Impossibility of Quantum Virtual Black-Box Obfuscation of Classical Circuits

Abstract

Virtual black-box obfuscation is a strong cryptographic primitive: it encrypts a circuit while maintaining its full input/output functionality. A remarkable result by Barak et al. (Crypto 2001) shows that a general obfuscator that obfuscates classical circuits into classical circuits cannot exist. A promising direction that circumvents this impossibility result is to obfuscate classical circuits into quantum states, which would potentially be better capable of hiding information about the obfuscated circuit. We show that, under the assumption that Learning With Errors (LWE) is hard for quantum computers, this quantum variant of virtual black-box obfuscation of classical circuits is generally impossible. On the way, we show that under the presence of dependent classical auxiliary input, even the small class of classical point functions cannot be quantum virtual black-box obfuscated.

Appendices

A Proof of Lemma 2.9

Proof

The input-recovering circuit $C_\mathsf {rec}$ will consist of running C coherently, copying out the output register, and reverting the coherent computation of C. Suppose the circuit C contains k measurement gates, $\ell$ initializations of wires in the $\left| 0\right\rangle$ state, and outputs of length n. Define $C_\mathsf {rec}$ as:

• 1. Run $U_C$ on input , where $U_C$ is the unitary that coherently executes C, $A = (A_1, A_2)$ is a register that contains the actual input and the auxiliary input $\left| 0\right\rangle$ states for C, and M is the register that contains the auxiliary wires for the coherent measurements.

• 2. Copy the wires that are supposed to contain the output $C(\rho _\mathsf {in})$ into a register Y, initialized to $\left| 0^n\right\rangle \!\left\langle 0^n\right|$, using $\mathsf {CNOT}$s. The source of the $\mathsf {CNOT}$s is a register O, the subregister of A containing those output wires. Write $\overline{O}$ for the registers in A that are not in O (these wires are normally discarded after the execution of C).

• 3. Run $U_C^{\dagger }$ to recover the original input, and discard the registers $A_2$ and M.

The behavior of $C_\mathsf {rec}$ can be summarized as

(33)

To see that $C_\mathsf {rec}$ acts as promised, let $\rho _{\mathsf {in}}$, x, and $\varepsilon$ be s.t. $\left\| \,C(\rho _{\mathsf {in}}) - \left| x\right\rangle \!\left\langle x\right| \,\right\| _{\mathrm {tr}} \le \varepsilon$. If $\varepsilon$ is small, the $\mathsf {CNOT}$ in Step  2 does not create a lot of entanglement, since the control wires are (close to) the computational-basis state $\left| x\right\rangle \!\left\langle x\right|$. The output is therefore (almost) perfectly copied out.

More formally, note that $C(\rho _{\mathsf {in}}) = {\mathop Tr }_{\overline{O}M}\left[ U_C(\rho _{\mathsf {in}} \otimes \left| 0^{\ell + k}\right\rangle \!\left\langle 0^{\ell + k}\right| )U_C^{\dagger }\right]$. By Lemma A.1 in [ABC+19], the closeness of $C(\rho _{\mathsf {in}})$ and $\left| x\right\rangle \!\left\langle x\right|$ implies that there exists a density matrix such that

(34)

Next, we use the fact that a quantum map cannot increase the trace distance between two states to derive two inequalities from Eq. 34.

For the first inequality, we append $\left| x\right\rangle \!\left\langle x\right|$ on both sides (into a separate Y register):

(35)

For the second inequality, we instead append $\left| 0\right\rangle \!\left\langle 0\right|$ into the Y register, followed by $\mathsf {CNOT}$s from O onto Y. Note that on the second term inside the trace norm, the effect is the same as before:

(36)

Thus, by the triangle inequality, the left-hand terms inside the trace norms in Eqs. 35 and 36 are $2\sqrt{\varepsilon }$-close. Applying the map ${\mathop Tr }_{A_2M}\left[ U_C^{\dagger } (\cdot ) U_C\right]$ to both terms, which again does not increase the trace difference, we arrive at the desired statement:

$$\begin{aligned} \frac{1}{2}\left\| \,\left( \rho _{\mathsf {in}} \otimes \left| x\right\rangle \!\left\langle x\right| \right) \ \ - \ \ C_\mathsf {rec} (\rho _{\mathsf {in}})\,\right\| _{\mathrm {tr}} \le 2\sqrt{\varepsilon }. \end{aligned}$$

(37)

B Auxiliary Lemmas for Theorem 5.1

Lemma B.1

Let $g : \{0,1\}^m \rightarrow \{0,1\}^n$ for $m, n \in \mathbb {N}$, and let $c \in \{0,1\}^n$. Let $f : \{0,1\} \times \{0,1\}^m \rightarrow \{0,1\}^n$ be defined by

$$\begin{aligned} f(b,x) := {\left\{ \begin{array}{ll} c &{}\text {if } b = 0\\ g(x) &{}\text {if } b = 1. \end{array}\right. } \end{aligned}$$

