m, sig) : Take as input m ∈ {0, 1}, and a state sig on n qubits.

• Compute H ⊗n sig if m = 1, otherwise do nothing to the quantum state.

• Measure the state in the computational basis. Let σ be the outcome.

• Output (m, σ).

Verif(vk, (m, σ)) : Parse vk as (C 0 , C 1 ) where C 0 and C 1 are circuits.

• Output C m (σ).

TokenVerif(vk, sig) : Parse vk as (C 0 , C 1 ) where C 0 and C 1 are circuits.

• Let V i be the unitary implementing the following operation:

• Measure the last register in the computational basis.

• If the outcome is 1, return (0, sig ′ ). Otherwise, return (1, sig ′ ).

Figure A.1:

A one-bit one-time strongly unforgeable scheme from hidden coset states.

Appendix

B Password-Authenticated Quantum Key Exchange

In their 1984 seminal paper [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF], Bennett and Brassard gave the first proof that the laws of quantum mechanics could lead to an achievement of unconditional security for classical cryptographic tasks. Their celebrated Quantum Key Distribution protocol (so-called QKD) allows two parties to agree on a common secret key which is informationtheoretic secret, assuming a quantum channel and an authenticated (but not secret) classical channel. Even though this protocol is a conceptual milestone in the quantum cryptography field, the need for an information-theoretically authenticated classical communication channel leads to a bootstrapping problem. In practice, implementations of unconditionally secure QKD leave no choice but requiring Alice and Bob to use a pre-shared short random secret key (to authenticate the messages with authentication codes constructed from universal hashing) in order to obtain a larger random secret key.

Another unavoidable problem is that the authentication keys can be run out, because either the adversary makes the execution fail (denial-of-service attack) or due to technical problems (the parties cannot exclude that an eavesdropper was in fact present). Moreover, when considering large scale quantum networks, in which secure communication should be possible between any pair of nodes, the requirement for pre-shared randomness does not scale well: each node would have to store a number of keys, which is linear in the size of the network, let alone the problem of key management. On the contrary, in so-called authenticated key exchange, the two parties are able to generate a shared cryptographic secret key, to be later used with symmetric primitives in order to protect communications, while interacting over an insecure network under the control of an adversary. Various authentication means have been introduced for classical networks. The most practical ones are certainly based on either Public Key Infrastructures (PKI) or human-memorable passwords. The latter leads to PAKE, standing for Password-Authenticated Key Exchange. PAKE protocols allow users to securely establish a common cryptographic key over an insecure and unauthenticated channel only using a low-entropy, human-memorable secret key called a password. The advantage of a PAKE, in sharp contrast to all QKD-like schemes, is that no authenticated channel is needed. In the classical setting, PAKE has been extensively studied, resulting in various secure and efficient protocols. However, classical PAKE protocols can only achieve computational security, where the adversary's power is computationally limited. Thus, it is natural to ask if we can achieve a provably stronger security notion for password-based key exchange protocols using quantum communication.

Unfortunately, even if QKD raised a lot of hope on unconditional security using quantum mechanics, a series of no-go theorems showed that the dream of unconditional security brought by quantum communication will never be a reality for many crypto-• if the inputs are unequal, send both parties the special symbol ⊥.

The functionality F EQ

The functionality F EQ is parameterized by a security parameter λ and a "dictionary" D. It interacts with two parties P i , P j , and an adversary A via the following queries:

Upon receiving a query (NewSession, sid, P i , P j , π) from party P i :

Send (NewSession, sid, P i , P j ) to A. In addition, do the following:

• If this is the first NewSession query, then record (sid, P i , P j , π) and mark this record fresh.

• If this is the second NewSession query and there is a record (sid, P j , P i , π ′ ) which is fresh, then do: if π = π ′ , then set out = 1, otherwise, set out =⊥.

Mark both records completed.

Upon receiving a query (Test, sid, P, π ′ ), P ∈ {P i , P j } from A :

If there is a record of the form (sid, P, * , π) which is fresh, then do: If π = π ′ , mark the record compromised and reply to A with "correct guess". If π ̸ = π ′ , mark the record interrupted and reply to A with "wrong guess".

