Quantum Approximate Optimization Algorithm (QAOA) is a prospective candidate for providing quantum advantage in finding approximate solutions to optimization problems using near-term quantum devices. In this paper, the goal is to reduce the number of CNOT gates and the depth of quantum ansatz circuits for QAOA. First, we present a generalized QAOA formulation for any Hamiltonian that involves upto two-body interactions, as a graph. The circuit realization of the depthp QAOA requires 2mp CNOT gates where the graph for the Hamiltonian has n vertices and m edges. Presently, a CNOT gate is one of the primary sources of error. We propose a graphtheoretic algorithm which can eliminate n - 1 CNOTs from the QAOA ansatz while retaining functional equivalence with the original circuit. This improves upon previously proposed Depth First Search (DFS) method by restricting the increase in depth of the circuit, which was a drawback of the method, by +/- 84.8% for Erd.os-Renyi graphs. Finally, if the underlying connectivity (hardware coupling map) and the initial qubit placement for a hardware are known, then we present how to extend the greedy heuristic method in order to obtain a functionally equivalent circuit with +/- 5% fewer SWAP gates for Erd.os-Renyi graphs.

Error syndromes for heavy hexagonal code and other topological codes such as surface code have typically been decoded by using Minimum Weight Perfect Matching– (MWPM) based methods. Recent advances have shown that topological codes can be efficiently decoded by deploying machine learning (ML) techniques, in particular with neural networks. In this work, we first propose an ML-based decoder for heavy hexagonal code and establish its efficiency in terms of the values of threshold and pseudo-threshold for various noise models. We show that the proposed ML-based decoding method achieves ~ 5 × higher values of threshold than that for MWPM. Next, exploiting the property of subsystem codes, we define gauge equivalence for heavy hexagonal code, by which two distinct errors can belong to the same error class. A linear search-based method is proposed for determining the equivalent error classes. This provides a quadratic reduction in the number of error classes to be considered for both bit flip and phase flip errors and thus a further improvement of ~ 14% in the threshold over the basic ML decoder. Last, a novel technique based on rank to determine the equivalent error classes is presented, which is empirically faster than the one based on linear search.

We initiate the study of Private Certifier Intersection (PCI), which allows mutually distrusting parties to establish a trust basis for cross-validation of claims if they have one or more trust authorities (certifiers) in common.This is one of the essential requirements for verifiable presentations in Web 3.0, since it provides additional privacy without compromising on decentralization.A PCI protocol allows two or more parties holding certificates to identify a common set of certifiers while additionally validating the certificates issued by such certifiers, without leaking any information about the certifiers not in the output intersection.In this paper, we formally define the notion of multi-party PCI in the Simplified-UC framework for two different settings depending on whether certificates are required for any of the claims (called PCI-Any) or all of the claims (called PCI-All).We then design and implement two provably secure and practically efficient PCI protocols supporting validation of digital signature-based certificates: a PCI-Any protocol for ECDSAbased certificates and a PCI-All protocol for BLS-based certificates.The technical centerpiece of our proposals is the first secretsharing-based MPC framework supporting efficient computation of elliptic curve-based arithmetic operations, including elliptic curve pairings, in a black-box way.We implement this framework by building on top of the well-known MP-SPDZ library using OpenSSL and RELIC for elliptic curve operations, and use this implementation to benchmark our proposed PCI protocols in the LAN and WAN settings.In an intercontinental WAN setup with parties located in different continents, our protocols execute in less than a minute on input sets of size 40, which demonstrates the practicality of our proposed solutions.

An important task in quantum generative machine learning is to model the probability distribution of measurements of many-body quantum systems. Classical generative models, such as generative adversarial networks (GANs) and variational autoencoders (VAEs), can model the distributions of product states with high fidelity, but fail or require an exponential number of parameters to model entangled states. In this paper, we introduce a quantum-enhanced VAE (QeVAE), a generative quantum-classical hybrid model that uses quantum correlations to improve the fidelity over classical VAEs, while requiring only a linear number of parameters. We provide a closed-form expression for the output distributions of the QeVAE. We also empirically show that the QeVAE outperforms classical models on several classes of quantum states, such as 4-qubit and 8-qubit quantum circuit states, haar random states, and quantum kicked rotor states, with a more than 2x increase in fidelity for some states. Finally, we find that the trained model outperforms the classical model when executed on the IBMq Manila quantum computer. Our work paves the way for new applications of quantum generative learning algorithms and characterizing measurement distributions of high-dimensional quantum states.

