Verifiable One-Time Programs

• Verifiable one-time programs are single-use cryptographic protocols enhanced with verification layers that ensure program integrity before execution.
• They combine minimal quantum resources with classical cryptography to enforce simulation-based security under specific adversarial models.
• Applications include secure computation, sealed-bid auctions, and public signature verification, driving advancements in practical quantum cryptography.

Verifiable one-time programs (Ver-OTPs) are one-time programs augmented with a verification layer. In the recent literature, they are defined so that a receiver can verify that a program instance is well formed relative to public data and a public relation before execution, while the execution itself still enforces one-time evaluation of a function $f(s,x)$. Closely related formulations treat verifiability operationally: for a publicly verifiable function family, a valid one-time program should not enable production of two distinct valid input/output pairs under the public verification procedure. Ver-OTPs therefore sit at the intersection of one-time memories, quantum one-time programs, public verification, and simulation-based or operational security. They are motivated by the fact that classical one-time programs are generally impossible without hardware assumptions, while the strongest quantum notions remain impossible for non-trivial functionalities (Stambler, 26 Sep 2025, Gupte et al., 2024).

1. Origins in one-time memories and quantum one-time programs

A one-time program allows evaluation on a single input of the user’s choice, but not on a second input. A one-time memory (OTM) is the simpler primitive in which two messages are stored and a receiver can later read either one but not both. OTMs are modeled after a non-interactive $1$-out-of-$2$ oblivious transfer and are complete for one-time classical and quantum programs (Broadbent et al., 2018).

The foundational obstacle is that classical information is copyable. The literature summarized here states that perfect, information-theoretically secure OTPs are impossible without self-destructing hardware, and that secure OTMs do not exist in the standard model in both the classical and quantum settings (Roehsner et al., 2020, Broadbent et al., 2018). Early quantum work therefore moved to intermediate physical models. In the isolated-qubits model, qubits can be accessed using local operations and classical communication (LOCC), but not entangling operations. Within that model, OTM constructions based on Wiesner’s conjugate coding and error-correcting codes achieve information-theoretic security against one-pass LOCC adversaries, and later work strengthens this to “single-shot” security stated in terms of smoothed min-entropy (Liu, 2013, Liu, 2014).

This line is directly relevant to Ver-OTPs because verifiability requires stronger guarantees than average-case leakage bounds. The isolated-qubits work explicitly argues that Shannon-entropy guarantees are inadequate for most cryptographic applications, whereas single-shot min-entropy bounds are the appropriate baseline for OTM-based OTPs and especially verifiable OTPs (Liu, 2014). A plausible implication is that verifiability is not an add-on to one-time security; it depends on the same shift from weak leakage measures to worst-case, single-execution guarantees.

2. Security notions and formal definitions

Recent work separates several notions of OTP security instead of treating “one-time” as a single property. A central hierarchy introduces simulation-based security with a single physical query, classical-output simulation-based security, Single-Effective-Query (SEQ) simulation-based security, and operational notions that prohibit an adversary from producing two correct outputs or from winning more general security games twice. In that hierarchy, the first two simulation notions remain impossible for non-trivial functionalities, whereas SEQ and operational notions are meaningful and achievable in restricted models (Gupte et al., 2024).

For verifiable functionalities, the operational notion is explicit. A function family $F$ is verifiable if there exists an efficient verification key $vk_f$ and verification procedure $\operatorname{Ver}$ such that valid outputs verify with probability $1-\operatorname{negl}(\lambda)$. Verifiable operational OTP security then requires that a QPT adversary, given $\mathrm{OTP}(f)$ and $vk_f$, cannot output two distinct valid pairs. The definition is:

$$\Pr_{f, vk_f \leftarrow F}\left[\operatorname{Ver}_f(vk_f, x_1, y_1) = 1 \wedge \operatorname{Ver}_f(vk_f, x_2, y_2) = 1 : ((x_1, y_1), (x_2, y_2)) \in \mathcal{A}(\mathrm{OTP}(f), vk_f)\right] \leq \operatorname{negl}(\lambda)$$

(Gupte et al., 2024)

A distinct but complementary formulation appears in the explicit Ver-OTP functionality for relation-based verification. There, the ideal functionality is parameterized by a function $1$0, a relation $1$1, and a CRS for NIZK. The sender invokes a create phase with $1$2; creation succeeds only if $1$3. The receiver can then verify consistency before executing, and execution returns $1$4 and deletes the stored program. Security is simulation-sound, with efficient simulators for malicious sender and malicious receiver (Stambler, 26 Sep 2025).