Upon receiving a query (Output, sid, γ), γ ∈ {1, ⊥} from A :

If there is a record of the form (sid, * , * , π) which is compromised, or one of the parties is corrupted, then set out = γ. If this record is interrupted, then set out =⊥. Otherwise, do nothing.

Upon receiving a query (Deliver, sid, P ), P ∈ {P i , P j } from A :

If there is a record of the form (sid, P, * , π) which is completed, send (deliver, sid, out) to the player P . Ignore all subsequent (Deliver, P ) queries for the same player P . More precisely, F EQ captures a protocol between two parties P i , P j started by having the two parties sending messages to the functionality with their secret strings π i , π j . If the inputs match, the functionality assigns the output to be 1, otherwise it sets the output to be ⊥. Finally, the adversary A instructs the functionality when to send the output to both parties. Thus, this definition corresponds to achieving explicit mutual authentication. We also allow the adversary three special powers. First, we allow him to set the output if one of the parties is corrupted and both the parties have the same input. Furthermore, he controls the delivery of messages to the parties. This is an ability that he inevitably has in the real world. Finally, as in the case of PAKE, the low entropy of the messages in the dictionary D makes online dictionary attacks unavoidable, which is captured by the Test query given to the adversary. The following lemma shows that the

B.3 On the Impossibility of Securely Realizing PAKE

In this section, we show negative results on the achievable security of Password-based Key Exchange protocols when allowed to use quantum communication. We focus on two composability settings: Either a "minimal" simulation-based security following a real world-ideal world paradigm, as defined in [Can00; FS09], or the full universally composable security [START_REF] Canetti | Universally Composable Security: A New Paradigm for Cryptographic Protocols[END_REF][START_REF] Unruh | Universally Composable Quantum Multi-party Computation[END_REF].

Following the literature, we call plain model the setting in which there are no setup assumptions (such as public-key infrastructure (PKI), common reference string (CRS), random oracles (ROM), etc). Following for instance [START_REF] Kushilevitz | Informationtheoretically secure protocols and security under composition[END_REF], in which the authors study the connections between information-theoretic security and security under composition, we consider here the information-theoretic setting, in which the adversary is polynomially unbounded. Informally, the output of a real execution of the protocol with a real adversary must be (perfectly or statistically) the same as the output of an ideal execution with a trusted party and an ideal-world adversary/simulator. On the contrary, in the computational setting, we focus on the notion of everlasting security [MU07; Unr13], which informally means that the adversary is polynomially bounded during the execution of the protocol, and unbounded afterwards. This models an adversary possibly saving transcripts today, in order to potentially use them at the time a quantum computer is built.

B.3.3 Impossibility in the Universally Composability Model

As in the classical case (Canetti et al. prove in [START_REF] Canetti | MacKenzie: Universally Composable Password-Based Key Exchange[END_REF] the impossibility of universally composable PAKE in the plain model), the (im)possibility of PAKE depends on the existence of some setup assumption. As shown by Unruh in [Unr13], the classical notion of passive adversaries (which copy all data) does not make sense in the quantum case. He thus considers only unitary protocols, which perform no measurements (any protocol can be transformed into such a protocol using additional quantum memory). Unruh then defines a functionality F to be quantum-passively-realizable it there exists a unitary protocol that realizes F with respect to passive unlimited adversaries (that follow the protocol exactly and do not even copy information). The following lemma gives examples of quantum-passively-realizable functionalities.

Lemma B.3 ([Unr13, Lemma 8]).

The following functionalities are quantum-passivelyrealizable: F CT (coin-toss), F CRS (common reference string), F EP R (predistributed EPR pair), F P KI (public key infrastructure; assuming that the secret key is uniquely determined by the public key).

We state the following impossibility theorem for PAKE in the UC model.

Theorem B.2.

There is no statistically or everlastingly quantum-UC-secure PAKE protocol with explicit authentication which only uses quantum-passively-realizable functionalities as trusted setup assumptions.

Proof. First note that according to the following lemma, the impossibility of everlasting quantum-UC security implies the impossibility of statistical quantum-UC security.

