Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years)...
Transcript of Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years)...
![Page 1: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/1.jpg)
Quantum Algorithms Introduction
AIM Workshop on Quantum algorithms for
analysis of public-key crypto
Michele Mosca
4 February 2019
![Page 2: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/2.jpg)
Cryptography:RSA, DSA, DH, ECDH, ECDSA,…, SHA, AES
Secure web browsing, Auto-updates, VPN, Secure email, Blockchain, etc…
Cloud computing, Payment systems, Internet, IoT, etc…
![Page 3: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/3.jpg)
• User errors
• Corrupt users
• Admin errors
• Corrupt admin
• Platform implementation errors
• Platform design errors
• Cryptography implementation errors
• Fundamentally vulnerable cryptography
So many different vulnerabilities
![Page 4: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/4.jpg)
• User errors
• Corrupt users• Admin errors
• Corrupt admin• Platform implementation errors
• Platform design errors•Crypto implementation errors•Fundamentally vulnerable
cryptography
Ranked, from bad to worse?
![Page 5: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/5.jpg)
Do we need to worry now?
• Depends on*:• How long do you need your cryptographic keys to be secure?
– security shelf-life (x years)• How much time will it take to re-tool the existing
infrastructure with large-scale quantum-safe solution? (y years) – migration time
• How long will it take for a large-scale quantum computer to be built (or for any other relevant advance)? (z years) – collapse time
• “Theorem”: If x + y > z, then worry.
y
time
xz
*M. Mosca: e-Proceedings of 1st ETSI Quantum-Safe Cryptography Workshop, 2013. Also http://eprint.iacr.org/2015/1075
![Page 6: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/6.jpg)
Business bottom line
Fact: If x+y>z, then you will not be able to provide the required x years of security.
Fact: If y>z then cyber systems will collapse in z years with no quick fix.
Prediction: In the next 6-12 months, more organizations will be differentiated by whether or not they have a well-articulated quantum risk management plan.
Fact: Rushing “y” will be expensive, disruptive, and lead to vulnerable implementations.
![Page 7: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/7.jpg)
How close are we to having sufficient quantum resources?
![Page 8: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/8.jpg)
What is ‘z’?
• M. Mosca [Oxford, 1996]: “20 qubits in 20 years”
• Microsoft Research [October 2015]: ”Recent improvements in control of quantum systems make it seem feasible to finally build a quantum computer within a decade”.
• M. Mosca ([NIST, April 2015], [ISACA, September 2015]): “1/7 chance of breaking RSA-2048 by 2026, ½ chance by 2031”
• M. Mosca [London, September 2017]: “1/6 chance within 10 years”
• Simon Benjamin [London, September 2017]: Speculates that if someone is willing to “go Manhattan project” then “maybe 6-12 years”
![Page 10: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/10.jpg)
i.e. quantum annealers, quantum simulators, NISQ
Not a known threat to cryptography
• Can they capture some of the power of quantum computation?
• Can they simulate themselves or similar systems faster/cheaper than conventional computers?
• Can they solve useful problems better than conventional devices?
• Can the same platforms be leveraged for fault-tolerant quantum computing?
Non-fault-tolerant quantum devices
“Similarly, although there is no proof today that imperfect quantum machines can compute fast enough to solve practical problems, that may change.”
![Page 11: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/11.jpg)
Known to solve many problems previously thought to be intractable
©2017 M. Mosca
Scalable fault-tolerant quantum computer
![Page 12: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/12.jpg)
![Page 13: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/13.jpg)
![Page 14: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/14.jpg)
![Page 15: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/15.jpg)
Theorem:The set
is a universal set of gates.
{ }CNOTTHG ,,=
i.e. any n-qubit unitary operator U can be approximated with error , for any , using a finite circuit with gates from G.
ε0>ε
There are many other universal gate sets, though this “Clifford +T” gate set is studied extensively. There is an elegant theory of fault-tolerant quantum-error correction built around it.
What exactly are we trying to build?
![Page 16: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/16.jpg)
“Threshold theorem”
Architecture description
Error model
Threshold “ɛ”If the error rates of the basic operations of the device are below ɛ,
then we can efficiently scale quantum computations.
16
![Page 17: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/17.jpg)
CNOT fault-tolerant CNOT
≡
Physical qubits and gates versus logical qubits and gates
Logical layer Physical layer
![Page 18: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/18.jpg)
What resources are required to implement a specific quantum attack?
• A billion physical qubits and a trillion physical gates?• A million qubits and 100 million gates?
• Something else?
• Asymptotic complexity estimates give a very coarse-grained approximation.
