\subsubsection*{Acknowledgements.} We warmly thank the organizers of \emph{Women in Numbers Europe 4} for putting together this team. We also wish to thank Chris Leonardi and Andrew Sutherland for helpful conversations around the contents of \cite{Eprint} and \cite{Sutherland} respectively.

The first author was supported by the European Union’s H2020 Programme under grant agreement number ERC-669891.
The second author was supported by the Austrian Science Fund, Project P34808.
The fifth author was supported by the Magnus Ehrnrooth grant 336005 and Academy of Finland grant 351271.
The last author was partially supported by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) -- Project-ID 286237555 -- TRR 195 and by the Italian program Rita Levi Montalcini for young researchers, Edition 2020.

\section*{Introduction}

Homomorphic encryption is a method of encrypting plaintext that allows users to compute directly with the ciphertext.
This has many interesting applications, including being able to engage in cloud computing without giving up your data to the owner of the cloud.
Scientifically, the premise is easy to describe:
Suppose that the plaintext and the ciphertext space both have a ring structure, and that we encrypt plaintext via a map between these spaces.
If this map is a ring homomorphism, then this describes a \emph{fully homomorphic encryption} scheme.
Creating such a ring homomorphism that describes secure encryption (requiring, for example, that such a map should be efficiently computable and hard to invert) is, however, much harder than describing its properties.
The closest the scientific community has come to constructing an example of fully homomorphic encryption is using maps based on (variants of) the \emph{Learning With Errors} (LWE) problem from lattice-based cryptography \cite{Regev, LPR, GSW, FHEW, TFHE}.
However, all known LWE-based constructions are not truly fully homomorphic:
Decrypting a message that was encrypted using LWE relies on the `error' that was used in the encryption being small, and adding and multiplying encrypted messages together causes the error to grow.
Once the error is too large, the data can no longer be decrypted, so methods such as bootstrapping need to be employed to correct this growth (see e.g.~\cite{FHEW}).
These methods may lead to practical fully homomorphic encryption in the future,
but more research is needed.

In this paper, we explore an alternative approach for homomorphic encryption,
introduced by Leonardi and Ruiz-Lopez in~\cite{Eprint}.
Their construction relies on the \emph{Learning Homomorphisms with Noise} (LHN) problem
introduced by Baumslag, Fazio, Nicolosi, Shpilrain, and Skeith in~\cite{Baumslag}:
Roughly speaking, this is the problem of recovering a group homomorphism from the knowledge of the images of certain elements multiplied by noise.
The focus of~\cite{Eprint} is on the difficulty of constructing post-quantum secure instantiations of their primitive,
but we believe the construction is interesting even in a classical setting.
A big advantage of the LHN approach over a LWE approach is that the noise,
which plays the role of the errors in LWE-based homomorphic encryption, does not grow with repeated computation in the way that the errors grow in lattice-based constructions.
As such, there is no limitation on the number of additions that can be computed on encrypted data.
However, it is less clear how to extend this construction to a multiplicative homomorphism.
As such, the LHN approach is akin in some sense to the Benaloh~\cite{Benaloh} or Paillier~\cite{Paillier} cryptosystems.
In the nonabelian setting, Leonardi and Ruiz-Lopez's construction has some hopes of being post-quantum secure unlike the Benaloh or Paillier constructions,
but as they explored already in their work this is nontrivial to instantiate,
and our work only strengthens this claim as we show that even solvable groups may admit quantum~attacks.

$\,$\\
\noindent
Our main contributions  address \textbf{finite groups} and include:
\begin{enumerate}
    \item Reducing the security of the abelian group instantiation of Leonardi and Ruiz-Lopez's public key homomorphic encryption scheme to the discrete logarithm problem in 2-groups (under certain plausible assumptions);
    this gives a polynomial-time classical attack if the 2-part of the relevant group is cyclic, and a practical classical attack if it is a product of a small number of cyclic groups.
    \item Highlighting an abelian group instantiation of Leonardi and Ruiz-Lopez's homomorphic encryption scheme where there is no known practical classical attack,
    namely, the product of many cyclic 2-groups. This may be of interest to the community as a new example of unbounded additively homomorphic encryption.
    \item Highlighting assumptions that need to be made in order to apply any discrete-logarithm derived attack, with a view to constructing (more) examples of groups on which there is no known practical attack on Leonardi and Ruiz-Lopez's homomorphic encryption scheme.
    \item A description of a quantum attack on an instantiation with  solvable groups, under certain assumptions.
\end{enumerate}

The layout of this paper is as follows: In Section~\ref{sec:cryptosystem}, we recap the public key homomorphic encryption scheme proposed by Leonardi and Ruiz-Lopez in~\cite{Eprint}.
In Section~\ref{sec:2}, we discuss some simple instantiations: The abelian case, the noiseless case, and we give some basic security requirements (including some recalled from~\cite{Eprint}).
In Section~\ref{abelian-case} we describe our reduction from the abelian group instantiation of the Leonardi Ruiz-Lopez primitive to the (extended) discrete logarithm problem, under certain assumptions.
In \cref{sectionConvert}, we describe some ways of instantiating the primitive with nonabelian groups to which our attack on abelian groups would also apply.
In Section~\ref{sec:solvable}, we describe our quantum attack on instantiations with solvable groups, under certain assumptions on how such groups would be represented.
In Section~\ref{future-work}, we outline our plans for future work.

\section{Preliminaries}\label{sec:cryptosystem}

In this section, we describe the public-key additive homomorphic encryption of Leonardi and Ruiz-Lopez~\cite[Sec.\ 5.2]{Eprint};
we will refer to this throughout this work as \emph{Leonardi--Ruiz-Lopez encryption}.

Fix three finitely generated groups $G, H, K$ and probability distributions $\xi$ on $G$ and $\chi$ on $H$. This data should be chosen in such a way that operations can be performed efficiently in the groups and we can sample from both distributions efficiently. A natural choice could be, for instance, to take $G,H,K$ finite and $\xi,\chi$ to be uniform distributions.
The groups $G,H,K$ and the distributions $\xi,\chi$ are public. In the following sections we will mostly work with finite groups and we will always make it clear when this is the case.

\medskip

\noindent
For the \textbf{key generation}, Alice
\begin{itemize}
    \item chooses efficiently computable secret homomorphisms $\varphi \colon G \to H$ and $\psi \colon H \to K$  such that she can efficiently sample from $\ker(\psi)$
    and such that the center $\mathrm{Z}(H)$ of $H$ is not contained in $\ker(\psi)$;
    \item chooses a natural number $m$;
    \item samples elements $g_1,\dots, g_m \in G$ via $\xi$ and secret  elements $h_1,\dots,h_m \in \ker(\psi)$ via $\chi$;
    \item chooses an element $\tau \in \mathrm{Z}(H)\backslash \ker(\psi)$ of order $2$.
\end{itemize}
Alice computes the public key as the set

\[ \{(g_1,\varphi(g_1)h_1), \dots, (g_m,\varphi(g_m)h_m), \tau \}.    \]
Note that, whereas the elements $g_1,\dots,g_m$ are public,  both $\varphi$ and $h_1,\dots,h_m$ are private (as are also $\psi$ and $\ker(\psi)$).

\medskip

\noindent
For \textbf{encrypting} a one-bit message $\beta \in \{0,1\}$, Bob chooses a natural number $\ell$, then samples a word $w=w_1\cdots w_{\ell}$  over the indices $ \{1,\dots, m\}$ and using Alice's public key, he computes
\[ (g,h')=(g_{w_1}\cdots g_{w_{\ell}},\varphi(g_{w_1})h_{w_1}\cdots \varphi(g_{w_{\ell}})h_{w_{\ell}} ).
\] He then sends $(g,h)=(g,h'\tau^\beta)$ to Alice.

\medskip

\noindent
For \textbf{decrypting} $(g,h)$, Alice computes $\nu=\psi(\varphi(g))^{-1}\cdot\psi(h) \in K$ and deduces that the message $\beta$ equals $0$ if $\nu$ equals $1_K$ (and else, $\beta$ equals $1$).

\medskip

To see that the decryption indeed produces the correct message $\beta$, recall that $h_1,\dots, h_m$ are contained in $\ker(\psi)$.  Hence $\nu=\psi(\tau)^\beta$  and, since $\tau$ is not contained in $\ker(\psi)$, the element $\nu$  equals $1$ if and only if $\beta$ equals $0$.

\newcommand{\textsf{LHN-PKE}}{\textsf{LHN-PKE}}

For the convenience of the reader, we give a schematic summary of the data described above:
\begin{center}
\renewcommand{\arraystretch}{1.5}%
\begin{tabular}{ |c|c|c| }
 \hline
\ \  Public information \ \  & \ \  Alice's private information \ \  & \ \  Bob's private information \ \ \\
\hline
$G, H, K, \xi, \chi$ & $\phi:G\rightarrow H$  &  \\
  \ $(g_1,\varphi(g_1)h_1), \dots, (g_m,\varphi(g_m)h_m)$  \  & $\psi:H\rightarrow K$  & $\beta\in\{0,1\}$ \\
$\tau\in \mathrm{Z}(H)\setminus\ker(\psi)$ &  $\ker(\psi)$&  word $w$\\
$(g,h)=(g,h'\tau^\beta) \in G \times H$ & $h_1,\ldots,h_m\in\ker(\psi)$ & \\
 \hline
\end{tabular}
\end{center}

\subsection{Homomorphic properties}\label{sec:homomorphic}

The primary selling point of Leonardi--Ruiz-Lopez encryption is that it is \emph{unbounded additive homomorphic}.
We say that an encryption function $E$ from plaintext to ciphertext space is \emph{additive} if the plaintext space admits an additive operator $+$ and, given encryptions $E(\beta)$ and $E(\tilde{\beta})$ of messages $\beta$ and $\tilde{\beta}$ respectively, one can compute a valid encryption $E(\beta + \tilde{\beta})$ of $\beta + \tilde{\beta}$ (without the knowledge of the plaintext $\beta + \tilde{\beta}$).
We say that $E$ is \emph{unbounded additive homomorphic} if such additions can be performed an unbounded number
of times without introducing systematic decryption failures.\footnote{
The number of additions is bounded in, for example, LWE-based homomorphic encryption, where the error grows too large.
}

The reader may have observed that $\tau$ having order two is not necessary for successful decryption;
this property is needed to make the encryption additive,
as we now recall from~\cite{Eprint}.

Write the encryptions of $\beta$ and $\tilde{\beta}$ sampled from $\{0,1\}$ as
\[(g,h'\tau^{\beta}) = (g_{w_1}\cdots g_{w_{\ell}},\varphi(g_{w_1})h_{w_1}\cdots \varphi(g_{w_{\ell}})h_{w_{\ell}} \tau^\beta)\]
and
\[(\tilde{g},\tilde{h}'\tau^{\tilde{\beta}}) = ({g}_{\tilde{w}_1}\cdots {g}_{\tilde{w}_{\tilde{\ell}}}, \varphi({g}_{\tilde{w}_1}){h}_{\tilde{w}_1}\cdots \varphi({g}_{\tilde{w}_{\tilde{\ell}}}){h}_{\tilde{w}_{\tilde{\ell}}}  \tau^{\tilde{\beta}})\]
respectively.
Then, as $\tau$ is central in $H$ and has order 2,
we can construct a valid encryption of $\beta + \tilde{\beta}$ via the observation that
\begin{align*}
    &\varphi(g_{w_1})h_{w_1}\cdots \varphi(g_{w_{\ell}})h_{w_{\ell}} \tau^\beta
{\varphi}({g}_{\tilde{w}_1})h_{\tilde{w}_1}\cdots {\varphi}({g}_{\tilde{w}_{\tilde{\ell}}}){h}_{\tilde{w}_{\tilde{\ell}}}  \tau^{\tilde{\beta}}
\\=
&\,\varphi(g_{w_1})h_{w_1}\cdots \varphi(g_{w_{\ell}})h_{w_{\ell}}
{\varphi}({g}_{\tilde{w}_1}){h}_{\tilde{w}_1}\cdots {\varphi}({g}_{\tilde{w}_{\tilde{\ell}}}){h}_{\tilde{w}_{\tilde{\ell}}}
\tau^{\beta + \tilde{\beta}};
\end{align*}
this encryption is given by
\[(g,h'\tau^\beta)(\tilde{g},\tilde{h}'\tau^{\tilde{\beta}})=(g\tilde{g},h'\tau^{\beta}\tilde{h'}\tau^{\tilde{\beta}})=(g\tilde{g},h'\tilde{h'}\tau^{\beta+\tilde{\beta}}).\]

\begin{rmk}
    Note that, for Leonardi--Ruiz-Lopez encryption to be fully homomorphic, it would also need to be \emph{multiplicative}: That is, at the very least,
    given valid encryptions of $E(\beta)$ and $E(\tilde{\beta})$, we should be able to deduce a valid encryption of $\beta\tilde{\beta}$.
    It is not at all obvious if this is even possible.
    On an abstract level our encryption function from plaintext to ciphertext space maps
    \[E: \{0,1\} \rightarrow G\times H,\]
    where the domain can be naturally endowed with a ring structure using addition and multiplication mod 2,
    but there seems to be no natural extra operation on $G\times H$ that would allow us to deduce a valid encryption of $\beta\tilde{\beta}$. We stress that in the case of LWE-based homomorphic encryption, both plaintext and ciphertext spaces come equipped with a ring structure, so the equivalent of our function $E$ is generally taken to be a ring homomorphism.