A Fair Digital Exchange is defined as either all or none of the participants achieving a (predetermined) desirable outcome. This work addresses third party mediated systems for digital content where mutually unknown, and hence non-trusting, buyers, sellers and the mediator (third party) take part in an exchange protocol. We address the lack of guaranteed fairness, as defined above, in the existing platforms for this setting. We present TEDX, a decentralized solution for guaranteed three party fair exchange of digital goods with scalability and support for incremental deployment over the existing (non-fair) platforms. TEDX combines carefully crafted message exchanges with incentive schemes designed to deter malicious behavior. TEDX also leverages ideas from blockchain anchored state-channels to provide trusted execution while minimizing the operational overheads of blockchain. We present the design and a security analysis of TEDX to validate the claimed fairness properties. We also present the details of a prototype implementation of TEDX leveraging Hyperledger Fabric and performance evaluation of the same on a realistic testbed spanning five public cloud zones. Our results indicate that TEDX adds only a minimal overhead of 16% while being 46x faster than a naive blockchain solution, thereby demonstrating that TEDX is scalable.

Ethereum is one of the most valuable blockchain networks in terms of the total monetary value locked in it, and arguably been the most active network where new blockchain innovations in research and applications are demonstrated. But, this also leads to Ethereum network being susceptible to a wide variety of threats and attacks in an attempt to gain unreasonable advantage or to undermine the value of the users. Even with the state-of-art classical ML algorithms, detecting such attacks is still hard. This motivated us to build a hybrid system of quantum-classical algorithms that improves phishing detection in financial transaction networks. This paper presents a classical ensemble pipeline of classical and quantum algorithms and a detailed study benchmarking existing Quantum Machine Learning algorithms such as Quantum Support Vector Machine and Variational Quantum Classifier. With the current generation of quantum hardware available, smaller datasets are more suited to the QML models and most research restricts to hundreds of samples. However, we experimented on different data sizes and report results with a test data of 12K transaction nodes, which is to the best of the authors knowledge the largest QML experiment run so far on any real quantum hardware. The classical ensembles of quantum-classical models improved the macro F-score and phishing F-score. One key observation is QSVM constantly gives lower false positives, thereby higher precision compared with any other classical or quantum network, which is always preferred for any anomaly detection problem. This is true for QSVMs when used individually or via bagging of same models or in combination with other classical/quantum models making it the most advantageous quantum algorithm so far. The proposed ensemble framework is generic and can be applied for any classification task

A core enabler for blockchain or DLT interoperability is the ability to atomically exchange assets held by mutually untrusting owners on different ledgers. This atomic swap problem has been well-studied, with the Hash Time Locked Contract (HTLC) emerging as a canonical solution. HTLC ensures atomicity of exchange, albeit with caveats for node failure and timeliness of claims. But a bigger limitation of HTLC is that it only applies to a model consisting of two adversarial parties having sole ownership of a single asset in each ledger. Realistic extensions of the model in which assets may be jointly owned by multiple parties, all of whose consents are required for exchanges, or where multiple assets must be exchanged for one, are susceptible to collusion attacks and hence cannot be handled by HTLC. In this paper, we generalize the model of asset exchanges across DLT networks and present a taxonomy of use cases, describe the threat model, and propose MPHTLC, an augmented HTLC protocol for atomic multi-owner-and-asset exchanges. We analyze the correctness, safety, and application scope of MPHTLC. As proof-of-concept, we show how MPHTLC primitives can be implemented in networks built on Hyperledger Fabric and Corda, and how MPHTLC can be implemented in the Hyperledger Labs Weaver framework by augmenting its existing HTLC protocol.

Decentralized exchange markets leveraging blockchain have been proposed recently to provide open and equal access to traders, improve transparency and reduce systemic risk of centralized exchanges. However, they compromise on the privacy of traders with respect to their asset ownership, account balance, order details and their identity. In this paper, we present Rialto, a fully decentralized privacy-preserving exchange marketplace with support for matching trade orders, on-chain settlement and market price discovery. Rialto provides confidentiality of order rates and account balances and unlinkability between traders and their trade orders, while retaining the desirable properties of a traditional marketplace like front-running resilience and market fairness. We define formal security notions and present a security analysis of the marketplace. We perform a detailed evaluation of our solution, demonstrate that it scales well and is suitable for a large class of goods and financial instruments traded in modern exchange markets.

