Diana Kessler

Verification is a crucial property of many cryptographic functionalities, enabling a verifier to check whether a prover conducted an operation as agreed or deviated from the agreement. Probably the most intuitive technique for verification is the cut-and-choose technique, in which the verifier randomly intertwines test rounds with the output round to verify the honesty of the prover. Although this technique was successfully deployed for some use cases, such as quantum key distribution, its suitability for many other functionalities remains unknown. We consider two central verification tasks — quantum state verification and verifiable delegated quantum computing — and prove inherent trade-offs when verification is implemented solely via cut-and-choose: no protocol can simultaneously achieve high correctness, security, and efficiency; improving any one of these quantities beyond certain bounds necessarily degrades at least one of the others.

Quantum state verification plays a vital role in many quantum cryptographic protocols, as it allows using quantum states from an untrusted source. While some progress has been made in this direction, the question of whether the most prevalent type of quantum state verification, namely cut-and-choose verification, can be efficient and secure, is still not answered in full generality. In this work, we show a fundamental limit for quantum state verification for all cut-and-choose approaches used to verify arbitrary quantum states. We provide a no-go result showing that the cut-and-choose techniques cannot lead to quantum state verification protocols that are both efficient and secure. We show this trade-off for stand-alone and composable security, where the scaling of the lower bound for the security parameters renders cut-and-choose quantum state verification effectively useless.