arXiv CSopen access

On the Cryptographic Structure Required for Verifying Qubits

On the Cryptographic Structure Required for Verifying Qubits Itay Shalit†

James Bartusek*

arXiv:2606.05527v1 [quant-ph] 4 Jun 2026

June 5, 2026 Abstract Classically testing for the presence of anti-commuting operators on a quantum device is a critical tool underpinning recent progress in classical verification of quantum computation. While we can base such tests on certain cryptographic assumptions, known results require highly structured assumptions, e.g. trapdoor claw-free functions. In this work, we seek to explain this state of affairs by constructing strong cryptography from (certain forms of) classical tests of anti-commutation. In particular, we formulate the notion of a “test of non-commutation” (ToNC), which is an interactive protocol between a quantum prover and classical verifier where, in the final round, the prover applies one of two binary observables 𝑃0 , 𝑃1 depending on the verifier’s challenge bit 𝑐. An (𝜖, 𝛿)-ToNC is any such protocol where there exists a quantum strategy that attains 𝜖 advantage in making the verifier accept, but any quantum strategy with commuting 𝑃0 , 𝑃1 can attain at most 𝛿 advantage. We then show the following results. • (𝜖, 𝛿)-ToNC implies (classical-communication) key agreement (KA) for any 𝛿 < 5𝜖−1 4 . • (𝜖, 𝛿)-ToNC plus one-way functions implies (classical-communication) oblivious transfer 2 (OT) for any 𝛿 < 𝜖 2+𝜖 . Along the way, we develop tools for and provide the first known results on hardness amplification for post-quantum KA and OT, where the communication is classical but the adversary may be quantum. In particular, we prove the following results of independent interest. • Post-quantum hard-core measure theorem: For any efficiently sampleable, high minentropy distribution 𝐷 over classical (𝑥, 𝑏) such that quantum circuits have advantage at most 𝛿 in predicting 𝑏 given 𝑥, there exists a sub-distribution 𝑀 ⪯ 𝐷 of density 1 − 𝛿 such that 𝑏 is (nearly) optimally quantum-hard to predict on (𝑥, 𝑏) ← 𝑀 . • Post-quantum interactive XOR lemma: Given any classically-interactive protocol such that quantum adversaries have advantage at most 𝛿 in guessing a private challenger bit 𝑏, repeating sequentially yields a protocol where quantum adversaries have advantage at most 𝛿 2 + negl(𝜆) in guessing the XOR of the two challenger bits 𝑏1 ⊕ 𝑏2 .

* Columbia University. Email: [email protected]. †

Stanford University. Email: [email protected]. Supported by a Shoucheng Zhang Graduate Fellowship.

1

Contents 1

Introduction 3 1.1 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.2 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.3 Open problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2

Technical overview 2.1 Weak BA from ToNC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Weak OT from ToNC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 BA amplification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 OT amplification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3

Preliminaries 19 3.1 Cryptographic primitives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 3.2 Alternating projectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

4

Tests of non-commutation 24 4.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 4.2 Normal form compiler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

5

Weak cryptography from tests of non-commutation 30 5.1 Weak bit agreement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.2 Weak (committed-bit) oblivious transfer . . . . . . . . . . . . . . . . . . . . . . . . . . 32

6

Hardness amplification 6.1 Post-quantum hard-core measure theorem . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Key agreement amplification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Post-quantum interactive XOR lemma . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4 Oblivious transfer amplification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2

11 12 12 14 17

37 37 54 63 67

1

Introduction

The qubit, being the basic unit of quantum information, lies at the foundation of quantum computation and the theory of quantum mechanics itself. While one can define a qubit as a unit vector in C2 , it can alternatively be understood as any pair of anti-commuting binary observables [Vid20]. This idea traces its origins back to the Heisenberg view of quantum mechanics, and is justified by the fact that any pair of anti-commuting binary observables is, up to an isometry, equivalent to the Pauli observables 𝜎𝑋 and 𝜎𝑍 operating on C2 . It turns out that this definition has particularly nice operational properties, as discussed at length in [Vid20]. Verifying qubits. A natural question of importance to the theory of quantum mechanics, and especially so in the early days of quantum information-processing, is whether it is possible to classically test for the presence of a qubit on a purported quantum device. That is, can we validate the existence of anti-commuting operators just by sending classical signals and receiving classical responses? This motivates the following definition of a “qubit test”. Qubit test (informal). A qubit test is a classical interactive protocol between a classical (polynomial-time) verifier and a quantum (polynomial-time) prover, whose description includes two binary observables 𝑃0 , 𝑃1 . In the final round, the verifier sends a challenge 𝑐 ∈ {0, 1}, and the prover returns the bit obtained by applying 𝑃𝑐 to its current state. For any prover that makes the verifier accept with probability greater than some threshold 𝛼, it must be the case that 𝑃0 𝑃1 ≈ −𝑃1 𝑃0 . While qubit tests are of inherent interest as a bridge between the classical and quantum worlds, in recent years they have also played a key role in the construction of several more advanced classical verification protocols. For example, methods developed to test for the presence of qubits underpin certifiable randomness protocols [BCM+ 21], classical verification of general BQP computation [Mah22, NZ23], verifiable remote state preparation (and applications) [GV19, Zha25, Zha23], and computational self-testing (and applications) [MV21, MDCAF21], to name a few. Cryptographic instantiations. By now, the community has developed several constructions of qubit tests. The first result was due to [BCM+ 21], who instantiated them1 from the assumption of learning with errors (LWE), or more generally from trapdoor claw-free functions that satisfy an “adaptive hard-core bit” property. Followup work has diversified and broadened the set of assumptions known to imply qubit tests, yielding constructions from “plain” trapdoor claw-free functions [KMCVY22, BGKM+ 23], quantum fully-homomorphic encryption [KLVY23], cryptographic group actions [AMR22], oblivious state preparation [BK25], and the lattice isomorphism problem (LIP) [BMM25]. However, a common pattern can be identified behind these results. In particular, all instantiations rely on mathematically “structured” assumptions (LWE, group actions, LIP) that imply strong forms of asymmetric cryptography such as (classical-communication) oblivious transfer. In fact, it remains open to construct qubit tests even given some basic forms of asymmetric structure, such as a (plain) trapdoor function. 1

Strictly speaking, this construction does not conform to the qubit test defined above, as the final prover answers are strings instead of single bits.

3

Comparison with proofs of quantumness. This situation can be contrasted with what is known about the relaxed goal of (classically) verifiable proofs of quantumness. Here, the goal is to devise a protocol where quantum provers have a strictly greater advantage than classical provers, but do not guarantee anything beyond the fact that the prover is non-classical. It is known that efficientlyverifiable proofs of quantumness exist in the random oracle model (that is, from a heuristic use of unstructured cryptography) [YZ24] and inefficiently-verifiable proofs of quantumness exist if (and only if) one-way puzzles exist [MSY25], which are believed to be weaker even than one-way functions [KT24, Kre21, MY22]. While proofs of quantumness have relevance to the goal of establishing quantum advantage, they do not appear to serve as a bedrock for obtaining more advanced forms of classical verification. This state of affairs brings into focus a potential dividing line between proofs of quantumness and qubit tests, both in terms of functionality (the methods behind qubit tests appear to have much more powerful applications) and feasibility (proofs of quantumness can be instantiated with hash functions, while qubit tests are only known from structured assumptions). The goal of this work is to gain a more principled understanding of why this line exists. Tests of non-commutation. In fact, we consider a weaker primitive which merely certifies that the prover’s observables do not fully commute, rather than that they approximately anti-commute. We refer to this primitive as a test of non-commutation (ToNC). It differs from a qubit test only in the soundness guarantee: For any quantum polynomial-time prover that succeeds with probability greater than 𝛼, we require that 𝑃0 𝑃1 ̸= 𝑃1 𝑃0 in place of the stronger conclusion that 𝑃0 𝑃1 ≈ − 𝑃1 𝑃0 . We proceed to show that ToNCs imply certain strong forms of cryptography, which establishes the same for full-fledged qubit tests.

1.1

Results

We give constructions of fully-secure oblivious transfer and key agreement protocols with purely classical communication, starting from (even weakly-secure) tests of non-commutation (ToNC). Along the way, we obtain the first post-quantum hardness amplification results for bit agreement (BA) and oblivious transfer (OT), which are of independent interest. Our main novel techniques go into building weakly-secure OT, and amplifying both weakly-secure BA and OT to their fullysecure variants. In order to present these results precisely, we first fix definitions of ToNC, weak bit agreement, and OT. Definitions. We begin by formalizing our notion of ToNC. As discussed above, we consider interactive protocols where the prover’s strategy consists of three parts: a quantum polynomialtime (QPT) interactive machine 𝑃Prep that interacts with a PPT verifier 𝑉 , and two (potentially non-commuting) binary observables 𝑃0 , 𝑃1 . The interactive phase is denoted as |𝜓⟩ , 𝑐, 𝑎* ← ⟨𝑃Prep (1𝜆 ), 𝑉 (1𝜆 )⟩, where |𝜓⟩ is the prover’s final state, 𝑐 ∈ {0, 1} is a challenge bit sent to the prover, and 𝑎* is the “correct” answer bit kept private by the verifier. We then define a (𝜖, 𝛿)-ToNC as satisfying the following properties.2 2

The reader may notice that the verification procedure implicit in this definition is not fully general. Indeed, rather than apply an arbitrary predicate on its state and the prover’s response 𝑎, the verifier simply checks whether 𝑎 = 𝑎* . In fact, in the body we define a ToNC more generally, and then show that any ToNC can be compiled into the form written here (which we call a “normal form” ToNC) while preserving the completeness-soundness gap.

4

• ToNC Completeness: It holds that [︃

|𝜓⟩ , 𝑐, 𝑎* ← ⟨𝑃Prep (1𝜆 ), 𝑉 (1𝜆 )⟩ Pr 𝑎 = 𝑎 : 𝑎 ← 𝑃𝑐 (|𝜓⟩) *

]︃

≥

1 𝜖 + . 2 2

• ToNC Soundness: For any QPT strategy 𝑃̃︀Prep , 𝑃̃︀0 , 𝑃̃︀1 such that 𝑃̃︀0 𝑃̃︀1 = 𝑃̃︀1 𝑃̃︀0 , [︃

|𝜓⟩ , 𝑐, 𝑎* ← ⟨𝑃̃︀Prep (1𝜆 ), 𝑉 (1𝜆 )⟩ Pr 𝑎 = 𝑎 : 𝑎 ← 𝑃̃︀𝑐 (|𝜓⟩)

]︃

*

≤

1 𝛿 + + negl(𝜆). 2 2

It may be useful to keep a running example of a ToNC in mind. Consider the “compiled” CHSH game [KMCVY22, KLVY23]. Here, the (honest) state |𝜓⟩ is a single qubit either in the standard or the Hadamard basis, and the challenge 𝑐 tells the (honest) prover whether to measure it in the 𝑋+𝑍 or 𝑋−𝑍 basis. In the compiled CHSH game, we have 𝜖 = 2 cos2 (𝜋/8)−1 ≈ 0.7, while there are several instantiations under various cryptographic assumptions attaining the soundness bound 𝛿 = 0.5. Next, we consider standard game-based definitions for (weak) bit agreement and (weak) OT. Bit agreement is an interactive protocol that takes place between two parties 𝐴 and 𝐵, denoted as 𝑘𝐴 , 𝑘𝐵 , 𝜏 ← ⟨𝐴(1𝜆 ), 𝐵(1𝜆 )⟩, where 𝑘𝐴 ∈ {0, 1} is 𝐴’s output, 𝑘𝐵 ∈ {0, 1} is 𝐵’s output, and 𝜏 denotes the (classical) transcript of interaction that occurs between 𝐴 and 𝐵. We then define a (𝜖, 𝛿)-BA as satisfying the following properties. • Lack of bias: ⃒ ⃒ ⃒ 1 ⃒⃒ ⃒ Pr [𝑘 = 0]− ⃒ = negl(𝜆), ⃒ ⃒ (𝑘𝐴 ,𝑘𝐵 ,𝜏 )←⟨𝐴(1𝜆 ),𝐵(1𝜆 )⟩ 𝐴 2⃒

⃒ ⃒ ⃒ 1 ⃒⃒ ⃒ Pr [𝑘 = 0]− ⃒ = negl(𝜆), ⃒ ⃒ (𝑘𝐴 ,𝑘𝐵 ,𝜏 )←⟨𝐴(1𝜆 ),𝐵(1𝜆 )⟩ 𝐵 2⃒

• BA Correctness: [𝑘𝐴 = 𝑘𝐵 ] ≥

Pr

(𝑘𝐴 ,𝑘𝐵

,𝜏 )←⟨𝐴(1𝜆 ),𝐵(1𝜆 )⟩

1 𝜖 + − negl(𝜆). 2 2

̃︀ • BA Security: For any QPT adversary 𝐸,

Pr

(𝑘𝐴 ,𝑘𝐵

,𝜏 )←⟨𝐴(1𝜆 ),𝐵(1𝜆 )⟩

[︁

]︁

̃︀ ) = 𝑘𝐴 | 𝑘𝐴 = 𝑘𝐵 ≤ 𝐸(𝜏

1 𝛿 + + negl(𝜆). 2 2

Note that (1, 0)-BA is the fully-secure notion, which we will just call bit agreement, or sometimes key agreement. Finally, (weak) OT is an interactive protocol that takes place between a sender 𝑆 and receiver 𝑅, denoted as (𝑏, 𝑟), (𝑟0 , 𝑟1 ) ← ⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩, where (𝑏, 𝑟) ∈ {0, 1}2 is the output of 𝑅 and (𝑟0 , 𝑟1 ) ∈ {0, 1}2 is the output of 𝑆. We then define a (𝜖, 𝛿, 𝛾)-OT as satisfying the following properties.

5

• OT Correctness: It holds that [︁

Pr 𝑟 = 𝑟𝑏 : (𝑏, 𝑟), (𝑟0 , 𝑟1 ) ← ⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩

]︁

≥

1 𝜖 + − negl(𝜆). 2 2

̃︀ • OT Receiver security: For any QPT adversarial sender 𝑆, [︁

]︁

̃︀ ≤ Pr ̃︀𝑏 = 𝑏 : (𝑏, 𝑟), ̃︀𝑏 ← ⟨𝑅(1𝜆 ), 𝑆⟩

1 𝛾 + + negl(𝜆). 2 2

̃︀ • OT Sender security: For any QPT adversarial receiver 𝑅, [︁

̃︀ 𝑆(1𝜆 )⟩ Pr 𝑟̃︀ = 𝑟0 ⊕ 𝑟1 : 𝑟, ̃︀ (𝑟0 , 𝑟1 ) ← ⟨𝑅,

]︁

≤

1 𝛿 + + negl(𝜆). 2 2

Note that (1, 0, 0)-OT is the fully-secure notion, which we just refer to as OT. Main results: BA and OT from ToNC. We are now in a position to state our main results, establishing that strong forms of cryptography are inherent to tests of non-commutation. In this section, whenever we say ToNC, we always mean normal-form ToNC as defined above, where there is always exactly one correct answer bit (as discussed above). Before stating the theorems, we note that (𝜖, 𝛿)-ToNC is impossible whenever 𝛿 < 𝜖/2. This is because, given any (potentially non-commuting) strategy that attains advantage 𝜖, one can derive a commuting strategy with advantage 𝜖/2, by sampling a random bit 𝑐′ , running the 𝜖-good strategy when 𝑐 = 𝑐′ , and outputting a uniformly random bit when 𝑐 = 1 − 𝑐′ . We first consider an implication to (classical-communication) key agreement, which holds unconditionally. Theorem 1.1. (𝜖, 𝛿)-ToNC implies classical-communication key agreement for any constants 𝜖, 𝛿 such that 𝛿<

5𝜖 − 1 . 4

Moreover, (𝜖, 𝛿)-ToNC with robust completeness3 implies classical-communication key agreement for any non-trivial parameters, i.e., whenever 𝛿 < 𝜖. Due to the nature of our techniques, we establish the above in the presence of adversaries with non-uniform classical advice, but not necessarily non-uniform quantum advice. Next, we build (classical-communication) OT. Here, we make use of (post-quantum) one-way functions in addition to the ToNC. Theorem 1.2. (𝜖, 𝛿)-ToNC plus one-way functions implies classical-communication oblivious transfer for any constants 𝜖, 𝛿 such that 𝜖2 + 𝜖 𝛿< . 2 Here, we actually establish the above in the presence of adversaries with non-uniform quantum advice, but not necessarily non-uniform classical advice.4 3 Robust completeness (Definition 4.4) demands that the honest strategy succeeds with the same probability for any sampling of the preamble, which is a natural property that is satisfied by schemes such as the compiled CHSH and magic square games. 4 Note that the classical advice case does not necessarily follow as a special case of the quantum advice case, and indeed our particular reduction requires the use of quantum advice.

6

1

0.8

𝛿

0.6 Compiled CHSH game

0.4

Compiled magic square game

0.2

0

0

0.2

0.4

0.6 𝜖

0.8

1

Figure 1: Visualization of the parameter regimes captured by Theorem 1.1 and Theorem 1.2. The solid black line is 𝛿 = 𝜖, and the dashed black line is 𝛿 = 𝜖/2, so the region between is the region of parameters where (normal form) ToNC plausibly exists. The dark gray shade denotes the subregion where we show that ToNC implies KA or OT (additionally assuming one-way functions for the latter). The blue curve is the key agreement threshold 𝛿 = (5𝜖 − 1)/4, and the red curve is the oblivious transfer threshold 𝛿 = (𝜖2 + 𝜖)/2. It remains open to show that ToNC in the white region below the solid black line implies KA or OT. However, we note that ToNC with robust completeness and any 𝜖/2 ≤ 𝛿 < 𝜖 implies KA, which is not reflected in the figure above. Checking parameters for our running example of the compiled CHSH game where 𝜖 ≈ 0.7 and 𝛿 = 0.5, we see that 0.5 <

5(0.7) − 1 ≈ 0.63, 4

and

0.5 <

0.72 + 0.7 ≈ 0.6. 2

As another example, one can consider the compiled magic square game [CMM+ 26], which fits our definition of (𝜖, 𝛿)-ToNC with 𝜖 = 1 and 𝛿 = 0.5. These are strictly better parameters than the compiled CHSH game and thus also fall in the range supported by our theorem statements. Post-quantum hardness amplification. Our main results are obtained in two steps: (1) construct weak forms of BA and OT from ToNC, and (2) amplify the hardness of the BA or OT. Even though our protocols utilize only classical communication, the honest parties may be quantum, and the adversaries of course may be quantum as well. Thus, we need post-quantum hardness amplification for BA and OT. While BA and OT amplification enjoys a long history of study in the purely classical setting, to the best of our knowledge there is no prior work that considers post-quantum hardness amplification for BA or OT. We first consider post-quantum BA amplification. Here, the adversarial Eve receives a classical input (the transcript of the protocol) and applies a quantum circuit in an attempt to guess the shared bit. In the purely classical setting, Holenstein [Hol05] gave a tight amplification result,

7

2𝜖 . This is tight establishing that (𝜖, 𝛿)-BA implies fully-secure key agreement whenever 𝛿 < 1+𝜖 2𝜖 since (𝜖, 𝛿)-BA exists unconditionally whenever 𝛿 ≥ 1+𝜖 [Hol05]. This result was derived from a tight hard-core set theorem, improving on that of [Imp95], and stated roughly as follows. Consider any function 𝑓 and predicate 𝑃 such that for any polynomialsize classical circuit, Pr𝑥←{0,1}𝑛 [𝐶(𝑓 (𝑥)) = 𝑃 (𝑥)] ≤ 1 − 2𝛿 . Then there exists a set 𝑆 ⊂ {0, 1}𝑛 of density roughly 𝛿 such that 𝐶 has very close to 1/2 advantage on 𝑥 ← 𝑆. We give a post-quantum analogue of this tight hard-core set theorem. The fact that the predictor is now a quantum predictor requires modifying the proof of the original theorem, as well as slightly modifying the statement. We discuss these changes further in Section 2.3.

Theorem 1.3. (Informal: Post-quantum hard-core measure) Let {𝐷𝜆 }𝜆∈N be any family of distributions over (𝑥, 𝑏) that can be sampled in quantum polynomial time, such that max(𝑥,𝑏) {𝐷𝜆 (𝑥, 𝑏)} = negl(𝜆). If for any polynomial-size quantum circuit 𝑄, Pr

[𝑄(𝑥) = 𝑏] ≤

(𝑥,𝑏)←𝐷𝜆

1 𝛿 + , 2 2

then there exists a measure 𝑀𝜆 ⪯ 𝐷𝜆 of density roughly 1 − 𝛿 such that Pr (𝑥,𝑏)←𝑀𝜆

1 [𝑄(𝑥) = 𝑏] ≈ . 2

By combining our post-quantum hard-core measure theorem with the techniques of [Hol05], we derive tight post-quantum key agreement amplification (the fact that this bound is tight is shown in [Hol05]). Theorem 1.4. For constants 𝜖, 𝛿, post-quantum (𝜖, 𝛿)-BA secure against adversaries with non-uniform classical advice, implies post-quantum (1, 0)-BA if and only if 𝛿<

2𝜖 . 1+𝜖

Next, we consider post-quantum OT amplification. Here, additional complications arise in the post-quantum setting due to the fact that the adversary is interactive, which we discuss in depth in Section 2.4. Our main technique here is a sequential repetition theorem from which our OT amplification results can be derived, which can be seen as a post-quantum analogue of the “interactive XOR lemma” from [HR08, Lemma 3.1]. Informally, the theorem can be stated as follows. Theorem 1.5. (Informal: Post-quantum sequential XOR lemma) Consider any interactive protocol between a (potentially quantum) adversary and a classical challenger who obtains a private bit 𝑏 at the end of interaction. Suppose that any QPT adversary has advantage at most 𝛿 in guessing 𝑏. Then, if we repeat the protocol ℓ times sequentially, no QPT adversary has advantage better than 𝛿 ℓ + negl(𝜆) in guessing ⨁︀ 𝑖∈[ℓ] 𝑏𝑖 , where 𝑏𝑖 is the challenger’s (private) bit obtained in the 𝑖’th repetition. Even given the recent progress on parallel repetition in the (post-)quantum setting [BQSY24, HK25], the above theorem does not follow directly from prior work (see more discussion in Section 1.2). To prove it, we use Marriott-Watrous [MW04] style rewinding arguments to establish a post-quantum analogue of Levin’s isolation lemma [Lev85, GNW11]. Finally, we use our sequential XOR lemma to amplify weak OT to fully-secure OT. For technical reasons, the first half of this amplification process only applies to a specialized form of OT we 8

define called “committed-bit OT” (Definition 3.8), which we build from ToNC. This technique amplifies (𝜖, 𝛿, 0) committed-bit OT to (1, 1/2, 0) committed-bit OT for any 𝛿 < 𝜖2 . The next part follows essentially directly from the sequential XOR lemma, and applies to any OT satisfying the standard game-based definition. That is, we prove the following theorem. Theorem 1.6. For any 𝛿 < 1, post-quantum (1, 𝛿, 0)-OT implies post-quantum (1, 0, 0)-OT. Discussion. Our work is motivated by the apparent gap between the type of cryptography known to be sufficient for qubit tests (and related forms of classical verification) and the type of cryptography sufficient for weaker primitives such as tests of quantumness. Starting with the work of [IR89], cryptographers have studied an often elucidating characterization of cryptographic primitives into two groups: (1) those that exist unconditionally in the random oracle model (sometimes called “minicrypt” primitives), and (2) those that provably do not exist unconditionally in the random oracle model (sometimes called “cryptomania” primitives). While the group (1) primitives can be heuristically instantiated with unstructured cryptography such as hash functions, group (2) primitives seem to require highly structured, e.g. algebraic, forms of cryptographic hardness. While tests of quantumness are known to exist unconditionally in the (quantum) random oracle model [YZ24], and thus exist in group (1), we so far do not know such a result for qubit tests. Our work shows that (at least, in the parameter ranges covered by our theorem statements above) establishing qubit tests as a group (1) or “minicrypt” primitive would also establish classical-communication key agreement and oblivious transfer as minicrypt primitives. This would be a highly surprising result, for the following reasons. First of all, even though the study of (classical-communication) key agreement goes back to the earliest days of modern cryptography [DH76], there have been no candidates proposed from unstructured cryptography. This is partially explained by the result of [IR89], who showed that there is no black-box construction from one-way functions assuming that the honest parties and adversaries make only classical queries to the one-way function. Extending this result to the setting of quantum queries remains an open question, though there has been recent progress towards this goal [ACC+ 22, LLLL25]. In fact, current results suggest that qubit tests may require more structure than even classicalcommunication key agreement. For example, consider that injective trapdoor functions, which are known to imply key agreement, are not known to imply qubit tests. Instead, current constructions of qubit tests utilize two-to-one trapdoor functions, at the very least. This situation can be partially explained by our result establishing that tests of non-commutation plus one-way functions imply oblivious transfer. Indeed, while injective trapdoor functions imply key agreement, they are black-box separated from oblivious transfer [GKM+ 00].5 Thus, if one could build qubit tests from injective trapdoor functions (which trivially also imply one-way functions), this would yield classical-communication OT from injective trapdoor functions, which would be considered a very surprising result.

1.2

Related work

Proofs of quantum memory [HMOY25]. Recently, [HMOY25] introduced the notion of a proof of quantum memory (PoQM), which is a classical-communication protocol that occurs in two stages. After the first stage, there is a one-message challenge from the verifier that is answered by the prover. It has completeness 𝛼 if there exists a prover that can cause the verifier to accept with 5

Again, note that this result only considers honest parties and adversaries that make classical queries to the primitives, and the quantum-query case remains open

9

probability 𝛼, and it has soundness 𝛽 if any prover that maintains only classical memory between stages can cause the verifier to accept with probability at most 𝛽.6 PoQM is, in general, a less structured primitive than ToNC. For example, it is not hard to see that (normal form) (𝜖, 𝛿)-ToNC implies PoQM with completeness 12 + 2𝜖 and soundness 21 + 2𝛿 , as well as “extraction probability” 12 + 2𝜖 , which refers to the probability that the verifier can predict the prover’s final message. Moreover, [HMOY25] establish that PoQM with (1) extraction probability 1 − 1/poly and, (2) a 1/poly gap between completeness and soundness, implies (fully-secure) classical-communication key agreement. Thus, our result that (1, 𝛿)-ToNC implies KA for any 𝛿 < 1 can also be achieved by an alternate route that goes through PoQM. However, the majority of our results do not follow from [HMOY25]. This includes our constructions of KA from (𝜖, 𝛿)-ToNC for any setting of 𝜖 < 1 (covering important examples such as the compiled CHSH game), as well as all of our constructions of OT from ToNC (plus one-way functions), explaining the lack of approaches to building ToNC from weaker forms of asymmetric cryptography such as plain trapdoor functions. Oblivious state preparation [BK25]. Recently, [BK25] introduced the notion of oblivious state preparation (OSP), which is a classical-communication protocol that allows a client to prepare a BB84 quantum state in the server’s memory in such a manner that the server has negligible advantage in determining whether it is in the standard or Hadamard basis. They show that OSP implies both (classical-communication) key agreement and OT.7 OSP is a stronger primitive than ToNC: While OSP is known to imply (2 cos2 (𝜋/8) − 1, 0.5)ToNC [BK25] by compiling the CHSH game, the reverse direction is not known. Whether we can obtain (some form of) OSP from ToNC is an interesting question, though appears somewhat difficult. Foundations of interactive quantum advantage [TZ25]. In another recent work, [TZ25] study the cryptographic implications of verifiable quantum advantage. Their result most relevant to this work establishes that there is no construction of constant-round interactive quantum advantage from the black-box use of indistinguishability obfuscation and one-way permutations. Since constant-round (𝜖, 𝛿)-ToNC immediately implies constant-round quantum advantage for any 𝛿 < 𝜖, this establishes the same for any non-trivial constant-round ToNC. Our results differ from theirs in the following ways: • Our cryptographic implications of ToNC apply to ToNC with any number of rounds, and are not limited to black-box constructions of ToNC. • Our results give evidence that ToNC cannot be constructed from random oracles, while [TZ25]’s results do not rule out the possibility that ToNC can be constructed from collisionresistant hashing (which exists in the random oracle model). (Post-)quantum parallel repetition [BQSY24, HK25]. A couple of recent works have ushered in the study of hardness amplification in the post-quantum and quantum settings, in particular when protocols are parallel repeated. However, as we discuss further in Section 2, these results do not have implications to post-quantum key agreement and oblivious transfer amplification, for the following reasons. [HK25] focus primarily on public-coin arguments, where the job of the adversary 6

They also consider a more general variant, where there is a number of qubits of memory that suffice for completeness, and a fewer number of qubits for which the soundness bound holds. 7 In fact, they require one-way functions as well to obtain the notion of OT that we consider in this paper.

10

is to convince the verifier to accept, as opposed to guess a hidden bit known to a private-coin challenger. While they do have a private-coin result, it is limited to three-message protocols. [BQSY24] focus on three-message, quantum-communication protocols (they also have a round-compression theorem for quantum-communication arguments, but this does not apply to classical-communication protocols). While they do derive a quantum analogue of Yao’s XOR lemma, it does not apply to the classically-interactive private-coin setting that we require for OT amplification.

1.3

Open problems

Our work motivates several directions for future research, which we outline here. 1. Can we tighten our implications from ToNC to key agreement and OT? For example, there exists a region of 𝛿 < 𝜖 for which we don’t know how to derive OT from (𝜖, 𝛿)-ToNC. Moreover, can we hope to remove the reliance on one-way functions and establish OT from ToNC unconditionally? 2. As mentioned earlier, our BA amplification techniques only apply to adversaries with nonuniform classical advice, while our OT amplification techniques only apply to adversaries with non-uniform quantum advice. Can we give post-quantum BA and OT amplification for both types of advice? Can we give post-quantum BA and OT amplification in the uniform setting? 3. Can we continue to improve our understanding of the relationships between PoQM, ToNC, OSP, and OT? For example, does some variant of ToNC imply OSP? Does OT imply ToNC, or is there a separation? One current gap between what is known about OT vs. ToNC is the fact that trapdoor permutations are known to imply OT, but not known to imply ToNC. 4. In this work, we consider ToNC where the prover’s final-round strategy consists of binaryoutcome observables. While this is a natural setting, one could consider a more general type of protocol where the prover’s final-round strategy outputs a string of bits as opposed to a single bit. In fact, this is the setting considered by the original qubit test protocol of [BCM+ 21]. Can we show cryptographic implications from such multi-bit answer ToNCs? 5. As we are the first to study post-quantum hardness amplification for key agreement and OT, several questions remain. For example, can we derive more general amplification results for OT? Such results would presumably extend the parameter regime in which our construction of OT from ToNC remains valid. Additionally, are there other applications of our postquantum hard-core measure theorem or post-quantum interactive XOR lemma?

2

Technical overview

In this overview, we will first cover our constructions of weak bit agreement (BA) and weak oblivious transfer (OT) from tests of non-commutation (ToNC), and proceed to discuss our postquantum hardness amplification techniques. Normal-form ToNC. Recall from the previous section that we work with a notion that we call “normal-form” ToNC. In such a ToNC, the interaction between quantum prover and classical verifier always reaches a final stage where the prover receives a challenge bit 𝑐 and the verifier obtains a (private) answer bit 𝑎* . The prover then applies one of two binary observables 𝑃0 or 𝑃1 to its state 11

|𝜓⟩, depending on the choice of 𝑐, to obtain an answer 𝑎. We say that the prover has 𝜖 advantage if Pr[𝑎 = 𝑎* ] = 12 + 2𝜖 . In Section 4.2, we show that a more-general variant of ToNC (where the verifier may sometimes accept both or neither possible answers) can be compiled into normal-form ToNC with the same completeness-soundness gap. Hence, in the remainder of this section, we will focus on building cryptography from normal-form ToNC.

2.1

Weak BA from ToNC

It turns out that (normal-form) ToNC can essentially already be seen as a weak bit agreement between prover and verifier. Indeed, suppose that the prover computes 𝑎 but keeps it private. Then we have that the prover and verifier agree on a bit 𝑎 = 𝑎* with advantage 𝜖. Now consider an eavesdropper 𝐸 who may observe the (classical) transcript 𝜏 of interaction between the prover and verifier, and suppose that they are able to guess the value of 𝑎* with advantage 𝛾 (meaning probability 12 + 𝛾2 ). Since the transcript 𝜏 is disjoint from the prover’s state |𝜓⟩, such an 𝐸 can be used to derive a commuting strategy with advantage 𝜖+𝛾 2 . In particular, consider a prover that, prior to seeing the final challenge bit 𝑐, flips a random coin 𝑏 ← {0, 1}. If 𝑏 = 𝑐, it runs the honest prover strategy on its final state |𝜓⟩ while if 𝑏 = 1 − 𝑐, it runs 𝐸 on the classical transcript of the protocol. Such a prover is commuting by inspection and has advantage exactly 𝜖+𝛾 2 . Now, suppose we start with a (𝜖, 𝛿)-ToNC according to the definition provided in the previous section (and formally in Definition 4.1 and Definition 4.2). Then we obtain a bit agreement protocol with correctness advantage 𝜖, and where any 𝐸 has advantage at most 2𝛿 − 𝜖 in guessing the verifier’s bit (call her Alice). Due to technical reasons in the ensuing bit agreement amplification, we care in particular about 𝐸’s advantage conditioned on Alice and Bob outputting the same bit. Thus, the best conditional advantage bound we can derive comes out to 𝛿′ =

1 + 4𝛿 − 3𝜖 , 1+𝜖

yielding a (𝜖, 𝛿 ′ )-BA protocol for such 𝛿 ′ according to the definition given in the previous section (and formally in Definition 3.5). The formal protocol and analysis are given in Section 5.1.

2.2

Weak OT from ToNC

Next, we discuss our construction of weak OT from ToNC. Building OT presents several complications that did not arise in the construction of BA. For instance, the adversary actively participates (potentially maliciously) in the protocol. Moreover, to prepare for our OT amplification step, we will actually build a stronger notion of OT than what was presented in the previous section, which we call committed-bit OT. Skeleton protocol. In this overview, we give a sense of the core of our idea by presenting a bare-bones OT protocol that works only if several conditions are satisfied. In the body, we utilize techniques such as cryptographic commitments (which introduces an additional assumption of one-way functions), cut-and-choose, and random-termination to “compile” the skeleton protocol into a full-fledged committed-bit OT. However, the main intuition can be appreciated with the following skeleton, which uses a (normal-form) (𝜖, 𝛿)-ToNC.

12

• Let the OT sender be the verifier and the OT receiver be the prover in two runs of the ToNC. That is, run |𝜓0 ⟩ , 𝑐0 , 𝑎*0 ← ⟨𝑃Prep (1𝜆 ), 𝑉Prep (1𝜆 )⟩,

|𝜓1 ⟩ , 𝑐1 , 𝑎*1 ← ⟨𝑃Prep (1𝜆 ), 𝑉Prep (1𝜆 )⟩.

However, the sender (verifier) does not send (𝑐0 , 𝑐1 ) to the receiver (prover) yet. • The receiver samples 𝑐𝑅,0 , 𝑐𝑅,1 ← {0, 1} and computes answers 𝑎𝑅,0 ← 𝑃𝑐𝑅,0 (|𝜓0 ⟩),

𝑎𝑅,1 ← 𝑃𝑐𝑅,1 (|𝜓1 ⟩).

