Enteractive is the industry leader in Reactivation, driving innovation through our tech, powered by personal human interaction. As the pioneers behind the (Re)Activation Cloud®, we are experts in personal contact. We partner with operators to increase retention and player loyalty, by engaging with players on a 1-on-1 conversation. Our latest product is the player-facing mobile-first Engager platform, allowing players to manage how they communicate with us through both live chat and one-to-one phone calls. This adds another layer of personalisation for players which is key to retention. Our (Re)Activation services use the latest innovative technologies to keep your player data safe, highly-secured and compliant with modern regulation including GDPR & G4 Responsible Gaming. We’re about building bridges between operators and their players. By learning more about them we help you create a win-win situation where players are happier and your company is more profitable. Subscribe to Enteractive Insights for monthly industry & company updates: https://pages.enteractive.com/newslettersignup

Enteractive

enteractive

Welcome! Happy to see you in the seventh part of my Vuejs Amsterdam Conference 2022 summary series, in which I share a summary of all the talks with you. You can read my JSWorld Conference 2022 Summary series (in four parts) , where I summarized all the first day’s talks. You can also find the previous Talks of the Vue Amsterdam conference 2022 in my blog. here (Recurring) Introduction After two and a half years, JSWorld and Vue Amsterdam Conference were back in Theater Amsterdam between 1 and 3 June, and I had the chance to attend this conference for the first time. I learned many things, met many wonderful people, spoke with great developers, and had a great time. On the first day the JSWorld Conference was held, and on the second and third days, the Vue Amsterdam. The conference was full of information with great speakers, each of whom taught me something valuable. They all wanted to share their knowledge and information with other developers. So I thought it would be great if I could continue to share it and help others use it. At first, I tried to share a few notes or slides, but I felt it was not good enough, at least not as good as what the speaker shared with me. So I decided to re-watch each speech, dive deeper into them, search, take notes and combine them with their slides and even their exact words in their speech and then share it with you so that what I share with you is at least at the same level as what I learned from them. A Very Important Point and I have only tried to learn them so that I can turn them into these articles. Even This means if you learn something new, it is because of their efforts. Everything you read during these few articles is the result of the effort and time of the speaker itself, many of the sentences written in these articles are exactly what they said or what they wrote in Slides. Last but not least, I may not dig into every technical detail or live codings in some of the speeches. But if you are interested and need more information, let me know and I’ll try to write a more detailed article separately. Also, don’t forget to check out their Twitter/Linkedin. you can find the program of the conference. Here Animating with Vue - Frontend Developer at SAP Ramona Biscoveanu Sometimes our applications need a little bit of "wow" and we can do this with some "movement" just the perfect amount to make them more alive. We will be looking at how to use the Vue magic to create awesome animations, from simple ones to more complex ones, combining Vue with animation libraries. 90s Websites On 90s websites, there were sometimes a lot of motions and colors. But the only way we could have animations back then was with gifs. Just imagine the bandwidth those gifs consumed in the era of Dial-Up internet! So we end up with some tiny low-frame gifs to limit the bandwidth consumption, and this was the result: Why Animate? One of the reasons we use animations these days, even back then, is to capture users' attention and focus. Think of how many distractions we have, notifications on our phones, pop-ups on the websites, or the jumping icons on the dock on macOS. We can also trick users into thinking that our website is a lot faster. We give them this perception that our APIs are faster by putting loaders and progress bars. Studies are saying if you have a custom loader you have a chance of keeping the people on our website longer. Sometimes we try to inform our users efficiently. Maybe we have lots of things going on on our website and we want to tell the user what is the next step in the flow of the application with an animated button. Other times we need interactive content for marketing materials to keep users there. Animations are also powerful when you try to tell a story. Vue <Transition /> In Vanilla JavaScript or jQuery, you need to manually calculate the timings and delays, and decide when to add or remove classes. But in Vue, we wrap the target element into the component and it does many of those hard things automatically. Here is a simple fade animation: <Transition /> <transition name="fade">
  <p v-if="show">hello</p>
</transition> .fade-enter-active, .fade-leave-active {
  transition: opacity .5s;
}
.fade-enter-from, .fade-leave-to 
  opacity: 0;
} This is how Vue handles that: Vue <TransitionGroup /> is a built-in component designed for animating the insertion, removal, and order change of elements or components that are rendered in a list. <TransitionGroup> This is a simple example of some tiles sliding on the screen: <transition-group tag="div" class="tile-section" name="list" appear>
  <TileComp
    v-for="(tile, i) in tiles"
    :key="i + 'tile'"
    :header="tile.title"
    :content="tile.content"
    :footer="tile.footer"
  ></TileComp>
</transition-group> .list-enter-active,
.list-leave-active {
  transition: all 1s ease;
}
.list-enter-from,
.list-leave-to {
  opacity: 0;
  transform: translateY(70px);
} JavaScript Hooks CSS is awesome and we can do a lot with it, but sometimes it’s not enough. Vue provides some hooks on the component. <Transition /> <Transition
  @before-enter="onBeforeEnter"
  @enter="onEnter"
  @after-enter="onAfterEnter"
  @enter-cancelled="onEnterCancelled"
  @before-leave="onBeforeLeave"
  @leave="onLeave"
  @after-leave="onAfterLeave"
  @leave-cancelled="onLeaveCancelled"
>
  
</Transition> GreenSock GSAP The GreenSock Animation Platform ( for short) is a powerful JavaScript library that enables front-end developers and designers to create robust timeline-based animations. GSAP One of the most important things you will hear a lot in GSAP is Tween. A Tween is what does all the animation work — think of it like a high-performance property setter. You feed in targets (the objects you want to animate), a duration, and any properties you want to animate and when its playhead moves to a new position, it figures out what the property values should be at that point and applies them accordingly. Common methods for creating a Tween (all of these methods return a Tween instance): gsap.to() gsap.from() gsap.fromTo() For simple animations (no fancy sequencing), the methods above are all you need! gsap.to(".selector", {toVars});
gsap.from(".selector", {fromVars});
gsap.fromTo(".selector", {fromVars}, {toVars});
// special properties (duration, ease, etc.) go in toVar Now let’s add GSAP to our tiles example: <div class="tile-section">
  <TileComp
    v-for="(tile, i) in tiles"
    :key="i + 'tile'"
    :header="tile.title"
    :content="tile.content"
    :footer="tile.footer"
  ></TileComp>
</div> import gsap from "gsap";
...
mounted() {
  gsap.from(".tile", {
    duration: 0.5,
    opacity: 0,
    scale: 0,
    y: 200,
    ease: "power2",
    stagger: 0.1,
  });
}, Vue Animation Counter Another simple example of using GSAP to make nice animations can be a celebrate counter animation. Here you can see what it will look like: All we have in the template is just an h1 element where we pass the formatted value and a reset button. <div>
  <h1 ref="celebrate" class="counter" :class="{ celebrate: isCelebrate }">
    {{ this.numberWithCommas(value) }}
  </h1>
  <button class="restart" @click="restart">Restart</button>
</div> We need to use function of GSAP. Think of it as a tool to sequence your animations. timeline import gsap from "gsap";
import confetti from "canvas-confetti";
const tl = gsap.timeline();
const start = 100000;
const end = 3240074;

export default {
  props: {
    msg: String,
  },
  data() {
    return {
      isCelebrate: false,
      value: start,
    };
  },
  mounted() {
    tl.fromTo(
      ".counter",
      {
        innerText: start,
        scale: 0.8,
      },
      {
        innerText: end,
        snap: { innerText: 1 },
        duration: 4,
        ease: "linear",
        onUpdate: () => {
          this.$refs.celebrate.innerText = this.numberWithCommas(
            this.$refs.celebrate.innerText
          );
        },
        onComplete: () => {
          this.celebrate();
        },
      }
    );
  },
  methods: {
    celebrate() {
      this.isCelebrate = true;
      confetti({
        particleCount: 150,
        spread: 100,
        origin: { y: 0.6 },
        colors: ["#647eff", "#42d392"],
        disableForReducedMotion: true,
      });
    },
    numberWithCommas(x) {
      return x.toString().replace(/\B(?=(\d{3})+(?!\d))/g, ",");
    },
    restart() {
      tl.restart();
      this.isCelebrate = false;
    },
  },
}; Page Transition In Vue Router 4 the syntax for transitioning pages has changed a bit. We don’t wrap the router into the transition component anymore. instead, we use the : v-slot <router-view v-slot="{ Component }">
  <transition name="fade">
    <component :is="Component" />
  </transition>
</router-view> Here is an example of a page transition: For building this page transition, we need the enter hook: <router-view v-slot="{ Component }">
  <transition
    :key="$route.path"
    @enter="onEnter"
    :css="false"
  >
    <component :is="Component" />
  </transition>
</router-view> Then we need to register the plugin from GSAP: SplitText import gsap from "gsap";
import SplitText from "gsap/SplitText";

gsap.registerPlugin(SplitText);

gsap.defaults({
  duration: 1,
  ease: "power3.inOut",
}); And then using the plugin we split the text to be able to animate it: mySplitText(el) {
  return new SplitText(el, { type: "words,chars,lines" });
}, Let’s take a look at hook: onEnter onEnter(el, done) {
  const masterTL = gsap.timeline({
    onComplete: () => {
      done;
    },
  });

  masterTL.add(
    this.enterContentTextAnimation(
      mySplitText(".content-text-header").chars
    )
  );
  masterTL.add(
    this.enterContentTextAnimation(".content-text-body"),
    "-=0.9" //overlap with previous by 0.9s
  );
  masterTL.add(this.imgScaleOut(".content img"), "<");
	//The start of previous animation
}, And here you can see how you can nest GSAP timelines and what and functions do: enterContentTextAnimation imgScaleOut enterContentTextAnimation(id) {
  const tl = gsap.timeline();

  tl.fromTo(
    id,
    {
      yPercent: "100",
      opacity: 0,
    },
    {
      yPercent: "0",
      opacity: 1,
      stagger: 0.03,
    }
  );
},

imgScaleOut(id) {
  const tl = gsap.timeline();

  tl.from(id, {
    scale: 1.5,
  });

  return tl;
}, SVG Animated charts can be a good example of SVG animation: Here is the part of the code that makes this chart animation possible: watch: {
  data(newValue, oldValue) {
    newValue.map((data, index) => {
      var id = "#arc" + index;
      var d = this.calculateArc(data, index);
      var oldValueD = this.calculateArc(oldValue[index]);
      const tl = gsap.timeline();

      tl.fromTo(
        id,
        {
          attr: { d: oldValueD },
        },
        {
          duration: 0.5,
          attr: { d: d },
          yoyo: true,
        }
      );
    });
  },
}, It’s important to not abuse animations on your website. Sometimes they are useful, but sometimes they can kill your audience. End of The Seventh Talk I hope you enjoyed this part and it can be as valuable to you as it was to me. Over the next few days, I’ll share the rest of the talks with you. Stay tuned…