    The map $E$ being a ring homomorphism is, however, not always strictly necessary to deduce a valid encryption of $\beta\tilde{\beta}$.
    If in future work we were to succeed in deducing a valid encryption of $\beta \tilde{\beta}$, we expect that this will only apply to a specific instantiation of
    Leonardi--Ruiz-Lopez encryption, not one for abstract groups, where there is more structure to be exploited.
\end{rmk}

\subsection{Remarks on Leonardi--Ruiz-Lopez encryption}

\noindent
Some remarks on the construction above:
\begin{enumerate}[label=$(\mathrm{R}\arabic*)$]
    \item The underlying hard problem of this encryption scheme is described as the $\textsf{LHN-PKE}$ problem, so named as it is based on the Learning Homomorphisms with Noise problem (LHN) but is adapted to this Public Key Encryption scheme (PKE).

\begin{definition}\label{def-LHN-PKE}
    Let $G, H, K, \xi,$ and $ \chi$ be as above. We define the \emph{$\textsf{LHN-PKE}$} problem for $G, H, K, \xi,$ and $ \chi$ to be: Given
    $G, H, K, \xi,$ and $\chi$,
    for any
    \begin{itemize}
        \item $\varphi$ sampled uniformly at random from $\Hom(G,H)$,
        \item $\psi$ sampled uniformly at random from the elements of $\Hom(H,K)$ whose kernel does not contain $\mathrm{Z}(H)$,
        \item $g_1,\ldots,g_m$ sampled from $G$ using $\xi$,
        \item $h_1,\ldots,h_m$ sampled from $\ker(\psi)$ using $\chi$,
        \item $\tau$ sampled from the order $2$ elements of $\mathrm{Z}(H) \setminus \ker(\psi)$ using $\chi$,
        \item $\beta$ sampled uniformly at random from $\{0,1\}$,
        \item small $\ell$ and word $w=w_1\cdots w_{\ell}$ sampled uniformly at random from $\{1,\cdots,m\}^{\ell}$,
    \end{itemize}
    recover $\beta$ from the following information:
    \begin{itemize}
        \item $(g_1,\varphi(g_1)h_1), \ldots, (g_m,\varphi(g_m)h_m)$,
        \item $\tau$,
        \item $g=g_{w_1}\cdots g_{w_{\ell}}$,
        \item $h = h'\tau^\beta = \varphi(g_{w_1})h_{w_1}\cdots \varphi(g_{w_{\ell}})h_{w_{\ell}} \tau^\beta$.
    \end{itemize}
\end{definition}

    \item In order for the encryption and decryption to work, the assumptions that $\tau$ is central or of order $2$ are not necessary. The reason we work under these assumptions is, as explained in \cref{sec:homomorphic}, that in this case, the cryptosystem is unbounded additive homomorphic.

    \item\label{rmk:wlog-gen}
Once Alice has fixed the elements $g_1,\dots,g_m$ and determined the public key, all computations inside $G$ actually take place inside the subgroup $\langle g_1,\dots, g_m \rangle$ that is generated by $g_1,\ldots,g_m$. So for cryptanalysis, we may and will assume that $G$ is generated by $g_1,\dots,g_m$, i.e.\ that  $G=\langle g_1,\dots, g_m \rangle$.

    \item The work of~\cite{Eprint} was inspired by~\cite{Baumslag}, which introduces the Learning Homomorphisms with Noise problem in order to construct a symmetric primitive. However, the noise accumulates in the construction of~\cite{Baumslag} in a manner akin to the error growth in LWE constructions. Leonardi and Ruiz-Lopez also introduce a symmetric primitive in~\cite{Eprint}, but we focus on the PKE construction in this work.

    \item The noise consists of the elements $h_1,\dots,h_m$ that are mixed into the product $h'$ in the second component $h$ of the ciphertext. These elements are chosen to be in the kernel of $\psi$ and therefore get erased during decryption. `Being contained in the kernel' of $\psi$ can thus be thought of as an equivalent of `the error being small' in the LWE-based encryption of~\cite{Regev} or `the noise being small' in LHN-based encryption of~\cite{Baumslag}.
    The strength of Leonardi--Ruiz-Lopez encryption is that the noise does not accumulate and will not lead to systematic decryption errors, since in the decryption process, we can erase the noise neatly by applying~$\psi$.

\end{enumerate}

\section{Simple instantiations and security}\label{sec:2}

In this section, we describe some simple instantiations of Leonardi--Ruiz-Lopez encryption.
The abelian case is a central focus of this paper as it is much simpler to describe than the general case;
the description below is for the reader who wishes only to understand the abelian case.
We also describe the noiseless case in order to highlight the role that the noise plays in the encryption.
Finally we discuss the requirements on the setup parameters of Leonardi--Ruiz-Lopez encryption in order to achieve security against some naive classical attacks,
concluding this section with a list of properties that the groups must have for any classically secure instantiation.

\subsection{The abelian case}
If $H$ is abelian, we can rewrite
$(g,h)= (g_{w_1}\cdots g_{w_{\ell}},\varphi(g_{w_1})h_{w_1}\cdots \varphi(g_{w_{\ell}})h_{w_{\ell}}\cdot\tau^\beta )$ as
\[ (g,h)= (g_{w_1}\cdots g_{w_{\ell}},\varphi(g_{w_1})\cdots \varphi(g_{w_{\ell}})h_{w_1}\cdots h_{w_{\ell}}\cdot\tau^\beta )=(g,\varphi(g)h_{w_1}\cdots h_{w_{\ell}}\cdot\tau^\beta).\]
If both $G$ and $H$ are abelian, it makes sense to switch to the following notation:
Instead of choosing indices $w_1,\dots,w_{\ell}$, Bob just chooses non-negative integers $r_1,\dots,r_m$ and encrypts $\beta$ to
\[ (g,h)= (g_1^{r_1}\cdots g_m^{r_m},\varphi(g_1^{r_1})\cdots \varphi(g_m^{r_m})h_1^{r_1}\cdots h_m^{r_m}\cdot\tau^\beta )=(g,\varphi(g)h_1^{r_1}\cdots h_m^{r_m}\cdot\tau^\beta).\]
This system has been claimed to not be quantum secure in \cite[Section~8.2]{Eprint}, cf.\ also \cref{sec:LRL-cryptanalysis}, while we discuss security in the classical sense in \cref{sec:assumptions}. Moreover, in \cref{sectionConvert}
we describe instantiations of the $\textsf{LHN-PKE}$ problem in which $G$ and $H$ are nonabelian but the security reduces to the case in which they are.

\subsection{The noiseless case}\label{sec:noiseless}
Let us assume that $h_1=h_2=\dots=h_m=1$. Then the public key consists of all pairs $(g_i,\varphi(g_i))$ together with $\tau$ and Bob would encrypt the message $\beta \in \{0,1\}$ to
\[ (g,h)=(g_{w_1}\cdots g_{w_{\ell}},\varphi(g_{w_1})\cdots \varphi(g_{w_{\ell}})\tau^\beta)=(g,\varphi(g)\tau^\beta).
\]
Let Eve be an attacker who is aware of the fact that Alice decided to work in a noiseless setting. Then Eve knows all $g_i$'s as well as their images $\varphi(g_i)$ from the public key. If she can write $g$ as a product in $g_1,\dots,g_m$, then she can compute $\varphi(g)$. Knowing $\tau$ from the public key, Eve can then decrypt $(g,h)=(g,\varphi(g)\tau^\beta)$. Note that even if Eve did not use the same word $w_1\cdots w_{\ell}$ as Bob to write $g$ as a product in $g_1,\dots,g_m$, she would nonetheless obtain the correct value of $\varphi(g)$.

Of course, finding such a word might still be a hard problem, even if $m=1$. For example, if $G$ is the multiplicative group of a finite field and $g_1$ is a generator, finding a word in $g_1$ defining $g$ is the same as solving the discrete logarithm problem, which is known to be hard for classical computers (though there are quantum algorithms to solve it, see \cite{Shor_1, Shor_2}). Alice, on the other hand, will probably have a closed form describing $\varphi$ that does not require to write elements as products in $g_1,\dots,g_m$ when she applies $\varphi$ in the decryption process (and similarly for $\psi$). In the $m=1$ example above, she would choose $\varphi$ to take every element to a certain power.

For attacking the cryptosystem in the general case, a possible strategy is to construct attacks that reduce to the noiseless case. We will come back to such attacks in \cref{sec:security}.

\subsection{Security}\label{sec:security}

In all that follows, let $\lambda$ be the security parameter.\footnote{
Typically, we want any computations undertaken by the user to have complexity that is polynomial in $\lambda$, and an attacker who attempts to decrypt by guessing any unknowns should only succeed with probability at most $2^{-\lambda}$.}

\subsubsection{Many homomorphisms}
First of all, note that an attacker who can guess both $\varphi$ and $\psi$ can decrypt in the same way Alice does.
Denote the set of all possible choices for $\psi$ by
\[\operatorname{Hom}(H,K)^- = \{ \psi \in \operatorname{Hom}(H,K) :
\mathrm{Z}(H) \not\subseteq \ker(\psi)\}.\]
To avert brute force attacks, the groups $G,H,K$ should be chosen in such a way that $\operatorname{Hom}(G,H)$ and $\operatorname{Hom}(H,K)^-$ are of size at least $\Theta(2^{\lambda})$,\footnote{
We are using Bachmann-Landau notation for complexity, see for example Section 1.2.11.1 of~\cite{Knuth}.
}
and $\varphi$ and $\psi$ should be sampled uniformly at random from
$\operatorname{Hom}(G,H)$ and $\operatorname{Hom}(H,K)^-$ respectively.
This ensures that if an attacker guesses $\varphi$ she succeeds with probability $2^{-\lambda}$, and similarly for $\psi$.

\subsubsection{Words}
As we already saw in the noiseless case, there are links between the $\textsf{LHN-PKE}$ problem and the ability of an attacker to write $g$ as an expression in the generators $g_1,\ldots,g_m$.
Assume for instance that Eve wants to decrypt the cyphertext $(g,h)$. She knows that $g$ is a product in $g_1,\dots,g_m$ and recall that $g_1,\dots,g_m$ are public.
If she knows the exact expression of $g$ as a product in $g_1,\dots,g_m$ that Bob used in the encryption process, then she can compute $h'$ from the public key, erase it from $h=h'\tau^\beta$, and recover the message $\beta$.
It is important to note that other than in the noiseless case, it is in general not enough to find \textit{any} expression of $g$ as a product in $g_1,\dots,g_m$, because that product will in general not produce the correct term $h'$ yielding to a different accumulation of the noise.
That is, the attacker needs to recover the \emph{correct} word $w$, not just any expression of $g$ in $g_1\ldots,g_m$. In the cryptanalysis we carry out in \cref{abelian-case} for finite abelian $G$, $H$, and $K$, we give a reduction of $\textsf{LHN-PKE}$ to the extended discrete logarithm problem for finite $2$-groups; our reduction circumnavigates the issue of finding the correct word.

\subsubsection{An attack on instances with few normal subgroups}

The idea behind the following attack is to replace Alice's secret $\psi:H\rightarrow K$ with some new $\bar \psi:H\rightarrow L$ erasing the noise without erasing~$\tau^\beta$ (for instance $L$ could be a quotient of $H$, as described below).
A similar attack was also described in Section 7.2 of \cite{Eprint}.
Assume that Eve knows a normal subgroup $N$ of $H$ that contains all elements $h_1,\dots,h_m$ but does not contain $\tau$. She can then define $\bar \psi\colon H \to H/N$ as the natural projection and by applying $\bar \psi$ to all second coordinates of the elements $(g_i,\varphi(g_i)h_i)$ in the public key and to the second coordinate of the encrypted message $(g,h)$ she can switch to the noiseless case; cf.\ \cref{sec:noiseless}.
We deduce in particular, that there should be at least $\Theta(2^{\lambda})$ normal subgroups in $H$,
so that if an attacker guesses $\ker(\psi)$ she succeeds with probability $2^{-\lambda}$.

\subsubsection{An attack on instances with weak normal subgroups}

Now suppose that an attacker can find a normal subgroup $N$ of $H$ that contains $\varphi(g_i)h_i$ for all $i=1,\dots,m$ but does not contain $\tau$ (note that these elements are all public so it is easy to check these conditions).
Then she can directly apply the projection $H\to H/N$ to the second coordinate in the encrypted message $(g,h)$ and can deduce that $\beta$ equals zero if and only if she obtained the neutral element in $H/N$.
To avoid such an attack it seems that Alice should check, after the key generation process, whether the normal closure of $\langle \varphi(g_1)h_1,\dots,\varphi(g_m)h_m \rangle$ contains $\tau$ and if it doesn't she should choose a different key.
For cryptanalysis, we may thus assume that $H$ equals the normal closure of $\langle \varphi(g_1)h_1,\dots,\varphi(g_m)h_m \rangle$ (as otherwise, we can just work in this smaller group). In particular, if $H$ is abelian, we may assume $H=\varphi(G)\ker\psi$.

\subsubsection{A summary of the discussed security assumptions}\label{sec:security-assumptions}

We conclude this section with a list of necessary properties for security deduced from the list of naive attacks above:

\begin{enumerate}[label=$(\mathrm{S}\arabic*)$]
    \item\label{it:S1} $\operatorname{Hom}(G,H)$ and $\operatorname{Hom}(H,K)^-$ are of size exponential in the security parameter;

    \item\label{it:S2} finding the precise word $w$ used to express $g$ as a product in the $g_i$'s in the encryption phase has complexity that is exponential in the security parameter;
    \item\label{it:S3} the number of normal subgroups in H is exponential in the security parameter;
    \item\label{it:S4} the normal closure of $\langle \varphi(g_1)h_1,\dots,\varphi(g_m)h_m \rangle$ contains $\tau$.
\end{enumerate}

\section{Cryptanalysis in the finite abelian case}\label{abelian-case}
In this section, we discuss the hardness of $\textsf{LHN-PKE}$ under the assumption that $G$ and $H$ are finite and that $H$ is abelian.
Leonardi and Ruiz-Lopez~\cite{Eprint} dismissed the abelian instantiation due to an argument that there should exist a polynomial-time quantum algorithm for the $\textsf{LHN-PKE}$ problem;
the reduction is more complex than is suggested in~\cite{Eprint} but their statement is true as we show in \cref{sec:LRL-cryptanalysis}.
Nevertheless, the unbounded homomorphic property of the proposed cryptosystem is sufficiently powerful that a classically secure construction would also be of great interest to the cryptographic community.
We show that, if $H$ is abelian, under some mild assumptions that we introduce in \cref{sec:assumptions}, the $\textsf{LHN-PKE}$ problem for $G$ and $H$ can be reduced to the extended discrete logarithm problem (cf.\ \cref{def:eDLP}) in some specific abelian $2$-group.

