⚛️ quantum physics

Comparing classical and quantum conditional disclosure of secrets

This paper investigates the advantages of quantum resources in conditional disclosure of secrets (CDS) by establishing new lower bounds and demonstrating exponential separations between quantum and classical CDS complexities for specific functions, thereby clarifying the power of quantum information-theoretic cryptography.

Original authors: Uma Girish, Alex May, Leo Orshansky, Chris Waddell

Published 2026-04-01

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Uma Girish, Alex May, Leo Orshansky, Chris Waddell

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to solve a mystery with a friend, but you can't talk to each other directly. You both have clues (inputs), and you need to send a message to a referee (a judge) to reveal a secret. However, there's a catch: the referee should only be able to unlock the secret if your clues match a specific rule. If they don't match, the referee must learn absolutely nothing about the secret.

This is the world of Conditional Disclosure of Secrets (CDS). It's a fundamental game in cryptography used to protect privacy while allowing specific information to be shared when conditions are met.

This paper asks a big question: Does using "quantum magic" (entanglement and quantum states) make this game easier, faster, or more secure than using just classical physics (bits and random numbers)?

Here is a breakdown of their findings using everyday analogies.

1. The Setup: The "Secret Handshake" Game

Think of Alice and Bob as two spies.

The Goal: They want to reveal a secret code to a Referee, but only if their secret codes (inputs) satisfy a condition (like "Are our codes different?").
The Rules: They can't talk to each other during the game. They can only send one message each to the Referee.
The Classical Way: They share a random list of numbers (like a one-time pad) beforehand. They mix their inputs with this list to create their messages.
The Quantum Way: Instead of a random list, they share a pair of "entangled" particles (like a pair of magic dice that always land on matching numbers, no matter how far apart they are). They use these dice to create their messages.

2. The Big Discovery: Quantum Wins in Some Cases

The authors found that quantum resources do provide a massive advantage in specific scenarios.

The "Not-Equals" Puzzle

Imagine the game is: "Reveal the secret if our inputs are different."

Classical Difficulty: If Alice and Bob have long strings of bits (say, 1,000 bits), and they need to prove they are different without revealing how they are different, they have to send a huge amount of data. It's like trying to prove two massive libraries are different by mailing the entire contents of both libraries to the judge. The cost grows linearly with the size of the input.
Quantum Ease: Using entangled particles, Alice and Bob can perform a "quantum dance" (similar to the famous Deutsch-Jozsa algorithm). They can compress that massive amount of information into a tiny message.
The Result: For a 1,000-bit input, the classical spies need to send 1,000 bits. The quantum spies only need to send about 10 bits (logarithmic growth). It's the difference between mailing a library and mailing a single postcard.

The "Forrelation" Puzzle

This is a more complex math problem involving how two patterns relate to each other.

Classical: The best known classical method requires sending a message proportional to the input size (linear).
Quantum: The authors designed a new protocol using "non-local quantum computation" (a fancy way of saying they use quantum entanglement to do math across space without talking). They showed this can be done with a message size that grows very slowly (logarithmic).
Analogy: If the classical method is like walking every step of a 10-mile path to check the scenery, the quantum method is like taking a teleportation shortcut that only takes a few steps.

3. The "Speed Limits" (Lower Bounds)

Just because quantum is faster in some games doesn't mean it breaks the laws of physics. The authors also proved "speed limits" for how fast quantum CDS can be.

The One-Way Limit: They proved that even with quantum magic, you can't go faster than the speed of "one-way communication" in the classical world. It's like saying: "Even if you have a super-fast car (quantum), you still can't drive faster than the speed limit of the road (classical complexity) allows."
The Two-Prover Limit: They introduced a new way to measure difficulty using a "two-prover" game (like a courtroom with two witnesses). They showed that the difficulty of the quantum secret-sharing game is tied to how hard it is to fool these two witnesses. This connects quantum cryptography to deep, unsolved problems in computer science.

4. Why This Matters

This paper is important for three reasons:

It proves Quantum Advantage: It's not just theory; there are real, concrete problems where quantum cryptography is exponentially better than classical cryptography.
It helps Classical Cryptography: By studying the quantum version, they found new ways to understand the limits of the classical version. Sometimes, looking at a problem through a "quantum lens" reveals weaknesses in the "classical" logic that were previously hidden.
It connects to the Universe: The techniques used here (Non-Local Quantum Computation) are the same ones physicists use to study black holes and the structure of spacetime (AdS/CFT correspondence). Understanding how to share secrets securely in a quantum world helps us understand how the universe processes information.

Summary

Think of this paper as a comparison between a classic lock-and-key system and a quantum teleportation system.

For some locks, the quantum system is a miracle: it opens them instantly with a whisper, while the classic system requires a sledgehammer.
For other locks, the quantum system is bound by the same rules as the classic one.
The authors mapped out exactly where the magic works and where the rules of physics still apply, giving us a better map for the future of secure communication.

1. Problem Statement

The paper investigates Conditional Disclosure of Secrets (CDS), a fundamental primitive in information-theoretic cryptography. In a CDS protocol, two parties (Alice and Bob) hold inputs $x$ and $y$ and share randomness (classical) or entanglement (quantum). They send messages to a referee who also knows $x$ and $y$ . The goal is for the referee to recover a secret $s$ if and only if a Boolean function $f(x, y) = 1$ . If $f(x, y) = 0$ , the referee must learn nothing about $s$ .