Vue Amsterdam 2022: Part VII - Animating with Vue

Vue Amsterdam 2022: Parte VII - Animación con Vue

Vue Amsterdam 2022 : Partie VII - Animer avec Vue

Vue एम्स्टर्डम 2022: भाग VII - Vue . के साथ एनिमेट करना

Vue アムステルダム 2022: パート VII - Vue によるアニメーション化

Vue Amsterdam 2022: Parte VII - Animando com Vue

Vue Amsterdam 2022: Phần VII - Hoạt hình với Vue

Vue Amsterdam 2022：第七部分 - 使用 Vue 制作动画

This paper is available on arxiv under CC 4.0 license. Authors: (1) Ruta Jawale; (2) Dakshita Khurana. Table of Links Abstract and Introduction Technical Overview Preliminaries Unclonable Non-Interactive Zero-Knowledge in the CRS Model Unclonable NIZK in the Quantum Ramdon Oracle Model Unclonable Signatures of Knowledge References References [Aar09] Scott Aaronson. Quantum copy-protection and quantum money. In Proceedings of the 24th Annual IEEE Conference on Computational Complexity, CCC 2009, Paris, France, 15-18 July 2009, pages 229–242. IEEE Computer Society, 2009. [AC13] Scott Aaronson and Paul F. Christiano. Quantum money from hidden subspaces. Theory Comput., 9:349–401, 2013. [AGKZ20] Ryan Amos, Marios Georgiou, Aggelos Kiayias, and Mark Zhandry. One-shot signatures and applications to hybrid quantum/classical authentication. In Konstantin Makarychev, Yury Makarychev, Madhur Tulsiani, Gautam Kamath, and Julia Chuzhoy, editors, Proccedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, STOC 2020, Chicago, IL, USA, June 22-26, 2020, pages 255–268. ACM, 2020. [AK21] Prabhanjan Ananth and Fatih Kaleoglu. Unclonable encryption, revisited. In Kobbi Nissim and Brent Waters, editors, Theory of Cryptography - 19th International Conference, TCC 2021, Raleigh, NC, USA, November 8-11, 2021, Proceedings, Part I, volume 13042 of Lecture Notes in Computer Science, pages 299–329. Springer, 2021. [AKL+22] Prabhanjan Ananth, Fatih Kaleoglu, Xingjian Li, Qipeng Liu, and Mark Zhandry. On the feasibility of unclonable encryption, and more. In Yevgeniy Dodis and Thomas Shrimpton, editors, Advances in Cryptology - CRYPTO 2022 - 42nd Annual International Cryptology Conference, CRYPTO 2022, Santa Barbara, CA, USA, August 15-18, 2022, Proceedings, Part II, volume 13508 of Lecture Notes in Computer Science, pages 212–241. Springer, 2022. [ALL+21] Scott Aaronson, Jiahui Liu, Qipeng Liu, Mark Zhandry, and Ruizhe Zhang. New approaches for quantum copy-protection. In Tal Malkin and Chris Peikert, editors, Advances in Cryptology - CRYPTO 2021 - 41st Annual International Cryptology Conference, CRYPTO 2021, Virtual Event, August 16-20, 2021, Proceedings, Part I, volume 12825 of Lecture Notes in Computer Science, pages 526–555. Springer, 2021. [AN11] Tolga Acar and Lan Nguyen. Revocation for delegatable anonymous credentials. In Dario Catalano, Nelly Fazio, Rosario Gennaro, and Antonio Nicolosi, editors, Public Key Cryptography - PKC 2011 - 14th International Conference on Practice and Theory in Public Key Cryptography, Taormina, Italy, March 6-9, 2011. Proceedings, volume 6571 of Lecture Notes in Computer Science, pages 423–440. Springer, 2011. [AP21] Prabhanjan Ananth and Rolando L. La Placa. Secure software leasing. In Anne Canteaut and Franc¸ois-Xavier Standaert, editors, Advances in Cryptology - EUROCRYPT 2021 - 40th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, October 17-21, 2021, Proceedings, Part II, volume 12697 of Lecture Notes in Computer Science, pages 501–530. Springer, 2021. [BCC+09] Mira Belenkiy, Jan Camenisch, Melissa Chase, Markulf Kohlweiss, Anna Lysyanskaya, and Hovav Shacham. Randomizable proofs and delegatable anonymous credentials. In Shai Halevi, editor, Advances in Cryptology - CRYPTO 2009, 29th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 16-20, 2009. Proceedings, volume 5677 of Lecture Notes in Computer Science, pages 108–125. Springer, 2009. [BGG+23] James Bartusek, Sanjam Garg, Vipul Goyal, Dakshita Khurana, Giulio Malavolta, Justin Raizes, and Bhaskar Roberts. Obfuscation and outsourced computation with certified deletion. Cryptology ePrint Archive, Paper 2023/265, 2023. [BI20] Anne Broadbent and Rabib Islam. Quantum encryption with certified deletion. In Rafael Pass and Krzysztof Pietrzak, editors, Theory of Cryptography, pages 92–122, Cham, 2020. Springer International Publishing. [BK23] James Bartusek and Dakshita Khurana. Cryptography with certified deletion. In Crypto 2023 (to appear), 2023. [BKP23] James Bartusek, Dakshita Khurana, and Alexander Poremba. Publicly-verifiable deletion via target-collapsing functions. In Crypto 2023 (to appear), 2023. [BL20] Anne Broadbent and S´ebastien Lord. Uncloneable quantum encryption via oracles. In Steven T. Flammia, editor, 15th Conference on the Theory of Quantum Computation, Communication and Cryptography, TQC 2020, June 9-12, 2020, Riga, Latvia, volume 158 of LIPIcs, pages 4:1–4:22. Schloss Dagstuhl - Leibniz-Zentrum f ¨ur Informatik, 2020. [BS16] Shalev Ben-David and Or Sattath. Quantum tokens for digital signatures. CoRR, abs/1609.09047, 2016. [BS17] Shalev Ben-David and Or Sattath. Quantum tokens for digital signatures. IACR Cryptol. ePrint Arch., page 94, 2017. [BS23a] Mohammed Barhoush and Louis Salvail. How to sign quantum messages, 2023. [BS23b] Mohammed Barhoush and Louis Salvail. Powerful primitives in the bounded quantum storage model, 2023. [CKS10] Jan Camenisch, Markulf Kohlweiss, and Claudio Soriente. Solving revocation with efficient update of anonymous credentials. In Juan A. Garay and Roberto De Prisco, editors, Security and Cryptography for Networks, 7th International Conference, SCN 2010, Amalfi, Italy, September 13-15, 2010. Proceedings, volume 6280 of Lecture Notes in Computer Science, pages 454–471. Springer, 2010. [CL06] Melissa Chase and Anna Lysyanskaya. On signatures of knowledge. In Cynthia Dwork, editor, Advances in Cryptology - CRYPTO 2006, 26th Annual International Cryptology Conference, Santa Barbara, California, USA, August 20-24, 2006, Proceedings, volume 4117 of Lecture Notes in Computer Science, pages 78–96. Springer, 2006. [CLLZ21] Andrea Coladangelo, Jiahui Liu, Qipeng Liu, and Mark Zhandry. Hidden cosets and applications to unclonable cryptography. In Tal Malkin and Chris Peikert, editors, Advances in Cryptology - CRYPTO 2021 - 41st Annual International Cryptology Conference, CRYPTO 2021, Virtual Event, August 16-20, 2021, Proceedings, Part I, volume 12825 of Lecture Notes in Computer Science, pages 556–584. Springer, 2021. [CW19] Xavier Coiteux-Roy and Stefan Wolf. Proving erasure. In IEEE International Symposium on Information Theory, ISIT 2019, Paris, France, July 7-12, 2019, pages 832–836, 2019. [FGH+12] Edward Farhi, David Gosset, Avinatan Hassidim, Andrew Lutomirski, and Peter W. Shor. Quantum money from knots. In Shafi Goldwasser, editor, Innovations in Theoretical Computer Science 2012, Cambridge, MA, USA, January 8-10, 2012, pages 276–289. ACM, 2012. [FLS90] Uriel Feige, Dror Lapidot, and Adi Shamir. Multiple non-interactive zero knowledge proofs based on a single random string (extended abstract). In 31st Annual Symposium on Foundations of Computer Science, St. Louis, Missouri, USA, October 22-24, 1990, Volume I, pages 308–317. IEEE Computer Society, 1990. [FM18] Honghao Fu and Carl A. Miller. Local randomness: Examples and application. Phys. Rev. A, 97:032324, Mar 2018. [GMR89] Shafi Goldwasser, Silvio Micali, and Charles Rackoff. The knowledge complexity of interactive proof systems. SIAM J. Comput., 18(1):186–208, 1989. [Got03] Daniel Gottesman. Uncloneable encryption. Quantum Inf. Comput., 3(6):581–602, 2003. [GZ20] Marios Georgiou and Mark Zhandry. Unclonable decryption keys. IACR Cryptol. ePrint Arch., page 877, 2020. [HMNY21] Taiga Hiroka, Tomoyuki Morimae, Ryo Nishimaki, and Takashi Yamakawa. Quantum encryption with certified deletion, revisited: Public key, attribute-based, and classical communication. In Mehdi Tibouchi and Huaxiong Wang, editors, Advances in Cryptology – ASIACRYPT 2021, pages 606–636, Cham, 2021. Springer International Publishing. [HMNY22] Taiga Hiroka, Tomoyuki Morimae, Ryo Nishimaki, and Takashi Yamakawa. Certified everlasting zero-knowledge proof for QMA. CRYPTO, 2022. https://ia.cr/2021/1315. [IBM23] IBM. Cost of a data breach report 2023. Technical report, IBM, 2023. [Kan18] Daniel M. Kane. Quantum money from modular forms. CoRR, abs/1809.05925, 2018. [KN23] Fuyuki Kitagawa and Ryo Nishimaki. One-out-of-many unclonable cryptography: Definitions, constructions, and more. IACR Cryptol. ePrint Arch., page 229, 2023. [KT20] Srijita Kundu and Ernest Y. Z. Tan. Composably secure device-independent encryption with certified deletion, 2020. [LS19] Alex Lombardi and Luke Schaeffer. A note on key agreement and noninteractive commitments. Cryptology ePrint Archive, Paper 2019/279, 2019. https://eprint.iacr.org/2019/279. [LZ19] Qipeng Liu and Mark Zhandry. Revisiting post-quantum fiat-shamir. In Alexandra Boldyreva and Daniele Micciancio, editors, Advances in Cryptology - CRYPTO 2019 - 39th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 18-22, 2019, Proceedings, Part II, volume 11693 of Lecture Notes in Computer Science, pages 326–355. Springer, 2019. [MST21] Christian Majenz, Christian Schaffner, and Mehrdad Tahmasbi. Limitations on uncloneable encryption and simultaneous one-way-to-hiding. IACR Cryptol. ePrint Arch., page 408, 2021. [Por22] Alexander Poremba. Quantum proofs of deletion for learning with errors. Cryptology ePrint Archive, Report 2022/295, 2022. https://ia.cr/2022/295. [PS19] Chris Peikert and Sina Shiehian. Noninteractive zero knowledge for NP from (plain) learning with errors. In Alexandra Boldyreva and Daniele Micciancio, editors, Advances in Cryptology - CRYPTO 2019 - 39th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 18-22, 2019, Proceedings, Part I, volume 11692 of Lecture Notes in Computer Science, pages 89–114. Springer, 2019. [Sah99] Amit Sahai. Non-malleable non-interactive zero knowledge and adaptive chosenciphertext security. In 40th Annual Symposium on Foundations of Computer Science, FOCS ’99, 17-18 October, 1999, New York, NY, USA, pages 543–553. IEEE Computer Society, 1999. [SCO+01] Alfredo De Santis, Giovanni Di Crescenzo, Rafail Ostrovsky, Giuseppe Persiano, and Amit Sahai. Robust non-interactive zero knowledge. In Joe Kilian, editor, Advances in Cryptology - CRYPTO 2001, 21st Annual International Cryptology Conference, Santa Barbara, California, USA, August 19-23, 2001, Proceedings, volume 2139 of Lecture Notes in Computer Science, pages 566–598. Springer, 2001. [SCP00] Alfredo De Santis, Giovanni Di Crescenzo, and Giuseppe Persiano. Necessary and sufficient assumptions for non-iterative zero-knowledge proofs of knowledge for all NP relations. In Ugo Montanari, Jos´e D. P. Rolim, and Emo Welzl, editors, Automata, Languages and Programming, 27th International Colloquium, ICALP 2000, Geneva, Switzerland, July 9-15, 2000, Proceedings, volume 1853 of Lecture Notes in Computer Science, pages 451–462. Springer, 2000. [SP92] Alfredo De Santis and Giuseppe Persiano. Zero-knowledge proofs of knowledge without interaction (extended abstract). In 33rd Annual Symposium on Foundations of Computer Science, Pittsburgh, Pennsylvania, USA, 24-27 October 1992, pages 427–436. IEEE Computer Society, 1992. [Unr14] Dominique Unruh. Revocable quantum timed-release encryption. In Phong Q. Nguyen and Elisabeth Oswald, editors, Advances in Cryptology - EUROCRYPT 2014 - 33rd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Copenhagen, Denmark, May 11-15, 2014. Proceedings, volume 8441 of Lecture Notes in Computer Science, pages 129–146. Springer, 2014. [Unr17] Dominique Unruh. Post-quantum security of fiat-shamir. In Tsuyoshi Takagi and Thomas Peyrin, editors, Advances in Cryptology - ASIACRYPT 2017 - 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I, volume 10624 of Lecture Notes in Computer Science, pages 65–95. Springer, 2017. [Wie83] Stephen Wiesner. Conjugate coding. SIGACT News, 15(1):78–88, 1983. [Zha19a] Mark Zhandry. How to record quantum queries, and applications to quantum indifferentiability. In Alexandra Boldyreva and Daniele Micciancio, editors, Advances in Cryptology - CRYPTO 2019 - 39th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 18-22, 2019, Proceedings, Part II, volume 11693 of Lecture Notes in Computer Science, pages 239–268. Springer, 2019. [Zha19b] Mark Zhandry. Quantum lightning never strikes the same state twice. In Yuval Ishai and Vincent Rijmen, editors, Advances in Cryptology - EUROCRYPT 2019 - 38th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Darmstadt, Germany, May 19-23, 2019, Proceedings, Part III, volume 11478 of Lecture Notes in Computer Science, pages 408–438. Springer, 2019. A A Reduction Between Unclonability Definitions A.1 In the CRS model For completeness, here we repeat the definitions of unclonability. Definition A.1. (Unclonable Security for Hard Instances). A proof (Setup, Prove,Verify) satisfies unclonable security if for every language L with corresponding relation RL, for every polynomialsized quantum circuit family {Cλ}λ∈N, and for every hard distribution {Xλ,Wλ}λ∈N over RL, there exists a negligible function negl(·) such that for every λ ∈ N, Definition A.2. (1-to-2 Unclonable Extractability) A proof (Setup, Prove,Verify) satisfies unclonable security there exists a QPT extractor E which is an oracle-aided circuit such that for every language L with corresponding relation RL and for every non-uniform polynomial-time quantum adversary A, for every instance-witness pair (x, w) ∈ RL and λ = λ(|x|), such that there is a polynomial p(·) satisfying: there is also a polynomial (·) such that q Any protocol satisfying Definition A.2 also satisfies Definition A.1. Claim A.3. . Suppose there exists a protocol Π = ( ) satisfying Definition A.2. Proof Setup, Prove, Verify Consider the extractor E guaranteed by Definition A.2. Given a sample (x, w) ← (X ,W), we will show that there is a polynomial p ′ (·) such that which suffices to contradict hardness of the distribution (X ,W), as desired. Towards showing that Equation (37) holds, recall by Definition A.2 that for every NP instance-witness pair (x, w) such that there is a polynomial p(·) satisfying: there is also a polynomial (·) such that q This implies that there is a polynomial (·) such that for every (x, w) ∈ S, q This, combined with Equation (36) implies that which proves Equation (37) as desired. A.2 In the QRO model For completeness, here we repeat the definitions of unclonability. Definition A.4. (Unclonable Security for Hard Instances). A proof ( ) satisfies unclonable security with respect to a quantum random oracle O if for every language L with corresponding relation RL, for every polynomial-sized quantum oracle-aided circuit family {Cλ}λ∈N, and for every hard distribution {Xλ,Wλ}λ∈N over RL, there exists a negligible function l(·) such that for every λ ∈ N, Prove, Verify neg Definition A.5. (1-to-2 Unclonable Extractability) A proof ( ) satisfies unclonable security with respect to a quantum random oracle O there exists a QPT extractor E which is an oracle-aided circuit such that for every language L with corresponding relation RL and for every non-uniform polynomial-time quantum adversary A, for every instance-witness pair (x, w) ∈ RL and λ = λ(|x|), such that there is a polynomial p(·) satisfying: Prove, Verify there is also a polynomial (·) such that q Any protocol satisfying Definition A.5 also satisfies Definition A.4. Claim A.6. Suppose there exists a protocol Π = (Prove,Verify) satisfying Definition A.5. Proof. Let S denote the set of instance-witness pairs {(x, w) ∈ (X ,W)} that satisfy First, we claim that Suppose not, then by Equation (41), contradicting Equation (40). Thus, Equation (42) must be true. Consider the extractor E guaranteed by Definition A.5. Given a sample (x, w) ← (X ,W), we will show that there is a polynomial p ′ (·) such that which suffices to contradict hardness of the distribution (X ,W), as desired. Towards showing that Equation (43) holds, recall by Definition A.5 that for every NP instance-witness pair (x, w) such that there is a polynomial p(·) satisfying: there is also a polynomial (·) such that q This along with Equation (40) implies that there is a polynomial (·) such that for every (x, w) ∈ S, q This, combined with Equation (42) implies that which proves Equation (43) as desired.

Unclonable Non-Interactive Zero-Knowledge: References

This paper is available on arxiv under CC 4.0 license. Authors: (1) Ruta Jawale; (2) Dakshita Khurana. Table of Links Abstract and Introduction Technical Overview Preliminaries Unclonable Non-Interactive Zero-Knowledge in the CRS Model Unclonable NIZK in the Quantum Ramdon Oracle Model Unclonable Signatures of Knowledge References 6 Unclonable Signatures of Knowledge 6.1 Definition (Unclonable Extractable SimExt-secure Signatures of Knowledge). Let NP relation R with corresponding language L be given such that they can be indexed by a security parameter λ ∈ N. Let a message space M be given such that it can be indexed by a security parameter λ ∈ N. Definition 6.1 ∈ N. Let a message space M be given such that it can be indexed by a security parameter λ ∈ N. (Setup, Sign, Verify) is an unclonable signature of knowledge of a witness with respect to L and M if it has the following properties: • (Setup, Sign,Verify) is a quantum Sim-Ext signature of knowledge (Definition 3.16). • (k−1)-to-k-Unclonable with Extraction: There exists an oracle-aided polynomial-size quantum circuit E such that for every polynomial-size quantum circuit A, for every tuple of k − 1 instance-witness pairs (x1, ω1), . . . ,(xk−1, ωk−1) ∈ R, every {mι ∈ Mλ}ι∈[k−1], for every (x, m) where we define such that there is a polynomial (·) where p then there is also a polynomial (·) such that q 6.2 Construction Let Π = (Setup, P,V) Theorem 6.2. be a non-interactive simulation-extractable, adaptive multi-theorem computational zero-knowledge, unclonable-extractable protocol for NP (Definition 4.7). (Setup, Sign, Verify) in Figure 6 is an unclonable-extractable SimExt-secure signature of knowledge (Definition 6.1). Correctness follows naturally. It remains to prove simulateability, extractability, and unclonable extractability Proof of Theorem 6.2. Let Π.Sim = (Π.Sim0, Π.Sim1) be the adaptive multi-theorem computationally zero-knowledge simulator of Π. We define Sim0 with oracle access to Π.Sim0 as follows: Simulateable. Input: 1 λ. (1) Send 1 λ to Π.Sim0. Receive (crs,td) from Π.Sim0. (2) Output crs and td. We define Sim1 with oracle access to Π.Sim1 as follows: Input: crs, td, x, m. (1) Define xΠ = (x, m). Send (crs,td, xΠ) to Π.Sim1. Receive π from Π.Sim1. (2) Output σ = π. Let a polynomial p(·) and an oracle-aided polynomial-size quantum circuit A be given such that We define a reduction to the multi-theorem zero-knowledge property of Π as follows: Reduction: to zero-knowledge of Π given oracle access to A. (1) Receive (real or simulated) crs from the challenger. (2) Send crs to A. (3) On query (x, w, m) from A: send xΠ = (x, m) to the challenger, receives (real or simulated) π from the challenger, send σ = π to A. (4) Output the result of A. The view of A matches that of our protocol in Figure 6 or Sim0 and Sim1. As such, this reduction should have the same advantage at breaking the adaptive multi-theorem computational zero-knowledge property of Π. We reach a contradiction, hence our protocol must be simulateable. Extractable. Let Π.Sim = (Π.Sim0, Π.Sim1) be the adaptive multi-theorem computationally zero-knowledge simulator of Π. Let Π.Ext be the simulation extractable extractor of Π defined relative to Π.Sim. Let Sim = (Sim0, Sim1) be the simulator given by the simulation property which uses Π.Sim. We define Ext with oracle access to Π.Ext as follows: Input: crs, td, x, m, σ = π. (1) Define xΠ = (x, m). (2) Send (crs, td, xΠ, π) to Π.Ext. Receive wΠ = w from Π.Ext. (3) Output w. Let a polynomial (·) and an oracle-aided polynomial-size quantum circuit A be given such that p where Q is the list of queries from A to Sim1. If Verify accepts the output of A, then Π.V must accept (crs, xΠ, π). If (x, m) 6∈ Q, then since xΠ contains x, m, xΠ must not be in the queries asked to Π.Sim1. Since (x, w) 6∈ R, then xΠ 6∈ LΠ by the definition of LΠ. As such, it must necessarily be the case that (xΠ, wΠ) 6∈ RΠ. Hence, we have that where QΠ is the list of queries, originating from A, that Sim1 makes to Π.Sim1. We define a reduction to the simulation extraction property of Π as follows: Reduction: to simulation extraction of Π given oracle access to A. (1) Receive crs from the challenger. (2) Send crs to A. (3) On query (x, w, m) from A: send xΠ = (x, m) to the challenger, receives π from the challenger, send σ = π to A. (4) Receive (x, m, σ = π) from A. Define xΠ = (x, m). (5) Output (xΠ, π). The view of A matches that of Sim0 and Sim1. As such, this reduction should have the same advantage at breaking the extraction property of Π. We reach a contradiction, hence our protocol must be extractable. Let Π.Sim be the adaptive multi-theorem computationally zero-knowledge simulator of Π. Let Π.Ext be the simulation extractable extractor of Π defined relative to Π.Sim. Let Π.E be the unclonable extractor of Π. We define E with oracle-access to Π.E, Π.Sim, Π.Ext, and some A as follows: Unclonable Extractability. extract a valid witness. Formally, that is that both Scenario One We will show that we will directly contradict the unclonability of the NIZK protocol Π. We define a reduction to the unclonability of Π as follows: The view of A matches either the real or the simulated game. Additionally, the challenger may run the honest extractor. As such, this reduction should have the same advantage at breaking the unclonability property of Π. This reaches a contradiction. Scenario Two We now switch to a hybrid where the proofs in the signatures are simulated. There exists a polynomial (·) such that Claim 6.3. p ′ where QΠ is the list of queries that are made to Π.Sim1. We define a reduction to the simulation extraction property of Π as follows: The view of A matches that in Equation (31). As such, this reduction should have the same advantage at breaking the extraction property of Π. We reach a contradiction. As such, it only remains to prove Claim 6.3. Assume for the sake of contradiction that the claim is false. This means there is an inverse polynomial gap between the game in Claim 6.3 and Equation (30). We define a reduction to the multi-theorem zero-knowledge property of Π as follows: Proof of Claim 6.3. The view of A matches that of our protocol in Figure 6 or Sim0 and Sim1. As such, this reduction should have the same advantage at breaking the adaptive multi-theorem computational zero-knowledge property of Π. We reach a contradiction. We reach a contradiction in both scenarios, hence our protocol must be unclonable. Assuming the polynomial quantum hardness of LWE, injective one-way functions exist, post-quantum iO exists, there exists an unclonable SimExt-secure signature of knowledge (Definition 6.1). Corollary 6.4. This follows from Corollary 4.13 and Theorem 6.2. Proof. 6.3 Revocable Anonymous Credentials In this section, we will see how to use unclonable signatures of knowledge to construct an anonymous credentials scheme which has a natural revocation property. (Revocable Anonymous Credentials). ( e) is a revocable anonymous credentials scheme with respect to some set of accesses {Sλ}λ∈N if it has the following syntax and properties. Definition 6.5 IssuerKeyGen, Issue,VerifyCred, Revoke, Prove, VerRevok . The input 1 λ is left out when it is clear from context. Syntax • (nym,sk) ← IssuerKeyGen(1λ ): The probabilistic polynomial-time algorithm IssuerKeyGen is run by the issuer of the credentials. It takes input 1 λ ; and outputs a pseudonym nym with a secret key sk. • cred ← Issue(1λ , nym,sk, access): The polynomial-time quantum algorithm Issue is run by the issuer of the credentials. It takes input the issuer’s keys and sk as well as the requested access access ∈ Sλ; and outputs a quantum credential cred along with a classical identifier id. nym • VerifyCred(1λ , nym, access, cred) ∈ {0, 1}: The polynomial-time quantum algorithm VerifyCred is run by a verifier of the user’s credentials. It takes input the issuer’s pseudonym nym, the requested access access ∈ Sλ, and a credential cred; and outputs 1 cred is a valid credential for access access with respect to . iff nym • ← Revoke( ): The polynomial-time quantum algorithm Revoke is run by the issuer of the credentials. It takes input the issuer’s keys nym and sk, and the access access being revoked; and outputs a notice of revocation . revnotice 1λ , nym,sk, access revnotice • π ← Prove(1λ , cred): The polynomial-time quantum algorithm Prove is run by the user of the credentials. It takes input the issuer’s pseudonym nym, and a revocation notice revnotice, and the credential to be revoked cred which is identified by ; and outputs a proof of revocation π. nym,revnotice, revnotice • ( , π) ∈ {0, 1}: The polynomial-time quantum algorithm is run by the issuer of the credentials. It takes input the issuer’s keys and sk, the access access being revoked, the revocation notice , and a proof of revocation π; and outputs 1 iff π is a valid proof that the user’s access to the credential identified by id has been revoked. Ver Revoke 1λ , nym, sk, access, revnotice VerRevoke nym revnotice Properties. • Correctness: For every sufficiently large λ ∈ N, and every access ∈ Sλ, • Revocation: For every polynomial-size quantum circuit A, there exists a negligible function negl(·) such that for sufficiently large λ ∈ N, and every access ∈ Mλ REMARK 6.1. Unlike previous literature, the users that get issued credentials do not have their own identity. We also define algorithms for a three-message revocation process as opposed to the polynomial-message revocation process defined in the literature. We now introduce a construction based on unclonable signatures of knowledge. Theorem 6.6. Let (X ,W) be a hard-distribution of instance and witness pairs for some NP relation. Let {Sλ}λ∈N be some set of accesses. Let ( ) be an unclonable-extractable -secure signature of knowledge for message space {Sλ}λ∈N (Definition 6.1). Setup, Sign, Verify SimExt ( ) IssuerKeyGen, Issue,VerifyCred, Revoke, Prove, VerRevoke defined in Figure 7 is a revocable anonymous credentials scheme (Definition 6.5). Proof Sketch. The correctness of this revocable anonymous credentials scheme follows from the correctness of the unclonable signature of knowledge scheme. We will now sketch the proof of revocation. Say that there exists an adversary A, access access, and polynomial p(·) such that, with probability at least 1/p(λ): (1) π passes the revocation check, and (2) cred′ passes the credential check. This means that both π and cred′ are valid signatures with respect to the same crs, x, and access that the signature cred was issued under. This satisfies the “if” condition of the unclonability property of the unclonable signature of knowledge. As such, there exists a polynomial q(·) such that the unclonable signature of knowledge’s extractor can produce a witness w for x with probability at least 1/q(λ). However, this contradicts the hardness of the distribution (X ,W). Hence, our protocol must have the revocation property. . Assuming the polynomial quantum hardness of LWE, injective one-way functions exist, post-quantum iO exists, and the hardness of NP, there exists a revocable anonymous credentials scheme (Definition 6.5). Corollary 6.7 . This follows from Corollary 6.4 and Theorem 6.6. Proof

