Imagine you're a burglar casing a neighborhood. You can spend weeks studying blueprints (preprocessing) and carry a notebook of lock patterns (space), then spend a few minutes per house picking locks (queries). The harder question in security isn't whether any lock can be picked — it's how much prep and how big a notebook you'd need to make the attack practical. This paper proves that quantum locks are exponentially harder to case than classical ones, even when the burglar has quantum tools. The committed claim: for binary phase states — a specific quantum cryptographic primitive — a T-query adversary with S qubits of advice can recover a random key with probability at most O((T² + √(ST))/N), where N = 2^n. The critical term is that √(ST) rather than the ST that appears in the best known bound for classical (post-quantum) one-way functions. That square root isn't cosmetic. It means the quantum primitive stays secure against preprocessing attacks with space up to N², while classical primitives break at space N. You get a quadratic security amplification just by using quantum communication — n qubits of key material buys you security that n classical bits fundamentally cannot. The methodology is elegant in its simplicity. Express the optimal preprocessing attack as the operator norm of a random matrix, then bound the expected value via the trace-moment method. The trace moments get a natural interpretation through Zhandry's compressed oracle framework (Crypto 2019). This isn't a new algorithmic family — it's a proof technique that simplifies and generalizes Liu's Eurocrypt 2023 approach. The paper sits squarely in the random oracle model (QROM) tradition, meaning it proves things about idealized hash functions, not specific constructions. The results extend beyond the headline bound. The authors tighten Liu's analysis of post-quantum pseudorandom generators in QROM, achieving a distinguishing advantage of O(T²/N + √(ST/N)). They extend the one-query lower bound of Lombardi-Ma-Wright (STOC 2024) for unitary synthesis to hold against adversaries making one arbitrary function query plus polynomially many adaptive random oracle queries. And they prove a tight O(√S/N) bound for pseudorandomness of random binary phase states against space-S distinguishers. Four results, one unified framework. Integrity is strong for a theory paper: all results are mathematical proofs, not simulations or experiments. There's no benchmark-shopping or p-hacking possible — either the bound holds or it doesn't. The baselines are explicitly named (Liu's Eurocrypt 2023 bound, the Lombardi-Ma-Wright STOC 2024 result) and the improvement is stated precisely. The bounds are proved near-optimal by comparison to known attacks. This is the gold standard for theoretical cryptography: prove the bound, name the prior art, state exactly where you improve. The live fight in this subfield is whether quantum cryptographic primitives offer provable advantages over classical ones in the preprocessing (non-uniform) setting. This paper lands a clean hit for the 'yes' camp. The √(ST) vs ST gap is not a technicality — it's a separation result. Classical crypto hits a wall at space N; quantum crypto pushes that wall to N². The field has been chipping away at these time-space tradeoffs since Yao's 1990 work, and this paper closes a significant gap. What's missing is the obvious: extending these bounds beyond the random oracle model to standard-model assumptions. That's the perennial gap in QROM-based cryptography. The authors almost certainly know this is the right next step; they didn't take it because it's genuinely hard — likely years of additional technique development, not a compute budget issue. The random oracle model is where you prove the bound is possible before you prove it's real.
