Write, autoreview, editor, reviewer
3,129
edits
Line 32: | Line 32: | ||
==='''Stage1''' Preimages superposition=== | ==='''Stage1''' Preimages superposition=== | ||
*'''Input:''' Client uniformly samples a set of random three-bits strings α = (α1,··· ,αn−1) where αi ← {0,1}3, and runs the algorithm (k,tk) ← GenF(1n). The α and k are public inputs (known to both parties), while tk is the “private” input of the Client, A public function family F = {fk : {0,1}n → {0,1}m} of trapdoor one-way functions that are quantum safe, two-regular and collision resistant (or second preimage resistant) (See Supplementary Information for Function Construction) | |||
*'''Input:''' Client uniformly samples a set of random three-bits strings α = (α1,··· ,αn−1) where αi ← {0,1}3, and runs the algorithm (k,tk) ← GenF(1n). The α and k are public inputs (known to both parties), while tk is the “private” input of the Client | |||
#Client: instructs Server to prepare one register at ⊗nH |0i and second register initiated at |0im | #Client: instructs Server to prepare one register at ⊗nH |0i and second register initiated at |0im | ||
#Client: returns k to Server and the Server applies Ufk using the first register as control and the second as target | #Client: returns k to Server and the Server applies Ufk using the first register as control and the second as target | ||
Line 41: | Line 40: | ||
{missing equation} | {missing equation} | ||
where G¯ is the set of bits positions where x,x0 are identical, G is the set of bits positions where the preimages differ, while suitably changing the order of writing the qubits. | where G¯ is the set of bits positions where x,x0 are identical, G is the set of bits positions where the preimages differ, while suitably changing the order of writing the qubits. | ||
==='''Stage2''' Squeezing=== | ==='''Stage2''' Squeezing=== | ||
*'''Output''': If the protocol is run honestly, when there is no abort, the state that Server has is |+θi, where the Client (only) knows the classical description. | *'''Output''': If the protocol is run honestly, when there is no abort, the state that Server has is |+θi, where the Client (only) knows the classical description. |