(38)

Then for every QPT A, there exists a simulator S such that for all f, g of the form described above, and all input states $\rho$:

$$\begin{aligned} \Pr [A^f(\rho ) = 1] \ \ = \ \ \Pr [S^g(\rho , c) = 1]. \end{aligned}$$

(39)

Proof

Recall that since A and S are quantum algorithms, they access their oracles in superposition: that is, A has access to the map defined by $\left| x\right\rangle \left| z\right\rangle \mapsto \left| x\right\rangle \left| z \oplus f(x)\right\rangle$, and S has access to the map defined by $\left| x\right\rangle \left| z\right\rangle \mapsto \left| x\right\rangle \left| z \oplus g(x)\right\rangle$. The simulator S runs A on input $\rho$, and simulates any oracle calls to f (on inputs registers BX and output register Z) using two oracle calls to g. It only needs to prepare an auxiliary register in the state $\left| 0^n\right\rangle$, and run the following circuit:

To see that this circuit exactly simulates a query to f on BXZ, consider an arbitrary query state

$$\begin{aligned} \sum _i \alpha _i \left| b_i, x_i\right\rangle _{BX}\left| z_i\right\rangle _{Z}\left| \varphi _i\right\rangle _R, \end{aligned}$$

(40)

where R is some purifying register. The state on BXZR (plus the two auxiliary registers containing $\left| 0^n\right\rangle$ and $\left| c\right\rangle$) after the above circuit is executed, is equal to

$$\begin{aligned}&\sum _i \alpha _i \left| b_i, x_i\right\rangle _{XB} \left| 0^n\right\rangle \left| z_i \oplus b \cdot g(x_i) \oplus (1-b) \cdot c\right\rangle _Z \left| c\right\rangle \left| \varphi _i\right\rangle _R \end{aligned}$$

(41)

$$\begin{aligned} =&\sum _i \alpha _i \left| b_i, x_i\right\rangle _{XB} \left| 0^n\right\rangle \left| z_i \oplus f(x_i)\right\rangle _Z \left| c\right\rangle \left| \varphi _i\right\rangle _R, \end{aligned}$$

(42)

which is exactly the state that would result from a direct query to f.

Corollary B.2

Let $\hat{\mathcal {C}}^{\mathsf {point}} _{\lambda }$ and q be as in Sect. 5. Then for any QPT $\mathcal {S} _0$, there exists a QPT simulator $\mathcal {S} _1$ such that for all $\alpha ,r \in \{0,1\}^{\lambda }$,

$$\begin{aligned} \left| \Pr [\mathcal {S} _0^{\hat{C}_{\alpha ,\beta ,q,r,r',\widetilde{\alpha }, o _{ sk ,\beta }}}(1^{\lambda }) = 1] - \Pr [\mathcal {S} _1^{\mathbf {P}_{\alpha ,\beta }}(1^{\lambda }, \widetilde{\alpha }, o _{ sk ,\beta }, pk ) = 1] \right| \le \mathsf {negl}\left( \lambda \right) . \end{aligned}$$

(43)

A similar statement holds for circuits from $\hat{\mathcal {C}}^{\mathsf {zero}} _{\lambda }$.

Proof

The statement is proven via an intermediate simulator $\mathcal {S} _2$. This simulator is constructed by repeated application of Lemma B.1, so that for all $\alpha ,r$,

$$\begin{aligned} \left| \Pr [\mathcal {S} _0^{\hat{C}_{\alpha ,\beta ,q,r,r',\widetilde{\alpha }, o _{ sk ,\beta }}}(1^{\lambda }) = 1] - \Pr [\mathcal {S} _2^{\mathbf {P}_{\alpha ,\beta }}(1^{\lambda }, \widetilde{\alpha }, o _{ sk ,\beta }, c_0, c_1, c_2, \dots , c_K, \bot ) = 1] \right| \end{aligned}$$

(44)

is at most $\mathsf {negl}\left( \lambda \right)$, where $K = K(q,\lambda )$ as in Definition 3.1. On the right-hand side, the probability is additionally over a random choice of $r'$ (resulting in the sequence $(c_0, c_1, c_2, \dots , c_K)$).

Next, we apply the simulatability property of Definition 3.1. It states that there exists a simulator $\mathcal {S} _3$ that, given a public key, can generate the distribution over $(c_0, c_1, c_2, \dots , c_K)$ itself. Define

$$\begin{aligned} \mathcal {S} _1^{\mathbf {P}_{\alpha ,\beta }}(1^{\lambda }, \widetilde{\alpha }, o _{ sk ,\beta }, pk ) := \mathcal {S} _2^{\mathbf {P}_{\alpha ,\beta }}(1^{\lambda }, \widetilde{\alpha }, o _{ sk ,\beta }, \mathcal {S} _3( pk ), \bot ), \end{aligned}$$

(45)

and the corollary follows.