---
abstract: 'We present two new constructions of quantum hash functions: the first based on expander graphs and the second based on extractor functions and estimate the amount of randomness that is needed to construct them. We also propose a keyed quantum hash function based on extractor function that can be used in quantum message authentication codes and assess its security in a limited attacker model.'
author:
- 'M. Ziatdinov'
date: 'May 28, 2016'
title: From Graphs to Keyed Quantum Hash Functions
---

Introduction {#sec:introduction}
============

Quantum hash functions are similar to classical (cryptographic) hash functions and their security is guaranteed by physical laws. However, their construction and applications are not fully understood.

Quantum hash functions were first implicitly introduced in @Buhrman2001 as quantum fingerprinting. Then @Gavinsky2010 noticed that quantum fingerprinting can be used as cryptoprimitive. However, binary quantum hash function are not very suitable if we need group operations (and group is not ${\mathbb{Z}}_{2^k}$. For example, several classical hash functions were proposed that use groups, e.g. by @Charles2009 and by @Tillich1994. @Ablayev2015 gave a definition and construction of non-binary quantum hash functions. @Ziatdinov2016 showed how to generalize quantum hashing to arbitrary finite groups. Recently, @Vasiliev2016 showed how quantum hash functions are connected with $\epsilon$-biased sets.

Quantum hash functions map a classical message into a Hilbert space. Such space should be as small as possible, so eavesdropper can’t read a lot of information about classical message (this is guaranteed by physical laws as Holevo-Nayak’s theorem states). But images of different messages should be as far apart as possible, so recipient can check that hash differ or not with high probability. We measure this distance using an absolute value of scalar product of hashes of different messages.

Informally speaking, to define a quantum hash function we need some random data. Then our input is mixed with this random data. Quantum parallelism allows us to do it in different subspaces simultaneously, so resulting hash is small. For example, random subsets suffice (for ${\mathbb{Z}}_m$) [@Ablayev2008], random codes suffice (for ${\mathbb{Z}}_2^n$) [@Buhrman2001], random automorphisms suffice (for any finite group) [@Ziatdinov2016]. @Vasiliev2015 used some heuristics to find best subsets of ${\mathbb{Z}}_m$.

However, typically the amount of randomness that is needed to construct such quantum hash functions is large (about $O(\log^2 |G|)$). We reduce amount of randomness needed to define quantum hash function to $O(\log |G| \log \log |G|)$ in expander-based quantum hash function.

Extractor-based quantum hash function allows us to introduce a notion of keyed quantum hash function. It can be used, for example, in quantum message authentication codes. Unlike [@Barnum2001] and [@Barnum2002] we use classical keys and authenticate classical messages. Unlike [@Curty2001] we authenticate whole messages, not single bits. However, our security analysis has only limited attacker.

It is known that walk on expander graph gives results very similar to random sampling. We show that walks on expander graphs give a quantum hash functions in section \[sec:expander-qhf\]. Structure of these quantum hash functions is somewhat different from previous versions.

Extractor is a generalization of expander graph. In the section \[sec:keyed-qhf\] we propose a keyed quantum hash function based on extractors and assess its security against limited attacker.

#### Acknowledgements.

I thank Farid Ablayev, Alexander Vasiliev and Marco Carmosino for helpful discussions. A part of this research was done while attending a Special Semester Program on Computational and Proof Complexity (April-June 2016) organized by Chebyshev Laboratory of St.Petersburg State University in cooperation with Skolkovo Institute of Science and Technology and Steklov Institute of Mathematics at St.Petersburg. Partially supported by Russian Foundation for Basic Research, Grants 14-07-00557, 15-37-21160. The work is performed according to the Russian Government Program of Competitive Growth of Kazan Federal University.

Definitions
===========

Let us recall some basic definitions.

Statistics
----------

We use a standard definition of the statistical distance.

We say that two distributions $F$ and $G$ are $\epsilon$-close, if for every event $A$, $|\Pr[F \in A] - \Pr[G \in A]| \le \epsilon$.

The support of a distribution $X$ is ${\mathrm{Supp}}(X) = \{ x : \Pr[X = x] > 0 \}$.

The uniform distribution over ${\{0,1\}}^m$ is denoted by $U_m$ and we say that $X$ is $\epsilon$-close to uniform if it is $\epsilon$-close to $U_m$.