• The receiver sends 𝑐𝑅,0 ⊕ 𝑐𝑅,1 and the protocol only continues if 𝑐𝑅,0 ⊕ 𝑐𝑅,1 ̸= 𝑐0 ⊕ 𝑐1 . In this case, the sender sends 𝑐0 , 𝑐1 to the receiver and outputs 𝑟0 = 𝑎*0 and 𝑟1 = 𝑎*1 as its OT bits. • The receiver sets 𝑏 to be the unique bit such that 𝑐𝑅,𝑏 = 𝑐𝑏 , and sets 𝑟 = 𝑎𝑅,𝑏 . First, note that if the receiver uses the honest prover strategy, then 𝑟 = 𝑟𝑏 with advantage 𝜖, as in this case the challenge 𝑐𝑅,𝑏 it used to produce 𝑎𝑅,𝑏 was the same as the verifier’s challenge 𝑐𝑏 . Next, note that receiver security is optimal: The sender learns nothing about the receiver’s bit 𝑏 since it learns 𝑐𝑅,0 ⊕ 𝑐𝑅,1 but neither bit individually. Finally, it remains to prove a bound on the advantage that the (potentially adversarial) receiver has in guessing 𝑟1−𝑏 . Enforcing good behavior. We say that an adversarial receiver is “well-behaved” if (1) its advantage in guessing 𝑎𝑅,𝑏 = 𝑎*𝑏 is indeed (roughly) 𝜖, (2) 𝑐𝑅,0 , 𝑐𝑅,1 are chosen uniformly at random, and (3) it honestly reports the value of 𝑐𝑅,0 ⊕ 𝑐𝑅,1 . In the full protocol, we enforce that the receiver is well-behaved by using a coin-flipping protocol to sample 𝑐𝑅,0 , 𝑐𝑅,1 , having the receiver commit to its challenges 𝑐𝑅,0 , 𝑐𝑅,1 , 𝑐𝑅,0 ⊕ 𝑐𝑅,1 and answers 𝑎𝑅,0 , 𝑎𝑅,1 , and running a cut-and-choose plus random-termination strategy that repeats the protocol and requires them to open all but one of these sets of commitments. Reduction to ToNC. Now, we argue that any well-behaved receiver with advantage 𝛾 in guessing 𝑟1−𝑏 implies a commuting prover strategy in the ToNC with advantage roughly 𝜖+𝛾 2 . To see this, ̃︀ ̃︀ consider a prover 𝑃 that utilizes the well-behaved receiver as follows. 𝑃 simulates the receiver’s interaction with the sender in two ToNC executions except that it performs the verifier itself in one of them, and forwards messages to its own verifier in the other. Which one is forwarded to the “real” verifier will be chosen uniformly at random, but for the sake of discussion let’s say protocol 0 is forwarded and protocol 1 is simulated in 𝑃̃︀ ’s head. Condition on 𝑐𝑅,0 ⊕ 𝑐𝑅,1 ̸= 𝑐0 ⊕ 𝑐1 and let 𝑏 be such that 𝑐𝑅,𝑏 = 𝑐𝑏 . If 𝑏 = 0, then we know the receiver’s answer 𝑎𝑅,𝑏 will yield advantage 𝜖 in predicting the verifier’s bit 𝑎* , so 𝑃̃︀ will return 𝑎𝑅,𝑏 to its verifier. Otherwise, if 𝑏 = 1, then we know that the receiver’s guess for 𝑟𝑏−1 = 𝑟0 has advantage 𝛾 in predicting the verifier’s bit 𝑎* , so 𝑃̃︀ will return its guess for 𝑟𝑏−1 instead. Since 𝑐𝑅,0 , 𝑐𝑅,1 are random, and we randomize the choice of which of the two protocols are forwarded to the verifier, both cases happen with probability exactly 1/2, yielding an overall advantage of 𝜖+𝛾 𝜖+𝛾 2 . By soundness of the ToNC, we have that 2 < 𝛿, and thus 𝛾 < 2𝛿 − 𝜖.

13

Using non-uniformity. This is the main idea that underlies our result that (𝜖, 𝛿)-ToNC implies (𝜖, 2𝛿 − 𝜖, 0) (committed-bit) OT. However, before moving on, we point out one complication that arises in the above strategy. On the one hand, 𝑃̃︀ actually has to learn the values 𝑐𝑅,0 , 𝑐𝑅,1 , 𝑎𝑅,0 , 𝑎𝑅,1 used by the adversarial receiver in the OT protocol, but on the other hand, these cannot be revealed in the transcript as they may leak the receiver’s choice bit. To remedy this, we have the receiver commit to these values and then have 𝑃̃︀ extract them in the reduction. As we use only one-way functions for the commitment, this extraction procedure is not efficient. However, it turns out that we can push all of the inefficiency required to before the beginning of the ToNC protocol, and have 𝑃̃︀ make use of non-uniformity to perform an inefficient operation before the beginning of the protocol. Thus, our final result is actually that (𝜖, 𝛿)-ToNC secure against adversaries with non-uniform (potentially quantum) advice implies (𝜖, 2𝛿 − 𝜖, 0) (committed-bit) OT. The formal protocol and analysis are given in Section 5.2.

2.3

BA amplification

In the remainder of the paper, we prove amplification theorems for BA and OT in the postquantum setting. That is, we address the setting where adversaries and the communicating parties are quantum (rather than classical) polynomial-time machines. Due to structural differences between BA and OT, we were compelled to take different amplification routes for each. We begin by describing at a high level how we amplify weak BA into full-fledged key agreement, presented in Section 6.1 and Section 6.2. The classical setting. Our starting point is Holenstein’s tight classical amplification theorem [Hol05], which characterizes exactly when weakly-secure BA can be amplified to fully-secure key agreement. We briefly recall the classical approach and then explain the modifications needed in our (post-quantum) setting. Secure random variables. Following Holenstein, we consider the notion of an information-theoretically secure weak BA, where a single execution produces correlated bits (𝑋, 𝑌 ) for Alice and Bob, together with side information 𝑍 held by Eve – namely, the transcript. One says that (𝑋, 𝑌, 𝑍) is an (𝜖, 𝛿)-secure random variable if (i) 𝑋 and 𝑌 are unbiased, (ii) Pr[𝑋 = 𝑌 ] ≥ 21 + 2𝜖 , and (iii) there exists an event 𝐸 that implies 𝑋 = 𝑌 such that Pr[𝐸 | 𝑋 = 𝑌 ] ≥ 𝛿 and 𝐼(𝑋; 𝑍 | 𝐸) = 0. That is, conditioned on 𝐸, Eve’s view gives no information about the shared bit. Definition 6.10 formalizes this notion. An information-theoretic amplification protocol. Given ℓ independent (𝜖, 𝛿)-secure random variables, Holenstein gives an efficient protocol that compiles them into a perfect (up to negligible factors) secure random variable – and hence fully-secure key agreement, assuming the following condition on (𝜖, 𝛿) holds: 1−𝜖 𝛿> . 1+𝜖 It is now left to show that applying such a compilation protocol to multiple independent computationally-secure weak BA instances results in a fully-secure BA instance. To do so, Holenstein proves a variant of Impagliazzo’s hard-core set lemma against non-uniform classical circuits, with improved parameters [Hol05, Lemma 2.1]. Let us state it in terms of bit agreement for the sake of discussion.

14

Hard-core set lemma. Fix some arbitrarily small constant 𝛾 > 0, and suppose that any adversarial circuit of size 𝑠 given the communication transcript can succeed in guessing the output bit (conditioned on the parties agreeing on the same bit) with probability at most 1 − 𝛿/2. Then, there exists a set 𝑆 of transcripts whose total mass depends on 𝛿, 𝑠, such that when sampling a weak BA instance from 𝑆, all circuits of size somewhat smaller than 𝑠 succeed in guessing the agreed bit (conditioned on agreement) with probability at most 1+𝛾 2 . Amplification in the (classical) computational security setting. exactly as in the information-theoretic case.

The amplified protocol works

1. The parties perform ℓ(𝜆) = poly(𝜆) independent instances of the weak computationallysecure BA protocol, producing pairs of bits (𝑥𝑖 , 𝑦𝑖 )𝑖=1,...,ℓ . 2. They run the compilation protocol on (𝑥𝑖 , 𝑦𝑖 )𝑖=1,...,ℓ , producing final output bits 𝑘𝐴 , 𝑘𝐵 . Using the hard-core set lemma, one proves that any potential adversary attempting to break the amplified protocol over weak computationally-secure BA instances, cannot do significantly better than it would on a series of information theoretic (𝜖, 𝛿)-secure random variables. Indeed, given a hard-core set 𝑆, define the event 𝐸 to be "the transcript corresponds to 𝑥 ∈ 𝑆 and the parties output the same bit". Conditioned on 𝐸, the weak BA transcript 𝑧 carries essentially no efficiently-computable information about the shared bit 𝑥 = 𝑦, so for the computationallybounded adversary, the triplet (𝑥, 𝑦, 𝑧) is indistinguishable from an information-theoretically secure (𝜖, 𝛿sec )-secure random variable, with 𝛿sec ≈ Pr[𝐸 | 𝑋 = 𝑌 ]. The proof is completed using an appropriate hybrid argument. Moving to the quantum setting. It turns out that given an appropriate post-quantum analogue of the hard-core set lemma, the BA amplification works using an argument similar to that described above. So we will focus on the hard-core set lemma itself. In particular, our goal is to re-prove it in the setting where the adversary can apply a quantum circuit rather than a classical circuit. The approach laid out by [Hol05, HS11] for proving the hard-core set lemma in the classical setting, consists of two main steps. • A hard set for each predictor. Assume that no efficient adversary can guess the output bit of the protocol from the communication transcript with probability better than 1 − 𝛿/2, conditioned on agreement. Then for any fixed predictor 𝑄 and any slack 𝛾 ∈ (0, 𝛿), there is a set of transcripts of mass at least 𝛿 − 𝛾 on which 𝑄 has essentially no advantage, i.e. its success is at most 1/2 + 𝛾/2. • Per-set predictors ⇒ one universal predictor. Now suppose that for every large set there exists some adversary of size 𝑠 that computes the output bit with noticeable advantage 𝛾 on that measure. Then one can “fix” the predictor: There exists a single predictor (with a moderate size blowup) that achieves advantage better than 𝛾/2 simultaneously on all sets of mass at least 𝛿. This contradicts the previous item. Together, these two components imply the existence of a hard-core set on which all predictors of size 𝑠 have advantage close to 1/2. The key component in the proof of the second step is von Neumann’s minimax theorem, which translates to the setting of quantum circuits without requiring significant adaptations. In what follows, we describe how we adapt the proof of the first step in some more detail. 15

A hard measure for any quantum predictor. Fix a deterministic predicate 𝑃 : {0, 1}𝑛 → {0, 1} and any randomized classical circuit 𝐶(𝑥, 𝑏) that is intended to output 1 when 𝑏 = 𝑃 (𝑥) and 0 otherwise. Theorem 3 in [HS11] (which is similar in spirit to Lemma 2.4 from [Hol05]) shows that one can decompose the input space relative to this particular 𝐶 into a large “hard” subset of the domain 𝑆 ⊆ {0, 1}𝑛 of probability mass 𝛿 and its complement. That is, on 𝑆, 𝐶’s acceptance probability is essentially insensitive to whether 𝑏 = 𝑃 (𝑥) or 𝑏 = 1 − 𝑃 (𝑥), meaning that flipping 𝑃 on 𝑆 is nearly indistinguishable to 𝐶. Moreover, one can convert 𝐶 into an explicit predictor 𝑄 that recovers 𝑃 (𝑥) with an overall success at least 1 − 𝛿/2 on the entire domain. In the classical hard-core set proof, the first component is a statement of the form: given a fixed predictor 𝐴, there exists a large region on which 𝐴 has only tiny advantage. The above decomposition can be used as an alternative route to such a statement, as follows. Define a distinguisher 𝐶𝐴 (𝑥, 𝑏) that outputs 1 iff 𝐴(𝑥) = 𝑏. Applying the decomposition to 𝐶𝐴 yields a set 𝑆 where 𝐶𝐴 cannot reliably distinguish 𝑏 = 𝑃 (𝑥) from 𝑏 = 1 − 𝑃 (𝑥), which exactly means that on 𝑥 ← 𝑆, the predictor 𝐴 has success close to 1/2. Moreover, under the assumed global hardness parameter 𝛿 (namely, no predictor can achieve success ≥ 1 − 𝛿/2 overall), the theorem’s predictor 𝑄 forces the extracted set 𝑆 to have density at least about 𝛿 – otherwise 𝑄 would contradict hardness. Our Theorem 6.1 is a generalization of Theorem 3 in [HS11], which differs in several respects: • Quantum circuits. We allow the distinguisher 𝐶 to be a quantum circuit, and thus the resulting predictor 𝑄 is quantum. • Arbitrary input distributions. Rather than working only with the uniform distribution over {0, 1}𝑛 , we formulate the statement with respect to an arbitrary distribution 𝒟 over inputs. This enables applying the theorem to the case of bit agreement protocols, where the distribution over communication transcripts is typically not uniform. We note that in the classical case, one can often utilize the uniform distribution over the participant’s random coins, thus avoiding the necessity of generalizing the distribution. However, this is not possible if the participants are quantum. • A hard measure rather than a hard set. As a consequence of allowing a quantum distinguisher 𝐶, we construct a quantum predictor which maps a pair (𝑥, 𝑃 (𝑥)) probabilistically to a bit. Since the predictor is non-deterministic, it does not immediately give rise to a hard subset. Instead, its prediction statistics constitute a sub-distribution measure of 𝒟 that designates the portion of the domain on which 𝐶 is insensitive to flipping 𝑃 . The measure is explicitly constructed in Corollary 6.3. The measure vs. set discrepancy comes from the fact that the proof in [HS11] relies on derandomizing the distinguisher 𝐶 through fixing a set 𝑅 of random seeds. Evaluations of 𝐶(𝑥, 𝑟) on any 𝑟 ∈ 𝑅 are used to compute a criterion which determines whether 𝑥 ∈ 𝑆—thus 𝑆 becomes a deterministic set. This perspective breaks down in the quantum setting, where the distinguisher’s behavior is inherently probabilistic and cannot be derandomized in the same manner. Instead, the hard region is represented by a weight function 𝑤(𝑥) ∈ [0, 1] derived from the prediction statistics of the quantum distinguisher, yielding a sub-distribution 𝑀 ⪯ 𝐷. Consequently, the remainder of the amplification argument is reformulated so that Holenstein’s hard-core-set reasoning continues to hold when the hard object is a weighted measure rather than a deterministic subset.8 A further subtlety is that the weak-BA distribution is not necessarily a deterministic predicate. After conditioning on the two parties agreeing on the same bit, we obtain a distribution over 8 As mentioned before, [Hol05]’s proof also relied on a randomness fixing argument, though we found [HS11]’s approach easier to adapt to the quantum setting while maintaining optimal parameters.

16

transcript/bit pairs (𝑍, 𝑋). To apply a predicate-style hard-core theorem, we lift the domain to (𝑍, 𝑏0 ), where 𝑏0 is the agreed-upon bit, and define the deterministic predicate 𝑃 (𝑍, 𝑏0 ) = 𝑏0 . Given a transcript predictor 𝐶(𝑍), we form a distinguisher 𝐶((𝑍, 𝑏0 ), 𝑏) that ignores 𝑏0 and checks whether 𝐶(𝑍) = 𝑏. The obliviousness of the predictor returned by our decomposition theorem is essential for using weak BA security to prove a hard-core measure: if the hard-core measure has too little mass, the resulting predictor on the lifted domain collapses back to a predictor of 𝑋 from 𝑍, contradicting weak-BA security. Lemma 6.6 establishes the minimax fixing step needed for the hard-core measure theorem, which appears as Theorem 6.7. Theorem 6.13 establishes the generic amplification statement with a hybrid argument, and Theorem 6.9 states that the amplifiable parameter range in the quantum setting is identical to Holenstein’s tight result in the classical setting.

2.4

OT amplification

Finally, we discuss our approach to post-quantum OT amplification, which requires a new set of techniques, presented in Section 6.3 and Section 6.4. New challenges. The fundamental differences with BA amplification stem from the fact that the adversary participates in the protocol itself. That is, one must consider the “input” of the weakly hard distinguishing problem to be the quantum state produced at the end of the protocol, as opposed to just the classical transcript. Moreover, as we allow the adversary to be malicious,9 it may influence the generation of this (transcript, state) pair. While hard-core set theorems have been applied successfully to obtain (semi-honest)10 OT amplification in the purely classical setting [Wul07], the fact that we must consider quantum inputs now prevents us from applying the techniques from last section.11 Instead, we prove a novel postquantum XOR lemma that applies to classical-communication interactive protocols, and put it to work to obtain our OT amplification results. Interactive XOR lemma. The interactive XOR lemma can be motivated by considering the following desired form of OT amplification. Suppose we have a (1, 𝛿, 0)-OT protocol (according to the definition given in Section 1.1 and formally in Definition 3.6) for some constant 𝛿 < 1, and our goal is to obtain fully-secure OT, i.e. (1,0,0)-OT. A natural idea is to repeat the protocol 𝜆 times sequentially, instructing the sender to XOR together their bits across runs. That is, letting {𝑟𝑖,0 , 𝑟𝑖,1 }𝑖∈[𝜆] be the set of sender bits obtained from the 𝜆 repetitions, we know that any adversarial receiver has 𝛿 advantage in guessing each 𝑟𝑖,0 ⊕ 𝑟𝑖,1 , and it is natural to conjecture that any ⨁︀ adversarial receiver thus has 𝛿 𝜆 = negl(𝜆) advantage in guessing 𝑖∈[𝜆] 𝑟𝑖,0 ⊕ 𝑟𝑖,1 . Crucially, note that we are not asking that the receiver make a guess for each 𝑟𝑖,0 ⊕ 𝑟𝑖,1 directly after the 𝑖’th repetition of the protocol (in which case it would be trivial to show that all guesses are correct 9 One might wonder about the possibility of post-quantum semi-honest OT amplification, where both the honest and adversarial participants are quantum but the communication is classical. This appears to be a bit tricky to reason about; in particular, the accepted model of quantum semi-honest adversaries allow them to purify their actions in the protocol [DNS10], resulting in an interaction that now involves quantum communication. We believe that several of the non-trivialities involved in the setting of malicious post-quantum amplification would also arise in any reasonable semi-honest quantum model, and thus we focus on the malicious case. 10 In the classical setting, semi-honest amplification is sufficient, since maliciously-secure OT follows generically from semi-honest OT [GMW87, Kil88]. No such semi-honest to malicious compiler is known in the quantum setting. 11 One might wonder about the possibility of obtaining some analogue of a hard-core measure for distributions over quantum states, but we leave this possibility to future work (and indeed, are not convinced that reasonable formulations of this statement are possible).

17

with probability at most 𝛿 𝜆 ), but are rather asking that they guess a single bit at the end of all 𝜆 repetitions. A useful abstraction of this setting can be phrased as follows. Suppose we have a protocol Γ that takes place between a (potentially quantum) adversary 𝐴 and a classical verifier 𝑉 , who obtains an output 𝑏 ∈ {0, 1} at the end of the protocol. Let 𝛿 be the maximum advantage that any 𝐴 can obtain in guessing the verifier’s output 𝑏. Then, if we sequentially repeat the protocol twice, letting 𝑏1 and 𝑏2 denote the two verifier outputs, the maximum advantage that any 𝐴 can obtain in guessing 𝑏1 ⊕ 𝑏2 is 𝛿 2 + negl(𝜆). Note that in the full statement (Theorem 6.16), we allow for different protocols Γ1 , Γ2 with different advantage bounds 𝛿1 , 𝛿2 . In fact, this is precisely the post-quantum analogue of a classical claim due to Halevi and Rabin [HR08, Lemma 3.1], which itself is an interactive analogue of Levin’s Isolation Lemma [Lev85], as stated in [GNW11]. Unfortunately, the classical proof makes heavy use of rewinding, which is non-trivial and sometimes impossible in the quantum setting. However, the core rewinding idea has been adapted to the quantum setting in a recent work of [BQSY24], though we note that their theorems do not directly apply to our setting as they are stated for three-message parallelrepeated quantum-communication protocols. We proceed to give an overview of our proof technique, which is somewhat related to [BQSY24], but ultimately different and self-contained. Proof technique. For convenience, let’s move to the {+1, −1} basis for classical bits, and suppose that the adversary’s output is 𝑏𝐴 ∈ {+1, −1}, while the two verifier outputs are 𝑏1 , 𝑏2 ∈ {+1, −1}. Then, for contradiction, we assume the existence of an adversary 𝐴 such that E[𝑏𝐴 · 𝑏1 · 𝑏2 ] > 𝛿 2 . Rearranging, we have that E[𝑏1 · E[𝑏𝐴 · 𝑏2 | |𝜓⟩]] > 𝛿

2

𝑏𝐴 · 𝑏2 ⃒⃒ E 𝑏1 · E ⃒ |𝜓⟩ 𝛿 [︂

⇒

[︂

⃒

]︂]︂

> 𝛿,

where |𝜓⟩ is the intermediate state that 𝐴 has between the executions of Γ1 and Γ2 . By security of Γ2 we know that for any such |𝜓⟩, it holds that −𝛿 ≤ E[𝑏𝐴 · 𝑏2 | |𝜓⟩] ≤ 𝛿. This suggests the following strategy for breaking security of the first protocol: 1. Run the first stage of 𝐴 until it finishes interacting with Γ1 and produces state |𝜓⟩. 2. Use |𝜓⟩ to obtain a real number 𝛼 ∈ [−𝛿, 𝛿] whose expectation is distributed identically to E[𝑏𝐴 · 𝑏2 ]. 3. Output 𝑏𝐴 ∈ {1, −1} sampled as a Bernoulli random variable which takes the value 1 with probability 12 ( 𝛼𝛿 + 1). The only step that is potentially problematic in the quantum setting is (2). Indeed, in the classical setting, this is accomplished by repeatedly simulating executions with Γ2 and estimating the probability of success. Note that it does not suffice to run a single execution, as this would output a value in {+1, −1} which has the correct expectation but is not within the range [−𝛿, 𝛿] required to get step (3) to work. Fortunately, Marriott-Watrous [MW04] style rewinding applied to |𝜓⟩ allows us to implement step (2). Indeed, alternating the projector Π0 corresponding to initializing the verifier for Γ2 and 18

the projector Π1 corresponding to running the interaction and checking whether 𝑏𝐴 = 𝑏2 allows us to (approximately) sample from a distribution with the correct expectation and the correct support. However, to prove that the distribution is supported on [−𝛿, 𝛿], we must actually assume that Γ2 is secure against adversaries with non-uniform quantum advice. In particular, this guarantees that the eigenvalues of Π0 Π1 Π0 all fall in the range [−𝛿, 𝛿]. Indeed, Marriott-Watrous (approximately) samples from a distribution supported only on eigenvalues, and thus the output 𝛼 will be in [−𝛿, 𝛿] (with high probability). Completing OT amplification. Recursively applying the interactive XOR lemma allows us to prove our motivating example, that (1, 𝛿, 0)-OT implies (1, 0, 0)-OT for any 𝛿 < 1.12 While this result is already of inherent interest, it does not suffice to complete our desired implications from ToNC. In particular, if the ToNC does not have completeness 1 (e.g. the compiled CHSH game), then we obtain some (𝜖, 𝛿, 0) for both 𝜖 < 1 and 𝛿 < 1. To boost correctness of (𝜖, 𝛿, 0)-OT, we adapt an approach of [Wul07] establishing that for any 𝛿 < 𝜖2 , classical semi-honest (𝜖, 𝛿, 0)-OT implies classical semi-honest (1, 𝛿 ′ , 0)-OT for some 𝛿 ′ < 1. The approach involves two steps: 1. Boost security by applying a sequential XOR lemma (which also brings correctness down with it). We already have the tool for analyzing this. 2. Boost correctness by repeating the protocol several times with the same input bits from each party. In step (2), it is imperative for security that the receiver indeed uses the same choice bit 𝑏 in each execution. While this holds by definition in the classical semi-honest model, we have to somehow enforce that our quantum malicious receiver exhibits this behavior. To do so, we rely on another layer of cut-and-choose, utilizing the fact that our weak OT protocol is in fact a “committed-bit” OT. This means that after the protocol has completed, the receiver can open the interaction to its choice bit 𝑏, convincing the sender that it indeed used this 𝑏 during the interaction. This allows us to implement step (2) securely, and we thus establish that (𝜖, 𝛿, 0) committed-bit OT implies (1, 1/2, 0)-OT for any 𝛿 < 𝜖2 .

3

Preliminaries

Let 𝜆 be the security parameter. By default, we consider non-uniform families of quantum adversaries, but the type of non-uniformity will vary. In particular, we will sometimes consider adversaries with non-uniform classical advice, given by {𝑄𝜆 }𝜆∈N , and sometimes consider adversaries with non-uniform quantum advice, given by {𝜌𝜆 , 𝑄𝜆 }𝜆∈N . In both cases, we will often suppress the parameterization over 𝜆 and write just 𝑄 or 𝜌, 𝑄. Definition 3.1 (Sub-distribution measure). Let Ω be a finite set. A sub-distribution (equivalently, a sub-probability measure) on Ω is a function 𝑀 : Ω → [0, 1] such that its total mass 𝜇(𝑀 ) :=

∑︁

𝑀 (𝜔)

𝜔∈Ω

satisfies 𝜇(𝑀 ) ≤ 1. If 𝜇(𝑀 ) > 0, we write 𝜔 ← 𝑀 to denote sampling from the normalized distribution 𝑀/𝜇(𝑀 ), i.e., 𝑀 (𝜔0 ) Pr[𝜔 = 𝜔0 ] = (𝜔0 ∈ Ω). 𝜇(𝑀 ) 12

In fact this also establishes that (1, 0, 𝛿)-OT implies (1, 0, 0)-OT by first applying a standard OT reversal.

19

Given a distribution 𝐷 on Ω, we write 𝑀 ⪯ 𝐷 if 𝑀 (𝜔) ≤ 𝐷(𝜔) for all 𝜔 ∈ Ω. Theorem 3.2 (von Neumann’s minimax theorem [vN28]). Let 𝒜 be a finite set, let 𝑌 ⊆ R𝑑 be a nonempty compact convex set, and let 𝑢 : 𝒜 × 𝑌 → R be such that 𝑢(𝑎, ·) is affine on 𝑌 for every 𝑎 ∈ 𝒜. Write Δ(𝒜) for the simplex of distributions over 𝒜, and define 𝑢 ¯(𝑝, 𝑦) := E𝑎∼𝑝 [𝑢(𝑎, 𝑦)]. Then min max 𝑢(𝑎, 𝑦) = 𝑦∈𝑌

𝑎∈𝒜

max min 𝑢 ¯(𝑝, 𝑦).

𝑝∈Δ(𝒜) 𝑦∈𝑌

In particular, there exists 𝑝⋆ ∈ Δ(𝒜) such that for all 𝑦 ∈ 𝑌 , 𝑢 ¯(𝑝⋆ , 𝑦) ≥ min𝑦′ ∈𝑌 max𝑎∈𝒜 𝑢(𝑎, 𝑦 ′ ).

3.1

Cryptographic primitives

Definition 3.3 (Inefficiently-extractable commitment). An inefficiently-extractable commitment between a classical committer and classical receiver consists of an interaction stCom , 𝜏 ← ⟨Com(1𝜆 , 𝑏), Rec(1𝜆 )⟩, where stCom is the private state of the committer, and 𝜏 is the public transcript of interaction produced by the protocol, along with a PPT algorithm Ver(stCom , 𝜏, 𝑏) → {⊤, ⊥}. It should satisfy the following properties. • Correctness: for any 𝑏 ∈ {0, 1}, [︁

Pr Ver(stCom , 𝜏, 𝑏) = ⊤ : stCom , 𝜏 ← ⟨Com(1𝜆 , 𝑏), Rec(1𝜆 )⟩

]︁

= 1 − negl(𝜆).

̃︂ outputting a bit ̃︀ • Hiding: For any QPT adversarial receiver 𝜌, Rec 𝑏, ⃒ ]︁ ⃒⃒ ]︁ [︁ [︁ ⃒ 𝜆 𝜆 ̃︀ ̃︀ ̃︂ ̃︀ ̃︂ ⃒ Pr ̃︀ 𝑏 = 0 : 𝑏 ← ⟨Com(1 , 0), Rec(𝜌)⟩ − Pr 𝑏 = 0 : 𝑏 ← ⟨Com(1 , 1), Rec(𝜌)⟩ ⃒⃒ = negl(𝜆). ⃒

• Binding: There exists a (potentially inefficient) function Ext such that for any unbounded adversarial ̃︂ committer Com, [︃

𝜆 ̃︂ ̃︀ ̃︀ Com , 𝜏, 1 − 𝑏) = ⊤ : stCom , 𝜏 ← ⟨Com, Rec(1 )⟩ Pr Ver(st 𝑏 := Ext(𝜏 )

]︃

= negl(𝜆).

Remark 3.4. We remark that Naor’s commitment [Nao89] based on any (post-quantum) pseudo-random generator satisfies the above definition. Definition 3.5 (Bit Agreement). An (𝜖, 𝛿)-weak bit agreement (BA) protocol with classical communication consists of an interaction between polynomial-time (potentially quantum) parties 𝐴 and 𝐵, denoted by (𝑘𝐴 , 𝑘𝐵 , 𝜏 ) ← ⟨𝐴(1𝜆 ), 𝐵(1𝜆 )⟩, where 𝑘𝐴 ∈ {0, 1} is 𝐴’s output, 𝑘𝐵 ∈ {0, 1} is 𝐵’s output, and 𝜏 denotes the (classical) transcript of interaction that occurs between 𝐴 and 𝐵. The protocol satisfies the following properties.

20

• Lack of bias. ⃒ ⃒ ⃒ 1 ⃒⃒ ⃒ Pr [𝑘 = 0]− ⃒ = negl(𝜆), ⃒ ⃒ (𝑘𝐴 ,𝑘𝐵 ,𝜏 )←⟨𝐴(1𝜆 ),𝐵(1𝜆 )⟩ 𝐴 2⃒

⃒ ⃒ ⃒ 1 ⃒⃒ ⃒ Pr [𝑘 = 0]− ⃒ = negl(𝜆), ⃒ ⃒ (𝑘𝐴 ,𝑘𝐵 ,𝜏 )←⟨𝐴(1𝜆 ),𝐵(1𝜆 )⟩ 𝐵 2⃒

• Correctness. [𝑘𝐴 = 𝑘𝐵 ] ≥

Pr

(𝑘𝐴 ,𝑘𝐵

,𝜏 )←⟨𝐴(1𝜆 ),𝐵(1𝜆 )⟩

1 𝜖 + − negl(𝜆). 2 2

̃︀ • Security. For any QPT adversary 𝜌, 𝐸,

Pr

(𝑘𝐴 ,𝑘𝐵

[︁

,𝜏 )←⟨𝐴(1𝜆 ),𝐵(1𝜆 )⟩

1 𝛿 + + negl(𝜆). 2 2

]︁

̃︀ 𝐸(𝜌, 𝜏 ) = 𝑘𝐴 | 𝑘𝐴 = 𝑘𝐵 ≤

We introduce two definitions of oblivious transfer (OT). First, we give a standard game-based definition, specified as follows. Definition 3.6 (Oblivious transfer). An (𝜖, 𝛿, 𝛾)-weak oblivious transfer (OT) with classical communication is a protocol that takes place between a polynomial-time (potentially quantum) sender 𝑆 and a polynomial-time (potentially quantum) receiver 𝑅, denoted by (𝑏, 𝑟), (𝑟0 , 𝑟1 ), 𝜏 ← ⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩, where (𝑏, 𝑟) is the output of 𝑅, (𝑟0 , 𝑟1 ) is the output of 𝑆, and 𝜏 is the (classical) transcript of interaction produced by the protocol. It should satisfy the following properties. • Correctness: It holds that [︁

Pr 𝑟 = 𝑟𝑏 : (𝑏, 𝑟), (𝑟0 , 𝑟1 ), 𝜏 ← ⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩

]︁

≥

1 𝜖 + − negl(𝜆). 2 2

̃︀ • Receiver security: For any QPT adversarial sender 𝜌, 𝑆, [︁

]︁

̃︀ Pr ̃︀𝑏 = 𝑏 : (𝑏, 𝑟), ̃︀𝑏 ← ⟨𝑅(1𝜆 ), 𝑆(𝜌)⟩ ≤

1 𝛾 + + negl(𝜆). 2 2

̃︀ • Sender security: For any QPT adversarial receiver 𝜌, 𝑅, [︁

̃︀ Pr 𝑟̃︀ = 𝑟0 ⊕ 𝑟1 : 𝑟, ̃︀ (𝑟0 , 𝑟1 ) ← ⟨𝑅(𝜌), 𝑆(1𝜆 )⟩

]︁

≤

1 𝛿 + + negl(𝜆). 2 2

Remark 3.7. We refer to (1, 0, 0)-weak OT as “standard OT”, or just “OT”, as it satisfies the standard notions of correctness and security. Next, we give a specialized variant of OT that we call committed-bit OT. Definition 3.8 (Committed-bit OT). An (𝜖, 𝛿, 𝛾)-weak committed-bit OT with classical communication is a protocol that takes place between a polynomial-time (potentially quantum) sender 𝑆 and a polynomialtime (potentially quantum) receiver 𝑅. The protocol begins with a setup phase, denoted by init𝑅 , 𝜏Setup ← Setup⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩, 21

where init𝑅 is 𝑅’s private state and 𝜏Setup is the public (classical) transcript of interaction. Next, for any 𝑏 ∈ {0, 1}, the parties run (𝑟, st𝑅 ), (𝑟0 , 𝑟1 , st𝑆 ), 𝜏 ← OT⟨𝑅(𝑏, init𝑅 ), 𝑆(𝜏Setup )⟩. In addition, there exists a (potentially inefficient) function TrapGen, a polynomial-time function Ext, and a verification protocol {⊤, ⊥} ← Ver⟨𝑅(st𝑅 ), 𝑆(𝑏, st𝑆 )⟩, such that the following properties hold. • Correctness: For any 𝑏 ∈ {0, 1}, [︃

init𝑅 , 𝜏Setup ← Setup⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩ Pr 𝑟 = 𝑟𝑏 : (𝑟, st𝑅 ), (𝑟0 , 𝑟1 , st𝑆 ), 𝜏 ← OT⟨𝑅(𝑏, init𝑅 ), 𝑆(𝜏Setup )⟩

]︃

≥

1 𝜖 + − negl(𝜆). 2 2

• Completeness: For any 𝑏 ∈ {0, 1}, [︃

init𝑅 , 𝜏Setup ← Setup⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩ Pr Ver⟨𝑅(st𝑅 ), 𝑆(𝑏, st𝑆 )⟩ = ⊤ : (𝑟, st𝑅 ), (𝑟0 , 𝑟1 , st𝑆 ), 𝜏 ← OT⟨𝑅(𝑏, init𝑅 ), 𝑆(𝜏Setup )⟩

]︃

= 1−negl(𝜆).

