Learning with Errors (LWE) Advances Post-Quantum Security
Compiler Succinctly Creates Classical Interactive Arguments with Post-Soundness Using Error Learning
Modern cryptography relies on the challenge of reliably validating complex calculations, which drives academics to find ways to prove their accuracy with minimal communication. A new compiler by Andrew Huang and Yael Tauman Kalai at MIT's Computer Science and Artificial Intelligence Laboratory translates every computing process into a short interactive argument. This achievement addresses the disadvantages of previous cryptography methods and ensures that traditional computers can verify.
This technique allows short and classically verifiable proofs for any protocol, a critical step toward durable and practical cryptographic systems.
Building Security on Post-Quantum Hardness
The well-researched post-sub-exponential hardness of the Learning with Errors (LWE) problem secures this unique approach. This robust basis is a major improvement over past systems that relied on dubious post-quantum security assumptions.
Compiler transformations work with several protocols. Any MIP protocol, including those with many provers or not brief, becomes a concise classical QIA. It also applies to any QIP protocol that is only effective against semi-malicious provers, even ones with a malicious beginning state. Supporting potentially dangerous starting conditions improves the security of many systems.
Kalai, Lombardi, Vaikuntanathan, and Yang (KLVY) presented a MIP protocol compiler at STOC 2022, although its post-quantum soundness is still being assessed. Updated compilers provide stronger Learning with Errors LWE security assurances.
This compiler relates the soundness of the classical QIA to the quantum value/soundness of the underlying MIP protocol instead of just the quantum computing operator value, assuming the post-quantum hardness of Learning with Errors LWE. Previous results focused on this relationship but found it difficult to resolve generically.
Two-Step Compilation
Core transformation has two main steps:
From QI Time from QIP The researchers first prove that a language with a semi-malicious QIP and a time-based prover is a QMATIME language. Quantum computers operating in time poly can verify this class's languages. This is achieved by flattening the QIP interaction into a large quantum circuit with the prover's auxiliary state as its witness.
They then provide a brief classical defense of any such language. The Morimae-Fitzsimons protocol converts the witness state into one that can be validated by measuring qubits alone in the basis. This phase uses classical quantum operation verification methods.
To reduce communication complexity and improve succinctness, a semi-succinct commitment technique is used. Previous protocols required communication proportional to computation time. The verifier can submit a single compact commitment key, unlike earlier methods that required unique keys for each qubit. A concise argument is then produced using protocol compression.
Complexity and Efficiency Guarantee
High efficiency is achieved by conventional QIA:
Simply put, communication difficulty increases polynomially with security parameter. Communication difficulty grows slowly with computing time (polylogarithmically).
In the statement's timeframe, the verifier works.
Based on the initial protocol time, the prover's runtime increases polynomially.
This efficiency requires real-valued auxiliary states of the honest prover and real coefficients in the state expansion. Since Mahadev's work, all classically proving quantum computation protocols have this constraint, ensuring an efficient prover runtime.
The final system is secure, thus no quantum-time cheating prover can convince the verifier of a false assertion, assuming the post-quantum difficulty of Learning with Errors LWE. Built-in argument system rounds may exist.
This paper provides a generic, robust transformation for quantum verification that bridges sophisticated quantum computing and verifiable classical systems, enabling secure quantum technology to become mainstream. Whether the protocol can be publicly verifiable and whether real-valued witnesses are needed for prover efficiency are intriguing questions.