These two formulations differ in emphasis. The operational definition of verifiability focuses on the impossibility of extracting two publicly valid outputs from one token. The relation-based definition focuses on non-interactive assurance that the program instance itself is correctly formed relative to public data. Contemporary Ver-OTP research uses both viewpoints.

3. Core constructions from minimal quantum resources

A major technical direction is to reduce the quantum component to the simplest possible objects. One construction of simulation-secure OTMs in the quantum random oracle model uses only single-qubit Wiesner states and conjunction obfuscation constructible from the Learning-Parity-with-Noise assumption. The sender chooses random $1$5 bases and random strings $1$6, prepares independent $1$7-qubit Wiesner states, computes hashes $1$8, and creates an obfuscated conjunction for each basis; the receiver chooses a basis, measures all qubits in that basis, hashes the outcomes, satisfies one conjunction, derives one key, and decrypts one message. No complex entanglement or indistinguishability obfuscation is required (Stambler, 19 Jan 2026).

The same paper proves a sequential POVM tradeoff: if a POVM identifies computational-basis states with probability at least $1$9, then the best conjugate-basis guessing strategy succeeds with probability at most $2$0. This formalizes the one-time effect for single-qubit conjugate coding in a way tailored to adaptive adversaries (Stambler, 19 Jan 2026).

The explicit Ver-OTP construction uses a different assembly of classical and quantum components. The sender garbles a circuit for $2$1, generates wire keys $2$2, secret-shares each wire key, and encodes each share as a single-bit OTP instantiated with a single qubit. Each OTP also carries a NIZK proof that the share is correct relative to committed labels. The receiver opens random subsets in a cut-and-choose phase, verifies the proofs, and later reconstructs only the selected wire label for each input bit from the unopened shares. The construction combines single-qubit states, garbled circuits, commitment schemes, NIZKs, secret sharing, and cut-and-choose soundness (Stambler, 26 Sep 2025).

The common theme is minimal quantum structure. In both cases the quantum requirement is reduced to single-qubit states, while the heavy cryptographic machinery is classical.

4. Forms of verifiability

Verifiability in this area is not a single mechanism. One form is pre-execution relation checking. In the relation-based Ver-OTP construction, the receiver can verify in zero knowledge that the garbled circuit is well formed and that each unopened OTP encodes a correct secret share with respect to committed labels and the public relation $2$3. This is non-interactive verification relative to a CRS (Stambler, 26 Sep 2025).

A second form is public output verification. For verifiable function families, recent OTP constructions produce outputs that satisfy the original public verification procedure rather than an ad hoc token-specific checker. Signature tokens are the main example: the one-time program produces a classical signature satisfying the original public verification procedure, and verification is unchanged and public. The same framework extends to one-time NIZK proof tokens, where verification is again public (Gupte et al., 2024).

A third form is “testability,” which is closely related to verifiability but not identical to it. Testable OTP compilers output a quantum program state together with a public reflection oracle

$2$4

allowing anyone to test whether the program state is untouched. This supplies a public authenticity check on the program state itself rather than on a relation proof or output transcript (Gupte et al., 28 Feb 2026).

Experimental probabilistic OTPs add a fourth, statistical form of verifiability. In the entanglement-based protocol, table lines are consumed on use, Alice can set acceptance thresholds for delegated signatures, and Alice and Bob can test a subset of entangled pairs for Bell inequality violation to detect eavesdropping. The experiment reported a CHSH parameter $2$5, and the delegated-signature use-case used threshold-based acceptance to distinguish honest from cheating behavior (Roehsner et al., 2020). This is weaker than formal simulation-based verifiability, but it shows that correctness auditing and one-time enforcement can be coupled in practice.

5. Limits, impossibility results, and adversarial models

A recurrent misconception is that quantum information makes arbitrary one-time programs possible. The literature rejects that view. Strong simulation-based notions equivalent to ideal obfuscation are impossible for non-trivial functions, and even classical-output simulation remains impossible in the oracle model for suitable function classes (Gupte et al., 2024). More broadly, a generic “best-possible” OTP compiler does not exist even for randomized classical functionalities under lossy encryption assumptions (Gupte et al., 28 Feb 2026).

Because of these impossibility results, recent positive work narrows both the security notion and the adversarial model. SEQ simulation security gives the simulator access to a stateful interface that permits only one effective evaluation; this is strong enough to capture nontrivial one-time behavior while avoiding the impossibility of single-query VBB-style definitions (Gupte et al., 2024). For testable OTPs, generalized SEQ security for quantum channels implies best-possible testable one-time security, and SEQ-secure OTPs for all quantum functionalities are constructed in the classical oracle model (Gupte et al., 28 Feb 2026).