AbstractTraditional zero-knowledge protocols have been studied and optimized for the setting where a single prover holds the complete witness and tries to convince a verifier about a predicate on the witness, without revealing any additional information to the verifier. In this work, we study the notion of distributed-prover zero knowledge (DPZK) for arbitrary predicates where the witness is shared among multiple mutually distrusting provers and they want to convince a verifier that their shares together satisfy the predicate. We make the following contributions to the notion of distributed proof generation: (i) we propose a new MPC-style security definition to capture the adversarial settings possible for different collusion models between the provers and the verifier, (ii) we discuss new efficiency parameters for distributed proof generation such as the number of rounds of interaction and the amount of communication among the provers, and (iii) we propose a compiler that realizes distributed proof generation from the zero-knowledge protocols in the Interactive Oracle Proofs (IOP) paradigm. Our compiler can be used to obtain DPZK from arbitrary IOP protocols, but the concrete efficiency overheads are substantial in general. To this end, we contribute (iv) a new zero-knowledge IOP Graphene which can be compiled into an efficient DPZK protocol. The (D + 1)-DPZK protocol D-Graphene, with D provers and one verifier, admitsO(N1/c) proof size with a communication complexity ofO(D2·(N1−2/c+Ns)), whereNis the number of gates in the arithmetic circuit representing the predicate andNsis the number of wires that depends on inputs from two or more parties. Significantly, only the distributed proof generation in D-Graphene requires interaction among the provers. D-Graphene compares favourably with the DPZK protocols obtained from the state-of-art zero-knowledge protocols, even those not modelled as IOPs.

Interoperation between permissioned consortium blockchain networks relies on their abilities to discover and validate the identities of each others' participant organizations. These organizations may possess self-sovereign decentralized identities and verifiable credentials issued by well-known certification authorities. Two mutually untrusting networks of organizations can establish a basis for interoperation if they have one or more certification authorities in common. Yet, for privacy reasons, neither of them may want to expose a priori their entire lists of authorities, necessitating a negotiation process through which common authorities can be identified. In this paper, we analyze this negotiation problem, and propose and analyze two solution approaches, one involving active participation of the trust anchors and the other without involving them.

While a Quantum Approximate Optimization Algorithm (QAOA) is intended to provide a quantum advantage in finding approximate solutions to combinatorial optimization problems, noise in the system is a hurdle in exploiting its full potential. Several error mitigation techniques have been studied to lessen the effect of noise on this algorithm. Recently, Majumdar et al. proposed a Depth First Search (DFS) based method to reduce $n-1$ CNOT gates in the ansatz design of QAOA for finding Max-Cut in a graph G = (V, E), |V| = n. However, this method tends to increase the depth of the circuit, making it more prone to relaxation error. The depth of the circuit is proportional to the height of the DFS tree, which can be $n-1$ in the worst case. In this paper, we propose an $O(\Delta \cdot n^2)$ greedy heuristic algorithm, where $\Delta$ is the maximum degree of the graph, that finds a spanning tree of lower height, thus reducing the overall depth of the circuit while still retaining the $n-1$ reduction in the number of CNOT gates needed in the ansatz. We numerically show that this algorithm achieves nearly 10 times increase in the probability of success for each iteration of QAOA for Max-Cut. We further show that although the average depth of the circuit produced by this heuristic algorithm still grows linearly with n, our algorithm reduces the slope of the linear increase from 1 to 0.11.

Quantum Approximate Optimization Algorithm (QAOA) is studied primarily to find approximate solutions to combinatorial optimization problems. For a graph with $n$ vertices and $m$ edges, a depth $p$ QAOA for the Max-cut problem requires $2\cdot m \cdot p$ CNOT gates. CNOT is one of the primary sources of error in modern quantum computers. In this paper, we propose two hardware independent methods to reduce the number of CNOT gates in the circuit. First, we present a method based on Edge Coloring of the input graph that minimizes the the number of cycles (termed as depth of the circuit), and reduces upto $\lfloor \frac{n}{2} \rfloor$ CNOT gates. Next, we depict another method based on Depth First Search (DFS) on the input graph that reduces $n-1$ CNOT gates, but increases depth of the circuit moderately. We analytically derive the condition for which the reduction in CNOT gates overshadows this increase in depth, and the error probability of the circuit is still lowered. We show that all IBM Quantum Hardware satisfy this condition. We simulate these two methods for graphs of various sparsity with the \textit{ibmq\_manhattan} noise model, and show that the DFS based method outperforms the edge coloring based method, which in turn, outperforms the traditional QAOA circuit in terms of reduction in the number of CNOT gates, and hence the probability of error of the circuit.