̃︀ • Receiver security: For any QPT adversarial sender 𝜌, 𝑆, ⃒ [︃ ]︃ ⃒ ̃︀ init𝑅 , init𝑆 , 𝜏Setup ← Setup⟨𝑅(1𝜆 ), 𝑆(𝜌)⟩ ⃒ ̃︀ ⃒ Pr 𝑏 = 0 : ̃︀ ⃒ (𝑟, st𝑅 ), (̃︀𝑏, st𝑆 ), 𝜏 ← OT⟨𝑅(0, init𝑅 ), 𝑆(init 𝑆 )⟩ [︃ ]︃⃒ ⃒ ̃︀ init𝑅 , init𝑆 , 𝜏Setup ← Setup⟨𝑅(1𝜆 ), 𝑆(𝜌)⟩ ⃒ ̃︀ − Pr 𝑏 = 0 : ⃒ ≤ 𝛾 + negl(𝜆). ̃︀ (𝑟, st𝑅 ), (̃︀𝑏, st𝑆 ), 𝜏 ← OT⟨𝑅(1, init𝑅 ), 𝑆(init 𝑆 )⟩ ⃒ ̃︀ init , with probability 1 − negl(𝜆) over • Sender security: For any unbounded algorithm 𝑅 ̃︀ init , 𝑆(1𝜆 )⟩, init𝑅 , 𝜏Setup ← Setup⟨𝑅

td := TrapGen(𝜏Setup ),

̃︀ it holds that for any QPT adversarial receiver 𝑅, [︃

̃︀ ̃︀ 𝑅 , 𝑟𝑏 ) = 𝑟1−𝑏 : st𝑅 , (𝑟0 , 𝑟1 , st𝑆 ), 𝜏 ← OT⟨𝑅(init𝑅 ), 𝑆(𝜏Setup )⟩ Pr 𝑅(st 𝑏 := Ext(td, 𝜏 )

]︃

≤

1 𝛿 + + negl(𝜆), 2 2

and, [︃

̃︀ ̃︀ 𝑅 ), 𝑆(1 − 𝑏, st𝑆 )⟩ = ⊤ : st𝑅 , (𝑟0 , 𝑟1 , st𝑆 ), 𝜏 ← OT⟨𝑅(init𝑅 ), 𝑆(𝜏Setup )⟩ Pr Ver⟨𝑅(st 𝑏 := Ext(td, 𝜏 )

]︃

= negl(𝜆).

Remark 3.9. We note that any (𝜖, 𝛿, 𝛾)-weak committed-bit OT implies (𝜖, 𝛿, 𝛾)-weak OT secure against adversaries with non-uniform quantum advice. Correctness and receiver security are immediate, while ̃︀ can compute 𝑟0 ⊕ 𝑟1 with some advantage, then, given 𝑟𝑏 , it sender security follows due to the fact that if 𝑅 can output 𝑟1−𝑏 with (at least) the same advantage.

22

3.2

Alternating projectors

Marriott and Watrous introduce algorithms based on alternating projectors, which they used for witness-preserving QMA amplification [MW04]. Chiesa et al. present tools for analyzing these algorithms [CMSZ22]; we now review these tools, which will later be used for proving Theorem 6.16. Jordan decomposition.

By Jordan’s lemma applied to (Π𝐴 , Π𝐵 ), ℋ decomposes orthogonally as ℋ =

⨁︁

𝑆𝑗 ,

𝑗

where each 𝑆𝑗 has dimension at most⃒2, and For⃒a 2-dimensional ⃒by both ⟩ ⃒is preserved ⟩ ⟩ ⃒ projections. ⟩ ⟩ ⃒ 𝐴 ⃒ 𝐴 ⃒ 𝐵 ⃒ 𝐵 ⃒ 𝐴 block 𝑆𝑗 choose orthonormal pairs {⃒𝑣𝑗,1 , ⃒𝑣𝑗,0 } and {⃒𝑣𝑗,1 , ⃒𝑣𝑗,0 } such that ⃒𝑣𝑗,1 ∈ im(Π𝐴 ), ⃒ ⟩ ⃒ 𝐴 ⃒𝑣𝑗,0 ∈ ker(Π𝐴 ) and similarly for 𝐵. Define the overlap parameter ⃒⟨

⃒ ⃒

⟩⃒ 2

𝐴 𝑣 𝐵 ⃒ ∈ [0, 1]. 𝑝𝑗 := ⃒ 𝑣𝑗,1 ⃒ 𝑗,1

By convention, phases may be fixed so that within 𝑆𝑗 , the bases are related by a planar rotation: ⃒ ⃒ ⟩ √ ⃒ ⟩ √︁ ⟩ ⃒ 𝐵 ⃒ 𝐴 ⃒ 𝐴 + 1 − 𝑝𝑗 ⃒𝑣𝑗,0 . ⃒𝑣𝑗,1 = 𝑝𝑗 ⃒𝑣𝑗,1

⃒ ⃒ ⟩ √︁ ⟩ ⟩ √ ⃒ ⃒ 𝐵 ⃒ 𝐵 ⃒ 𝐴 + 1 − 𝑝𝑗 ⃒𝑣𝑗,0 , ⃒𝑣𝑗,1 = 𝑝𝑗 ⃒𝑣𝑗,1

Corollary 3.10. In the Jordan decomposition notation above, fix a 2-dimensional block 𝑆𝑗 and let 𝑝𝑗 := 𝐴 | 𝑣 𝐵 ⟩|2 , where the bases are chosen so that |⟨𝑣𝑗,1 𝑗,1 𝐴 |𝑣𝑗,1 ⟩ =

√

√︁

𝐵 𝑝𝑗 |𝑣𝑗,1 ⟩+

𝐵 1 − 𝑝𝑗 |𝑣𝑗,0 ⟩.

(1)

Then 𝐴 𝐴 (Π𝐴 Π𝐵 Π𝐴 ) |𝑣𝑗,1 ⟩ = 𝑝𝑗 |𝑣𝑗,1 ⟩.

In particular, each Jordan parameter 𝑝𝑗 is an eigenvalue of the restriction Π𝐴 Π𝐵 Π𝐴 |im(Π𝐴 ) . Consequently, if (︁ )︁ spec Π𝐴 Π𝐵 Π𝐴 |im(Π𝐴 ) ⊆ [𝑎, 𝑏], then every Jordan parameter 𝑝𝑗 lies in [𝑎, 𝑏]. 𝐴 ⟩ and |𝑣 𝐵 ⟩ := |𝑣 𝐵 ⟩. Since |𝑣 𝐴 ⟩ ∈ im(Π ) we have Π |𝑣 𝐴 ⟩ = Proof. Fix 𝑗 and abbreviate |𝑣 𝐴 ⟩ := |𝑣𝑗,1 𝐴 𝐴 𝑗,1 𝐴 𝐵 ⟩ = |𝑣 𝐵 ⟩ and Π |𝑣 𝐵 ⟩ = 0, we get |𝑣 ⟩. Using the rotation relation (1) and that Π𝐵 |𝑣𝑗,1 𝐵 𝑗,0 𝑗,1

Π𝐵 |𝑣 𝐴 ⟩ =

√

𝑝𝑗 |𝑣 𝐵 ⟩.

Applying Π𝐴 again and using the second rotation relation |𝑣 𝐵 ⟩ = 𝐴 ⟩ = 0, we obtain with Π𝐴 |𝑣𝑗,0 √ Π𝐴 |𝑣 𝐵 ⟩ = 𝑝𝑗 |𝑣 𝐴 ⟩. Combining, Π𝐴 Π𝐵 Π𝐴 |𝑣 𝐴 ⟩ = Π𝐴 Π𝐵 |𝑣 𝐴 ⟩ =

√

√

𝐴 ⟩ together 𝑝𝑗 |𝑣 𝐴 ⟩+ 1 − 𝑝𝑗 |𝑣𝑗,0

√︀

𝑝𝑗 Π𝐴 |𝑣 𝐵 ⟩ = 𝑝𝑗 |𝑣 𝐴 ⟩,

as claimed. The final implication follows since 𝑝𝑗 is an eigenvalue of Π𝐴 Π𝐵 Π𝐴 |im(Π𝐴 ) . The following analysis is concerned with algorithms that alternately apply two binary projective measurements 𝐴 = (Π𝐴 , 𝐼 − Π𝐴 ) and 𝐵 = (Π𝐵 , 𝐼 − Π𝐵 ) on a Hilbert space ℋ, stopping after a prescribed number of steps or upon observing a desired outcome. 23

A classical distribution for alternating outcomes. MWDist(𝑇, 𝑝) on bit strings (𝑏1 , . . . , 𝑏𝑇 ) by:

Fix 𝑇 ∈ N and 𝑝 ∈ [0, 1]. Define a distribution

1. Sample independent 𝑎1 , . . . , 𝑎𝑇 ∈ {0, 1} with Pr[𝑎𝑖 = 1] = 𝑝. 2. Set 𝑏0 := 1 and update 𝑏𝑖 := 𝑏𝑖−1 ⊕ 𝑎𝑖 for 𝑖 = 1, . . . , 𝑇 . 3. Output (𝑏1 , . . . , 𝑏𝑇 ). ⃒ ⃒

⟩

𝐵 Lemma 3.11 (Lemma 4.4 in [CMSZ22]). If the initial post-measurement state is ⃒𝑣𝑗,1 and we apply 𝑇 measurements alternating 𝐴, 𝐵, 𝐴, 𝐵, . . ., then the resulting outcome bits (𝑏1 , . . . , 𝑏𝑇 ) are distributed as MWDist(𝑇, 𝑝𝑗 ).

Lemma ⃒ 3.12 ⟩ (Lemma 4.5 in [CMSZ22]). If the initial state lies in im(Π𝐵 ), it must take the form |𝜓⟩ = ∑︀ ⃒ 𝐵 2 𝑣 𝛼 𝑗 𝑗 ⃒ 𝑗,1 . Then the outcome distribution equals: sample an index 𝑗 with probability |𝛼𝑗 | , then sample from MWDist(𝑇, 𝑝𝑗 ). Let ˜𝑏 = (𝑏0 , 𝑏1 , . . . , 𝑏𝑛 ) ∈ {0, 1}𝑛+1 . Define the normalized count of consecutive repeats ⃒ 1⃒ NReps(˜𝑏) := ⃒{ 𝑗 ∈ {1, . . . , 𝑛} : 𝑏𝑗 = 𝑏𝑗−1 }⃒. 𝑛

Proposition 3.13 (Proposition 4.7 in [CMSZ22]). If (𝑏1 , . . . , 𝑏𝑇 ) ∼ MWDist(𝑇, 𝑝) , then NReps(1, 𝑏1 , . . . , 𝑏𝑇 ) has the same distribution as Bin(𝑇, 𝑝)/𝑇 . In particular, E[NReps(1, 𝑏1 , . . . , 𝑏𝑇 )] = 𝑝. Hence, applying 𝑇 alternating measurements and outputting the repeat fraction provides an estimator whose expectation (in block 𝑗) is 𝑝𝑗 . Proposition 3.14 (Additive Chernoff bound, Proposition 3.1 in [CMSZ22]). Let 𝑋 ∼ Bin(𝑛, 𝑝). For 𝜀, 𝜂 > 0, if ln(1/2𝜂) 𝑛 ≥ , 2𝜀2 then ]︁ [︁ ⃒ ⃒ Pr ⃒𝑋/𝑛 − 𝑝⃒ ≤ 𝜀 ≥ 1 − 𝜂. Using Chernoff’s bound, we have Pr[|NReps(MWDist(𝑇, 𝑝𝑗 )) − 𝑝𝑗 | ≤ 𝜀] ≥ 1 − 𝜂 whenever 𝑇 ≥ ln(1/2𝜂)/(2𝜀2 ).

4

Tests of non-commutation

4.1

Definitions

Definition 4.1 (Test of Non-Commutation). An (𝛼, 𝛽) classical test of non-commutation (ToNC) is a two-stage interactive protocol between a QPT (uniform) prover 𝑃 and a PPT (uniform) verifier 𝑉 . The first stage is defined by interactive strategies 𝑃Prep and 𝑉Prep , which we denote by (|𝜓⟩ , (𝑐, st)) ← ⟨𝑃Prep (1𝜆 ), 𝑉Prep (1𝜆 )⟩, where |𝜓⟩ is 𝑃 ’s output, (𝑐, st) is 𝑉 ’s output, and 𝑐 ∈ {0, 1}, st ∈ {0, 1}* . The second stage is defined by two binary-outcome observables 𝑃0 , 𝑃1 , where 𝑃𝑐 is applied in the case that the first stage outputs 𝑐, and a verification predicate 𝑉Ver (st, 𝑎) → {0, 1}. It should satisfy the following properties. 24

• Completeness: It holds that13 [︃

|𝜓⟩ , (𝑐, st) ← ⟨𝑃Prep (1𝜆 ), 𝑉Prep (1𝜆 )⟩ Pr 𝑉Ver (st, 𝑎) = 1 : 𝑎 ← 𝑃𝑐 (|𝜓⟩)

]︃

≥ 𝛽.

• Soundness: For any non-uniform QPT strategy 𝜌, 𝑃̃︀Prep , 𝑃̃︀0 , 𝑃̃︀1 such that 𝑃̃︀0 𝑃̃︀1 = 𝑃̃︀1 𝑃̃︀0 , [︃

|𝜓⟩ , (𝑐, st) ← ⟨𝑃̃︀Prep (1𝜆 , 𝜌), 𝑉Prep (1𝜆 )⟩ Pr 𝑉Ver (st, 𝑎) = 1 : 𝑎 ← 𝑃̃︀𝑐 (|𝜓⟩)

]︃

≤ 𝛼 + negl(𝜆).

Definition 4.2 (Normal form test of non-commutation). We say that the test of non-commutation (Definition 4.1) is in normal form if: • st = 𝑎* ∈ {0, 1}, and • 𝑉Ver (𝑎* , 𝑎) = 1 iff 𝑎 = 𝑎* . That is, there is always exactly one answer bit that the verifier accepts. Remark 4.3. In any normal-form ToNC, both 𝛽, 𝛼 ≥ 1/2 since there always exists a trivial strategy which outputs a uniformly random bit. Thus, it is often convenient to write the parameters of a normal-form ToNC using the advantage of the prover as opposed to the raw probability of success. That is, we will often refer to a normal form (𝛼, 𝛽)-ToNC where 𝛼, 𝛽 ∈ [1/2, 1] as an (𝜖, 𝛿)-ToNC, where 𝜖 := 2𝛽−1, 𝛿 := 2𝛼−1 ∈ [0, 1]. We will also assume without loss of generality that 𝛿 ≥ 𝜖/2, as justified in our discussion in Section 1.1. Next, we specify a stronger completeness guarantee stating that for all preambles, the (honest) prover’s advantage is at least 𝜖. Note that this is satisfied by the compiled CHSH game (with 𝜖 = 2 cos2 (𝜋/8) − 1) and the compiled magic square game (with 𝜖 = 1). Definition 4.4 (Test of non-commutation with robust completeness). We say that a (normal form) (𝜖, 𝛿)-ToNC has robust completeness if with probability 1 over |𝜓⟩ , (𝑐, st) ← ⟨𝑃Prep (1𝜆 ), 𝑉Prep (1𝜆 )⟩, Pr [𝑉Ver (st, 𝑎) = 1 : 𝑎 ← 𝑃𝑐 (|𝜓⟩)] =

4.2

1 𝜖 + . 2 2

Normal form compiler

In this subsection, we present a procedure that transforms a less structured form of ToNC into a normal-form ToNC as in Definition 4.2. This transformation incurs an inverse-polynomial parameter loss. Whereas in the final round of a normal-form ToNC the verifier accepts exactly one of the two possible prover answers, in the less structured form, the verifier may alternatively accept both or neither. Since our constructions of oblivious transfer and key agreement use normal-form ToNCs, the compilation procedure below shows that the same implications hold for a broader class of ToNC protocols. Moreover, this compilation procedure suggests that normal-form ToNC is not merely a convenient technical restriction, but a natural abstraction: it captures, up to bounded parameter loss, a broad class of ToNC protocols. 13

In an abuse of notation, we write 𝑃 (|𝜓⟩) to denote the distribution induced by measuring state |𝜓⟩ with projective measurement {𝑃, 𝐼 − 𝑃 }.

25

Theorem 4.5 (Normal form compiler). Let 𝐼 be two-stage protocol satisfying Definition 4.1, except that the second-stage predicate 𝑉Ver (st, ·) may (for some values of st) accept both 𝑎 ∈ {0, 1} or accept neither. Then for any inverse-polynomial function 𝜀(𝜆), there exists a normal-form test 𝐼 nf with parameters (𝛼′ , 𝛽 ′ ) such that 𝛽 ′ − 𝛼′ ≥ 𝛽 − 𝛼 − 𝑂(𝜀). Remark 4.6. As we explain in the proof below, the verifier in the constructed normal-form test 𝐼 nf may include a quantum polynomial-time preprocessing phase that takes as input the security parameter and outputs some classical information. After this, its interaction with the prover is entirely classical. While this does not exactly fit the syntax of Definition 4.1, we remark that all the implications of (normal-form) ToNC that we show (i.e. to classical-communication KA and OT) follow in exactly the same manner if we start with a ToNC with quantum verifier preprocessing. Proof. By the completeness of 𝐼, there exists a uniform QPT strategy 𝑆 = (𝑃Prep , 𝑃0 , 𝑃1 ) that succeeds with probability at least 𝛽 for any value of the security parameter 𝜆. Let (𝑐, st) be the verifier output in the preparation stage when interacting with 𝑃Prep . For any such output, define the acceptance set 𝐴(𝑐, st) := {𝑎 ∈ {0, 1} : 𝑉Ver (𝑐, st, 𝑎) = 1}, so that |𝐴(𝑐, st)| ∈ {0, 1, 2}. Define ℓ(𝜆) := Pr[|𝐴(𝑐, st)| = 2],

𝜇(𝜆) := Pr[|𝐴(𝑐, st)| = 0],

𝛾(𝜆) := Pr[|𝐴(𝑐, st)| = 1],

where the probabilities are taken over random interactions between 𝑆(𝜆) and the verifier 𝑉 (𝜆). Given the security parameter 𝜆, the verifier in our normal-form test 𝐼 nf must determine the numbers ℓ(𝜆), 𝜇(𝜆), 𝛾(𝜆). For all non-commutation tests we are aware of, these numbers are in fact constants independent of the security parameter, and thus they can be hard-coded into the verifier. However, in general, this may not be the case, so the verifier will estimate these values by running a quantum pre-processing step in 𝐼 ns (Step 1 in the protocol described below). Now, let 𝑎 be the answer obtained by applying 𝑃𝑐 to the prover state, and define the conditional success on unique-accepting transcripts 𝜉(𝜆) := Pr[𝑎 = 𝑎⋆ (𝑐, st) | |𝐴(𝑐, st)| = 1], where if |𝐴(𝑐, st)| = 1, 𝑎⋆ (𝑐, st) is the unique accepted answer. Then the overall success of 𝑆 decomposes as Pr[𝐼 accepts with 𝑆] = ℓ + 𝛾 𝜉 ≥ 𝛽. (2) Consider the following strategy in 𝐼. It executes 𝑆 in the first stage of the protocol, and in the second stage it sends the verifier a uniformly random bit. This strategy succeeds in the protocol with probability ℓ + 𝛾2 , and applies perfectly commuting observables in the second stage. Therefore, the soundness of 𝐼 implies that ℓ + 𝛾2 ≤ 𝛼. On the other hand, ℓ + 𝛾𝜉 ≥ 𝛽. Thus, 1 𝛽−𝛼 𝛽 − 𝛼 ≤ (𝜉 − )𝛾 → 𝛾 ≥ 2 𝜉 − 12

(and indeed 𝜉 >

1 because 𝛽 > 𝛼). 2

1 We deduce that 𝛾 > 0. Moreover, since 𝛼 < 𝛽 are constants, we get 𝛾(𝜆) ≥ poly(𝜆) . 1 The normal-form protocol 𝐼 nf . Fix functions 𝜀(𝜆) = poly(𝜆) such that 𝜀 < 𝛾4 , and 𝜂 > 0, where 𝜂(𝜆) = negl(𝜆), and let 𝑟, 𝑣 be two polynomials. The verifier operates as follows:

26

1. Obtain estimates of ℓ := ℓ(𝜆), 𝜇 := 𝜇(𝜆), 𝛾 := 𝛾(𝜆), either as hard-coded values or by simulating interaction with the prover strategy 𝑆 several times and taking the averages. By running enough times, the verifier can obtain estimates that, with overwhelming probability, are arbitrarily inverse-polynomial close to the real values. We suppress mention of this approximation for the rest of the proof, and assume that the verifier obtains the exact values ℓ := ℓ(𝜆), 𝜇 := 𝜇(𝜆), 𝛾 := 𝛾(𝜆). 2. Sets a variable FLAG := 0, draws 𝑤 ∈ [𝑣(𝜆)] uniformly at random. For 𝑖 = 1, . . . , 𝑤: (a) Runs 𝑟 copies of 𝐼 sequentially with the prover, using fresh verifier randomness at each copy. The verifier completes only the first step of the protocol at each copy, producing outputs (𝑐𝑖 , st𝑖 ). (b) Computes |𝐴(𝑐𝑖 , st𝑖 )| by executing 𝑉Ver (st𝑖 , 0) and 𝑉Ver (st𝑖 , 1), and sets 1 ℓ̂︀ := |{𝑖 : |𝐴(𝑐𝑖 , st𝑖 )| = 2}|, 𝑟

1 ̂︀ := |{𝑖 : |𝐴(𝑐𝑖 , st𝑖 )| = 0}|, 𝜇 𝑟

1 𝛾̂︀ := |{𝑖 : |𝐴(𝑐𝑖 , st𝑖 )| = 1}|. 𝑟

̂︀ − 𝜇|, |𝛾 ̂︀ − 𝛾| exceeds 𝜀, the verifier sets FLAG := 1 and exits (c) If 𝛾̂︀ = 0, or if any of |ℓ̂︀− ℓ|, |𝜇 the loop.

3. The verifier then runs the following steps. (a) Runs step 2 (a) once, and thus produces outputs (𝑐𝑖 , st𝑖 ). (b) Samples 𝑖 ← [𝑟] uniformly at random, sets 𝑐 := 𝑐𝑖 and sends 𝑖 to the prover. If |𝐴(𝑐𝑖 , st𝑖 )| ̸= 1, sets FLAG = 1. (c) If FLAG = 1, the verifier draws a uniformly random bit st ← {0, 1}, sends 𝑐 to the prover and receives an answer bit 𝑎, and then accepts if and only if st = 𝑎. (d) Otherwise, the verifier sets st := 𝑎⋆ (𝑐𝑖 , st𝑖 ), where 𝑎⋆ (𝑐𝑖 , st𝑖 ) is the unique answer accepted by the verifier in the 𝑖-th instance. The prover sends an answer bit 𝑎, and the verifier accepts if and only if st = 𝑎. Completeness. We consider the prover strategy 𝑆̃︀ for 𝐼 nf , which executes 𝑆 independently in each copy of 𝐼. By standard concentration bounds and a union bound over the three empirical frequencies, for large enough polynomials 𝑟, 𝑣 we obtain that the probability that FLAG = 1 at the end of stage 2 of the protocol is at most 𝜂(𝜆). Conditioned on the event that FLAG = 0 at the end of step 2, with probability 𝛾, the verifier does not set FLAG = 1 in stage 3(b), and in that case the acceptance probability is 𝜉 = 𝛽−ℓ 𝛾 . 𝜉 is the acceptance probability of a prover running the strategy 𝑆 in the original protocol 𝐼, conditioned on |𝐴(𝑐, st)| = 1. If the verifier does set FLAG = 1 in stage 3(b), the acceptance probability is 12 . Overall, [︁ ]︁ 1 𝛽−ℓ Pr 𝐼 nf accepts with 𝑆̃︀ ≥ 𝜉𝛾 + (1 − 𝛾) − 𝜂, where 𝜉 = . 2 𝛾

Soundness. Let 𝑆̃︀ = (𝑃̃︀Prep , 𝑃̃︀0 , 𝑃̃︀1 ) be an arbitrary QPT strategy for 𝐼 nf whose final observables commute: 𝑃̃︀0 𝑃̃︀1 = 𝑃̃︀1 𝑃̃︀0 .

27

(3)

Let 𝑠 denote the success probability of 𝑆̃︀ in 𝐼 nf . Recall that a block consists of 𝑟 first-stage executions of 𝐼. We call a block good if its empirical frequencies satisfy ̂︀ − 𝜇| ≤ 𝜀, |ℓ̂︀ − ℓ| ≤ 𝜀, |𝜇 |𝛾̂︀ − 𝛾| ≤ 𝜀. Since we chose 𝜀 < 𝛾/4, every good block also satisfies 𝛾̂︀ > 0. Let 𝐹 be the event that FLAG = 0 at the end of stage 2, and write 𝑢 := Pr[𝐹 ]. Thus, 𝐹 is the event that every one of the 𝑤 cut-and-choose blocks in stage 2 is good. We first record the following random-stopping fact. This is the point where we use the fact that 𝑤 ← [𝑣] is hidden from the prover. ̃︀ Claim 4.7. For every strategy 𝑆,

Pr[𝐹 ∧ the stage-3 block is bad] ≤

1 . 𝑣

Consequently, if 𝑢 > 0, then Pr[the stage-3 block is bad | 𝐹 ] ≤

1 . 𝑢𝑣

Proof. Consider the coupled execution in which the verifier keeps generating blocks of 𝑟 first-stage executions using the same interface that the prover sees before the index 𝑖 is sent. Let 𝑇 be the index of the first bad block in this coupled execution, with 𝑇 = ∞ if no bad block ever occurs. The stopping time 𝑤 ← [𝑣] is sampled independently of the prover’s behavior and is not revealed before the stage-3 block has already been generated. Then, consider the event 𝐹 ∧ the stage-3 block is bad. This is exactly the events that 𝑇 = 𝑤 + 1. Since 𝑤 is uniform in [𝑣], this event has probability at most 1/𝑣. The conditional bound follows by dividing by Pr[𝐹 ] = 𝑢. We now split into two cases. Case 1: 𝑢 ≤ 𝜀. Conditioned on ¬𝐹 , the verifier has already set FLAG = 1, and therefore the final target bit st is uniform and independent of the prover’s final answer. Thus the prover succeeds with probability exactly 1/2 conditioned on ¬𝐹 . Conditioned on 𝐹 , its success probability is at most 1. Therefore 1−𝑢 1 𝑢 1 𝜀 𝑠≤ +𝑢= + ≤ + . 2 2 2 2 2 On the other hand, the strategy for 𝐼 that runs the honest first-stage strategy 𝑆 and then answers with a uniformly random bit has commuting final observables and succeeds with probability ℓ + 𝛾/2. By the soundness of 𝐼, 𝛾 ℓ + ≤ 𝛼 + negl(𝜆). 2 Hence, in this case, 1 𝜀 1 𝛾 𝑠 ≤ + ≤ + 𝛼 − ℓ − + 𝑂(𝜀) + negl(𝜆). 2 2 2 2 Case 2: 𝑢 > 𝜀. Choose 𝑣 large enough so that 𝑣 ≥ 1/𝜀2 . By Claim 4.7, Pr[the stage-3 block is bad | 𝐹 ] ≤ 28

1 ≤ 𝜀. 𝑢𝑣

Let 𝑞 ← [𝑟] be the uniformly random coordinate selected by the verifier in stage 3. Conditioned on 𝐹 , define ℓ := Pr[|𝐴(𝑐𝑞 , st𝑞 )| = 2 | 𝐹 ], 𝛾 := Pr[|𝐴(𝑐𝑞 , st𝑞 )| = 1 | 𝐹 ]. Since, conditioned on 𝐹 , the stage-3 block is good except with probability at most 𝜀, and since 𝑞 is uniform in the stage-3 block, we have |ℓ − ℓ| ≤ 2𝜀,

|𝛾 − 𝛾| ≤ 2𝜀.

(4)

Next define 𝜒 := Pr[𝑎 = 𝑎⋆ (𝑐𝑞 , st𝑞 ) | 𝐹 ∧ |𝐴(𝑐𝑞 , st𝑞 )| = 1], where 𝑎 is the answer output by 𝑆̃︀ after receiving the selected index 𝑞 and the challenge 𝑐𝑞 . If the conditioning event has probability 0, set 𝜒 = 1/2. We now construct a commuting strategy 𝐾 for the original protocol 𝐼. The strategy 𝐾 internally runs 𝑆̃︀ and simulates the verifier of 𝐼 nf . It first simulates stages 1–2 of 𝐼 nf . If FLAG = 1 at the ̃︀ Since 𝑢 > 𝜀, after end of stage 2, it restarts this simulation with a fresh copy of 𝑆. 𝑧 = poly(1/𝜀, 𝜆) repetitions, 𝐾 obtains an execution satisfying 𝐹 , except with negligible probability. If all repetitions fail, 𝐾 answers randomly. Once an execution satisfying 𝐹 has been obtained, 𝐾 generates the stage-3 block. It samples 𝑞 ← [𝑟] uniformly at random and embeds its external interaction with the verifier of 𝐼 in the 𝑞-th coordinate of this block, while simulating all other coordinates honestly. After the 𝑟 first-stage ̃︀ When the external verifier of 𝐼 sends executions have been completed, 𝐾 sends the index 𝑞 to 𝑆. ̃︀ obtains an answer 𝑎, and returns 𝑎 its challenge bit 𝑐, the strategy 𝐾 forwards this challenge to 𝑆, to the external verifier. The final observables of 𝐾 are precisely the final observables induced by 𝑆̃︀ after the simulated ̃︀ final transcript and the classical index 𝑞 have been fixed. Therefore they commute, because 𝑆’s observables commute. By construction, up to the negligible probability that 𝐾 fails to obtain an execution satisfying 𝐹 , the external instance of 𝐼 is distributed as the selected coordinate of the stage-3 block conditioned on 𝐹 . Therefore the success probability of 𝐾 in 𝐼 is ℓ + 𝛾 𝜒 − negl(𝜆). Indeed, if |𝐴(𝑐𝑞 , st𝑞 )| = 2, every answer is accepted; if |𝐴(𝑐𝑞 , st𝑞 )| = 0, no answer is accepted; and if |𝐴(𝑐𝑞 , st𝑞 )| = 1, the success probability is exactly 𝜒. By the soundness of the original protocol 𝐼, we obtain ℓ + 𝛾 𝜒 ≤ 𝛼 + negl(𝜆). (5) We now relate this to the success probability 𝑠 of 𝑆̃︀ in 𝐼 nf . Conditioned on ¬𝐹 , the verifier uses a uniformly random target bit, so the success probability is 1/2. Conditioned on 𝐹 , the verifier uses the real unique accepting bit only if the selected coordinate is unique-accepting; otherwise it sets FLAG = 1 and uses a uniformly random target bit. Hence 1−𝑢 1−𝛾 𝑠= +𝑢 𝛾𝜒+ 2 2 (︂

)︂

1 1 = + 𝑢𝛾 𝜒 − . 2 2 (︂

If 𝜒 ≤ 1/2, then 𝑠 ≤ 1/2, and using ℓ + 𝛾/2 ≤ 𝛼 + negl(𝜆), we again get 𝑠≤

1 𝛾 + 𝛼 − ℓ − + negl(𝜆). 2 2 29

)︂

Otherwise, 𝜒 > 1/2. Since 𝑢 ≤ 1, 1 1 𝑠≤ +𝛾 𝜒− 2 2 (︂

)︂

=

1 𝛾 +𝛾𝜒− . 2 2

Using (5), this gives 𝑠≤

1 𝛾 + 𝛼 − ℓ − + negl(𝜆). 2 2

Finally, by (4), 𝑠≤

1 𝛾 + 𝛼 − ℓ − + 𝑂(𝜀) + negl(𝜆). 2 2

Since 𝑆̃︀ was arbitrary, the soundness parameter 𝛼′ of 𝐼 nf satisfies 𝛼′ ≤

Gap analysis.

𝛾 1 + 𝛼 − ℓ − + 𝑂(𝜀) + negl(𝜆). 2 2

(6)

From the completeness analysis, we have 𝛽′ ≥

1 𝛾 + 𝛾𝜉 − − 𝜂. 2 2

Using the decomposition ℓ + 𝛾𝜉 ≥ 𝛽, we get 𝛽′ ≥ Combining (6) and (7),

1 𝛾 + 𝛽 − ℓ − − 𝜂. 2 2

(7)

𝛽 ′ − 𝛼′ ≥ 𝛽 − 𝛼 − 𝑂(𝜀) − 𝜂 − negl(𝜆).

Choosing the completeness parameters so that 𝜂 ≤ 𝑂(𝜀), and absorbing the negligible term into the 𝑂(𝜀) loss, we conclude that 𝛽 ′ − 𝛼′ ≥ 𝛽 − 𝛼 − 𝑂(𝜀), as required. 1 Recall that 𝐼 nf is constructed with a choice of 𝜀, and it remains efficient for any 𝜀(𝜆) = poly(𝜆) . Thus, the above gap is attainable for any such 𝜀. This completes the proof.

5

Weak cryptography from tests of non-commutation

5.1

Weak bit agreement

Weak bit agreement is a protocol run between two potentially quantum parties 𝐴 and 𝐵 that communicate classically. The protocol is parameterized by 𝜖, which determines the probability that 𝐴 and 𝐵 agree on a bit, and 𝛿, which determines how much information an eavesdropper can obtain about the shared bit.

30

Theorem 5.1. Given any normal-form (𝜖, 𝛿) test of non-commutation secure against adversaries with non-uniform classical (resp. quantum) advice (Definition 4.1, Remark 4.3), there exists a (𝜖, 𝛿 ′ )-BA secure against adversaries with non-uniform classical (resp. quantum) advice (Definition 3.5) for any 𝛿′ ≥

1 + 4𝛿 − 3𝜖 . 1+𝜖

Moreover, given any normal-form (𝜖, 𝛿) test of non-commutation secure against adversaries with nonuniform classical (resp. quantum) advice with robust completeness (Definition 4.4), there exists a (𝜖, 𝛿 ′ )-BA secure against adversaries with non-uniform classical (resp. quantum) advice for any 𝛿 ′ ≥ 2𝛿 − 𝜖. Proof. The protocol is given in Protocol 5.1. The theorem follows by combining Lemma 5.2 and Lemma 5.3. Protocol: Weak bit agreement Parties. Alice 𝐴 and Bob 𝐵 (classical communication; parties may be quantum). Ingredient. Normal-form (𝜖, 𝛿) test of non-commutation 𝑃Prep , 𝑉Prep , 𝑃0 , 𝑃1 , 𝑉Ver (Definition 4.1). Step 1: Non-commutation test. The parties run |𝜓⟩ , (𝑐, 𝑎* ) ← ⟨𝑃Prep (1𝜆 ), 𝑉Prep (1𝜆 )⟩, with 𝐴 playing the role of verifier and 𝐵 playing the role of prover. At its conclusion, 𝐴 obtains the “correct” answer bit 𝑎* and sends the challenge bit 𝑐 to 𝐵. Step 2: Random mask. 𝐴 samples 𝑟 ← {0, 1} uniformly at random and sends it to 𝐵. Step 3: Outputs. 𝐴 outputs the bit 𝑘𝐴 := 𝑎* ⊕ 𝑟. Upon receiving (𝑐, 𝑟), 𝐵 applies 𝑎 ← 𝑃𝑐 (|𝜓⟩) and outputs 𝑘𝐵 := 𝑎 ⊕ 𝑟. Lemma 5.2 (Correctness). Protocol 5.1 satisfies Lack of bias and Correctness according to Definition 3.5 with the same 𝜖 from the ToNC parameters. Proof. The event 𝑘𝐴 = 𝑘𝐵 is exactly the event that 𝑎 = 𝑎* , and hence occurs with advantage 𝜖 due to the completeness of the ToNC. Moreover, due to the random masking, Pr[𝑘𝐴 = 0] = Pr[𝑘𝐵 = 0] = 12 .

