arXiv subjects

Or Sattath

Publications and source records attributed to Or Sattath.

At least 19 recordsLinked to original sources

arXiv2026

Hybrid Consensus with Quantum Sybil Resistance

Sybil resistance is a key requirement of decentralized consensus protocols. It is achieved by introducing a scarce resource (such as computational power, monetary stake, disk space, etc.), which prevents participants from costlessly creating multiple fake identities and hijacking the protocol. Quantum states are generically uncloneable, which suggests that they may serve naturally as an unconditionally scarce resource. In particular, uncloneability underlies quantum position-based cryptography, which is unachievable classically. We design a consensus protocol that combines classical hybrid consensus protocols with quantum position verification as the Sybil resistance mechanism, providing security in the standard model, and achieving improved energy efficiency compared to hybrid protocols based on Proof-of-Work. Our protocol inherits the benefits of other hybrid protocols, namely the faster confirmation times compared to pure Proof-of-Work protocols, and resilience against the compounding wealth issue that plagues protocols based on Proof-of-Stake Sybil resistance. We additionally propose a spam prevention mechanism for our protocol in the Random Oracle model.

quant-ph↗

arXiv2024

The power of a single Haar random state: constructing and separating quantum pseudorandomness

In this work, we focus on the following question: what are the cryptographic implications of having access to an oracle that provides a single Haar random quantum state? We find that the study of such a model sheds light on several aspects of the notion of quantum pseudorandomness. Pseudorandom states (PRS) are a family of states for which it is hard to distinguish between polynomially many copies of either a state sampled uniformly from the family or a Haar random state. A weaker notion, called single-copy pseudorandom states (1PRS), satisfies this property with respect to a single copy. We obtain the following results: 1. First, we show, perhaps surprisingly, that 1PRS (as well as bit-commitments) exist relative to an oracle that provides a single Haar random state. 2. Second, we build on this result to show the existence of an isometry oracle relative to which 1PRS exist, but PRS do not. Taken together, our contributions yield one of the first black-box separations between central notions of quantum pseudorandomness, and introduce a new framework to study black-box separations between various inherently quantum primitives.

quant-ph↗

arXiv2024

51% Attack via Difficulty Increase with a Small Quantum Miner

We present a strategy for a single quantum miner with relatively low hashing power, with the same ramifications as a 51% attack. Bitcoin nodes consider the chain with the highest cumulative proof-of-work to be the valid chain. A quantum miner can manipulate the block timestamps to multiply the difficulty by $c$. The fork-choice rule counts every block with increased difficulty with weight $c$. By using Grover's algorithm, it is only $O(\sqrt c)$ harder for the quantum miner to mine such blocks. By picking a high enough $c$, the single quantum miner can create a competing chain with fewer blocks, but more cumulative proof-of-work. The time required is $O(\frac{1}{r^2})$ epochs, where $r$ is the fraction of the block rewards that the quantum miner would have received if they mined honestly. Most proof-of-work cryptocurrencies, including Bitcoin, are vulnerable to our attack. However, it will likely be impossible to execute in forthcoming years, as it requires an extremely fast and fault-tolerant quantum computer.

quant-ph↗

arXiv2023

Signatures From Pseudorandom States via $\bot$-PRFs

Different flavors of quantum pseudorandomness have proven useful for various cryptographic applications, with the compelling feature that these primitives are potentially weaker than post-quantum one-way functions. Ananth, Lin, and Yuen (2023) have shown that logarithmic pseudorandom states can be used to construct a pseudo-deterministic PRG: informally, for a fixed seed, the output is the same with $1-1/poly$ probability. In this work, we introduce new definitions for $\bot$-PRG and $\bot$-PRF. The correctness guarantees are that, for a fixed seed, except with negligible probability, the output is either the same (with probability $1-1/poly$) or recognizable abort, denoted $\bot$. Our approach admits a natural definition of multi-time PRG security, as well as the adaptive security of a PRF. We construct a $\bot$-PRG from any pseudo-deterministic PRG and, from that, a $\bot$-PRF. Even though most mini-crypt primitives, such as symmetric key encryption, commitments, MAC, and length-restricted one-time digital signatures, have been shown based on various quantum pseudorandomness assumptions, digital signatures remained elusive. Our main application is a (quantum) digital signature scheme with classical public keys and signatures, thereby addressing a previously unresolved question posed in Morimae and Yamakawa's work (Crypto, 2022). Additionally, we construct CPA secure public-key encryption with tamper-resilient quantum public keys.