Private blockchain networks are used by enterprises to manage decentralized processes without trusted mediators and without exposing their assets publicly on an open network like Ethereum. Yet external parties that cannot join such networks may have a compelling need to be informed about certain data items on their shared ledgers along with certifications of data authenticity; e.g., a mortgage bank may need to know about the sale of a mortgaged property from a network managing property deeds. These parties are willing to compensate the networks in exchange for privately sharing information with proof of authenticity and authorization for external use. We have devised a novel and cryptographically secure protocol to effect a fair exchange between rational network members and information recipients using a public blockchain and atomic swap techniques. Using our protocol, any member of a private blockchain can atomically reveal private blockchain data with proofs in exchange for a monetary reward to an external party if and only if the external party is a valid recipient. The protocol preserves confidentiality of data for the recipient, and in addition, allows it to mount a challenge if the data turns out to be inauthentic. We also formally analyze the security and privacy of this protocol, which can be used in a wide array of practical scenarios.

Functional encryption (FE) is an extremely powerful cryptographic mechanism that lets an authorized entity compute on encrypted data, and learn the results in the clear. However, all current cryptographic instantiations for general FE are too impractical to be implemented. We construct IRON, a provably secure, and practical FE system using Intel's recent Software Guard Extensions (SGX). We show that IRON can be applied to complex functionalities, and even for simple functions, outperforms the best known cryptographic schemes. We argue security by modeling FE in the context of hardware elements, and prove that IRON satisfies the security model.

Encrypted database systems provide a great method for protecting sensitive data in untrusted infrastructures. These systems are built using either special-purpose cryptographic algorithms that support operations over encrypted data, or by leveraging trusted computing co-processors. Strong cryptographic algorithms (e.g., public-key encryptions, garbled circuits) usually result in high performance overheads, while weaker algorithms (e.g., order-preserving encryption) result in large leakage profiles. On the other hand, some encrypted database systems (e.g., Cipherbase, TrustedDB) leverage non-standard trusted computing devices, and are designed to work around the architectural limitations of the specific devices used. In this work we build StealthDB - an encrypted database system from Intel SGX. Our system can run on any newer generation Intel CPU. StealthDB has a very small trusted computing base, scales to large transactional workloads, requires minor DBMS changes, and provides a relatively strong security guarantees at steady state and during query execution. Our prototype on top of Postgres supports the full TPC-C benchmark with a 30% decrease in the average throughput over an unmodified version of Postgres operating on a 2GB unencrypted dataset.

In an Attribute-Based Encryption (ABE) scheme the ciphertext encrypting a message μ , is associated with a public attribute vector 𝐱 and a secret key 𝗌𝗄_P is associated with a predicate P. The decryption returns μ if and only if P(𝐱) = 1 . ABE provides efficient and simple mechanism for data sharing supporting fine-grained access control. Moreover, it is used as a critical component in constructions of succinct functional encryption, reusable garbled circuits, token-based obfuscation and more. In this work, we describe a new efficient ABE scheme for a family of branching programs with short secret keys and from a mild assumption. In particular, in our construction the size of the secret key for a branching program P is |P| + poly(λ ) , where λ is the security parameter. Our construction is secure assuming the standard Learning With Errors (LWE) problem with approximation factors n^ω (1) . Previous constructions relied on n^O(log n) approximation factors of LWE (resulting in less efficient parameters instantiation) or had large secret keys of size |P| ×poly(λ ) . We rely on techniques developed by Boneh et al. (EUROCRYPT’14) and Brakerski et al. (ITCS’14) in the context of ABE for circuits and fully-homomorphic encryption.

The candidate construction of multilinear maps by Garg, Gentry, and Halevi (Eurocrypt 2013) has lead to an explosion of new cryptographic constructions ranging from attribute-based encryption (ABE) for arbitrary polynomial size circuits, to program obfuscation, and to constrained pseudorandom functions (PRFs). Many of these constructions require κ-linear maps for large κ. In this work, we focus on the reduction of κ in certain constructions of access control primitives that are based on κ-linear maps; in particular, we consider the case of constrained PRFs and ABE. We construct the following objects: • A constrained PRF for arbitrary circuit predicates based on (n + `OR − 1)−linear maps (where n is the input length and `OR denotes the OR-depth of the circuit). • For circuits with a specific structure, we also show how to construct such PRFs based on (n + `AND − 1)−linear maps (where `AND denotes the AND-depth of the circuit). We then give a black-box construction of a constrained PRF for NC predicates, from any bit-fixing constrained PRF that fixes only one of the input bits to 1; we only require that the bit-fixing PRF have certain key homomorphic properties. This construction is of independent interest as it sheds light on the hardness of constructing constrained PRFs even for “simple” predicates such as bit-fixing predicates. Instantiating this construction with the bit-fixing constrained PRF from Boneh and Waters (Asiacrypt 2013) gives us a constrained PRF for NC predicates that is based only on n-linear maps, with no dependence on the predicate. In contrast, the previous constructions of constrained PRFs (Boneh and Waters, Asiacrypt 2013) required (n + ` + 1)−linear maps for circuit predicates (where ` is the total depth of the circuit) and n-linear maps even for bit-fixing predicates. We also show how to extend our techniques to obtain a similar improvement in the case of ABE and construct ABE for arbitrary circuits based on (`OR + 1)−linear (respectively (`AND + 1)−linear) maps.

