[Paper Review] Improved Low-qubit Hidden Shift Algorithms

Xavier Bonnetain|arXiv (Cornell University)|Jan 31, 2019

Quantum Computing Algorithms and Architecture14 references4 citations

TL;DR

This paper improves the quantum hidden shift algorithm of Childs, Jao, and Soukharev by integrating subset-sum algorithms to significantly reduce query and time complexity. It achieves a key result of reducing the quantum query cost by a factor of up to 4.5 compared to prior work, with new tradeoffs between quantum queries, classical time, and memory, especially under a quadratic gap assumption for post-quantum security applications.

ABSTRACT

Hidden shift problems are relevant to assess the quantum security of various cryptographic constructs. Multiple quantum subexponential time algorithms have been proposed. In this paper, we propose some improvements on a polynomial quantum memory algorithm proposed by Childs, Jao and Soukharev in 2010. We use subset-sum algorithms to significantly reduce its complexity. We also propose new tradeoffs between quantum queries, classical time and classical memory to solve this problem.

Motivation & Objective

• To reduce the quantum query and classical time complexity of the hidden shift problem in abelian groups.
• To improve upon the 2010 quantum algorithm by Childs, Jao, and Soukharev, which had a complexity of $ L( frac{1}{ sqrt{2}}) $ in quantum queries.
• To explore new tradeoffs between quantum queries, classical time, and classical memory, particularly under a quadratic gap assumption.
• To assess the concrete cost implications for post-quantum cryptographic schemes relying on hidden shift hardness.
• To investigate whether subset-sum algorithms can be leveraged to optimize the combination routines in hidden shift algorithms.

Proposed method

• Integrates subset-sum algorithms into the combination routines of the hidden shift algorithm to reduce the number of required quantum queries.
• Uses a generalized routine structure with input sizes $ k_i = (i\alpha + \beta)\sqrt{n\log_2 n} $ to balance query and classical time costs.
• Applies the $ L(c) $ notation to express asymptotic complexity in terms of the subset-sum solving exponent $ c $.
• Employs a quadratic gap strategy where quantum query cost is $ L(\sqrt{c/3}) $ and classical time is $ L(2\sqrt{c/3}) $, mirroring Grover’s algorithm tradeoff.
• Optimizes the number of queries by using a single routine with $ O(n^2) $ queries and $ \widetilde{O}(2^{0.291n}) $ classical time, outperforming classical algorithms when $ c < 0.5 $.
• Adapts the approach to both polynomial-memory and memory-heavy variants, comparing with prior works like Kuperberg and Regev.

Experimental results

Research questions

• RQ1 Can subset-sum algorithms be used to reduce the quantum query complexity of the hidden shift problem?
• RQ2 What tradeoffs between quantum queries, classical time, and classical memory can be achieved using subset-sum techniques?
• RQ3 How does the performance of the improved algorithm compare to prior quantum hidden shift algorithms in terms of asymptotic and concrete complexity?
• RQ4 Can a quadratic gap between quantum query cost and classical time cost be achieved while maintaining subexponential complexity?
• RQ5 Does the improved algorithm outperform classical algorithms in concrete settings, especially when $ c < 0.5 $?

Key findings

• The improved algorithm reduces the quantum query cost to $ L(\sqrt{c}) $, where $ c $ is the exponent for solving subset-sum instances.
• With a quadratic gap between classical time and quantum query cost, the algorithm achieves $ L(\sqrt{c/3}) $ quantum queries and $ L(2\sqrt{c/3}) $ classical time.
• For $ c = 0.291 $, the algorithm achieves $ \widetilde{O}(2^{0.291n}) $ classical time and memory, outperforming classical exhaustive search when $ c < 0.5 $.
• Using a single routine with $ O(n^2) $ queries and $ \widetilde{O}(2^{0.291n}) $ classical time, the algorithm beats the best known classical algorithm for $ c < 0.5 $.
• The method reduces the query complexity exponent by a factor of up to 4.5 compared to the original Childs-Jao-Soukharev algorithm.
• The algorithm provides improved tradeoffs for post-quantum security, particularly for NIST’s security levels 1, 3, and 5, which are based on exhaustive search assumptions.