cs.CR↗

arXiv2023

Public-Key Encryption with Quantum Keys

In the framework of Impagliazzo's five worlds, a distinction is often made between two worlds, one where public-key encryption exists (Cryptomania), and one in which only one-way functions exist (MiniCrypt). However, the boundaries between these worlds can change when quantum information is taken into account. Recent work has shown that quantum variants of oblivious transfer and multi-party computation, both primitives that are classically in Cryptomania, can be constructed from one-way functions, placing them in the realm of quantum MiniCrypt (the so-called MiniQCrypt). This naturally raises the following question: Is it possible to construct a quantum variant of public-key encryption, which is at the heart of Cryptomania, from one-way functions or potentially weaker assumptions? In this work, we initiate the formal study of the notion of quantum public-key encryption (qPKE), i.e., public-key encryption where keys are allowed to be quantum states. We propose new definitions of security and several constructions of qPKE based on the existence of one-way functions (OWF), or even weaker assumptions, such as pseudorandom function-like states (PRFS) and pseudorandom function-like states with proof of destruction (PRFSPD). Finally, to give a tight characterization of this primitive, we show that computational assumptions are necessary to build quantum public-key encryption. That is, we give a self-contained proof that no quantum public-key encryption scheme can provide information-theoretic security.

quant-ph↗

arXiv2023

Protecting Quantum Procrastinators with Signature Lifting: A Case Study in Cryptocurrencies

Current solutions to quantum vulnerabilities of widely used cryptographic schemes involve migrating users to post-quantum schemes before quantum attacks become feasible. This work deals with protecting quantum procrastinators: users that failed to migrate to post-quantum cryptography in time. To address this problem in the context of digital signatures, we introduce a technique called signature lifting, that allows us to lift a deployed pre-quantum signature scheme satisfying a certain property to a post-quantum signature scheme that uses the same keys. Informally, the said property is that a post-quantum one-way function is used "somewhere along the way" to derive the public-key from the secret-key. Our constructions of signature lifting relies heavily on the post-quantum digital signature scheme Picnic (Chase et al., CCS'17). Our main case-study is cryptocurrencies, where this property holds in two scenarios: when the public-key is generated via a key-derivation function or when the public-key hash is posted instead of the public-key itself. We propose a modification, based on signature lifting, that can be applied in many cryptocurrencies for securely spending pre-quantum coins in presence of quantum adversaries. Our construction improves upon existing constructions in two major ways: it is not limited to pre-quantum coins whose ECDSA public-key has been kept secret (and in particular, it handles all coins that are stored in addresses generated by HD wallets), and it does not require access to post-quantum coins or using side payments to pay for posting the transaction.

cs.CR↗

arXiv2023

Encryption with Quantum Public Keys

It is an important question to find constructions of quantum cryptographic protocols which rely on weaker computational assumptions than classical protocols. Recently, it has been shown that oblivious transfer and multi-party computation can be constructed from one-way functions, whereas this is impossible in the classical setting in a black-box way. In this work, we study the question of building quantum public-key encryption schemes from one-way functions and even weaker assumptions. Firstly, we revisit the definition of IND-CPA security to this setting. Then, we propose three schemes for quantum public-key encryption from one-way functions, pseudorandom function-like states with proof of deletion and pseudorandom function-like states, respectively.