Model restrictions also appear in concrete security proofs. The simulation-secure OTM in the quantum random oracle model is proved secure when the adversary can only query the random oracle classically, and its adaptive adversary model is BPPQNC$2$6: polynomial-time classical computation interleaved with quantum circuits of polynomial-bounded depth, with adaptive classical control and persistent quantum memory. The same work conjectures, via an informal lifting argument, security against polynomial-depth adaptive quantum adversaries between random-oracle queries (Stambler, 19 Jan 2026).

Other constructions exhibit different boundaries. The stateless-hardware OTM protocol achieves quantum-UC security against a malicious receiver making at most $2$7 adaptive queries to the token, but also proves impossibility if the token accepts coherent superposition queries (Broadbent et al., 2018). Across these lines of work, the shared message is that one-time security is achievable only when the model tracks what information can be irreversibly extracted.

6. Applications and implementations

Ver-OTPs have become a platform for higher-level secure computation. The clearest example is single-round Open Secure Computation (OSC), constructed from Ver-OTPs and multi-key homomorphic encryption. OSC enables single-round sealed-bid auctions, single-round and honest-majority atomic proposes as a building block of consensus protocols, and single-round differentially private statistical aggregation without pre-registration (Stambler, 26 Sep 2025).

Publicly verifiable cryptographic tokens are another application class. In the newer OTP hierarchy, signature tokens and one-time NIZK proofs are treated as verifiable OTPs because outputs can be checked by anyone under the original verification procedure (Gupte et al., 2024). This moves Ver-OTPs away from software-only metaphors and toward concrete cryptographic artifacts with public authenticity semantics.

Experimental realizations remain probabilistic but are increasingly network-oriented. The entanglement-based protocol for probabilistic one-time programs achieved four orders of magnitude higher count rates than the earlier single-qubit implementation, up to $2$8, and separated quantum exchange from later classical program execution by generating a reusable shared table. It was demonstrated over an underground fiber link between university buildings in downtown Vienna and applied to one-time delegation of signature authority. For $2$9, $F$0, and $F$1, the reported honest success probability was $F$2 and the cheating success probability was $F$3 (Roehsner et al., 2020). These systems do not by themselves realize the full modern Ver-OTP functionality, but they show that one-time use, public checking, delayed execution, and quantum-network compatibility can coexist.

A separate practical branch uses trusted hardware rather than quantum states. One-time programs implemented with Intel TXT and TPMs use measured launch, PCR-bound NVRAM, and attestation-oriented mechanisms to enforce single execution. In one variant the TEE directly enforces one-timeness; in another it instantiates a one-time memory for garbled-circuit keys (Zhao et al., 2019). This is not a quantum Ver-OTP construction, but it remains relevant as a practical comparison point: verifiability can come from attestation and state continuity instead of quantum measurement disturbance.

7. Open problems and research directions

Several technical bottlenecks remain explicit in the literature. For single-qubit Wiesner-state OTMs, open problems include tighter bounds for the multi-qubit measurement tradeoff, noise resilience and error correction for long-term storage, and formalization of the depth-lifting theorem used to argue security against adaptive depth-bounded quantum adversaries. The same work also points to error-corrected memory states as a possible route to implementations that persist for long periods of time (Stambler, 19 Jan 2026).

At the application layer, the Ver-OTP-to-OSC pipeline depends on a CRS for NIZK and on a strengthened multi-key homomorphic encryption notion. Open directions include removing the CRS dependency, extending the framework to quantum functionalities, improving noise tolerance, and constructing or adapting MHE schemes with the required simulation properties (Stambler, 26 Sep 2025).

A broader systems direction is to avoid long-term quantum memory and global entanglement. Semi-quantum constructions based on classical-query oracles and semi-quantum tokens yield short-lived OTPs, RAM obfuscation, long-lived OTPs, and copy-protection schemes without long-term quantum memory or global entanglement (Stambler, 30 Apr 2025). This suggests a possible future architecture in which verifiable one-time behavior is realized by short-lived quantum authentication steps combined with predominantly classical state management.

At the highest level of abstraction, current theory indicates that generic best-possible OTPs are impossible, but best-possible testable OTPs may be achievable through SEQ security or stateful quantum indistinguishability obfuscation (Gupte et al., 28 Feb 2026). The resulting picture is sharply delimited: Ver-OTPs are not a universal consequence of quantum mechanics, but a family of carefully modeled primitives in which one-time use, public or zero-knowledge verification, and minimal quantum resources can be reconciled under specific assumptions.