Lemma 5.3 (Security). Protocol 5.1 satisfies Security according to Definition 3.5 with 𝛿 ′ = 1+4𝛿−3𝜖 1+𝜖 . In the case that the ToNC has robust completeness, it satisfies Security with 𝛿 ′ = 2𝛿 − 𝜖. [︁

]︁

̃︀ and let 𝛾 be such that Pr 𝐸(𝜏 ̃︀ ) = 𝑘𝐴 = 1 + 𝛾 in an execution with Proof. Fix a QPT adversary 𝐸 2 2 honest 𝐴, 𝐵, where 𝜏 is the transcript produced by the interaction. By completeness of the ToNC, fix a QPT prover strategy 𝑃Prep , 𝑃0 , 𝑃1 that accepts with probability at least 21 + 2𝜖 . 𝐸 may or may not have non-uniform quantum advice 𝜌, which determines whether our new prover strategy does. We suppress mention of 𝜌 in what follows.

31

We build a new prover strategy 𝑃̃︀Prep , 𝑃̃︀0 , 𝑃̃︀1 with commuting final-round observables, as follows. 𝑃̃︀Prep interacts with the verifier through the preparation stage by executing 𝑃Prep . After receiving the final-round challenge 𝑐 ∈ {0, 1}, it samples a fresh uniform bit 𝑏 ← {0, 1} and proceeds as follows: • If 𝑐 = 𝑏, it answers using 𝑃𝑐 . ̃︀ applied to the (classical) transcript 𝜏 . • If 𝑐 ̸= 𝑏, it answers using 𝐸

Equivalently, 𝑃̃︀Prep can execute a joint measurement producing both candidate answers (^ 𝑎0 , 𝑎 ^1 ): ̃︀ 1−𝑏 ) (where 𝜏𝑡 denotes the transcript sample 𝑏; measure using 𝑃𝑐 to obtain 𝑎 ^𝑏 ; compute 𝑎 ^1−𝑏 ← 𝐸(𝜏 with final challenge set to 𝑡). Then, on challenge 𝑐, output 𝑎 ^𝑐 . Since this procedure produces both answers in one joint measurement, it is clear that the induced final-round observables commute. Conditioned on 𝑏 = 𝑐 (probability 1/2), 𝑃̃︀ behaves like 𝑃 on the final round, and thus has advantage at least 𝜖. Conditioned on 𝑏 ̸= 𝑐 (probability 1/2), 𝑃̃︀ has advantage 𝛾, by definition. Hence, the advantage of 𝑃̃︀ is at least 𝜖+𝛾 2 . By soundness of the ToNC against commuting strategies, 𝜖+𝛾 ≤𝛿 2

⇒

𝛾 ≤ 2𝛿 − 𝜖.

Since Pr[𝑘𝐴 = 𝑘𝐵 ] ≥ 12 + 2𝜖 , we have ⎛ [︁

]︁

̃︀ ) = 𝑘𝐴 | 𝑘𝐴 = 𝑘𝐵 − 1 ≤ 2 ⎝ 2 Pr 𝐸(𝜏 (︃

≤2

[︁

̃︀ ) = 𝑘𝐴 Pr 𝐸(𝜏

]︁ ⎞

Pr[𝑘𝐴 = 𝑘𝐵 ] 1 𝜖 2 +𝛿− 2 1 𝜖 2 + 2

⎠−1

)︃

−1

2 + 4𝛿 − 2𝜖 −1 1+𝜖 1 + 4𝛿 − 3𝜖 , = 1+𝜖 =

which completes the proof. ̃︀ ) = 𝑘𝐴 Now, in the case that the ToNC satisfies robust completeness, we have that the event 𝐸(𝜏 is independent of the event 𝑘𝐴 = 𝑘𝐵 , and thus [︁

]︁

[︁

]︁

̃︀ ) = 𝑘𝐴 | 𝑘𝐴 = 𝑘𝐵 − 1 = 2 Pr 𝐸(𝜏 ̃︀ ) = 𝑘𝐴 − 1 = 𝛾 ≤ 2𝛿 − 𝜖. 2 Pr 𝐸(𝜏

5.2

Weak (committed-bit) oblivious transfer

Theorem 5.4. Assume the existence of an inefficiently-extractable commitment (Definition 3.3) and a normal form (𝜖, 𝛿) test of non-commutation secure against adversaries with non-uniform quantum advice (Definition 4.1, Remark 4.3). Then for any 𝛿 ′ > 2𝛿 − 𝜖, there exists an (𝜖, 𝛿 ′ , 0)-weak committed-bit OT (Definition 3.8). Proof. The protocol is given in Protocol 5.2. The theorem follows by combining Lemma 5.5, Lemma 5.6, Lemma 5.7, and Lemma 5.8.

32

Protocol: Weak committed-bit OT Parties. Sender 𝑆 and receiver 𝑅 (classical communication; parties may be quantum). Ingredients. Inefficiently-extractable commitment (Com, Rec, VerCom , ExtCom ) (Definition 3.3) and normal-form (𝜖, 𝛿) test of non-commutation (𝑃Prep , 𝑉Prep , 𝑃0 , 𝑃1 , 𝑉Ver ) (Definition 4.1). Setup⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩: • Challenge commitments. For each 𝑘 ∈ [𝜆], 𝑖 ∈ [2𝜆], 𝑅 samples 𝑥𝑘𝑖 ← {0, 1} and the parties run ⟨ (︁ )︁ (︁ )︁⟩ st𝑘Com,𝑖 , 𝜏𝑖𝑘 ← Com 1𝜆 , 𝑥𝑘𝑖 , Rec 1𝜆 , with 𝑅 playing the role of Com and 𝑆 playing the role of Rec. {︁

• 𝑅 sets init𝑅 := st𝑘Com,𝑖

}︁ 𝑘∈[𝜆],𝑖∈[2𝜆]

.

OT⟨𝑅(𝑏, init𝑅 ), 𝑆(init𝑆 )⟩: • Answer commitments. For each 𝑘 ∈ [𝜆], 𝑖 ∈ [2𝜆], 𝑅 samples 𝑦𝑖𝑘 ← {0, 1} and the parties run ⟨ (︁ )︁ (︁ )︁⟩ 𝑘 𝑘 st′ Com,𝑖 , 𝜏 ′ 𝑖 ← Com 1𝜆 , 𝑦𝑖𝑘 , Rec 1𝜆 , with 𝑅 playing the role of Com and 𝑆 playing the role of Rec. • Pair commitments. For each 𝑘 ∈ [𝜆] and unordered pair {𝑖, 𝑗} ⊆ [2𝜆], 𝑅 sets 𝑥𝑘𝑖,𝑗 := 𝑥𝑘𝑖 ⊕ 𝑥𝑘𝑗 , and the parties run ⟨

(︁

)︁

(︁

𝑘 st𝑘Com,{𝑖,𝑗} , 𝜏{𝑖,𝑗} ← Com 1𝜆 , 𝑥𝑘𝑖,𝑗 , Rec 1𝜆

)︁⟩

,

with 𝑅 playing the role of Com and 𝑆 playing the role of Rec. • Main loop. 𝑆 samples 𝑘 * ← [𝜆]. For 𝑘 = 1 to 𝑘 * : – Non-commutation tests. For each 𝑖 ∈ [2𝜆], the parties run (︁

)︁

|𝜓𝑖𝑘 ⟩ , 𝑐𝑘𝑖 , 𝑎𝑘𝑖 ← ⟨𝑃Prep (1𝜆 ), 𝑉Prep (1𝜆 )⟩, with 𝑅 playing the role of the prover and 𝑆 playing the role of the verifier. For each 𝑖 ∈ [2𝜆], 𝑆 samples 𝑧𝑖𝑘 ← {0, 1} and sends 𝑧𝑖𝑘 to 𝑅. For each 𝑖 ∈ [2𝜆], 𝑅 sets 𝑐𝑘𝑅,𝑖 := 𝑥𝑘𝑖 ⊕ 𝑧𝑖𝑘 , computes 𝑎𝑘𝑅,𝑖 ← 𝑃𝑐𝑘

𝑅,𝑖

(︁

)︁

|𝜓𝑖𝑘 ⟩

̂︀𝑘𝑖 := 𝑎𝑘𝑅,𝑖 ⊕ 𝑦𝑖𝑘 to 𝑆. and sends 𝑎

– Pairing and checks. 𝑆 partitions [2𝜆] uniformly at random (︁ into a disjoint )︁ set of 𝜆 𝑘 𝑘 pairs 𝒫, and sends 𝒫 to 𝑅. For each {𝑖, 𝑗} ∈ 𝒫, 𝑅 sends 𝑥𝑖,𝑗 , stCom,{𝑖,𝑗} to 𝑆, who aborts if (︁ )︁ 𝑘 VerCom st𝑘Com,{𝑖,𝑗} , 𝜏{𝑖,𝑗} , 𝑥𝑘𝑖,𝑗 = ⊥. 𝑆 chooses a pair 𝑃 * = {𝑖* , 𝑗 * } ∈ 𝒫 uniformly at random conditioned on 𝑥𝑘𝑖* ,𝑗 * ⊕ 𝑧𝑖𝑘* ⊕ 𝑧𝑗𝑘* ̸= 𝑐𝑘𝑖* ⊕ 𝑐𝑘𝑗* (or aborts if no such pair exists), and sends 𝑃 * to 𝑅. For each {𝑖, 𝑗} ∈ 𝒫 ∖ {𝑃 * }:

33

𝑘 𝑘 𝑘 𝑘 𝑘 ′𝑘 𝑘 ′𝑘 * 𝑅 sends 𝑥𝑖 , stCom,𝑖 , 𝑥𝑗 , stCom,𝑗 , 𝑦𝑖 , st Com,𝑖 , 𝑦𝑗 , st Com,𝑗 to 𝑆, who aborts if any of the respective VerCom checks fail. 𝑘 𝑘 𝑘 * 𝑆 aborts if 𝑥𝑖,𝑗 ̸= 𝑥𝑖 ⊕ 𝑥𝑗 . Otherwise, 𝑆 sets

̂︀𝑘𝑖 ⊕ 𝑦𝑖𝑘 , 𝑎𝑘𝑅,𝑗 = 𝑎 ̂︀𝑘𝑗 ⊕ 𝑦𝑗𝑘 . 𝑐𝑘𝑅,𝑖 = 𝑥𝑘𝑖 ⊕ 𝑧𝑖𝑘 , 𝑐𝑘𝑅,𝑗 = 𝑥𝑘𝑗 ⊕ 𝑧𝑗𝑘 , 𝑎𝑘𝑅,𝑖 = 𝑎

𝑆 aborts if: *

𝑘

𝑘

* For less than 1/4 fraction of 𝑖 ∈ [2𝜆] ∖ 𝑃 , 𝑐𝑅,𝑖 = 𝑐𝑖 . 𝜖 1 1/3 * 𝑘 𝑘 𝑘 𝑘 * For less than 2 + 2 − 𝜆 fraction of 𝑖 ∈ [2𝜆] ∖ 𝑃 such that 𝑐𝑅,𝑖 = 𝑐𝑖 , 𝑎𝑅,𝑖 = 𝑎𝑖 . • Final transfer. Re-define *

*

𝑐0 = 𝑐𝑘𝑖* , 𝑐1 = 𝑐𝑘𝑗 * ,

*

*

𝑐𝑅,0 = 𝑐𝑘𝑅,𝑖* , 𝑐𝑅,1 = 𝑐𝑘𝑅,𝑗 *

*

*

𝑎𝑅,0 = 𝑎𝑘𝑅,𝑖* , 𝑎𝑅,1 = 𝑎𝑘𝑅,𝑗 *

*

*

𝑧0 = 𝑧𝑖𝑘* , 𝑧1 = 𝑧𝑗𝑘*

𝑎0 = 𝑎𝑘𝑖* , 𝑎1 = 𝑎𝑘𝑗 * , 𝑥0 = 𝑥𝑘𝑖* , 𝑥1 = 𝑥𝑘𝑗* ,

*

*

*

*

*

*

stCom,0 = st𝑘Com,𝑖* , stCom,1 = st𝑘Com,𝑗 * ,

*

*

𝜏0 = 𝜏𝑖𝑘* , 𝜏1 = 𝜏𝑗𝑘* .

– 𝑆 sends {𝑐0 , 𝑐1 } to 𝑅. – Let ̂︀𝑏 ∈ {0, 1} be the unique bit such that 𝑐𝑅,̂︀𝑏 = 𝑐̂︀𝑏 . 𝑅 sends 𝑏′ = 𝑏 ⊕ ̂︀𝑏 to 𝑆. – 𝑆 outputs (𝑟0 := 𝑎𝑏′ , 𝑟1 := 𝑎1−𝑏′ ) and st𝑆 = (𝑏′ , 𝜏0 , 𝜏1 , 𝑐0 , 𝑐1 , 𝑧0 , 𝑧1 ). – 𝑅 outputs 𝑟 := 𝑎𝑅,̂︀𝑏 and st𝑅 = (𝑥0 , 𝑥1 , stCom,0 , stCom,1 ). Ver⟨𝑅(st𝑅 ), 𝑆(𝑏, st𝑆 )⟩: • If VerCom (st𝑆,0 , st𝑅,0 , 𝑥0 ) = ⊥ or VerCom (st𝑆,1 , st𝑅,1 , 𝑥1 ) = ⊥, output ⊥. • Let 𝑐𝑅,0 = 𝑥0 ⊕ 𝑧0 , 𝑐𝑅,1 = 𝑥1 ⊕ 𝑧1 . If 𝑐0 ⊕ 𝑐1 = 𝑐𝑅,0 ⊕ 𝑐𝑅,1 , output ⊥. • Let ̂︀𝑏 be the unique bit such that 𝑐𝑅,̂︀𝑏 = 𝑐̂︀𝑏 . Output ⊤ iff 𝑏 = ̂︀𝑏 ⊕ 𝑏′ . TrapGen(𝜏Setup ): (︁

)︁

{︁

• For each 𝑘 ∈ [𝜆], 𝑖 ∈ [2𝜆], run 𝑥𝑘𝑖 := ExtCom 𝜏𝑖𝑘 . Set td := 𝑥𝑘𝑖

}︁ 𝑖∈[2𝜆]

.

Ext(td, 𝜏 ): • 𝜏 includes 𝑧0 , 𝑧1 , 𝑐0 , 𝑐1 , 𝑏′ and td includes 𝑥0 = 𝑥𝑖* and 𝑥1 = 𝑥𝑗 * . • Let 𝑐𝑅,0 = 𝑥0 ⊕ 𝑧0 , 𝑐𝑅,1 = 𝑥1 ⊕ 𝑧1 . If 𝑐0 ⊕ 𝑐1 = 𝑐𝑅,0 ⊕ 𝑐𝑅,1 , output 0. • Let ̂︀𝑏 be the unique bit such that 𝑐𝑅,̂︀𝑏 = 𝑐̂︀𝑏 . Output ̂︀𝑏 ⊕ 𝑏′ . Lemma 5.5 (Correctness). Protocol 5.2 satisfies Correctness according to Definition 3.8 with 𝜖 = 2𝛽 − 1. Proof. By inspection, and the completeness of the ToNC (Definition 4.1), we have that 𝑟 = 𝑟𝑏 with probability 𝛽 = 21 + 2𝜖 , conditioned on 𝑆 not aborting during one of the iterations of the main loop. So, it remains to show that 𝑆 aborts with negl(𝜆) probability. We will show that 𝑆 aborts in an iteration for any 𝑘 ∈ [𝜆] with negl(𝜆) probability, which establishes the above by a union bound. 34

First, consider the check that for 1/4 fraction of 𝑖 ∈ [2𝜆] ∖ 𝑃 * , 𝑐𝑘𝑅,𝑖 = 𝑐𝑘𝑖 . Since the bits 𝑐𝑘𝑅,𝑖 are masked by the 𝑧𝑖𝑘 , which are sampled uniform and independent of the rest of the protocol, this check fails with probability bounded by the following Hoeffding inequality: #{𝑖 : 𝑐𝑘𝑅,𝑖 ̸= 𝑐𝑘𝑖 }𝑖∈[2𝜆]∖𝑃 * 1 2𝜆 − 2 Pr < ≤ exp −2 2𝜆 − 2 4 16 [︃

]︃

(︂

)︂

= negl(𝜆).

Next, consider the check that for less than 12 + 2𝜖 −𝜆1/3 fraction of 𝑖 ∈ [2𝜆]∖𝑃 * such that 𝑐𝑘𝑅,𝑖 = 𝑐𝑘𝑖 , 𝑎𝑘𝑅,𝑖 = 𝑎𝑘𝑖 . Conditioned on the above, we have that the number of such 𝑖 is at least (2𝜆 − 2)/4. Due to the completeness of ToNC, each event 𝑎𝑘𝑅,𝑖 = 𝑎𝑘𝑖 is an independent Bernoulli random variable with success 12 + 2𝜖 . Thus, this check fails with probability bounded by the following Hoeffding inequality: [︃

Pr

#{𝑖 : 𝑐𝑘𝑅,𝑖 = 𝑐𝑘𝑖 ∧ 𝑎𝑘𝑅,𝑖 = 𝑎𝑘𝑖 } #{𝑖 : 𝑐𝑘𝑅,𝑖 = 𝑐𝑘𝑖 }

]︃

1 𝜖 2𝜆 − 2 < + − 𝜆1/3 ≤ exp −2 2/3 2 2 4𝜆 (︂

)︂

= negl(𝜆).

It is easy to check that all other abort conditions happen with negl(𝜆) probability, so we can conclude that 𝑟 = 𝑟𝑏 with probability at least 12 + 2𝜖 − negl(𝜆). Lemma 5.6 (Completeness). Protocol 5.2 satisfies Completeness according to Definition 3.8. Proof. This follows directly from the correctness of the commitment scheme (Definition 3.3). Lemma 5.7 (Receiver security). Protocol 5.2 satisfies Receiver security according to Definition 3.8 with 𝛾 =0. Proof. This follows from the hiding of the commitment scheme (Definition 3.3). Indeed, the only information that 𝑆 receives about 𝑏 is masked by ̂︀𝑏, which is determined by 𝑥𝑖* , 𝑥𝑗 * as well as public information in the transcript. 𝑆 receives 𝑥𝑖* ⊕ 𝑥𝑗 * , which fixes 𝑥𝑖* , 𝑥𝑗 * to either {00, 11} or {01, 10}. In either case, ̂︀𝑏 (along with other public information) is determined by which of the two strings was committed to. By a standard hybrid argument, commitments to 00 and 11 can only be distinguished with negl(𝜆) advantage and likewise for commitments to 01 and 10. This completes the proof. Lemma 5.8 (Sender security). Protocol 5.2 satisfies Sender security according to Definition 3.8 for any constant 𝛿 ′ > 2𝛿 − 𝜖. Proof. Sender security for committed-bit OT has two requirements. The second follows directly from the binding of the commitment scheme (Definition 3.3), so it remains to establish the first. ̃︀ init , 𝑅) ̃︀ that has 𝛿 ′ advantage in the first part of sender We exhibit a reduction that takes any (𝑅 security and produces a non-uniform commuting prover that has 12 (𝜖 + 𝛿 ′ ) − 𝑜(1) advantage in the soundness game of the ToNC. When 𝛿 ′ = 2𝛿 − 𝜖 + Ω(1), this yields an adversary with advantage 𝛿 + Ω(1), a contradiction. Our non-uniform ToNC prover (𝑃init , 𝑃Prep , 𝑃0 , 𝑃1 ) is specified as follows, where 𝑃init is a potentiallyinefficient operation that runs prior to the beginning of the interaction with the verifier, and outputs a quantum state. Note that this model of non-uniform adversary with quantum advice is identical to the model where we allow 𝑃Prep to be initialized with a (potentially inefficientlycomputable) mixed state 𝜌. 𝑃init : 35

• Run the following loop until it succeeds: {︁

̃︀ init , 𝑆(1𝜆 )⟩ and td := TrapGen(𝜏Setup ). Parse td as 𝑥𝑘 – Run init𝑅 , 𝜏Setup ← Setup⟨𝑅 𝑖

}︁ 𝑘∈[𝜆],𝑖∈[2𝜆]

̃︀ during the “answer commitment” phase of OT. – Interact with 𝑅

– For each 𝑘 ∈ [𝜆], 𝑖 ∈ [2𝜆], run 𝑦𝑖𝑘 := ExtCom (𝜏𝑖′ ). ̃︀ during the “pair commitment”, and “main loop” phases of OT up until – Interact with 𝑅 the beginning of the 𝑘 * ’th loop.

– If there has not been an abort yet, then declare success and move on, otherwise try the loop again. 𝑃Prep : ̃︀ as 𝑉Prep in the protocol • Sample 𝑖* ← [𝜆]. For each 𝑖 ∈ [2𝜆], interact with 𝑅 *

(︁

|𝜓𝑖 ⟩ , 𝑐𝑘𝑖 , 𝑎𝑘𝑖

*

)︁

̃︀ 𝑉Prep (1𝜆 )⟩, ← ⟨𝑅,

except that for the {︁ 𝑖* ’th instance, 𝑃 forwards the message to its own external challenger. }︁ * * * * 𝑘 𝑘 but not 𝑐𝑘𝑖* , 𝑎𝑘𝑖* . Note that 𝑃 knows 𝑐𝑖 , 𝑎𝑖 * 𝑖̸=𝑖

*

{︁

*

̃︀ and receive 𝑎 ̂︀𝑘𝑖 • Sample 𝑧 𝑘 ← {0, 1}2𝜆 , send 𝑧 𝑘 to 𝑅, *

*

*

}︁

*

𝑖∈[2𝜆]

*

*

*

. Set 𝑐𝑘𝑅,𝑖* := 𝑥𝑘𝑖* ⊕ 𝑧𝑖𝑘* and

̂︀𝑘𝑖* ⊕ 𝑦𝑖𝑘* . 𝑎𝑘𝑅,𝑖* := 𝑎

𝑃𝑐𝑅,𝑖* *

• In this case, the external challenge 𝑐 = 𝑐𝑘𝑅,𝑖* . *

• Output 𝑎′ := 𝑎𝑘𝑅,𝑖* . 𝑃1−𝑐𝑅,𝑖* *

• In this case, the external challenge 𝑐 = 1 − 𝑐𝑘𝑅,𝑖* . • In what follows, if there is an abort, then output a uniformly random bit. *

*

*

*

• Set 𝑐𝑘𝑖* := 𝑐 and for 𝑖 ∈ [2𝜆], set 𝑐𝑘𝑅,𝑖 := 𝑥𝑘𝑖 ⊕ 𝑧𝑖𝑘 . Sample 𝑗 * uniformly at random such that * * * * * * 𝑐𝑘𝑅,𝑖* ⊕ 𝑐𝑘𝑅,𝑗 * ̸= 𝑐𝑘𝑖* ⊕ 𝑐𝑘𝑗 * , meaning 𝑐𝑘𝑅,𝑗 * = 𝑐𝑘𝑗 * , and set 𝑃 * := {𝑖* , 𝑗 * }. Partition the rest of [2𝜆] ∖ 𝑃 * uniformly at random to form 𝒫. {︁

*

̃︀ receive 𝑥𝑘 • Send 𝒫 to 𝑅, 𝑖,𝑗

}︁ {𝑖,𝑗}∈𝒫

, and abort if (︁

*

*

)︁

𝑘 VerCom st𝑘Com,{𝑖,𝑗} , 𝜏{𝑖,𝑗} , 𝑥𝑖,𝑗 = ⊥

̃︀ and receive for any {𝑖, 𝑗} ∈ 𝒫. Send 𝑃 * to 𝑅 *

*

*

*

*

𝑘*

*

𝑘*

𝑥𝑘𝑖 , st𝑘Com,𝑖 , 𝑥𝑘𝑗 , st𝑘Com,𝑗 , 𝑦𝑖𝑘 , st′ Com,𝑖 , 𝑦𝑗𝑘 , st′ Com,𝑗 for each {𝑖, 𝑗} ∈ 𝒫 ∖ 𝑃 * . Perform the remainder of the abort checks implemented by 𝑆.

36

.

{︁

*

*

• Send 𝑐𝑘𝑖* , 𝑐𝑘𝑗 *

}︁

*

̃︀ and let 𝑟1−𝑏 be 𝑅 ̃︀ ′ 𝑠 final output. Output 𝑎′ := 𝑟1−𝑏 . and 𝑟𝑏 := 𝑎𝑘𝑗 * to 𝑅,

Note that the operations 𝑃0 and 𝑃1 are commuting by definition, since one of them directly outputs a classical bit stored in memory. The fact that this adversary has advantage 12 (𝜖 + 𝛿) − 𝑜(1) in guessing the external verifier’s bit 𝑎* follows from the following sequence of observations. ̃︀ view given by the reduction is the same as its view in its real interaction with 𝑆 except • 𝑅’s that:

– It is conditioned on not aborting (that is, causing 𝑆 to abort) during the first 𝑘 * − 1 runs of the main loop. *

*

*

– It potentially differs in the event that 𝑥𝑘𝑖* ,𝑗 * ̸= 𝑥𝑘𝑖* ⊕ 𝑥𝑘𝑗 * but 𝑆 does not abort in the 𝑘 * ’th loop. Note that the probability that the above event occurs is 1/𝜆 + negl(𝜆) = 𝑜(1) due to the cut-and-choose on pair commitments and the binding of the commitment scheme. • Note that, conditioned on 𝑆 aborting, any adversary’s advantage in the first part of sender ̃︀ has non-zero constant advantage, it has a non-zero consecurity is exactly 0. Thus, since 𝑅 stant probability of not aborting, and thus 𝑃init ’s loop will terminate in finite time. Moreover, ̃︀ probability of aborting in the 𝑘 * ’th loop consince 𝑘 * is sampled uniformly at random, 𝑅’s ditioned on not aborting in the first 𝑘 * − 1 loops is bounded by 1/𝜆 = 𝑜(1). Finally, this also ̃︀ advantage conditioned on not aborting must be at least 𝛿. implies that 𝑅’s *

*

*

• Since 𝑧𝑖𝑘* is uniformly random, 𝑐𝑘 = 𝑐𝑘𝑅,𝑖* with probability exactly 1/2, and thus the prover runs 𝑃𝑐𝑘* * and 𝑃1−𝑐𝑘* * each with probability 1/2. 𝑅,𝑖

𝑅,𝑖

*

• First condition on 𝑐 = 𝑐𝑘𝑅,𝑖* . Due to the fact that 𝑆 does not abort except with probability 𝑜(1), the binding of the commitment scheme, and the fact that 𝑖* is uniformly random conditioned * * on 𝑐𝑘𝑅,𝑖* = 𝑐𝑘𝑖* , we have that 𝑎′ = 𝑎* with advantage 𝜖 − 𝑜(1). *

̃︀ advantage conditioned on not aborting • Next condition on 𝑐 = 1 − 𝑐𝑘𝑅,𝑖* . By the fact that 𝑅’s ̃︀ view is consistent with its real view conditioned on not is at least 𝛿 and the fact that 𝑅’s * aborting except with probability 𝑜(1), we have that conditioned on 𝑐 = 1 − 𝑐𝑘𝑅,𝑖* , 𝑎′ = 𝑎* with advantage 𝛿 − 𝑜(1).

6

Hardness amplification

6.1

Post-quantum hard-core measure theorem

Fix a deterministic predicate 𝑃 : {0, 1}𝑛 → {0, 1} and any randomized classical circuit 𝐶(𝑥, 𝑏) that is intended to output 1 when 𝑏 = 𝑃 (𝑥) and 0 otherwise. Theorem 3 in [HS11] (which is similar in spirit to Lemma 2.4 from [Hol05]) shows that one can decompose the input space relative to this particular 𝐶 into a large “hard” subset of the domain 𝑆 ⊆ {0, 1}𝑛 of probability mass 𝛿 and its complement. That is, on 𝑆, 𝐶’s acceptance probability is essentially insensitive to whether 𝑏 = 𝑃 (𝑥) or 𝑏 = 1 − 𝑃 (𝑥), meaning that flipping 𝑃 on 𝑆 is nearly indistinguishable to 𝐶. Moreover, one can convert 𝐶 into an explicit predictor 𝑄 that recovers 𝑃 (𝑥) with an overall success at least 1 − 𝛿/2 on the entire domain. We prove a variation of [HS11, Theorem 3] which differs in the following respects. 37

• Post-quantum setting. We allow the distinguisher 𝐶 to be a quantum circuit, and thus the resulting predictor 𝑄 is quantum. • Arbitrary input distributions. Rather than working only with the uniform distribution over {0, 1}𝑛 , we formulate the statement with respect to an arbitrary distribution 𝒟 over inputs. • A measure rather than a hard set. As a consequence of allowing a quantum distinguisher 𝐶, we construct a quantum predictor which maps a pair (𝑥, 𝑃 (𝑥)) probabilistically to a bit. Since the predictor is non-deterministic, it does not immediately give rise to a hard subset. Instead, its prediction statistics constitute a sub-distribution measure of 𝒟 (as in Definition 3.1) that designates the portion of the domain on which 𝐶 is insensitive to flipping 𝑃 . The measure is explicitly constructed in Corollary 6.3. The measure vs. set discrepancy comes from the fact that the proof in [HS11] relies on derandomizing the distinguisher 𝐶 through fixing a set 𝑅 of random seeds. Evaluations of 𝐶(𝑥, 𝑟) on any 𝑟 ∈ 𝑅 are used to compute a criterion which determines whether 𝑥 ∈ 𝑆—thus 𝑆 becomes a deterministic set. Such derandomization is impossible in our setting, where 𝐶 is no longer classical. However, shifting to working with a measure enables recovering analogous results in this setting as well. Next, we define a function that will be used in the Theorem’s statement. Definition.

For parameters 𝜏 ∈ R and 𝜉 > 0, define

Soft𝜏,𝜉 (𝑡) :=

⎧ ⎪ 1, ⎪ ⎪ ⎨

𝜏 −𝑡

𝜉 ⎪ ⎪ ⎪ ⎩0,

𝑡 ≤ 𝜏 − 𝜉, ,

𝜏 − 𝜉 < 𝑡 < 𝜏, 𝑡 ≥ 𝜏.

Soft𝜏,𝜉 (𝑡) ∈ [0, 1] and it is 1/𝜉-Lipschitz in 𝑡 and also 1/𝜉-Lipschitz in 𝜏 (for each fixed 𝑡). Soft𝜏,𝜉 (𝑡) can be thought of as a “soft indicator” of being in the hard region: it is 1 when 𝑡 is clearly below 𝜏 , it is 0 when 𝑡 is above 𝜏 , and it interpolates linearly in a narrow boundary band. Theorem 6.1 (A generalization of Theorem 3 in [HS11]). Let there be: • A function 𝑛 : N → N, such that 𝑛(𝜆) = poly(𝜆). • A family of predicates {𝑃𝜆 }𝜆∈N , where 𝑃𝜆 : {0, 1}𝑛(𝜆) → {0, 1}. • A family of distributions {𝒟𝜆 }𝜆∈N , where 𝒟𝜆 is over {0, 1}𝑛(𝜆) , such that the following min-entropy condition holds: for 𝑚(𝜆) := max{𝐷𝜆 (𝑧) | 𝑧 ∈ {0, 1}𝑛(𝜆) }, it holds that 𝑚(𝜆) ≤ negl(𝜆). • A family of samplers {Samp𝜆 }𝜆∈N such that Samp𝜆 outputs (𝑥, 𝑃𝜆 (𝑥)) where 𝑥 is sampled from 𝐷𝜆 . Samp runs in time poly(𝜆). Consider any function 𝜀 : N → (0, 1) satisfying 𝜀(𝜆) = 1/poly(𝜆). Then there exists a uniform quantum polynomial-time oracle algorithm Gen such that for every security parameter value 𝜆 and every quantum circuit 𝒞 : {0, 1} 𝑛(𝜆)+1 → {0, 1}, on input (𝜀(𝜆), 1𝜆 ) and with oracle access to 𝒞, Gen outputs: • A parameter 𝜉 > 0 and a threshold 𝜏 ∈ [0, 1 + 𝜉]. 38

• Quantum circuits 𝑆, 𝑄 with oracle access to 𝒞, • a parameter 𝛿 ∈ [0, 1], such that except with probability negl(𝜆) over measurements of Gen𝒞 , the following properties hold14 . For 𝑥 ∈ {0, 1}𝑛(𝜆) and 𝑏 ∈ {0, 1} define the pointwise gaps Δ𝑥 := 𝑝𝑥 (𝑃 (𝑥)) − 𝑝𝑥 (1 − 𝑃 (𝑥)),

𝑝𝑥 (𝑏) := Pr[𝒞(𝑥, 𝑏) = 1], and define the global gap [︀

]︀

[︀

]︀

Δ := Pr 𝒞(𝑥, 𝑃 (𝑥)) = 1 − Pr 𝒞(𝑥, 1 − 𝑃 (𝑥)) = 1 = 𝑥←𝒟

𝑥←𝒟

E [Δ𝑥 ].

𝑥←𝒟

Additionally, denote 𝑤𝜏 (𝑥) := Soft𝜏,𝜉 (Δ𝑥 ) ∈ [0, 1],

𝛿𝜏 := E [𝑤𝜏 (𝑥)]. 𝑥←𝒟

1. (Correct mass). For every fixed 𝑥, Pr[𝑆(𝑥, 𝑃 (𝑥)) = 1] = 𝑤𝜏 (𝑥) ± (𝜀/200 + negl(𝜆)). Moreover, Gen’s output 𝛿 satisfies 𝛿𝜏 − 𝜖/200 ≤ 𝛿 ≤ 𝛿𝜏 . 2. (Indistinguishability). Let 𝑃 ′ (𝑥) be the randomized predicate 𝑃 ′ (𝑥) := 𝑃 (𝑥) ⊕ 𝑆(𝑥, 𝑃 (𝑥)), then ⃒ ⃒ ⃒ [︀ ]︀ [︀ ]︀⃒ ⃒ Pr 𝒞(𝑥, 𝑃 (𝑥)) = 1 − Pr 𝒞(𝑥, 𝑃 ′ (𝑥)) = 1 ⃒ ≤ 𝜀. ⃒𝑥←𝒟 ⃒ 𝑥←𝒟

3. (Predictability). The circuit 𝑄 satisfies [︀

]︀

Pr 𝑄(𝑥) = 𝑃 (𝑥) ≥ 1 −

𝑥←𝒟

𝛿 − negl(𝜆). 2

4. (Obliviousness). The circuit 𝑄(𝑥) can be written as 𝑄𝐶(𝑥,·),𝐶(·,·) . That is, the underlying oracle circuit 𝑄 is fixed and independent of 𝑥, and it utilizes 𝑥 only within a fixed, 𝑥-independent procedure of oracle queries to 𝐶(𝑥, ·). In this sense, 𝑄 is oblivious to 𝑥. There exist fixed polynomials 𝑞(·, ·) and 𝑟(·, ·) such that the oracle circuits 𝑆, 𝑄: • make at most 𝑞(𝜆, 1/𝜀) oracle calls to 𝒞, and • the remaining circuit has size at most 𝑟(𝜆, 1/𝜀). ̂︀ Consequently, after hardwiring 𝒞 and replacing each oracle gate by a copy of 𝒞, the compiled circuit 𝑄 satisfies ̂︀ ≤ 𝑞(𝜆, 1/𝜀) · |𝒞| + 𝑟(𝜆, 1/𝜀), |𝑄| ̂︀ and similarly for 𝑆.

