# Trapdoor claw-free function pair $f_0,f_1:X\mapsto Y$ have the same image $Y$ and are injective i.e., every $y\in Y$ there are exactly two $x_0,x_1$ such that $f_0(x_0)=f_1(x_1)=y$ The trapdoor property means that given $y$ it is hard to compute $x_0,x_1$ s.t. $f_0(x_0)=f_1(x_1)=y$ but if you have the trapdoor hint then computing $x_0,x_1$ from $y$ can be done efficiently. The claw-free property means that it is hard to compute $x_0,x_1$ s.t. $f_0(x_0)=f_1 (x_1)$ . ## In QFHE paper In [^1] trapdoor claw-free functions are used to hide a secret bit $s$ ,$f_0,f_1:\{0,1\}\times R\mapsto Y$ have the same image $Y$ and are injective. For any $(\mu_0,r_0), (\mu_1,r_1)$ such that $f_0(\mu_0,r_0)=f_1(\mu_1,r_1)=y$ then $\mu_0\oplus \mu_1=s$ TCFs are used by a quantum server to create a superposition over a claw, while a classical prover should not be able to find the claw. ## Created 2026-03-12 11:45 [^1]: [[@Classical Homomorphic Encryption for Quantum Circuits]]