Unclonable Non-Interactive Zero-Knowledge: Unclonable Signatures of Knowledge

This paper is available on arxiv under CC 4.0 license. Authors: (1) Ruta Jawale; (2) Dakshita Khurana. Table of Links Abstract and Introduction Technical Overview Preliminaries Unclonable Non-Interactive Zero-Knowledge in the CRS Model Unclonable NIZK in the Quantum Ramdon Oracle Model Unclonable Signatures of Knowledge References 5 Unclonable NIZK in the Quantum Random Oracle Model 5.1 A Modified Sigma Protocol We will begin by introducing a slightly modified sigma protocol. In the coming sections, our construction will involve applying Fiat-Shamir to this modified protocol. This follows directly from the perfect completeness of Π. Proof. Perfect completeness and any x with associated λ ∈ N satisfying we have We define Ext 3 with oracle-access to Π.Ext and some A as follows: Input: x, S. Given (x, α, s) from AΠ: send α to Π.Ext, receive β from Π.Ext, and send β to AΠ. (1) Upon receiving γ from AΠ: send γ to Π.Ext. (2) Output the result of Π.Ext as w. (3) We define the following set of parameters: c = cΠ, p(·) = pΠ(·), negl0 (·) = negl0,Π(·) and negl1 (·) = negl1,Π(·). Let polynomial-size quantum circuit A = (A 0, A 1) and (x, S) be given such that We now define AΠ = (A0,Π, A1,Π) with oracle-access to A. A0,Π is hardwired with S, takes input x, sends (x, S) to A0, receives ((x, α, s), |sti) from A0, and outputs (α, |sti). A1,Π is hardwired with S, takes input (x, |sti, β), sends ((x, S), |sti, β) to A1, receives γ from A1, outputs γ. By the structure of our proof and definition of our verifier, this means that which satisfies the constraint in Equation (15). This means we have, when combined with our definition of Ext, that Thus showing that our protocol is a proof of knowledge protocol. . Let Π.Sim be the computational honest-verifier zero-knowledge quantum simulator for Π. We define Sim with oracle access to Π.Sim as follows: Computational Honest-Verifier Zero-Knowledge with Quantum Simulator Input: x, S. (1) Compute (α, β, γ) ← Π.Sim(1λ , x) (2) Sample s from S. (3) Output ((x, α, s), β, γ). Let a polynomial p(·), a polynomial-size quantum circuit D, λ ∈ N, and ((x, S), w) ∈ R be given such that We define a reduction to the zero-knowledge property of Π as follows: Reduction: to zero-knowledge of Π given oracle access to D. Hardwired with: x, S. (1) Receive (real or simulated) (α, β, γ) from the challenger. (2) Sample s from S. (3) Send ((x, α, s), β, γ) to D. Receive b from D. (4) Output b. When the challenger sends a real (or simulated) proof for Π, the reduction generates a proof that is identical to the real (resp. simulated) proof. As such, this reduction preserves the distinguishing advantage of . This reaches a contradiction against the zero-knowledge property of Π. Hence, our protocol must be zero-knowledge. D By the definition of the honest prover P.Com, which is a contradiction. Hence our protocol must have unpredictable commitments. Corollary 5.2. The Fiat-Shamir heuristic applied to the post-quantum sigma protocol defined in Theorem 5.1 yields a classical post-quantum NIZKPoK Π′ in the QROM (Definition 3.11). . This follows by Theorem 5.1 and Theorem 3.12. Proof 5.2 Unclonability Definitions Unclonable NIZKs in the quantum random oracle model are defined analogously to the CRS model – we repeat these definitions in the QRO model for completeness below. (Unclonable Security for Hard Instances). A proof (P,V) satisfies unclonable security with respect to a quantum random oracle O if for every language L with corresponding relation RL, for every polynomial-sized quantum circuit family {Cλ}λ∈N, and for every hard distribution {Xλ,Wλ}λ∈N over RL, there exists a negligible function negl1 (·) such that for every λ ∈ N, Definition 5.3. Definition 5.4 ((k−1)-to-k-Unclonable Extractable NIZK in QROM). Let security parameter λ ∈ N and NP relation R with corresponding language L be given. Let Π = (P,V) be given such that P and V are poly(λ)-size quantum algorithms. We have that for any (x, ω) ∈ R, P receives an instance and witness pair (x, ω) as input and outputs π, and V receives an instance x and proof π as input and outputs a value in {0, 1}. Π is a non-interactive (k − 1)-to-k-unclonable NIZKPoK protocol for language L with respect to a random oracle O if the following holds: • Π is a NIZKPoK protocol for language L in the quantum random oracle model (Definition 3.11). • (k−1)-to-k-Unclonable with Extraction: There exists an oracle-aided polynomial-size quantum circuit E such that for every polynomial-size quantum circuit A, for every tuple of k − 1 instance-witness pairs (x1, ω1), . . . ,(xk−1, ωk−1) ∈ R, for every x where we define such that there is a polynomial p(·) where then there is also a polynomial (·) such that q Similar to the previous section, we have the following lemma. Let Π = (Setup, P,V) be a a non-interactive 1-to-2-unclonable zero-knowledge quantum protocol (Definition 5.4). Then, Π satisfies Definition 5.3. Lemma 5.5. For a proof of Lemma 5.5, we refer to Appendix A. 5.3 Unclonable NIZK Implies Public-Key Quantum Money in QROM Theorem 5.6. Let O be a quantum random oracle. Let (X ,W) be a hard distribution over a language L ∈ NP. Let Π = (P,V) be a 1-to-2 unclonable non-interactive perfectly complete, computationally zero-knowledge protocol for L in the QRO model (Definition 5.4). Then (P,V) implies a public-key quantum money mini-scheme in the QRO model (Definition 3.15) as described in Figure 4. . . This follows directly from the perfect completeness of Π. Unforgeability. Let p(·) be a polynomial and A be a quantum polynomial-time adversary such that for an infinite number of λ ∈ N +, Proof Perfect Correctness We construct a reduction that breaks the uncloneability definition (Definition 5.3) which we show (in Appendix A) is implied by our definition (Definition 5.4). The challenger, with access to random oracle O, samples a hard instance-witness pair (x, w) ← (X ,Y) and a proof π ← P O(x, w). The challenger then forwards (x, π) to the reduction, which also has oracle access to O. The reduction then sets |$i = π and s = x. The reduction sends (|$i, s) to the adversary A who returns back (|$0, s0, |$1, s1). The reduction then parses and sets πi = |$ii for i ∈ {0, 1}. The reduction then sends π0 and π1 back to the challenger. 5.4 Construction and Analysis Let λ, k ∈ N and a public-key quantum money mini-scheme ( ) be given. Let points q1, . . . , qk with the following structure be given: a point q contains a serial number s sampled according to (1λ ). Lemma 5.7. NoteGen,Ver NoteGen The points q1, . . . , qk must be distinct with overwhelming probability. . Each point contains a serial number sampled according to the quantum money generation algorithm, (1λ ). By the unpredictability of the serial numbers of quantum money (Definition 3.13), all k honestly generated serial numbers must be distinct with overwhelming probability. Hence, these k points will be distinct with overwhelming probability. Proof NoteGen We now introduce our construction in Figure 5 and prove the main theorem of this section. Theorem 5.8. Let k(·) be a polynomial. Let NP relation R with corresponding language L be given. Let ( ) NoteGen, Ver be a public-key quantum money mini-scheme (Definition 3.13) and Π = (P,V) be a post-quantum sigma protocol (Definition 3.4). (P,V) as defined in Figure 5 will be a non-interactive knowledge sound, computationally zero-knowledge, and (k − 1)-to-k-unclonable with extraction protocol for L in the quantum random oracle model (Definition 3.11). Let the parameters and primitives be as given in the theorem statement. We argue that completeness follows from the protocol construction in Figure 5, and we prove the remaining properties below. Proof. we have Let polynomial-size quantum circuit A and x be given such that Let AF S be defined with oracle-access to some A and O as follows: Input: x, S. (1) Given a query (x, α, s) from A: send (x, α, s) to O, receive β from O, and send β to A. (2) Upon receiving π = (|$i, s, α, β, γ) from A: output πF S = ((x, α, s), β, γ). By the structure of our proof and definition of our verifier, this means that which satisfies the constraint in Equation (16). This means we have, when combined with our definition of Ext and S, that Thus showing that our protocol is a proof of knowledge protocol. Zero-Knowledge. Let SimF S be the simulator for Π′ in Corollary 5.2 (where Π instantiates Theorem 5.1). Let RF S be the relation for Π′ with respect to R. We define Sim with oracle-access to SimF S and program access to some random oracle O as follows: (ignores any witnesses it may receive). Input: x Let an oracle-aided distinguisher D which can only make queries (x, w) ∈ R, and a polynomial p(·) be given such that We define a reduction to the zero-knowledge property of Π′ as follows: Reduction: to zero-knowledge of Π′ given oracle access to D and program access to O. For every (x, w) from D: The view of D matches that of our protocol in Figure 5 or Sim. As such, our reduction should have the same advantage at breaking the zero-knowledge property of Π′ . We reach a contradiction, hence our protocol must be zero-knowledge. Let Ext be the quantum circuit of the extractor we defined earlier (in our proof that Figure 5 is a proof of knowledge). Let Sim be the quantum circuit of the simulator that we defined earlier (in our proof that Figure 5 is a zero-knowledge protocol). We define an extractor E with oracle-access to some A as follows: Unclonable Extractability. Hardwired with: some choice of I ⊆ [k − 1], J ⊆ [k], x1, . . . , xk−1 ∈ R, x. (1) Samples ℓ ∈ J uniformly at random. (2) Instantiates a simulatable and extractable random oracle O. Runs Ext on O throughout the interaction with A (which may involve rewinding, in which case we would rewind A and repeat the following steps). Require that Ext extracts with respect to the ℓth proof output by A. (3) Compute πι ← Sim(xι) for ι ∈ [k − 1] where we store all points Sim would program into a list P. (4) Send {πι}ι∈[k−1] to A. (5) For every query from A, if the query is in P, then reply with the answer from P. Else, forward the query to O and send the answer back to A. Let Ob denote this modified random oracle. (7) Outputs the result of Ext as w. Given Equation (24), we may be in one of the two following cases: either A generates two accepting proofs which have the same serial number as a honestly generated proof, or A does not. We consider these two scenarios separately and show that each reaches a contradiction. Scenario One Say that A generates two accepting proofs which have the same serial number as an honestly generated proof. By applying a union bound to Equation (24), we have that this event could happen with at least 1/2p(λ) probability. Symbolically, Scenario Two Alternatively, say that A does not generate two accepting proofs which have the same serial number as an honestly generated proof. By the pigeon-hole principle, this means that A generates an accepting proof with a serial number which is not amongst the ones it received. By applying a union bound to Equation (24), we have that this event could happen with at least 1/2p(λ) probability. In summary, we have that Through an averaging argument, we can fix index j ∈ J which gives us the same event with an advantage of 1/(2kp(λ)). We will now switch to a hybrid where we provide A with simulated proofs at indices I. There exists a polynomial (·) such that Claim 5.9. q We will later see a proof of Claim 5.9. For now, assuming that this claim holds, we can define an adversary from which Ext can extract a valid witness for x. There exists a polynomial ′ (·) such that Claim 5.10. q We will soon see a proof for Claim 5.10. Meanwhile, if this claim is true, then we will have a direct contradiction with Equation (19). Thus, all that remains to be proven are the two claims: Claim 5.9 and Claim 5.10. We start by proving the former claim. Proof of Claim 5.9. independently program these k points. Then we can argue the indistinguishability of switching one-by-one to simulated proofs. We will argue that our simulator will run in expected polynomial time. By Lemma 5.7, the k points which our simulator will program will be distinct with overwhelming probability. Furthermore, since we assumed that our quantum random oracle can be programmed at multiple distinct points Definition 3.10, our simulator is well-defined. We first need to argue that our strategy is well-defined, that we will be able to We now argue indistinguishability of the simulated proofs from the honestly generated proofs via a hybrid argument. Suppose for sake of contradiction that the probability difference between Equation (21) and Equation (22) was 1/p′ (λ) for some polynomial p ′ (·). We construct a series of consecutive hybrids for each i ∈ [k − 1] where we switch the i th proof from prover generated to simulated. By this hybrid argument, there must be some position ℓ ∈ [k − 1] where switching the ℓ th proof has a probability difference of at least 1/(kp′ (λ)). We now formalize a reduction which can distinguish between these two settings: We first argue that the view that the reduction provides to A matches one of the games: where all proofs up to the ℓ th are simulated or where all proofs up to and including the ℓ th are simulated. By Lemma 5.7, the point computed or programmed by the challenger will be distinct from the points which the reduction programs. As such, the reduction is allowed to modify 5 the oracle which A interfaces with (see step (4)). In summary, A will be provided access to an oracle that is consistent with all of the proofs it receives. Given that A has a view which directly matches its expected view in either game, then the reduction’s advantage is the same as A’s advantage which is at least 1/(kp′ (λ)). This is a contradiction with the zero-knowledge property of our protocol. Thus, our original claim must be true. Now, we continue on to proving the latter claim. 5.10. Given that Claim 5.9 holds, this implies that Proof of Claim First we must argue that A’s view remains identical to the game which appears in both Equation (24) and Equation (25). The oracle which A interfaces with (see step (4)) will be consistent with all of the proofs it receives. Through Equation (25), we reach the conclusion that By the definition of a proof of knowledge (Definition 3.11) which have some parameters polynomial p ∗ (·) and negligible functions negl0 (·) and negl1 (·), we have that there exists some polynomial q ′ (·) such that which completes the proof of our claim. By completing the proofs of our claims, we have concluding the proof of our theorem statement. Assuming the injective one-way functions exist, and post-quantum iO exists, there exists a non-interactive knowledge sound, computationally zero-knowledge, and (k − 1)-to-kunclonable with extraction protocol for NP in the quantum random oracle model (Definition 5.4). Corollary 5.11. This follows from Theorem 3.14 and Theorem 5.8. Proof. We have thus shown that Figure 5 is an unclonable NIZK PoK in the ROM model as defined according to our unclonability definition, Definition 5.4.