• To attempt to estimate this question, we need a more fine-grained study of the full tool chain between algorithms and physical qubits.
![Page 19: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/19.jpg)
Quantum compilers
![Page 20: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/20.jpg)
Examples of technical advances in quantum compilation
• Use number theory methods to bypass Solovay-Kitaev algorithm and achieve optimal synthesis of one-qubit unitaries (over Clifford and T gates)
• Use matroid partitioning to reduce T-complexity and T-depth
• Use channel representation of unitaries to find optimal T-depth
![Page 21: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/21.jpg)
The art of quantum algorithmics is to choreograph constructive interference on desirable outcomes and destructive interference on undesirable outcomes.
![Page 22: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/22.jpg)
Some basic tools
![Page 23: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/23.jpg)
The Hadamard basis change1
210
210 H +→
12
102
11 H −→
012
102
1 H→+
112
102
1 H→−
![Page 24: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/24.jpg)
The Hadamard transformation: summary
12
1)1(02
1b bH −+→←
![Page 25: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/25.jpg)
The Hadamard transformation: circuit
notation
b 12
1)1(02
1 b−+H
![Page 26: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/26.jpg)
The Hadamard transformation on several bits
1x 12
1)1(02
11x−+H
2x 12
1)1(02
12x−+H
3x 12
1)1(02
13x−+H
![Page 27: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/27.jpg)
The Hadamard transformation: global view
![Page 28: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/28.jpg)
The Hadamard transformation: global view
321 xxx ∑∈
⋅−3}1,0{
32181)1(
y
yx yyyHHH ⊗⊗
![Page 29: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/29.jpg)
The Hadamard transformation: global view
∑∈
⋅−=⊗⊗3}1,0{
321321 81)1(
y
yx yyyxxxHHH
![Page 30: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/30.jpg)
The Hadamard transformation on several bits
1x12
1)1(02
11x−+ H
2x12
1)1(02
12x−+ H
3x12
1)1(02
13x−+ H
![Page 31: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/31.jpg)
The Hadamard transformation: global view
321 xxx∑∈
⋅−3}1,0{
32121)1(
y
yx yyy
H
H
H
![Page 32: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/32.jpg)
The Hadamard transformation: global view
321 xxx∑∈
⋅−3}1,0{
32121)1(
y
yx yyyHHH ⊗⊗
![Page 33: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/33.jpg)
Looking at NOT and CNOT in Hadamard bases
Consider applying a NOT gate to the following states
( )1010 NOT −−→−
1010 NOT +→+
![Page 34: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/34.jpg)
e.g.Now consider applying a controlled-NOT gate to the following states
( ) ( )101101 CNOT −− →−
( ) ( )100100 CNOT + →+
( ) ( )101101 CNOT + →+
( ) ( )100100 CNOT − →−
![Page 35: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/35.jpg)
Computing functions into the phase
Suppose we know how to compute a function
)(xfcxcx ⊕
}1,0{}1,0{: →f
( ) ( )10)1(10 )( −−− xx xf
fU
fU
![Page 36: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/36.jpg)
Generalization (Kitaev): Eigenvalue “kick-back”Suppose we know how to compute an operator
ψψ φieU =
( ) ( )ψψ φ 1010 ieUc +=+−
ψψ 00 =−Uc
ψψ φ 11 ieUc =−
Then the “controlled-U” gives us
![Page 37: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/37.jpg)
How do we implement c-U?Replace every gate G in the circuit for U with a c-G.For example,
=
![Page 38: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/38.jpg)
Deutsch’s problemCompute using only once )1()0( ff ⊕ fU
0 H
f
H
10 −
![Page 39: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/39.jpg)
Deutsch algorithm
( )( )101)1(0)1(2
1 )1()0( −−+− ff
( )( )101)1(02)1( )1()0(
)0(
−−+−
= ⊕ fff
0 H
f
H )1()0(2)1( )0(
fff
⊕−
10 − 10 −
![Page 40: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/40.jpg)
Garbage-free implementations of f(x)
Does the Deutsch algorithm work if when we implement
we actually leave “junk” information in ancilla qubits?
)(0 xfxx
)()(00 xjunkxfxx
No!! We need a “clean” implementation of f(x).
![Page 41: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/41.jpg)
Making reversible circuits(see Fig. 1.6 in KLM text)
One problem is that there will be junk left in the extra bits
)(00)()()()()(0)()()(
000
xfxxfuncomputexfxjunkxfxxfcopy
xjunkxfxxfcomputex
→
→
→
Bennett showed how to “uncompute” the junk
![Page 42: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/42.jpg)
Making reversible circuits
An irreversible circuit with space S and depth (or “time”) T can thus be simulated by a reversible circuit with space in O(S+T) and time O(T)
Bennett also showed how to implement a reversible version with time O(T1+ε ) and space O(S log(T)) or time O(T) and space O(STε ).