Proof. Fix 𝜆. All probabilities over 𝒞, 𝑆, 𝑄 are over their internal measurements. Fix 𝜈 ≤ negl(𝜆). Given (𝑥, 𝑏) and accuracy 𝛼 > 0, using Chernoff’s bound, one can estimate 𝑝𝑥 (𝑏) to within ±𝛼 with failure probability at most 𝜈 by running 𝒞(𝑥, 𝑏) independently 𝑇 = Θ(log(1/𝜈)/𝛼2 ) times and taking the empirical mean. The same holds for the gap Δ(𝑏) 𝑥 := 𝑝𝑥 (𝑏) − 𝑝𝑥 (1 − 𝑏), up to constant factors. 14

Fix 𝜆 and suppress the subscript 𝜆.

39

Normalizing the global gap. Using poly(𝜆, 1/𝜀) samples (𝑥, 𝑃 (𝑥)) ← Samp and a constant number of calls to 𝒞 per sample, estimate Δ to within ±𝜀/20 except with probability negl(𝜆). If the ̂︀ satisfies |Δ| ̂︀ ≤ 𝜀/10, output 𝛿 := 1, 𝜉 := 𝜀2 /1000, 𝜏 := 1 + 𝜉, let 𝑆 always output 1, and estimate Δ ̂︀ < −𝜀/10, replace let 𝑄 output a uniform bit. All four conclusions are immediate. Otherwise, if Δ 𝒞 by 1 − 𝒞. Henceforth assume Δ ≥ 𝜀/20. Defining a function 𝐹 .

Fix 𝜉 := 𝜀2 /1000.

For 𝜏 ∈ R, recall 𝑤𝜏 (𝑥) := Soft𝜏,𝜉 (Δ𝑥 ) and define the associated function [︀

]︀

𝐹 (𝜏 ) := E𝑥←𝒟 Δ𝑥 · 𝑤𝜏 (𝑥) . We will apply the intermediate value theorem on the interval [0, 1 + 𝜉]. First, 𝐹 (0) ≤ 0, since for any 𝑥 such that 𝑤0 (𝑥) ̸= 0, necessarily Δ𝑥 < 0. Second, for all Δ𝑥 ∈ [−1, 1] we have Soft1+𝜉,𝜉 (Δ𝑥 ) = 1, hence 𝐹 (1 + 𝜉) = E𝑥←𝒟 [Δ𝑥 ] = Δ. The map 𝜏 ↦→ 𝐹 (𝜏 ) is continuous, and by Step 0 we have Δ ≥ 𝜀/20. Therefore there exists 𝜏 ⋆ ∈ [0, 1 + 𝜉] such that 𝜀 𝐹 (𝜏 ⋆ ) = . (8) 25 A mean-correct estimator for 𝐹 (𝜏 ).

Fix 𝛼 := 𝜉𝜀/800.

For each sampled (𝑥, 𝑃 (𝑥)), compute two independent estimates of Δ𝑥 : ̂︀ (𝐴) Δ 𝑥

̂︀ (𝐵) , and Δ 𝑥

(·)

̂︀ 𝑥 − Δ | ≤ 𝛼, except with probability at most 𝜈. Define each satisfying |Δ 𝑥 ̂︀ (𝐴) ∈ [−1, 1]. ̂︀ (𝐵) · Soft 𝑌𝜏 (𝑥) := Δ 𝜏,𝜉 Δ𝑥 𝑥 (︀

)︀

Let 𝑋 ∼ 𝒟 and define 𝜇𝜏 := E[𝑌𝜏 (𝑋)]. Lemma 6.2 (Mean correctness). For every 𝜏 ∈ R, |𝜇𝜏 − 𝐹 (𝜏 )| ≤ 𝛼/𝜉 + 𝜈. (𝐵)

̂︀ 𝑥 Proof. Condition on 𝑋 = 𝑥. Because Δ (𝐴) ̂︀ 𝑥 , we have independent of Δ

is an unbiased estimator of Δ𝑥 conditioned on 𝑥 and is

[︁

)︀ ⃒⃒

]︁

̂︀ (𝐴) ⃒ 𝑋 = 𝑥 . E[𝑌𝜏 (𝑋) | 𝑋 = 𝑥] = Δ𝑥 · E Soft𝜏,𝜉 Δ 𝑥

40

(︀

(𝐴)

̂︀ 𝑥 The function 𝑡 ↦→ Soft𝜏,𝜉 (𝑡) is 1/𝜉-Lipschitz, hence on the event |Δ

− Δ𝑥 | ≤ 𝛼 we have

⃒ ⃒ ⃒ ̂︀ (𝐴) ) − Soft (Δ )⃒⃒ ≤ 𝛼/𝜉. ⃒Soft𝜏,𝜉 (Δ 𝑥 𝜏,𝜉 𝑥

This event fails with probability at most 𝜈, and Soft𝜏,𝜉 (·) ∈ [0, 1]. Therefore ⃒ [︁ ⃒ ]︁ ⃒ ̂︀ (𝐴) ) | 𝑋 = 𝑥 − Soft (Δ )⃒⃒ ≤ 𝛼/𝜉 + 𝜈. ⃒E Soft𝜏,𝜉 (Δ 𝑥 𝜏,𝜉 𝑥

Multiplying by |Δ𝑥 | ≤ 1 and averaging over 𝑥 ∼ 𝒟 yields the claim. Choosing 𝜏 .

Choose a grid step 𝜌 := 𝜉𝜀/800

and define a grid ⌊︂

𝒯 := {𝑗𝜌 : 𝑗 = 0, 1, . . . , 𝑁 } ∪ {1 + 𝜉},

𝑁 :=

1+𝜉 , 𝜌 ⌋︂

so that 𝒯 ⊆ [0, 1 + 𝜉]. For each 𝜏 ∈ 𝒯 , estimate 𝜇𝜏 by sampling 𝑚 = poly(𝜆, 1/𝜀) independent points from Samp, computing 𝑌𝜏 (·) for each point independently, and averaging: 1 𝐹̂︀ (𝜏 ) :=

𝑚 ∑︁

𝑚 𝑖=1

𝑌𝜏 (𝑥𝑖 ).

Output the smallest 𝜏 ∈ 𝒯 such that 𝜀 ]︁ . (9) 100 20 Hoeffding’s bound (since each 𝑌𝜏 ∈ [−1, 1]) implies that there exists 𝑚 = poly(𝜆, 1/𝜀) such that |𝐹̂︀ (𝜏 ) − 𝜇𝜏 | ≤ 𝜀/800 except with probability 𝜈. Union bounding over 𝜏 ∈ 𝒯 , and using Lemma 6.2, we obtain that except with probability negl(𝜆), 𝐹̂︀ (𝜏 ) ∈

[︁ 𝜀

,

|𝐹̂︀ (𝜏 ) − 𝐹 (𝜏 )| ≤ |𝐹̂︀ (𝜏 ) − 𝜇𝜏 | + |𝜇𝜏 − 𝐹 (𝜏 )| ≤ 𝜀/400 + 𝜈

for all 𝜏 ∈ 𝒯 .

(10)

Denote this good event by 𝒢. We next argue that (9) has at least one solution. By (8) there exists 𝜏,𝜉 (𝑡) is 1/𝜉-Lipschitz, we have

𝜏 ⋆ with 𝐹 (𝜏 ⋆ ) = 𝜀/25. Since for each fixed 𝑡 the map 𝜏 ↦→ Soft |𝐹 (𝜏 ) − 𝐹 (𝜏 ′ )| ≤ |𝜏 − 𝜏 ′ |/𝜉

for all 𝜏, 𝜏 ′ .

Hence there exists 𝜏̃︀ ∈ 𝒯 with |𝐹 (𝜏̃︀) − 𝐹 (𝜏 ⋆ )| ≤ 𝜌/𝜉 = 𝜀/800. Together with (10), this implies 𝐹̂︀ (𝜏̃︀) ∈ [𝜀/100, 𝜀/20]. For any 𝜏 ∈ 𝒯 satisfying (9), on 𝒢, 3𝜀 𝜀 −𝜈 ≥ − 𝜈, 400 150 𝜀 + 𝜈. 𝐹 (𝜏 ) ≤ 𝐹̂︀ (𝜏 ) + 𝜀/400 + 𝜈 ≤ 𝜀/20 + 𝜀/400 + 𝜈 ≤ 10 Therefore, except with probability negl(𝜆), the 𝜏 output by Gen𝒞 satisfies (11): 𝐹 (𝜏 ) ≥ 𝐹̂︀ (𝜏 ) − 𝜀/400 − 𝜈 ≥ 𝜀/100 − 𝜀/400 − 𝜈 =

𝜀 𝜀 𝜀 − 𝜈 ≤ 𝐹 (𝜏 ) ≤ +𝜈 and 𝜏 ≥ − 𝜈. 150 10 150 The lower bound on 𝜏 follows since on the support of 𝑤𝜏 we have Δ𝑥 ≤ 𝜏 , hence 𝐹 (𝜏 ) = E[Δ𝑥 𝑤𝜏 (𝑥)] ≤ 𝜏 · E[𝑤𝜏 (𝑋)] ≤ 𝜏. 41

(11)

Defining 𝑆 and outputting 𝛿.

We define the circuit 𝑆:

A quantum circuit S The circuit takes an input (𝑥, 𝑏) ∈ {0, 1}𝑛(𝜆)+1 . (𝑏)

(𝑏)

̂︀ 𝑥 ; 1. estimates Δ𝑥 := 𝑝𝑥 (𝑏) − 𝑝𝑥 (1 − 𝑏) within ±𝛼 except with probability negl(𝜆), obtaining Δ (𝑏)

̂︀ 𝑥 ). 2. outputs 1 with probability Soft𝜏,𝜉 (Δ

Let 𝑤(𝑥) := Soft𝜏,𝜉 (Δ𝑥 )

and

𝛿𝜏 := E[𝑤𝜏 (𝑋)].

Because Soft𝜏,𝜉 is 1/𝜉-Lipschitz, for every fixed 𝑥: Pr[𝑆(𝑥, 𝑃 (𝑥)) = 1 | 𝑥] = Soft𝜏,𝜉 (Δ𝑥 ) ± (𝛼/𝜉 + negl(𝜆)) = 𝑤𝜏 (𝑥) ± (𝜀/800 + negl(𝜆)).

(12)

Independently sample 𝑚𝛿 = poly(𝑛, 1/𝜀) points 𝑥1 , . . . , 𝑥𝑚𝛿 ∼ 𝒟 via Samp. For each 𝑥𝑖 , estimate ̂︀ , and form Δ𝑥𝑖 within ±𝛼 (except with probability negl(𝜆)), obtaining Δ 𝑥𝑖 ̂︀ ) ∈ [0, 1]. 𝑍𝑖 := Soft𝜏,𝜉 (Δ 𝑥𝑖

Let

𝑚

𝛿̂︀ :=

𝛿 1 ∑︁ 𝑍𝑖 . 𝑚𝛿 𝑖=1

̂︀ − Δ | ≤ 𝛼 the 1/𝜉Recall 𝛿𝜏 = E𝑋∼𝒟 [𝑤𝜏 (𝑋)]. Conditioning on 𝑥𝑖 = 𝑥, on the good event |Δ 𝑥 𝑥 ⃒ ⃒ ̂︀ ⃒ ⃒ Lipschitz property gives Soft𝜏,𝜉 (Δ𝑥 ) − Soft𝜏,𝜉 (Δ𝑥 ) ≤ 𝛼/𝜉, whereas on the bad event we have Soft𝜏,𝜉 (·) ∈ [0, 1]. Hence ⃒ ⃒

⃒ ⃒

̂︀ ) | 𝑥 = 𝑥] − Soft (Δ )⃒ ≤ 𝛼/𝜉 + 𝜈, |E[𝑍𝑖 | 𝑥𝑖 = 𝑥] − 𝑤(𝑥)| = ⃒E[Soft𝜏,𝜉 (Δ 𝑥 𝑖 𝑥 𝜏,𝜉

and averaging over 𝑥 ∼ 𝒟 yields ⃒ ⃒ ⃒E[𝑍𝑖 ] − 𝛿𝜏 ⃒ ≤ 𝛼/𝜉 + 𝜈.

Moreover, since 𝑍𝑖 ∈ [0, 1] are i.i.d., Hoeffding’s inequality implies that there exists 𝑚𝛿 = poly(𝑛, 1/𝜀) such that, except with probability 𝜈, ⃒ ⃒ ⃒ ̂︀ ⃒ ⃒𝛿 − E[𝑍𝑖 ]⃒ ≤ 𝜀/800.

Thus, by the triangle inequality, except with probability negl(𝜆), |𝛿̂︀ − 𝛿𝜏 | ≤ |𝛿̂︀ − E[𝑍𝑖 ]| + | E[𝑍𝑖 ] − 𝛿𝜏 | ≤ 𝜀/800 + 𝛼/𝜉 + 𝜈 ≤ 𝜀/400 + 𝜈, where we used 𝛼/𝜉 = 𝜀/800. Define 𝛿 := max{0, 𝛿̂︀ − 𝜀/400}. Then (except with probability negl(𝜆)) we have 𝛿 ≤ 𝛿𝜏 and 0 ≤ 𝛿𝜏 − 𝛿 ≤ 𝜀/200, hence also |𝛿 − 𝛿𝜏 | ≤ 𝜀/200. 42

Define

Indistinguishability.

𝑃 ′ (𝑥) := 𝑃 (𝑥) ⊕ 𝑆(𝑥, 𝑃 (𝑥))

By definition of 𝑃 ′ , for a fixed 𝑥, Pr[𝒞(𝑥, 𝑃 (𝑥)) = 1] − Pr 𝒞(𝑥, 𝑃 ′ (𝑥)) = 1 = Pr[𝑆(𝑥, 𝑃 (𝑥)) = 1 | 𝑥] · Δ𝑥 . [︀

]︀

Averaging over 𝑥 ∼ 𝒟 gives Pr [𝒞(𝑥, 𝑃 (𝑥)) = 1] − Pr [𝒞(𝑥, 𝑃 ′ (𝑥)) = 1] = E𝑥∼𝒟 Δ𝑥 · Pr[𝑆(𝑥, 𝑃 (𝑥)) = 1 | 𝑥] . [︀

𝑥∼𝒟

]︀

𝑥∼𝒟

Due to (12), replacing Pr[𝑆(𝑥, 𝑃 (𝑥)) = 1 | 𝑥] by 𝑤(𝑥) = Soft𝜏,𝜉 (Δ𝑥 ) incurs an error smaller than 𝜀/200 + negl(𝜆), hence the right-hand side equals 𝐹 (𝜏 ) ± (𝜀/200 + negl(𝜆)). Using (11), its absolute value is at most 𝜀/10 + 𝜀/200 + negl(𝜆) ≤ 𝜀. Predictability.

Define 𝑔𝑥 := 𝑝𝑥 (1) − 𝑝𝑥 (0).

Then for every 𝑥, 𝑔𝑥 = (2𝑃 (𝑥) − 1)Δ𝑥 ,

(2𝑃 (𝑥) − 1) 𝑔𝑥 = Δ𝑥 ,

equivalently

|𝑔𝑥 | = |Δ𝑥 |.

A quantum circuit Q The circuit takes an input 𝑥 ∈ {0, 1}𝑛(𝜆) . 1. Estimates 𝑔𝑥 to within ±𝛼 with failure probability at most 𝜈 ≤ negl(𝜆), obtaining a random estimate 𝑔̂︀𝑥 satisfying ⃒ ]︀ [︀ Pr |𝑔̂︀𝑥 − 𝑔𝑥 | ≤ 𝛼 ⃒ 𝑥 ≥ 1 − 𝜈. (13) 2. Outputs a bit according to the following randomized rule (depending only on 𝑔̂︀𝑥 ):

𝑄(𝑥) :=

⎧ ⎪ 1, ⎪ ⎪ ⎨

𝑔̂︀𝑥 ≥ 𝜏, 𝑔̂︀𝑥 ≤ −𝜏,

0,

⎪ (︁ )︁ ⎪ ⎪ 𝑔𝑥 ⎩1 with prob. 1 1 + ̂︀ , 𝜏

2

A Lipschitz bound.

otherwise.

Fix 𝑥 and 𝑏 ∈ {0, 1}. Define ⃒

[︀

]︀

𝜑𝑏 (𝑡) := Pr 𝑄(𝑥) = 𝑏 ⃒ 𝑔̂︀𝑥 = 𝑡 . 1 1 By inspection, 𝜑𝑏 is piecewise linear with slope in − 2𝜏 , 2𝜏 ; hence it is 1/(2𝜏 )-Lipschitz :

[︀

|𝑡 − 𝑡′ | 2𝜏

|𝜑𝑏 (𝑡) − 𝜑𝑏 (𝑡′ )| ≤

]︀

∀ 𝑡, 𝑡′ ∈ R.

(14)

Let ℰ𝑥 := {|𝑔̂︀𝑥 − 𝑔𝑥 | ≤ 𝛼}. On the event ℰ𝑥 , 𝛼 , 2𝜏 using (14). Taking expectation conditioned on 𝑥 and ℰ𝑥 gives 𝜑𝑃 (𝑥) (𝑔̂︀𝑥 ) ≥ 𝜑𝑃 (𝑥) (𝑔𝑥 ) −

[︀

]︀

[︀

]︀

Pr 𝑄(𝑥) = 𝑃 (𝑥) | 𝑥, ℰ𝑥 = E 𝜑𝑃 (𝑥) (𝑔̂︀𝑥 ) | 𝑥, ℰ𝑥 ≥ 𝜑𝑃 (𝑥) (𝑔𝑥 ) −

𝛼 . 2𝜏

Removing the conditioning on ℰ𝑥 incurs a loss of at most 𝜈: [︀

]︀

Pr 𝑄(𝑥) = 𝑃 (𝑥) | 𝑥 ≥ 𝜑𝑃 (𝑥) (𝑔𝑥 ) − 43

𝛼 − 𝜈. 2𝜏

(15)

Exact success when 𝑔̂︀𝑥 = 𝑔𝑥 .

Define the function 𝑠𝜏 : R → [0, 1] by ⎧ ⎪ 1, ⎪ ⎪ ⎨ (︀ )︀ 𝑠𝜏 (𝑢) := 21 1 + 𝑢𝜏 , ⎪ ⎪ ⎪ ⎩0,

𝑢 ≥ 𝜏, |𝑢| < 𝜏, 𝑢 ≤ −𝜏.

Observe that (︀

)︀

𝜑𝑃 (𝑥) (𝑔𝑥 ) = 𝑠 (2𝑃 (𝑥) − 1)𝑔𝑥 = 𝑠𝜏 (Δ𝑥 ),

(16)

using (2𝑃 (𝑥) − 1)𝑔𝑥 = Δ𝑥 . Combining (15) and (16) yields, for every 𝑥, [︀

]︀

Pr 𝑄(𝑥) = 𝑃 (𝑥) | 𝑥 ≥ 𝑠𝜏 (Δ𝑥 ) −

𝛼 − 𝜈. 2𝜏

(17)

A pointwise comparison using the soft weight. Assume, as ensured by our parameter choices in Step 3, that 𝜏 ≥ 𝜉. We claim that for every Δ𝑥 ∈ [−1, 1], 𝑠𝜏 (Δ𝑥 ) ≥ 1 −

Soft𝜏,𝜉 (Δ𝑥 ) Δ𝑥 Soft𝜏,𝜉 (Δ𝑥 ) 𝜉 + − . 2 2𝜏 8𝜏

(18)

Proof of (18). We consider three cases. Case 1: Δ𝑥 ≥ 𝜏 . Then Soft𝜏,𝜉 (Δ𝑥 ) = 0 and the right-hand side equals 1 − 𝜉/(8𝜏 ) ≤ 1 = 𝑠𝜏 (Δ𝑥 ). Case 2: Δ𝑥 ≤ 𝜏 − 𝜉. Then Soft𝜏,𝜉 (Δ𝑥 ) = 1 and the right-hand side is 1 Δ𝑥 1+ 2 𝜏 (︂

)︂

−

𝜉 . 8𝜏

If Δ𝑥 ≤ −𝜏 then 𝑠𝜏 (Δ𝑥 ) = 0 and the inequality holds since the displayed quantity is ≤ 0. If −𝜏 < Δ𝑥 ≤ 𝜏 − 𝜉 then 𝑠𝜏 (Δ𝑥 ) = 12 (1 + Δ𝑥 /𝜏 ) and the inequality holds with slack 𝜉/(8𝜏 ). Case 3: Δ𝑥 ∈ (𝜏 − 𝜉, 𝜏 ). Write 𝑢 := 𝜏 − Δ𝑥 ∈ (0, 𝜉). Then Soft𝜏,𝜉 (Δ𝑥 ) = 𝑢/𝜉 and the right-hand side of (18) (without the −𝜉/(8𝜏 ) term) equals 1−

𝑢 Δ𝑥 𝑢 𝑢 𝜏 −𝑢 𝑢 𝑢2 + · =1− + · =1− . 2𝜉 2𝜏 𝜉 2𝜉 2𝜏 𝜉 2𝜏 𝜉

Since 𝜏 ≥ 𝜉 and 𝑢 ∈ (0, 𝜉), we have Δ𝑥 = 𝜏 − 𝑢 > 0, hence Δ𝑥 ∈ (−𝜏, 𝜏 ) and therefore 1 Δ𝑥 1+ 𝑠𝜏 (Δ𝑥 ) = 2 𝜏 (︂

Thus,

(︃

𝑢2 𝑠𝜏 (Δ𝑥 ) − 1 − 2𝜏 𝜉

)︃

𝑢 = 2𝜏

)︂

=1−

(︂

𝑢 . 2𝜏

𝑢 𝜉 −1 ≥− , 𝜉 8𝜏 )︂

because the minimum over 𝑢 ∈ [0, 𝜉] occurs at 𝑢 = 𝜉/2 and equals −𝜉/(8𝜏 ). This proves (18) in all cases. Combining (17) and (18) gives, for every 𝑥, [︀

]︀

Pr 𝑄(𝑥) = 𝑃 (𝑥) | 𝑥 ≥ 1 −

𝑤𝜏 (𝑥) Δ𝑥 𝑤𝜏 (𝑥) 𝜉 𝛼 + − − − 𝜈. 2 2𝜏 8𝜏 2𝜏

44

(19)

Averaging and concluding.

Taking expectation of (19) over 𝑥 ← 𝒟 yields

[︀

]︀

Pr 𝑄(𝑥) = 𝑃 (𝑥) ≥ 1 −

𝑥∼𝒟

𝛿𝜏 𝐹 (𝜏 ) 𝜉 𝛼 + − − − 𝜈, 2 2𝜏 8𝜏 2𝜏

since 𝛿𝜏 = E[𝑤(𝑋)] and 𝐹 (𝜏 ) = E[Δ𝑋 𝑤(𝑋)]. Using the concrete choice 𝛼 = 𝜉𝜀/800 and 𝜀 ≤ 1 without loss of generality, we have 𝛼 ≤ 𝜉/800, and hence 𝜉 𝛼 𝜉 𝜉 𝜉 + ≤ + < . (20) 8𝜏 2𝜏 8𝜏 1600𝜏 2𝜏 Therefore, [︀ ]︀ 𝛿𝜏 𝐹 (𝜏 ) − 𝜉 Pr 𝑄(𝑥) = 𝑃 (𝑥) ≥ 1 − + − 𝜈. 𝑥∼𝒟 2 2𝜏 Finally, by Step 4 we have 0 ≤ 𝛿𝜏 − 𝛿 ≤ 𝜀/200 except with probability negl(𝜆), and by Step 3 we have 𝐹 (𝜏 ) ≥ 𝜀/150 and 𝜏 ≤ 1 + 𝜉. Since 𝜉 = 𝜀2 /1000, for all sufficiently large 𝜆, 𝐹 (𝜏 ) − 𝜉 𝜀/150 − 𝜀2 /1000 𝜀 𝛿𝜏 − 𝛿 ≥ ≥ ≥ . 2𝜏 2(1 + 𝜉) 400 2 Plugging this in gives [︀

]︀

Pr 𝑄(𝑥) = 𝑃 (𝑥) ≥ 1 −

𝑥∼𝒟

𝛿𝜏 − 𝛿 𝛿 𝛿𝜏 + − 𝜈 = 1 − − 𝜈, 2 2 2

which completes the predictability claim. Obliviousness.

The obliviousness property stems directly from the definition of 𝑄.

Efficiency. All estimation steps use poly(𝜆, 1/𝜀) oracle calls to 𝒞, and the grid has poly(𝜆, 1/𝜀) points. Thus Gen runs in poly(𝜆, 1/𝜀) time. By inspection, 𝑆 and 𝑄 are obtained by composing a poly(𝜆, 1/𝜀)-number of invocations of 𝒞 arising only from the estimation subroutines, with poly(𝜆, 1/𝜀) additional non-oracle computation. Hence there exist fixed polynomials 𝑞(·, ·) and 𝑟(·, ·) such that 𝑆 and 𝑄 make at most 𝑞(𝜆, 1/𝜀) oracle calls to 𝒞 and have non-oracle size at most ̂︀ ≤ 𝑞(𝜆, 1/𝜀) · |𝒞| + 𝑟(𝜆, 1/𝜀), and similarly for 𝑟(𝜆, 1/𝜀). Therefore, the compiled circuits satisfy |𝑄| ̂︀ 𝑆. Next, we state and prove a corollary of Theorem 6.1. Corollary 6.3. Let 𝜆 ∈ N and let 𝑛 = 𝑛(𝜆) = poly(𝜆). Let 𝐷𝜆 be a distribution over 𝒳𝜆 × {0, 1} where 𝒳𝜆 := {0, 1}𝑛 , and assume 𝐷𝜆 is samplable in poly(𝜆) time. Write (𝑋, 𝐵) ← 𝐷𝜆 . Assume the following min-entropy condition: 𝑚(𝜆) := max Pr[𝑋 = 𝑥] = negl(𝜆). 𝑥∈𝒳𝜆 𝐷𝜆

Let 𝛿 = 𝛿(𝜆) ∈ (0, 1) and let 𝑠(𝜆) be a circuit size bound. Suppose that for every uniform (resp. nonuniform) quantum circuit 𝑄 : 𝒳𝜆 → {0, 1} of size at most 𝑠(𝜆), ]︀ 𝛿 𝑄(𝑋) = 𝐵 ≤ 1 − . 2 (𝑋,𝐵)←𝐷𝜆

Pr

[︀

45

Fix any 𝜖 = 𝜖(𝜆) = 1/poly(𝜆) with 𝜖 ≤ 𝛿/2. Let 𝜀 := 𝛿𝜖, and let 𝐶 : 𝒳𝜆 → {0, 1} be a uniform (resp. non-uniform) quantum circuit such that (︁

)︁ (︀

(︁

𝑞 𝜆, 1𝜀 · |𝐶| + 𝑛 + 𝑟 𝜆, 1𝜀 )︀

)︁

≤ 𝑠(𝜆),

(21)

where 𝑟(·, ·), 𝑞(·, ·) are the polynomials defined in the statement of Theorem 6.1. Then, there exists a measure 𝑀𝜆 ⪯ 𝐷𝜆 with total mass 𝜇(𝑀𝜆 ) ≥ 𝛿 − 𝜖 such that [︀

]︀

𝐶(𝑋) = 𝐵 ≤

Pr (𝑋,𝐵)←𝑀𝜆

1 + 2𝜖, 2

where (𝑋, 𝐵) ← 𝑀𝜆 denotes sampling from the normalized distribution 𝑀𝜆 /𝜇(𝑀𝜆 ). Proof. Fix 𝜆 and suppress the subscript 𝜆. Define a deterministic predicate. Define the lifted domain 𝒳 ′ := 𝒳 × {0, 1} and define the deterministic predicate 𝑃 : 𝒳 ′ → {0, 1} by 𝑃 (𝑥, 𝑏0 ) := 𝑏0 . A sampler for (𝑋 ′ , 𝑃 (𝑋 ′ )) is immediate: sample (𝑥, 𝑏0 ) ← 𝐷 and output (𝑥, 𝑏0 ), 𝑏0 . (︀

Build an oracle circuit for Theorem 6.1. circuit

)︀

Given the predictor 𝐶 : 𝒳 → {0, 1}, define a quantum

𝒞 : 𝒳 ′ × {0, 1} → {0, 1} (︀

)︀

that on input (𝑥, 𝑏0 ), 𝑏 outputs 1 iff 𝐶(𝑥) = 𝑏. Crucially, 𝒞 ignores 𝑏0 . Invoke Gen𝒞 (𝜀, 1𝜆 ) from Theorem 6.1 on the distribution 𝐷 with the accuracy parameter set to 𝜀 := 𝛿𝜖, obtaining 𝜉, 𝜏 , circuits 𝑆, 𝑄 with oracle access to 𝒞, and an output parameter 𝛿out . Importantly, 𝐷 meets the min-entropy condition in the statement of Theorem 6.1. With probability 1 − negl(𝜆), the properties correct mass, indistinguishability, predictability, and obliviousness all hold. As in Theorem 6.1, let the pointwise gaps be 𝑝𝑥′ (𝑏) := Pr 𝒞(𝑥′ , 𝑏) = 1 , [︀

]︀

Δ𝑥′ := 𝑝𝑥′ (𝑃 (𝑥′ )) − 𝑝𝑥′ (1 − 𝑃 (𝑥′ )).

For 𝑥′ = (𝑥, 𝑏0 ) we have 𝑝(𝑥,𝑏0 ) (𝑏) = Pr[𝐶(𝑥) = 𝑏],

Δ(𝑥,𝑏0 ) = Pr[𝐶(𝑥) = 𝑏0 ] − Pr[𝐶(𝑥) = 1 − 𝑏0 ] = 2 Pr[𝐶(𝑥) = 𝑏0 ] − 1.

Define the soft weight and its mean: 𝑤𝜏 (𝑥′ ) := Soft𝜏,𝜉 (Δ𝑥′ ) ∈ [0, 1], Define a measure 𝑀 .

𝛿𝜏 :=

E

𝑋 ′ ∼𝒟

𝑤𝜏 (𝑋 ′ ) .

[︀

]︀

Note that for any 𝑥′ , 0 ≤ 𝑤𝜏 (𝑥′ ) ≤ 1. Define the measure 𝑀 ⪯ 𝐷 by 𝑀 (𝑥, 𝑏) := 𝐷(𝑥, 𝑏) · 𝑤𝜏 (𝑥, 𝑏).

(22)

Then, the total mass of 𝑀 is as follows 𝜇(𝑀 ) =

∑︁

𝑀 (𝑥, 𝑏) =

𝑥,𝑏

46

E [𝑤𝜏 (𝑋 ′ )] = 𝛿𝜏 .

𝑋 ′ ∼𝒟

(23)

Lower bound the total mass 𝜇(𝑀 ). We claim 𝛿𝜏 ≥ 𝛿 − 𝜖. By the correct mass property from Theorem 6.1, except with negligible probability, 𝛿out ≤ 𝛿𝜏

|𝛿out − 𝛿𝜏 | ≤ 𝜀/200.

and

Hence it suffices to show 𝛿out ≥ 𝛿 − 𝜖. Assume toward contradiction that 𝛿out < 𝛿 − 𝜖 and that the Theorem 6.1 guarantees hold. By the predictability property from Theorem 6.1, Pr 𝑄(𝑋 ′ ) = 𝑃 (𝑋 ′ ) ≥ 1 − ′ [︀

]︀

𝑋 ∼𝒟

𝛿out 𝛿 𝜖 − negl(𝜆) > 1 − + − negl(𝜆). 2 2 2

̃︀ : 𝒳 → {0, 1} by 𝑄(𝑥) ̃︀ Define 𝑄 := 𝑄((𝑥, 0)). We claim that for every (𝑥, 𝑏0 ) ∈ 𝒳 ′ , [︀

]︀

[︀

]︀

(24)

Pr 𝑄((𝑥, 𝑏0 )) = 𝑏0 = Pr 𝑄((𝑥, 0)) = 𝑏0 .

Indeed, by obliviousness of 𝑄 (Theorem 6.1), on any input 𝑥′ = (𝑥, 𝑏0 ) the circuit 𝑄 utilizes 𝑥 only within a fixed, 𝑥-independent procedure of oracle queries to 𝐶(𝑥, ·). Since 𝒞((𝑥, 𝑏0 ), ·) ignores 𝑏0 , the joint distribution of oracle answers returned to 𝑄 is identical for inputs (𝑥, 0) and (𝑥, 1). Therefore the output distribution of 𝑄((𝑥, 𝑏0 )) is the same as that of 𝑄((𝑥, 0)), establishing (24). Averaging (24) over (𝑋, 𝐵) ∼ 𝐷 yields [︀

]︀

𝑄((𝑋, 𝐵)) = 𝐵 =

Pr

Pr

[︀

]︀

𝑄((𝑋, 0)) = 𝐵 =

(𝑋,𝐵)∼𝐷

(𝑋,𝐵)∼𝐷

(𝑋,𝐵)∼𝐷

Pr

[︀

]︀

̃︀ 𝑄(𝑋) =𝐵 .

Consequently, Pr (𝑋,𝐵)∼𝐷

[︀

]︀

̃︀ 𝑄(𝑋) =𝐵 =

𝑄(𝑋 ′ ) = 𝑃 (𝑋 ′ ) > 1 − Pr ′ [︀

]︀

𝑋 ∼𝒟

𝛿 𝜖 + − negl(𝜆). 2 2

̃︀ can be realized by a (non-oracle) quantum Size of the compiled predictor. We now argue that 𝑄 circuit of size at most 𝑠(𝜆). Recall that 𝑄 is produced by invoking Theorem 6.1 on the oracle circuit 𝒞 with accuracy parameter 𝜀 = 𝛿𝜖. By Theorem 6.1, the circuit 𝑄 makes at most 𝑞(𝜆, 1/𝜀) oracle calls to 𝒞 on any input and has non-oracle size at most 𝑟(𝜆, 1/𝜀). By hardwiring 𝒞 and replacing each oracle gate by a copy of 𝒞, ̂︀ of size at most we obtain an explicit (non-oracle) circuit 𝑄 ̂︀ ≤ 𝑞(𝜆, 1/𝜀) · |𝒞| + 𝑟(𝜆, 1/𝜀). |𝑄| (︀

)︀

In our construction, 𝒞 on input (𝑥, 𝑏0 ), 𝑏 evaluates 𝐶(𝑥) and compares it to 𝑏 while ignoring 𝑏0 , and hence |𝒞| ≤ |𝐶| + 𝑛. ̂︀ ≤ 𝑠(𝜆). This contradicts the assumed hardness of 𝐷 Therefore, the size condition (21) implies |𝑄| against size-𝑠(𝜆) circuits. Therefore 𝛿out ≥ 𝛿 − 𝜖, and since 𝛿out ≤ 𝛿𝜏 we get

𝜇(𝑀 ) = 𝛿𝜏 ≥ 𝛿 − 𝜖.