We denote that distribution $F$ is $\epsilon$-close to distribution $G$ by $F {\overset{\epsilon}{\approx}}G$.

We also use a standard definition of the min-entropy.

Let $X$ be a distribution. The min-entropy of $X$ is $H_\infty(X) = \min_{x \in {\mathrm{Supp}}(X)} \log \frac 1 {\Pr[X=x]}$.

Quantum model of computation
----------------------------

We use the following model of computation.

Recall that a qubit ${\left| \Psi \right\rangle}$ is a superposition of basis states ${\left| 0 \right\rangle}$ and ${\left| 1 \right\rangle}$, i.e. ${\left| \Psi \right\rangle} = \alpha{\left| 0 \right\rangle} + \beta{\left| 1 \right\rangle}$, where $\alpha, \beta \in {\mathbf{C}}$ and $|\alpha|^2 + |\beta|^2 = 1$. So, qubit ${\left| \Psi \right\rangle} \in {\mathcal{H}^2}$, where ${\mathcal{H}^2}$ is a two-dimensional Hilbert complex space.

Let $s \ge 1$. We denote $2^s$-dimensional Hilbert complex space by ${({\mathcal{H}^2})^{\otimes s}}$: $${({\mathcal{H}^2})^{\otimes s}} = {\mathcal{H}^2}\otimes {\mathcal{H}^2}\otimes \ldots \otimes {\mathcal{H}^2}= \mathcal{H}^{2^s}$$

We denote a state ${\left| a_1 \right\rangle}{\left| a_2 \right\rangle}\ldots{\left| a_n \right\rangle}$, each $a_i \in {\{0,1\}}$, by ${\left| i \right\rangle}$, where $i$ is $\overline{a_1a_2\ldots a_n}$ in binary. For example, we denote ${\left| 1 \right\rangle}{\left| 1 \right\rangle}{\left| 0 \right\rangle}$ by ${\left| 6 \right\rangle}$. Usually it is clear, which space this state belongs to.

Computation is done by multiplying a state by a unitary matrix: ${\left| \Psi_1 \right\rangle} = U {\left| \Psi_0 \right\rangle}$, where $U$ is a unitary matrix: $U^\dagger U = I$, $U^\dagger$ is the conjugate matrix and $I$ is the identity matrix.

The density matrix of a mixed state $\{p_i, {\left| \psi_i \right\rangle}\}$ is a matrix $\rho = \sum_i p_i {\left| \psi_i \right\rangle}{\left\langle \psi_i \right|}$. A density matrix belongs to ${\mathrm{Hom}({({\mathcal{H}^2})^{\otimes s}},{({\mathcal{H}^2})^{\otimes s}})}$, the set of linear transformations from ${({\mathcal{H}^2})^{\otimes s}}$ to ${({\mathcal{H}^2})^{\otimes s}}$.

At the end of computation state is measured by POVM (Positive Operator Valued Measure). A POVM on a ${({\mathcal{H}^2})^{\otimes s}}$ is a collection $\{E_i\}$ of positive semi-definite operators $E_i : {\mathrm{Hom}({({\mathcal{H}^2})^{\otimes m}},{({\mathcal{H}^2})^{\otimes m}})} \to {\mathrm{Hom}({({\mathcal{H}^2})^{\otimes m}},{({\mathcal{H}^2})^{\otimes m}})}$ that sums up to the identity transformation, i.e. $E_i \succeq 0$ and $\sum_i E_i = I$. Applying a POVM $\{E_i\}$ on a density matrix $\rho$ results in answer $i$ with probability $\operatorname{Tr}(E_i \rho)$.

Character theory
----------------

Let $G$ be a group with unity $e$ and operation $\circ$.

The character $\chi: G \to {\mathbb{C}}$ of the group $G$ is a homomorphism of $G$ to ${\mathbb{C}}$: for any $g, g' \in G$ it holds that $\chi(g \circ g') = \chi(g) \chi(g')$.

Graphs
------

Let the graph $\Gamma = (V,E)$ with set of vertices $V$ and set of edges $E$ be fixed. Self-loops and multiple edges are allowed.

