How about QKD?

Quantum key distribution

Toy example of BB84

Limitations of QKD

• Limited functionalities
  • No digital signatures (yet)
• Need to physically ship qubits
  • No-Cloning Theorem!
  • Need trusted relays to go beyond ~100km

Lamport's hash-based
one-time signature

• Key generation
  • Private key: \((s_0,s_1)\)
  • Public key: \((p_0,p_1)=\left(H(s_0),H(s_1)\right)\)
• To sign a message \(m\in\{0,1\}\), the signature is simply \(s_m\)
• To verify, check whether \(H(s_m)\stackrel{?}{=}p_m\)

Merkle tree

Stateful vs. stateless

• Can commit OTS PKs to Merkle tree
  • Public key = Merkle root
  • Each signature includes OTS signature + authentication path to Merkle root
• Going stateless (Goldreich, 1987)
  • Lots of pseudorandom, on-demand tree of trees
  • Each signature additionally includes chain of (hash-based) signatures of certificate authorities

The shortest vector problem on euclidean lattices

• A lattice is a discrete subset of \(\mathbb R^n=\text{span}(\mathbf b_1,\ldots,\mathbf b_n)\): \[\mathcal L=\left\{\sum_{i=1}^na_i\mathbf b_i:a_i\in\mathbb Z\right\}=\Big\{\mathbf a^T\mathbf B:\mathbf a\in\mathbb Z^n\Big\}\]
• SVP: Given a basis of a lattice \(\mathcal L\) and a norm \(N\) (often \(L^2\)), find the shortest nonzero vector in \(\mathcal L\) as measured by \(N\)

LWE

Learning with error

SIS

Short integer solution

Ideal lattices

• How to "compress" \(\mathbf A\)?
  • Build \(\mathbf A\) from a basis for the ideal generated by \(\mathbf a\) and \(X\) in a quotient ring, e.g., \(\mathbb Z_q[X]/(X^n-1)\): \[ \begin{aligned} \mathbf{As} & =\begin{bmatrix} \mathbf a & \mathbf aX & \cdots & \mathbf aX^{n-1} \end{bmatrix}\begin{bmatrix} s_0 & \cdots & s_{n-1} \end{bmatrix}^T \\ & =s_0\mathbf a + s_1\mathbf aX + \cdots + s_{n-1}\mathbf aX^{n-1} \\ & =\mathbf a\left(s_0+s_1X+\cdots+s_{n-1}X^{n-1}\right) \end{aligned} \]
• Core computation: From matrix-vector multiplication to polynomial multiplication

NIST PQC standardization

• Feb 2016: Announced in PQCRYPTO
  • Need to run on classical, non-quantum computers
  • Wide spectrum: From extremely constrained devices to limited communication bandwidth
• July 2022: To standardize 4 algorithms
  
  
  
  
  
  
   
• July 2023: To consider 40 additional signature schemes

Beyond KEM & signature:
Introducing zk-SNARK

• Noninteractive ARgument of Knowledge
  • Prover sends to Verifier \( f,x,y, \) and a proof \( \pi \), which proves that Prover knows a (secret) \( \color{red}w\color{black} \) s.t. \( f(x,\color{red}w\color{black})=y \)
• Succinct if \( \pi \) is "small" compared with \( f, \) e.g., \( |\pi|=O(\log|f|) \)
• Zero-Knowledge if Verifier learns nothing about \( \color{red}w\color{black} \) beyond its existence and what can be inferred from \( f(x,\color{red}w\color{black})=y \)

zk-SNARKing 自然人憑證

• CA signs Cert: "Batman was born on Jan 1, 1974"
• \( f(x,\color{red}w\color{black})=1 \) if and only if:
  • \( \color{red}w\color{black} \) is a valid certificate signed by CA
  • \( \color{red}w\color{black} \) says as of today, \( x \) is over 18 years old
• Beers for Batman if \( \pi \) proves \( f(\text{Batman},\color{red}\text{Cert}\color{black})=1 \)

zk-SNARKing C2PA

• Coalition for Content Provenance and Authenticity
  • Camera signs all photos taken: \( s=\text{sign}_C(p) \)
  • Publisher/consumer verifies: \( \text{verify}_C(p,s)? \)
• What if \( p'=f(p) \) where \( f \) crops, resizes, rotates, etc?
  • \( \pi \): "I know \( \color{red}p\color{black},\color{red}s\color{black} \) s.t. \( \text{verify}_C(\color{red}p\color{black},\color{red}s\color{black}) \) & \( p'=f(\color{red}p\color{black}) \)"
  • For zk-SNARKs, \( |\pi|\ll |f|=o(|\color{red}p\color{black}|) \)