47

(25)

An upper bound on the success of 𝐶 on 𝑀 . We analyze 𝐶 under the normalized distribution 𝑀/𝜇(𝑀 ). Using Δ(𝑥,𝑏) = 2 Pr[𝐶(𝑥) = 𝑏] − 1, we have [︀

Pr

]︀

𝐶(𝑋) = 𝐵 =

(𝑋,𝐵)←𝑀

[︀ ]︀ [︀ ]︀ 1 1 1 1 · E Δ(𝑋,𝐵) 𝑤𝜏 (𝑋, 𝐵) . + · E Δ(𝑋,𝐵) = + 2 2 (𝑋,𝐵)←𝑀 2 2𝛿𝜏 (𝑋,𝐵)∼𝐷

(26)

where the last equality stems from (22) and (23). Let 𝐹 (𝜏 ) := E𝑋 ′ ∼𝒟 [Δ𝑋 ′ 𝑤𝜏 (𝑋 ′ )], as in the proof of Theorem 6.1. Let 𝑃 ′ (𝑥′ ) := 𝑃 (𝑥′ ) ⊕ 𝑆(𝑥′ , 𝑃 (𝑥′ )). Fixing 𝑥′ , we get Pr 𝒞(𝑥′ , 𝑃 (𝑥′ )) = 1 | 𝑥′ − Pr 𝒞(𝑥′ , 𝑃 ′ (𝑥′ )) = 1 | 𝑥′ = [︀

]︀

[︀

]︀

Pr 𝑃 ′ (𝑥′ ) = 1 − 𝑃 (𝑥′ ) · Pr 𝒞(𝑥′ , 𝑃 (𝑥′ )) = 1 | 𝑥′ − Pr 𝒞(𝑥′ , 1 − 𝑃 (𝑥′ )) = 1 | 𝑥′ [︀

]︀ (︀

[︀

]︀

[︀

[︀

′

′

]︀)︀

=

′ ]︀

Pr 𝑆(𝑥 , 𝑃 (𝑥 )) = 1 | 𝑥 · Δ𝑥′ . Averaging over 𝑋 ′ ∼ 𝒟 and using the indistinguishability property from Theorem 6.1 gives ⃒ ⃒

𝐴 := ⃒⃒ ′E

[︁

𝑋 ∼𝒟

⃒ ]︀]︁⃒

Δ𝑋 ′ · Pr 𝑆(𝑋 ′ , 𝑃 (𝑋 ′ )) = 1 | 𝑋 ′ ⃒⃒ ≤ 𝜀. [︀

(27)

By the correct mass property from Theorem 6.1, for each fixed 𝑥′ we have Pr 𝑆(𝑥′ , 𝑃 (𝑥′ )) = 1 | 𝑥′ = 𝑤𝜏 (𝑥′ ) ± (𝜀/200 + negl(𝜆)). ]︀

[︀

Combining with (27) and observing that |Δ𝑥′ | ≤ 1, |𝐹 (𝜏 )| = | ′E [Δ𝑋 ′ 𝑤𝜏 (𝑋 ′ )]| ≤ 𝐴 + 𝜀/200 + negl(𝜆) ≤ 𝜀 + 𝜀/200 + negl(𝜆) ≤ 2𝜀 𝑋 ∼𝒟

for all sufficiently large 𝜆. From (26) we have the identity [︀

]︀

𝐶(𝑋) = 𝐵 =

Pr (𝑋,𝐵)←𝑀

1 1 + · 𝐹 (𝜏 ), 2 2𝛿𝜏

Because 𝛿𝜏 > 0 this results in the first inequality below: Pr (𝑋,𝐵)←𝑀

[︀

]︀

𝐶(𝑋) = 𝐵 ≤

1 2𝜀 1 𝛿𝜖 1 1 |𝐹 (𝜏 )| + ≤ + = + ≤ + 2𝜖. 2 2𝛿𝜏 2 2(𝛿 − 𝜖) 2 𝛿−𝜖 2

Here, the second inequality relies on (25), and the last inequality uses 𝜖 ≤ 𝛿/2, so 𝛿/(𝛿 − 𝜖) ≤ 2. This completes the proof. In the next proof, we make use of the following lemma. Lemma 6.4 ([BSW03]). Let 𝐷 be a distribution on {0, 1}𝑛 , 𝐹 be a set of functions 𝑓 : {0, 1}𝑛 → [−1, 1], and 𝑓 be a convex combination of functions from 𝐹 . Then for any 𝜖 ∈ (0, 1) and for some 𝑘 ≤ 𝑛/2𝜖2 , there exist functions 𝑓1 , . . . , 𝑓𝑘 such that ⃒ (︃ )︃ ⃒ 𝑘 ⃒ ⃒ 1 ∑︁ ⃒ ⃒ max 𝑛 ⃒𝑓 (𝑥) − 𝑓𝑖 (𝑥) ⃒ ≤ 𝜖. ⃒ 𝑘 𝑥∈{0,1} ⃒ 𝑖=1

Remark 6.5. We note that Lemma 6.4 does not guarantee that the functions 𝑓1 , . . . , 𝑓𝑘 can be computed efficiently given 𝑓 . Therefore, the following theorems we prove in this section, which all rely on Lemma 6.4, are stated in the non-uniform security model.

48

Lemma 6.6 (Minimax fixing lemma). Let {𝐷𝜆 }𝜆∈N be a family of distributions over {0, 1}𝑛(𝜆) × {0, 1}. Fix functions 𝛼(𝜆) ∈ (0, 1] and 𝛾(𝜆) ∈ (0, 1), and a size bound 𝑡(𝜆). Assume that for all sufficiently large 𝜆, for every measure 𝑀𝜆 ⪯ 𝐷𝜆 with 𝜇(𝑀𝜆 ) ≥ 𝛼(𝜆), there exists a quantum circuit 𝑄′𝜆 of size at most 𝑡(𝜆) such that [︀

Pr

𝑄′ (𝑋) = 𝐵

]︀

>

(𝑋,𝐵)←𝑀𝜆

1 + 𝛾(𝜆). 2

Define 𝑡′′ (𝜆) :=

(︁ 𝑛(𝜆)

(︁ 𝑛(𝜆) + 1 )︁

)︁

+ 1 · 𝑡(𝜆) + log 𝛾(𝜆)2

𝛾(𝜆)2

.

Then for all sufficiently large 𝜆, there exists a quantum circuit 𝑄′′𝜆 of size at most 𝑡′′ (𝜆) such that for every measure 𝑀𝜆 ⪯ 𝐷𝜆 with 𝜇(𝑀𝜆 ) ≥ 𝛼(𝜆), Pr (𝑋,𝐵)←𝑀𝜆

[︀

𝑄′′𝜆 (𝑋) = 𝐵

]︀

>

1 𝛾(𝜆) + . 2 2

Proof. Fix 𝜆 ∈ N and suppress it from the notation. Mass-normalization. Throughout this proof, the notation (𝑋, 𝐵) ← 𝑀 denotes sampling from the normalized distribution 𝑀/𝜇(𝑀 ), so E(𝑥,𝑏)←𝑀 [·] is not linear in 𝑀 . To apply minimax, we may w.l.o.g. restrict Bob to measures of exact mass 𝛼. Indeed, for any measure 𝑀 ⪯ 𝐷 with 𝜇(𝑀 ) ≥ 𝛼, define the scaled measure 𝛼 ̃︁ := 𝑀 · 𝑀. 𝜇(𝑀 ) ̃︁ ⪯ 𝐷, 𝜇(𝑀 ̃︁) = 𝛼, and the normalized distributions coincide: Then 𝑀 ̃︁ 𝑀 ̃︁) 𝜇(𝑀

=

𝑀 . 𝜇(𝑀 )

Hence, for every circuit 𝑄, [𝑄(𝑋) = 𝐵] =

Pr (𝑋,𝐵)←𝑀

Pr

(28)

[𝑄(𝑋) = 𝐵].

̃︀ (𝑋,𝐵)←𝑀

Therefore, the lemma’s assumption and desired conclusion are unchanged if we quantify Bob only over 𝑅𝛼 := { 𝑀 ⪯ 𝐷 | 𝜇(𝑀 ) = 𝛼 }. Note that 𝑅𝛼 is nonempty (since 𝛼𝐷 ∈ 𝑅𝛼 ), convex, and compact when identified with a subset 𝑛 of R{0,1} ×{0,1} . The game.

For any circuit 𝑄′ , define the function 𝑔𝑄′ : {0, 1}𝑛 × {0, 1} → [−1, 1] by 𝑔𝑄′ (𝑥, 𝑏) := 2 Pr 𝑄′ (𝑥) = 𝑏 − 1 = Pr 𝑄′ (𝑥) = 𝑏 − Pr 𝑄′ (𝑥) = 1 − 𝑏 . [︀

]︀

E

[𝑔𝑄′ (𝑥, 𝑏)] = 2

[︀

]︀

[︀

Pr

[𝑄′ (𝑥) = 𝑏] − 1.

Then for any measure 𝑀 , (𝑥,𝑏)←𝑀

(𝑥,𝑏)←𝑀

49

]︀

Consider the following zero-sum game between Alice and Bob. Alice chooses a circuit 𝑄′ of size at most 𝑡; Bob chooses a measure 𝑀 ∈ 𝑅𝛼 ; and Alice’s payoff is Π(𝑄′ , 𝑀 ) :=

1 ∑︁ 𝑀 (𝑥, 𝑏) · 𝑔𝑄′ (𝑥, 𝑏) 𝛼 𝑥,𝑏

for 𝑀 ∈ 𝑅𝛼 .

For 𝑀 ∈ 𝑅𝛼 we have Π(𝑄′ , 𝑀 ) = E(𝑥,𝑏)←𝑀 [𝑔𝑄′ (𝑥, 𝑏)], and Π(𝑄′ , ·) is linear in 𝑀 on 𝑅𝛼 . By the lemma assumption, for every 𝑀 ∈ 𝑅𝛼 there exists a circuit 𝑄′ of size at most 𝑡 such that [𝑄′ (𝑋) = 𝐵] >

Pr (𝑋,𝐵)←𝑀

and hence

Π(𝑄′ , 𝑀 ) = 2

1 + 𝛾, 2

[𝑄′ (𝑋) = 𝐵] − 1 > 2𝛾.

Pr (𝑋,𝐵)←𝑀

Equivalently,

Π(𝑄′ , 𝑀 ) > 2𝛾.

max

min

𝑀 ∈𝑅𝛼 𝑄′ : |𝑄′ |≤𝑡

Minimax. Apply von Neumann’s minimax theorem with Alice’s finite action set being the set of size-𝑡 circuits (with a finite universal gate set), Bob’s action set 𝑌 = 𝑅𝛼 (compact convex), and payoff 𝑢(𝑄′ , 𝑀 ) = Π(𝑄′ , 𝑀 ) (affine in 𝑀 ). We obtain a mixed strategy for Alice, i.e. a distribution over size-𝑡 circuits which we denote 𝑄, such that for all 𝑀 ∈ 𝑅𝛼 , E

Π(𝑄′ , 𝑀 ) > 2𝛾.

[︀

]︀

𝑄′ ∼𝑄

Define the (pointwise) averaged payoff function 𝑔𝑄 (𝑥, 𝑏) :=

E

[︀

𝑄′ ∼𝑄

]︀

𝑔𝑄′ (𝑥, 𝑏) .

By linearity, E

Π(𝑄′ , 𝑀 ) =

[︀

𝑄′ ∼𝑄

]︀

[︀ ]︀ 1 ∑︁ 𝑀 (𝑥, 𝑏) 𝑔𝑄 (𝑥, 𝑏) = E 𝑔𝑄 (𝑥, 𝑏) , 𝛼 𝑥,𝑏 (𝑥,𝑏)←𝑀

so we have for every 𝑀 ∈ 𝑅𝛼 , E

[︀

(𝑥,𝑏)←𝑀

]︀

𝑔𝑄 (𝑥, 𝑏) > 2𝛾.

(29)

Sparsifying the mixed strategy. Note that 𝑔𝑄′ (𝑥, 1) = −𝑔𝑄′ (𝑥, 0) for every 𝑥, since Pr[𝑄′ (𝑥) = 0]+ Pr[𝑄′ (𝑥) = 1] = 1. Define the one-argument function ℎ𝑄′ : {0, 1}𝑛 → [−1, 1] by ℎ𝑄′ (𝑥) := 𝑔𝑄′ (𝑥, 0), so that for all (𝑥, 𝑏), 𝑔𝑄′ (𝑥, 𝑏) = (1 − 2𝑏) ℎ𝑄′ (𝑥). Define ℎ𝑄 (𝑥) := E𝑄′ ∼𝑄 [ℎ𝑄′ (𝑥)]; then 𝑔𝑄 (𝑥, 𝑏) = (1 − 2𝑏) ℎ𝑄 (𝑥). Now apply Lemma 6.4 to the convex combination ℎ𝑄 over the domain {0, 1}𝑛 : there exist circuits 𝑄′1 , . . . , 𝑄′𝑘 of size at most 𝑡 with ⌈︂

𝑘 ≤ 50

𝑛 𝛾2

⌉︂

such that

⃒ ⃒ 𝑘 ⃒ ⃒ 1 ∑︁ ⃒ ⃒ max 𝑛 ⃒ℎ𝑄 (𝑥) − ℎ𝑄′𝑖 (𝑥)⃒ ≤ 𝛾. ⃒ 𝑘 𝑥∈{0,1} ⃒ 𝑖=1

Multiplying by (1 − 2𝑏) ∈ {±1} shows that, for all (𝑥, 𝑏), ⃒ ⃒ 𝑘 ⃒ ⃒ 1 ∑︁ ⃒ ⃒ 𝑔𝑄′𝑖 (𝑥, 𝑏)⃒ ≤ 𝛾. ⃒𝑔𝑄 (𝑥, 𝑏) − ⃒ ⃒ 𝑘 𝑖=1

Define 𝑄′′ as follows: on input 𝑥, sample 𝑖 ← [𝑘] uniformly and output 𝑄′𝑖 (𝑥). Then for every (𝑥, 𝑏) we have 𝑘 1 ∑︁ 𝑔𝑄′′ (𝑥, 𝑏) = 𝑔 ′ (𝑥, 𝑏), 𝑘 𝑖=1 𝑄𝑖 and hence for every 𝑀 ∈ 𝑅𝛼 , E

(𝑥,𝑏)←𝑀

[𝑔𝑄′′ (𝑥, 𝑏)] ≥

E

(𝑥,𝑏)←𝑀

[𝑔𝑄 (𝑥, 𝑏)] − 𝛾 > 2𝛾 − 𝛾 = 𝛾,

where the strict inequality uses (29). Extending back to all 𝜇(𝑀 ) ≥ 𝛼.

Let 𝑅 := { 𝑀 ⪯ 𝐷 | 𝜇(𝑀 ) ≥ 𝛼 }.

̃︁ yields the same normalized ̃︁ = 𝛼 𝑀 ∈ 𝑅𝛼 . By (28), sampling from 𝑀 or 𝑀 For any 𝑀 ∈ 𝑅, let 𝑀 𝜇(𝑀 ) ′′ distribution, so the same success probability for 𝑄 . Therefore, for every 𝑀 ∈ 𝑅,

Pr

1 1 1 𝛾 + E [𝑔𝑄′′ (𝑥, 𝑏)] > + . 2 2 (𝑥,𝑏)←𝑀 2 2

[𝑄′′ (𝑥) = 𝑏] =

(𝑥,𝑏)←𝑀

Size bound. By construction, 𝑄′′ can be implemented by wiring in the 𝑘 circuits 𝑄′1 , . . . , 𝑄′𝑘 and using log 𝑘 bits to sample 𝑖; thus |𝑄′′ | ≤ 𝑘 · 𝑡 + log 𝑘. With 𝑘 ≤ ⌈𝑛/𝛾 2 ⌉, we have 𝑘 ≤ 𝑛/𝛾 2 + 1, and since 𝛾 ∈ (0, 1), (︁ 𝑛

log 𝑘 ≤ log Hence |𝑄′′ | ≤

(︁ 𝑛

𝛾

𝛾

+1 2

)︁

(︁ 𝑛 + 1 )︁

≤ log

𝛾2

(︁ 𝑛 + 1 )︁

)︁

+ 1 · 𝑡 + log 2

𝛾2

.

= 𝑡′′ ,

as required. Theorem 6.7 (Post-quantum hard-core measure). Let {𝐷𝜆 }𝜆∈N be a family of distributions over {0, 1}𝑛(𝜆) × {0, 1} that are sampleable in time poly(𝜆), and assume the min-entropy condition max

(𝑥,𝑏)∈{0,1}𝑛(𝜆) ×{0,1}

𝐷𝜆 (𝑥, 𝑏) ≤ negl(𝜆).

51

Fix a function 𝛿(𝜆) ∈ (0, 1) and a size bound 𝑠(𝜆). Let 𝑞(·, ·) and 𝑟(·, ·) be the polynomials from Theorem 6.1. Assume that for all sufficiently large 𝜆, for every quantum circuit 𝑄 : {0, 1}𝑛(𝜆) → {0, 1} of size at most 𝑠(𝜆), [︀ ]︀ 𝛿(𝜆) Pr 𝑄(𝑋) = 𝐵 ≤ 1 − . 2 (𝑋,𝐵)←𝐷𝜆 Let 𝛾(𝜆) be any function such that 𝛾(𝜆) ∈ [1/poly(𝜆), 𝛿(𝜆)], and define

and

𝜖(𝜆) :=

𝛾(𝜆) , 4

𝜀(𝜆) := 𝛿(𝜆) · 𝜖(𝜆) =

⌊︃

(︀

)︀ ⌋︃

′′

𝑠 (𝜆) :=

𝑠(𝜆) − 𝑟 𝜆, 1/𝜀(𝜆) (︀ )︀ 𝑞 𝜆, 1/𝜀(𝜆)

𝛿(𝜆)𝛾(𝜆) , 4 ⌊︃

′

− 𝑛(𝜆),

𝑠 (𝜆) :=

⌋︃

𝛾(𝜆)2 ′′ · 𝑠 (𝜆) . 4 𝑛(𝜆)

Then for all sufficiently large 𝜆, there exists a measure 𝑀𝜆 ⪯ 𝐷𝜆 such that 𝜇(𝑀𝜆 ) ≥ 𝛿(𝜆) − 𝜖(𝜆) = 𝛿(𝜆) −

𝛾(𝜆) , 4

and for every quantum circuit 𝑄′ : {0, 1}𝑛(𝜆) → {0, 1} of size at most 𝑠′ (𝜆), [︀

Pr

𝑄′ (𝑋) = 𝐵

]︀

≤

(𝑋,𝐵)←𝑀𝜆

1 + 𝛾(𝜆). 2

Proof. Fix a sufficiently large security parameter 𝜆 and suppress it from the notation. Write 𝑛 := 𝑛(𝜆), 𝛿 := 𝛿(𝜆), 𝛾 := 𝛾(𝜆), 𝜖 := 𝛾/4, and 𝜀 := 𝛿𝜖 = 𝛿𝛾/4. Note that 0 < 𝛾 < 𝛿 < 1 and also 𝑛 ≥ 1: indeed, if 𝑛 = 0 then the domain has size 2 and hence max𝑥,𝑏 𝐷(𝑥, 𝑏) ≥ 1/2, contradicting max𝑥,𝑏 𝐷(𝑥, 𝑏) ≤ negl(𝜆). We first dispose of the degenerate case 𝑠′ ≤ 0. Case 1: 𝑠′ < 0. Then there is no circuit of size at most 𝑠′ , so the prediction condition is vacuous. Take 𝑀 := (𝛿 − 𝜖) · 𝐷. Then 𝑀 ⪯ 𝐷 and 𝜇(𝑀 ) = 𝛿 − 𝜖, as required. Case 2: 𝑠′ = 0. Let 𝑝𝑏 := Pr(𝑋,𝐵)←𝐷 [𝐵 = 𝑏] for 𝑏 ∈ {0, 1}. By the hypothesis of the theorem (applied to the constant circuits of size 0), 𝑝𝑏 =

Pr (𝑋,𝐵)←𝐷

[𝑄𝑏 (𝑋) = 𝐵] ≤ 1 −

𝛿 2

for

𝑄𝑏 (𝑥) ≡ 𝑏.

Hence 𝑝1−𝑏 = 1 − 𝑝𝑏 ≥ 𝛿/2, so in fact 𝑝0 , 𝑝1 ≥ 𝛿/2. Define a measure 𝑀 ⪯ 𝐷 by reweighting labels: 𝑀 (𝑥, 𝑏) :=

𝛿−𝜖 𝐷(𝑥, 𝑏) 2𝑝𝑏

𝑏 ∈ {0, 1}.

Since 𝑝𝑏 ≥ 𝛿/2 ≥ (𝛿 − 𝜖)/2, we have (𝛿 − 𝜖)/(2𝑝𝑏 ) ≤ 1, and therefore 𝑀 ⪯ 𝐷. Moreover, 𝜇(𝑀 ) =

∑︁ ∑︁

𝑀 (𝑥, 𝑏) =

𝑏∈{0,1} 𝑥

∑︁ 𝛿 − 𝜖 𝛿 − 𝜖 ∑︁ 𝐷(𝑥, 𝑏) = 𝑝𝑏 = 𝛿 − 𝜖. 2𝑝𝑏 𝑥 2𝑝𝑏 𝑏∈{0,1} 𝑏∈{0,1} ∑︁

Finally, under 𝑀 the label is perfectly balanced: ∑︀

Pr (𝑋,𝐵)←𝑀

[𝐵 = 𝑏] =

𝑥 𝑀 (𝑥, 𝑏)

𝜇(𝑀 )

52

=

(𝛿 − 𝜖)/2 1 = . 𝛿−𝜖 2

Thus any size-0 circuit is constant and succeeds with probability exactly 1/2, which is at most 1/2 + 𝛾. This establishes the theorem when 𝑠′ = 0. Case 3: 𝑠′ ≥ 1. Assume towards contradiction that for every measure 𝑀 ⪯ 𝐷 with 𝜇(𝑀 ) ≥ 𝛿 − 𝜖 there exists a quantum circuit 𝑄′ of size at most 𝑠′ such that [︀ ′ ]︀ 1 𝑄 (𝑋) = 𝐵 > + 𝛾.

Pr

(30)

2

(𝑋,𝐵)←𝑀

Apply Lemma 6.6 with parameters 𝛼 := 𝛿−𝜖, 𝑡 := 𝑠′ , and 𝛾 (as above). We obtain a single quantum circuit 𝑄′′ such that for all measures 𝑀 ⪯ 𝐷 with 𝜇(𝑀 ) ≥ 𝛿 − 𝜖, [︀ ′′ ]︀ 1 𝛾 𝑄 (𝑋) = 𝐵 > + ,

Pr

2

(𝑋,𝐵)←𝑀

(31)

2

and whose size satisfies 𝑛 𝑛+1 + 1 𝑠′ + log 2 𝛾 𝛾2

|𝑄′′ | ≤

(︂

⌊︁ 2

⌋︁

)︂

(︂

)︂

(︂

≤2

𝑛 + 1 𝑠′ . 𝛾2 )︂

(32)

𝛾 ′′ Recall the definition 𝑠′ = 4𝑛 𝑠 and note that 𝑠′ ≥ 1 implies 𝑠′′ > 0, so multiplying by 𝑠′′ below preserves inequalities. Thus, we get

(︃

𝑛 𝛾 2 ′′ 1 𝛾2 |𝑄 | ≤ 2 + 1 · 𝑠 = 1 + 𝛾2 4𝑛 2 𝑛 (︂

′′

)︂

)︃

𝑠′′ .

Finally, since 0 < 𝛾 < 1 and 𝑛 ≥ 1, we have 𝛾 2 /𝑛 ≤ 1, hence 12 (1 + 𝛾 2 /𝑛) ≤ 1, and therefore |𝑄′′ | ≤ 𝑠′′ .

(33)

Applying Corollary 6.3. We verify that the min-entropy premise of Corollary 6.3 holds. Indeed, for every 𝑥 ∈ {0, 1}𝑛 , Pr[𝑋 = 𝑥] =

∑︁

𝐷(𝑥, 𝑏) ≤ 2 · max 𝐷(𝑥, 𝑏) = negl(𝜆). (𝑥,𝑏)

𝑏∈{0,1}

Apply Corollary 6.3 to the circuit 𝐶 := 𝑄′′ with⌊︁ parameter ⌋︁ 𝜖 := 𝛾/4. We verify the corollary’s size 𝑠−𝑟(𝜆,1/𝜀) ′′ condition (21). By (33) and the definition 𝑠 = 𝑞(𝜆,1/𝜀) − 𝑛, we have |𝐶| + 𝑛 ≤ 𝑠′′ + 𝑛 ≤

⌊︂

𝑠 − 𝑟(𝜆, 1/𝜀) . 𝑞(𝜆, 1/𝜀) ⌋︂

Let 𝑞𝜆 := 𝑞(𝜆, 1/𝜀) and 𝑟𝜆 := 𝑟(𝜆, 1/𝜀). Since 𝑞𝜆 ≥ 1 (interpreting 𝑞𝜆 as the integer oracle-call bound from Theorem 6.1), multiplying by 𝑞𝜆 and adding 𝑟𝜆 yields 𝑠 − 𝑟𝜆 𝑞𝜆 · (|𝐶| + 𝑛) + 𝑟𝜆 ≤ 𝑞𝜆 · + 𝑟𝜆 ≤ 𝑠. 𝑞𝜆 ⌊︂

⌋︂

which is exactly the needed size condition. Therefore the corollary yields a measure 𝑀 ⋆ ⪯ 𝐷 with 𝜇(𝑀 ⋆ ) ≥ 𝛿 − 𝜖 such that Pr

(𝑋,𝐵)←𝑀 ⋆

[︀ ′′ ]︀ 1 1 𝛾 𝑄 (𝑋) = 𝐵 ≤ + 2𝜖 = + .

2

2

2

This contradicts (31) applied to 𝑀 ⋆ , and hence the assumption (30) was false. Thus there exists a measure 𝑀 ⪯ 𝐷 with 𝜇(𝑀 ) ≥ 𝛿 − 𝜖 such that every size-𝑠′ circuit predicts 𝐵 from 𝑋 under 𝑀 with probability at most 1/2 + 𝛾, completing the proof. 53

To conclude this subsection, we state a corollary that follows immediately from 6.7 by taking the contrapositive. Corollary 6.8 (Contrapositive of Theorem 6.7). Let {𝐷𝜆 }𝜆∈N be a family of distributions over {0, 1}𝑛(𝜆) × {0, 1} that are sampleable in time poly(𝜆), and assume max

(𝑥,𝑏)∈{0,1}𝑛(𝜆) ×{0,1}

𝐷𝜆 (𝑥, 𝑏) ≤ negl(𝜆).

Fix functions 𝛿(𝜆) ∈ (0, 1) and 𝑠(𝜆) ∈ N, and let 𝑞(·, ·) and 𝑟(·, ·) be the polynomials from Theorem 6.1. Let 𝛾(𝜆) be any function such that 𝛾(𝜆) ∈ [1/poly(𝜆), 𝛿(𝜆)] and define

and ′′

𝑠 (𝜆) :=

𝜖(𝜆) :=

𝛾(𝜆) , 4

𝜀(𝜆) := 𝛿(𝜆) · 𝜖(𝜆) =

⌊︃

(︀

)︀ ⌋︃

𝑠(𝜆) − 𝑟 𝜆, 1/𝜀(𝜆) (︀ )︀ 𝑞 𝜆, 1/𝜀(𝜆)

𝛿(𝜆)𝛾(𝜆) , 4 ⌊︃

′

− 𝑛(𝜆),

𝑠 (𝜆) :=

⌋︃

𝛾(𝜆)2 ′′ · 𝑠 (𝜆) . 4 𝑛(𝜆)

Suppose that for infinitely many 𝜆, for every measure 𝑀𝜆 ⪯ 𝐷𝜆 satisfying 𝜇(𝑀𝜆 ) ≥ 𝛿(𝜆) − 𝜖(𝜆) = 𝛿(𝜆) −

𝛾(𝜆) , 4

there exists a quantum circuit 𝑄′𝜆 : {0, 1}𝑛(𝜆) → {0, 1} of size at most 𝑠′ (𝜆) such that Pr (𝑋,𝐵)←𝑀𝜆

[︀

𝑄′𝜆 (𝑋) = 𝐵

]︀

>

1 + 𝛾(𝜆). 2

Then for infinitely many 𝜆, there exists a quantum circuit 𝑄𝜆 : {0, 1}𝑛(𝜆) → {0, 1} of size at most 𝑠(𝜆) such that [︀ ]︀ 𝛿(𝜆) 𝑄𝜆 (𝑋) = 𝐵 > 1 − Pr . 2 (𝑋,𝐵)←𝐷𝜆

6.2

Key agreement amplification

In this section, we prove a theorem which enables generically amplifying a weak bit agreement protocol to a full-fledged key agreement protocol, in a manner that preserves post-quantum security. Theorem 6.9. Assuming there exists a post-quantum (𝜖, 𝛿)-BA protocol secure against adversaries with non-uniform classical advice for constants 𝜖, 𝛿 ∈ [0, 1] such that 𝛿<

2𝜖 , 1+𝜖

there exists a (1, 0)-BA protocol secure against adversaries with non-uniform classical advice. A proof of this theorem is presented at the end of this section, after developing the necessary tools. We begin by defining the notion of a (𝜖, 𝛿)-secure random variable, and of an information theoretic key-agreement amplification for a set of such independent variables. Definition 6.10 ((𝜖, 𝛿)-secure random variable [Hol05]). A triple 𝑋 × 𝑌 × 𝑍 of random variables over {0, 1} × {0, 1} × {0, 1}* is (𝜖, 𝛿)-secure for 𝜖 = 𝜖(𝜆) and 𝛿 = 𝛿(𝜆) if 54

• Pr[𝑋 = 0] = Pr[𝑋 = 1] = Pr[𝑌 = 0] = Pr[𝑌 = 1] = 1/2. • Pr[𝑋 = 𝑌 ] ≥ 1/2 + 𝜖/2. • There exists an event 𝐸 which implies 𝑋 = 𝑌 such that Pr[𝐸 | 𝑋 = 𝑌 ] ≥ 𝛿 and 𝐼(𝑋; 𝑍 | 𝐸) = 0. That is, conditioned on 𝐸, 𝑍 gives no information about 𝑋. Definition 6.11 (Information-theoretic key agreement protocol for (𝜖, 𝛿)-secure random variables [Hol05]). Let 𝜖 = 𝜖(𝜆), 𝛿 = 𝛿(𝜆), 𝑛 = 𝑛(𝜆), and {(𝑋𝑖 , 𝑌𝑖 , 𝑍𝑖 )}𝑖∈[ℓ] be ℓ independent (𝜖, 𝛿)-secure random variables. Let 𝑋 = {𝑋𝑖 }𝑖∈[ℓ] , 𝑌 = {𝑌𝑖 }𝑖∈[ℓ] , 𝑍 = {𝑍𝑖 }𝑖∈[ℓ] . An information-theoretic key agreement protocol for (𝜖, 𝛿)-secure random variables is a protocol where 𝐴 has input (1𝜆 , 𝑋), 𝐵 has input (1𝜆 , 𝑌 ), and they communicate (classically) to produce a transcript 𝑇 , an output 𝑘𝐴 for 𝐴, and an output 𝑘𝐵 for 𝐵. The guarantee is that (𝑘𝐴 , 𝑘𝐵 , (𝑇, 𝑍)) is an (1 − 2−𝜆 , 1 − 2−𝜆 )-secure random variable, and the protocol is called efficient if the running time for both 𝐴 and 𝐵 is poly(𝜆). We will rely on the following claim: Claim 6.12 ([Hol05]). For any constants 𝜖, 𝛿 such that 𝛿 > 1−𝜖 1+𝜖 , there exists an efficient informationtheoretic key agreement protocol for (𝜖, 𝛿)-secure random variables. Next, we state and prove an amplification theorem of weak bit-agreement to key agreement. Theorem 6.13 (Adaptation of Theorem 2.17 from [Hol05]). Let 𝜖(𝜆), 𝛿(𝜆) : N → (0, 1). If there exists a post-quantum (𝜖(𝜆), 𝛿(𝜆))-BA protocol secure against adversaries with non-uniform classical advice, and 1 an efficient information-theoretic key agreement protocol for (𝜖(𝜆), 1 − 𝛿(𝜆) − poly(𝜆) )-secure random variables, then there exists a (1, 0)-WBA, and thus a standard (computationally-secure) key agreement protocol. Proof. Let ℓ = ℓ(𝜆) be the number of invocations of the WBA protocol required by the informationtheoretic key agreement protocol, and let 𝑛 = 𝑛(𝜆) be the number of bits in the transcript of each WBA protocol. Let 𝐷 = {𝐷𝜆 }𝜆∈N be the distribution over transcripts and output bits (𝑍, 𝑋) ∈ {0, 1}𝑛 × {0, 1} in the WBA protocol, conditioned on 𝐴 and 𝐵 obtaining the same output bit 𝑋. Let 𝛿hc (𝜆) := 1 − 𝛿(𝜆). By the theorem’s assumption, there exists an inverse-polynomial function 𝜅(𝜆) = 1/poly(𝜆) such that the information-theoretic key agreement protocol works for (𝜖(𝜆), 𝛿hc (𝜆) − 𝜅(𝜆)) -secure random variables. By decreasing 𝜅 if necessary, we assume that 𝜅(𝜆) ≤ 𝛿hc (𝜆)/2 for all sufficiently large 𝜆. Now consider the following key agreement protocol. 𝐴 and 𝐵 first use the WBA protocol ℓ times to obtain outputs 𝑋1 , . . . , 𝑋ℓ and 𝑌1 , . . . , 𝑌ℓ along with transcripts 𝑍1 , . . . , 𝑍ℓ . Then, for every 𝑖 ∈ [ℓ], party 𝐴 publicly samples and sends a uniformly random bit 𝐺𝑖 ← {0, 1}, and the parties define 𝑋 𝑖 := 𝑋𝑖 ⊕ 𝐺𝑖 ,

𝑌 𝑖 := 𝑌𝑖 ⊕ 𝐺𝑖 ,

𝑍 𝑖 := (𝑍𝑖 , 𝐺𝑖 ).