Functional encryption (FE) is an emerging paradigm for public-key cryptography that enables fine-grained access control over encrypted data. In FE, each function (program) P is associated with a secret key skP . User holding skP and a ciphertext ct encrypting a message msg, can learn P (msg) in clear, but nothing else about the message is revealed. Unfortunately, all the existing constructions are either very restrictive in the supported classes of functions, or rely on non-standard mathematical assumptions and satisfy weaker security notions such as indistinguishabilitybased security, or far from satisfying practical efficiency for general function families. In this work, we present a construction of functional encryption in a hardware assisted model of computation. We prove the security of our construction under the simulation-based definition. We present an implementation of our construction and show essential evaluation results, which demonstrate that our construction is very practical. In our evaluation, key-generation, encryption and decryption take around 1, 22 and 140 milliseconds for linear regression programs over 4 million sample points. Our construction is motivated by the recent advances in processors that enable creation of encrypted memory containers.

The candidate construction of multilinear maps by Garg, Gentry, and Halevi (Eurocrypt 2013) has lead to an explosion of new cryptographic constructions ranging from attribute-based encryption (ABE) for arbitrary polynomial size circuits, to program obfuscation, and to constrained pseudorandom functions (PRFs). Many of these constructions require κ -linear maps for large κ . In this work, we focus on the reduction of κ in certain constructions of access control primitives that are based on κ -linear maps; in particular, we consider the case of constrained PRFs and ABE. We construct the following objects: We then give a black-box construction of a constrained PRF for 𝐍𝐂^1 predicates, from any bit-fixing constrained PRF that fixes only one of the input bits to 1; we only require that the bit-fixing PRF have certain key homomorphic properties. This construction is of independent interest as it sheds light on the hardness of constructing constrained PRFs even for “simple” predicates such as bit-fixing predicates. Instantiating this construction with the bit-fixing constrained PRF from Boneh and Waters (Asiacrypt 2013) gives us a constrained PRF for 𝐍𝐂^1 predicates that is based only on n-linear maps, with no dependence on the predicate. In contrast, the previous constructions of constrained PRFs (Boneh and Waters, Asiacrypt 2013) required (n+ℓ +1)- linear maps for circuit predicates (where ℓ is the total depth of the circuit) and n-linear maps even for bit-fixing predicates. We also show how to extend our techniques to obtain a similar improvement in the case of ABE and construct ABE for arbitrary circuits based on (ℓ _𝖮𝖱+1)- linear (respectively (ℓ _𝖠𝖭𝖣+1)- linear) maps.

The candidate construction of multilinear maps by Garg, Gentry, and Halevi (Eurocrypt 2013) has lead to an explosion of new cryptographic constructions ranging from attribute-based encryption (ABE) for arbitrary polynomial size circuits, to program obfuscation, and to constrained pseudorandom functions (PRFs). Many of these constructions require κ-linear maps for large κ. In this work, we focus on the reduction of κ in certain constructions of access control primitives that are based on κ-linear maps; in particular, we consider the case of constrained PRFs and ABE. We construct the following objects: A constrained PRF for arbitrary circuit predicates based on (n+ `OR − 1)−linear maps (where n is the input length and `OR denotes the OR-depth of the circuit). For circuits with a specific structure, we also show how to construct such PRFs based on (n+ `AND− 1)−linear maps (where `AND denotes the AND-depth of the circuit). We then give a black-box construction of a constrained PRF for NC predicates, from any bit-fixing constrained PRF that fixes only one of the input bits to 1; we only require that the bit-fixing PRF have certain key homomorphic properties. This gives us a constrained PRF for NC predicates that is based only on n-linear maps, with no dependence on the predicate. In contrast, the previous constructions of constrained PRFs (Boneh and Waters, Asiacrypt 2013) required (n+ `+ 1)−linear maps for circuit predicates (where ` is the total depth of the circuit) and n-linear maps even for bit-fixing predicates. We also show how to extend our techniques to obtain a similar improvement in the case of ABE and construct ABE for arbitrary circuits based on (`OR + 1)−linear (respectively (`AND + 1)−linear) maps.