Chain-of-PRs: Quantum PRS Expansion

• Chain-of-PRs is a method for expanding a k-bit key into a large quantum pseudo-random state via iterative, unitary expansion gadgets.
• It sequentially applies expansion circuits with Hadamard layers to output k+f(k) pseudo-random qubits while preserving negligible distinguishing advantage.
• The approach mirrors classical PRG expansion and achieves polynomial circuit complexity, ensuring practical security for quantum cryptographic applications.

A chain-of-PRs (chain of pseudo-random quantum states) is a black-box construction that enables the expansion of quantum pseudo-randomness by sequentially composing expansion gadgets, allowing the production of $k + f(k)$ pseudo-random qubits from a single $k$-bit key for any polynomial $f(k)$. This concept generalizes and adapts the classical cryptographic paradigm of iterative pseudo-random generator (PRG) expansion to the setting of quantum pseudo-random state (PRS) generation. The chain-of-PRs technique provides a rigorous method to extend quantum pseudo-random states to arbitrarily large output sizes while preserving essential cryptographic indistinguishability properties and maintaining polynomial resource requirements (Levy et al., 2024).

1. Formal Definition of PRS and Security

Let $\lambda$ denote the security parameter. A (keyed) family $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$ is a $\lambda$-secure, $n$-qubit PRS generator if:

• (Efficient generation) There exists a QPT (quantum polynomial-time) unitary $G$ such that $G|k\rangle|0^n\rangle = |k\rangle|\varphi_k\rangle$.
• (Indistinguishability) For every QPT distinguisher $A$ and all $k$0, the advantage

$k$1

is negligible in $k$2. Thus, no efficient quantum adversary can distinguish the keyed state from Haar-random on up to polynomially many copies.

2. Black-Box Expansion: One-Step PRS Expansion Circuit

Theorem 2.1 of [Levy & Vidick, (Levy et al., 2024)] provides a universal black-box construction for PRS expansion. Given a PRS unitary $k$3 on $k$4 qubits:

1. Fix $k$5 such that $k$6.
2. To generate an $k$7-qubit PRS on input $k$8:
   • Apply $k$9 on the first $f(k)$0 qubits.
   • Apply $f(k)$1 on the last $f(k)$2 qubits (shifted by $f(k)$3).
   • Apply $f(k)$4 (Hadamard on all $f(k)$5 qubits).

The output $f(k)$6 is an $f(k)$7-qubit PRS with the same $f(k)$8-bit key, with indistinguishability preserved up to negligible error for polynomial numbers of oracle calls.

3. Iterative Construction: Achieving $f(k)$9 Expansion

To reach an output state on $\lambda$0 qubits from an initial $\lambda$1-qubit PRS, this circuit is iterated $\lambda$2 times with geometrically growing register sizes:

• Each round $\lambda$3 expands by $\lambda$4 with $\lambda$5, typically $\lambda$6.
• The number of steps is $\lambda$7, i.e., $\lambda$8 if $\lambda$9 is polynomial.
• The composite expansion unitary is $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$0, outputting $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$1 on $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$2 qubits.

The parameter bookkeeping ensures that $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$3 in each expansion, so Theorem 2.1 remains applicable throughout the process.

4. Security Preservation Under Chaining

The expansion circuit is state-oblivious and requires no key-refresh or key-length extension per expansion. Security is shown as follows:

• Each expansion step increases the distinguishing advantage by at most a negligible $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$4.
• An end-to-end hybrid argument introduces a sequence of intermediate states $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$5, replacing the first $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$6 expansions with ideal Haar randomness:

$$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$7

• Since $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$8 and $$\{\,|\varphi_k\rangle \in S((\mathbb{C}^2)^{\otimes n(\lambda)})\,\}_{k\in\{0,1\}^k(\lambda)}$$9 is negligible, the overall distinguishing advantage remains negligible in $\lambda$0.

This establishes that the chain-of-PRs construction yields a quantum pseudo-random state over $\lambda$1 qubits, indistinguishable from Haar by any QPT for polynomially many copies.

5. Circuit-Complexity and Parameter Relationships

Let $\lambda$2 and $\lambda$3 denote the circuit size and depth of the base $\lambda$4 on $\lambda$5 qubits (typically, $\lambda$6 and $\lambda$7). For each expansion:

• Each $\lambda$8 step: two calls to $\lambda$9 and a Hadamard layer.
• After $n$0 steps:
  • Total size: $n$1.
  • Total depth: $n$2.

With $n$3, the chain construction is resource-efficient and remains in quantum polynomial time.

Summary Table: Chain-of-PRs Expansion Parameters

Parameter	Symbol	Value/Constraint
Key length	$n$4	security parameter $n$5
Initial output size	$n$6	$n$7
Expansion per round	$n$8	$n$9
Total rounds	$G$0	$G$1
Final output size	$G$2	$G$3

6. Classical Analogy, Concrete Examples, and Key Distinctions

The iterative chain construction mirrors the classical method for expanding PRGs by one bit at a time, then chaining to achieve any polynomial output length. Key differences in the quantum setting:

• Security relies on quantum state-indistinguishability, not output bit-string pseudorandomness.
• Expansion gadgets must be unitary (no measurement); security arguments use the contractivity of trace distance under CPTP maps.
• For soundness, each expansion requires that $G$4: insufficient leftover qubits can be trivially distinguished, unlike constant-entropy leftovers in classical PRGs.

Numerical examples:

• With $G$5, $G$6, $G$7, $G$8, the output reaches $G$9 qubits, security at most $G|k\rangle|0^n\rangle = |k\rangle|\varphi_k\rangle$0.
• For $G|k\rangle|0^n\rangle = |k\rangle|\varphi_k\rangle$1, $G|k\rangle|0^n\rangle = |k\rangle|\varphi_k\rangle$2, final output $G|k\rangle|0^n\rangle = |k\rangle|\varphi_k\rangle$3 qubits after $G|k\rangle|0^n\rangle = |k\rangle|\varphi_k\rangle$4 steps.

7. Open Questions and Implications

The chain-of-PRs construction addresses a longstanding challenge: achieving arbitrary polynomial expansion of pseudo-random quantum states without key length growth, in analogy with classical black-box PRG expansion. It remains an open question to characterize the full class of PRS that are chain-expandable by this method and to optimize the base PRS generator's circuit complexity for practical implementations. The approach demonstrates that, while classical and quantum pseudo-randomness exhibit structural similarities, expanded quantum pseudo-randomness imposes stricter requirements on circuit design and entropy left per round (Levy et al., 2024).