On the Limits of Stretching Quantum Pseudorandomness

Abstract: Pseudorandom states, introduced by Ji, Liu, and Song (CRYPTO '18), are quantum analogues of classical pseudorandom generators. A fundamental property of classical pseudorandom generators is that their output can be stretched to arbitrary polynomial length. Whether an analogous stretching property holds for quantum pseudorandom states remains unclear. In this work, we prove the first black-box separation between single-copy secure pseudorandom states ($\mathsf{1PRS}$) with different output lengths. Specifically, we construct a quantum oracle relative to which $\mathsf{1PRS}$ with output length $m(n)=1.1n$ exist, but $\mathsf{1PRS}$ with output length $m(n)=Ω(n^{2+ε})$ do not, for any $ε>0$. Our proof leverages the Common Haar Random State (CHRS) model introduced by Chen, Coladangelo, and Sattath (EUROCRYPT '25), and introduces a technique to bound the effective number of resource CHRS states utilized by any $\mathsf{1PRS}$ generator in this model.

• The paper demonstrates a formal separation between short- and long-stretch quantum pseudorandom generators, proving that black-box constructions cannot achieve superquadratic stretching.
• The analysis leverages a novel resource-counting lemma and oracle construction based on Haar-random states to quantify the fundamental limitations in black-box settings.
• The findings highlight clear contrasts with classical pseudorandom generator stretching, emphasizing the unique challenges posed by quantum no-cloning and state destructiveness.

On the Limits of Stretching Quantum Pseudorandomness: An Expert Overview

Introduction

The paper "On the Limits of Stretching Quantum Pseudorandomness" (2606.24736) rigorously investigates the stretchability of quantum pseudorandom state (PRS) generators, specifically focusing on the feasibility and limitations of black-box constructions that increase (or "stretch") the output length of single-copy secure pseudorandom states ($\oPRS$). While in the classical regime non-trivial pseudorandom generators can be stretched to arbitrary polynomial output lengths via straightforward iterative methods, the quantum setting introduces significant structural and technical obstructions due to no-cloning and the nonlinear behavior of quantum state manipulation.

This work sets out, for the first time, a formal separation between $\oPRS$ of different output lengths in a black-box model, and in doing so, highlights fundamental constraints on quantum pseudorandom objects that sharply distinguish them from their classical counterparts.

Main Results

The primary contribution is the construction of a quantum oracle relative to which $\oPRS$ exist with output length $m(n)=1.1n$ (for $n$-bit keys) but do not exist with output length $m(n)=\Omega(n^{2+\epsilon})$ for any constant $\epsilon>0$. This is formalized by demonstrating that, even with coherent isometry (superposition) access to the underlying generator, no black-box construction can yield a long-stretch $\oPRS$ from a short-stretch one under these oracle conditions.

Key numerical claim: The separation is tight in that it rules out any superquadratic polynomial stretch, whereas existing positive constructions only allow sublinear additive stretch (i.e., $n+n^c$ for any $c<1$), leaving a gap between known upper and lower bounds.

Black-Box Model: The impossibility holds in a strong black-box sense—constructions that can query the generator as an isometry but not with full unitary/inverse access. Thus, any successful stretch must either be non-black-box, exploit inverse/unitary access, or depart from mere generator isometry queries.

Technical Contributions

Oracle Construction

The oracle is built on an extension of the Common Haar Random State (CHRS) model, which supplies parties with Haar-random quantum states for arbitrary lengths. Crucially, the adversary and generator are endowed, via the oracle, with controlled access to an exponential number of copies of these states, as well as the ability to execute large quantum circuits over them. The model is proof-theoretically robust: the separation is generic over a measure-1 set of Haar-random families.

Black-Box Separation via Resource Counting

A central technical achievement is reducing the analysis of any $\oPRS$0 generation procedure (which could, naively, exploit an exponential number of CHRS instances) to an equivalent protocol that only utilizes polynomially many copies of Haar states. This is achieved via a novel resource-counting lemma, which leverages the structure of pure-state outputs and the symmetric tensor structure to show that effective dependency on Haar randomness—hence, attackable via standard quantum property tests—is strictly limited.

Case Analysis of Attacks

Two critical regimes are considered for a putative long-stretch $\oPRS$1 generator:

(A) Substantial Use of Large or Numerous Haar States:

If the generator employs (i) at least one large (length $\oPRS$2) Haar state, or (ii) many ($\oPRS$3) medium ($\oPRS$4 bits) Haar states, an attack based on generalization of the SWAP (permutation) test can discern structured from Haar-random states with exponentially small soundness error.

(B) Use of Only Few, Short Haar States:

If the generator only interacts with sublinear number and size Haar states, then the image of the generator is confined within a rank-deficient subspace, rendering the average output statistically distinguishable from the maximally mixed state—regardless of the adversary's knowledge of Haar states.

In both cases, attacks are efficiently implementable using the (double-exponential) oracle model, relying fundamentally on quantum property testing techniques, including generalized SWAP and permutation symmetry measurements.

Impossibility of Black-Box Stretch

It is proven that, relative to the constructed oracle, any black-box construction that simulates a long-stretch $\oPRS$5 generator via isometry access to a short-stretch one is impossible. This leverages the fact that all such black-box reductions must relativize to the oracle world.

Contrasts with Classical PRG Stretching

In the classical setting, non-trivial PRGs can be arbitrarily stretched by iterative self-feeding due to their bit-string outputs and the triviality of "discard" and "concatenate" operations. The quantum setting is uniquely constrained by:

• The no-cloning theorem, which prevents repeated use of outputted quantum states as keys.
• The destructive nature of simple qubit discarding (which converts pure states to mixed).
• The structural rigidity of indistinguishability when only single-copy security is required.

Explicitly, whereas quantum PRGs can be constructed to stretch output by an explicit additive $\oPRS$6 ($\oPRS$7), this work demonstrates that quadratic or greater polynomial stretching cannot be realized in a black-box way.

Implications

Practical:

Quantum cryptographic protocols reliant on long-stretching pseudorandomness cannot, under this model, use iterated black-box self-extension. Impossibility in the black-box regime necessitates either fundamentally new non-black-box amplification techniques or stronger structural assumptions (e.g., access to inverses, additional entanglement resources).

Theoretical:

This work highlights the essential structural divergence between classical and quantum pseudorandomness, especially regarding composability and extensibility. Future constructions of quantum PRS must fundamentally address or circumvent these hardness barriers. The resource-counting results may have applications in other quantum cryptographic separation questions.

Open Problems:

• Is a separation possible in the even more restricted linear or near-linear stretch regime?
• Can the oracle be extended to preclude black-box stretching under stronger unitary or inverse-access models?
• Is it possible to close the gap between additive sublinear stretch and the superquadratic impossibility threshold?

Conclusion

"On the Limits of Stretching Quantum Pseudorandomness" establishes a definitive black-box barrier to the generic extension of quantum pseudorandom state generators. By developing and leveraging a nuanced resource counting framework, it delimits the range of quantum pseudorandom stretch realizable in black-box models and delineates sharp structural contrasts with classical constructions. The work provides a reference framework for further separation arguments and will serve as a foundational result in quantum cryptographic complexity.