Lemma B.4 ([Unr13, Lemma 1]). Let π and ρ be protocols. If π statistically quantum-UC-emulates ρ, then π everlastingly quantum-UC-emulates ρ.

In the following, we thus focus on the proof for the everlasting security. Assuming some trusted setup, the following lemma states the impossibility of everlastingly realizing F EQ using only quantum-passively-realizable functionalities.

Lemma B.5.

There is no statistically or everlastingly quantum-UC-secure protocol that realizes F EQ which only uses quantum-passively-realizable functionalities as trusted setup assumptions.

Before proving Lemma B.5, we recall the impossibility of achieving everlastingly quantum-UC-secure oblivious transfer.

Lemma B.6 ([Unr13, Theorem 5]

). There is no statistically or everlastingly quantum-UC-secure OT protocol which only uses quantum-passively-realizable functionalities as trusted setup assumptions.

We use the notion of reductions between MPC functionalities, that allows us to form "classes" of functionalities with similar cryptographic complexity: Following [MPR10], a functionality is said trivial or feasible if it can be realized in the UC framework in the plain model (with no setup assumptions), and it is said complete if it is sufficient for computing arbitrary other functions, under appropriate complexity assumptions, when used as trusted setups. We recall the following results that are proven in [START_REF] Unruh | Universally Composable Quantum Multi-party Computation[END_REF][START_REF] Fehr | Feasibility and Completeness of Cryptographic Tasks in the Quantum World[END_REF]. 1. If a protocol π statistically UC-realizes a functionality F, then π statistically quantum-UC-realizes the functionality F (Quantum lifting theorem).

2. Feasibility in the quantum world is equivalent to classical feasibility, in both the computational and statistical setting.

To show a reduction from F EQ to F OT , we employ the following intermediate results.

Definition B.1 (OT-cores). Let F be a deterministic two-party function, Γ A , Γ B be the input alphabet of two parties, Ω A , Ω B be the output distribution of two parties, and f A , f B be the output values of the two parties. A quadruple (x, x ′ , y, y ′ ) ∈ Γ 2 A × Γ 2 B is an OT-core of F , if the following three conditions are met:

1. f A (x, y) = f A (x, y ′ ).

2. f B (x, y) = f B (x ′ , y).

3. f A (x ′ , y) ̸ = f A (x ′ , y ′ ) or f B (x, y ′ ) ̸ = f B (x ′ , y ′ ) (or both).

In [START_REF] Kraschewski | Completeness Theorems with Constructive Proofs for Finite Deterministic 2-Party Functions[END_REF] the so-called Classification theorem was proven, which shows a necessary and sufficient condition to have a reduction protocol from an ideal functionality F to F OT .

Theorem B.3 (The Classification Theorem [KM11]

). There exists an OT protocol that is statistically secure against passive adversaries in the F-hybrid model, for some F, if and only if F has an OT-core.

Proof of Lemma B.5. We first show that the equality-testing function F EQ admits an OT-core. Consider F EQ := (Γ A , Γ B , Ω A , Ω B , f A , f B ), without loss of generality, assume Γ A = Γ B = Γ. Let c ∈ Γ be a random value drawn from the input distribution, then a quadruple (c, c + 1, c -1, c + 1) is an OT-core of F EQ because: Then the classification theorem (Theorem B.3) tells us that there exists an OT protocol that is statistically secure against passive adversaries in the F EQ -hybrid model. Using the lifting theorem (Lemma B.7), that protocol is also statistically secure against quantum-passive adversaries in the F EQ -hybrid model.

We now prove the lemma by contradiction. Assume that there exists an everlasting quantum-UC-secure protocol π realizing F EQ which only uses quantum-passivelyrealizable functionalities. Let ρ be the protocol resulting from π by replacing invocations to F EQ by invocations to the subprotocol π. Then ρ is an everlasting quantum-UCsecure protocol realizing F OT which only uses quantum-passively-realizable functionalities against quantum-passive adversaries. This contradicts Lemma B.6.

Because of Lemma B.4, the impossibility of statistical security follows immediately from the impossibility of everlasting security.

The proof of Theorem B.2 then follows directly from Lemma B.1 and Lemma B.5.