Assume that $G$ and $H$ are finite and that $H$ is abelian.  Given the following public information
\begin{enumerate}
    \item $\{(g_1,\varphi(g_1)h_1),\ldots,(g_m,\varphi(g_m)h_m),\tau\}$ and
    \item $(g,h)=(g,h'\tau^\beta) \in G \times H$
\end{enumerate}
one can proceed as follows:
\begin{itemize}
    \item
    In case $G$ is not abelian,
    the $\textsf{LHN-PKE}$ problem for $G,H,K,\xi,$ and $\chi$ is reduced to the $\textsf{LHN-PKE}$ problem for $\overline{G} = G/[G,G], H, K, \xi$, and $\chi$ following \cref{G_also_abelian}: Here
    $[G,G]$ denotes the commutator subgroup of $G$, so $\overline{G}$ is abelian.
    \item In case $G$ is also abelian and satisfies some additional assumptions presented in \cref{sec:assumptions}, the $\textsf{LHN-PKE}$ problem for $G,H,K,\xi,$ and $\chi$ is reduced to the eDLP problem in $G$, as defined in \cref{sec:assumptions}.
    \item In case $G$ is also abelian and satisfies some additional assumptions presented in \cref{sec:assumptions}, the $\textsf{LHN-PKE}$ problem for $G,H,K,\xi,$ and $\chi$ reduces to the $\textsf{LHN-PKE}$ problem for
    $G_2, H_2, K, \xi$, and $\chi$, where
    $G_2$ and $H_2$ are the Sylow 2-subgroups of $G$ and $H$, respectively.
\end{itemize}
To conclude, in \cref{sec:limitations} we discuss the genericity and limitations of the assumptions made in \cref{sec:assumptions}, as well as the impact of the reductions made.

\subsection{A simplified setting for $\textsf{LHN-PKE}$  when $H$ is abelian}

In this section we take $H$ to be abelian and we show that, for cryptanalysis, one can can consider, instead of $G$, its abelianization $G/[G,G]$.

\begin{lemma}\label{G_also_abelian}
Assume $H$ is abelian. Then the $\textsf{LHN-PKE}$ problem for $G,H,K,\xi,$ and $\chi$ is at most as hard as the $\textsf{LHN-PKE}$ problem for $\overline{G} = G/[G,G], H, K, \xi$, and $\chi$.
\end{lemma}
\begin{proof}
Since $H$ is abelian, the commutator subgroup $[G,G]$ of $G$ is contained in the kernel of $\varphi$. Define $\overline{G}=G/[G,G]$. Then $\varphi\colon G\to H$ induces a well-defined homomorphism $\overline{\varphi} \colon \overline{G} \to H$ and any ciphertext $(g,h)$ can be interpreted as the ciphertext $(\bar g, h)$ in the cryptosystem given by $\overline{\varphi} \colon \overline{G} \to H$, $\psi\colon H \to K$ as before and public key given by $(\overline{g_i},\bar \varphi(\overline{g_i})h_i)$ for $i=1,\dots,m$ together with the same $\tau$ as before. Indeed, if Bob used the word $w_1\cdots w_{\ell}$ to encrypt $(g,h)$, then the same word gives rise to the encryption $(\bar g, h)$ in the new cryptosystem of the same message.
\qed
\end{proof}

\subsection{Cryptanalysis for abelian groups}\label{sec:assumptions}

In \cref{sec:assumptions} we discuss the $\textsf{LHN-PKE}$ problem for $G,H,$ and $K$ finite and abelian.
In each subsection, we explicitly mention under which assumptions from the following list we are working.
For  a group $\Gamma$ and $\gamma_1,\ldots,\gamma_m\in\Gamma$, we are interested in the following properties:

\begin{enumerate}[label=$(\mathrm{A}\arabic*)$]
    \item\label{it:A1} $\Gamma$ is abelian;
    \item\label{it:A2} the largest positive odd factor of the order $|\Gamma|$ of $\Gamma$ is known (or easily computable);
    \item\label{it:A3} $\gamma_1,\ldots,\gamma_m\in \Gamma$ are such that $\Gamma=\gen{\gamma_1}\oplus\ldots\oplus\gen{\gamma_m}$;
    \item\label{it:A4} The orders $|\gamma_1|,\ldots,|\gamma_m|$ of $\gamma_1,\ldots,\gamma_m$ are known (or easily computable).
\end{enumerate}

Under Assumptions \ref{it:A1}, \ref{it:A3}, and \ref{it:A4} the following problem is well-posed.

\begin{definition}\label{def:eDLP}
The \emph{extended discrete logarithm problem (eDLP)}  for $\Gamma$ is the problem of determining, for each $x\in \Gamma$, the unique vector \[(\alpha_1,\ldots,\alpha_m)\in \Z/|\gamma_1|\Z\times \ldots\times\Z/|\gamma_m|\Z\] such that
    \[x=\gamma_1^{\alpha_1}\cdots \gamma_m^{\alpha_m}.\]
\end{definition}

\noindent
Note that eDLP is just called \emph{discrete logarithm problem} (DLP) in \cite{Sutherland}. For a discussion of existing algorithms to solve it, we refer to \cref{sec:eDLP2gps}.

\subsubsection{From $\textsf{LHN-PKE}$ to eDLP}\label{sec:attack2gps}

\noindent
In this section, we work under Assumptions \ref{it:A1}, \ref{it:A3}, and \ref{it:A4} of \cref{sec:assumptions}. More precisely, we assume that $G$ and $H$ are abelian, $G$ is finite and satisfies $G=\gen{g_1}\oplus\ldots\oplus\gen{g_m}$, and the orders of $g_1,\ldots,g_m$ are known.

\begin{proposition}\label{lem:h_i<g_i}
The $\textsf{LHN-PKE}$ problem for $G,H,K,\xi,$ and $\chi$ is at most as hard as the \emph{eDLP} problem in $G$.
\end{proposition}

\begin{proof}
Let $r_1\ldots,r_m\in\Z$ be the non-negative integers chosen to write $$g=g_1^{r_1}\cdots g_m^{r_m} \ \ \textup{ and } \ \ h=\varphi(g)h_1^{r_1}\cdots h_m^{r_m}\cdot\tau^\beta.$$
For each $i\in\{1,\ldots,m\}$, set $\ell_i=\varphi(g_i)h_i$ and, given that the order of $\varphi(g_i)$ divides $|g_i|$, compute
 \[
 \ell_i^{|g_i|}=(\varphi(g_i)h_i)^{|g_i|}=h_i^{|g_i|}.
 \]
 As a consequence, the subgroup $M$ of $H$ that is generated by $Y=\{\ell_i^{|g_i|} : i=1,\ldots,m\}$ is contained in $\ker(\psi)$ and thus does not contain $\tau$. Since the orders of the $g_i$'s are known, the subgroup $M$ can be easily determined.

We show that, eDLP being solvable in $G$ yields also  $\textsf{LHN-PKE}$ being solvable in this context. To this end, let $s_1,\ldots,s_m$ be such that, for any choice of $i$, one has $s_i\equiv r_i \bmod |g_i|$. From the public information, one easily computes
\begin{align*
    X & = \prod_{i=1}^m(\ell_i^{s_i})^{-1}\cdot h=\prod_{i=1}^m\ell_i^{r_i-s_i}\cdot\tau^{\beta}=\prod_{i=1}^m\varphi(g_i)^{r_i-s_i}h_i^{r_i-s_i}\cdot \tau^{\beta}.
\end{align*}
Since $r_i-s_i$ is a multiple of $|g_i|$, it is straightforward to see that $X\in M$ if and only if $\beta=0$, i.e., working modulo the subgroup $M$, one can recover $\beta$ from the public information.
\qed
\end{proof}

\subsubsection{From abelian groups to $2$-groups}\label{sec:reduce_2}
In this section, we assume that \ref{it:A1} and \ref{it:A2} from \cref{sec:assumptions} hold, i.e.\ we assume that both $G$ and $H$ are finite abelian groups and that the odd parts of $|G|$ and $|H|$ are known. We let $G_2$ and $H_2$ denote the unique Sylow $2$-subgroups of $G$ and $H$, respectively. In the new language, $\tau$ and $\tau^\beta$ belong to $H_2$.
In the following, we show that in the case of abelian groups, the $\textsf{LHN-PKE}$ problem for the original data reduces to the $\textsf{LHN-PKE}$ problem for the 2-parts $G_2$ and $H_2$ (with the induced data).

\begin{theorem}\label{result_abelian}
The $\textsf{LHN-PKE}$ problem for $G, H, K, \xi$, and $\chi$ is at most as hard as the $\textsf{LHN-PKE}$ problem for $G_2, H_2, K, \xi$, and $\chi$.
\end{theorem}
\begin{proof}
Write the orders of $G$ and $H$ as
\[ |G|=2^{n_G}q_G, \  |H|=2^{n_H}q_H \]
where $q_G$ and $q_H$ are odd numbers.
Define $q$ as the least common multiple of $q_G$ and $q_H$ or any other odd common multiple (such as $q_{G}q_{H}$ which might be easier to compute).
Then for any elements $g \in G$ and $h \in H$,
the orders of $g^q$ and $h^q$ are both powers of $2$, i.e.\ $g^q\in G_2$ and $h^q\in H_2$.
Moreover, $G$ and $H$ being abelian, the assignment $x \rightarrow x^q$ defines  homomorphisms $G\to G_2$ and $H\to H_2$.

Equip $G_2$ and $H_2$ with the induced distributions $\xi$ and $\chi$ and write $\varphi_2\colon G_2\to H_2$ and $\psi_2\colon H_2\to K$ for the restrictions of $\varphi$ and $\psi$ to $G_2$ and $H_2$, respectively. Assume that $\beta$ can be recovered from $(G_2, H_2, K, \xi,\chi)$. We show that $\beta$ can be determined from $(G, H, K, \xi,\chi)$.

Recall that the pair $(g,h)=(g_1^{r_1}\cdots g_m^{r_m},\varphi(g)h_1^{r_1}\cdots h_m^{r_m}\cdot\tau^\beta)=(g,h'\tau^\beta) \in G\times H$ is public. Raising both entries to their $q$-th power, one obtains
 \[
 (g^q,h^q)=((g_1^q)^{r_1}\cdots (g_m^q)^{r_m},\varphi(g^q)\cdot(h_1^q)^{r_1}\cdots (h_m^q)^{r_m}\cdot(\tau^q)^\beta)=(g^q,(h')^q\tau^\beta)\in G_2\times H_2.
 \]
From the last equation it is clear that
the elements $g_1,\dots,g_m \in G$ and
$h_1,\dots,h_m \in H$ are replaced with their $q$-th powers $g_1^q,\dots,g_m^q \in G_2$ and $h_1^q,\dots,h_m^q\in H_2$. Moreover, as $\tau=\tau^q$, it holds that $\tau \in H_2\setminus\ker(\psi)$ and so the pair $(\tau,\beta)$ is preserved. By assumption $\beta$ is determined from the data associated to the $2$-parts and so the proof is complete.
\qed
\end{proof}

\subsection{Assumptions and reductions}\label{sec:limitations}

Assume in this section that $G$ and $H$ are finite and that $H$ is abelian.

Thanks to \ref{rmk:wlog-gen}, for cryptanalysis purposes, we can replace $G$ with $\tilde{G}=\gen{g_1,\ldots,g_m}$ and we do so. Moreover,
in view of \cref{G_also_abelian}, the $\textsf{LHN-PKE}$ problem on the pair $(\tilde{G},H)$ is reduced to the $\textsf{LHN-PKE}$ problem on the pair $(\overline{G},H)$, where $\overline{G}$ denotes the abelianization of $\tilde{G}$. Assumption \ref{it:A1} holds for the last pair and the elements $g_1,\ldots,g_m\in G$ are replaced with their images $\overline{g_1}, \ldots,\overline{g_m}$ in $\overline{G}$ and the homomorphism $\phi:\tilde{G}\rightarrow H$ with the induced homomorphism $\overline{G}\rightarrow H$, which we identify with $\phi$, for simplicity.

Assuming now that \ref{it:A2} holds for $H$ and $\overline{G}$, \cref{result_abelian} allows to reduce the $\textsf{LHN-PKE}$ problem on $(\overline{G},H)$ to the $\textsf{LHN-PKE}$ problem on $(\overline{G}_2,H_2)$, where $\overline{G}_2$ and $H_2$ denote the Sylow $2$-subgroups of $\overline{G}$ and $H$. Here the elements $\overline{g_1},\ldots,\overline{g_m}$ and $h_1,\ldots,h_m$ are replaced by
\[\overline{g_1}^q,\ldots,\overline{g_m}^q \ \ \textup{ and } \ \ h_1^q,\ldots,h_m^q\]
where $q$ denotes the least common multiple of the odd parts of $|\overline{G}|$ and $|H|$.

Set $X_2=\gen{\overline{g_1}^q,\ldots,\overline{g_m}^q}$ and  suppose, at last, that \ref{it:A3} and \ref{it:A4} hold for $X_2$ namely that
\[X_2=\gen{\overline{g_1}^q}\oplus\ldots\oplus\gen{\overline{g_m}^q}\]
and the sizes of the summands are known. Then, as a consequence of \cref{lem:h_i<g_i}, the $\textsf{LHN-PKE}$ problem for $(\overline{G}_2,H_2)$ is reduced to the eDLP problem in $\overline{G}_2$.

