Lower Bounds for Quantum Secure Function Evaluation Reductions
Esther Hänggi, Severin Winkler
TL;DR
This work analyzes the limits of quantum reductions in secure two-party computation, focusing on one-sided output secure function evaluation (SFE). It proves a non-asymptotic impossibility result: no ε-secure quantum protocol can securely compute any non-trivial function from noiseless channels, since Bob can recover function values for all his inputs; it then develops a framework for reductions to trusted randomness and derives a lower bound on the sum of conditional max-entropies, which translates into concrete lower bounds on the number of oblivious transfer instances required for secure implementations. The results yield quantitative bounds for fundamental tasks like inner-product and equality, showing that quantum protocols cannot substantially outperform classical limits in these cases. Together, the findings clarify the cryptographic capacity and resource requirements of quantum reductions and OT-based constructions in finite-resource regimes, with implications for the design of secure two-party protocols.
Abstract
One-sided output secure function evaluation is a cryptographic primitive where the two mutually distrustful players, Alice and Bob, both have a private input to a bivariate function. Bob obtains the value of the function for the given inputs, while Alice receives no output. It is known that this primitive cannot be securely implemented if the two players only have access to noiseless classical and quantum communication. In this work, we first show that Bob can extract the function values for all his possible inputs from any implementation of a non-trivial function that is correct and preserves the privacy of Bob's input. Our result holds in the non-asymptotic setting where the players have finite resources and the error is a constant. Then we consider protocols for secure function evaluation in a setup where the two players have access to trusted distributed randomness as a resource. Building upon the first result, we prove a bound on the efficiency of such cryptographic reductions for any non-trivial function in terms of the conditional entropies of the trusted randomness. From this result, we can derive lower bounds on the number of instances of different variants of OT needed to securely implement a given function.