Comparing classical and quantum conditional disclosure of secrets

TL;DR

Preliminary evidence that classical and quantum CDS are separated even with correctness and security error allowed is interpreted as preliminary evidence that classical and quantum CDS are separated even with correctness and security error allowed.

Abstract

The conditional disclosure of secrets (CDS) setting is among the most basic primitives studied in information-theoretic cryptography. Motivated by a connection to non-local quantum computation and position-based cryptography, CDS with quantum resources has recently been considered. Here, we study the differences between quantum and classical CDS, with the aims of clarifying the power of quantum resources in information-theoretic cryptography. We establish the following results: 1) We prove a $Ω(\log \mathsf{R}_{0,A\rightarrow B}(f)+\log \mathsf{R}_{0,B\rightarrow A}(f))$ lower bound on quantum CDS where $\mathsf{R}_{0,A\rightarrow B}(f)$ is the classical one-way communication complexity with perfect correctness. 2) We prove a lower bound on quantum CDS in terms of two round, public coin, two-prover interactive proofs. 3) For perfectly correct CDS, we give a separation for a promise version of the not-equals function, showing a quantum upper bound of $O(\log n)$ and classical lower bound of $Ω(n)$. 4) We give a logarithmic upper bound for quantum CDS on forrelation, while the best known classical algorithm is linear. We interpret this as preliminary evidence that classical and quantum CDS are separated even with correctness and security error allowed. We also give a separation for classical and quantum private simultaneous message passing for a partial function, improving on an earlier relational separation. Our results use novel combinations of techniques from non-local quantum computation and communication complexity.

Figures (7)

• Figure 1: (a) A classical CDS protocol. Alice, on the lower left, holds input $x\in \{0,1\}^n$ and a secret $s$ from alphabet $S$. Bob, on the lower right, holds input $y\in \{0,1\}^n$. Alice and Bob can share a random string $r$. The referee, top right, holds $x$ and $y$. Alice sends a message $m_A(x,s,r)$ to the referee; Bob sends a message $m_B(y,r)$. The referee should learn $s$ iff $f(x,y)=1$ for some agreed on choice of Boolean function $f$. (b) A quantum CDS protocol. The secret can be a quantum system $Q$ or classical string $s$ (the two cases are equivalent, as noted in allerstorfer2024relating). Alice and Bob can share an entangled quantum state, and send quantum messages to the referee. The referee should be able to recover the secret iff $f(x,y)=1$. Figure reproduced from asadi2024conditional.
• Figure 2: A CDQS protocol, with system labels and location of each quantum operation. The density matrix on $M_AM_B$ we refer to as the mid-protocol density matrix. We sometimes combine the actions of Alice and Bob to define $\mathbfcal{N}^{x,y}_{Q\rightarrow M}=\mathbfcal{N}^x_{AL\rightarrow M_A}\otimes\mathbfcal{N}^y_{R\rightarrow M_B}$.
• Figure 3: The two-prover proof protocol. Alice and Bob receive systems $M_A$ and $M_B$ from prover $P$, and systems $M_A'$ and $M_B'$ from prover $P'$. Alice applies $(\mathbf{U}^x_{M_AM_A'\rightarrow QL})^\dagger$, Bob applies $(\mathbf{U}^y_{R\rightarrow M_BM_B'})^\dagger$. Bob then sends $R$ to Alice, who measures $LR$ and $Q$ to check they are the inputs to the corresponding CDQS protocol.
• Figure 4: (a) Circuit diagram showing the local implementation of a channel $\mathbfcal{N}_{AB}$. (b) Circuit diagram showing the non-local implementation of the same channel. The operations $\mathbfcal{V}^L$, $\mathbfcal{V}^R$, $\mathbfcal{W}^L$, and $\mathbfcal{W}^R$ are quantum channels. The lower, bent wire represents an entangled state.
• Figure 5: Circuit computing the forrelation function $f(x,y)$. Figure reproduced from girish2022quantum. Here, $E$ is the operator as in \ref{['fig:E']}.

Theorems & Definitions (26)

• Definition 1
• Theorem 2
• Remark 3
• Definition 4
• Definition 5
• Theorem 6
• Lemma 7
• Definition 8
• Definition 9
• Definition 10: Classical one-way communication complexity