Graph $\Gamma$ is the $d$-regular graph if all vertices have the same degree $d$; i.e. each vertex is incident to exactly $d$ edges.

Adjacency matrix of the graph $A = A(\Gamma)$ is an $n \times n$ matrix whose $(u,v)$ entry is the number of edges between vertex $u$ and vertex $v$.

Let $\lambda_1 \ge \lambda_2 \ge \ldots \ge \lambda_n$ be eigenvalues of matrix $A = A(\Gamma)$, i.e. for some $v_i$ it holds that $A v_i = \lambda_i v_i$. We refer to the eigenvalues of $A(\Gamma)$ as the spectrum of the graph $\Gamma$.

Given a $d$-regular graph $\Gamma$ with $n$ vertices and spectrum $\lambda_1 \ge \lambda_2 \ge \ldots \ge \lambda_n$ we denote $\lambda(\Gamma) = \max\{ |\lambda_2|, |\lambda_n| \}$.

We call the graph $\Gamma$ a $(d,\lambda)$-expander graph if $\Gamma$ is $d$-regular and has $\lambda(\Gamma) = \lambda$.

Every expander graph can be converted to a bipartite expander graph. One can just take two copies of vertex sets and change original edges to go from one copy to another. Generalization of these bipartite expander graphs is extractor graphs. The extractor graph is a bipartite graph where size of components can be different. An extractor can also be defined in terms of function that maps pair of first component vertex and edge to second component vertex.

A function $E: {\{0,1\}}^n \times {\{0,1\}}^d \to {\{0,1\}}^m$ is a $(k,\epsilon)$-extractor if for every distribution $X$ over ${\{0,1\}}^n$ with $H_\infty(X) \ge k$, $E(X,Y)$ is $\epsilon$-close to uniform (where $Y$ is distributed like $U_d$ and is independent of $X$).

Sometimes we use extractor functions that map one (arbitrary) set to other: $E: G \times {\{0,1\}}^d \to H$. These functions can be thought of as bipartite graphs with vertices $(G,H)$. In this case we denote uniform distribution on $H$ by $U_H$. We also use extractors against quantum storage. Informally, their output is $\epsilon$-close to uniform and no quantum circuit operating on $b$ qubits can distinguish output from uniform.

An $(n,b)$ quantum encoding is a collection $\{\rho(x)\}_{x \in {\{0,1\}}^n}$ of density matrices $\rho(x) \in {({\mathcal{H}^2})^{\otimes b}}$.

A boolean test $T$ $\epsilon$-distinguishes a distribution $D_1$ from a distribution $D_2$ if $|\Pr_{x_1 \in D_1}[T(x_1) = 1] - \Pr_{x_2 \in D_2}[T(x_2) = 1]| \ge \epsilon$.

We say $D_1$ is $\epsilon$-indistinguishable from $D_2$ if no boolean POVM can $\epsilon$-distinguish $D_1$ from $D_2$.

A function $X: {\{0,1\}}^n \times {\{0,1\}}^d \to {\{0,1\}}^m$ is a $(k,b,\epsilon)$ strong extractor against quantum storage, if for any distribution $X \subseteq {\{0,1\}}^n$ with $H_\infty(X) \ge k$ and every $(n,b)$ quantum encoding $\{\rho(x)\}$, $U_t \circ E(X,U_t) \circ \rho(X)$ is $\epsilon$-indistinguishable from $U_{t+m} \circ \rho(X)$.

Quantum hash functions {#sec:qhf}
======================

Informally, quantum hash function is a function that maps [*large*]{} classical input to a [*small*]{} quantum (hash) state such that two requirements are satisfied: (1) it is hard to restore input given the hash state and (2) it is easy to check with high probability that inputs for two quantum hash states are equal or different.

It is easy to meet the first requirement for a constant hash size. One can simply take a qubit ${\left| \Psi(w) \right\rangle} = \alpha(w){\left| 0 \right\rangle} + \beta{\left| 1 \right\rangle}$ and encode the input in a fractional part of $\alpha$. But then the second requirement is not satisfied.

It is easy to meet the second requirement for a hash size that is logarithmic in input size. One can simply map the input to the corresponding base state: ${\left| \Psi(i) \right\rangle} = {\left| i \right\rangle}$. However, then the first requirement is not satisfied.

Let us give the formal definition.