![Page 43: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/43.jpg)
Bernstein-Vazirani problem
Suppose is of the form
for some
}1,0{}1,0{: →nf
Given
determine
xaxf ⋅=)(
na }1,0{∈
)(xfcxcx ⊕
naaaa 21=
fU
…
![Page 44: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/44.jpg)
Bernstein-Vazirani problem0 H H
0 H H
0 H H
1a
2a
3a
∑∈ 3}1,0{
321
x
x∑∈
⋅−3}1,0{
32)1(
x
xa
x
f10 − 10 −
![Page 45: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/45.jpg)
Generally
0 F 1−F
0 F
0 F
f
f : →npZ m
pZ x Mx
1−F1−F
1d
2dFF
1−F1−F
1d
2d
⋅Td M
![Page 46: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/46.jpg)
Another property of Hadamard transformation
Consider nZS 2≤
∑∈
+=+Ss
syS
Sy 1Let
Then∑
⊥∈⊥
⋅⊗ −
=+St
tyn t
SSyH )1(
{ }SstsZttS n ∈∀=⋅∈=⊥ 0,: 2
![Page 47: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/47.jpg)
Simon’s problemSuppose that has the property thatXf n →}1,0{:
)()( yfxf = SySx +=+iff
For some “hidden subgroup” nZS 2≤
)(0 xfxx Given find SfU
![Page 48: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/48.jpg)
Simon’s algorithm0 H
f
H
0 H H
0 H H
∑∈+
+
SZSy
nyfSy
S3
2
)(2
00
∑ ∑∈+ ∈
⋅⊥
−
⊥
SZSy St
ty yftS 3
2
)()1(1
1t
2t
3t
( )⊥
=S
t 1Pr
⊥∈St
![Page 49: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/49.jpg)
Applications of Simon’s algorithm??
![Page 50: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/50.jpg)
![Page 51: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/51.jpg)
![Page 52: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/52.jpg)
![Page 53: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/53.jpg)
![Page 54: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/54.jpg)
![Page 55: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/55.jpg)
Denote W(x)=W(a||c)=s
![Page 56: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/56.jpg)
( )( )cPaPccaW 12)( ⊕⊕=
}1,0{,,}1,0{, ∈≠∈ bn βαβαLet
( ) ( )( )
=⊕=⊕
=10
bifaWbifaW
abfαββα
Let
Then ( ) ( ) ( ) ( ) ( )zababiffabfabf 1=⊕′′′′=
where ( ) ( )βα 11 PPz ⊕=
![Page 57: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/57.jpg)
So ( ) ( ) ( ) ( ) ( )zababiffabfabf 1=⊕′′′′=
where ( ) ( )βα 11 PPz ⊕=
(N.B. the “only if” part is critical)
In other words, if W is based on the 3-round Feistel cipher, the derived function f will have the above property.
Simon’s algorithm will randomly sample vectors orthogonal to (1||z).
![Page 58: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/58.jpg)
In other words, if W is based on the 3-round Feistel cipher, the derived function f will have the above property, and Simon’s algorithm will randomly sample vectors orthogonal to (1||z).
However, if W is based on a random permutation, no such pattern is likely to emerge.
Thus, a quantum algorithm can efficiently distinguish a 3-round Feistel cipher with internal permutations from a random permutation.
![Page 59: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/59.jpg)
![Page 60: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/60.jpg)
Generalization of Simon’s problem, order-finding and DLP: “Hidden subgroup problem”
60
• A unifying framework was developed for these problems
XGf →:
iff( ) ( )yfxf = SySx +=+GS ≤for some
• If G is Abelian, finitely generated, and represented in a reasonable way, we can efficiently find S.