While assumptions~\ref{it:A1}--\ref{it:A4} are natural assumptions to make when constructing groups that both admit efficient computation and satisfy the security requirements \ref{it:S1}--\ref{it:S4} of \cref{sec:security-assumptions},
there exist examples of groups where these assumptions are not satisfied or may be at odds with our security requirements.
In this section we discuss assumptions~\ref{it:A1}--\ref{it:A4} with a view towards constructing instantiations of Leonardi--Ruiz-Lopez encryption to which our classical attack does not apply, or at least is not polynomial-time.

\subsubsection{The eDLP in finite abelian $p$-groups}\label{sec:eDLP2gps}

Let $p$ be a prime number and let $G$ be a finite abelian $p$-group given as
\[G=\gen{g_1}\oplus\ldots\oplus\gen{g_m},\]
where the orders of the summands are known.
Let $e\in\Z$ be such that $p^e$ is the exponent of $G$. Then, according to \cite[Cor.~1]{Sutherland}, the eDLP in $G$ can be solved using
\begin{equation} \label{re} O\left(
\frac{\log(e+1)}{\log\log(e+2)}\log|G|+\frac{\log_p|G|}{m}p^{m/2}
\right)
\end{equation}
group operations on a classical computer.
In particular, when $m$ is polynomial in $\log\log |G|$, the eDLP has complexity polynomial in $\log|G|$.
When $p=2$, setting  $n= \log_p|G|$, we deduce the following from the performance result in  \cite[Table~1]{Sutherland}:
\begin{itemize}
    \item When $m =1,2,4,8,$ the counts are dominated by the first term of \eqref{re}. This explains the initial cost decrease when $m$ increases for a fixed $n.$
    \item Using Shank's algorithm, there is a possibility of improving the factor $n/m$ by $\sqrt{n/m}$ though this is not relevant for applications: these normally require that $n/m$ is close to $1.$
\end{itemize}
To the best of our knowledge, there is no existing work on the eDLP that beats~\cite{Sutherland}.

\subsubsection {On the security assumptions \ref{it:A2} and \ref{it:A4}} \label{RSAetc}
In \cref{sec:attack2gps} above we described how and under which assumptions the $\textsf{LHN-PKE}$ problem for $G$, $H$, and $K$ can be reduced to solving the eDLP in $G$.
The necessity for setting assumptions \ref{it:A2} and  \ref{it:A4} in particular, came from the fact that there are known examples of abelian groups, some of them already being used successfully in existing  cryptographic protocols, that do not have to obey them.

One type of such groups are the known RSA groups. These are given in the form $(\mathbb{Z}/N\mathbb{Z})^{\times}$ where $N = pq$ is hard to factor. In this case, Alice would know the factorisation and hence the order of the group, but an adversary should not be able to compute it.

Another type of such groups, where even the creators of the cryptosystem might not know the group's order, is that of ideal class groups of imaginary quadratic fields. This is an interesting category of groups for cryptography since it allows one to work in a \emph{trustless setup}. In other words, we do not need a trusted third party to generate groups of secure order, in contrast to cryptosystems that employ RSA groups for example, where a trusted third party needs to generate a secure, i.e. hard to factor, modulus $N \in \mathbb{N}$ for the groups $(\mathbb{Z}/N\mathbb{Z})^{\times}$. Despite the fact that neither the structure nor the order of the ideal class group is known, the group operation is efficient and the elements of the group have a compact representation, via reduced binary quadratic forms. An excellent reference for trusted unknown-order groups is the paper by Dobson, Galbraith and Smith \cite{DGS};
 they also take into account Sutherland's algorithm \cite{SuthClass} and they propose new security parameters for cryptosystems that employ ideal class groups. In the same paper the authors also discuss other groups of unknown order that can be used, namely genus-$3$ Jacobians of hyperelliptic curves, initially introduced by Brent \cite{Brent}. Even though these groups appear to have some computational advantages when compared to ideal class groups, these advantages exist only in theory for now since these genus-3 Jacobians have not yet been implemented.

\subsubsection{Regarding Assumption \ref{it:A3}}

In this section, we discuss Assumption \ref{it:A3}. For the sake of simplicity and in view of \cref{sec:reduce_2}, we restrict to $2$-groups but everything can be said similarly for arbitrary finite abelian groups using \cref{result_abelian}.

    The case where Assumption \ref{it:A3} holds for $\gen{g_1,\ldots,g_m}$, i.e., $g_1,\dots,g_m$ are independent and satisfy $\langle g_1,\dots,g_m \rangle =\gen{g_1}\oplus\ldots\oplus\gen{g_m}$, seems to be the key case out of the following reasons. First of all, when sampling $g_1,\dots,g_m$ from $G$ uniformly, it is very likely that these are independent at least if $m$ is small in comparison with the number of cyclic factors in $G$. For example, if $G=C_2^\lambda$ is  a direct product of cyclic groups of order $2$, then the probability of sampling $g_1,\dots,g_m$ that are independent is
    $$ \frac{(2^\lambda-1)(2^\lambda-2)(2^\lambda-2^2)\cdots(2^\lambda-2^{m-1})}{2^{m\lambda}}$$ which is very close to $1$ if $m\ll \lambda$. In addition, the case where $g_1,\dots,g_m$ are independent can be seen as the generic case and we expect that an attacker could use similar strategies as developed in \cref{sec:assumptions} and design an attack for the dependent case. Indeed, if $g_1,\dots,g_m$ are dependent, the attacker will obtain more information from the public key as in the independent case. \\

There is also another strategy for an attack if \ref{it:A3} does not hold for $G$ and the number of cyclic factors in $H$ is small. More precisely, assume that $|\Hom(H,\F_2)|$ is sub-exponential. If Eve can write any element $g \in G$ as a product in $g_1,\dots,g_m$  then she can recover the secret message $\beta$ from the ciphertext $(g,h)$ as follows. For every maximal subgroup $M$ of $H$ not containing $\tau$ (by assumption, there are only sub-exponentially many of these) convert $h$ into an element $\tilde h$ in $H/M$. Decrypt $(g,\tilde h) \in G\times \tilde H$ as if the noise was erased completely in $H/M$ (as explained in Section \ref{sec:noiseless}) and check on a number of self-encrypted messages if this provides a correct decryption function. Since $\ker(\psi)\neq H$, there will always be a maximal subgroup $M$ of $H$ that contains $h_1\dots,h_m$ but does not contain $\tau$, so eventually this procedure will indeed provide a decrpytion function.

\subsection{Comparison with the quantum attack}\label{sec:LRL-cryptanalysis}

Throughout this section, assume that \ref{it:A3} holds for the abelian group $G$. Even though we only did cryptanalysis for finite groups until now, we show in the following two subsections how one can perform quantum attacks  when $G$ is either torsion-free or finite. The mixed case can be considered as a combination of the two cases: first dealing with the free part of the group and then recovering $\beta$ as explained in the finite case.

\subsubsection{The torsion-free case}\label{subs:TorsionFree}

Assume as in \cite[Sec.\ 8.2]{Eprint}, that $G=\gen{g_1}\oplus\ldots\oplus\gen{g_m}$ is isomorphic to $\Z^{m}$, i.e.\ the orders $|g_i|$ are all infinite.
We briefly recall the discussion from \cite[Sec.\ 8.2]{Eprint}.
To this end, let $f:\Z^{m+1}\rightarrow G$ be defined by
\[
(a_1,\ldots,a_{m+1}) \longmapsto g^{a_{m+1}}g_1^{a_1}\cdots g_m^{a_m}.
\]
 Then the kernel of $f$ is equal to $\gen{(r_1,\ldots,r_m,1)}$ and it can be determined, using Shor's algorithm~\cite{Shor_2}, in quantum polynomial time in $m$; cf.\ \cite{ImIv22,Wat01}.
Once $(r_1,\ldots,r_m,1)$ is known, it is easy to recover $\beta$ from the encrypted message $(g,h)$ and the public information.

\subsubsection{The torsion case}

Assume in this section that
$G$ is finite and that \ref{it:A4} holds. Let, moreover,  $f:\Z^{m+1}\rightarrow G$ be defined by
\[
(a_1,\ldots,a_{m+1}) \longmapsto g^{a_{m+1}}g_1^{a_1}\cdots g_m^{a_m}.
\]
Then a set of generators of $\ker(f)$ can be determined in time polynomial in $\log|G|$ on a quantum computer \cite{Kitaev,Shor_2,Simon}; see also \cite{EHK04}.
Note that $\ker(f)$ contains $|g_1|\Z\times \ldots\times |g_m|\Z\times |g|\Z$.

Let now $(s_1,\ldots,s_{m+1})$ be one of the generators found. Then $g=g_1^{-s_1s_{m+1}}\cdots g_m^{-s_ms_{m+1}}$ and so it follows that
\[
g_1^{r_1+s_1s_{m+1}}\cdots g_m^{r_m+s_ms_{m+1}}=1.
\]
This is the same as saying that, for each $1\leq i\leq m$, one has $$r_i\equiv -s_is_{m+1}\bmod |g_i|. $$
Modding out $H$ by the subgroup generated by all $h_i^{|g_i|}$  one can recover $\beta$ and thus solve the $\textsf{LHN-PKE}$ problem; cf.\ \cref{lem:h_i<g_i}.

\section{An attack that reduces to the abelian case}\label{sectionConvert}

A general strategy for an attacker to solve the $\textsf{LHN-PKE}$ problem could be to convert the $H$-part of the ciphertext as follows.   Assume that Eve has access to the ciphertext
\[(g,h) = (g_{w_1}\cdots  g_{w_\ell}, \varphi(g_{w_1})h_{w_1}\cdots\varphi(g_{w_{\ell}})h_{w_\ell}\tau^\beta) \in G \times H\]
encrypted by Bob using Alice's public key
\[\{(g_1,\varphi(g_1)h_1),\ldots,(g_m,\varphi(g_m)h_m),\tau\}.\]Eve can then choose a homomorphism $\vartheta\colon H \to \overline{H}$ for some group $\overline{H}$ such that $\vartheta(\tau)\neq 1$ and compute $\vartheta(h)$. Her new pair $(g,\overline{ h})=(g,\vartheta(h))$ is then of the form
\[ (g_{w_1}\cdot \dotsc \cdot g_{w_{\ell}},\overline{\varphi}(g_{w_1})\overline{ h}_{w_1}\cdot \dotsc \cdot \overline{\varphi}(g_{w_{\ell}})\overline{ h}_{w_{\ell}} \overline{\tau}^\beta) \]  where, for all $i$, we set $\overline{h_i}=\vartheta(h_i)$ and write  $\overline{\varphi}=\vartheta\circ\varphi$ and $\overline{\tau}=\vartheta(\tau)$. Since $\overline{\tau}\neq 1$, this pair still contains the information on $\beta$ and if $\vartheta$ is chosen cleverly, it might be much simpler to deduce $\beta$ from $(g,h')$. Note that in general, we cannot define a suitable counterpart $\overline{\psi}$ of $\psi$ here, so the information that $\tau$ is not contained in the kernel of $\psi$ cannot be directly converted into a statement on $\overline{\tau}$ and has to be considered individually (if necessary).

\medskip

A special case of this strategy is to reduce, if possible, to an abelian group $\overline{H}$, i.e., the goal is to eventually apply the attack that we describe in Section~\ref{abelian-case} even when $G$ and $H$ are nonabelian.

Suppose that, given $\tau$ and $H$, Eve is able to find an abelian group $\overline{H}$ and an efficiently computable homomorphism $\vartheta: H \rightarrow \overline{H}$ such that $\vartheta(\tau) \neq 1$ and such that $\vartheta(\tau)$ is not contained in the subgroup generated by certain powers of $\vartheta(\varphi(g_i)h_i)$. This condition can be checked using the public key and we will specify below which powers are sufficient.
Let $\overline{G}=G/[G,G]$ be the abelianization of $G$ and $\bar \varphi \colon \overline{G} \to \overline{H}$ be the homomorphism obtained from $\vartheta\circ \varphi \colon G\to \overline{H}$ by reducing modulo $[G,G]$. For all $i$, define $\bar h_i=\vartheta(h_i)$, set $\bar \tau=\vartheta(\tau)$ and, for all $g$ in $G$, let $\bar g \in \overline{G}$ be the image of $g$ in $\overline{G}$.

Eve first replaces the encrypted message by
\[(\bar g, \vartheta(h))=(\bar g_{w_1}\cdots  \bar g_{w_\ell}, \bar\varphi(\bar g_{w_1})\bar h_{w_1}\cdots\bar\varphi(\bar g_{w_{\ell}})\bar h_{w_\ell}\bar \tau^\beta) \in \overline{G} \times \overline{H}\]
in order to work inside abelian groups $\overline{G}$ and $\overline{H}$. Now she proceeds in a similar way as in the proof of \cref{result_abelian}: First, she computes the group orders of $\overline{G}$ and $\overline{H}$ and finds the least common multiple $q$ of their odd parts. Then she converts the tuple $(\bar g, \vartheta(h))  $ above into a tuple with entries inside the $2$-Sylow subgroups $\overline{G}_2$, $\overline{H}_2$ of $\overline{G}$ and $\overline{H}$ by taking both entries to their $q$-th powers:
\[(\bar g^q, \vartheta(h)^q)=(\bar g_{w_1}^q\cdots  \bar g_{w_\ell}^q, \bar\varphi(\bar g_{w_1}^q)\bar h_{w_1}^q\cdots\bar\varphi(\bar g_{w_{\ell}}^q)\bar h_{w_\ell}^q\bar \tau^\beta) \in \overline{G}_2 \times \overline{H}_2.\]
Finally, Eve can proceed in a  similar way as in the proof of \cref{lem:h_i<g_i}:
For all $i$ define $\bar l_i=(\bar\varphi(\bar g_i)\bar h_i)^q=\vartheta(\varphi(g_i)h_i)^q$ and let $
\beta_i$ be the order of $\varphi(\bar g_i)$. Eve can compute the elements $\bar l_i$ and the numbers $\beta_i$ using the public key. Then  $(\bar l_i)^{\beta_i}=(\bar h_i^q)^{\beta_i}$ can also be computed from the public key. If $\bar \tau$ is not contained in the subgroup $M$ generated by $(\bar l_1)^{\beta_1},\dots,(\bar l_m)^{\beta_m}$, then working inside $\overline{H} /M$ can reveal the value of $\beta$ as in the proof of \cref{lem:h_i<g_i} under similar assumptions as stated there.

\begin{rmk}\label{rmk:attack-ab}
    Observe that the above attack applies to any finite group $H$ if $\tau \not\in [H,H]$ and the image of $\tau$ in $H/[H,H]$ is not contained in the subgroup generated by the images of certain powers of $\varphi(g_i)h_i$.
     In particular, it is advisable (but likely not sufficient) to sample $\tau$ from~$[H,H]$.
\end{rmk}

\section{Normal forms and the solvable case}\label{sec:solvable}

In this section we consider the case where the platform groups are finite and solvable and give evidence of why, given the efficiency constraints attached to the system, the groups should not be expected to provide secure postquantum cryptosystems (in analogy to \cref{sec:LRL-cryptanalysis}).