For $\delta \in (0, 1/2)$ we call a function $\psi : X \to {({\mathcal{H}^2})^{\otimes s}}$ a $\delta$-resistant function if for any pair $w,w'$ of different elements of $X$ their images are almost orthogonal: $$\label{eq:qhf-resistance}
  |{\langle \psi(w) | \psi(w') \rangle}| \le \delta.$$

We call a map $\psi: X \to {({\mathcal{H}^2})^{\otimes s}}$ an $\delta$-resistant $(K;s)$ quantum hash function if $\psi$ is a $\delta$-resistant function, and $\log|X| = K$.

Quantum hash function maps inputs of length $K$ to (quantum) outputs of length $s$. If $K \gg s$ any attacker can’t get a lot of information by Holevo-Nayak theorem [@Nayak1999].

The equality of two hashes can be checked using, for example, well-known SWAP-test [@Gottesman2001].

All our hash functions have the following form: $$\label{eq:qhf-structure}
  {\left| \psi(g) \right\rangle} = \sum_{i=1}^t \chi(k_i(g)) {\left| i \right\rangle},$$ where $g$ is an element of some group $G$, $\{k_i, i=1,\ldots,t\}$, $k_i: G \to H$ is a set of mappings from group $G$ with operation $\circ$ to group $H$ with operation $\bullet$ and $\chi: H \to {\mathbb{C}}$ is a character of the group $H$.

For example, the group $G$ can be thought of as $Z_{2^n}$ with group operation $+$, then elements of $G$ can be encoded as binary strings ${\{0,1\}}^n$ of length $n$

Why groups? {#sec:why-group}
-----------

We use groups in quantum hash functions of form (\[eq:qhf-structure\]), not just arbitrary sets, because groups have nice structure. We can combine elements of group and we can inverse them. Several classical cryptoprimitives were proposed that use groups, e.g. by @Charles2009 and by @Tillich1994.

Expanders for Quantum Hashing {#sec:expander-qhf}
=============================

As noted in Section \[sec:introduction\], randomly chosen parameters with high probability lead to a quantum hash function. We replace this process with random walk on expander graph that is known to be close to uniform sampling.

In this section we fix a group $G$ with group operation $\odot$ and unity $e$. Let $\Gamma = (V,E)$ be an extractor - i.e. $d$-regular graph with spectral gap $\lambda$. We label vertices $V$ of graph $\Gamma$ with messages (i.e. elements of group $G$).

Let us randomly choose one vertex and perform a random walk of length $t$ starting from it. Denote vertices that occured in this walk by $s_j$. Parameter $t$ depend on security parameter $\epsilon$ of quantum hash function and we derive its value in theorem \[thm:t-expander\].

It is easy to note that such construction requires only $t d + \log |G|$ bits of randomness.

Let us define the expander quantum hash function.

The expander quantum hash function ${{\Psi}_{\Gamma,t}}(g)$ maps elements of $G$ to unitary transformations in $m$-dimensional Hilbert space ${({\mathcal{H}^2})^{\otimes m}}$: $${{\Psi}_{\Gamma,t}}(g) = \sum_{k=1}^t \chi(g \odot s_k) {\left| k \right\rangle}.$$

If we choose $\Gamma$ and $t$ appropriately, ${{\Psi}_{\Gamma,t}}$ is a quantum hash function.

\[thm:t-expander\] For any $\delta \in (0; \frac 1 2)$ the function ${{\Psi}_{\Gamma,t}}$ is a $\delta$-resistant $(\log |G|;\log t)$ quantum hash function if $t > O(\frac{\log |G|}{\delta})$.

Let us fix some $t$. $${\langle {\Psi}^\dagger(g) | {{\Psi}_{\Gamma,t}}(g') \rangle} = \sum_{k=1}^t {\langle \chi^*(g \odot s_k) | \chi(g' \odot s_k) \rangle} = |\sum_{k=1}^t \chi(s_k^{-1} \odot g^{-1} \odot g' \odot s_k)|.$$

Denoting $g'' = g^{-1} \odot g'$, we get $${\langle {\Psi}^\dagger(g) | {{\Psi}_{\Gamma,t}}(g') \rangle} = |\sum_{k=1}^t \chi(s_k^{-1} \odot g'' \odot s_k)|,$$ and $x_k = s_k^{-1} \odot g'' \odot s_k$ is also some random walk on graph $\Gamma$.