cs.CR↗

arXiv2023

Quantum Tokens for Digital Signatures

The fisherman caught a quantum fish. "Fisherman, please let me go", begged the fish, "and I will grant you three wishes". The fisherman agreed. The fish gave the fisherman a quantum computer, three quantum signing tokens and his classical public key. The fish explained: "to sign your three wishes, use the tokenized signature scheme on this quantum computer, then show your valid signature to the king, who owes me a favor". The fisherman used one of the signing tokens to sign the document "give me a castle!" and rushed to the palace. The king executed the classical verification algorithm using the fish's public key, and since it was valid, the king complied. The fisherman's wife wanted to sign ten wishes using their two remaining signing tokens. The fisherman did not want to cheat, and secretly sailed to meet the fish. "Fish, my wife wants to sign ten more wishes". But the fish was not worried: "I have learned quantum cryptography following the previous story (The Fisherman and His Wife by the brothers Grimm). The quantum tokens are consumed during the signing. Your polynomial wife cannot even sign four wishes using the three signing tokens I gave you". "How does it work?" wondered the fisherman. "Have you heard of quantum money? These are quantum states which can be easily verified but are hard to copy. This tokenized quantum signature scheme extends Aaronson and Christiano's quantum money scheme, which is why the signing tokens cannot be copied". "Does your scheme have additional fancy properties?" the fisherman asked. "Yes, the scheme has other security guarantees: revocability, testability and everlasting security. Furthermore, if you're at sea and your quantum phone has only classical reception, you can use this scheme to transfer the value of the quantum money to shore", said the fish, and swam away.

quant-ph↗

arXiv2022

Quantum Amnesia Leaves Cryptographic Mementos: A Note On Quantum Skepticism

Leonard Shelby, the protagonist of Memento, uses mementos in the form of tattoos and pictures to handle his amnesia. Similar to Leonard, contemporary quantum computers suffer from "quantum amnesia": the inability to store quantum registers for a long duration. Quantum computers can only retain classical "mementos" of quantum registers by measuring them before those vanish. Some quantum skeptics argue that this quantum amnesia is inherent. We point out that this variant of a skeptic world is roughly described by the quantum bounded storage model, and although it is a computational obstacle that annuls potential quantum computational advantage, the seemingly undesired properties provide a cryptographic advantage. Namely, providing exotic primitives promised by the quantum bounded storage model, such as unconditionally secure commitment and oblivious transfer schemes, with constructions involving nothing but transmission and measurement of BB84 states.

quant-ph↗

arXiv2022

Uncloneable Cryptography

The no-cloning theorem asserts that, unlike classical information, quantum information cannot be copied. This seemingly undesirable phenomenon is harnessed in quantum cryptography. Uncloneable cryptography studies settings in which the impossibility of copying is a desired property, and achieves forms of security that are classically unattainable. The first example discovered and analyzed was in the context of cash. On the one hand, we want users to hold the cash; on the other hand, the cash should be hard to counterfeit. Quantum money uses variants of the no-cloning theorem to make counterfeiting impossible. In the past decade, this field developed in various directions: several flavors of quantum money, such as classically verifiable, locally verifiable, semi-quantum, quantum coins, and quantum lightning were constructed. New uncloneable primitives were introduced, such as uncloneable signatures, quantum copy protection for classical software, pseudorandom states, and several uncloneable forms of encryption. This work is a gentle introduction to these topics.