They use 𝑋 1 , . . . , 𝑋 ℓ and 𝑌 1 , . . . , 𝑌 ℓ as inputs to the information-theoretic key agreement protocol and run it, producing a transcript 𝑇 . Their outputs 𝑘𝐴 and 𝑘𝐵 are the outputs of the informationtheoretic key agreement protocol. 55

The public masks preserve correctness, since 𝑋 𝑖 = 𝑌 𝑖 if and only if 𝑋𝑖 = 𝑌𝑖 . They also preserve the WBA security of each coordinate: any predictor for 𝑋 𝑖 = 𝑋𝑖 ⊕ 𝐺𝑖 given (𝑍𝑖 , 𝐺𝑖 ) can be converted into a predictor for 𝑋𝑖 given 𝑍𝑖 by XORing the predictor’s output with 𝐺𝑖 . Suppose for contradiction that there exists a QPT adversary {Adv𝜆 }𝜆∈N such that [︁ ]︁ 1 Pr Adv𝜆 (𝑍 1 , . . . , 𝑍 ℓ , 𝑇 ) = 𝑘𝐴 | 𝑘𝐴 = 𝑘𝐵 ≥ + non-negl(𝜆). 2 Define its conditional key-guessing advantage by ]︁ 1 [︁ 𝛽(𝜆) := Pr Adv𝜆 (𝑍 1 , . . . , 𝑍 ℓ , 𝑇 ) = 𝑘𝐴 | 𝑘𝐴 = 𝑘𝐵 − . 2 By assumption, 𝛽(𝜆) = non-negl(𝜆). Our goal is to obtain a QPT adversary {Adv′𝜆 }𝜆∈N such that, for infinitely many 𝜆, (𝑍,𝑋)←𝐷𝜆

Min-entropy alignment.

Adv′𝜆 (𝑍) = 𝑋 ≥

[︀

Pr

]︀

1 𝛿(𝜆) + + non-negl(𝜆). 2 2

(34)

We denote 𝜂(𝜆) := max{

[𝑍 = 𝑧] | 𝑧 ∈ {0, 1}𝑛(𝜆) }.

Pr (𝑍,𝑋)←𝐷𝜆

If it is not the case that 𝜂(𝜆) ≤ negl(𝜆), we modify ΠWBA so that, at the end of the protocol, one of the parties sends a uniformly random bitstring 𝑈 ← {0, 1}𝜆 , which is then ignored. We include 𝑈 as part of the WBA transcript. Since 𝑈 is independent of the parties’ outputs, this leaves correctness and security unchanged and ensures that max 𝐷𝜆 (𝑧, 𝑥) ≤ negl(𝜆). (𝑧,𝑥)

Henceforth, we assume without loss of generality that this min-entropy condition holds. Parameter translation.

The WBA security guarantee can be rewritten as

[︀

]︀

̃︀ ) = 𝑘𝐴 | 𝑘𝐴 = 𝑘𝐵 ≤ Pr 𝐸(𝜏

𝛿hc (𝜆) 1 𝛿(𝜆) + + negl(𝜆) = 1 − + negl(𝜆). 2 2 2

Define

𝜅(𝜆) . 2 Earlier, we defined 𝜅(𝜆) ≤ 𝛿hc (𝜆)/2 for all sufficiently large 𝜆. Hence 𝛿* (𝜆) ∈ (0, 1) for all sufficiently large 𝜆. 𝛿* (𝜆) := 𝛿hc (𝜆) −

Fixing the hard-core parameter. Since 𝛽(𝜆) = non-negl(𝜆), there exists a polynomial 𝑝(·) and infinitely many security parameters 𝜆 such that 1 𝛽(𝜆) ≥ . 𝑝(𝜆) In the remainder of the proof, we restrict attention to this infinite set of security parameters. Define 𝛿* (𝜆) 𝜅(𝜆) 1 𝛾(𝜆) := min , , . 8 4 8ℓ(𝜆)𝑝(𝜆) {︂

}︂

Then 𝛾(𝜆) = Ω(1/poly(𝜆)) on this infinite set, and for all sufficiently large 𝜆 we have 0 < 𝛾(𝜆) ≤ 𝛿* (𝜆), as required in Corollary 6.8. 56

(35)

Invoking the hard-core contrapositive. We will apply Corollary 6.8 to the distribution 𝐷𝜆 over (𝑍, 𝑋) with density parameter 𝛿* (𝜆) and hard-core parameter 𝛾(𝜆). It suffices to show that for every measure 𝑀𝜆 ⪯ 𝐷𝜆 satisfying 𝜇(𝑀𝜆 ) ≥ 𝛿* (𝜆) −

𝛾(𝜆) , 4

(36)

there exists a non-uniform QPT predictor Adv′′𝜆 such that Adv′′𝜆 (𝑍) = 𝑋 >

[︀

Pr (𝑍,𝑋)←𝑀𝜆

]︀

1 + 𝛾(𝜆), 2

(37)

where (𝑍, 𝑋) ← 𝑀𝜆 denotes sampling from the normalized distribution 𝑀𝜆 /𝜇(𝑀𝜆 ). Indeed, once this is shown, Corollary 6.8 yields a non-uniform QPT predictor Adv′𝜆 such that, for infinitely many 𝜆, Adv′𝜆 (𝑍) = 𝑋 > 1 −

[︀

Pr (𝑍,𝑋)←𝐷𝜆

]︀

𝛿* (𝜆) 1 𝛿(𝜆) 𝜅(𝜆) = + + . 2 2 2 4

contradicting WBA security. A hybrid argument.

Fix any such measure 𝑀 := 𝑀𝜆 ⪯ 𝐷 := 𝐷𝜆 , and define 𝜌(𝑧, 𝑥) :=

⎧ ⎨ 𝑀 (𝑧,𝑥) ,

𝐷(𝑧, 𝑥) > 0,

⎩0,

𝐷(𝑧, 𝑥) = 0.

𝐷(𝑧,𝑥)

Since 𝑀 ⪯ 𝐷, we have 𝜌(𝑧, 𝑥) ∈ [0, 1] for every (𝑧, 𝑥). For 𝑖 ∈ {0, . . . , ℓ}, define the hybrid ℋ𝑖 as follows. First, run the WBA protocol ℓ times to produce 𝑋1 , . . . , 𝑋ℓ ,

𝑌1 , . . . , 𝑌ℓ ,

𝑍1 , . . . , 𝑍ℓ .

Set initially ̂︀ 𝑗 , 𝑌̂︀𝑗 ) := (𝑋𝑗 , 𝑌𝑗 ) (𝑋

for every 𝑗 ∈ [ℓ].

For every 𝑗 ∈ [ℓ], if 𝑋𝑗 = 𝑌𝑗 , sample a flag bit 𝐵𝑗 according to Pr[𝐵𝑗 = 1 | 𝑋𝑗 , 𝑌𝑗 , 𝑍𝑗 ] = 𝜌(𝑍𝑗 , 𝑋𝑗 ). ̂︀ 𝑗 , 𝑌̂︀𝑗 ) by (𝑅𝑗 , 𝑅𝑗 ), where If 𝑋𝑗 ̸= 𝑌𝑗 , set 𝐵𝑗 := 0. For every 𝑗 ≤ 𝑖 such that 𝐵𝑗 = 1, replace (𝑋 𝑅𝑗 ← {0, 1} is freshly sampled and uniform. After this replacement step, sample independent public bits 𝐺1 , . . . , 𝐺ℓ ← {0, 1},

and define ̂︀ 𝑗 ⊕ 𝐺𝑗 , 𝑋 𝑗 := 𝑋

𝑌 𝑗 := 𝑌̂︀𝑗 ⊕ 𝐺𝑗 ,

𝑍 𝑗 := (𝑍𝑗 , 𝐺𝑗 ).

Run the information-theoretic key agreement protocol on 𝑋 1, . . . , 𝑋 ℓ

and

𝑌 1, . . . , 𝑌 ℓ

to obtain transcript 𝑇 and output bits (𝑘𝐴 , 𝑘𝐵 ). Run Adv𝜆 (𝑍 1 , . . . , 𝑍 ℓ , 𝑇 ) 57

to obtain 𝑐. The hybrid outputs 1 if and only if and

𝑐 = 𝑘𝐴

𝑘𝐴 = 𝑘𝐵 .

We first note that the joint distribution of the input bits (𝑋 1 , 𝑌 1 ), . . . , (𝑋 ℓ , 𝑌 ℓ ) to the information-theoretic key agreement protocol is identical in all hybrids. Indeed, the only replacement occurs when 𝑋𝑗 = 𝑌𝑗 , and after the public mask 𝐺𝑗 is applied, both (𝑋𝑗 ⊕ 𝐺𝑗 , 𝑌𝑗 ⊕ 𝐺𝑗 )

(𝑅𝑗 ⊕ 𝐺𝑗 , 𝑅𝑗 ⊕ 𝐺𝑗 )

and

are distributed as a uniformly random equal pair. Therefore, if 𝑝agr := Pr[𝑘𝐴 = 𝑘𝐵 ], then 𝑝agr is the same in all hybrids. The hybrid ℋ0 is exactly the real attack experiment for the amplified protocol. Hence, by the contradiction assumption, (︂

Pr[ℋ0 = 1] = 𝑝agr ·

1 + 𝛽(𝜆) . 2 )︂

(38)

We next argue that in ℋℓ , the variables (𝑋 𝑗 , 𝑌 𝑗 , 𝑍 𝑗 )𝑗∈[ℓ] are independent (𝜖(𝜆), 𝛿hc (𝜆) − 𝜅(𝜆))-secure random variables. Fix any 𝑗 ∈ [ℓ]. Since 𝐺𝑗 is uniform and independent, we have ]︁ [︁ ]︁ [︁ ]︁ [︁ ]︁ [︁ 1 Pr 𝑋 𝑗 = 0 = Pr 𝑋 𝑗 = 1 = Pr 𝑌 𝑗 = 0 = Pr 𝑌 𝑗 = 1 = . 2

Moreover, equality is preserved by the mask, and the replacement step only occurs when 𝑋𝑗 = 𝑌𝑗 . Therefore [︁ ]︁ 1 𝜖(𝜆) Pr 𝑋 𝑗 = 𝑌 𝑗 = Pr[𝑋𝑗 = 𝑌𝑗 ] ≥ + − negl(𝜆). 2 2 Define the event 𝐹𝑗 := {𝑋𝑗 = 𝑌𝑗 ∧ 𝐵𝑗 = 1}. Then 𝐹𝑗 implies 𝑋 𝑗 = 𝑌 𝑗 . Furthermore, because 𝑋 𝑗 = 𝑌 𝑗 if and only if 𝑋𝑗 = 𝑌𝑗 , and conditioned on 𝑋𝑗 = 𝑌𝑗 the pair (𝑍𝑗 , 𝑋𝑗 ) is distributed according to 𝐷, we have [︁

]︁

Pr 𝐹𝑗 | 𝑋 𝑗 = 𝑌 𝑗 =

E

[𝜌(𝑍, 𝑋)] = 𝜇(𝑀 ).

(𝑍,𝑋)←𝐷

By (36) and the definitions of 𝛿* and 𝛾, we have 𝜇(𝑀 ) ≥ 𝛿* (𝜆) −

𝛾(𝜆) 𝜅(𝜆) 𝛾(𝜆) = 𝛿hc (𝜆) − − . 4 2 4

Since 𝛾(𝜆) ≤ 𝜅(𝜆)/4, this implies 𝜇(𝑀 ) ≥ 𝛿hc (𝜆) −

𝜅(𝜆) 𝜅(𝜆) − ≥ 𝛿hc (𝜆) − 𝜅(𝜆). 2 16 58

Thus the event 𝐹𝑗 has sufficiently large conditional probability to witness that the variables in ℋℓ are (𝜖(𝜆), 𝛿hc (𝜆) − 𝜅(𝜆)) -secure random variables. Finally, 𝐼(𝑋 𝑗 ; 𝑍 𝑗 | 𝐹𝑗 ) = 0. Indeed, conditioned on 𝐹𝑗 , in ℋℓ we have 𝑋 𝑗 = 𝑅𝑗 ⊕ 𝐺𝑗 , where 𝑅𝑗 is uniform and independent of (𝑍𝑗 , 𝐺𝑗 ). Thus the variables in ℋℓ satisfy the input condition for the information-theoretic key agreement protocol. Hence the output triple (𝑘𝐴 , 𝑘𝐵 , (𝑇, 𝑍 1 , . . . , 𝑍 ℓ )) is an (1 − 2−𝜆 , 1 − 2−𝜆 )-secure random variable. In particular, 𝑝agr = Pr[𝑘𝐴 = 𝑘𝐵 ] ≥ 1 − negl(𝜆), and any predictor of 𝑘𝐴 from (𝑇, 𝑍 1 , . . . , 𝑍 ℓ ) has success probability at most 1/2 + negl(𝜆) conditioned on 𝑘𝐴 = 𝑘𝐵 . Therefore (︂

Pr[ℋℓ = 1] = 𝑝agr ·

1 + negl(𝜆) . 2 )︂

(39)

Combining (38) and (39), we obtain 𝜏 (𝜆) := Pr[ℋ0 = 1] − Pr[ℋℓ = 1] = 𝑝agr · (𝛽(𝜆) − negl(𝜆)) . Since 𝑝agr ≥ 1 − negl(𝜆), for all sufficiently large 𝜆 in the infinite set under consideration, 𝜏 (𝜆) ≥

𝛽(𝜆) . 2

(40)

Therefore, there exists an index 𝑖 = 𝑖(𝜆) ∈ [ℓ] such that Pr[ℋ𝑖−1 = 1] − Pr[ℋ𝑖 = 1] ≥ 𝛼(𝜆),

where 𝛼(𝜆) :=

𝛽(𝜆) . 2ℓ(𝜆)

(41)

Let 𝑊 denote the tuple of post-randomization values in all coordinates except 𝑖: (︀

)︀

𝑊 := (𝑋 𝑗 , 𝑌 𝑗 , 𝑍 𝑗 ) 𝑗̸=𝑖 . The distribution of 𝑊 is the same in ℋ𝑖−1 and ℋ𝑖 . By averaging, there exists a value 𝑤 = 𝑤(𝜆) in the support of 𝑊 such that Pr[ℋ𝑖−1 = 1 | 𝑊 = 𝑤] − Pr[ℋ𝑖 = 1 | 𝑊 = 𝑤] ≥ 𝛼(𝜆).

59

(42)

Defining Adv′′𝜆 . Hard-code 𝑖 = 𝑖(𝜆) and 𝑤 = 𝑤(𝜆) into Adv′′𝜆 . Given input a WBA transcript 𝑧, the predictor Adv′′𝜆 operates as follows. 1. Sample independent uniform bits 𝑅𝑖 , 𝐺𝑖 ← {0, 1}, and set 𝑥𝑖 = 𝑦 𝑖 := 𝑅𝑖 ⊕ 𝐺𝑖 ,

𝑧 𝑖 := (𝑧, 𝐺𝑖 ).

Combine this coordinate with the hard-coded values 𝑤 in all coordinates 𝑗 ̸= 𝑖, and run the information-theoretic key agreement protocol to obtain transcript 𝑇 and outputs (𝑘𝐴 , 𝑘𝐵 ). 2. Query Adv𝜆 (𝑧 1 , . . . , 𝑧 ℓ , 𝑇 ) to obtain 𝑐. 3. If 𝑐 = 𝑘𝐴 and 𝑘𝐴 = 𝑘𝐵 , output 𝑅𝑖 . Otherwise, output 1 ⊕ 𝑅𝑖 . Let 𝑠Adv (𝜆) be an upper bound on the circuit size of Adv𝜆 , and let 𝑠KA (𝜆) upper bound the circuit size needed to execute the efficient information-theoretic key-agreement protocol once on ℓ(𝜆) input bits, producing (𝑇, 𝑘𝐴 , 𝑘𝐵 ). Both 𝑠Adv and 𝑠KA are polynomial in 𝜆. Hard-coding 𝑤, 𝑖 contributes 𝑂(ℓ(𝜆) · (𝑛(𝜆) + 3)) bits of advice and hence 𝑂(ℓ(𝜆) · 𝑛(𝜆)) circuit-size overhead. Therefore the constructed nonuniform predictor Adv′′𝜆 can be implemented by a quantum circuit of size at most 𝑡(𝜆) := 𝑠Adv (𝜆) + 𝑠KA (𝜆) + 𝑂(ℓ(𝜆) · 𝑛(𝜆)) + poly(𝜆) = poly(𝜆).

(43)

Recall 𝐹𝑖 = {𝑋𝑖 = 𝑌𝑖 ∧ 𝐵𝑖 = 1}. By construction, conditioned on 𝑊 = 𝑤, the hybrids ℋ𝑖−1 and ℋ𝑖 are identical conditioned on ¬𝐹𝑖 . Conditioned on 𝐹𝑖 , they differ only in the value fed to the information-theoretic protocol in coordinate 𝑖: in ℋ𝑖−1 it is 𝑋𝑖 ⊕ 𝐺𝑖 , while in ℋ𝑖 it is 𝑅𝑖 ⊕ 𝐺𝑖 for an independent uniform 𝑅𝑖 . Therefore Pr[ℋ𝑖−1 = 1 | 𝑊 = 𝑤] − Pr[ℋ𝑖 = 1 | 𝑊 = 𝑤] (︁

)︁

= Pr[𝐹𝑖 | 𝑊 = 𝑤] · Pr[ℋ𝑖−1 = 1 | 𝑊 = 𝑤, 𝐹𝑖 ] − Pr[ℋ𝑖 = 1 | 𝑊 = 𝑤, 𝐹𝑖 ] . Combining this identity with (42), and using Pr[𝐹𝑖 | 𝑊 = 𝑤] ≤ 1, yields Pr[ℋ𝑖−1 = 1 | 𝑊 = 𝑤, 𝐹𝑖 ] − Pr[ℋ𝑖 = 1 | 𝑊 = 𝑤, 𝐹𝑖 ] ≥ 𝛼(𝜆).

(44)

Let 𝐺out denote the event that the hybrid outputs 1, namely 𝐺out := {𝑐 = 𝑘𝐴 ∧ 𝑘𝐴 = 𝑘𝐵 }. Then (44) says [︁

]︁

[︁

]︁

Pr 𝐺out | 𝑊 = 𝑤, 𝐹𝑖 , 𝑋 𝑖 = 𝑋𝑖 ⊕ 𝐺𝑖 − Pr 𝐺out | 𝑊 = 𝑤, 𝐹𝑖 , 𝑋 𝑖 ← 𝑅𝑖 ⊕ 𝐺𝑖 ≥ 𝛼(𝜆). Since 𝑅𝑖 is uniform and independent of 𝑋𝑖 , the second term is the average of the two cases 𝑋 𝑖 = 𝑋𝑖 ⊕ 𝐺𝑖

𝑋 𝑖 = (1 − 𝑋𝑖 ) ⊕ 𝐺𝑖 .

and 60

Hence

[︁

Δ𝐺 := Pr 𝐺out | 𝑊 = 𝑤, 𝐹𝑖 , 𝑋 𝑖 = 𝑋𝑖 ⊕ 𝐺𝑖

]︁

(45)

]︁

[︁

− Pr 𝐺out | 𝑊 = 𝑤, 𝐹𝑖 , 𝑋 𝑖 = (1 − 𝑋𝑖 ) ⊕ 𝐺𝑖 ≥ 2𝛼(𝜆).

Conditioned on 𝐹𝑖 , the pair (𝑍𝑖 , 𝑋𝑖 ) is distributed according to the normalized measure 𝑀 . Indeed, for every (𝑧, 𝑥) in the support of 𝐷, Pr[(𝑍𝑖 , 𝑋𝑖 ) = (𝑧, 𝑥) | 𝐹𝑖 ] = =

𝐷(𝑧, 𝑥)𝜌(𝑧, 𝑥) E(𝑍,𝑋)←𝐷 [𝜌(𝑍, 𝑋)] 𝑀 (𝑧, 𝑥) . 𝜇(𝑀 )

Therefore, by construction of Adv′′𝜆 , Pr

(𝑍𝑖 ,𝑋𝑖 )←𝑀

Adv′′𝜆 (𝑍𝑖 ) = 𝑋𝑖 = Pr[𝐺out ∧ 𝑅𝑖 = 𝑋𝑖 | 𝑊 = 𝑤, 𝐹𝑖 ]

[︀

]︀

+ Pr[¬𝐺out ∧ 𝑅𝑖 = 1 − 𝑋𝑖 | 𝑊 = 𝑤, 𝐹𝑖 ] 1 (︁ = Pr[𝐺out | 𝑊 = 𝑤, 𝐹𝑖 , 𝑅𝑖 = 𝑋𝑖 ] 2 + Pr[¬𝐺out | 𝑊 = 𝑤, 𝐹𝑖 , 𝑅𝑖 = 1 − 𝑋𝑖 ]

)︁

1 = (1 + Δ𝐺 ) 2 1 ≥ + 𝛼(𝜆). 2 On the infinite set under consideration, 𝛽(𝜆) ≥ 1/𝑝(𝜆), and hence 𝛼(𝜆) =

𝛽(𝜆) 1 ≥ > 𝛾(𝜆), 2ℓ(𝜆) 2ℓ(𝜆)𝑝(𝜆)

Pr

[︀

by (35). Thus (𝑍𝑖 ,𝑋𝑖 )←𝑀𝜆

Adv′′𝜆 (𝑍𝑖 ) = 𝑋𝑖 > ]︀

1 + 𝛾(𝜆), 2

which establishes (37). Finally, choose the size bound 𝑠(𝜆) in Corollary 6.8 so that for all sufficiently large 𝜆, (︁

𝑠(𝜆) ≥ 𝑞(𝜆, 1/𝜀(𝜆)) · 𝑛(𝜆) +

⌈︁ 4𝑛(𝜆)

⌉︁)︁

(𝑡(𝜆) + 1) 𝛾(𝜆)2

where

+ 𝑟(𝜆, 1/𝜀(𝜆)),

𝛿* (𝜆)𝛾(𝜆) . 4 Then the resulting parameter 𝑠′ (𝜆) from Corollary 6.8 satisfies 𝑠′ (𝜆) ≥ 𝑡(𝜆), so Adv′′𝜆 is a valid witness circuit in the premise of the corollary. Therefore Corollary 6.8, invoked with density parameter 𝛿* (𝜆) and hard-core parameter 𝛾(𝜆), gives a predictor Adv′𝜆 such that, for infinitely many 𝜆, ]︀ [︀ 𝛿* (𝜆) Pr Adv′𝜆 (𝑍) = 𝑋 > 1 − . 2 (𝑍,𝑋)←𝐷𝜆 𝜀(𝜆) =

61

By definition of 𝛿* (𝜆), 1−

𝛿* (𝜆) 𝛿hc (𝜆) 𝜅(𝜆) 1 𝛿(𝜆) 𝜅(𝜆) =1− + = + + . 2 2 4 2 2 4

Since 𝜅(𝜆) = 1/poly(𝜆), this exceeds the WBA security threshold 1 𝛿(𝜆) + + negl(𝜆) 2 2 by an inverse-polynomial amount for all sufficiently large 𝜆 in the infinite set under consideration. This contradicts WBA security. This contradiction proves that the amplified protocol is computationally secure. Its correctness and lack of bias follow from the guarantee of the information-theoretic key agreement protocol, and hence the protocol is a fully secure bit-agreement protocol. This completes the proof. We conclude this section by relating our key-agreement amplification result to non-commutation tests, and prove that non-commutation tests in a certain parameter regime imply key agreement. We also conclude that any non-commutation test with robust completeness implies key agreement. Corollary 6.14. Given any normal-form (𝜖, 𝛿)-ToNC such that 𝜖 >

1 + 4𝛿 1 + , 5 poly(𝜆)

there exists classical-communication key agreement. Proof. By Theorem 5.1, a normal-form (𝜖, 𝛿)-ToNC implies (𝜖, 𝛾)-WBA with 𝛾=

4(1 + 𝛿) 1 + 4𝛿 − 3𝜖 = − 3. 1+𝜖 1+𝜖

Next, by Theorem 6.13, it suffices that for some slack 𝜁(𝜆) = 1/poly(𝜆), there exists an efficient information-theoretic key-agreement protocol for (𝜖, 1 − 𝛾 − 𝜁(𝜆))-secure random variables. By Claim 6.12, such a protocol exists whenever 1 − 𝛾 − 𝜁(𝜆) >

1−𝜖 . 1+𝜖

Substituting 𝛾 = 4(1+𝛿) 1+𝜖 − 3 yields 4−

4(1 + 𝛿) 1−𝜖 − 𝜁(𝜆) > . 1+𝜖 1+𝜖

Multiplying by 1 + 𝜖 and rearranging gives (5 − 𝜁(𝜆)) 𝜖 > 1 + 4𝛿 + 𝜁(𝜆), equivalently 𝜖 >

1 + 4𝛿 + 𝜁(𝜆) . 5 − 𝜁(𝜆)

Since 𝜁(𝜆) = 1/poly(𝜆), this is implied by 𝜖 >

1 + 4𝛿 1 + . 5 poly(𝜆)

Under this condition we obtain key agreement, completing the proof. 62

Corollary 6.15. Given any normal-form (𝜖, 𝛿)-ToNC with robust completeness and 𝜖 > 𝛿 + 1/poly(𝜆), there exists classical-communication key agreement. Proof. By Theorem 5.1, a normal-form (𝜖, 𝛿)-ToNC with robust completeness implies (𝜖, 𝛾)-WBA with 𝛾 = 2𝛿 − 𝜖. Therefore, if 𝜖 > 𝛿 + 1/poly(𝜆), there exists a (𝜖, 𝛾)-WBA with 𝛾 < 𝜖 − 1/poly(𝜆). Then by Claim 6.12 and Theorem 6.13, there exists a standard key agreement protocol.

6.3

Post-quantum interactive XOR lemma

The multiplicative Isolation Lemma—introduced and proved by Levin—is used in his work to prove Yao’s XOR lemma [Lev85]. Halevi and Rabin [HR08, Lemma 3.1] extend Levin’s proof of Yao’s XOR lemma, which relies on the Isolation Lemma, to the setting of classical interactive protocols. In particular, they show that if every computationally bounded adversary can predict the protocol’s single secret bit with correlation advantage at most 𝜀, then the 𝑡-fold sequential XOR-composition amplifies secrecy so that every efficient adversary’s advantage drops to roughly 𝜀𝑡 (up to negligible terms). We extend their result to the post-quantum setting, by proving an analogous theorem which enables amplifying security against computationally-bounded quantum adversaries. The main challenge in proving such a theorem, is the reliance of the classical proof on rewinding the adversary, which is non-trivial and at times potentially impossible when the adversary is quantum, due to the no-cloning principle. In order to overcome it, we utilize an approach for quantum rewinding developed by Marriott and Watrous [MW04] and further analyzed by [CMSZ22] (see our Preliminaries section for an introduction to this approach). Theorem 6.16. Let Γ1 , Γ2 be two protocols such that for any 𝑖 ∈ {1, 2}, for any QPT adversary 𝐴 and state |𝜓⟩, E

𝑟←{0,1}* , 𝑏𝐴 , 𝜉←Γ𝑖 ⟨𝐴(|𝜓⟩),𝑉𝑖 (𝑟)⟩

[𝑏𝐴 · 𝑃𝑖 (𝑟, 𝜉)] ≤ 𝛿𝑖 ,

where 𝑉𝑖 is the verifier in Γ𝑖 , 𝑟𝑖 are its random bits, 𝜉 is the interaction transcript, 𝑃𝑖 (𝑟, 𝜉) ∈ {−1, +1} is a poly(𝜆)-time computable predicate, and 𝑏𝐴 ∈ {−1, +1} is the adversary’s output. Then for any QPT adversary 𝐴 and state |𝜓⟩, E

𝑟1 ,𝑟2 ←{0,1}* , |𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 (|𝜓⟩),𝑉1 (𝑟1 )⟩, 𝑏𝐴 , 𝜉2 ←Γ2 ⟨𝐴2 (|𝜓 ′ ⟩),𝑉2 (𝑟2 )⟩

[𝑏𝐴 · 𝑃1 (𝑟1 , 𝜉1 ) · 𝑃2 (𝑟2 , 𝜉2 )] ≤ 𝛿1 · 𝛿2 + negl(𝜆),

where we view 𝐴 as a sequential adversary 𝐴 = (𝐴1 , 𝐴2 ): first 𝐴1 interacts with 𝑉1 (𝑟1 ) on input |𝜓⟩, producing a transcript 𝜉1 and leaving a residual state |𝜓 ′ ⟩; then 𝐴2 , initialized with |𝜓 ′ ⟩, interacts with 𝑉2 (𝑟2 ) producing a transcript 𝜉2 and output bit 𝑏𝐴 . Proof. Suppose for contradiction that there exist a QPT adversary 𝐴 and a quantum state |𝜓⟩ such that E * [𝑏𝐴 · 𝑃1 (𝑟1 , 𝜉1 ) · 𝑃2 (𝑟2 , 𝜉2 )] > 𝛿1 · 𝛿2 + 𝜅(𝜆). 𝑟1 ,𝑟2 ←{0,1} , |𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 (|𝜓⟩),𝑉1 (𝑟1 )⟩, 𝑏𝐴 , 𝜉2 ←Γ2 ⟨𝐴2 (|𝜓 ′ ⟩),𝑉2 (𝑟2 )⟩

63

for a function 𝜅 = Ω(1/poly(𝜆)). We can write this as ⎡

⎤

⎢ ⎣𝑃1 (𝑟1 , 𝜉1 ) ·

E

𝑟1 ←{0,1}*

|𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 (|𝜓⟩),𝑉1 (𝑟1 )⟩

[𝑏𝐴 · 𝑃2 (𝑟2 , 𝜉2 )]⎦ > 𝛿1 · 𝛿2 + 𝜅(𝜆), (46) ⎥

E

𝑟2 ←{0,1}* 𝑏𝐴 , 𝜉2 ←Γ2 ⟨𝐴2 (|𝜓 ′ ⟩),𝑉2 (𝑟2 )⟩

Now, for any |𝜓 ′ ⟩, let 𝑇 (⃒𝜓 ′ ) := ⃒

⟩︀

E

𝑟2 ←{0,1}* 𝑏𝐴 , 𝜉2 ←Γ2 ⟨𝐴2 (|𝜓 ′ ⟩),𝑉2 (𝑟2 )⟩

[𝑏𝐴 · 𝑃2 (𝑟2 , 𝜉2 )] .

Due to the security guarantee of Γ2 , for any state |𝜓 ′ ⟩ |𝑇 (⃒𝜓 ′ )| ≤ 𝛿2 . ⃒

⟩︀

(47)

Note that if 𝑇 (|𝜓 ′ ⟩) < −𝛿2 using an adversary 𝐴2 , we obtain an adversary which breaks the security by flipping the sign of the predictions of 𝐴2 . This justifies the bound on the absolute value of 𝑇 (|𝜓 ′ ⟩). Due to (46), we have that [︂

E

𝑟1 ←{0,1}* |𝜓 ′ ⟩, 𝜉←Γ1 ⟨𝐴1 (|𝜓⟩),𝑉1 (𝑟1 )⟩

𝑇 (|𝜓 ′ ⟩) 𝜅(𝜆) 𝑃1 (𝑟1 , 𝜉1 ) · > 𝛿1 + . 𝛿2 𝛿2 ]︂

(48)

To complete the proof, it suffices to give a procedure 𝐵 that, given |𝜓 ′ ⟩, outputs a real number 𝛼 ∈ [−𝛿2 , 𝛿2 ] so that for any |𝜓 ′ ⟩, 𝜏 (𝜆) := ⃒E[𝐵(⃒𝜓 ′ )] − 𝑇 (⃒𝜓 ′ )⃒ ⃒

⃒

⟩︀

⃒

⟩︀ ⃒

such that 𝜅−𝜏 1 = Ω( ). 𝛿2 poly(𝜆)

(49)

Indeed, given such a 𝐵, an adversary 𝐴 could perform the following steps: 1. Run 𝐴1 in the interaction with 𝑣1 and keep the intermediate state |𝜓 ′ ⟩. 2. Run 𝐵(|𝜓 ′ ⟩) and obtain 𝛼. 3. Output 𝑏𝐴 ∈ {1, −1} sampled as a Bernoulli random variable which takes the value 1 with probability 𝛼/𝛿22 +1 . In that case, we would have

64

E

𝑟←{0,1}* , 𝑏𝐴 , 𝜉←Γ1 ⟨𝐴,𝑉1 (𝑟)⟩

[𝑏𝐴 · 𝑃 (𝑟, 𝜉)] ⎡

=

E

𝑟←{0,1}* , |𝜓 ′ ⟩, 𝜉←Γ1 ⟨𝐴1 ,𝑉1 (𝑟)⟩

⎤

⎢ ⎢ ⎢ ⎣

E ′

𝛼←𝐵(|𝜓 ⟩),

𝑏𝐴 ←Ber(

[︂

=

E

𝑟1 ←{0,1}* |𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 ,𝑉1 (𝑟1 )⟩

E

𝑟1 ←{0,1}* |𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 ,𝑉1 (𝑟1 )⟩

[︂

≥

E

𝑟1 ←{0,1}*

|𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 ,𝑉1 (𝑟1 )⟩

[︂

≥

E

|𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 ,𝑉1 (𝑟1 )⟩

]︂

𝑇 (|𝜓 ′ ⟩) E[𝐵(|𝜓 ′ ⟩)] − 𝑇 (|𝜓 ′ ⟩) + 𝛿2 𝛿2

1 𝑇 (|𝜓 ′ ⟩) · 𝑃1 (𝑟1 , 𝜉1 ) − 𝛿2 𝛿2

)︂

]︂

· 𝑃1 (𝑟1 , 𝜉1 )

]︂

𝑇 (|𝜓 ′ ⟩) 𝛿2

𝑟1 ←{0,1}*

𝛼/𝛿2 +1 ) 2

E[𝐵(|𝜓 ′ ⟩)] · 𝑃1 (𝑟1 , 𝜉1 ) 𝛿2

[︂(︂

=

⎥ ⎥ ⎦

[𝑏𝐴 ] · 𝑃1 (𝑟, 𝜉)⎥

]︂

· 𝑃1 (𝑟1 , 𝜉1 ) −

E

𝑟1 ←{0,1}*

⃒ ⟩︀ ⃒]︀ ⃒ ⟩︀ [︀⃒ ⃒E[𝐵(⃒𝜓 ′ )] − 𝑇 (⃒𝜓 ′ )⃒

|𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 ,𝑉1 (𝑟1 )⟩

𝜏 (𝜆) . 𝛿2

(50) a contradiction with the hardness of Γ1 . In the second equality, we rely on the following identity 𝛼/𝛿2 + 1 E[𝐵(|𝜓 ′ ⟩)] [𝑏𝐴 ] = E ′ 2 E[Ber( )] − 1] = E ′ [𝛼/𝛿2 ] = 2 𝛿2 𝛼←𝐵(|𝜓 ⟩) 𝛼←𝐵(|𝜓 ⟩) [︂

E

𝛼←𝐵(|𝜓 ′ ⟩), 𝑏𝐴 ←Ber(

]︂

𝛼/𝛿2 +1 ) 2

Combined with (48), we get: E[𝐵(|𝜓 ′ ⟩)] · 𝑃1 (𝑟1 , 𝜉1 ) E [𝑏𝐴 · 𝑃1 (𝑟1 , 𝜉1 )] = E 𝛿2 [︂

]︂

> 𝛿1 +

𝜅(𝜆) 𝜏 (𝜆) 1 − = 𝛿1 + Ω( ), 𝛿2 𝛿2 poly(𝜆)

(51)

contradicting the security of Γ1 . The last equality is due to (49). We next define 𝐵. Let 𝑋 be the adversary register holding the intermediate state |𝜓 ′ ⟩ at the start of the second execution. Let 𝑌 be an auxiliary register that contains the ancilla qubits to be used by both parties for computations and communication. It includes one designated qubit 𝑍 that indicates whether the final outputs match. By purification and deferred measurement, there exists a unitary 𝑈 :𝑋 ⊗𝑌 →𝑋 ⊗𝑌 that coherently implements the full second execution of Γ2 between 𝐴2 and 𝑉2 . Define the match projector by Πmatch := 𝐼𝑋,𝑌 ∖𝑍 ⊗ |0⟩⟨0|𝑍 , and define

Π1 := 𝑈 † Πmatch 𝑈.