Let $G$ be a weighted graph with eigenvalue gap $\epsilon = 1 - \lambda$ and non-uniformity $\nu$. Let random walk on $G$ starts in distribution $q$ and has stationary distribution $\pi$. Then Chernoff bound for expander graphs [@Gillman1993] states that for any positive integer $n$ and for any $\gamma > 0$: $$\label{eq:gillman-chernoff}
  \Pr\left[ \bigg| \sum_{i=1}^n f(x_i) - n {\mathbf{E}}_\pi f \bigg| \ge \gamma \right] \le 4 N_q \exp\left[-\bigg(\frac{\gamma}{||f||_\infty}\bigg)^2 \frac{\epsilon}{20n} \right].$$ Here we have graph weights $w_{ij} = \frac 1 d$ for all $i,j$ and $w_x=1$, thus $\nu = 1$ and $\pi(x) = \frac 1 V$. Initial distribution $q$ is uniform distribution over $G$, therefore $N_q = 1$. Function $f(x) = \chi(x)$ obviously has $||f||_\infty \le 1$. We also bound (\[eq:gillman-chernoff\]) with some small probability, e.g. $\frac 1 {|G|}$. Then (\[eq:gillman-chernoff\]) becomes $$\Pr \bigg[ \big| \sum_{i=1}^t f(x_i) - t {\mathbf{E}}_\pi f \big| \ge \gamma \bigg] \le 4\exp \bigg[ - \frac {\gamma^2 \epsilon} {20t} \bigg] \le \frac 1 {|G|}.$$

Solving with respect to $t$ gives us: $$t \ge \frac {20}{(1-\lambda) \delta} \ln(4 |G|) = O(\log |G|).$$

If we make a random walk of length $t = O(\log |G|)$, we will get a quantum hash function with high probability.

So, construction of this quantum hash function requires only $O(\log |G|)$ bits of randomness if underlying expander graph is chosen carefully.

For all $n$ and $\delta \in (0;\frac 1 2)$ there exist a $\delta$-resistant $(\log n;\log t + 1)$ quantum hash function with $t \ge \frac{160 \sqrt 2}{3 \delta} \ln(4 n)$.

We use Margulis construction [@Hoory2006] of $(8;\frac{5 \sqrt 2}{8})$ expander graph with $n^2$ vertices and character of group ${\mathbb{Z}}_n^2$.

Extractors for Quantum Hashing {#sec:extractor-qhf}
==============================

Let ${\mathrm{Ext}}: G \times {\{0,1\}}^d \to H$ be a $(k;\epsilon)$ extractor function. Let $t$ and $s_i \in G, i \in \{1,\ldots,t\}$ be parameters. We choose them in Theorem \[thm:extractor-qhf\]. Denote $S = \{ s_i \}$.

We define a quantum hash function ${\Psi}$ based on extractor ${\mathrm{Ext}}$ as follows.

$${{\Psi}_{{\mathrm{Ext}},t,S}}(g) = \sum_{i=1}^t \sum_{j=1}^{2^d} \chi({\mathrm{Ext}}(g \circ s_i,j)) {\left| j \right\rangle} {\left| i \right\rangle}.$$

Intuitively, we start from several vertices and move along all incident edges simultaneously.

Parameters $t$, $s_i$ depend on security parameter $\epsilon$. Let us choose it.

\[thm:extractor-qhf\] If ${\mathrm{Ext}}$ is a $(k,\epsilon)$ extractor, parameter $t > \frac{\log |H| + 1}{2\epsilon^2} ||\chi||_\infty$ and $s_i$ are chosen according to distribution $X$ with $H_\infty(X) \ge k$, then ${\Psi}_{{\mathrm{Ext}}}$ is an $\epsilon$-resistant $(n;d + \log t)$ quantum hash function.