Unclonable Non-Interactive Zero Knowledge in the Quantum Random Oracle Model

কোয়ান্টাম র্যান্ডম ওরাকল মডেলে আনক্লোনেবল নন-ইন্টারেক্টিভ জিরো নলেজ

Nicht klonbares, nicht interaktives Nullwissen im Quantum Random Oracle-Modell

Conocimiento cero no interactivo no clonable en el modelo cuántico aleatorio de Oracle

Connaissance zéro non interactive non clonable dans le modèle Oracle quantique aléatoire

क्वांटम रैंडम ओरेकल मॉडल में अनक्लोनेबल नॉन-इंटरएक्टिव जीरो नॉलेज

量子ランダムOracleモデルにおける複製不可能な非対話型のゼロ知識

Quantum Random Oracle 모델의 복제 불가능한 비대화형 제로 지식

Conhecimento zero não interativo não clonável no modelo Quantum Random Oracle

Неклонируемое неинтерактивное нулевое знание в модели квантового случайного оракула

Kuantum Rastgele Oracle Modelinde Klonlanamayan Etkileşimli Olmayan Sıfır Bilgi

Không có kiến thức không tương tác, không thể nhân bản trong Mô hình Oracle ngẫu nhiên lượng tử

量子随机预言模型中不可克隆的非交互式零知识

This paper is available on arxiv under CC 4.0 license. Authors: (1) Ruta Jawale; (2) Dakshita Khurana. Table of Links Abstract and Introduction Technical Overview Preliminaries Unclonable Non-Interactive Zero-Knowledge in the CRS Model Unclonable NIZK in the Quantum Ramdon Oracle Model Unclonable Signatures of Knowledge References 4 Unclonable Non-Interactive Zero-Knowledge in the CRS Model 4.1 Simulation-Extractable Definition (Post-Quantum (Quantum) Simulation-Extractable NIZK for in CRS Model). Let NP relation R with corresponding language L be given such that they can be indexed by a security parameter λ ∈ N. Definition 4.1 NP Π = ( ) is a post-quantum (quantum) non-interactive simulation-extractable zero-knowledge argument for NP in the CRS model if it has the following syntax and properties. Setup, P, V • Π is a post-quantum (quantum) non-interactive simulation sound, adaptive multi-theorem computational zero-knowledge argument for in the model (Definition 3.7). NP CRS • Simulation Extractability. Let Sim = ( ) be the simulator given by the adaptive multi-theorem computational zero-knowledge property. There exists a (quantum) polynomial-time circuit Ext and a negligible function such that for every oracle-aided polynomials-ize quantum circuit A and every λ ∈ N, Sim0, Sim1 negl(·) where is the list of queries from to Sim1. Q A REMARK 4.1. As defined in Definition 4.1, a simulation-extractable zero-knowledge protocol has simulation soundness [Sah99, SCO+01], is a proof of knowledge, and has adaptive computational soundness (Definition 3.5). (Post-Quantum Simulation-Extractable NIZK for NP in the CRS Model). Let NP relation R with corresponding language L be given. Theorem 4.2 Let Π = ( ) Setup, P,V be a non-interactive post-quantum simulation sound, adaptively multi-theorem computationally zero-knowledge protocol for NP (Definition 3.7). Let (Gen, Enc, Dec) be a post-quantum perfectly correct, IND-CPA secure encryption scheme (Definition 3.3). ( ) Setup, P,V as defined in Figure 1 will be a non-interactive post-quantum simulation-extractable, adaptively multi-theorem computationally zero-knowledge argument for L in the common reference string model (Definition 4.1). . Completeness follows from the perfect completeness of Π. Proof Perfect Completeness. Let Π.Sim = (Π.Sim0, Π.Sim1) be the adaptive multi-theorem computationally zero-knowledge simulator of Π. We define Sim0 with oracle access to Π.Sim0 as follows: Adaptively Multi-theorem Computationally Zero-Knowledge. Input: 1 λ . We will first switch the honest proofs for simulated proofs, using the adaptive multi-theorem zeroknowledge of Π. Later, we will see how we can switch the encryption of a valid witness to an encryption of 0, by using the security of the encryption scheme. We define a series of intermediary hybrids starting from encrypting all real witnesses to encrypting all zeros. The first intermediary hybrid switches the encryption sent in the last query from an encryption of a witness to an encryption of 0. We continue switching the encryption in the second to last query and so on, until we’ve switched the first proof that the adversary makes. Let (·) be a polynomial denoting the maximum number of queries that A makes. By a union bound and Equation (2), there must exist a hybrid indexed by (where we switch the ciphertext in the th proof from encrypting a witness to encrypting 0) where first distinguishes between the two ciphertexts with advantage 1/(p ′ (λ)q(λ)). That is, q i i A Proof of Claim 4.3. Let a polynomial p(·) and an oracle-aided polynomial-size quantum circuit A be given such that This concludes our proof. Hence our protocol must be multi-theorem zero-knowledge. This follows from Corollary 3.9 and Theorem 4.2. Proof. 4.2 Unclonability Definitions We consider two definitions of unclonability for NIZKs. The first one, motivated by simplicity, informally guarantees that no adversary given honestly proofs for “hard” instances is able to output more than one accepting proof for the same instance. Definition 4.5 ((Quantum) Hard Distribution). Let an NP relation R be given. (X ,W) is a (quantum) hard distribution over R if the following properties hold. • Syntax. (X ,W) is indexable by a security parameter λ ∈ N. For every choice of λ ∈ N, the support of (Xλ,Wλ) is over instance and witness pairs (x, w) such that x ∈ L, |x|= λ, and (x, w) ∈ R. • Hardness. For every polynomial-sized (quantum) circuit family A = {Aλ}λ∈N, Definition 4.6. (Unclonable Security for Hard Instances). A proof (Setup, P,V) satisfies unclonable security for a language L with corresponding relation RL if for every polynomial-sized quantum circuit family {Cλ}λ∈N, and for every hard distribution {Xλ,Wλ}λ∈N over RL, there exists a negligible function negl(·) such that for every λ ∈ N, We will now strengthen this definition to consider a variant where from any adversary A that on input a single proof of membership of x ∈ L outputs two proofs for x, we can extract a valid witness w for x with high probability. In fact, we can further generalize this definition to a setting where the adversary obtains an even larger number (say k − 1) input proofs on instances x1, . . . , xk−1, and outputs k or more proofs. Then we require the extraction of an NP witness corresponding to any proofs that are duplicated (i.e. two or more proofs w.r.t. the same instance xi ∈ {x1, . . . , xk−1}). We write this definition below. ((k − 1)-to-k-Unclonable Extractable NIZK). Let security parameter λ ∈ N and NP relation R with corresponding language L be given. Let Π = (Setup, P,V) be given such that Setup, P and V are poly(λ)-size quantum algorithms. We have that for any (x, w) ∈ R, (crs,td) is the output of Setup on input 1 λ , P receives an instance and witness pair (x, w) along with crs as input and outputs π, and V receives an instance x, crs, and proof π as input and outputs a value in {0, 1}. Definition 4.7 Π is a non-interactive (k−1)-to-k-unclonable zero-knowledge quantum protocol for language L if the following holds: • Π is a quantum non-interactive zero-knowledge protocol for language L (Definition 3.5). • (k−1)-to-k-Unclonable with Extraction: There exists an oracle-aided polynomial-size quantum circuit E such that for every polynomial-size quantum circuit A, for every tuple of k − 1 instance-witness pairs (x1, ω1), . . . ,(xk−1, ωk−1) ∈ R, for every x where we define – I ⊆ [k − 1] such that |I|≥ 1, xi = x for all i ∈ I, and xι 6= x for all ι 6∈ I, and – J ⊆ [k] such that |J |≥ max{2, |I|}, xj = x for all j ∈ J , and xι 6= x for ι 6∈ J , such that there is a polynomial p(·) where then there is also a polynomial (·) such that q . Let Π = (Setup, P,V) be a 1-to-2-unclonable with extraction, non-interactive zero-knowledge quantum protocol (Definition 4.7). Then, Π satisfies Definition 4.6. Lemma 4.8 For a proof of Lemma 4.8, we refer to Appendix A. 4.3 Unclonable NIZK Implies Public-Key Quantum Money Mini-Scheme Figure 2: Public-Key Quantum Money Mini-Scheme from an Unclonable Non-Interactive Quantum Protocol . Let (X ,W) Theorem 4.9 be a hard distribution over a language L ∈ NP. Let Π = (Setup, P,V) satisfy Definition 4.6. Then (Setup, P,V) implies a public-key quantum money scheme mini-scheme (Definition 3.13) as described in Figure 2. . Perfect Correctness. This follows directly from the perfect completeness of Π. Unforgeability. Let p(·) be a polynomial and A be a quantum polynomial-time adversary such that for an infinite number of λ ∈ N +, Proof 4.4 Construction and Analysis of Unclonable NIZK from Public-Key Quantum Money . Let k(·) be a polynomial. Let NP relation R with corresponding language L be given. Theorem 4.10 Let (NoteGen,Ver) be a public-key quantum money mini-scheme (Definition 3.13) and Com be a post-quantum commitment scheme (Definition 3.1). Let Π = (Setup, P,V) be a non-interactive postquantum simulation-extractable, adaptive multi-theorem computational zero-knowledge protocol for NP (Definition 4.1). ( ) Setup, P,V as defined in Figure 3 will be a non-interactive quantum simulation-extractable, adaptive multi-theorem computationally zero-knowledge, and (k − 1)-to-k-unclonable with extraction protocol for L in the common reference string model (Definition 4.7). . Completeness follows from perfect correctness of the public key quantum money scheme, and perfect completeness of Π. Proof. Perfect Completeness . Let Π.Sim = (Π.Sim0, Π.Sim1) be the adaptive multi-theorem computationally zero-knowledge simulator of Π. We define Sim0 with oracle access to Π.Sim0 as follows: Adaptive Multi-Theorem Computational Zero-Knowledge However, we make the following claim which is in direct contradiction with Equation (3). Scenario One Given the event in Equation (5) holds, then the reduction will, with advantage 1/q(λ) for some polynomial q(·), succeed at breaking the hiding of Com, thus reaching a contradiction. Since Equation (3) directly contradicts Claim 4.11 which we have proven, then we have reached a contradiction. Therefore, the protocol must be simulation extractable. Let Π.Sim = (Π.Sim0, Π.Sim1) be the adaptive multi-theorem computationally zero-knowledge simulator of Π. Let Π.Ext be the simulation-extraction extractor of Π with respect to Π.Sim. Let Sim = (Sim0, Sim1) be the simulator, with oracle access to Π.Sim, as defined in the proof that Figure 3 is adaptive multi-theorem computational zero-knowledge. Let Ext be the extractor, based on Sim, as defined in the proof that Figure 3 is simulation-extractable. We define E with oracle access to Sim, Ext, and some A as follows: Unclonable Extractability. Scenario One Say that A generates two accepting proofs which have the same serial number as an honestly generated proof. By applying a union bound to Equation (7), we have that this event could happen with at least 1/2p(λ) probability. Symbolically, Scenario Two Alternatively, say that A does not generate two accepting proofs which have the same serial number as an honestly generated proof. By the pigeon-hole principle, this means that A generates an accepting proof with a serial number which is not amongst the ones it received. By applying a union bound to Equation (7), we have that this event could happen with at least 1/2p(λ) probability. In summary, we have that Through an averaging argument, we can fix index j ∈ J which gives us the same event with an advantage of 1/(2kp(λ)). We will now switch to a hybrid where we provide A with simulated proofs at indices I. . There exists a polynomial (·) such that Claim 4.12 q Given that the event in Equation (13) holds, then B contradicts Claim 4.11. Thus, all that remains to be proven is Claim 4.12. Proof of Claim 4.12. We proceed by contradiction. Let negl(·) be a negligible function such that By Equation (10) and Equation (13), there exists a polynomial q ∗ (·) such that By using the advantage of A in this game, we can show a reduction that breaks the multi-theorem zero-knowledge of Figure 3. We will now outline this reduction. Given that A is able to change its output dependent on which of the two worlds in Equation (14) that it is in, then the reduction will be able to distinguish between receiving honest proofs or simulated proofs. With advantage 1/q∗ (λ), the reduction will succeed at breaking the adaptive multi-theorem computational zero-knowledge of our protocol, thus reaching a contradiction. By completing the proofs of our claim, we have concluding the proof of our theorem statement. . Assuming the polynomial quantum hardness of LWE, injective one-way functions exist, and post-quantum iO exists, there exists a non-interactive adaptive knowledge sound, adaptive computationally zero-knowledge, and (k−1)-to-k-unclonable with extraction protocol for NP in the common reference string model (Definition 4.7). Corollary 4.13 . This follows from Theorem 3.2, Corollary 4.4, Theorem 3.14, and Theorem 4.10. Proof We have thus shown that Figure 3 is an unclonable NIZK PoK in the CRS model as defined according to our proposed unclonability definition, Definition 4.7. In the upcoming sections, we will consider unclonable proof systems in the QROM.