Also define the projector onto the clean start state of 𝑌 : Π0 := 𝐼𝑋 ⊗ |0⟩⟨0|𝑌 . 65

Fix 𝜀, 𝜂 > 0 and let ⌈︂

𝑛 :=

ln(1/2𝜂) 2𝜀2

⌉︂

. On input |𝜓 ′ ⟩𝑋 , algorithm 𝐵: 1. Prepares 𝑌 in |0⟩𝑌 , so the joint state is |Ψ0 ⟩ = |𝜓 ′ ⟩𝑋 |0⟩𝑌 ∈ im(Π0 ). 2. Performs 𝑛 alternating binary projective measurements, starting with Π1 : (Π1 , 𝐼 − Π1 ), (Π0 , 𝐼 − Π0 ), (Π1 , 𝐼 − Π1 ), (Π0 , 𝐼 − Π0 ), . . . Let 𝑏𝑖 ∈ {0, 1} be the outcome bit of the 𝑖-th measurement. 3. Sets 𝑝̃︀ := NReps(1, 𝑏1 , . . . , 𝑏𝑛 ),

̃︀ := 2𝑝̃︀ − 1. 𝛼

4. Outputs the clipped value ̃︀ ∈ [−𝛿2 , 𝛿2 ]. 𝛼 := max{−𝛿2 , min{𝛿2 , 𝛼}}

Let 𝑞(𝜓 ′ ) := Pr[𝑏𝐴 = 𝑃 (𝑟2 , 𝜉2 ) : Γ2 ⟨𝐴2 (|𝜓 ′ ⟩), 𝑉 (𝑟2 )⟩] be the probability in the second execution, so that 𝑇 (|𝜓 ′ ⟩) = E[𝑏𝐴 · 𝑃2 (𝑟2 , 𝜉2 )] = 2𝑞(𝜓 ′ ) − 1. By Proposition 3.13 applied with 𝐵 = (Π0 , I − Π0 ) and 𝐴 = (Π1 , I − Π1 ), the estimator 𝑝̃︀ satisfies ̃︀ = 𝑞(𝜓 ′ ), hence E[𝑝] ̃︀ = 2E[𝑝] ̃︀ − 1 = 2𝑞(𝜓 ′ ) − 1 = 𝑇 (|𝜓 ′ ⟩). E[𝛼] Furthermore, the hardness of Γ2 implies that all eigenvalues of Π0 Π1 Π0 restricted to im(Π0 ) lie in [︀ 1 𝛿2 1 𝛿2 ]︀ 2 − 2 , 2 + 2 . Let us show this. Fix any unit vector |𝜑⟩ ∈ im(Π0 ). Since Π0 = 𝐼𝑋 ⊗ |0⟩⟨0|𝑌 , every such vector is of the form |𝜑⟩ = |𝜓 ′ ⟩𝑋 |0⟩𝑌 for some unit |𝜓 ′ ⟩𝑋 , and hence ⟨𝜑|Π0 Π1 Π0 |𝜑⟩ = ⟨𝜑|Π1 |𝜑⟩. By construction of Π1 := 𝑈 † Πmatch 𝑈 , the quantity 𝑞(𝜓 ′ ) is equal to ⟨𝜓 ′ 0|Π1 |𝜓 ′ 0⟩. Moreover, due to (47), |𝑇 (|𝜓 ′ ⟩)| ≤ 𝛿2 , and recall that 𝑇 (|𝜓 ′ ⟩) = 2𝑞(𝜓 ′ ) − 1. Hence, 𝑞(𝜓 ′ ) ∈ [ 21 − 𝛿22 , 12 + 𝛿22 ]. Therefore, for every unit |𝜑⟩ ∈ im(Π0 ), 𝛿2 1 2 − 2

≤ ⟨𝜑|Π0 Π1 Π0 |𝜑⟩ ≤ 21 + 𝛿22 ,

which implies the stated restriction of the eigenvalues. Therefore, Corollary 3.10 implies that every Jordan parameter 𝑝𝑗 lies in this interval, so 2𝑝𝑗 −1 ∈ ̃︀ [−𝛿2 , 𝛿2 ]. By Chernoff’s bound, Pr[|𝑝̃︀ − 𝑝𝑗 | ≤ 𝜀] ≥ 1−𝜂 in each Jordan block, hence |𝛼−(2𝑝 𝑗 −1)| ≤ ̃︀ by at most 2𝜀 on the good 2𝜀 except with probability 𝜂. Therefore, the clipping step changes 𝛼 event and by at most 2 always, yielding the expectation bound ⃒ ⃒ ⃒E[𝛼] − E[𝛼] ̃︀ ⃒ ≤ 2𝜀 + 2𝜂.

Combining the last two displays, 𝜏 (𝜆) := ⃒E[𝐵(|𝜓 ′ ⟩)] − 𝑇 (|𝜓 ′ ⟩)⃒ = ⃒E[𝛼] − 𝑇 (|𝜓 ′ ⟩)⃒ ≤ 2𝜀 + 2𝜂. ⃒

⃒

⃒

⃒

𝜅−𝜏 1 Choosing, for example, 𝜀(𝜆), 𝜂(𝜆) := 𝜅(𝜆) 8 , implies 𝛿2 = Ω( poly(𝜆) ) as required.

66

Remark 6.17. We stress that our Theorem holds in the non-uniform computational model, where the security of the protocol holds against any QPT adversary with non-uniform quantum advice. Levin’s Isolation Lemma is also proven in the non-uniform model, and Goldreich et al. extend it to the uniform model under an assumption on sampling [GNW11]. We leave the question of extending our result to the uniform model for future work. By applying Theorem 6.16 repeatedly, we immediately obtain the following corollary. Corollary 6.18. Let {Γ𝑖 }𝑖∈[ℓ] be ℓ = poly(𝜆) many protocols such that for each 𝑖 ∈ [ℓ], any QPT adversary 𝐴, and any state |𝜓⟩, E

𝑟←{0,1}* , 𝑏𝐴 , 𝜉←Γ𝑖 ⟨𝐴(|𝜓⟩),𝑉𝑖 (𝑟)⟩

[𝑏𝐴 · 𝑃𝑖 (𝑟, 𝜉)] ≤ 𝛿𝑖 ,

where 𝑉𝑖 is the verifier in Γ𝑖 , 𝑟 are its random bits, 𝜉 is the interaction transcript, 𝑃𝑖 (𝑟, 𝜉) ∈ {−1, +1} is a poly(𝜆)-time computable predicate, and 𝑏𝐴 ∈ {−1, +1} is the adversary’s output. Then for any QPT adversary 𝐴 and state |𝜓⟩, E*

{𝑟𝑖 ←{0,1} }𝑖∈[ℓ] , |𝜓 ′ ⟩, 𝜉1 ←Γ1 ⟨𝐴1 (|𝜓⟩),𝑉1 (𝑟1 )⟩,

[𝑏𝐴 · 𝑃1 (𝑟1 , 𝜉1 ) · · · · · 𝑃ℓ (𝑟ℓ , 𝜉ℓ )] ≤

∏︁

𝛿𝑖 + negl(𝜆),

𝑖∈[ℓ]

.. .

𝑏𝐴 , 𝜉ℓ ←Γℓ ⟨𝐴ℓ (|𝜓 ′ ⟩),𝑉ℓ (𝑟ℓ )⟩

where we view 𝐴 as a sequential adversary 𝐴 = (𝐴1 , . . . , 𝐴ℓ ): first 𝐴1 interacts with 𝑉1 (𝑟1 ) on input |𝜓⟩, producing transcript 𝜉1 and leaving a residual state |𝜓 ′ ⟩; this repeats ℓ times sequentially until 𝐴ℓ , initialized with |𝜓 ′ ⟩, interacts with 𝑉ℓ (𝑟ℓ ) producing transcript 𝜉ℓ and final output bit 𝑏𝐴 .

6.4

Oblivious transfer amplification

First, we give an OT amplification theorem that follows fairly immediately from Corollary 6.18. Theorem 6.19. Given any (1, 𝛿, 0)-OT or (1, 0, 𝛿)-OT secure against adversaries with non-uniform quantum advice (Definition 3.6) for 𝛿 ≤ 1 − 1/poly(𝜆), there exists standard OT secure against adversaries with non-uniform quantum advice. Proof. Note that (1, 0, 𝛿)-weak OT implies (1, 𝛿, 0)-weak OT by standard OT reversal. So let 𝑆 ′ , 𝑅′ be an (1, 𝛿, 0)-weak OT. We perform standard sequential repetition to achieve the standard OT: (1, 0, 0) OT • Let ℓ = 𝜆/(1 − 𝛿). For 𝑖 ∈ [ℓ], the parties run (𝑏𝑖 , 𝑟𝑖 ), (𝑟0,𝑖 , 𝑟1,𝑖 ) ← ⟨𝑅′ (1𝜆 ), 𝑆 ′ (1𝜆 )⟩. • 𝑅 samples 𝑏 ← {0, 1}, sends {𝑏 ⊕ 𝑏𝑖 }𝑖∈[ℓ] to 𝑆, and outputs 𝑟𝑏 := • 𝑆 receives {𝑏′𝑖 }𝑖∈[ℓ] and outputs 𝑟0 :=

⨁︁

𝑟𝑖,𝑏′𝑖 ,

𝑖∈[ℓ]

𝑟1 :=

⨁︁ 𝑖∈[ℓ]

67

𝑟𝑖,1−𝑏′𝑖 .

⨁︀

𝑖∈[ℓ] 𝑟𝑖 .

Correctness follows by inspection, and receiver security follows from a standard hybrid argument. Sender security follows from Corollary 6.18. Indeed, we fix each of Π1 , . . . , Πℓ to be the interactive protocol between honest sender 𝑆 ′ and adversarial receiver, where the predicate 𝑃 outputs the XOR of the sender outputs 𝑟0,𝑖 ⊕ 𝑟1,𝑖 . Then note that 𝛿 ℓ + negl(𝜆) ≤ 𝑒−𝜆 = negl(𝜆). Next, we amplify our committed-bit OT to the point where we can apply the above theorem. As discussed in Section 2.4, our strategy is inspired by a strategy from [Wul07] in the classical semi-honest case. Lemma 6.20. Given any (𝜖, 𝛿, 0) committed-bit OT (Definition 3.8) for constants 𝜖, 𝛿 such that 𝛿 < 𝜖2 , there exists a (1, 1/2, 0) committed-bit OT. Proof. Let Setup′ , OT′ , Ver′ , TrapGen′ , Ext′ be the committed-bit OT. Set ℓ = log𝜖2 /𝛿 (2𝜆), and 𝑡 = 2𝛿1ℓ . Note that ℓ = 𝑂(𝜆) and 𝑡 = poly(𝜆). Our protocol between receiver 𝑅 and sender 𝑆 is defined as follows. (1, 1/2, 0) committed-bit OT • Setup⟨𝑅(1𝜆 ), 𝑆(1𝜆 )⟩: – For 𝑖 ∈ [𝜆], 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], the parties run init𝑅,𝑖,𝑗,𝑘 , 𝜏Setup,𝑖,𝑗,𝑘 ← Setup′ ⟨𝑅′ (1𝜆 ), 𝑆 ′ (1𝜆 )⟩. – Set init𝑅 := {init𝑅,𝑖,𝑗,𝑘 }𝑖,𝑗,𝑘 . • OT⟨𝑅(𝑏, init𝑅 ), 𝑆(init𝑆 )⟩: – For 𝑖 ∈ [𝜆]: * 𝑅 samples 𝑏𝑖 ← {0, 1}. * For 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], the parties run (𝑟𝑖,𝑗,𝑘 , st𝑅,𝑖,𝑗,𝑘 ), (𝑟𝑖,𝑗,𝑘,0 , 𝑟𝑖,𝑗,𝑘,1 , st𝑆,𝑖,𝑗,𝑘 ), 𝜏𝑖,𝑗,𝑘 ← OT′ ⟨𝑅′ (𝑏𝑖 , init𝑅,𝑖,𝑗,𝑘 ), 𝑆 ′ (𝜏Setup,𝑖,𝑗,𝑘 )⟩. – 𝑆 samples 𝑖* ← [𝜆]. For 𝑖 ∈ [𝜆] ∖ {𝑖* }: * 𝑅 sends 𝑏𝑖 . * For 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], the parties run Ver′ ⟨𝑅′ (st𝑅,𝑖,𝑗,𝑘 ), 𝑆 ′ (𝑏𝑖 , st𝑆,𝑖,𝑗,𝑘 )⟩, and 𝑆 aborts if any of the results are ⊥. – 𝑅 sends 𝑏′ := 𝑏 ⊕ 𝑏𝑖 . – 𝑆 samples 𝑟0 , 𝑟1 ← {0, 1}, sends ⎧ ⎨

⨁︁

⎩ 𝑗,𝑏

𝑘∈[ℓ]

𝑟′ ′ := 𝑟0 ⊕

𝑟𝑖* ,𝑗,𝑘,𝑏′ ,

′ 𝑟𝑗,1⊕𝑏 ′ := 𝑟1 ⊕

⨁︁ 𝑘∈[ℓ]

to 𝑅 and outputs 𝑟0 , 𝑟1 and st𝑆 := 𝑏′ , 𝑖* , {st𝑆𝑖* ,𝑗,𝑘 }𝑗,𝑘 .

68

𝑟𝑖* ,𝑗,𝑘,1⊕𝑏′

⎫ ⎬ ⎭

𝑗∈[𝑡]

– 𝑅 outputs ⎧ ⎨

′ ⊕ 𝑟 := maj 𝑟𝑗,𝑏 𝑖*

⨁︁

⎩

𝑘∈[ℓ]

𝑟𝑖* ,𝑗,𝑘

⎫ ⎬ ⎭

𝑗∈[𝑡]

and st𝑅 := {st𝑅𝑖* ,𝑗,𝑘 }𝑗,𝑘 . • Ver⟨𝑅(st𝑅 ), 𝑆(𝑏, st𝑆 )⟩: – For 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], the parties run Ver′ ⟨𝑅′ (st𝑅,𝑖* ,𝑗,𝑘 ), 𝑆 ′ (𝑏 ⊕ 𝑏′ , st𝑆,𝑖* ,𝑗,𝑘 )⟩, and output ⊤ only if all are ⊤. • TrapGen(𝜏Setup ): For 𝑖 ∈ [𝜆], 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], run td𝑖,𝑗,𝑘 := TrapGen′ (𝜏Setup,𝑖,𝑗,𝑘 ) and output td := {td𝑖,𝑗,𝑘 }𝑖,𝑗,𝑘 . • Ext(td, 𝜏 ): For 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], run 𝑏𝑗,𝑘 := Ext′ (td𝑖* ,𝑗,𝑘 , 𝜏𝑖* ,𝑗,𝑘 ). If there exists 𝑏* such that 𝑏𝑗,𝑘 = 𝑏* for all 𝑗, 𝑘, then output 𝑏* ⊕ 𝑏′ , and otherwise output 0. First, we argue correctness. By correctness of OT′ , we have that for any fixed 𝑖* , 𝑗, 𝑘, Pr[∀𝑘 ∈ [ℓ] 𝑟𝑖* ,𝑗,𝑘 = 𝑟𝑖* ,𝑗,𝑘,𝑏𝑖 ] ≥ 𝜖ℓ − negl(𝜆). Thus, by a Hoeffding inequality, we have that ⎡

Pr ⎣maj

⎧ ⎨ ⨁︁ ⎩

𝑘∈[ℓ]

𝑟𝑖* ,𝑗,𝑘 ⊕

⨁︁

𝑟𝑖* ,𝑗,𝑘,𝑏𝑖

𝑘∈[ℓ]

⎫ ⎬

⎤ ℓ

2

2

ℓ

= 0⎦ ≥ 1−𝑒−2(𝜖 −negl(𝜆)) 𝑡 ≥ 1−𝑒−(𝜖 /𝛿) −negl(𝜆) = 1−negl(𝜆).

⎭

By construction, this event implies that 𝑟 = 𝑟𝑏 , which completes the proof. Next, completeness follows from the completeness of OT′ , and receiver security follows from the receiver security of OT′ and a standard hybrid argument. Thus, it remains to argue sender security. ̃︀ init , 𝑅) is the adversarial receiver, and We define Hyb𝜄 for each 𝜄 = 0, . . . , 𝑡, as follows. Here, (𝑅 we describe their interaction with a challenger running a variant of the honest sender algorithms. To avoid notational clutter, we don’t explicitly notate the adversary’s state as it evolves throughout this process. Hyb𝜄 ̃︀ init , 𝑆 ′ (1𝜆 )⟩ and td𝑖,𝑗,𝑘 := TrapGen′ (𝜏Setup,𝑖,𝑗,𝑘 ). • For 𝑖 ∈ [𝜆], 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], run 𝜏Setup,𝑖,𝑗,𝑘 ← Setup′ ⟨𝑅 ̃︀ 𝑆 ′ (𝜏Setup,𝑖,𝑗,𝑘 )⟩ and • For 𝑖 ∈ [𝜆], 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], run (𝑟𝑖,𝑗,𝑘,0 , 𝑟𝑖,𝑗,𝑘,1 , st𝑆,𝑖,𝑗,𝑘 ), 𝜏𝑖,𝑗,𝑘 ← OT′ ⟨𝑅, 𝑏𝑖,𝑗,𝑘 := Ext(td𝑖,𝑗,𝑘 , 𝜏𝑖,𝑗,𝑘 ).

• Sample 𝑖* ← [𝜆]. For 𝑖 ∈ [𝜆] ∖ {𝑖* }: ̃︀ – Receive 𝑏𝑖 from 𝑅. ̃︀ 𝑆 ′ (𝑏𝑖 , st𝑆,𝑖,𝑗,𝑘 )⟩, and abort if any of the results are ⊥. – For 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], run Ver′ ⟨𝑅, ̃︀ • Receive 𝑏′ from 𝑅.

69

• For each 𝑗 ∈ [𝑡], 𝑘 ∈ [ℓ], run 𝑏𝑗,𝑘 := Ext′ (td𝑖* ,𝑗,𝑘 , 𝜏𝑖* ,𝑗,𝑘 ). If there does not exist 𝑏* such that 𝑏𝑗,𝑘 = 𝑏* for all 𝑗, 𝑘, then abort (and the adversary wins with probability exactly 1/2, i.e. 0 advantage). Otherwise, set 𝑏 = 𝑏′ ⊕ 𝑏* . • Sample 𝑟𝑏 ← {0, 1}, set 𝑟𝑏,𝑗 := 𝑟𝑏 for all 𝑗 ∈ [𝑡], set 𝑟1⊕𝑏,𝑗 := 1 for all 𝑗 ≤ 𝜄, and set 𝑟1⊕𝑏,𝑗 := 0 for all 𝑗 > 𝜄. • Send

⎧ ⎨

𝑟′ ′ := 𝑟𝑏′ ,𝑗 ⊕

⎩ 𝑗,𝑏

⨁︁

𝑟𝑖* ,𝑗,𝑘,𝑏′ ,

′ 𝑟𝑗,1⊕𝑏 ′ := 𝑟1⊕𝑏′ ,𝑗 ⊕

𝑘∈[ℓ]

⨁︁

𝑟𝑖* ,𝑗,𝑘,1⊕𝑏′

⎫ ⎬ ⎭

𝑘∈[ℓ]

𝑗∈[𝑡]

and 𝑟𝑏 to 𝑅. ̃︀ init , 𝑅) ̃︀ conditioned on: Now, note that Hyb0 is the same as the sender security game for (𝑅

• 𝑟𝑏 = 0, and • there exists 𝑏* such that 𝑏𝑗,𝑘 = 𝑏* for all 𝑗, 𝑘 (and the sender did not abort earlier). ̃︀ init , 𝑅) ̃︀ conditioned on: Moreover, Hyb𝑡 is the same as the sender security game for (𝑅

• 𝑟𝑏 = 1, and • there exists 𝑏* such that 𝑏𝑗,𝑘 = 𝑏* for all 𝑗, 𝑘 (and the sender did not abort earlier). Note that the event that there does not exist 𝑏* such that 𝑏𝑗,𝑘 = 𝑏* for all 𝑗, 𝑘, but the sender did not abort earlier occurs with probability at most 1/𝜆 due to the sender security (in particular the ̃︀ init , 𝑅) ̃︀ outputs 0 in Hyb , we have second part) of OT′ . Thus, letting 𝑝𝑖 be the probability that (𝑅 𝑖 that the receiver’s advantage in the sender security game is bounded by |𝑝0 − 𝑝𝑡 | + 𝑜(1). To complete the proof, we argue that for any 𝜄 ∈ [𝑡], |𝑝𝜄−1 −𝑝𝜄 | ≤ 𝛿 ℓ +negl(𝜆), as this implies that |𝑝0 − 𝑝𝑡 | ≤ 𝑡 · 𝛿 ℓ + negl(𝜆) ≤ 1/2 + negl(𝜆). This follows by a reduction to Corollary 6.18. Indeed, we note that the only difference between Hyb𝜄−1 and Hyb𝜄 is the bit 𝑟1⊕𝑏,𝜄 , which is masked by ⨁︀ 𝑘∈[ℓ] 𝑟𝑖* ,𝜄,𝑘,1⊕𝑏 . Thus, it suffices to argue that an appropriate ℓ-wise sequential repetition of the sender security game of OT′ yields advantage 𝛿 ℓ + negl(𝜆). In particular, it suffices to show that adversary has 𝛿 ℓ + negl(𝜆) advantage in the following game. ̃︀ init , 𝑆 ′ (1𝜆 )⟩ and td𝑘 ← TrapGen′ (𝜏Setup,𝑘 ). • For 𝑘 ∈ [ℓ], run 𝜏Setup,𝑘 ← Setup′ ⟨𝑅 ̃︀ ̃︀ 𝑆 ′ (𝜏Setup,𝑘 )⟩, 𝑏𝑘 := Ext(td𝑘 , 𝜏𝑘 ), and send 𝑟𝑏 to 𝑅. • For 𝑘 ∈ [ℓ], run (𝑟𝑘,0 , 𝑟𝑘,1 ), 𝜏𝑘 ← OT′ ⟨𝑅, 𝑘 ̃︀ outputs a bit 𝑟* and wins if 𝑟 * = • 𝑅

⨁︀

𝑘∈[ℓ] 𝑟1⊕𝑏𝑘 .

By the sender security of OT′ , we know that with 1 − negl(𝜆) probability over {︁

̃︀ init , 𝑆 ′ (1𝜆 )⟩, 𝜏Setup,𝑘 ← Setup′ ⟨𝑅

td𝑘 := TrapGen′ (𝜏Setup,𝑘 )

}︁ 𝑘∈[ℓ]

,

̃︀ has advantage at most 𝛿 + negl(𝜆) in guessing 𝑟1⊕𝑏 for any fixed 𝑘 ∈ [ℓ], even given arbitrary 𝑅 𝑘 inefficiently-computable advice about 𝜏Setup,1 , . . . , 𝜏Setup,ℓ . Thus, it suffices to show that for any ̃︀ has advantage at most 𝛿 ℓ +negl(𝜆) in guessing ⨁︀ such 𝜏Setup,1 , . . . , 𝜏Setup,ℓ , 𝑅 𝑘∈[ℓ] 𝑟1⊕𝑏𝑘 . This follows ′ ̃︀ directly from Corollary 6.18, by setting each Γ𝑘 to run (𝑟𝑘,0 , 𝑟𝑘,1 ), 𝜏𝑘 ← OT ⟨𝑅, 𝑆 ′ (𝜏Setup,𝑘 )⟩ and the predicate 𝑃 to compute 𝑏𝑘 := Ext(td𝑘 , 𝜏𝑘 ) and output 𝑟1⊕𝑏𝑘 .

70

References [ACC+ 22]

Per Austrin, Hao Chung, Kai-Min Chung, Shiuan Fu, Yao-Ting Lin, and Mohammad Mahmoody. On the impossibility of key agreements from quantum random oracles. In Advances in Cryptology – CRYPTO 2022: 42nd Annual International Cryptology Conference, CRYPTO 2022, Santa Barbara, CA, USA, August 15–18, 2022, Proceedings, Part II, page 165–194, Berlin, Heidelberg, 2022. Springer-Verlag.

[AMR22]

Navid Alamati, Giulio Malavolta, and Ahmadreza Rahimi. Candidate trapdoor claw-free functions from group actions with applications to quantum protocols. In Eike Kiltz and Vinod Vaikuntanathan, editors, Theory of Cryptography, pages 266–293, Cham, 2022. Springer Nature Switzerland.

[BCM+ 21]

Zvika Brakerski, Paul Christiano, Urmila Mahadev, Umesh Vazirani, and Thomas Vidick. A cryptographic test of quantumness and certifiable randomness from a single quantum device. J. ACM, 68(5), August 2021.

[BGKM+ 23] Zvika Brakerski, Alexandru Gheorghiu, Gregory D. Kahanamoku-Meyer, Eitan Porat, and Thomas Vidick. Simple tests of quantumness also certify qubits. In Helena Handschuh and Anna Lysyanskaya, editors, Advances in Cryptology – CRYPTO 2023, pages 162–191, Cham, 2023. Springer Nature Switzerland. [BK25]

James Bartusek and Dakshita Khurana. On the power of oblivious state preparation. In Advances in Cryptology – CRYPTO 2025: 45th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 17–21, 2025, Proceedings, Part II, page 575–607, Berlin, Heidelberg, 2025. Springer-Verlag.

[BMM25]

Pedro Branco, Giulio Malavolta, and Zayd Maradni. Fully-homomorphic encryption from lattice isomorphism. In Theory of Cryptography: 23rd International Conference, TCC 2025, Aarhus, Denmark, December 1–5, 2025, Proceedings, Part I, page 220–252, Berlin, Heidelberg, 2025. Springer-Verlag.

[BQSY24]

John Bostanci, Luowen Qian, Nicholas Spooner, and Henry Yuen. An efficient quantum parallel repetition theorem and applications. In Proceedings of the 56th Annual ACM Symposium on Theory of Computing, STOC 2024, page 1478–1487, New York, NY, USA, 2024. Association for Computing Machinery.

[BSW03]

Boaz Barak, Ronen Shaltiel, and Avi Wigderson. Computational analogues of entropy. In Sanjeev Arora, Klaus Jansen, José D. P. Rolim, and Amit Sahai, editors, Approximation, Randomization, and Combinatorial Optimization.. Algorithms and Techniques, pages 200–215, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg.

[CMM+ 26] David Cui, Giulio Malavolta, Arthur Mehta, Anand Natarajan, Connor Paddock, Simon Schmidt, Michael Walter, and Tina Zhang. A Computational Tsirelson’s Theorem for the Value of Compiled XOR Games. Quantum, 10:1987, January 2026. [CMSZ22]

Alessandro Chiesa, Fermi Ma, Nicholas Spooner, and Mark Zhandry. Post-quantum succinct arguments: Breaking the quantum rewinding barrier. In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS), pages 49–58, 2022.

[DH76]

Whitfield Diffie and Martin E Hellman. New directions in cryptography. IEEE Transactions on Information Theory, 22(6):644–654, 1976. 71

[DNS10]

Frédéric Dupuis, Jesper Buus Nielsen, and Louis Salvail. Secure two-party quantum evaluation of unitaries against specious adversaries. In Tal Rabin, editor, Advances in Cryptology – CRYPTO 2010, pages 685–706, Berlin, Heidelberg, 2010. Springer Berlin Heidelberg.

[GKM+ 00]

Y. Gertner, S. Kannan, T. Malkin, O. Reingold, and M. Viswanathan. The relationship between public key encryption and oblivious transfer. In Proceedings of the 41st Annual Symposium on Foundations of Computer Science, FOCS ’00, page 325, USA, 2000. IEEE Computer Society.

[GMW87]

O. Goldreich, S. Micali, and A. Wigderson. How to play any mental game. In Proceedings of the Nineteenth Annual ACM Symposium on Theory of Computing, STOC ’87, page 218–229, New York, NY, USA, 1987. Association for Computing Machinery.

[GNW11]

Oded Goldreich, Noam Nisan, and Avi Wigderson. On Yao’s XOR-Lemma, pages 273–301. Springer Berlin Heidelberg, Berlin, Heidelberg, 2011.

[GV19]

Alexandru Gheorghiu and Thomas Vidick. Computationally-secure and composable remote state preparation. 2019 IEEE 60th Annual Symposium on Foundations of Computer Science (FOCS), pages 1024–1033, 2019.

[HK25]

Andrew Huang and Yael Tauman Kalai. Parallel repetition for post-quantum arguments. Cryptology ePrint Archive, Paper 2025/1027, 2025.

[HMOY25] Minki Hhan, Tomoyuki Morimae, Yasuaki Okinaka, and Takashi Yamakawa. Proofs of quantum memory, 2025. [Hol05]

Thomas Holenstein. Key agreement from weak bit agreement. In Proceedings of the Thirty-Seventh Annual ACM Symposium on Theory of Computing, STOC ’05, page 664–673, New York, NY, USA, 2005. Association for Computing Machinery.

[HR08]

Shai Halevi and Tal Rabin. Degradation and amplification of computational hardness. In Proceedings of the 5th Conference on Theory of Cryptography, TCC’08, page 626–643, Berlin, Heidelberg, 2008. Springer-Verlag.

[HS11]

Thomas Holenstein and Grant Schoenebeck. General hardness amplification of predicates and puzzles. In Proceedings of the 8th Conference on Theory of Cryptography, TCC’11, page 19–36, Berlin, Heidelberg, 2011. Springer-Verlag.

[Imp95]

R. Impagliazzo. Hard-core distributions for somewhat hard problems. In Proceedings of the 36th Annual Symposium on Foundations of Computer Science, FOCS ’95, page 538, USA, 1995. IEEE Computer Society.

[IR89]

R. Impagliazzo and S. Rudich. Limits on the provable consequences of one-way permutations. In Proceedings of the Twenty-First Annual ACM Symposium on Theory of Computing, STOC ’89, page 44–61, New York, NY, USA, 1989. Association for Computing Machinery.

[Kil88]

Joe Kilian. Founding cryptography on oblivious transfer. In Proceedings of the Twentieth Annual ACM Symposium on Theory of Computing, STOC ’88, page 20–31, New York, NY, USA, 1988. Association for Computing Machinery.

72

[KLVY23]

Yael Kalai, Alex Lombardi, Vinod Vaikuntanathan, and Lisa Yang. Quantum advantage from any non-local game. In Proceedings of the 55th Annual ACM Symposium on Theory of Computing, STOC 2023, page 1617–1628, New York, NY, USA, 2023. Association for Computing Machinery.

[KMCVY22] Gregory D. Kahanamoku-Meyer, Soonwon Choi, Umesh V. Vazirani, and Norman Y. Yao. Classically verifiable quantum advantage from a computational Bell test. Nature Physics, 18(8), 08 2022. [Kre21]

William Kretschmer. Quantum pseudorandomness and classical complexity. Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 2021.

[KT24]

Dakshita Khurana and Kabir Tomer. Commitments from quantum one-wayness. In Proceedings of the 56th Annual ACM Symposium on Theory of Computing, STOC 2024, page 968–978, New York, NY, USA, 2024. Association for Computing Machinery.

[Lev85]

L A Levin. One-way functions and pseudorandom generators. In Proceedings of the Seventeenth Annual ACM Symposium on Theory of Computing, STOC ’85, page 363–365, New York, NY, USA, 1985. Association for Computing Machinery.

[LLLL25]

Longcheng Li, Qian Li, Xingjian Li, and Qipeng Liu. Cryptomania v.s. Minicrypt in a Quantum World. Cryptology ePrint Archive, Paper 2025/639, 2025.

[Mah22]

Urmila Mahadev. Classical verification of quantum computations. SIAM Journal on Computing, 51(4):1172–1229, 2022.

[MDCAF21] Tony Metger, Yfke Dulek, Andrea Coladangelo, and Rotem Arnon-Friedman. Device-independent quantum key distribution from computational assumptions. New J. Phys., 23(12):123021, 2021. [MSY25]

Tomoyuki Morimae, Yuki Shirakawa, and Takashi Yamakawa. Cryptographic characterization of quantum advantage. In Proceedings of the 57th Annual ACM Symposium on Theory of Computing, STOC ’25, page 1863–1874, New York, NY, USA, 2025. Association for Computing Machinery.

[MV21]

Tony Metger and Thomas Vidick. Self-Testing of a Single Quantum Device Under Computational Assumptions. In James R. Lee, editor, 12th Innovations in Theoretical Computer Science Conference (ITCS 2021), volume 185 of Leibniz International Proceedings in Informatics (LIPIcs), pages 19:1–19:12, Dagstuhl, Germany, 2021. Schloss Dagstuhl – Leibniz-Zentrum für Informatik.

[MW04]

Chris Marriott and John Watrous. Quantum Arthur-Merlin games. In Proceedings of the 19th IEEE Annual Conference on Computational Complexity, CCC ’04, page 275–285, USA, 2004. IEEE Computer Society.

[MY22]

Tomoyuki Morimae and Takashi Yamakawa. Quantum Commitments and Signatures Without One-Way Functions, page 269–295. Springer Nature Switzerland, 2022.

[Nao89]

Moni Naor. Bit commitment using pseudo-randomness. In Proceedings of the 9th Annual International Cryptology Conference on Advances in Cryptology, CRYPTO ’89, page 128–136, Berlin, Heidelberg, 1989. Springer-Verlag.

73

[NZ23]

Anand Natarajan and Tina Zhang. Bounding the quantum value of compiled nonlocal games: from CHSH to BQP verification, 2023.

[TZ25]

Kabir Tomer and Mark Zhandry. On the cryptographic foundations of interactive quantum advantage, 2025.

[Vid20]

Thomas Vidick. Course FSMP, Fall’20: Interactions with quantum devices, 2020.

[vN28]

John von Neumann. Zur theorie der gesellschaftsspiele. Mathematische Annalen, 100(1):295–320, 1928.

[Wul07]

Jürg Wullschleger. Oblivious-transfer amplification. In Proceedings of the 26th Annual International Conference on Advances in Cryptology, EUROCRYPT ’07, page 555–572, Berlin, Heidelberg, 2007. Springer-Verlag.

[YZ24]

Takashi Yamakawa and Mark Zhandry. Verifiable quantum advantage without structure. J. ACM, 71(3), June 2024.

[Zha23]

Jiayu Zhang. A quantum approach for reducing communications in classical secure computations with long outputs. Cryptology ePrint Archive, Paper 2023/1492, 2023.

[Zha25]

Jiayu Zhang. Formulations and Constructions of Remote State Preparation with Verifiability, with Applications. In Raghu Meka, editor, 16th Innovations in Theoretical Computer Science Conference (ITCS 2025), volume 325 of Leibniz International Proceedings in Informatics (LIPIcs), pages 96:1–96:19, Dagstuhl, Germany, 2025. Schloss Dagstuhl – Leibniz-Zentrum für Informatik.

74