It is sufficient to prove that for any $g' \neq g$ $$\begin{aligned}
    \bigg| {\langle {{\Psi}_{{\mathrm{Ext}},t,S}}(g) | {{\Psi}_{{\mathrm{Ext}},t,S}}(g') \rangle} \bigg| &= \bigg| \sum_{i=1}^t \sum_{j=1}^{2^d} \chi({\mathrm{Ext}}(g \circ s_i, j)^{-1} \bullet {\mathrm{Ext}}(g' \circ s_i, j) ) \bigg| \le \\
    & \le \sum_{i=1}^t \sum_{j=1}^{2^d} | \chi({\mathrm{Ext}}(g \circ s_i, j)^{-1} \bullet {\mathrm{Ext}}(g' \circ s_i, j) ) | < \epsilon.
  \end{aligned}$$

Define $X_i$ to be a distribution of (random variable) $s_i$. Let $Y_i$ be a random variable ${\mathbf{E}}_{U_d}[|\chi({\mathrm{Ext}}(X_i,U_d))|]$.

It is easy to see that $Y_i \le ||\chi||_\infty = 1$.

Then by Hoeffding’s inequality: $$Pr \Bigg[ \bigg| \frac 1 t \sum_{i=1}^t Y_i - {\mathbf{E}}\Big[ \frac 1 t \sum_{i=1}^t Y_i \Big] \bigg| \ge \epsilon \Bigg] \le 2 \exp \bigg( - 2t\epsilon^2 \bigg).$$

Bounding this probability by $\frac 1 {|H|}$ and solving with respect to $t$ gives $$t \ge \frac{\log|H| + 1}{2\epsilon^2}.$$

Note that selecting parameters $S$ requires $O(\log |G| \times \log |H|)$ random bits.

For every $\epsilon > 0$, $\alpha > 0$ and all positive integers $n, k$ there exist an $\epsilon$-resistant $(n; \log t + d + 1)$ quantum hash function, where $t \ge \frac{m+1}{2\epsilon^2}$, $d = O(\log n + \log (1 / \epsilon))$ and $m \ge (1-\alpha) k$.

@Guruswami2009 proved that for every $\alpha > 0$ and all positive integers $n,k$ and all $\epsilon > 0$ there is an explicit construction of a $(k;\epsilon)$ extractor $E: {\{0,1\}}^n \times {\{0,1\}}^d \to {\{0,1\}}^m$ with $d  = O(\log n + \log (1 / \epsilon))$ and $m \ge (1-\alpha) k$.

Quantum hash function ${\Psi}_{E,t}$ is the required function.

Keyed quantum hash functions {#sec:keyed-qhf}
============================

Classical message authentication codes (MAC) have wide range of applications. They are defined as a triple of algorithms: $G$ that generates a key, $S$ that uses the key and the message to generate a tag of the message, and $V$ that uses the key, the message and the tag to verify message integrity.

Formally, $G : 1^n \to K$, where $n$ is a a security parameter and $K$ is a set of all possible keys, $S: K \times X \to T$, where $X$ is a set of messages and $T$ is a set of tags and $V: K \times X \times T \to \{\mathrm{Acc}, \mathrm{Rej}\}$.

We require the following property for MAC to be a sound system: $$\label{eq:mac-sound}
  \forall n, \forall x \in X: k = G(1^n), V \big( k, x, S(k, x) \big) = \mathrm{Acc},$$ i.e. that verifier always accepts a generated tag.

We also require that MAC is a secure system and for any adversary $A$ that can query MAC: $$\label{eq:mac-secure}
  \forall n, k \notin \mathrm{Query}(A), (x,t) \gets A(S), \Pr \big[ V(k, x, t) = \mathrm{Acc} \big] \le \mathrm{negl}(n),$$ i.e. any adversary that can query MAC outputs correct tag for some key that was not queried and some message with negligible probability.

One classical construction of MAC is hash-based MAC (also known as keyed hash functions). Basically, keyed hash function is a function $H(k,x)$, such that $H(k,\cdot)$ is a cryptographic hash function for every $k$. It is easy to see that such function can be used as MAC.

With the same considerations as in Section \[sec:qhf\], we define these algorithms to be the following.

An $(\epsilon,\delta)$ keyed quantum hash function is a quantum function $S$, such that

A function $S$ accepts a key $k \in K$ and a message $x \in X$ and outputs a quantum tag for $x$: $S: K \times X \to T = {({\mathcal{H}^2})^{\otimes t}}$.

