**Abstract:** The Fiat-Shamir construction (Crypto 1986) is an efficient
transformation in the random oracle model for creating
non-interactive proof systems and signatures from
sigma-protocols. In classical cryptography, Fiat-Shamir is a
zero-knowledge proof of knowledge assuming that the underlying
sigma-protocol has the zero-knowledge and
special soundness properties. Unfortunately,
Ambainis, Rosmanis, and Unruh (FOCS 2014) ruled out non-relativizing
proofs under those conditions in the quantum setting.

In this paper, we show under which strengthened conditions the
Fiat-Shamir proof system is still post-quantum secure. Namely, we
show that if we require the sigma-protocol to have computational
zero-knowledge and *statistical* soundness, then Fiat-Shamir is a
zero-knowledge simulation-sound proof system (but not a proof of
knowledge!). Furthermore, we show that Fiat-Shamir leads to a
post-quantum secure unforgeable signature scheme when additionally assuming a
"dual-mode hard instance generator" for generating key pairs.