On the (Im)possibility of Time-Lock Puzzles in the Quantum Random Oracle Model

Abstract

Time-lock puzzles wrap a solution $\textrm{s}$ inside a puzzle $\textrm{P}$ in such a way that “solving” $\textrm{P}$ to find $\textrm{s}$ requires significantly more time than generating the pair $(\textrm{s},\textrm{P})$, even if the adversary has access to parallel computing; hence it can be thought of as sending a message $\textrm{s}$ to the future. It is known [Mahmoody, Moran, Vadhan, Crypto’11] that when the source of hardness is only a random oracle, then any puzzle generator with n queries can be (efficiently) broken by an adversary in O(n) rounds of queries to the oracle.

In this work, we revisit time-lock puzzles in a quantum world by allowing the parties to use quantum computing and, in particular, access the random oracle in quantum superposition. An interesting setting is when the puzzle generator is efficient and classical, while the solver (who might be an entity developed in the future) is quantum-powered and is supposed to need a long sequential time to succeed. We prove that in this setting there is no construction of time-lock puzzles solely from quantum (accessible) random oracles. In particular, for any n-query classical puzzle generator, our attack only asks O(n) (also classical) queries to the random oracle, even though it does indeed run in quantum polynomial time if the honest puzzle solver needs quantum computing.

Assuming perfect completeness, we also show how to make the above attack run in exactly n rounds while asking a total of $m\cdot n$ queries where m is the query complexity of the puzzle solver. This is indeed tight in the round complexity, as we also prove that a classical puzzle scheme of Mahmoody et al. is also secure against quantum solvers who ask $n-1$ rounds of queries. In fact, even for the fully classical case, our attack quantitatively improves the total queries of the attack of Mahmoody et al. for the case of perfect completeness from $O(mn \log n)$ to mn. Finally, assuming perfect completeness, we present an attack in the “dual” setting in which the puzzle generator is quantum while the solver is classical.

We then ask whether one can extend our classical-query attack to the fully quantum setting, in which both the puzzle generator and the solver could be quantum. We show a barrier for proving such results unconditionally. In particular, we show that if the folklore simulation conjecture, first formally stated by Aaronson and Ambainis [arXiv’2009] is false, then there is indeed a time-lock puzzle in the quantum random oracle model that cannot be broken by classical adversaries. This result improves the previous barrier of Austrin et. al [Crypto’22] about key agreements (that can have interactions in both directions) to time-lock puzzles (that only include unidirectional communication).

A. Afshar and M. Mahmoody were supported by NSF grants CCF-1910681 and CNS1936799. K.M. Chung was supported by NSTC QC project, under Grant no. NSTC 112-2119-M-001-006- and the Air Force Office of Scientific Research under award number FA2386-20-1-4066.

A The Description of the Extractor in Lemma 1

We give a proof and the description of $\textsf{Ext}$ for completeness.

Proof

of Lemma 1.

Define the algorithm $\textsf{Ext}({\mathcal A}^H(z))$ as follows:

• Pick $i\xleftarrow {\$}[q]$.

• Run ${\mathcal A}^H(z)$ until (right before) the $i{}^\textrm{th}$ query.

• Measure the query register of ${\mathcal A}^H(z)$ in the computational basis to obtain the outcome $x\in {\mathcal X}$.

• Output x.

The probability that $\textsf{Ext}({\mathcal A}^H(z))$ successfully outputs $x\in {\mathcal S}$ is given by

$$\begin{aligned} \sum _{j=1}^q\Pr [i=j]\Pr [x\in {\mathcal S}\mid i=j:x\leftarrow |\psi ^H_i\rangle ] = \frac{1}{q}\sum _{j=1}^q\Vert \varPi _{\mathcal S}|\psi ^H_j\rangle \Vert ^2 = \frac{\mu ({\mathcal A}^H(z),{{\mathcal S}})}{q}. \end{aligned}$$

   $\square$