Unclonable Non-Interactive Zero-Knowledge in the CRS Model

This paper is available on arxiv under CC 4.0 license. Authors: (1) Ruta Jawale; (2) Dakshita Khurana. Table of Links Abstract and Introduction Technical Overview Preliminaries Unclonable Non-Interactive Zero-Knowledge in the CRS Model Unclonable NIZK in the Quantum Ramdon Oracle Model Unclonable Signatures of Knowledge References 3 Preliminaries 3.1 Post-Quantum Commitments and Encryption (Post-Quantum Commitments). Com is a post-quantum commitment scheme if it has the following syntax and properties. Definition 3.1 Syntax. • c ← Com(m; r): The polynomial-time algorithm Com on input a message m and randomness r ∈ {0, 1} r(λ) outputs commitment a c. Properties. (Post-Quantum Commitment). [LS19] Assuming the polynomial quantum hardness of LWE, there exists a non-interactive commitment with perfect binding and computational hiding (Definition 3.1). Theorem 3.2 (Post-Quantum Public-Key Encryption). (Gen, Enc, Dec) is a post-quantum publickey encryption scheme if it has the following syntax and properties. Definition 3.3 Syntax. • (pk,sk) ← Gen(1λ ): The polynomial-time algorithm Gen on input security parameter 1 λ outputs a public key pk and a secret key sk. • c ← Enc(pk, m; r): The polynomial-time algorithm Enc on input a public key pk, message m and randomness r ∈ {0, 1} r(λ) outputs a ciphertext c. • m ← Dec(sk, c): The polynomial-time algorithm Dec on input a secret key sk and a ciphertext c outputs a message m. Properties. 3.2 Sigma protocols Definition 3.4 (Post-Quantum Sigma Protocol for NP). [LZ19] Let NP relation R with corresponding language L be given such that they can be indexed by a security parameter λ ∈ N. Π = (P = (P.Com, P.Prove),V = (V.Ch,V.Ver)) is a post-quantum sigma protocol if it has the following syntax and properties. . The input 1 λ is left out when it is clear from context. Syntax • (α,st) ← P.Com(1λ , x, w): The probabilistic polynomial-size circuit on input an instance and witness pair (x, w) ∈ Lλ outputs a commitment α and an internal prover state st. P.Com • β ← V.Ch(1λ , x, α): The probabilistic polynomial-size circuit V.Ch on input an instance x outputs a uniformly random challenge β. • γ ← P.Prove(1λ , x, w,st, β): The probabilistic polynomial-size circuit on input an instance and witness pair (x, w) ∈ Lλ, an internal prover state st, and a challenge β outputs the partial opening (to α as indicated by β) γ. P. Prove • (1λ , x, α, β, γ) ∈ {0, 1}: The probabilistic polynomial-size circuit V.Ver on input an instance x, a commitment α, a challenge β, and a partial opening γ outputs 1 iff γ is a valid opening to α at locations indicated by β. V. Ver Properties. . For every λ ∈ N and every (x, w) ∈ Rλ, • Perfect Completeness There exists a quantum polynomial-size circuit Sim and a negligible function negl(·) such that for every polynomial-size quantum circuit D, every sufficiently large λ ∈ N, and every (x, w) ∈ Rλ, • Computational Honest-Verifier Zero-Knowledge with Quantum Simulator. • Unpredictable Commitment. There exists a negligible function such that for every sufficiently large λ ∈ N and every (x, w) ∈ Rλ, negl(·) We note that the unpredictable commitment property in the definition above may appear to be an unusual requirement, but this property is w.l.o.g. for post quantum sigma protocols as shown in [LZ19]. In particular, any sigma protocol which does not have unpredictable commitments, can be modified into one that does: the prover can append a random string r to the end of their commitment message α, and the verifier can ignore this appended string r when they perform their checks. 3.3 NIZKs in the CRS model We consider the common reference string model. Definition 3.5 (Post-Quantum (Quantum) NIZK for NP in the CRS Model). Let NP relation R with corresponding language L be given such that they can be indexed by a security parameter λ ∈ N is a non-interactive post-quantum (quantum) zero-knowledge argument for in the CRS model if it has the following syntax and properties. Π = (Setup, P,V) NP Syntax. The input 1 λ is left out when it is clear from context. • ← Setup(1λ ): The probabilistic polynomial-size circuit Setup on input 1 λ outputs a common reference string crs. crs • π ← P(1λ , , x, w): The probabilistic (quantum) polynomial-size circuit P on input a common reference string crs and instance and witness pair (x, w) ∈ Rλ, outputs a proof π. crs • V(1λ , , x, π) ∈ {0, 1}: The probabilistic (quantum) polynomial-size circuit V on input a common reference string , an instance x, and a proof π outputs 1 iff π is a valid proof for x. crs crs Properties. For every λ ∈ N and every (x, w) ∈ Rλ, • Perfect Completeness. There exists a negligible function such that for every polynomial-size quantum circuit A and every sufficiently large λ ∈ N, • Adaptive Computational Soundness. negl(·) There exists a probabilistic (quantum) polynomial-size circuit Sim = ( ) and a negligible function such that for every polynomial-size quantum circuit A, every polynomial-size quantum circuit D, and every sufficiently large λ ∈ N, • Adaptive Computational Zero-Knowledge. Sim0, Sim1 negl(·) (Post-Quantum NIZK argument for NP in the CRS Model). [PS19] Theorem 3.6 Assuming the polynomial quantum hardness of LWE, there exists a non-interactive adaptively computationally sound, adaptively computationally zero-knowledge argument for NP in the common reference string model (Definition 3.5). (Post-Quantum (Quantum) Simulation-Sound NIZK for NP in CRS Model). Let NP relation R with corresponding language L be given such that they can be indexed by a security parameter λ ∈ N Definition 3.7 Π = ( ) is a post-quantum (quantum) non-interactive simulation-sound, adaptive multi-theorem computational zero-knowledge protocol for in the CRS model if it has the following syntax and properties. Setup, P,V NP • Π is a post-quantum (quantum) non-interactive zero-knowledge argument for in the model (Definition 3.5). NP CRS • Adaptive Multi-Theorem Computational Zero-Knowledge. [FLS90] There exists a probabilistic (quantum) polynomial-size circuit Sim = ( ) 1 and a negligible function such that for every polynomial-size quantum circuit A, every polynomial-size quantum circuit D, and every sufficiently large λ ∈ N, Sim0, Sim1 negl(·) [Sah99, SCO+01] Let Sim = (Sim0, Sim1) be the simulator given by the adaptive multi-theorem computational zero-knowledge property. There exists a negligible function negl(·) such that for every oracle-aided polynomial-size quantum circuit A and every sufficiently large λ ∈ N, • Simulation Soundness. where is the list of queries from to Q A Sim1. REMARK 3.1. In Definition 3.7, adaptive multi-theorem computational zero-knowledge implies adaptive computational zero-knowledge. REMARK 3.2. As defined in Definition 3.7, a simulation-sound zero-knowledge protocol has adaptive computational soundness (Definition 3.5). (Simulation Sound Compiler). [SCO+01] Given one-way functions and a single-theorem NIZK proof system for NP, then there exists a non-interactive simulation sound, adaptively multi-theorem computationally zero-knowledge proof for NP in the common reference string model (Definition 3.7). Theorem 3.8 (Post-Quantum Simulation Sound NIZK for NP). Assuming the polynomial quantum hardness of LWE, there exists a post-quantum non-interactive simulation sound, adaptively multi-theorem computationally zero-knowledge proof for NP in the common reference string model (Definition 3.7). Corollary 3.9 . This follows from Theorem 3.6 and Theorem 3.8. Proof 3.4 NIZKs in the QRO model We now consider the quantum random oracle model. For sake of completeness, we briefly outline a definition for a quantum random oracle. A quantum random oracle O is a random function which support quantum queries and allows for the following accesses: Definition 3.10. On input a message, O outputs a uniformly random value. This is the usual access provided. When quantum access may be invoked, we denote the oracle as |O. • Query Access. Given programmability access, O can be set to output a specified value on a specified input. An arbitrary number of distinct points can be programmed. • Programmability Access. Given extractability access, specific queries to |O can be read. • Extractability Access. Definition 3.11 ((Quantum) Post-Quantum for in QROM). [LZ19] Let O be a random oracle. Let NP relation R with corresponding language L be given such that they can be indexed by a security parameter λ ∈ N. NIZKPoK NP Π = ( ) is a (quantum) non-interactive zero-knowledge proof of knowledge protocol with respect to a random oracle if it has the following syntax and properties. P,V Syntax. The input 1 λ is left out when it is clear from context. Properties. • Perfect Completeness. For every λ ∈ N and every (x, w) ∈ Rλ, There exists a quantum polynomial-size circuit Sim which ignores its second input and a negligible function such that for every oracle-aided polynomial-size quantum circuit D which is limited to making queries (x, ω) ∈ Rλ on input 1 λ , and every sufficiently large λ ∈ N, • Zero-Knowledge with Quantum Simulator. negl(·) • Proof of Knowledge with Quantum Extractor. There exists an oracle-aided quantum polynomial-size circuit extractor Ext that simulates a random oracle |O , a constant c, a polynomial p(·), and negligible functions negl0 (·), negl1 (·) such that for every polynomial-size quantum circuit A and every x with associated λ ∈ N satisfying Exti (NIZKPoK in QROM [Unr17, LZ19]). Let Π be a post-quantum sigma protocol (Definition 3.4). The Fiat-Shamir heuristic applied to Π yields a classical post-quantum NIZKPoK in the QROM (Definition 3.11). Theorem 3.12 3.5 Quantum Money (Public Key Quantum Money Mini-Scheme). [AC13, Zha19b] (Gen,Ver) is a public key quantum money scheme if it has the following syntax and properties. Definition 3.13 Syntax. Properties. (Quantum Money from Subspace Hiding Obfuscation [AC13, Zha19b]). Theorem 3.14 If injective one-way functions and post-quantum iO exist, then public-key quantum money exists (Definition 3.13). (Public Key Quantum Money Mini-Scheme in QROM). ( ) is a public key quantum money scheme with respect to a quantum random oracle O if it has the following syntax and properties. Definition 3.15 Gen, Ver Syntax. Properties The unpredicable serial number property is w.l.o.g., just as above. 3.6 Quantum Signature of Knowledge Definition 3.16 (Quantum SimExt-secure Signature [CL06]). Let relation R with corresponding language L be given such that they can be indexed by a security parameter λ ∈ N. Let a message space M be given such that it can be indexed by a security parameter λ ∈ N. NP ( ) is a SimExt-secure quantum signature of knowledge of a witness with respect to L and M if it has the following syntax and properties. Syntax. The input 1 λ is left out when it is clear from context. Setup, Sign, Verify • ( ) ← Setup(1λ ): The probabilistic polynomial-time algorithm Setup on input 1 λ outputs a common reference string and a trapdoor td. crs, td crs • σ ← (1λ , , x, w, m): The polynomial-time quantum algorithm Sign on input a common reference string , an instance and witness pair (x, w) ∈ Rλ, and a message m ∈ Mλ, outputs a signature σ. Sign crs crs • (1λ , crs, x, m, σ) ∈ {0, 1}: The polynomial-time quantum algorithm Verify on input a common reference string crs, an instance x, a message m ∈ Mλ, and a signature σ, outputs 1 iff σ is a valid signature of m with respect to crs, Rλ, and x. Verify Properties.

Unclonable Non-Interactive Zero-Knowledge: Preliminaries

This paper is available on arxiv under CC 4.0 license. Authors: (1) Ruta Jawale; (2) Dakshita Khurana. Table of Links Abstract and Introduction Technical Overview Preliminaries Unclonable Non-Interactive Zero-Knowledge in the CRS Model Unclonable NIZK in the Quantum Ramdon Oracle Model Unclonable Signatures of Knowledge References 2 Technical Overview In this section, we give a high-level overview of our construction and the techniques underlying our main results. 2.1 Unclonable Extractable NIZKs in the CRS Model Our construction assumes the existence of public-key encryption, classical bit commitments where honestly generated commitment strings are perfectly binding, along with • Public-key quantum money mini-scheme (which is known assuming post-quantum iO [Zha19b]). At a high level, public-key quantum money mini-scheme consists of two algorithms: Gen and Ver. Gen on input a security parameter, outputs a quantum banknote |$i along with a classical serial number s. Ver is public, takes a quantum money banknote, and outputs either a classical serial number s, or ⊥ indicating that its input is an invalid banknote. The security guarantee is that no efficient adversary given an honest banknote |$i can output two notes |$1i and |$2i that both pass the verification and have serial numbers equal to that of |$i. • Post-quantum NIZKs for NP, which are known assuming the post-quantum hardness of LWE. These satisfy (besides completeness) (1) soundness, i.e., no efficient prover can generate accepting proofs for false NP statements, and (2) zero-knowledge, i.e., the verifier obtains no information from an honestly generated proof beyond what it could have generated on its own given the NP statement itself. . Given these primitives, the algorithms (Setup, Prove,Verify) of the unclonable extractable NIZK are as follows. Construction SETUP(1λ ): The setup algorithm samples a public key pk, the common reference string crs of a classical (post-quantum) NIZK for NP, along with a perfectly binding, computationally hiding classical commitment to 0 λ with uniform randomness t, i.e. c = Com(0λ ;t). It outputs (pk, crs, c). PROVE: Given the CRS (pk, crs, c), instance x and witness w, output (|$, s, ct, π) where • The state |$ ← Gen is generated as a quantum banknote with associated serial number s. • The ciphertext ct = Encpk(w; u) is an encryption of the witness w with randomness u. • The proof string π is a (post-quantum) NIZK for the following statement using witness (w, u): EITHER (∃w, u : ct = Encpk(w; u) ∧ RL(x, w) = 1) OR (∃r : c = Com(s; r)), where we recall that pk and c were a part of the CRS output by the Setup algorithm. VERIFY: Given CRS (pk, crs, c), instance x and proof (|$, s, ct, π), check that (1) Ver(|$) outputs s and (2) π is an accepting NIZK proof of the statement above. . Completeness, soundness/proof of knowledge and ZK for this construction follow relatively easily, so we focus on unclonable extractability in this overview. Recall that unclonable extractability requires that no adversary, given an honestly generated proof for x ∈ L, can split this into two accepting proofs for x ∈ L (as long as it is hard to find a witness for x). Towards a contradiction, suppose an adversary splits a proof into 2 accepting proofs (|$1i, s1, ct1, π1), (|$2i, s2, ct2, π2). Then, Analysis • If s1 = s2 = s, the adversary given one bank note with serial number s generated two valid banknotes |$i 1 and |$i 2 that both have the same serial number s. This contradicts the security of quantum money. • Otherwise, there is a bit b such that sb 6= s. Then, consider an indistinguishable hybrid where the adversary obtains a simulated proof generated without witness w as follows: (1) sample quantum banknote |$ with serial number s, (2) sample public key pk along with secret key sk, (3) generate c = Com(s;t), ct = Encpk(0; u), (4) generate proof π using witness t (since c = Com(s;t)) instead of using witness w. Send common reference string (pk, crs, c) and proof (|$i, s, ct, π) to the adversary. Now, the proof that the adversary generates with sb 6= s must contain ctb = Encpk(w; u), since c being generated as a commitment to s 6= sb along with the perfect binding property implies that (6∃ r : c = Com(sb; r)). That is, given instance x, the adversary can be used to compute a witness w for x by decrypting ciphertext ctb, thereby contradicting unclonable extractability. Having constructed unclonable extractable arguments in the CRS model, in the next section, we analyze a construction of unclonable extractable arguments in the QROM. 2.2 Unclonable Extractable NIZK in the QROM We now turn our attention to the QRO setting in which we demonstrate a protocol which is provably unclonable. Our construction assumes the existence of public-key quantum money mini-scheme and a post-quantum sigma protocol for NP. A sigma protocol (P,V) is an interactive three-message honest-verifier protocol: the prover sends a commitment message, the verifier sends a uniformly random challenge, and the prover replies by opening its commitment at the locations specified by the random challenge. Construction. The algorithms (PROVE, VERIFY) of the unclonable extractable NIZK in the QROM are as follows. PROVE: Given an instance x and witness w, output (|$, s, α, β, γ) where • The quantum banknote |$ is generated alongside associated serial number s. • P is run to compute the sigma protocol’s commitment message as α given (x, w) as input. • The random oracle is queried on input (α, s, x) in order to obtain a challenge β. • P is run, given as input (x, w, α, β) and its previous internal state, to compute the sigma protocol’s commitment openings as γ. 2.3 Unclonable NIZKs imply Quantum Money Mini-Scheme Finally, we discuss why unclonable NIZKs satisfying even the weaker definition of unclonable security (i.e., w.r.t. hard distributions) imply public-key quantum money mini-scheme. Given an unclonable NIZK, we build a public-key quantum money mini-scheme as follows. Construction. Let(X ,W) be a hard distribution over a language L ∈ NP. Let Π = (Setup, Prove,Verify) be an unclonable NIZK protocol for L. 2.4 Unclonable Signatures of Knowledge Informally, a signature of knowledge has the following property: if an adversary, given a signature of a message m with respect to an instance x, can produce two signatures for m which verify with respect to the same instance x, then the adversary must know (and our extractor will be able to extract) a witness for x. We obtain unclonable signatures of knowledge assuming the existence of an unclonable extractable simulation-extractable NIZK for NP. Simulation-extractability states that an adversary which is provided any number of simulated proofs for instance and witness pairs of their choosing, cannot produce an accepting proof π for an instance x which they have not queried before and where extraction fails to find an accepting witness w. Our unclonable extractable NIZK for NP in the CRS model can, with some extra work, be upgraded to simulation-extractable. We informally describe the construction of signatures of knowledge from such a NIZK below. . Let (Setup, P,V) be non-interactive simulation-extractable, adaptive multi-theorem computational zero-knowledge, unclonable-extractable protocol for NP. Let R be the NP relation corresponding to L. Construction SETUP: The setup algorithm samples a common reference string crs of an unclonable-extractable simulation-extractable NIZK for NP. It outputs crs. SIGN: Given the CRS crs, instance x, witness w, and message m, output signature π where • The proof string π is an unclonable-extractable simulation-extractable NIZK with tag m using witness w of the following statement: (∃w : (x, w) ∈ R). VERIFY: Given CRS crs, instance x, message m, and signature π, check that π is an accepting NIZK proof with tag m of the statement above. Analysis. The simulatability (extractability) property follows from the zero-knowledge (resp. simulation-extractability) properties of the NIZK. Suppose an adversary A given a signature σ was able to forge two signatures σ1 = π1 and σ2 = π2, and, yet, our extractor was to fail to extract a witness w from A. Then, • Either both proofs π1 and π2 are accepting proofs for membership of the same instance w.r.t. crs. However, this contradicts the unclonability of the NIZK. • Otherwise there exists a proof πi (where i ∈ {1, 2}) for an instance which A has not previously seen a proof for. We can switch to a hybrid where our signatures contain simulated proofs for the NIZK. But now, we have that the verifier accepts a proof for an instance which A has not seen a simulated proof for and, yet, we cannot extract a witness from A. This contradicts the simulation extractability of the NIZK. . In Section ??, we define and construct unclonable NIZKs in the CRS model, and in Section 5, in the QROM. Along the way, we also show that unclonable NIZKs imply quantum money (in the CRS and QRO model respectively). Later, we show how to define and construct unclonable signatures of knowledge from unclonable NIZKs in the CRS model. Roadmap