![Page 61: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/61.jpg)
61
Order finding (basis of quantum factoring):
Z=G X
K = r Z
any group
f =)(x a x
(applies more generally to finding the period of any periodic function f)
![Page 62: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/62.jpg)
62
Discrete Log of b=ak to base a :
f =),( yx a x b y
K = ( )1,−k
G rr ZZ ×= X any group
![Page 63: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/63.jpg)
63
Self-shift equivalences (Grigoriev):
nqGF )(= ],...,,)[( 21 nXXXqGFX =
=),...,,( 21 naaa ),...,( 11 nn aXaXP −−
)},...,(),...,(:),...,{(
111
1
nnn
n
XXPaXaXPaa
=−−
=
G
f
K
Abelian Stabilizer Problem (Kitaev)
Hidden Linear Forms (Boneh+Lipton)
![Page 64: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/64.jpg)
• Given any polynomial sized set of generators, we can use the AbelianHSP algorithm to find new generators that decompose G into a directsum of finite cyclic groups. http://arxiv.org/abs/cs/0101004
But finding generators satisfyingis not always easy, e.g. for it’s as hard as factoring N
64
• Any finite Abelian group G is the direct sum of finite cyclic groups
nggg ⊕⊕⊕ 21
nggg ,,, 21 ngggG ⊕⊕⊕= 21*.. NZGge =
Decomposing Abelian groups
![Page 65: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/65.jpg)
65
• Leads directly to an algorithm for computing the class group and class number of a quadratic number field [Watrous ‘00] (computing the class group of a more general number field is a much more difficult task).
• Decomposition of Abelian groups was also applied by •Friedl, Ivanyos and Santha [FIS05] to test if a finite set with a binary operation is an Abelian group, •Kedlaya [Ked06] to compute the zeta function of a genus g curve over a finite field Fq in time polynomial in g and q, and •Childs, Jao and Soukharev [CJS10] in order to construct elliptic curve isogenies in subexponential time.
![Page 66: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/66.jpg)
What about non-Abelian HSP?
66
• Consider the symmetric group• Sn is the set of permutations of n elements
• Let G be an n-vertex graph
• LetDefinehen
where
nSG =
}|)({ nG SGX ∈= ππ
( ) )(GfG ππ =GnG XSf →:
( ) ( ) KKff GG 2121 ππππ =⇔=
( ){ }GGGAUTK === ππ |)(• So the hidden subgroup of is the automorphism group of GGf
![Page 67: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/67.jpg)
Dihedral Hidden Subgroup Problem
67
XDf n →:
( ) ( ) )},1(),0,0{()','(',', sxxbbxbfxbf ∈−−⇔=
• A quantum computer can easily compute states of the form (“cosetstates”) for random x:
nsxx mod,1,0 ++• This can be easily converted to a state of the form
(for random known k):10 /2 nksie π+
![Page 68: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/68.jpg)
Dihedral Hidden Subgroup Problem
68
• It is easy to find s given
10 /2 nsie π+
10 /22 nsie π+
10 /42 nsie π+
10 /82 nsiπ+
• Kuperberg’s sieving method constructs these states from
samples of
with random k.
( )nOe10 /2 nksie π+
![Page 69: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/69.jpg)
Dihedral Hidden Subgroup Problem
69
• It is easy to find s given
10 /2 nsie π+
10 /22 nsie π+
10 /42 nsie π+
10 /82 nsiπ+
• Solving average-case subset sum suffices (Regev)
![Page 70: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/70.jpg)
Applications of Dihedral Hidden Subgroup Algorithm
70
• Regev:
![Page 71: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/71.jpg)
Applications of Dihedral Hidden Subgroup Algorithm
71
• Consider this approach to Diffie-Hellman-like key exchange:
• Group G acting on a set X• Alice sends Bob
• Bob send Alice
• They both compute the key
)(xg a
)(xgb
)()( xgxg abba ++ =
0,,,1, >∈∈=∈ ZbaXxgGg n
• (Childs-Ivanyos) Can use sieving to find a,b in time ( )nOe
• Childs-Ivanyos also find efficient algorithms for discrete logs in semi-groups
![Page 72: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/72.jpg)
Non-Abelian HSP
72
• Tools include non-Abelian QFT, “pretty good” measurements, “sieving”, and non-trivial reductions to Abelian HSP in some cases.
![Page 73: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/73.jpg)
Generalizations of Abelian HSP
73
• Finding Hidden Shifts and Translations
• Can generalize to finding hidden “non-linear” structures. E.g. hidden radius problem, shifted subset problem, hidden polynomial problem
• Estimating “Gauss sums”
• Etc.
![Page 74: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/74.jpg)
Generalizations of Abelian HSP
74
• Can view HSP has a hidden sub-lattice problem for.
One way to generalize the problem, is to find a hidden sub-lattice of.
Need to define appropriate ways for specifying/approximating inputs and outputs.
