(Quantum) Indifferentiability and Pre-Computation

TL;DR

This work shows that indifferentiability is (generically) insufficient for capturing pre-computation and proposes a strengthening of indifferentiability which is not only composable but also takes arbitrary pre-computation into account, and yields the first classical/quantum space-time trade-off for one-round sponge inversion.

Abstract

Indifferentiability is a popular cryptographic paradigm for analyzing the security of ideal objects -- both in a classical as well as in a quantum world. It is typically stated in the form of a composable and simulation-based definition, and captures what it means for a construction (e.g., a cryptographic hash function) to be ``as good as'' an ideal object (e.g., a random oracle). Despite its strength, indifferentiability is not known to offer security against pre-processing attacks in which the adversary gains access to (classical or quantum) advice that is relevant to the particular construction. In this work, we show that indifferentiability is (generically) insufficient for capturing pre-computation. To accommodate this shortcoming, we propose a strengthening of indifferentiability which is not only composable but also takes arbitrary pre-computation into account. As an application, we show that the one-round sponge is indifferentiable (with pre-computation) from a random oracle. This yields the first (and tight) classical/quantum space-time trade-off for one-round sponge inversion.

Figures (7)

• Figure 1: The one-round sponge.
• Figure 2: Schematic representation of indifferentiability of construction $\mathsf{C}$ from idealized primitive $\mathsf{R}$. The arrows denote "access to" the pointed system, and $\mathcal{D}$ is the distinguisher.
• Figure 3: Schematic representation of weak indifferentiability with pre-computation. Arrows denote access to the pointed to interface, and washed out colors denote inefficient pre-computation, i.e. entities with unbounded access. Dotted arrows denote forwarded advice.
• Figure 4: The reduction for removing shared randomness for weak indifferentiability. Two values of shared randomness are hard-coded into the simulator, which then uses bit $s$ to select between them.
• Figure 5: The adversary $\mathcal{A}=(\mathcal{A}_0, \mathcal{A}_1)$ in model $\mathsf{C}$.

Theorems & Definitions (29)

• theorem thmcountertheorem: Informal version of Theorem \ref{['thm:composition']}
• theorem thmcountertheorem: Informal version of Theorem \ref{['thm:sponge-indiff']} and Corollary \ref{['cor:weak-indiff-sponge']}
• definition thmcounterdefinition: Indifferentiability
• theorem thmcountertheorem
• proof
• corollary thmcountercorollary
• definition thmcounterdefinition: Strong Indifferentiability with Pre-Computation
• definition thmcounterdefinition: Weak Indifferentiability with Pre-Computation
• lemma thmcounterlemma
• proof