quant-ph↗

arXiv2022

Quantum Prudent Contracts with Applications to Bitcoin

Smart contracts are cryptographic protocols that are enforced without a judiciary. Smart contracts are used occasionally in Bitcoin and are prevalent in Ethereum. Public quantum money improves upon cash we use today, yet the current constructions do not enable smart contracts. In this work, we define and introduce quantum payment schemes, and show how to implement prudent contracts -- a non-trivial subset of the functionality that a network such as Ethereum provides. Examples discussed include: multi-signature wallets in which funds can be spent by any 2-out-of-3 owners; restricted accounts that can send funds only to designated destinations; and "colored coins" that can represent stocks that can be freely traded, and their owner would receive dividends. Our approach is not as universal as the one used in Ethereum since we do not reach a consensus regarding the state of a ledger. We call our proposal prudent contracts to reflect this. The main building block is either quantum tokens for digital signatures (Ben-David and Sattath QCrypt'17, Coladangelo et al. Crypto'21), semi-quantum tokens for digital signatures (Shmueli'22) or one-shot signatures (Amos et al. STOC'20). The solution has all the benefits of public quantum money: no mining is necessary, and the security model is standard (e.g., it is not susceptible to 51\% attacks, as in Bitcoin). Our one-shot signature construction can be used to upgrade the Bitcoin network to a quantum payment scheme. Notable advantages of this approach are: transactions are locally verifiable and without latency, the throughput is unbounded, and most importantly, it would remove the need for Bitcoin mining. Our approach requires a universal large-scale quantum computer and long-term quantum memory; hence we do not expect it to be implementable in the next few years.

quant-ph↗

arXiv2022

Uncloneable Decryptors from Quantum Copy-Protection

Uncloneable decryptors are encryption schemes (with classical plaintexts and ciphertexts) with the added functionality of deriving uncloneable quantum states, called decryptors, which could be used to decrypt ciphers without knowledge of the secret key (Georgiou and Zhandry, IACR'20). We study uncloneable decryptors in the computational setting and provide increasingly strong security notions which extend the various indistinguishable security notions of symmetric encryption. We show that CPA secure uncloneable bit decryptors could be instantiated from a copy protection scheme (Aaronson, CCC'09) for any balanced binary function. We introduce a new notion of flip detection security for copy protection schemes inspired by the notions of left or right security for encryption schemes, and show that it could be used to instantiate CPA secure uncloneable decryptors for messages of unrestricted length. We then show how to strengthen the CPA security of uncloneable decryptors to CCA2 security using strong EUF-CMA secure digital signatures. We show that our constructions could be instantiated relative to either the quantum oracle used in [Aar09] or the classical oracle used in (Aaronson et al., CRYPTO'21) to instantiate copy protection schemes. Our constructions are the first to achieve CPA or CCA2 security in the symmetric setting.

quant-ph↗

arXiv2022

Redesigning Bitcoin's fee market

The Bitcoin payment system involves two agent types: Users that transact with the currency and pay fees and miners in charge of authorizing transactions and securing the system in return for these fees. Two of Bitcoin's challenges are (i) securing sufficient miner revenues as block rewards decrease, and (ii) alleviating the throughput limitation due to a small maximal block size cap. These issues are strongly related as increasing the maximal block size may decrease revenue due to Bitcoin's pay-your-bid approach. To decouple them, we analyze the "monopolistic auction", showing: (i) its revenue does not decrease as the maximal block size increases, (ii) it is resilient to an untrusted auctioneer (the miner), and (iii) simplicity for transaction issuers (bidders), as the average gain from strategic bid shading (relative to bidding one's value) diminishes as the number of bids increases.

cs.CR↗

arXiv2022

The Pursuit of Uniqueness: Extending Valiant-Vazirani Theorem to the Probabilistic and Quantum Settings

Valiant-Vazirani showed in 1985 [VV85] that solving NP with the promise that "yes" instances have only one witness is powerful enough to solve the entire NP class (under randomized reductions). We are interested in extending this result to the quantum setting. We prove extensions to the classes Merlin-Arthur MA and Quantum-Classical-Merlin-Arthur QCMA. Our results have implications for the complexity of approximating the ground state energy of a quantum local Hamiltonian with a unique ground state and an inverse polynomial spectral gap. We show that the estimation (to within polynomial accuracy) of the ground state energy of poly-gapped 1-D local Hamiltonians is QCMA-hard [AN02], under randomized reductions. This is in stark contrast to the case of constant gapped 1-D Hamiltonians, which is in NP [Has07]. Moreover, it shows that unless QCMA can be reduced to NP by randomized reductions, there is no classical description of the ground state of every poly-gapped local Hamiltonian that allows efficient calculation of expectation values. Finally, we discuss a few of the obstacles to the establishment of an analogous result to the class Quantum-Merlin-Arthur (QMA). In particular, we show that random projections fail to provide a polynomial gap between two witnesses.