Unclonable Non-Interactive Zero-Knowledge: Technical Overview

This paper is available on arxiv under CC 4.0 license. Authors: (1) Ruta Jawale; (2) Dakshita Khurana. Table of Links Abstract and Introduction Technical Overview Preliminaries Unclonable Non-Interactive Zero-Knowledge in the CRS Model Unclonable NIZK in the Quantum Ramdon Oracle Model Unclonable Signatures of Knowledge References Abstract A non-interactive ZK (NIZK) proof enables verification of NP statements without revealing secrets about them. However, an adversary that obtains a NIZK proof may be able to clone this proof and distribute arbitrarily many copies of it to various entities: this is inevitable for any proof that takes the form of a classical string. In this paper, we ask whether it is possible to rely on quantum information in order to build NIZK proof systems that are impossible to clone. We define and construct unclonable non-interactive zero-knowledge proofs (of knowledge) for NP. Besides satisfying the zero-knowledge and proof of knowledge properties, these proofs additionally satisfy unclonability. Very roughly, this ensures that no adversary can split an honestly generated proof of membership of an instance x in an NP language L and distribute copies to multiple entities that all obtain accepting proofs of membership of x in L. Our result has applications to unclonable signatures of knowledge, which we define and construct in this work; these non-interactively prevent replay attacks. 1 Introduction Zero-knowledge (ZK) [GMR89] proofs allow a prover to convince a verifier about the truth of an (NP) statement, without revealing secrets about it. These are among the most widely used cryptographic primitives, with a rich history of study. . ZK proofs for NP are typically defined via the simulation paradigm. A simulator is a polynomial-time algorithm that mimics the interaction of an adversarial verifier with an honest prover, given only the statement, i.e., x ∈ L, for an instance x of an NP language L. A protocol satisfies zero-knowledge if it admits a simulator that generates a view for the verifier, which is indistinguishable from the real view generated by an honest prover. This captures the intuition that any information obtained by a verifier upon observing an honestly generated proof, could have been generated by the verifier “on its own” by running the simulator. Enhancing Zero-knowledge Despite being widely useful and popular, there are desirable properties of proof systems that (standard) simulation-based security does not capture. For example, consider (distributions over) instances x of an NP language L where it is hard to find an NP witness w corresponding to a given instance x. In an “ideal” world, given just the description of one such NP statement x ∈ L, it is difficult for an adversary to find an NP witness w, and therefore to output any proofs of membership of x ∈ L. And yet, upon obtaining a single proof of membership of x ∈ L, it may suddenly become feasible for an adversary to make many copies of this proof, thereby generating several correct proofs of membership of x ∈ L. Unfortunately, this attack is inevitable for classical non-interactive proofs: given any proof string, an adversary can always make multiple copies of it. And yet, there is hope to prevent such an attack quantumly, by relying on the no-cloning principle. Indeed, a recent series of exciting works have combined cryptography with the no-cloning principle to develop quantum money [Wie83, AC13, FGH+12, Zha19a, Kan18], quantum tokens for digital signatures [BS16], quantum copy-protection [Aar09, AP21, ALL+21, CLLZ21], unclonable encryption [Got03, BL20, AK21, MST21, AKL+22], unclonable decryption [GZ20], one-outof-many unclonable security [KN23], and more. In this work, we combine zero-knowledge and unclonability to address a question first posed by Aaronson [Aar09]: Can we construct unclonable quantum proofs? How do these proofs relate to quantum money or copy-protection? 1.1 Our Results We define and construct unclonable non-interactive zero-knowledge proofs of knowledge (NIZKPoK). We obtain a construction in the common reference string (CRS) model, as well as one in the quantum(-accessible) random oracle model (QROM). The CRS model allows a trusted third-party to set up a structured string that is provided to both the prover and verifier. On the other hand, the QROM allows both parties quantum access to a truly random function O. In what follows, we describe our contributions in more detail. 1.1.1 Definitional Contributions Before discussing how we formalize the concept of unclonability for NIZKs, it will be helpful to define hard distributions over NP instance-witness pairs. . Informally, an efficiently samplable distribution over instance-witness pairs of a language L is a “hard” distribution if given an instance sampled randomly from this distribution, it is hard to find a witness. Then, unclonable security requires that no adversary given an instance x sampled randomly from the distribution, together with an honestly generated proof, can output two accepting proofs of membership of x ∈ L. Hard Distributions over Instance-Witness Pairs More specifically, a hard distribution (X ,W) over RL satisfies the following: for any polynomialsized (quantum) circuit family {Cλ}λ∈N, For the sake of simplifying our subsequent discussions and definitions, let us fix a NP language L with corresponding relation R. Let (X ,W) be some hard distribution over R. For NIZKs satisfying standard completeness, soundness and ZK, we define a simple, natural variant of unclonable security as follows. Informally, a proof system satisfies unclonable security if, given an honest proof for an instance and witness pair (x, w) sampled from a hard distribution (X ,W), no adversary can produce two proofs that verify with respect to x except with negligible probability. A Weaker Definition: Unclonable Security. (Unclonable Security of NIZK). A NIZK proof (Setup, Prove,Verify) satisfies unclonable security if for every language L and every hard distribution (X ,W) over RL, for every poly-sized circuit family {Cλ}λ∈N, Definition 1.1. In the definition above, we aim to capture the intuition that one of the two proofs output by the adversary can be the honest proof they received, but the adversary cannot output any other correct proof for the same statement. Of course, such a proof is easy to generate if the adversary is able to find the witness w for x, which is exactly why we require hardness of the distribution (X ,W) to make the definition non-trivial. We also remark that unclonable security of proofs necessitates that the proof π keep hidden any witnesses w certifying membership of x in L, as otherwise an adversary can always clone the proof π by generating (from scratch) another proof for x given the witness w. A Stronger Definition: Unclonable Extractability. We can further strengthen the definition above to require that any adversary generating two (or more) accepting proofs of membership of x ∈ L given a single proof, must have generated one of the two proofs “from scratch” and must therefore “know” a valid witness w for x. This will remove the need to refer to hard languages. In more detail, we will say that a proof system satisfies unclonable extractability if, from any adversary A that on input a single proof of membership of x ∈ L outputs two proofs for x, then we can extract a valid witness w from A for at least one of these statements with high probability. Our (still, simplified) definition of unclonable extractability is as follows. (Unclonable Extractability.). A proof (Setup, Prove,Verify) satisfies unclonable security there exists a QPT extractor E which is an oracle-aided circuit such that for every language L with corresponding relation RL and for every non-uniform polynomial-time quantum adversary A, for every instance-witness pair (x, w) ∈ RL and λ = λ(|x|), such that there is a polynomial p(·) satisfying: Definition 1.2 there is also a polynomial q(·) such that In fact, in the technical sections, we further generalize this definition to consider a setting where the adversary obtains an even larger number (say k−1) input proofs on instances x1, . . . , xk−1, and outputs k or more proofs. Then we require the extraction of an NP witness corresponding to any proofs that attempt to “clone” honestly generated proofs (i.e. the adversary outputs two or more proofs w.r.t. the same instance xi ∈ {x1, . . . , xk−1}). All our theorem statements hold w.r.t. this general definition. Finally, we also consider definitions and constructions in the quantum-accessible random oracle model (QROM); these are natural generalizations of the definitions above, so we do not discuss them here. We also show that the latter definition of unclonable extractability implies the former, i.e. unclonable security. Informally, this follows because the extractor guaranteed by the definition of extractability is able to obtain a witness w for x from any adversary, which contradicts hardness of the distribution (X ,W). We refer the reader to Appendix A for a formal proof of this claim. 1.1.2 Realizations of Unclonable NIZK, and Relationship with Quantum Money We obtain realizations of unclonable NIZKs in both the common reference string (CRS) and the quantum random oracle (QRO) models, assuming public-key quantum money mini-scheme and other (post-quantum) standard assumptions. We summarize these results below. (Informal). Theorem 1.3 Assuming public-key quantum money mini-scheme, public-key encryption, perfectly binding and computationally hiding commitments, and adaptively sound NIZK proofs for NP, there exists an unclonable NIZKPoK scheme in the CRS model. (Informal). Theorem 1.4 Assuming public-key quantum money mini-scheme and honest verifier zeroknowledge proofs of knowledge (HVZKPoKs) for NP, there exists an unclonable NIZKPoK scheme in the QROM. (Informal). Theorem 1.5 Assuming public-key quantum money mini-scheme, public-key encryption, postquantum perfectly binding and computationally hiding commitments, and simulation-sound NIZK proofs for NP, there exists an unclonable signature of knowledge in the CRS model. Our work builds unclonable NIZKs for NP by relying on any (public-key) quantum money scheme (mini-scheme), in conjuction with other assumptions such as NIZKs for NP. Since constructions of public-key quantum money minischeme are only known based on post-quantum indistinguishability obfuscation [AC13, Zha19b], it is natural to wonder whether the reliance on quantum money is inherent. We show that this is indeed the case, by proving that unclonable NIZKs in fact imply public-key quantum money mini-scheme. Is Quantum Money necessary for Unclonable NIZKs? (Informal). Theorem 1.6 Unclonable NIZKs for NP imply public-key quantum money mini-scheme. 1.1.3 Applications A (classical) signature scheme asserts that a message m has been signed on behalf of a public key pk. However, in order for this signature to be authenticated, the public key pk must be proven trustworthy through a certification chain rooted at a trusted public key PK. However, as [CL06] argue, this reveals too much information; it should be sufficient for the recipient to only know that there exists a public key pk with a chain of trust from PK. To solve this problem, [CL06] propose signatures of knowledge which allow a signer to sign on behalf of an instance x of an NP-hard language without revealing its corresponding witness w. Such signatures provide an anonymity guarantee by hiding the pk of the sender. Unclonable Signatures of Knowledge. While this is ideal for many applications, anonymity presents the following downside: a receiver cannot determine whether they were the intended recipient of this signature. In particular, anonymous signatures are more susceptible to replay attacks. Replay attacks are a form of passive attack whereby an adversary observes a signature and retains a copy. The adversary then leverages this signature, either at a later point in time or to a different party, to impersonate the original signer. The privacy and financial consequences of replay attacks are steep. They can lead to data breach attacks which cost millions of dollars annually and world-wide [IBM23]. In this work, we construct a signature of knowledge scheme which is the first non-interactive signature in the CRS model that is naturally secure against replay attacks. Non-interactive, replay attack secure signatures have seen a lot of recent interest including a line of works in the bounded quantum storage model [BS23b] and the quantum random oracle model [BS23a]. Our construction is in the CRS model and relies on the hardness of NP problems, plausible cryptographic assumptions, and the axioms of quantum mechanics. We accomplish this by defining unclonable signatures of knowledge: if an adversary, given a signature of a message m with respect to an instance x, can produce two signatures for m which verify with respect to the same instance x, then our extractor is able to extract a witness for x. Our construction involves showing that an existing compiler can be augmented using unclonable NIZKs to construct unclonable signatures of knowledge. The authors of [CL06] construct signatures of knowledge from CPA secure dense cryptosystems [SP92, SCP00] and simulationsound NIZKs for NP [Sah99, SCO+01]. Signatures of knowledge are signature schemes in the CRS model for which we associate an instance x in a language L. This signature is simulatable, so there exists a simulator which can create valid signatures without knowledge of a witness for x. Additionally, the signature is extractable which means there is an extractor which is given a trapdoor for the CRS and a signature, and is able to produce a witness for x. We show that, by switching the simulation-sound NIZKs for unclonable simulation-extractable NIZKs (and slightly modifying the compiler), we can construct unclonable signatures of knowledge. . A recent exciting line of work obtains certified deletion for time-lock puzzles [Unr14], non-local games [FM18], information-theoretic proofs of deletion with partial security [CW19], encryption schemes [BI20, BK23], device-independent security of one-time pad encryption with certified deletion [KT20], public-key encryption with certified deletion [HMNY21], commitments and zero-knowledge with certified everlasting hiding [HMNY22], and fully-homomorphic encryption with certified deletion [Por22, BK23, BKP23, BGG+23]. While certified everlasting deletion of secrets has been explored in the context of interactive zero-knowledge proofs [HMNY22], there are no existing proposals for non-interactive ZK satisfying variants of certified deletion. Our work provides a pathway to building such proofs. Relationship with Revocation In this work, we construct a quantum revocable anonymous credentials protocol by way of the hardness of NP problems, plausible cryptographic assumptions, and the axioms of quantum mechanics. Our work follows a line of work on (classical) revocation for anonymous credentials schemes [BCC+09, CKS10, AN11]. In particular, our construction involves noting that NIZK proof systems that are unclonable can also be viewed as supporting a form of certified deletion/revocation, where in order to delete, an adversary must simply return the entire proof. In other words, the (quantum) certificate of deletion is the proof itself, and this certificate can be verified by running the NIZK verification procedure on the proof. The unclonability guarantee implies that an adversary cannot keep with itself or later have the ability to generate another proof for the same instance x. In the other direction, in order to offer certifiable deletion, a NIZK must necessarily be unclonable. To see why, note that if there was an adversary who could clone the NIZK, we could use this adversary to obtain two copies, and provably delete one of them. Even though the challenger for the certifiable deletion game would be convinced that its proof was deleted, we would still be left with another correct proof. 1.2 Related Works This work was built upon the foundations of and novel concepts introduced by prior literature. We will briefly touch upon some notable such results in this section. Unclonable encryption [Got03, BL20, AK21, MST21, AKL+22] imagines an interaction between three parties in which one party receives a quantum ciphertext and splits this ciphertext in some manner between the two remaining parties. At some later point, the key of the encryption scheme is revealed, yet both parties should not be able to simultaneouly recover the underlying message. While our proof systems share the ideology of unclonability, we do not have a similar game-based definition of security. This is mainly due to proof systems offering more structure which can take advantage of to express unclonability in terms of simulators and extractors. Unclonable Encryptions. Prior work [BS17] defines and constructs signature tokens which are signatures which involve a quantum signing token which can only be used once before it becomes inert. The setting they consider is where a client wishes to delegate the signing process to a server, but does not wish the server to be able to sign more than one message. They rely on quantum money [AC13] and the no-cloning principle to ensure the signature can only be computed once. For our unclonable signatures of knowledge result, we focus on the setting where a client wishes to authenticate themselves to a server and wants to prevent an adversary from simultaneously, or later, masquerading as them. Signature Tokens. The authors of [AGKZ20] introduce the notion of one-shot signatures which extend the concept of signature tokens to a scenario where the client and server only exchange classical information to create a one-use quantum signature token. They show that these signatures can be plausibly constructed in the CRS model from post-quantum indistinguishability obfuscation. Unless additional measures for security, which we discussed in our applications section, are employed, classical communication can be easily copied and replayed at a later point. In contrast, we prevent an adversary from simultaneously, or later, authenticating with the client’s identity. One-shot Signatures. Our QROM results are heavily inspired by the recent post-quantum Fiat-Shamir result [LZ19] which proves the post-quantum security of NIZKs in the compressed quantum(-accessible) random oracle model (compressed QROM). These classical NIZKs are the result of applying Fiat-Shamir to post-quantum sigma protocols which are HVZKPoKs. We further extend, and crucially rely upon, their novel proof techniques to prove extractability (for PoK) and programmability (for ZK) to achieve extractability and programmability for some protocols which output quantum proofs. Post-quantum Fiat-Shamir.

Unclonable Non-Interactive Zero-Knowledge: Abstract and Introduction

Combination of Abstractive & Extractive methods for Text Summarization (Tutorial 7)

The New Hollywood leader and one of the world’s most powerful brands just joined forces in a deal that elevates live sports on connected TV (CTV) and hammers another nail in the coffin of linear TV. Netflix announced that it will stream the NFL’s two Christmas Day games in 2024. This marks the beginning of a three-season agreement, during which the streaming service will also air at least one Christmas Day game in both 2025 and 2026. The games will also air on broadcast TV in the competing team cities, and they be available on U.S. mobile devices with NFL+. The Rise of Live Sports on CTV The live sports industry is the last bastion of linear TV viewing. But the world is changing fast. About half of U.S. audiences no longer pay for cable TV or other traditional pay TV services, according to Insider Intelligence. About four out of 10 viewers mainly consume sports content through ad-supported CTV platforms or social media, according to Trade Desk’s Future of TV Report. Streaming services have been gobbling up live sports content over the past few years, ranging from Amazon’s and Peacock’s deals to stream NFL games to Netflix acquiring rights for the WWE. And competition is heating up. A recently announced venture between ESPN, Fox, and Warner Bros. Discovery may account for about 55% of U.S. sports rights, according to Citi analysts. All Hail the NFL Netflix, a Johnny-come-lately to live sports, has good reason to cozy up to the NFL. The NFL dominates television and drives culture. Nielsen says the NFL accounted for a 93 of the 100 most-watched TV broadcasts in 2023. The NFL has wisely sensed and responded to the rise of CTV, agreeing to air games with a variety of streaming companies, among them Amazon Prime, Paramount+, Peacock, and YouTube TV. Thursday Night Football games on Amazon Prime and a Black Friday game (the first ever) in 2024 have delivered ratings and advertising gold. The league created controversy by streaming a 2024 wild card playoff game on Peacock exclusively, which shut out viewers who lacked a Peacock subscription. But the decision delivered numbers: 23 million total viewers, according to Nielsen. NBC said that the game set a record for the most-streamed live event in U.S. history. And Super Bowl LVIII on February 11 game attracted an average viewership of 123.4 million, setting a new record for the most-watched television broadcast in history. Out of this audience, 112 million viewers watched the game on CBS. The remaining viewership was distributed among Paramount+, Nickelodeon, Univision, CBS Sports, and various NFL digital platforms, including NFL+. All Eyes on Amazon The NFL is clearly just getting warmed up. The 2024-25 season will include a game in Brazil streaming exclusively on Peacock. The September 6 game will be the first NFL game played in South America and the second game to air exclusively on Peacock. A playoff wild card game will air on Amazon Prime Video. Amazon streaming a playoff game is especially intriguing. The experience will most certainly be different than the one Peacock featured and speaks to CTV’s potential for changing how people experience live sports. For one thing, Amazon will use the game to test Amazon Ad targeting features as it did with the Black Friday game when Amazon rolled out a new strategy called audience-based creative, allowing advertisers to target different audience segments with different ads in the same time slot.Amazon will also inject commerce into the game-watching experience. Amazon already offers deals for Amazon Prime customers associated with Thursday Night Football, and Amazon really ramped up shopping deals during the 2023 Black Friday game (including limited time deals along with plenty of shoppable ads).Amazon also provides several interactive features to enhance the TV viewing experience, such as X-Ray, which gives fans real-time access to live statistics and data. A feature called the 4th Down Decision Guide offers fans the opportunity to step into the role of NFL coaches during critical moments. It poses the question: should a team attempt to advance on fourth down or opt for a punt? Using machine learning, this tool assesses the success rates of both choices and evaluates their impact on the team's chances of winning the game. These kinds of features (and a lot more) are not gimmicks -- they make watching the game more of an experience. Essentially, Amazon and the NFL are reinventing Black Friday as a hybrid shopping and entertainment experience -- enticing people to stay online and watch football on a day when they’re usually out shopping was at one time unthinkable. The game garnered an average of 9.61 million viewers who watched the Miami Dolphins crush the New York Jets on Amazon Prime Video.The ratings were lower than expected. But Amazon’s first NFL outing with Thursday Night Football underwhelmed at first, too, and now things have turned around. And as Columbia University sports management professor Joe Favorito told The Street, "If you would have said to someone nine million people on the Friday after Thanksgiving are going to watch a streamed NFL game three years ago, people [would] have been jumping up and down." Amazon’s relationship with the NFL will also challenge Netflix to deliver something more experiential especially because Amazon is already creating the state of the art in CTV live sports. I expect Netflix will share more details of its own in coming weeks. A Christmas Advertising Bonanza? Christmas Day marks the NFL’s continued expansion into holiday sports viewing. The NFL averaged 28.4 million viewers across its three games on Christmas Day last season (compare that to the NBA, which averaged 2.8 million across its five games). According to the NFL, last year’s three Christmas games ranking among the top 25 most viewed TV programs of 2023. Analyst Guggenheim predicts that these games will bring in approximately $185 million in direct advertising revenue. This figure is in addition to potential increases in subscriber growth, engagement, or promotional benefits. Such a boost would signify a 15.7% increase over the firm’s existing 2024 advertising forecast of $1.18 billion. I’ve said it before, and I’ll say it again: the day is coming when the Super Bowl will move to CTV. Which New Hollywood business will win that prize? NFL photo by Photo by Adrian Curiel on Unsplash. Netflix photo by Alexander Shatov on Unsplash. The New Hollywood leader and one of the world’s most powerful brands just joined forces in a deal that elevates live sports on connected TV (CTV) and hammers another nail in the coffin of linear TV. Netflix announced that it will stream the NFL’s two Christmas Day games in 2024 . This marks the beginning of a three-season agreement, during which the streaming service will also air at least one Christmas Day game in both 2025 and 2026. stream the NFL’s two Christmas Day games in 2024 The games will also air on broadcast TV in the competing team cities, and they be available on U.S. mobile devices with NFL+. The Rise of Live Sports on CTV The Rise of Live Sports on CTV The live sports industry is the last bastion of linear TV viewing. But the world is changing fast. About half of U.S. audiences no longer pay for cable TV or other traditional pay TV services , according to Insider Intelligence. About four out of 10 viewers mainly consume sports content through ad-supported CTV platforms or social media , according to Trade Desk’s Future of TV Report. About half of U.S. audiences no longer pay for cable TV or other traditional pay TV services About half of U.S. audiences no longer pay for cable TV or other traditional pay TV services About four out of 10 viewers mainly consume sports content through ad-supported CTV platforms or social media About four out of 10 viewers mainly consume sports content through ad-supported CTV platforms or social media Streaming services have been gobbling up live sports content over the past few years, ranging from Amazon’s and Peacock’s deals to stream NFL games to Netflix acquiring rights for the WWE. And competition is heating up. A recently announced venture between ESPN, Fox, and Warner Bros. Discovery may account for about 55% of U.S. sports rights , according to Citi analysts. may account for about 55% of U.S. sports rights may account for about 55% of U.S. sports rights All Hail the NFL All Hail the NFL Netflix, a Johnny-come-lately to live sports, has good reason to cozy up to the NFL. The NFL dominates television and drives culture. Nielsen says the NFL accounted for a 93 of the 100 most-watched TV broadcasts in 2023 . The NFL has wisely sensed and responded to the rise of CTV, agreeing to air games with a variety of streaming companies, among them Amazon Prime, Paramount+, Peacock, and YouTube TV. Thursday Night Football games on Amazon Prime and a Black Friday game (the first ever) in 2024 have delivered ratings and advertising gold. NFL accounted for a 93 of the 100 most-watched TV broadcasts in 2023 NFL accounted for a 93 of the 100 most-watched TV broadcasts in 2023 The league created controversy by streaming a 2024 wild card playoff game on Peacock exclusively, which shut out viewers who lacked a Peacock subscription. But the decision delivered numbers: 23 million total viewers, according to Nielsen. NBC said that the game set a record for the most-streamed live event in U.S. history . NBC said that the game set a record for the most-streamed live event in U.S. history NBC said that the game set a record for the most-streamed live event in U.S. history And Super Bowl LVIII on February 11 game attracted an average viewership of 123.4 million, setting a new record for the most-watched television broadcast in history . Out of this audience, 112 million viewers watched the game on CBS. The remaining viewership was distributed among Paramount+, Nickelodeon, Univision, CBS Sports, and various NFL digital platforms, including NFL+. setting a new record for the most-watched television broadcast in history setting a new record for the most-watched television broadcast in history All Eyes on Amazon The NFL is clearly just getting warmed up. The 2024-25 season will include a game in Brazil streaming exclusively on Peacock. The September 6 game will be the first NFL game played in South America and the second game to air exclusively on Peacock. A playoff wild card game will air on Amazon Prime Video. Amazon streaming a playoff game is especially intriguing. The experience will most certainly be different than the one Peacock featured and speaks to CTV’s potential for changing how people experience live sports. For one thing, Amazon will use the game to test Amazon Ad targeting features as it did with the Black Friday game when Amazon rolled out a new strategy called audience-based creative, allowing advertisers to target different audience segments with different ads in the same time slot. Amazon will also inject commerce into the game-watching experience. Amazon already offers deals for Amazon Prime customers associated with Thursday Night Football, and Amazon really ramped up shopping deals during the 2023 Black Friday game (including limited time deals along with plenty of shoppable ads). Amazon also provides several interactive features to enhance the TV viewing experience, such as X-Ray, which gives fans real-time access to live statistics and data. A feature called the 4th Down Decision Guide offers fans the opportunity to step into the role of NFL coaches during critical moments. It poses the question: should a team attempt to advance on fourth down or opt for a punt? Using machine learning, this tool assesses the success rates of both choices and evaluates their impact on the team's chances of winning the game. These kinds of features (and a lot more) are not gimmicks -- they make watching the game more of an experience. Essentially, Amazon and the NFL are reinventing Black Friday as a hybrid shopping and entertainment experience -- enticing people to stay online and watch football on a day when they’re usually out shopping was at one time unthinkable. The game garnered an average of 9.61 million viewers who watched the Miami Dolphins crush the New York Jets on Amazon Prime Video. The ratings were lower than expected. But Amazon’s first NFL outing with Thursday Night Football underwhelmed at first, too, and now things have turned around. And as Columbia University sports management professor Joe Favorito told The Street, "If you would have said to someone nine million people on the Friday after Thanksgiving are going to watch a streamed NFL game three years ago, people [would] have been jumping up and down." Amazon’s relationship with the NFL will also challenge Netflix to deliver something more experiential especially because Amazon is already creating the state of the art in CTV live sports. I expect Netflix will share more details of its own in coming weeks. A Christmas Advertising Bonanza? A Christmas Advertising Bonanza? Christmas Day marks the NFL’s continued expansion into holiday sports viewing. The NFL averaged 28.4 million viewers across its three games on Christmas Day last season (compare that to the NBA, which averaged 2.8 million across its five games). According to the NFL, last year’s three Christmas games ranking among the top 25 most viewed TV programs of 2023 . The NFL averaged 28.4 million viewers across its three games on Christmas Day last season The NFL averaged 28.4 million viewers across its three games on Christmas Day last season last year’s three Christmas games ranking among the top 25 most viewed TV programs of 2023 last year’s three Christmas games ranking among the top 25 most viewed TV programs of 2023 Analyst Guggenheim predicts that these games will bring in approximately $185 million in direct advertising revenue . This figure is in addition to potential increases in subscriber growth, engagement, or promotional benefits. Such a boost would signify a 15.7% increase over the firm’s existing 2024 advertising forecast of $1.18 billion. $185 million in direct advertising revenue $185 million in direct advertising revenue I’ve said it before, and I’ll say it again: the day is coming when the Super Bowl will move to CTV. Which New Hollywood business will win that prize? NFL photo by Photo by Adrian Curiel on Unsplash. Netflix photo by Alexander Shatov on Unsplash. NFL photo by Photo by Adrian Curiel on Unsplash. Netflix photo by Alexander Shatov on Unsplash.