For the background on finite solvable groups we refer to the very friendly \cite[Ch.\ 3]{Isaacs}.

\begin{definition}
For a finite group $\Gamma$, the \emph{derived series} of $\Gamma$ is the series $(\Gamma^{(i)})_{i\geq 1}$ defined inductively by
\[\Gamma^{(1)}=\Gamma \ \ \textup{ and } \ \  \Gamma^{(i+1)}=[\Gamma^{(i)},\Gamma^{(i)}].\]
If for some index $m$ the group $\Gamma^{(m)}$ is trivial, then $\Gamma$ is said to be \emph{solvable}.
\end{definition}

In a finite solvable group $\Gamma$ each quotient $\Gamma^{(i)}/\Gamma^{(i+1)}$ is abelian. Moreover, only finitely many such quotients are nontrivial and, if one is trivial, all subsequent ones are, too.

Until the end of this section, assume that $H$ is solvable. Then, for cryptanalysis purposes and in analogy with \cref{G_also_abelian}, we assume without loss of generality that $G$ is also solvable. We let $s$ be the \emph{derived length} of $H$, i.e.\ $s$ is such that $H^{(s+1)}=1$ but $H^{(s)}\neq 1$. Then, without loss of generality, we assume that $G^{(s+1)}=1$. We remark that, if $s=1$, then $G$ and $H$ are abelian.

\begin{rmk}[Efficient communication and computation]\label{rmk:efficiency}
Alice and Bob,  as part of their message exchange, need to be able to communicate elements and perform operations in the groups efficiently. An often favourable approach (also proposed in \cite[\S~4.2]{Baumslag}) is that of using \emph{normal forms} of elements with respect to a \emph{polycyclic presentation},
cf.\ \cite[Ch.~2]{EickHab}. For instance, when working with $G$ and $H$ abelian, \ref{it:A3} and \ref{it:A4} holding for $G$ is almost the same as saying that $G$ is given by a polycyclic presentation and the expression $g=g_1^{r_1}\cdots g_m^{r_m}$ is the normal form of $g$ with respect to this presentation. The word ``almost'' in the previous sentence is there to stress that the $r_i$'s are not uniquely identified by their class modulo $|g_i|$, which in turn is what happens for normal forms (see below).
\end{rmk}

We briefly explain here what it means for an element $g$ of the solvable group $G$ to be communicated in a \emph{normal form} with respect to a polycylic presentation respecting the derived filtration. To do so, for each $i\in\{1,\ldots,s\}$:
\begin{enumerate}[label=$(\alph*)$]
\item let $m_i$ denote the minimum number of generators of $G^{(i)}/G^{(i+1)}$,
\item let $g_{i1},\ldots, g_{im_i}$ be elements of $G^{(i)}$ such that
\[
G^{(i)}/G^{(i+1)}=\gen{g_{i1}G^{(i+1)}}\oplus\cdots\oplus\gen{g_{im_i}G^{(i+1)}},
\]
\item for each $j\in\{1,\ldots,m_i\}$ let $o_{ij}$ denote the order of $g_{ij}$ modulo $G^{(i+1)}$.
\end{enumerate}
Then any element $g\in G$ can be uniquely represented by a vector
$$\delta=(\delta_{11},\ldots,\delta_{1m_1},\delta_{21},\ldots,\delta_{2m_2},\ldots,\delta_{s1},\ldots,\delta_{sm_s})$$
of integers $0\leq \delta_{ij}<o_{ij}$ of length $n=m_1+\ldots+m_s$  such that
\[
g=\prod_{i=1}^s\prod_{j=1}^{m_i}g_{ij}^{\delta_{ij}},
\]
which is precisely the normal form of $g$ with respect to the chosen generators $\{g_{ij}\}$.

Note that the data $(a)$-$(b)$-$(c)$ mentioned above should be public for Alice and Bob to be able to share the elements with each other. If the chosen generators fit into a \emph{polycyclic sequence}, then the group operation is performed through the \emph{collection process} \cite[\S~2.2]{EickHab}.
It should be mentioned that, though polycyclic presentations generally yield a good practical performance, it is, to the best of our knowledge, not clear whether multiplication in these presentations can always be performed in polynomial time \cite{LGSo98}.
Note that the expression of $h'$ also depends on the vector $\delta$:
\[
h'=\prod_{i=1}^s\prod_{j=1}^{m_i}(\varphi(g_{ij})h_{ij})^{\delta_{ij}}.
\]
Shor's algorithm, applied on each level $G^{(i)}/G^{(i+1)}$, is polynomial in the log of the size of this quotient. Moreover, Shor's algorithm really does determine the vector $\delta$ of $g$ because of the condition $0\leq \delta_{ij}<o_{ij}$. In particular
Eve can recover the vector $\delta$ of $g$ and use it to compute
\[
\tau^{\beta}=\left(\prod_{i=1}^s\prod_{j=1}^{m_i}(\varphi(g_{ij})h_{ij})^{\delta_{ij}}\right)^{-1}\cdot h.
\]
The complexity of this algorithm on each quotient $G^{(i)}/G^{(i+1)}$ is polynomial in $\log|G^{(i)}/G^{(i+1)}|$, which makes the overall complexity to be polynomial in $\log |G|$. There is obviously no separation in complexity between the algorithm being run by the adversary, and the one being run by the user. This implies that for the system to be secure, we would need to have $|G| > 2^{2^{\lambda}}$,
making it hard to say if it would even be possible to represent elements of $G$ in a computer.

\begin{rmk}
Given that the quotients of consecutive elements of the derived series are abelian, it is natural to ask whether the classical attack we designed for abelian groups could be generalised to an attack in the solvable context. It seems, however, that the nonabelian solvable case is substantially different from the abelian one. Among the limitations are:
\begin{itemize}
    \item $\tau$ could for instance belong to $H^{(s)}$ while $g_1,\ldots, g_m$ will typically live in $H^{(1)}\setminus H^{(2)}$ (in the general setting we are indeed not necessarily working with normal forms);
    \item without knowing $\varphi$, it is not at all clear at which depths in the derived filtration $\varphi(g_1),\ldots\varphi(g_m)$ are to be found in $H$ (as publicly given only with noise);
    \item dealing with quotients is more delicate as one always has to consider normal closures of subgroups.
\end{itemize}
\end{rmk}

\section{Future work}\label{future-work}

In future work, we plan to consider several types of finite groups $G$, $H$, and $K$ for instantiating Leonardi--Ruiz-Lopez encryption and explore whether we can either construct attacks for the corresponding cryptosystems or prove security results.

A first candidate would be the group $C_2^\lambda$ for all groups $G,H,K$. As none of the classical attacks presented in this paper apply in this case,
Leonardi--Ruiz-Lopez encryption might prove to be classically secure for this choice.
Other abelian candidates are the RSA groups and ideal class groups  mentioned in Section \ref{RSAetc}.

As a first nonabelian example, we plan to work with certain $p$-groups and use strategies that allow us to circumnavigate the attacks presented in Section \ref{sec:solvable}. In particular, it would be beneficial to work with presentations of groups that are not based on normal forms and yet allow efficient computation.
The advantage of working with nonabelian groups is that it may be possible to construct a post-quantum additive homomorphic cryptosystem.


\section{Preliminaries}\label{prelim}

Throughout this paper, we use the shorthand notation $[d] = \{1,\ldots,d\}$.
We write
\begin{eqnarray*} \begin{aligned}
H(\mathcal{B}_t,\ket{\phi}) =  - \sum_{i = 1}^{d}|\inp{\phi}{b_k^t}|^2 \log |\inp{\phi}{b_k^t}|^2,
\end{aligned} \end{eqnarray*}
for the Shannon entropy~\cite{shannon:info}
arising from measuring the pure state $\ket{\phi}$ in basis $\mathcal{B}_t = \{\ket{b_1^t},\ldots,\ket{b_d^t}\}$.
In general, we will use $\ket{b_k^t}$ with $k \in [d]$ to denote the $k$-th element of a basis $\mathcal{B}_t$
indexed by $t$. We also briefly refer to the R\'enyi entropy of order 2 (collision entropy)
of measuring $\ket{\phi}$ in basis $\mathcal{B}_t$ given by $H_2(\mathcal{B}_t,\ket{\phi}) = - \log \sum_{i=1}^d
|\inp{\phi}{b_k^t}|^4$~\cite{cachin:renyi}.

\subsection{Mutually unbiased bases}

We also need the notion of mutually unbiased bases (MUBs),
which were initially introduced in the context
of state estimation~\cite{wootters:mub}, but appear in many other problems in quantum information.
The following definition closely follows the one given in~\cite{boykin:mub}.
\begin{definition}[MUBs] \label{def-mub}
Let $\mathcal{B}_1 = \{|b^1_1\rangle,\ldots,|b^1_{d}\rangle\}$ and $\mathcal{B}_2 =
\{|b^2_1\rangle,\ldots,|b^2_{d}\rangle\}$ be two orthonormal bases in
$\mathbb{C}^d$. They are said to be
\emph{mutually unbiased}  if
$|\lanb^1_k |b^2_l\rangle| = 1/\sqrt{d}$, for every $k,l \in[d]$. A set $\{\mathcal{B}_1,\ldots,\mathcal{B}_m\}$ of
orthonormal bases in $\mathbb{C}^d$ is called a \emph{set of mutually
unbiased bases} if each pair of bases is mutually unbiased.
\end{definition}
We use $N(d)$ to denote the maximal number of MUBs in dimension $d$.
In any dimension $d$, we have that
$\mbox{N}(d) \leq d+1$~\cite{boykin:mub}. If $d = p^k$ is a prime power, we have
that $\mbox{N}(d) = d+1$ and explicit constructions are
known~\cite{boykin:mub,wootters:mub}. If $d = s^2$ is a square,
$\mbox{N}(d) \geq \mbox{MOLS}(s)$ where $\mbox{MOLS}(s)$ denotes the number of mutually orthogonal
$s \times s$ Latin squares~\cite{wocjan:mub}. In general, we have
$\mbox{N}(n m) \geq \min\{\mbox{N}(n),\mbox{N}(m)\}$ for all $n,m \in \mathbb{N}$~\cite{zauner:diss,klappenecker:mubs}.
It is also known that in any dimension, there exists an explicit construction for 3 MUBs~\cite{grassl:mub}.
Unfortunately, not very much is known for other dimensions. For example,
it is still an open problem whether there exists a set of $7$ MUBs in dimension $d=6$.
We say that a unitary $U_t$ transforms the computational basis into the $t$-th MUB
$\mathcal{B}_t = \{\ket{b^t_1},\ldots,\ket{b^t_d}\}$
if for all $k \in [d]$ we have $\ket{b^t_k} = U_t\ket{k}$.
Here, we are particularly concerned with two specific constructions of mutually unbiased bases.

\subsubsection{Latin squares}

First of all, we consider MUBs based on mutually orthogonal Latin squares~\cite{wocjan:mub}.
Informally, an $s \times s$ Latin square over the symbol set $[s] = \{1,\ldots,s\}$ is an arrangement
of elements of $[s]$ into an $s \times s$ square such that in each row and each column every element
occurs exactly once. Let $L_{ij}$ denote the entry in a Latin square in row $i$ and column $j$.
Two Latin squares $L$ and $L'$ are called mutually orthogonal if and only if
$\{(L_{i,j},L'_{i,j})|i,j \in [s]\} = \{(u,v)|u,v \in [s]\}$.
From any $s\times s$ Latin square we can obtain a basis for $\mathbb{C}^{s}\otimes \mathbb{C}^{s}$.
First, we construct $s$ of the basis vectors from the entries of
the Latin square itself. Let $\ket{v_{1,\ell}} = (1/\sqrt{s}) \sum_{i,j\in [s]} E^L_{i,j}(\ell) \ket{i,j}$
where $E^L$ is a predicate such that $E^L_{i,j}(\ell) = 1$ if and only if $L_{i,j} = \ell$.
Note that for each $\ell$ we have exactly $s$ pairs $i,j$ such that $E_{i,j}(\ell) = 1$, because
each element of $[s]$ occurs exactly $s$ times in the Latin square.
Secondly, from each such vector we obtain $s-1$ additional vectors by adding successive rows
of an $s \times s$ (complex) Hadamard matrix $H = (h_{ij})$ as coefficients to obtain the remaining
$\ket{v_{t,j}}$ for $t \in [s]$, where $h_{ij} = \omega^{ij}$ with $i,j \in \{0,\ldots,s-1\}$ and
$\omega = e^{2 \pi i/s}$.
Two additional MUBs can then be obtained in the same way from the two non-Latin squares where
each element occurs for an entire row or column respectively. From each mutually orthogonal latin square
and these two extra squares which also satisfy the above orthogonality condition, we obtain one basis.
This construction therefore gives $\mbox{MOLS}(s) + 2$ many MUBs. It is known that if $s = p^k$ is a
prime power itself, we obtain
$p^k+1\approx \sqrt{d}$ MUBs from this construction. Note, however, that there do exist many more
MUBs in prime power dimensions, namely $d+1$. If $s$ is not a prime power, it is merely known
that $\mbox{MOLS}(s) \geq s^{1/14.8}$~\cite{wocjan:mub}.