While classical CDS is well-studied, Quantum CDS (CDQS) has only recently been explored, motivated by connections to non-local quantum computation (NLQC) and position-based cryptography. The central research questions are:

Do quantum resources (entanglement) provide a computational advantage over classical resources in CDS?
How do lower bounds from classical communication complexity translate to the quantum setting?
Can we establish unconditional separations between classical and quantum CDS?

2. Methodology

The authors employ a combination of techniques from quantum information theory, communication complexity, and non-local quantum computation. Key methodological approaches include:

Reduction to Communication Complexity: The authors adapt proofs from classical CDS to the quantum setting. They demonstrate that quantum CDS protocols can be simulated or bounded by classical one-way communication protocols, thereby transferring lower bounds from the classical domain.
Interactive Proofs: To establish stronger lower bounds, the authors construct reductions to two-prover, two-message, public-coin interactive proofs (specifically the $QAM[2, 2]_{cc}$ class). This involves designing a protocol where provers simulate the CDS operations to verify correctness and security.
Non-Local Quantum Computation (NLQC): For upper bounds, the paper leverages the equivalence between CDQS and f-routing (a form of NLQC). They utilize results showing that quantum circuits with low T-depth (the depth of non-Clifford $T$ gates) can be implemented non-locally with polynomial entanglement and communication costs.
Protocol Construction: The authors design specific quantum protocols using entanglement (EPR pairs) and local operations (Hadamard gates, phase gates) to solve specific promise problems (e.g., Not-Equals, Forrelation) more efficiently than classical counterparts.

3. Key Contributions and Results

A. Lower Bounds on Quantum CDS

The paper establishes rigorous lower bounds for quantum CDS, drawing analogies to classical results but with distinct quantum nuances:

One-Way Communication Lower Bound: The authors prove that the cost of quantum CDS (communication + entanglement) is lower bounded by the logarithm of the classical one-way communication complexity:
$CDQS(f) = \tilde{\Omega}(\log R_{0, A\to B}(f) + \log R_{0, B\to A}(f))$
This is significant because it shows that even with quantum resources, the complexity is constrained by classical deterministic communication limits.
Two-Prover Interactive Proof Lower Bound: They derive a lower bound in terms of $QAM[2, 2]_{cc}$ (two-prover, two-message, public-coin interactive proofs). This serves as the closest quantum analogue to the classical lower bound based on $AM_{cc}$ complexity.
$CDQS(f) = \Omega(QAM[2, 2]_{cc}(f))$

B. Separations: Classical vs. Quantum

The paper provides evidence of quantum advantages in specific settings:

Perfectly Correct CDS (Unconditional Separation):
- Problem: A promise version of the Not-Equals (NEQ) function (inputs are either identical or differ in exactly $n/2$ bits).
- Classical Lower Bound: $\Omega(n)$ communication/randomness.
- Quantum Upper Bound: $O(\log n)$ using entanglement.
- Mechanism: The quantum protocol uses a variation of the Deutsch-Jozsa algorithm to compress the $n$ -bit inputs into $\log n$ -bit strings that preserve the equality property, which are then fed into a standard classical CDS protocol. This proves an unconditional separation for perfectly correct CDS.
Robust CDS (Imperfect Correctness/Security):
- Problem: The Forrelation problem (estimating the correlation between a vector and its Hadamard transform).
- Classical Status: The best known classical algorithm requires linear communication ( $\Omega(n)$ ).
- Quantum Upper Bound: The authors construct a protocol with polylogarithmic ( $O(\log^c n)$ ) communication and entanglement.
- Mechanism: They view the Forrelation circuit as a low T-depth quantum circuit. Using the connection between low T-depth circuits and efficient non-local computation (Theorem 24), they implement the circuit non-locally. This suggests a separation even when allowing for error, though it relies on the assumption that no sub-linear classical algorithm exists for Forrelation.
Private Simultaneous Message (PSM) Separation:
- The authors improve upon previous relational separations by showing an exponential separation for a partial function (Boolean Hidden Matching) in the robust setting.
- Classical: $\Omega(\sqrt{n})$ .
- Quantum: $O(\log n)$ using entanglement and local measurements to reduce the problem to an inner product on $O(\log n)$ bits.

4. Significance and Implications

Power of Quantum Resources: The paper confirms that quantum resources (entanglement) can provide exponential advantages in CDS, particularly for perfectly correct protocols and specific promise problems like Forrelation.
Bridging Fields: The work creates a strong bridge between Information-Theoretic Cryptography, Communication Complexity, and Non-Local Quantum Computation. It demonstrates that techniques from NLQC (specifically T-depth optimization) are powerful tools for constructing cryptographic primitives.
Refining Lower Bounds: By proving that quantum CDS is bounded by classical one-way communication complexity, the authors suggest that classical lower bounds are "weak" in the sense that they apply even to quantum strategies. This implies that finding stronger lower bounds for classical CDS is a difficult problem that may require new techniques beyond current communication complexity classes.
Open Questions: The paper highlights that while quantum advantages are clear for specific functions, the general relationship between entanglement cost and communication cost in quantum CDS remains open (specifically regarding "randomness sparsification," a property known in classical CDS but unproven in the quantum case).

In summary, this work provides a comprehensive framework for comparing classical and quantum CDS, establishing both new lower bounds that constrain quantum protocols and new upper bounds that demonstrate their superior efficiency for specific cryptographic tasks.