Alon et al. (CRYPTO 2021) introduced a multiparty quantum computation protocol that is secure with identifiable abort (MPQC-SWIA). However, their protocol allows only inside MPQC parties to know the identity of malicious players. This becomes problematic when two groups of people disagree and need a third party, like a jury, to verify who the malicious party is. This issue takes on heightened significance in the quantum setting, given that quantum states may exist in only a single copy. Thus, we emphasize the necessity of a protocol with publicly verifiable identifiable abort (PVIA), enabling outside observers with only classical computational power to agree on the identity of the malicious party in case of an abort. However, achieving MPQC with PVIA poses significant challenges due to the no-cloning theorem, and previous works proposed by Mahadev (STOC 2018) and Chung et al. (Eurocrypt 2022) for classical verification of quantum computation fall short. In this paper, we obtain the first MPQC-PVIA protocol assuming post-quantum oblivious transfer and a classical broadcast channel. The core component of our construction is a new authentication primitive called auditable quantum authentication (AQA) that identifies the malicious sender with overwhelming probability. Additionally, we provide the first MPQC protocol with best-of-both-worlds (BoBW) security, which guarantees output delivery with an honest majority and remains secure with abort even if the majority is dishonest. Our best-of-both-worlds MPQC protocol also satisfies PVIA upon abort.

翻译：Alon等人（CRYPTO 2021）提出了具备可识别中止安全性的多方量子计算协议（MPQC-SWIA）。然而，该协议仅允许MPQC参与方内部识别恶意参与者的身份。当两组存在分歧的群体需要第三方（如陪审团）验证恶意方身份时，这一问题便会显现。在量子场景中，由于量子态可能仅存在单个副本，该问题更具紧迫性。因此，我们强调需要一种具有公开可验证可识别中止（PVIA）特性的协议，使仅具备经典计算能力的外部观察者能在协议中止时统一确定恶意方的身份。然而，由于量子不可克隆定理的制约，实现支持PVIA的MPQC面临重大挑战，此前Mahadev（STOC 2018）和Chung等人（Eurocrypt 2022）提出的经典验证量子计算方案均无法解决该问题。本文基于后量子不经意传输和经典广播信道，首次提出了MPQC-PVIA协议。该协议的核心组件是一种名为可审计量子认证（AQA）的新型认证原语，能以压倒性概率识别恶意发送方。此外，我们首次实现了兼具最优安全属性（BoBW）的MPQC协议：在诚实参与者占多数时保证输出交付，在多数参与者不诚实的情况下仍能保证中止安全性。该最优安全属性MPQC协议在发生中止时同样满足PVIA特性。