As an example, consider the following $3 \times 3$ Latin square and
the $3 \times 3$ Hadmard matrix\\
\begin{center}
\begin{tabular}{lr}
\begin{tabular}{|c|c|c|}
\hline
1 & 2 & 3\\\hline
2 & 3 & 1\\\hline
3 & 1 & 2 \\\hline
\end{tabular},
&
$
H = \left(\begin{array}{ccc}
    1 &1& 1\\
    1 &\omega &\omega^2\\
    1 &\omega^2& \omega
\end{array}\right)$,
\end{tabular}
\end{center}
where $\omega = e^{2 \pi i/3}$.
First, we obtain vectors
\begin{eqnarray*}
\ket{v_{1,1}} &=& (\ket{1,1} + \ket{2,3} + \ket{3,2})/\sqrt{3}\\
\ket{v_{1,2}} &=& (\ket{1,2} + \ket{2,1} + \ket{3,3})/\sqrt{3}\\
\ket{v_{1,3}} &=& (\ket{1,3} + \ket{2,2} + \ket{3,1})/\sqrt{3}.
\end{eqnarray*}
With the help of $H$ we obtain 3
additional vectors from the ones above. From the vector $\ket{v_{1,1}}$,
for example, we obtain
\begin{eqnarray*}
\ket{v_{1,1}} &=& (\ket{1,1} + \ket{2,3} + \ket{3,2})/\sqrt{3}\\
\ket{v_{2,1}} &=& (\ket{1,1} + \omega \ket{2,3} + \omega^2 \ket{3,2})/\sqrt{3}\\
\ket{v_{3,1}} &=& (\ket{1,1} + \omega^2 \ket{2,3} + \omega \ket{3,2})/\sqrt{3}.
\end{eqnarray*}
This gives us basis $\mathcal{B} = \{\ket{v_{t,\ell}}|t,\ell \in [s]\}$ for $s = 3$.
The construction of another basis follows in exactly the same way from a mutually orthogonal
Latin square. The fact that two such squares $L$ and $L'$ are mutually orthogonal ensures
that the resulting bases will be mutually unbiased. Indeed, suppose we are given another such basis,
$\mathcal{B'} = \{\ket{u_{t,\ell}}|t,\ell \in [s]\}$ belonging to $L'$. We then have for any $\ell,\ell' \in [s]$ that
$|\inp{u_{1,\ell'}}{v_{1,\ell}}|^2 =
|(1/s) \sum_{i,j\in [s]} E^{L'}_{i,j}(\ell') E^L_{i,j}(\ell)|^2 = 1/s^2$, as there exists excactly only
one pair $\ell,\ell' \in [s]$ such that $E^{L'}_{i,j}(\ell') E^L_{i,j}(\ell) = 1$. Clearly, the same argument
holds for the additional vectors derived from the Hadamard matrix.

\subsubsection{Generalized Pauli matrices}

The second construction we consider is based on the generalized Pauli matrices
$X_d$ and $Z_d$~\cite{boykin:mub}, defined by their actions on the
computational basis $C = \{\ket{1},\ldots,\ket{d}\}$ as follows:
$$
X_d\ket{k} = \ket{k+1}, \and Z_d\ket{k} = \omega^k\ket{k},~\forall \ket{k} \in C,
$$
where $\omega = e^{2 \pi i/d}$.  We say that $\left(X_{d}\right)^{a_1} \left(Z_{d}\right)^{b_1}
\otimes \cdots \otimes \left(X_{d}\right)^{a_N} \left(Z_{d}\right)^{b_N}$ for
$a_k,b_k \in \{0,\ldots,d-1\}$ and $k \in [N]$ is a \emph{string of Pauli Matrices}.

If $d$ is a prime, it is known that the $d+1$ MUBs constructed first by
Wootters and Fields~\cite{wootters:mub} can also be obtained as the eigenvectors of the
matrices $Z_d,X_d,X_dZ_d,X_dZ_d^2,\ldots,X_dZ_d^{d-1}$~\cite{boykin:mub}. If $d = p^k$ is a prime power,
consider all $d^2-1$ possible strings of Pauli matrices excluding the identity and group them
into sets $C_1,\ldots,C_{d+1}$ such that $|C_i| = d - 1$ and $C_i \cup C_j = \{\mathbb{I}\}$ for $i \neq j$ and all
elements of $C_i$ commute. Let $B_i$ be the common eigenbasis of all elements of $C_i$. Then
$B_1,\ldots,B_{d+1}$ are MUBs~\cite{boykin:mub}. A similar result for $d = 2^k$ has also been shown
in~\cite{lawrence:mub}.
A special case of this construction are the three mutually unbiased bases in dimension $d=2^k$ given by
the unitaries $\mathbb{I}^{\otimes k}$,$H^{\otimes k}$ and $K^{\otimes k}$ with $K = (\mathbb{I} + i\sigma_x)/\sqrt{2}$ applied to the computational
basis.

\subsection{2-designs}

For the purposes of the present work, \emph{spherical $t$-designs} (see for example Ref.\ \cite{Renesetal04a}) can be defined as follows.

\begin{definition}[$t$-design]
Let $\{|\tau_1\rangle,\ldots,|\tau_{m}\rangle\}$ be a set of state vectors in $\mathbb{C}^d$, they are said to form a $t$-design if
\begin{eqnarray*} \begin{aligned}
\frac{1}{m}\sum_{i=1}^m [|\tau_i\rangle \langle \tau_i|]^{\otimes t} = \frac{\Pi_+^{(t,d)}}{\mathop{\mathrm{Tr}}\nolimits \Pi_+^{(t,d)}},
\end{aligned} \end{eqnarray*}
where $\Pi_+(t,d)$ is a projector onto the completely  symmetric subspace of ${\mathbb{C}^d}^{\otimes t}$ and
\begin{eqnarray*} \begin{aligned}
\mathop{\mathrm{Tr}}\nolimits \Pi_+^{(t,d)}=\cmb{d+t-1}{d-1}=\frac{(d+t-1)!}{(d-1)!~t!},
\end{aligned} \end{eqnarray*}
is its dimension.
\end{definition}
Any set $\mathbb{B}$ of $d+1$ MUBs forms a \emph{spherical $2$-design}  \cite{KlappeneckerRotteler05a,Renesetal04a},
i.e., we have for $\mathbb{B} = \{\mathcal{B}_1,\ldots,\mathcal{B}_{d+1}\}$ with $\mathcal{B}_t = \{\ket{b^t_1},\ldots,\ket{b^t_d}\}$ that
\begin{eqnarray*} \begin{aligned}
\frac{1}{d(d+1)}\sum_{t=1}^{d+1}\sum_{k=1}^{d} [|b^t_k\rangle \langle b^t_k|]^{\otimes 2} &= 2\frac{\Pi_+^{(2,d)}}{d(d+1)}.
\end{aligned} \end{eqnarray*}

\section{Uncertainty relations}

We now prove tight entropic uncertainty for measurements in MUBs in square dimensions.
The main result of~\cite{maassen:entropy}, which will be very useful for us, is stated next.
\begin{theorem}[Maassen and Uffink]
Let $\mathcal{B}_1$ and $\mathcal{B}_2$ be two orthonormal basis in a Hilbert space of dimension $d$. Then
for all pure states $\ket{\psi}$
\begin{eqnarray} \begin{aligned} \label{eq:maasenuffinkbound}
\frac{1}{2}\left[ H(\mathcal{B}_1,\ket{\psi})+H(\mathcal{B}_2,\ket{\psi})\right]\geq -\log c(\mathcal{B}_1,\mathcal{B}_2),
\end{aligned} \end{eqnarray}
where $c(\mathcal{B}_1,\mathcal{B}_2)=\max \left \{|\langle b_1|b_2\rangle|:|b_1\rangle \in \mathcal{B}_1,|b_2\rangle \in \mathcal{B}_2\right \}$.
\end{theorem}
The case when $\mathcal{B}_1$ and $\mathcal{B}_2$ are MUBs is of special interest for us. More generally, when one has a set of MUBs a trivial application of (\ref{eq:maasenuffinkbound}) leads to the following corollary also noted in~\cite{azarchs:entropy}.
\begin{corollary}\label{MUderived}
Let $\mathbb{B}=\{\mathcal{B}_1,\ldots,\mathcal{B}_m\}$, be a set of MUBs in a Hilbert space of dimension $d$. Then
\begin{eqnarray} \begin{aligned} \label{eq:manymubsbound}
\frac{1}{m} \sum_{t=1}^m H(\mathcal{B}_t,|\psi\rangle)\geq \frac{\log d}{2}.
\end{aligned} \end{eqnarray}
\end{corollary}
\begin{proof}
Using (\ref{eq:maasenuffinkbound}), one gets that for any pair of MUBs $\mathcal{B}_t$ and $\mathcal{B}_{t'}$ with $t\neq t'$
\begin{eqnarray} \begin{aligned}\label{eq:maassenuffinkij}
\frac{1}{2}\left[ H(\mathcal{B}_t,\psi)+H(\mathcal{B}_{t'},\psi)\right]\geq \frac{\log d}{2}.
\end{aligned} \end{eqnarray}
Adding up the resulting equation for all pairs $t\neq t'$ we get the desired result (\ref{eq:manymubsbound}).
\end{proof}
Here, we now show that this bound can in fact be tight for a large set of MUBs.

\subsection{MUBs in square dimensions}
Corollary \ref{MUderived}, gives  a lower bound on the average of the entropies of a set of MUBs. The obvious question is whether that bound is tight. We show that the bound is indeed tight when we consider product MUBs in a Hilbert space of square dimension.
\begin{theorem}\label{squareThm}
Let $\mathbb{B}=\{\mathcal{B}_1,\ldots,\mathcal{B}_m\}$ with $m\geq 2$ be a set of MUBs in a Hilbert space $\mathcal{H}$ of dimension $s$. Let $U_t$ be the unitary operator that transforms the computational basis to $\mathcal{B}_t$.
Then $\mathbb{V}=\{\mathcal{V}_1,\ldots,\mathcal{V}_m\}$, where
\begin{eqnarray*} \begin{aligned}
\mathcal{V}_t=\left \{U_t|k\rangle \otimes U_t^* |l\rangle: k,l\in[s] \right \},
\end{aligned} \end{eqnarray*}
is a set of MUBs in $\mathcal{H} \otimes \mathcal{H}$, and it holds that
\begin{eqnarray} \begin{aligned}\label{eq:squaremubsbound}
\min_{\ket{\psi}} \frac{1}{m} \sum_{t=1}^m H(\mathcal{V}_t,|\psi\rangle)= \frac{\log d}{2},
\end{aligned} \end{eqnarray}
where $d=\dim(\mathcal{H} \otimes \mathcal{H})=s^2$.
\end{theorem}
\begin{proof}
It is easy to check that $\mathbb{V}$ is indeed a set of MUBs. Our proof works by constructing a state $\ket{\psi}$
that achieves the bound in Corollary~\ref{MUderived}.
It is easy to see that the maximally entangled state
\begin{eqnarray*} \begin{aligned}
|\psi\rangle = \frac{1}{\sqrt{s}}\sum_{k=1}^{s}|kk\rangle,
\end{aligned} \end{eqnarray*}
satisfies $U\otimes U^*|\psi\rangle=|\psi\rangle$ for any $U\in \textrm{U}(d)$. Indeed,
\begin{eqnarray*} \begin{aligned}
\langle \psi |U\otimes U^*|\psi\rangle&=\frac{1}{s}\sum_{k,l=1}^{s} \langle k |U|l\rangle\langle k |U^*|l\rangle\\
						&=\frac{1}{s}\sum_{k,l=1}^{s} \langle k |U|l\rangle\langle l |U^\dagger|k\rangle\\
						&=\frac{1}{s}\mathop{\mathrm{Tr}}\nolimits UU^\dagger=1.
\end{aligned} \end{eqnarray*}
Therefore, for any $t\in[m]$ we have that
\begin{eqnarray*} \begin{aligned}
H(\mathcal{V}_t,|\psi\rangle)	&=-\sum_{kl}|\langle kl|U_t\otimes U_t^*|\psi\rangle|^2\log|\langle kl|U_t\otimes U_t^*|\psi\rangle|^2\\
				&=-\sum_{kl}|\langle kl|\psi\rangle|^2\log|\langle kl|\psi\rangle|^2\\
				&=\log s=\frac{\log d}{2}.
\end{aligned} \end{eqnarray*}
Taking the average of the previous equation we get the desired result.
\end{proof}

\subsection{MUBs based on Latin Squares}

We now consider mutually unbiased bases based on Latin squares~\cite{wocjan:mub}
as described in Section~\ref{prelim}. Our proof again follows by providing a state
that achieves the bound in Corollary~\ref{MUderived}, which turns out to have
a very simple form.
\begin{lemma}\label{LSentropy}
Let $\mathbb{B}=\{\mathcal{B}_1,\ldots,\mathcal{B}_m\}$ with $m \geq 2$ be any set of MUBs in a Hilbert space of dimension $d=s^2$ constructed
on the basis of Latin squares. Then
$$
\min_{\ket{\psi}} \frac{1}{m} \sum_{\mathcal{B}\in\mathbb{B}} H(\mathcal{B},\ket{\psi}) = \frac{\log d}{2}.
$$
\end{lemma}
\begin{proof}
Consider the state $\ket{\psi} = \ket{1,1}$ and fix a basis
$\mathcal{B}_t = \{\ket{v^t_{i,j}}|i,j \in [s]\} \in \mathbb{B}$
coming from a Latin square.
It is easy
to see that there exists exactly one $j \in [s]$ such that $\inp{v^t_{1,j}}{1,1} = 1/\sqrt{s}$. Namely this
will be the $j \in [s]$ at position $(1,1)$ in the Latin square. Fix this $j$. For any other
$\ell \in [s], \ell \neq j$, we have $\inp{v^t_{1,\ell}}{1,1} = 0$. But this means that
there exist exactly $s$ vectors in $\mathcal{B}$ such that $|\inp{v^t_{i,j}}{1,1}|^2 = 1/s$, namely
exactly the $s$ vectors derived
from $\ket{v^t_{1,j}}$ via the Hadamard matrix. The same argument holds for any such basis $\mathcal{B} \in \mathbb{T}$.
We get
\begin{eqnarray*}
\sum_{\mathcal{B} \in \mathbb{B}} H(\mathcal{B},\ket{1,1}) &=& \sum_{\mathcal{B} \in \mathbb{B}}
\sum_{i,j \in [s]} |\inp{v^t_{i,j}}{1,1}|^2 \log |\inp{v^t_{i,j}}{1,1}|^2\\
&=& |\mathbb{T}| s \frac{1}{s} \log \frac{1}{s}\\
&=& |\mathbb{T}| \frac{\log d}{2}.
\end{eqnarray*}
The result then follows directly from Corollary~\ref{MUderived}.
\end{proof}