Goodbye, Linear TV: Netflix to Stream NFL Christmas Games in 2024

বিদায়, লিনিয়ার টিভি: 2024 সালে এনএফএল ক্রিসমাস গেমস স্ট্রিম করবে Netflix

Auf Wiedersehen, lineares Fernsehen: Netflix überträgt NFL-Weihnachtsspiele im Jahr 2024

Adiós, Linear TV: Netflix transmitirá los juegos navideños de la NFL en 2024

Au revoir, télévision linéaire : Netflix diffusera les matchs de Noël de la NFL en 2024

अलविदा, लीनियर टीवी: नेटफ्लिक्स 2024 में एनएफएल क्रिसमस गेम्स स्ट्रीम करेगा

さようなら、リニアテレビ：Netflix が 2024 年に NFL クリスマス ゲームをストリーミング配信

안녕, Linear TV: Netflix, 2024년에 NFL 크리스마스 게임 스트리밍 예정

Adeus, Linear TV: Netflix transmitirá jogos de Natal da NFL em 2024

Прощай, линейное телевидение: Netflix будет транслировать рождественские игры НФЛ в 2024 году

Elveda Linear TV: Netflix, 2024'te NFL Noel Oyunlarını Yayınlayacak

Tạm biệt, Truyền hình tuyến tính: Netflix sẽ phát trực tuyến các trò chơi Giáng sinh của NFL vào năm 2024

再见，线性电视：Netflix 将于 2024 年播放 NFL 圣诞比赛

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction
Formal Model - Rollups with Decentralized Common Pool (DCP)
Atomic composability & ZK-proofs
Incorporating Zk-proofs
Application of the Formal Model
Conclusion and References 3 Atomic composability & ZK-proofs Zero-Knowledge Proofs (zk-proofs), particularly zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) and zk-STARKs (Zero-Knowledge Scalable Transparent Argument of Knowledge), are cryptographic methods that allow one party to prove to another party that a statement is true, without revealing any specific information beyond the validity of the statement itself [1, 2]. For atomic composability across rollups, zk-proofs can be exceptionally beneficial. Let’s explore how: 3.1 Transaction Validation zk-proofs can be utilized to validate that a transaction on one rollup adheres to specific conditions, without actually revealing the contents of the transaction. This is especially useful for maintaining privacy across rollups while still ensuring that conditions are met [6]. 3.2 Dependency Verification If one transaction depends on another from a different rollup, zk-proofs can be utilized to validate the successful execution and correctness of the dependent transaction, again, without revealing the actual transaction details [7]. 3.3 Concurrency and Aggregate Dependencies zk-proofs can be crafted to provide proofs of concurrent transaction executions or aggregate transaction conditions (like total transaction value across multiple rollups) being met, all without revealing specific transaction details [12]. 3.4 Compactness and Efficiency zk-proofs, especially zk-SNARKs, have the advantage of being succinct. That means, irrespective of the amount of data or the number of transactions they’re validating, the proof size remains relatively small and verification is swift. This feature can be immensely beneficial in a system with multiple rollups, where swift validations are essential [10]. This paper is available on arxiv under CC 4.0 license. Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Incorporating Zk-proofs Application of the Formal Model Conclusion and References Abstract and Introduction Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Atomic composability & ZK-proofs Incorporating Zk-proofs Incorporating Zk-proofs Application of the Formal Model Application of the Formal Model Conclusion and References Conclusion and References 3 Atomic composability & ZK-proofs Zero-Knowledge Proofs (zk-proofs), particularly zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) and zk-STARKs (Zero-Knowledge Scalable Transparent Argument of Knowledge), are cryptographic methods that allow one party to prove to another party that a statement is true, without revealing any specific information beyond the validity of the statement itself [1, 2]. For atomic composability across rollups, zk-proofs can be exceptionally beneficial. Let’s explore how: 3.1 Transaction Validation 3.1 Transaction Validation zk-proofs can be utilized to validate that a transaction on one rollup adheres to specific conditions, without actually revealing the contents of the transaction. This is especially useful for maintaining privacy across rollups while still ensuring that conditions are met [6]. 3.2 Dependency Verification 3.2 Dependency Verification If one transaction depends on another from a different rollup, zk-proofs can be utilized to validate the successful execution and correctness of the dependent transaction, again, without revealing the actual transaction details [7]. 3.3 Concurrency and Aggregate Dependencies 3.3 Concurrency and Aggregate Dependencies zk-proofs can be crafted to provide proofs of concurrent transaction executions or aggregate transaction conditions (like total transaction value across multiple rollups) being met, all without revealing specific transaction details [12]. 3.4 Compactness and Efficiency 3.4 Compactness and Efficiency zk-proofs, especially zk-SNARKs, have the advantage of being succinct. That means, irrespective of the amount of data or the number of transactions they’re validating, the proof size remains relatively small and verification is swift. This feature can be immensely beneficial in a system with multiple rollups, where swift validations are essential [10].

