Commitments are equivalent to statistically-verifiable one-way state generators
Rishabh Batra, Rahul Jain
TL;DR
The paper investigates how quantum commitments relate to statistically-verifiable one-way state generators (sv-OWSG) and associated entropic primitives. It provides two key reductions: an $m=\frac{c n}{\log n}$-copy sv-OWSG yields a $k^*$-imbalanced EFI (and hence EFI and commitments), and an EFI yields a poly$(n)$-copy sv-OWSG, establishing an equivalence among $O\left(\frac{n}{\log n}\right)$-copy sv-OWSGs, poly$(n)$-copy sv-OWSGs, EFI, and quantum commitments. The results extend classical strategies (Hill–Impagliazzo–Levin–Luby) to mixed-state quantum outputs using quantum extractors and hardcore predicates, yielding a simpler path to classical mildly non-uniform PRGs in the classical limit. The findings clarify the weakest quantum primitives from which commitments—and thus broad cryptographic functionality—can be realized, influencing the design of quantum-secure primitives and protocols.
Abstract
One-way state generators (OWSG) are natural quantum analogs to classical one-way functions. We consider statistically-verifiable OWSGs (sv-OWSG), which are potentially weaker objects than OWSGs. We show that O(n/log(n))-copy sv-OWSGs (n represents the input length) are equivalent to poly(n)-copy sv-OWSGs and to quantum commitments. Since known results show that o(n/log(n))-copy OWSGs cannot imply commitments, this shows that O(n/log(n))-copy sv-OWSGs are the weakest OWSGs from which we can get commitments (and hence much of quantum cryptography). Our construction follows along the lines of Hastad, Impagliazzo, Levin and Luby, who obtained classical pseudorandom generators (PRG) from classical one-way functions (OWF), however with crucial modifications. Our construction, when applied to the classical case, provides an alternative to the classical construction to obtain a classical mildly non-uniform PRG from any classical OWF. Since we do not argue conditioned on the output $f(x)$, our construction and analysis is arguably simpler and may be of independent interest. For converting a mildly non-uniform PRG to a uniform PRG, we can use the classical construction.