\subsection{Using a full set of MUBs}

We now provide an alternative proof of an entropic uncertainty relation
for a full set of mutually unbiased bases. This has previously been proved
in~\cite{sanchez:entropy2}. Nevertheless, because our proof is so
simple using existing results about 2-designs we include it here for completeness,
in the hope that if may offer additional insight.
\begin{lemma}\label{FullentropyCollision}
Let $\mathbb{B}$ be a set of $d+1$ MUBs in a Hilbert space of dimension $d$.
Then
$$
\frac{1}{d+1}\sum_{\mathcal{B}\in\mathbb{B}}H_2(\mathcal{B},\ket{\psi}) \geq \log\left(\frac{d+1}{2}\right).
$$
\end{lemma}
\begin{proof}
Let $\mathcal{B}_t = \{\ket{b^t_1},\ldots,\ket{b^t_d}\}$ and $\mathbb{B} = \{\mathcal{B}_1,\ldots,\mathcal{B}_{d+1}\}$.
We can then write
\begin{eqnarray*}
\frac{1}{d+1}\sum_{\mathcal{B}\in\mathbb{B}}H_2(\mathcal{B},\ket{\psi}) &=&
- \frac{1}{d+1}\sum_{t=1}^{d+1} \log \sum_{k=1}^d |\inp{b^t_k}{\psi}|^4\\
&\geq& \log\left(\frac{1}{d+1}\sum_{t=1}^{d+1}\sum_{k=1}^d |\inp{b^t_k}{\psi}|^4\right)\\
&=&\log\left(\frac{d+1}{2}\right),
\end{eqnarray*}
where the first inequality follows from the concavity of the $\log$,
and the final inequality follows directly from the fact that a full set of MUBs forms a 2-design
and~\cite[Theorem 1]{KlappeneckerRotteler05a}.
\end{proof}

We then obtain the original result by Sanchez-Ruiz~\cite{sanchez:entropy2} by noting that
$H(\cdot) \geq H_2(\cdot)$.
\begin{corollary}\label{Fullentropy}
Let $\mathbb{B}$ be a set of $d+1$ MUBs in a Hilbert space of dimension $d$.
Then
$$
\frac{1}{d+1}\sum_{\mathcal{B}\in\mathbb{B}}H(\mathcal{B},\ket{\psi}) \geq \log\left(\frac{d+1}{2}\right).
$$
\end{corollary}

\section{Locking}

We now turn our attention to locking. We first explain the connection between locking
and entropic uncertainty relations. In particular, we show that for MUBs based on generalized
Pauli matrices, we only need to look at such uncertainty relations to determine the exact strength
of the locking effect. We then consider how good MUBs based on Latin squares are for locking.

In order to determine how large the locking effect is for some set
of mutually unbiased bases $\mathbb{B}$,
and the state
\begin{equation}\label{rhoAB}
\rho_{AB} =
\sum_{t=1}^{|\mathbb{B}|}
\sum_{k=1}^{d} p_{t,k}
(\outp{k}{k} \otimes \outp{t}{t})_A
\otimes (\outp{b^t_k}{b^t_k})_B,
\end{equation}
we must find an optimal bound for $\mathcal{I}_c(\rho_{AB})$.
Here, $\{p_{t,k}\}$ is a probability distribution over $\mathbb{B} \times [d]$.
That is, we must find a POVM
$M_A \otimes M_B$ that maximizes Eq.\ (\ref{mutualInfo}).
It has been shown in~\cite{terhal:locking} that we can restrict ourselves to to taking
$M_A$ to be the local measurement determined by the projectors $\{\outp{k}{k} \otimes \outp{t}{t}\}$.
It is also known that we can limit ourselves to take the measurement $M_B$ consisting of rank one
elements $\{\alpha_i \outp{\Phi_i}{\Phi_i}\}$ only~\cite{davies:access}, where $\alpha_i \geq 0$ and $\ket{\Phi_i}$
is normalized.
Maximizing over $M_B$ then corresponds to maximizing Bob's accessible information~\cite[Eq.\ (9.75)]{peres:book} for
the ensemble $\mathcal{E} = \{p_{k,t},\outp{b^t_k}{b^t_k}\}$
\begin{eqnarray}
\begin{aligned}\label{accessible}
&&\mathcal{I}_{acc}(\mathcal{E})= \max_M \left(- \sum_{k,t} p_{k,t} \log p_{k,t} + \right.\\
&&\left.\sum_{i} \sum_{k,t} p_{k,t} \alpha_i \bra{\Phi_i}\rho_{k,t}\ket{\Phi_i}
\log \frac{p_{k,t} \bra{\Phi_i}\rho_{k,t}\ket{\Phi_i}}{\bra{\Phi_i}\mu\ket{\Phi_i}} \right),
\end{aligned}
\end{eqnarray}
where $\mu = \sum_{k,t} p_{k,t} \rho_{k,t}$ and $\rho_{k,t} = \outp{b^t_k}{b^t_k}$.
Therefore, we have $\mathcal{I}_c(\rho_{AB}) = \mathcal{I}_{acc}(\mathcal{E})$.
We are now ready to prove our locking results.

\subsection{An example}

We first consider a very simple example with only three MUBs that provides the intuition behind
the remainder of our paper. The three MUBs we consider now are generated by the unitaries
$\mathbb{I}$, $H$ and $K = (\mathbb{I} + i\sigma_x)/\sqrt{2}$ when applied to the computational basis.
For this small example, we also investigate the role of the prior over the bases and the encoded
basis elements. It turns out that this does not affect the strength of the locking effect positively. Actually, it is possible
to show the same for encodings in many other bases. However,we
do not consider this case in full generality as to not obscure our main line of argument.

\begin{lemma}\label{3mubLocking}
Let $U_0=\mathbb{I}^{\otimes n}$,$U_1 = H^{\otimes n}$, and $U_2 = K^{\otimes n}$,
where $k \in \{0,1\}^n$ and $n$ is an even integer.
Let $\{p_t\}$ with $t \in [3]$ be a probability distribution over
the set $\mathcal{S} = \{U_1,U_2,U_3\}$. Suppose that $p_1,p_2,p_3 \leq 1/2$ and let
$p_{t,k} = p_t (1/d)$.
Consider the ensemble $\mathcal{E} = \{ p_t \frac{1}{d},U_t \outp{k}{k}U_t^\dagger\}$, then
$$
\mathcal{I}_{acc}(\mathcal{E}) = \frac{n}{2}.
$$
If, on the other hand, there exists a $t \in [3]$ such that
$p_t > 1/2$, then $\mathcal{I}_{acc}(\mathcal{E}) > n/2$.
\end{lemma}
\begin{proof}
We first give an explicit measurement strategy and then prove a matching upper bound
on $\mathcal{I}_{acc}$.
Consider the Bell basis vectors $\ket{\Gamma_{00}} = (\ket{00} + \ket{11})/\sqrt{2}$,
$\ket{\Gamma_{01}} = (\ket{00} - \ket{11})/\sqrt{2}$, $\ket{\Gamma_{10}} = (\ket{01} + \ket{10})/\sqrt{2}$,
and $\ket{\Gamma_{11}} = (\ket{01} - \ket{10})/\sqrt{2}$. Note that we can write
for the computational basis
\begin{eqnarray*}
\ket{00} &=& \frac{1}{\sqrt{2}}(\ket{\Gamma_{00}} + \ket{\Gamma_{01}})\\
\ket{01} &=& \frac{1}{\sqrt{2}}(\ket{\Gamma_{10}} + \ket{\Gamma_{11}})\\
\ket{10} &=& \frac{1}{\sqrt{2}}(\ket{\Gamma_{10}} - \ket{\Gamma_{11}})\\
\ket{11} &=& \frac{1}{\sqrt{2}}(\ket{\Gamma_{00}} - \ket{\Gamma_{01}}).
\end{eqnarray*}
The crucial fact to note is that if we fix some $k_1k_2$, then
there exist exactly two Bell basis vectors $\ket{\Gamma_{i_1i_2}}$ such that
$|\inp{\Gamma_{i_1i_2}}{k_1k_2}|^2 = 1/2$. For the remaining two basis vectors
the inner product with $\ket{k_1k_2}$ will be zero.
A simple calculation shows that we can express the two qubit basis states of
the other two mutually unbiased bases analogously: for each two qubit basis state
there are exactly two Bell basis vectors such that the
inner product is zero and for the other two the inner product squared is $1/2$.

We now take the measurement given by $\{\outp{\Gamma_i}{\Gamma_i}\}$ with
$\ket{\Gamma_i} = \ket{\Gamma_{i_1i_2}} \otimes \ldots \otimes \ket{\Gamma_{i_{n-1}i_{n}}}$ for the binary
expansion of $i = i_1i_2\ldots i_n$. Fix a $k = k_1k_2\ldots k_n$. By the above argument,
there exist exactly $2^{n/2}$ strings $i \in \{0,1\}^n$ such that
$|\inp{\Gamma_i}{k}|^2 = 1/(2^{n/2})$. Putting everything together, Eq.\ (\ref{accessible})
now gives us for any prior distribution $\{p_{t,k}\}$ that
\begin{equation}\label{Ibell}
-\sum_i \bra{\Gamma_i}\mu\ket{\Gamma_i} \log \bra{\Gamma_i}\mu\ket{\Gamma_i} - \frac{n}{2} \leq \mathcal{I}_{acc}(\mathcal{E}).
\end{equation}
For our particular distribution we have $\mu = \mathbb{I}/d$ and thus
$$
\frac{n}{2} \leq \mathcal{I}_{acc}(\mathcal{E}).
$$

We now prove a matching upper bound that shows that our measurement is optimal.
For our distribution, we can rewrite Eq.\ (\ref{accessible}) for the POVM
given by $\{\alpha_i \outp{\Phi_i}{\Phi_i}\}$ to

\begin{eqnarray*}
\mathcal{I}_{acc}(\mathcal{E}) &=& \max_M \left(\log d + \right.\\
&&\left. \sum_i \frac{\alpha_i}{d} \sum_{k,t} p_{t} |\bra{\Phi_i}U_t\ket{k}|^2 \log |\bra{\Phi_i}U_t\ket{k}|^2 \right)\\
&=& \max_M \left(\log d -  \sum_i \frac{\alpha_i}{d} \sum_{t} p_t H(\mathcal{B}_t,\ket{\Phi_i}) \right).
\end{eqnarray*}

It follows from Corollary~\ref{MUderived} that $\forall i\in \{0,1\}^n$ and
$p_1,p_2,p_3\leq 1/2$,
\begin{eqnarray*}
(1/2-p_1) [H(\mathcal{B}_2,\ket{\Phi_i}) + H(\mathcal{B}_3,\ket{\Phi_i}) ]&+&\\
(1/2-p_2) [H(\mathcal{B}_1,\ket{\Phi_i}) + H(\mathcal{B}_3,\ket{\Phi_i})]&+&\\
(1/2-p_3)[H(\mathcal{B}_1,\ket{\Phi_i})+H(\mathcal{B}_2,\ket{\Phi_i})]&& \geq n/2.
\end{eqnarray*}
Reordering the terms we now get
$\sum_{t=1}^3 p_{t} H(\mathcal{B}_t,\ket{\Phi_i})\geq n/2.$
Putting things together and using the fact that $\sum_i \alpha_i=d$, we obtain
$$
\mathcal{I}_{acc}(\mathcal{E}) \leq \frac{n}{2},
$$
from which the result follows.

If, on the other hand, there exists a $t \in [3]$ such that $p_t > 1/2$, then
by measuring in the basis $\mathcal{B}_t$ we obtain $\mathcal{I}_{acc}(\mathcal{E}) \geq p_t n > n/2$.
\end{proof}

Above, we have only considered a non-uniform prior over the set
of bases.
In \cite{BalWehWin:pistar} it is observed that when we want to
guess the XOR of a string of length $2$ encoded in one (unknown to us)
of these three bases,
the uniform prior on the strings is not the one that gives the smallest
probability of success. This might lead one to think that a similar
phenomenon could be observed in the present setting, i.e., that one
might obtain better locking with three basis for a non-uniform prior on
the strings. In what follows, however, we show that this is not the case.