Towards Universal Atomic Composability: Atomic composability & ZK-proofs

The Top Three Pros and Cons of Artificial Intelligence

9 Common Technical SEO Issues and How to Fix Them - Beginners' Guide

Authors: (1) Jonathan H. Rystrøm. Table of Links Abstract and Introduction Previous Literature Methods and Data Results Discussions Conclusions and References A. Validation of Assumptions B. Other Models C. Pre-processing steps 6 Conclusion Understanding how recommender systems shape our behaviour is essential to avoid manipulation. In this paper, we investigated the Amazon recommender system concerning whether it has made it harder to change preferences. By analysing the Barrier-to-Exit (Rakova & Chowdhury, 2019) of more than 50,000 users, we found a highly significant growth in Barrier-to-Exit over time, which indicates that it has indeed become harder to change preferences for the analysed users. However, sampling bias induced by the calculation of Barrier-to-Exit makes it difficult to draw conclusions about the general population of Amazon customers. This highlights the dilemma of portability in measuring socio-technical systems (Selbst et al., 2019): accurately evaluating a concept like ”changing preferences” requires adapting to the context of the system, which makes it more difficult to generalise (and compare) to other systems. Comparing recommender systems is necessary for ensuring that these respect human autonomy (Varshney, 2020) and live up to new regulations such as the EU AI Act (Kop, 2021). Further work, should aim to create auditing procedures and metrics that allow third parties to measure potential preference manipulation in a way that fits within the context of the industry and allows for comparisons between different systems. This will help assess the pressures of Surveillance Capitalism (Zuboff, 2019) on human autonomy. References Baayen, R. H., Davidson, D. J., & Bates, D. M. (2008). Mixed-effects modeling with crossed random effects for subjects and items. Journal of memory and language, 59 (4), 390–412. (Publisher: Elsevier) Barto´n, K. (2022, September). MuMIn: Multi-Model Inference. Retrieved 2023-01-08, from https://CRAN.R-project .org/package=MuMIn Bates, D., M¨achler, M., Bolker, B., & Walker, S. (2014, June). Fitting Linear Mixed-Effects Models using lme4. arXiv. Retrieved 2023-01-12, from http://arxiv.org/abs/1406.5823 (arXiv:1406.5823 [stat]) Bennett, J., & Lanning, S. (2007). The netflix prize. In Proceedings of KDD cup and workshop (Vol. 2007, p. 35). New York. urrell, J. (2016, June). How the machine ‘thinks’: Understanding opacity in machine learning algorithms. Big Data & Society, 3 (1), 2053951715622512. Retrieved 2022-10-11, from https://ezproxy-prd.bodleian.ox.ac.uk:2246/doi/full/10.1177/2053951715622512 (Publisher: SAGE Publications Ltd) doi: 10.1177/ 2053951715622512 Calvo, R. A., Peters, D., Vold, K., & Ryan, R. M. (2020). Supporting Human Autonomy in AI Systems: A Framework for Ethical Enquiry. In C. Burr & L. Floridi (Eds.), Ethics of Digital Well-Being: A Multidisciplinary Approach (pp. 31–54). Cham: Springer International Publishing. Retrieved 2022-08-16, from https://doi.org/10.1007/ 978-3-030-50585-1 2 doi: 10.1007/978-3-030-50585-1 2 Carroll, M. D., Dragan, A., Russell, S., & Hadfield-Menell, D. (2022). Estimating and penalizing induced preference shifts in recommender systems. In International Conference on Machine Learning (pp. 2686–2708). PMLR. Feng, C., Wang, H., Lu, N., Chen, T., He, H., Lu, Y., & Tu, X. M. (2014, April). Log-transformation and its implications for data analysis. Shanghai Archives of Psychiatry, 26 (2), 105–109. Retrieved 2023-01-10, from https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4120293/ doi: 10.3969/j.issn.1002-0829.2014.02.009 Floridi, L., Holweg, M., Taddeo, M., Amaya Silva, J., M¨okander, J., & Wen, Y. (2022, March). capAI - A Procedure for Conducting Conformity Assessment of AI Systems in Line with the EU Artificial Intelligence Act (SSRN Scholarly Paper No. ID 4064091). Rochester, NY: Social Science Research Network. Retrieved 2022-04-01, from https://papers.ssrn.com/abstract=4064091 doi: 10.2139/ssrn.4064091 Fox, J. (2003). Effect Displays in R for Generalised Linear Models. Journal of Statistical Software, 8 (15). Retrieved 2023-01-10, from http://www.jstatsoft.org/v08/i15/ doi: 10.18637/jss.v008.i15 Fox, J. (2015). Applied regression analysis and generalized linear models. Sage Publications. Franklin, M., Ashton, H., Gorman, R., & Armstrong, S. (2022, May). Missing Mechanisms of Manipulation in the EU AI Act. The International FLAIRS Conference Proceedings, 35 . Retrieved 2022-12-31, from https:// journals.flvc.org/FLAIRS/article/view/130723 doi: 10.32473/flairs.v35i.130723 Gebru, T., Morgenstern, J., Vecchione, B., Vaughan, J. W., Wallach, H., Daum´e III, H., & Crawford, K. (2021, December). Datasheets for Datasets. arXiv. Retrieved 2022-10-20, from http://arxiv.org/abs/1803.09010 (arXiv:1803.09010 [cs]) Ghasemi, A., & Zahediasl, S. (2012, December). Normality Tests for Statistical Analysis: A Guide for NonStatisticians. International Journal of Endocrinology and Metabolism, 10 (2), 486–489. Retrieved 2023-01-11, from https://brief.land/ijem/articles/71904.html doi: 10.5812/ijem.3505 Gorelick, M., & Ozsvald, I. (2020). High performance Python: practical performant programming for humans (Second edition ed.). Beijing [China] ; Boston [MA]: O’Reilly. Harper, F. M., & Konstan, J. A. (2016, January). The MovieLens Datasets: History and Context. ACM Transactions on Interactive Intelligent Systems, 5 (4), 1–19. Retrieved 2022-12-29, from https://dl.acm.org/doi/10.1145/ 2827872 doi: 10.1145/2827872 Harris, C. R., Millman, K. J., van der Walt, S. J., Gommers, R., Virtanen, P., Cournapeau, D., . . . Oliphant, T. E. (2020, September). Array programming with NumPy. Nature, 585 (7825), 357–362. Retrieved 2021-12-27, from https://www.nature.com/articles/s41586-020-2649-2 doi: 10.1038/s41586-020-2649-2 Jannach, D., & Adomavicius, G. (2016, September). Recommendations with a Purpose. In Proceedings of the 10th ACM Conference on Recommender Systems (pp. 7–10). Boston Massachusetts USA: ACM. Retrieved 2022-09-01, from https://dl.acm.org/doi/10.1145/2959100.2959186 doi: 10.1145/2959100.2959186 Jiang, R., Chiappa, S., Lattimore, T., Gy¨orgy, A., & Kohli, P. (2019, January). Degenerate Feedback Loops in Recommender Systems. In Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society (pp. 383–390). Honolulu HI USA: ACM. Retrieved 2022-09-07, from https://dl.acm.org/doi/10.1145/3306618 .3314288 doi: 10.1145/3306618.3314288 Kipf, T. N., & Welling, M. (2017, February). Semi-Supervised Classification with Graph Convolutional Networks. arXiv. Retrieved 2022-12-14, from http://arxiv.org/abs/1609.02907 (arXiv:1609.02907 [cs, stat]) Knijnenburg, B. P., Reijmer, N. J., & Willemsen, M. C. (2011, October). Each to his own: how different users call for different interaction methods in recommender systems. In Proceedings of the fifth ACM conference on Recommender systems (pp. 141–148). New York, NY, USA: Association for Computing Machinery. Retrieved 2023-01-11, from https://doi.org/10.1145/2043932.2043960 doi: 10.1145/2043932.2043960 Kop, M. (2021, November). EU Artificial Intelligence Act: The European Approach to AI. , 11. Kuznetsova, A., Brockhoff, P. B., & Christensen, R. H. B. (2017). lmerTest package: tests in linear mixed effects models. Journal of statistical software, 82 (13). (Publisher: The Foundation for Open Access Statistics) Lam, S. K., Pitrou, A., & Seibert, S. (2015). Numba: A llvm-based python jit compiler. In Proceedings of the Second Workshop on the LLVM Compiler Infrastructure in HPC (pp. 1–6). Ledwich, M., & Zaitsev, A. (2019). Algorithmic extremism: Examining YouTube’s rabbit hole of radicalization. arXiv preprint arXiv:1912.11211 . Leino, J., & R¨aih¨a, K.-J. (2007, October). Case amazon: ratings and reviews as part of recommendations. In Proceedings of the 2007 ACM conference on Recommender systems (pp. 137–140). New York, NY, USA: Association for Computing Machinery. Retrieved 2023-01-08, from https://doi.org/10.1145/1297231.1297255 doi: 10.1145/1297231.1297255 Linden, G., Smith, B., & York, J. (2003). Amazon. com recommendations: Item-to-item collaborative filtering. IEEE Internet computing, 7 (1), 76–80. (Publisher: Ieee) Maddala, G. S. (1971, March). The Use of Variance Components Models in Pooling Cross Section and Time Series Data. Econometrica, 39 (2), 341. Retrieved 2023-01-11, from https://www.jstor.org/stable/1913349 ?origin=crossref doi: 10.2307/1913349 McAuley, J., Targett, C., Shi, Q., & Hengel, A. v. d. (2015, June). Image-based Recommendations on Styles and Substitutes. arXiv. Retrieved 2022-12-29, from http://arxiv.org/abs/1506.04757 (arXiv:1506.04757 [cs]) McKinney, W. (2011). pandas: a foundational Python library for data analysis and statistics. Python for high performance and scientific computing, 14 (9), 1–9. (Publisher: Seattle) Millecamp, M., Htun, N. N., Jin, Y., & Verbert, K. (2018). Controlling spotify recommendations: effects of personal characteristics on music recommender user interfaces. In Proceedings of the 26th Conference on user modeling, adaptation and personalization (pp. 101–109). Nakagawa, S., Johnson, P. C., & Schielzeth, H. (2017). The coefficient of determination R 2 and intra-class correlation coefficient from generalized linear mixed-effects models revisited and expanded. Journal of the Royal Society Interface, 14 (134), 20170213. (Publisher: The Royal Society) Nguyen, T. T., Hui, P.-M., Harper, F. M., Terveen, L., & Konstan, J. A. (2014). Exploring the filter bubble: the effect of using recommender systems on content diversity. In Proceedings of the 23rd international conference on World wide web - WWW ’14 (pp. 677–686). Seoul, Korea: ACM Press. Retrieved 2022-12-31, from http:// dl.acm.org/citation.cfm?doid=2566486.2568012 doi: 10.1145/2566486.2568012 Ni, J., Li, J., & McAuley, J. (2019). Justifying recommendations using distantly-labeled reviews and fine-grained aspects. In Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP) (pp. 188–197). Nonnecke, B., & Preece, J. (2000). Lurker demographics: Counting the silent. In Proceedings of the SIGCHI conference on Human factors in computing systems (pp. 73–80). O’Hara, R., & Kotze, J. (2010, January). Do not log-transform count data. Nature Precedings. Retrieved 2023-01-11, from https://www.nature.com/articles/npre.2010.4136.1 doi: 10.1038/npre.2010.4136.1 Pandita, R. (2017). Internet: A change agent an overview of internet penetration & growth across the world. International Journal of Information Dissemination and Technology, 7 (2), 83–91. Retrieved 2023-01-11, from https://www.proquest.com/docview/1920419032/abstract/14B253C0DD6A4277PQ/1 (Num Pages: 83-91 Place: Ambala, India Publisher: Maharishi Markandehwar University) Papakyriakopoulos, O., Serrano, J. C. M., & Hegelich, S. (2020). Political communication on social media: A tale of hyperactive users and bias in recommender systems. Online Social Networks and Media, 15 , 100058. (Publisher: Elsevier) Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., . . . Dubourg, V. (2011). Scikit-learn: Machine learning in Python. the Journal of machine Learning research, 12 , 2825–2830. (Publisher: JMLR. org) Poole, M. A., & O’Farrell, P. N. (1971). The assumptions of the linear regression model. Transactions of the Institute of British Geographers, 145–158. (Publisher: JSTOR) Popper, K. R. (1970). Normal science and its dangers. Cambridge University Press Cambridge. Rakova, B., & Chowdhury, R. (2019, September). Human self-determination within algorithmic sociotechnical systems. arXiv. Retrieved 2022-09-07, from http://arxiv.org/abs/1909.06713 (arXiv:1909.06713 [cs]) Raschka, S., Patterson, J., & Nolet, C. (2020). Machine learning in python: Main developments and technology trends in data science, machine learning, and artificial intelligence. Information, 11 (4), 193. (Publisher: Multidisciplinary Digital Publishing Institute) Roski, J., Maier, E. J., Vigilante, K., Kane, E. A., & Matheny, M. E. (2021). Enhancing trust in AI through industry self-governance. Journal of the American Medical Informatics Association, 28 (7), 1582–1590. (Publisher: Oxford University Press) Sandvig, C., Hamilton, K., Karahalios, K., & Langbort, C. (2014). Auditing algorithms: Research methods for detecting discrimination on internet platforms. Data and discrimination: converting critical concerns into productive inquiry, 22 , 4349–4357. Satterthwaite, F. E. (1946, December). An Approximate Distribution of Estimates of Variance Components. Biometrics Bulletin, 2 (6), 110. Retrieved 2023-01-11, from https://www.jstor.org/stable/10.2307/3002019 ?origin=crossref doi: 10.2307/3002019 Schielzeth, H., Dingemanse, N. J., Nakagawa, S., Westneat, D. F., Allegue, H., Teplitsky, C., . . . Araya-Ajoy, Y. G. (2020, September). Robustness of linear mixed-effects models to violations of distributional assumptions. Methods in Ecology and Evolution, 11 (9), 1141–1152. Retrieved 2022-12-27, from https://onlinelibrary.wiley.com/ doi/10.1111/2041-210X.13434 doi: 10.1111/2041-210X.13434 Selbst, A. D., Boyd, D., Friedler, S. A., Venkatasubramanian, S., & Vertesi, J. (2019, January). Fairness and Abstraction in Sociotechnical Systems. In Proceedings of the Conference on Fairness, Accountability, and Transparency (pp. 59–68). Atlanta GA USA: ACM. Retrieved 2022-09-07, from https://dl.acm.org/doi/10.1145/3287560.3287598 doi: 10.1145/3287560.3287598 Smith, B., & Linden, G. (2017, May). Two Decades of Recommender Systems at Amazon.com. IEEE Internet Computing, 21 (3), 12–18. Retrieved 2022-12-20, from http://ieeexplore.ieee.org/document/7927889/ doi: 10.1109/MIC.2017.72 Timmers, H., & Wagenaar, W. A. (1977, November). Inverse statistics and misperception of exponential growth. Perception & Psychophysics, 21 (6), 558–562. Retrieved 2023-01-10, from https://doi.org/10.3758/BF03198737 doi: 10.3758/BF03198737 Van Rossum, G. (2007). Python Programming language. In USENIX annual technical conference (Vol. 41, pp. 1–36). (Issue: 1) Villadsen, A. R., & Wulff, J. N. (2021, July). Statistical Myths About Log-Transformed Dependent Variables and How to Better Estimate Exponential Models. British Journal of Management, 32 (3), 779–796. Retrieved 2023-01-12, from https://onlinelibrary.wiley.com/doi/10.1111/1467-8551.12431 doi: 10.1111/1467-8551.12431 Wells, J. R., Danskin, G., & Ellsworth, G. (2018). Amazon. com, 2018. Harvard Business School Case Study(716-402). Wood, S. N., Pya, N., & S¨afken, B. (2016, October). Smoothing Parameter and Model Selection for General Smooth Models. Journal of the American Statistical Association, 111 (516), 1548–1563. Retrieved 2023- 01-12, from https://doi.org/10.1080/01621459.2016.1180986 (Publisher: Taylor & Francis eprint: https://doi.org/10.1080/01621459.2016.1180986) doi: 10.1080/01621459.2016.1180986 Zhu, F., & Liu, Q. (2018). Competing with complementors: An empirical look at Amazon.com. Strategic Management Journal, 39 (10), 2618–2642. Retrieved 2023-01-11, from https://onlinelibrary.wiley.com/doi/ abs/10.1002/smj.2932 ( eprint: https://onlinelibrary.wiley.com/doi/pdf/10.1002/smj.2932) doi: 10.1002/ smj.2932 Zuboff, S. (2019). The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power: Barack Obama’s Books of 2019. Profile Books. This paper is under CC 4.0 license. available on arxiv

Ensuring Ethical AI: Lessons from Amazon's Barrier-to-Exit Analysis

Recommendations by Concise User Profiles from Review Text: Ethics Statement and References

How to Run Your Own Local LLM: Updated for 2024 - Version 2

Mastering the Craft of Transforming Data into Engaging Visual Narratives in User Interfaces

I recently spoke with Lingo Co-Founder & CEO, HM Rawat, about the potential impact of Web3 on community empowerment. In our conversation, we also touched on the uniqueness of Web3 rewards, its challenges, and how a novel approach could shape the industry. I hope you find the discussion insightful. Tell us a bit about yourself and how you got into Web3. From selling MP3 CDs at school to exiting Mauritius’s fastest-growing Subway franchisee chain of 12+ restaurants, I’ve been an entrepreneur all my life. Heading marketing and sales at HMRawat Communications, our family business, was a milestone in my journey. During my time there, we secured over 80% of Mauritius’s mobile phone market share and achieved a 300x YoY revenue growth for the Madagascar unit. The Seychelles unit also saw a 1500x growth. Now, I’m applying all the lessons I learned over 30 years to build and scale Lingo. It’ll help fill Web3’s marketing gaps—the reason I entered this space. While the underlying tech is growing 2x faster than the Internet in the 90s, it’s not transforming as many lives as it can. Loyalty schemes feature heavily in Web2’s attract-extract models. How are Web3 rewards different? The global loyalty management market was roughly $10.5 billion in 2023. It’ll possibly grow at over 9% till 2030. But consumers will only get a tiny share of this revenue, as usual. Web2 loyalty schemes are extractive because they work within walled gardens owned and controlled by centralized entities. Consumers mostly receive points or token money that have limited redeemability. You can use them at partner stores only, for example. Web3 rewards, on the contrary, can put real value in the consumer’s hands. Consumers can trade loyalty tokens in secondary markets or exchange them with their friends. That’s the power of interoperability. Plus, on-chain revenue models are usually transparent and verifiable, enhancing accountability. Have Web3 rewards evolved fully? If not, what are its main challenges? No. Lingo will take Web3 rewards over the line but there’s still a long way to go. Inferior design and sub-par incentives are the main problems. The inability to sustain rewards and engage communities long-term is a key reason why over 72% of projects from the 2020-2021 bull market have died. Web3 projects typically have Ponzinomics for economic models. They constantly need to onboard new users to maintain rewards, etc. This is very dangerous in volatile, cyclical markets like crypto. It’s also unsustainable. Moreover, Web3 rewards don’t have enough real-world utility yet. They’re even inferior to centralized Web2 rewards in some ways. Meaning, communities don’t have the incentives to stay loyal long-term. Speculation and frothy practices are more prevalent instead. How does Lingo solve these problems? What’s unique about its approach? We’re solving the root cause, i.e., Ponzinomics. The lack of intrinsic value and solid foundations fuel the problems we discussed so far. Lingo fixes that. We’ve developed a new model that’ll generate tangible community rewards using Real World Assets (RWAs). The algorithm supporting Lingo’s circular economy invests transaction fees into high-performing RWAs and the returns go to the rewards pool. It ensures compound growth. Consumers will earn $LINGO tokens that they can redeem for real-world rewards by staking, etc. This system works irrespective of market conditions, making it robust and sustainable. We’re already seeing strong support for our vision and novel approach. Over 140K consumers have joined the waitlist. Our Twitter and Discord communities have 84,000+ and 50,000+ members respectively. We have 100+ brand ambassadors and raised over $5 million via private rounds. What’s in it for the community? How will Lingo change the experiences of end-users? Lingo users get passive, risk-minimized access to the RWA industry, which is expected to cross $16 trillion by 2030. Early adopters will further reap the benefits accruing from our first mover’s advantage. Consumers can access Web3’s largest rewards ecosystem with Lingo. This means special benefits at 3000+ brands like Nike, IKEA, Spotify, Uber, Netflix, and more. Our solutions will be available in 80+ countries, powered by Fizen and our 100,000+ hotel network. I’ve spent 12+ years building solutions and services for global consumers. Our Co-Founder, David Amsellem, built John Paul — the world’s top premium loyalty program that Accor Hotels acquired for $150 million in 2016. Over the years, we’ve both learned the importance of ensuring top-notch user experiences. That’s our priority at Lingo. Plus an awesome team of blockchain researchers, developers, and advisors is helping us turn vision into reality. We’ll unleash next-gen Web3 incentives. Community members will be the biggest beneficiaries here — it’ll be a win-win for consumers and partner brands. And finally, distributed governance gives users a meaningful say in the platform’s policies and financial models. We welcome anyone who’s ready to surf the tide. I recently spoke with Lingo Co-Founder & CEO, HM Rawat , about the potential impact of Web3 on community empowerment. In our conversation, we also touched on the uniqueness of Web3 rewards, its challenges, and how a novel approach could shape the industry. I hope you find the discussion insightful. Lingo HM Rawat Tell us a bit about yourself and how you got into Web3. Tell us a bit about yourself and how you got into Web3. From selling MP3 CDs at school to exiting Mauritius’s fastest-growing Subway franchisee chain of 12+ restaurants, I’ve been an entrepreneur all my life. Heading marketing and sales at HMRawat Communications, our family business, was a milestone in my journey. During my time there, we secured over 80% of Mauritius’s mobile phone market share and achieved a 300x YoY revenue growth for the Madagascar unit. The Seychelles unit also saw a 1500x growth. Now, I’m applying all the lessons I learned over 30 years to build and scale Lingo. It’ll help fill Web3’s marketing gaps—the reason I entered this space. While the underlying tech is growing 2x faster than the Internet in the 90s, it’s not transforming as many lives as it can. Loyalty schemes feature heavily in Web2’s attract-extract models. How are Web3 rewards different? Loyalty schemes feature heavily in Web2’s attract-extract models. How are Web3 rewards different? The global loyalty management market was roughly $10.5 billion in 2023. It’ll possibly grow at over 9% till 2030. But consumers will only get a tiny share of this revenue, as usual. roughly $10.5 billion roughly $10.5 billion Web2 loyalty schemes are extractive because they work within walled gardens owned and controlled by centralized entities. Consumers mostly receive points or token money that have limited redeemability. You can use them at partner stores only, for example. Web3 rewards, on the contrary, can put real value in the consumer’s hands. Consumers can trade loyalty tokens in secondary markets or exchange them with their friends. That’s the power of interoperability. Plus, on-chain revenue models are usually transparent and verifiable, enhancing accountability. Have Web3 rewards evolved fully? If not, what are its main challenges? Have Web3 rewards evolved fully? If not, what are its main challenges? No. Lingo will take Web3 rewards over the line but there’s still a long way to go. Inferior design and sub-par incentives are the main problems. The inability to sustain rewards and engage communities long-term is a key reason why over 72% of projects from the 2020-2021 bull market have died. 72% of projects 72% of projects Web3 projects typically have Ponzinomics for economic models. They constantly need to onboard new users to maintain rewards, etc. This is very dangerous in volatile, cyclical markets like crypto. It’s also unsustainable. Moreover, Web3 rewards don’t have enough real-world utility yet. They’re even inferior to centralized Web2 rewards in some ways. Meaning, communities don’t have the incentives to stay loyal long-term. Speculation and frothy practices are more prevalent instead. How does Lingo solve these problems? What’s unique about its approach? How does Lingo solve these problems? What’s unique about its approach? We’re solving the root cause, i.e., Ponzinomics. The lack of intrinsic value and solid foundations fuel the problems we discussed so far. Lingo fixes that. We’ve developed a new model that’ll generate tangible community rewards using Real World Assets (RWAs). The algorithm supporting Lingo’s circular economy invests transaction fees into high-performing RWAs and the returns go to the rewards pool. It ensures compound growth. Consumers will earn $LINGO tokens that they can redeem for real-world rewards by staking, etc. This system works irrespective of market conditions, making it robust and sustainable. We’re already seeing strong support for our vision and novel approach. Over 140K consumers have joined the waitlist. Our Twitter and Discord communities have 84,000+ and 50,000+ members respectively. We have 100+ brand ambassadors and raised over $5 million via private rounds. What’s in it for the community? How will Lingo change the experiences of end-users? What’s in it for the community? How will Lingo change the experiences of end-users? Lingo users get passive, risk-minimized access to the RWA industry, which is expected to cross $16 trillion by 2030 . Early adopters will further reap the benefits accruing from our first mover’s advantage. $16 trillion by 2030 $16 trillion by 2030 Consumers can access Web3’s largest rewards ecosystem with Lingo. This means special benefits at 3000+ brands like Nike, IKEA, Spotify, Uber, Netflix, and more. Our solutions will be available in 80+ countries, powered by Fizen and our 100,000+ hotel network. Fizen Fizen I’ve spent 12+ years building solutions and services for global consumers. Our Co-Founder, David Amsellem, built John Paul — the world’s top premium loyalty program that Accor Hotels acquired for $150 million in 2016. Over the years, we’ve both learned the importance of ensuring top-notch user experiences. That’s our priority at Lingo. Plus an awesome team of blockchain researchers, developers, and advisors is helping us turn vision into reality. We’ll unleash next-gen Web3 incentives. Community members will be the biggest beneficiaries here — it’ll be a win-win for consumers and partner brands. And finally, distributed governance gives users a meaningful say in the platform’s policies and financial models. We welcome anyone who’s ready to surf the tide.

Stories, News & Mentions about ENTERACTIVE

Enteractive’s Stories on HackerNoon