Applications include solving Pell’s equation, Principal Ideal Problem, and finding the unit group of a number field.
nZZZZ =⊗⊗⊗
nRRRR =⊗⊗⊗
![Page 75: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/75.jpg)
75
QUANTUM SEARCHING
![Page 76: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/76.jpg)
Searching problem
76
Consider
Given
}1,0{}1,0{: →nf
)(0: xfxxU f
Find an x satisfying f(x) = 1
![Page 77: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/77.jpg)
Application
77
Consider a 3-SAT formula
)( 2,2,1, jjjj yyyC ∨∨=
For a given assignment
MCCC ∧∧∧=Φ 21
},,,,,,,{ 2121, nnkj xxxxxxy ∈
=Φ 01
(x)f
n21 xxxx =
if x satisfies Φ
otherwise
![Page 78: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/78.jpg)
Running times
78
( ) 1=xf
tO
n2Can find a solution to using applications of
and other operations (without knowing t).
fU
tO
n2~
Suppose there are t solutions to ( ) 1=xf
![Page 79: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/79.jpg)
Parallelizing Brute-Force Search
79
Θ
M
n2Given M parallel quantum processors, finding an n-bit key requires time (measured in terms of function evaluations):http://arxiv.org/abs/quant-ph/9711070
Classical running time(1 processor)
Classical running time(240
processors)
Quantum running time(1 processor)
Quantum running time(240
processors)
AES-128 2128 288 264 244
e.g. Depth of parallel quantum attacks on AES-128 (in terms of function evaluations):
![Page 80: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/80.jpg)
Can be applied to speed up parts of complex classical algorithms, e.g. finding short vectors in a lattice.
![Page 81: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/81.jpg)
Some quantum algorithms require poly(n) computational qubits and exp(nc) “quantumly accessible” classical bits.
On Quantum RAM
What is the cost of exp(nc) “quantumly accessible” classical bits compared to exp(nc) computational qubits?
For superpolynomially many queries, it’s not clear if there is much advantage. http://arxiv.org/abs/1502.03450
![Page 82: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/82.jpg)
What is a qRAM?
• Quantum Random Access Memory; quantum equivalent of classical RAMs.
• A device with an array of memory cells, an input index register and an output register
• Queries memory addresses in superposition
• Value stored is either classical or quantum; we will focus on classical data here.
![Page 83: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/83.jpg)
Applications of qRAM
• Grover’s searching of unordered databases• Collision finding and element-distinctness • Dihedral hidden subgroup problems• Linear equation solver (uses qRAM to prepare/input certain vectors)• Generic cryptanalytic attacks• Etc.
![Page 84: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/84.jpg)
Generalization: Amplitude Amplification
Consider any algorithm that successfully guesses a solution to
with probability
A
1)( =xf p
pO 1
Quantum Amplitude Amplification finds a solution to
using (quantum) applications of and of A fU
1)( =xf
![Page 85: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/85.jpg)
Analysis
Let S = cost of implementing - “sampling” cost
Let C = cost of implementing - “checking” cost
A
Let p = probability that a sample is a solution.
fU
A classical search would have expected cost
A quantum search would have expected cost
( )CSp
+1
( )CSp
+1
![Page 86: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/86.jpg)
Element Distinctness
86
• Consider
• Find such that
• Classically (in the worst case) this takes evaluations of
Xf n →}1,0{:yx ≠ )()( yfxf =
)(NO f
![Page 87: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/87.jpg)
Element Distinctness
87
• Let sample random elements
• Thus
• Checking if any of the samples are not distinct over the range of f can be done in time
• Thus
Np 1≈
NA ( )jxf
( )NO~
( )
∈+ 4
3~1 NOCSp
![Page 88: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/88.jpg)
88
WALK-BASEDQUANTUMSEARCHING(WILL BE COVERED LATERTHIS WEEK BY ANOTHERSPEAKER)
![Page 89: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/89.jpg)
89
OTHER ALGORITHMSAND ALGORITHICPARADIGMS
![Page 90: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/90.jpg)
Hamiltonian simulation
90
Under appropriate conditions we can efficiently approximate some properties of φiHteOne application, in combination with eigenvalue estimation and other tools, is to determine some properties of the solution to (“well-conditioned”) sparse linear equations (by Harrow, Hassidim and Lloyd (HHL), 2008).
Useful for cryptanalysis??
![Page 91: Quantum Algorithms Introduction · infrastructure with large-scale quantum-safe solution? (y years) – migration time • How long will it take for a large-scale quantum computer](https://reader035.fdocuments.net/reader035/viewer/2022063010/5fc3f0637628bb23805d400a/html5/thumbnails/91.jpg)
And more…
91
•Adiabatic algorithms
•Topological algorithms
•Span programs
•Etc.
http://quantumalgorithmzoo.org/ (maintained by S. Jordan)