Let $p_t=\sum_{k} p_{k,t}$ be the marginal distribution on the basis,
then the difference in Bob's knowledge between receiving only the
quantum state and receiving the quantum state \emph{and} the basis information
is given by
\begin{eqnarray*}
 \Delta(p_{k,t})=H(p_{k,t})-\mathcal{I}_{acc}(\mathcal{E}) -H(p_t),
\end{eqnarray*}
substracting the basis information itself. Consider the post-measurement state
$\nu=\sum_i \bra{\Gamma_i}\mu\ket{\Gamma_i}\ket{\Gamma_i}\bra{\Gamma_i}$. Using (\ref{Ibell}) we obtain
\begin{eqnarray} \label{gap1}
 \Delta(p_{k,t})\leq H(p_{k,t})-S(\nu)+n/2 -H(p_t),
\end{eqnarray}
where $S$ is the von Neuman entropy. Consider the state
\begin{eqnarray*}
\rho_{12} =
\sum_{k=1}^{d} \sum_{t=1}^{3} p_{k,t}(\outp{t}{t})_1
\otimes (U_t \outp{k}{k} U_t^{\dagger})_2,
\end{eqnarray*}
we have that
\begin{eqnarray*}
S(\rho_{12})=H(p_{k,t}) &\leq S(\rho_1) +S(\rho_2)\\
                        & = H(p_t) +S(\mu)\\
                        &\leq H(p_t)+S(\nu).
\end{eqnarray*}
Using (\ref{gap1}) and the previous equation we get
\begin{eqnarray*}
 \Delta(p_{k,t})\leq n/2,
\end{eqnarray*}
for any prior distribution. This bound is saturated by the uniform prior
and therefore we conclude that the uniform prior results in the largest
gap possible.

\subsection{MUBs from generalized Pauli Matrices}

We first consider MUBs based on the generalized Pauli matrices $X_d$ and $Z_d$ as described
in Section~\ref{prelim}. We consider a uniform prior over the elements of each basis and the set of bases.
Choosing a non-uniform prior does not lead to a better locking effect.

\begin{lemma}\label{equiv}
Let $\mathbb{B}=\{\mathcal{B}_1,\ldots,\mathcal{B}_{m}\}$ be any set of MUBs constructed on the basis of generalized Pauli matrices
in a Hilbert space of prime power dimension $d = p^N$.
Consider the ensemble $\mathcal{E} = \{ \frac{1}{d m},\outp{b^t_k}{b^t_k}\}$. Then
$$
I_{acc}(\mathcal{E}) = \log d -
\frac{1}{m} \min_{\ket{\psi}} \sum_{\mathcal{B}_t \in \mathbb{B}} H(\mathcal{B}_t,\ket{\psi}).
$$
\end{lemma}
\begin{proof}
We can rewrite Eq.\ (\ref{accessible}) for the POVM
given by $\{\alpha_i \outp{\Phi_i}{\Phi_i}\}$ to
\begin{eqnarray*}
\mathcal{I}_{acc}(\mathcal{E}) &=& \max_M \left(\log d + \right.\\
&&\left. \sum_i \frac{\alpha_i}{d m} \sum_{k,t} |\inp{\Phi_i}{b^t_k}|^2 \log |\inp{\Phi_i}{b^t_k}|^2 \right)\\
&=& \max_M \left(\log d -  \sum_i \frac{\alpha_i}{d} \sum_{t} p_{t} H(\mathcal{B}_t,\ket{\Phi_i}) \right).
\end{eqnarray*}
For convenience, we split up the index $i$ into $i = ab$ with $a = a_1,\ldots,a_N$ and $b=b_1,\ldots,b_N$,
where $a_\ell,b_\ell \in \{0,\ldots,p-1\}$ in the following.

We first show
that applying generalized Pauli matrices to the basis vectors of a MUB merely permutes those vectors.
\begin{claim}
Let $\mathcal{B}_t = \{\ket{b^t_1},\ldots,\ket{b^t_d}\}$ be a basis based on generalized Pauli matrices
(Section~\ref{prelim}) with
$d = p^N$. Then $\forall a,b \in \{0,\ldots,p-1\}^N, \forall k \in [d]$ we have that $\exists k' \in [d],$ such
that $\ket{b^{t}_{k'}} = X_d^{a_1}Z_d^{b_1} \otimes \ldots
\otimes X_d^{a_N}Z_d^{b_N}\ket{b^t_k}$.
\end{claim}
\begin{proof}
Let $\Sigma_p^i$ for $i \in \{0,1,2,3\}$ denote the generalized Pauli's
$\Sigma_p^0 = \mathbb{I}_p$,
$\Sigma_p^1 = X_p$,
$\Sigma_p^3 = Z_p$, and
$\Sigma_p^2 = X_p Z_p$. Note that $X_p^uZ_p^v = \omega^{uv} Z_p^v X_p^u$,
where $\omega = e^{2\pi i/p}$.
Furthermore, define
$
\Sigma_p^{i,(x)} = \mathbb{I}^{\otimes (x - 1)} \otimes \Sigma_p^{i} \otimes \mathbb{I}^{N-x}
$
to be the Pauli operator $\Sigma_p^i$ applied to the $x$-th qupit.
Recall from Section~\ref{prelim} that the basis $\mathcal{B}_t$ is the unique simultaneous eigenbasis
of the set of operators in $C_t$, i.e., for all $k \in [d]$ and $f,g \in [N]$,
$\ket{b^t_k} \in \mathcal{B}_t$ and $c_{f,g}^t \in C_t$, we have
$c_{f,g}^t \ket{b^t_k}=\lambda_{k,f,g}^t \ket{b^t_k} \textrm{ for some value }\lambda^t_{k,f,g}$.
Note that any vector $\ket{v}$ that satisfies this equation
is proportional to a vector in $\mathcal{B}_t$. To prove
that any application of one of the generalized Paulis merely permutes the vectors in $\mathcal{B}_t$
is therefore equivalent to proving that $\Sigma^{i,(x)}_{p}
\ket{b^t_k}$ are eigenvectors of $c_{f,g}^t$ for any $f,g \in [k]$ and $i \in \{1,
3\}$. This can be seen as follows: Note that $c_{f,g}^t=\bigotimes_{n=1}^N
\left(\Sigma^{1, (n)}_{p}\right)^{f_N} \left(\Sigma^{3,(n)}_{p}\right)^{g_N}$
for $f = (f_1,\ldots,f_N)$ and $g=(g_1, \ldots, g_N)$
with $f_N,g_N \in \{0,\ldots,p-1\}$~\cite{boykin:mub}. A calculation then shows that
$$
c_{f,g}^t \Sigma^{i,(x)}_p \ket{b^t_k}= \tau_{f_x,g_x, i} \lambda_{k,f,g}^t \Sigma^{i,(x)}_{p} \ket{b^t_k},
$$
where  $\tau_{f_x,g_x, i}=\omega^{g_x}$ for $i = 1$ and
$\tau_{f_x,g_x,i}=\omega^{-f_x}$ for $i = 3$. Thus
$\Sigma^{i,(x)}_{p} \ket{b^t_k}$ is an eigenvector of $c^t_{f,g}$ for
all $t, f, g$ and $i$, which proves our claim.
\end{proof}

Suppose we are given $\ket{\psi}$ that minimizes
$\sum_{\mathcal{B}_t \in \mathbb{T}} H(\mathcal{B}_t,\ket{\psi})$.
We can then construct a full POVM with $d^2$ elements by taking
$\{\frac{1}{d}\outp{\Phi_{ab}}{\Phi_{ab}}\}$ with $\ket{\Phi_{ab}} = (X_d^{a_1}Z_d^{b_1} \otimes \ldots
\otimes X_d^{a_N}Z_d^{b_N})^\dagger\ket{\psi}$. However, it follows from our claim
above that $\forall a,b,k, \exists k'$ sucht that $|\inp{\Phi_{ab}}{b^t_k}|^2 = |\inp{\psi}{b^{t}_{k'}}|^2$,
and thus
$H(\mathcal{B}_t,\ket{\psi}) = H(\mathcal{B},\ket{\Phi_{ab}})$ from which the result follows.
\end{proof}

Determining the strength of the locking effects for such MUBs is thus equivalent to proving bounds on
entropic uncertainty relations. We thus obtain as a corollary of
Theorem~\ref{squareThm} and Lemma~\ref{equiv}, that, for dimensions which are the square of a prime power
$d = p^{2N}$, using any product MUBs based on generalized Paulis does not give us any better
locking than just using 2 MUBs.
\begin{corollary}\label{pauliLocking}
Let $\mathbb{S}=\{\mathcal{S}_1,\ldots,\mathcal{S}_{m}\}$ with $m \geq 2$ be any set of MUBs constructed on the basis of generalized Pauli matrices
in a Hilbert space of prime (power) dimension $s = p^N$.
Define $U_t$ as the unitary that transforms the computational basis
into the $t$-th MUB, i.e., $\mathcal{S}_t = \{U_t\ket{1},\ldots,U_t\ket{s}\}$.
Let $\mathbb{B} = \{\mathcal{B}_1,\ldots,\mathcal{B}_{m}\}$ be the set of product MUBs with
$\mathcal{B}_t = \{U_t \otimes U_t^* \ket{1},\ldots,U_t \otimes U_t^*\ket{d}\}$ in dimension $d=s^2$.
Consider the ensemble $\mathcal{E} = \{ \frac{1}{d m},\outp{b^t_k}{b^t_k}\}$. Then
$$
I_{acc}(\mathcal{E}) = \frac{\log d}{2}.
$$
\end{corollary}
\begin{proof}
The claim follows from Theorem~\ref{squareThm} and the proof of Lemma~\ref{equiv}, by constructing
a similar measurement formed from vectors $\ket{\hat{\Phi}_{\hat{a}\hat{b}}} = K_{a^1b^1}
\otimes K_{a^2b^2}^* \ket{\psi}$
with $\hat{a} = a^1a^2$ and $\hat{b} = b^1b^2$, where $a^1,a^2$ and $b^1,b^2$ are
defined like $a$ and $b$ in the proof of Lemma~\ref{equiv}, and $K_{ab} = (X_d^{a_1}Z_d^{b_1}\otimes\ldots\otimes X_d^{a_N}Z^{b_N}_d)^\dagger$
from above.
\end{proof}

The simple example we considered above is in fact a special case of Corollary~\ref{pauliLocking}.
It shows that if the vector that minimizes the sum of entropies has certain symmetries,
such as for example the Bell states, the resulting POVM can even be much simpler.

\subsection{MUBs from Latin Squares}

At first glance, one might think that maybe the product MUBs based on generalized Paulis are not well suited
for locking just because of their product form. Perhaps MUBs with entangled basis vectors do not exhibit this problem.
To this end, we examine how well MUBs based on Latin squares can lock classical information in a quantum state.
All such MUBs are highly entangled, with the exception of the two extra MUBs based on non-Latin squares.
Surprisingly, it turns out, however, that \emph{any} set of at least two MUBs based on Latin squares, does equally well
at locking as using just 2 such MUBs. Thus such MUBs perform equally ``badly'', i.e., we cannot improve the strength of
the locking effect by using more MUBs of this type.

\begin{lemma}\label{LSlocking}
Let $\mathbb{B}=\{\mathcal{B}_1,\ldots,\mathcal{B}_m\}$ with $m \geq 2$ be any set of MUBs in a Hilbert space of dimension $d=s^2$ constructed
on the basis of Latin squares.
Consider the ensemble $\mathcal{E} = \{ \frac{1}{d m},\outp{b^t_k}{b^t_k}\}$. Then
$$
\mathcal{I}_{acc}(\mathcal{E}) = \frac{\log d}{2}.
$$
\end{lemma}
\begin{proof}
Note that we can again rewrite $\mathcal{I}_{acc}(\mathcal{E})$ as in the proof of Lemma~\ref{equiv}. Consider
the simple measurement in the computational basis $\{\outp{i,j}{i,j}|i,j \in [s]\}$. The result
then follows by the same
argument as in Lemma~\ref{LSentropy}.
\end{proof}

\section{Conclusion and Open Questions}

We have shown tight bounds on entropic uncertainty relations and locking for specific sets of mutually unbiased bases.
Surprisingly, it turns out that using more mutually unbiased basis does not always lead to a better locking effect.
It is interesting to consider what may make these bases so special. The example of three MUBs considered in Lemma~\ref{3mubLocking}
may provide a clue. These three bases are given by the common eigenbases of $\{\sigma_x \otimes \sigma_x, \sigma_x \otimes \mathbb{I},
\mathbb{I} \otimes \sigma_x\}$, $\{\sigma_z \otimes \sigma_z, \sigma_z \otimes \mathbb{I}, \mathbb{I} \otimes \sigma_z\}$ and $\{\sigma_y \otimes \sigma_y,
\sigma_y \otimes \mathbb{I}, \mathbb{I} \otimes \sigma_y\}$ respectively~\cite{boykin:mub}. However, $\sigma_x \otimes \sigma_x$, $\sigma_z \otimes \sigma_z$ and
$\sigma_y \otimes \sigma_y$ commute and thus also share a common eigenbasis, namely the Bell basis. This is exactly the basis we will use as our
measurement. For all MUBs based on generalized Pauli matrices, the MUBs in prime power dimensions are given as the common eigenbasis
of similar sets consisting of strings of Paulis. It would be interesting to determine the strength of the locking effect on the
basis of the commutation relations of elements of \emph{different} sets. Perhaps it is possible to obtain good locking from a subset of such MUBs
where none of the elements from different sets commute.

It is also worth noting that  the numerics of~\cite{terhal:locking}
indicate that at least in dimension $p$ using more than three bases does indeed lead to a stronger
locking effect. It would be interesting to know, whether the strength of the locking effect
depends not only on the number of bases, but also on the dimension of the system in question.

Whereas general bounds still elude us, we have shown that merely choosing mutually unbiased bases is not sufficient to obtain good locking effects or high lower bounds
for entropic uncertainty relations.  We thus have to look for different properties.
\acknowledgments
We would like to thank Harry Buhrman, Hartwig Bosse, Matthias Christandl, Richard Cleve, Debbie Leung, Serge Massar,
David Poulin, and Ben Toner for discussions. We would especially like to thank Andris Ambainis and Andreas Winter for many
helpful comments and interesting discussions. We would also like to thank Debbie Leung, John Smolin and Barbara Terhal for providing
us with explicit details on the numerical studies conducted in~\cite{terhal:locking}.
Thanks also to Matthias Christandl and Serge Massar for discussions on errors in string commitment protocols, to which
end claim 1 was proved in the first place. Thanks also to Matthias Christandl and Ronald de Wolf for helpful
comments on an earlier version of this note.
We are supported by an NWO vici grant 2004-2009
and by the EU project QAP (IST 015848).