We require soundness, i.e. tags should be different for different messages under the same key. $$\forall k \in K, \forall x \in X, \forall y \neq x: {\langle S(k,x) | S(k,y) \rangle} < \epsilon.$$ For $x = y$ we get ${\langle S(k,x) | S(k,x) \rangle} = 1$.

We also require unforgeability: $$\forall k \in K, k \notin \mathrm{Query}(A), (x,t) \gets A(S), \Pr \big[ {\langle t | S(k,x) \rangle} \ge \epsilon) \big] \le \delta,$$ where $A$ is arbitrary attacker that can query $S$ and $\mathrm(Query)(A)$ is a set of queries made.

Informally, keyed quantum hash function outputs a tag for a message. If someone changes a message, then the verification step fails with high probability. If an attacker Eve can query a keyed quantum hash function, access to a function doesn’t help her to forge a tag for some message with some (unqueried) key.

\[thm:extractor-keyed-qhf\] Let us define an extractor-based keyed quantum hash function as follows. Let ${\mathrm{Ext}}: {\{0,1\}}^n \times {\{0,1\}}^d \to {\{0,1\}}^m$ be a $(k,b,\epsilon)$ extractor against $b$ quantum storage and $b > r (d + \log t)$ .

Then a function $${{\Psi}_{{\mathrm{Ext}}}}({\mathsf{key}},g) = \sum_{i=1}^t \sum_{j=1}^{2^d} \chi({\mathrm{Ext}}(g \circ {\mathsf{key}}\circ s_i,j)) {\left| j \right\rangle}{\left| i \right\rangle}$$ is a $(\epsilon; \epsilon + \epsilon^{2^s+1})$ keyed quantum hash function secure against an attacker $A$ with access to $r$ queries to ${\Psi}_{{\mathrm{Ext}}}$.

We have to prove two claims. First, for any $k,x$ and $x' \neq x$, it holds that ${\langle {{\Psi}_{{\mathrm{Ext}}}}(k,x) | {{\Psi}_{{\mathrm{Ext}}}}(k,x') \rangle} < \epsilon$. Second, for any attacker $A$ and any $k \notin \mathrm{Query}(A)$ attacker output $x,t$ such that ${\langle t | {{\Psi}_{{\mathrm{Ext}}}}(k,x) \rangle} \ge \epsilon$ with negligible probability.

The first claim is implied by Theorem \[thm:extractor-qhf\].

To prove the second claim we note that access to hash function doesn’t help attacker to output correct tag. Proof by contradiction. Suppose $A$ to be such attacker. Then we can distinguish between ${\mathrm{Ext}}(X,U_d)$ and $U_m$ using a $r (\log t + d)$ qubits. But $r (\log t + d) < b$ that contradicts the fact that ${\mathrm{Ext}}$ is an extractor against $b$ quantum storage.

Then attacker should output the tag without access to hash function. This is equal to outputting a state that is close to correct tag. Then the probability of correct guessing $p$ is a ratio of the volume of sphere with radius $\epsilon$ to the volume of the whole space: $$p = \frac {c \epsilon^{2^s + 1}} {c (1 + \epsilon)^{2^s+1}} \le \epsilon^{2^s+1}.$$

For all positive integers $k,n$ and all $c > 0$ there exist a $(N^{-c}; 2 N^{-c})$ keyed quantum hash function.

@De2009 proved that for every $\alpha, c > 0$ there exist an explicit $(\alpha N,b,N^{-c})$ extractor $E: {\{0,1\}}^N \times {\{0,1\}}^d \to {\{0,1\}}^m$ against $b$ quantum storage with $d = O(\log^4 n)$ and $m = \Omega (\alpha N - b)$.

Open problems
=============

Groups that we considered here and all constructions known to us use finite groups or sets and hash input strings of finite lengths.

Can quantum hash functions be constructed for infinite groups?

On the one hand, even one qubit can store arbitrary length binary string. On the other hand, the measurement of one qubit can’t result in more than one classical bit of information.

And “dual” question about infinite strings.

Can quantum hash functions work on infinite input strings (i.e. ${\{0,1\}}^*$)?

This problem seems to be easier, but it probably requires careful analysis.

Another interesting line of research would be improving keyed quantum hash function.

Can keyed quantum hash function be secure against an attacker with unlimited number of queries?
