ZIP 2005: Resolve TODO — discuss collapsing property for Recovery Protocol QROM lift.

Cite Unruh on the collapsing property, Czajkowski et al. for sponge,
ACMT2025 for the sponge strengthening, Fehr 2018 for the unified
algebraic framework covering Merkle–Damgård and HAIFA (BLAKE2b's
construction), and Gunsing and Mennink 2022 for tree hashes
(relevant for the Recovery Protocol's note-commitment tree).

Modelling H^rcm as collapsing reduces, via Fehr's theorem, to
modelling BLAKE2b's compression function as collapsing — the
natural post-quantum analog of the random-oracle modelling
assumption underlying the classical-ROM analysis.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: daira

zips/zip-2005.md

@@ -1303,8 +1303,39 @@ it would require running Grover's algorithm with a quantum circuit that
 does random accesses to a $2^{92.3}$-bit quantum memory.) Therefore, an
 output size of 253 bits does not exclude a hash function from being collapsing.
 
-TODO: discuss [^CBHSU2017] (sponge security), [^Unruh2015] [^Unruh2016]
-(collapse-binding property).
+The classical proof above relies on $\mathsf{H^{rcm}}$ being
+collision-resistant. The natural quantum analog is called the
+*collapsing* property, introduced by Unruh [^Unruh2015]
+[^Unruh2016]. It says that even a quantum adversary holding a
+*superposition* over several preimages of a fixed output cannot
+tell —by any subsequent measurement— which preimage it now has.
+This is the right property for our reduction. The proof above
+splits cases based on which $\mathsf{H^{rcm}}$ query produced the
+colliding output. That case analysis works the same classically
+and quantumly only if the underlying hash "collapses" the
+adversary's superposition to a single classical preimage.
+
+Subsequent work has analyzed whether standard hash-function
+constructions inherit collapsing from their compression function.
+Unruh [^Unruh2016] proved this for Merkle–Damgård (with a padding
+restriction); Czajkowski et al. [^CBHSU2017] for the *sponge*
+construction (the absorb-then-squeeze paradigm used by SHA-3 /
+Keccak), with [^ACMT2025] strengthening the sponge result via the
+related notion of quantum indifferentiability. Fehr [^Fehr2018]
+gave a unified algebraic framework that recovers these results and
+proves the collapsing property of HAIFA, a Merkle–Damgård variant
+with a per-iteration salt and counter. Gunsing and Mennink
+[^GM2022] extended this kind of analysis to tree-hash
+constructions, relevant for the Recovery Protocol's note-commitment
+tree.
+
+BLAKE2b uses HAIFA, so by Fehr's theorem modelling $\mathsf{H^{rcm}}$
+as collapsing reduces to modelling BLAKE2b's compression function
+as collapsing. The "iv-preimage resistance" side condition Fehr's
+theorem requires for arbitrary-length inputs is automatically
+satisfied if the compression function is modelled as a random oracle —
+which is also the modelling assumption underlying the classical-ROM
+analysis above.
 
 ### Security argument for key binding
 
@@ -2034,8 +2065,12 @@ manipulate the note selection algorithm to some extent.
 
 [^CBHSU2017]: [Post-quantum security of the sponge construction. Jan Czajkowski, Leon Groot Bruinderink, Andreas Hülsing, Christian Schaffner, and Dominique Unruh.](https://eprint.iacr.org/2017/771)
 
+[^Fehr2018]: [Classical Proofs for the Quantum Collapsing Property of Classical Hash Functions. Serge Fehr.](https://eprint.iacr.org/2018/887)
+
 [^CMSZ2021]: [Post-Quantum Succinct Arguments: Breaking the Quantum Rewinding Barrier. Alessandro Chiesa, Fermi Ma, Nicholas Spooner, and Mark Zhandr.](https://eprint.iacr.org/2021/334)
 
+[^GM2022]: [Collapseability of Tree Hashes. Aldo Gunsing and Bart Mennink.](https://eprint.iacr.org/2022/248)
+
 [^CDDGS2025]: [Quantum Rewinding for IOP-Based Succinct Arguments. Alessandro Chiesa, Marcel Dall'Agnol, Zijing Di, Ziyi Guan, and Nicholas Spooner.](https://eprint.iacr.org/2025/947)
 
 [^ACMT2025]: [The Sponge is Quantum Indifferentiable. Gorjan Alagic, Joseph Carolan, Christian Majenz, and Saliha Tokat.](https://eprint.iacr.org/2025/731)