Keita Xagawa

The MPC-in-the-Head paradigm is a promising approach for constructing post-quantum signatures, and its variants VOLE-in-the-Head (VOLEitH) and TC-in-the-Head (TCitH) are adopted in some NIST PQC candidates. Recent works by Aguilar-Melchor et al. (ASIACRYPT 2023), Hülsing et al. (CRYPTO 2024), and Baum et al. (CRYPTO 2025) establish EUF-CMA security for MPCitH/VOLEitH in the quantum random oracle model (QROM), but these proofs either ignore crucial optimizations such as rejection sampling and grinding or rely on round-by-round soundness and key-generation lossiness. Due to these restrictions, they do not directly apply to TCitH signatures such as Mirath, RYDE, or MQOM. This paper addresses this gap by analyzing the QROM security of TCitH signatures that incorporate the crucial optimizations. Our treatment of rejection sampling and grinding applies more generally to MPCitH signatures, while our complete security proofs are instantiated for the TCitH signatures Mirath and RYDE. Our contributions are twofold: 1) We provide a new (strong) EUF-CMA security proof that accommodates rejection sampling and grinding. 2) We identify a gap in the EUF-CMA proof of MQOM and show that this issue extends to some schemes, including SBC (Huth and Joux, CRYPTO 2024) and rBN++ (Kim, Lee, and Son, EUROCRYPT 2025).

In quantum cryptography, there could be a new world, Microcrypt, where cryptography is possible but one-way functions (OWFs) do not exist. Many quantum analogues of OWFs and pseudorandom generators (PRGs) that are potentially weaker than OWFs have been introduced, and their useful applications have been demonstrated. However, Microcrypt still lacks enough foundations on which they are based compared with the classical cryptographic world. In classical cryptography, many hardness assumptions on concrete mathematical problems have been introduced, such as the discrete logarithm (DL) problems or the decisional Diffie-Hellman (DDH) problems on concrete group structures related to finite fields or elliptic curves. They are then abstracted to generic hardness assumptions such as the DL and DDH assumptions over group actions. Finally, based on these generic assumptions, primitives and applications are constructed. The goal of the present paper is to introduce several abstracted generic hardness assumptions in Microcrypt, which could connect concrete mathematical hardness assumptions with applications. Our assumptions are based on a quantum analogue of group actions. A group action is a tuple ( G , S , ⋆ ) of a group G , a set S , and an operation ⋆ : G × S → S . We introduce a quantum analogue of group actions, which we call quantum group actions (QGAs), where G is a subgroup of unitary operators, S is a set of states, and ⋆ is the application of a unitary on a state. By endowing QGAs with some reasonable hardness assumptions, we introduce a natural quantum analogue of the decisional Diffie-Hellman (DDH) assumption and pseudorandom group actions. As an application, we construct classical-query pseudorandom function-like state generators (PRFSGs) based on these assumptions. PRFSGs are a quantum analogue of pseudorandom functions (PRFs), and have many applications such as IND-CPA SKE, EUF-CMA MAC, and private-key quantum money schemes. We also show that those assumptions are implied by non-adaptive pseudorandom unitaries (PRUs). Because classical group actions are instantiated with many concrete mathematical hardness assumptions, our QGAs could also have concrete (even OWFs-free) instantiations. We provide some candidate instantiations based on random circuits and IQP circuits.

One of the central questions in cryptology is how efficient generic constructions of cryptographic primitives can be. Gennaro, Gertner, Katz, and Trevisan [SIAM J. of Compt., 2005] studied the lower bounds of the number of invocations of a (trapdoor) one-way permutation in order to construct cryptographic schemes, e.g., pseudorandom number generators, digital signatures, and public-key and symmetric-key encryption. Recently, quantum machines have been explored to _construct_ cryptographic primitives other than quantum key distribution. This paper studies the efficiency of _quantum_ black-box constructions of cryptographic primitives when the communications are _classical_. Following Gennaro et al., we give the lower bounds of the number of invocations of an underlying quantumly-computable quantum-one-way permutation when the _quantum_ construction of pseudorandom number generator and symmetric-key encryption is weakly black-box. Our results show that the quantum black-box constructions of pseudorandom number generator and symmetric-key encryption do not improve the number of invocations of an underlying quantumly-computable quantum-one-way permutation.