quant-ph↗

arXiv2021

Revisiting the Properties of Money

The properties of money commonly referenced in the economics literature were originally identified by Jevons (1876) and Menger (1892) in the late 1800s and were intended to describe physical currencies, such as commodity money, metallic coins, and paper bills. In the digital era, many non-physical currencies have either entered circulation or are under development, including demand deposits, cryptocurrencies, stablecoins, central bank digital currencies (CBDCs), in-game currencies, and quantum money. These forms of money have novel properties that have not been studied extensively within the economics literature, but may be important determinants of the monetary equilibrium that emerges in the forthcoming era of heightened currency competition. This paper makes the first exhaustive attempt to identify and define the properties of all physical and digital forms of money. It reviews both the economics and computer science literatures and categorizes properties within an expanded version of the original functions-and-properties framework of money that includes societal and regulatory objectives.

econ.GN↗

arXiv2021

Quantum Technology for Economists

Research on quantum technology spans multiple disciplines: physics, computer science, engineering, and mathematics. The objective of this manuscript is to provide an accessible introduction to this emerging field for economists that is centered around quantum computing and quantum money. We proceed in three steps. First, we discuss basic concepts in quantum computing and quantum communication, assuming knowledge of linear algebra and statistics, but not of computer science or physics. This covers fundamental topics, such as qubits, superposition, entanglement, quantum circuits, oracles, and the no-cloning theorem. Second, we provide an overview of quantum money, an early invention of the quantum communication literature that has recently been partially implemented in an experimental setting. One form of quantum money offers the privacy and anonymity of physical cash, the option to transact without the involvement of a third party, and the efficiency and convenience of a debit card payment. Such features cannot be achieved in combination with any other form of money. Finally, we review all existing quantum speedups that have been identified for algorithms used to solve and estimate economic models. This includes function approximation, linear systems analysis, Monte Carlo simulation, matrix inversion, principal component analysis, linear regression, interpolation, numerical differentiation, and true random number generation. We also discuss the difficulty of achieving quantum speedups and comment on common misconceptions about what is achievable with quantum computing.

econ.GN↗

arXiv2021

Noise-Tolerant Quantum Tokens for MAC

Message Authentication Code or MAC, is a well-studied cryptographic primitive that is used in order to authenticate communication between two parties sharing a secret key. A Tokenized MAC or TMAC is a related cryptographic primitive, introduced by Ben-David & Sattath (QCrypt'17) which allows limited signing authority to be delegated to third parties via the use of single-use quantum signing tokens. These tokens can be issued using the secret key, such that each token can be used to sign at most one document. We provide an elementary construction for TMAC based on BB84 states. Our construction can tolerate up to 14% noise, making it the first noise-tolerant TMAC construction. The simplicity of the quantum states required for our construction combined with its noise tolerance, makes it practically more feasible than the previous TMAC construction. The TMAC is existentially unforgeable against adversaries with signing and verification oracles (i.e., analogous to EUF-CMA security for MAC), assuming post-quantum one-way functions exist.

quant-ph↗

arXiv2020

Semi-Quantum Money

Quantum money allows a bank to mint quantum money states that can later be verified and cannot be forged. Usually, this requires a quantum communication infrastructure to transfer quantum states between the user and the bank. Gavinsky (CCC 2012) introduced the notion of classically verifiable quantum money, which allows verification through classical communication. In this work we introduce the notion of classical minting, and combine it with classical verification to introduce semi-quantum money. Semi-quantum money is the first type of quantum money to allow transactions with completely classical communication and an entirely classical bank. This work features constructions for both a public memory-dependent semi-quantum money scheme and a private memoryless semi-quantum money scheme. The public construction is based on the works of Zhandry and Coladangelo, and the private construction is based on the notion of Noisy Trapdoor Claw Free Functions (NTCF) introduced by Brakerski et al. (FOCS 2018). In terms of technique, our main contribution is a perfect parallel repetition theorem for NTCF.

quant-ph↗