[Paper Review] Efficient Certifiable Randomness from a Single Quantum Device

Urmila Mahadev, Umesh Vazirani+1 more|arXiv (Cornell University)|Apr 24, 2022

Cryptography and Data Security4 citations

TL;DR

This paper presents a new protocol for certifiable randomness generation using a single untrusted quantum device, achieving near-optimal randomness rate by leveraging leakage-resilient Learning With Errors (LWE) constructions. The protocol generates Ω(n) bits of statistically random output in constant rounds with O(n) communication, significantly improving upon prior work while maintaining security under the post-quantum LWE assumption.

ABSTRACT

Brakerski et. al [BCM+18] introduced the model of cryptographic testing of a single untrusted quantum device and gave a protocol for certifiable randomness generation. We use the leakage resilience properties of the Learning With Errors problem to address a key issue left open in previous work - the rate of generation of randomness. Our new protocol can certify $Ω(n)$ fresh bits of randomness in constant rounds, where $n$ is a parameter of the protocol and the total communication is $O(n)$, thus achieving a nearly optimal rate. The proof that the output is statistically random is conceptually simple and technically elementary.

Motivation & Objective

• To address the low randomness generation rate in prior certifiable randomness protocols based on single quantum devices.
• To improve the efficiency and rate of randomness generation while maintaining statistical security under the Learning With Errors (LWE) assumption.
• To eliminate reliance on Noisy Trapdoor Claw-free Functions (NTCFs) by introducing a new cryptographic primitive based on leakage resilience.
• To provide a simpler, more direct proof of correctness compared to prior protocols based on parallel repetition or complex primitives.
• To certify both the randomness and the quantum dimension of the device by ensuring it possesses roughly n qubits of quantum memory.

Proposed method

• The protocol uses a lossy matrix derived from the Learning With Errors (LWE) problem, which is computationally indistinguishable from uniform but has a large kernel, enabling multiple preimages.
• Instead of a 2-to-1 function (as in NTCFs), the protocol uses a k-to-1 function where k is exponentially large, allowing certification of log k bits of randomness per round.
• The verifier performs a two-round protocol: first, it sends a lossy matrix and a challenge vector; second, it verifies the prover’s measurement outcomes via a Hadamard-like test.
• The protocol leverages leakage resilience techniques from cryptography to ensure that any prover passing the test must have prepared a superposition over many preimages, thereby generating more randomness.
• A quantum verifier extraction protocol is used to test the prover’s state without requiring a trapdoor, enabling efficient verification of the prover’s behavior.
• The security proof reduces to the hardness of the LWE problem and uses statistical distance bounds to show that the output has high min-entropy even conditioned on the verifier’s inputs.

Experimental results

Research questions

• RQ1 Can certifiable randomness be generated at a rate approaching optimal, i.e., Ω(n) bits per O(n) communication, using only a single untrusted quantum device?
• RQ2 Can leakage-resilient LWE constructions replace NTCFs as the core primitive in quantum verification protocols?
• RQ3 Is it possible to achieve a constant-round protocol with linear communication that still guarantees high min-entropy output under the LWE assumption?
• RQ4 Can the protocol certify not only randomness but also the quantum dimension of the device, i.e., that it has at least n qubits of quantum memory?
• RQ5 Does a simpler, more direct proof of correctness become feasible when using lossy matrices instead of NTCFs?

Key findings

• The protocol generates Ω(n) bits of statistically random output in constant rounds, achieving a nearly optimal rate of randomness per communication cost.
• The output has min-entropy at least n − ℓ log q − O(1) even when conditioned on the verifier’s random questions and classical transcript.
• The protocol maintains security under the post-quantum Learning With Errors (QLWE) assumption, with error bounds quantified as ε = 5δ^{1/4} + negligible(λ).
• The proof of correctness is conceptually simple and technically elementary, relying on leakage resilience rather than complex primitives like NTCFs.
• The protocol enables certification of quantum dimension: a successful prover must possess at least n qubits of quantum memory to generate the required superposition.
• The protocol achieves the same completeness and soundness guarantees as prior work but with significantly improved efficiency and a more direct security reduction.