[Paper Review] Quantum Algorithm for Optimization and Polynomial System Solving over Finite Field and Application to Cryptanalysis

Yu-Ao Chen, Xiao-Shan Gao+1 more|arXiv (Cornell University)|Feb 12, 2018

Coding theory and cryptography25 references4 citations

TL;DR

This paper presents polynomial-time quantum algorithms for solving polynomial systems over finite fields and integer optimization problems with bounded variables, achieving exponential speedup when the condition number of the problem is small. The key contribution is demonstrating that lattice-based post-quantum cryptosystems like NTRU and SIS are secure only if their associated equation systems have large condition numbers, making this parameter a new security criterion.

ABSTRACT

In this paper, we give quantum algorithms for two fundamental computation problems: solving polynomial systems over finite fields and optimization where the arguments of the objective function and constraints take values from a finite field or a bounded interval of integers. The quantum algorithms can solve these problems with any given success probability and have polynomial runtime complexities in the size of the input, the degree of the inequality constraints, and the condition number of certain matrices derived from the problem. So, we achieved exponential speedup for these problems when their condition numbers are small. As applications, quantum algorithms are given to three basic computational problems in cryptography: the polynomial system with noise problem, the short integer solution problem, the shortest vector problem, as well as the cryptanalysis for the lattice based NTRU cryptosystem. It is shown that these problems and NTRU can against quantum computer attacks only if their condition numbers are large, so the condition number could be used as a new criterion for the lattice based post-quantum cryptosystems.

Motivation & Objective

• To develop efficient quantum algorithms for solving polynomial systems over finite fields and bounded integer optimization problems.
• To analyze the role of the condition number in determining the quantum speedup for these problems.
• To apply the algorithms to fundamental problems in cryptography, including PSWN, SIS, SVP, and NTRU cryptanalysis.
• To establish the condition number as a new criterion for the security of lattice-based post-quantum cryptosystems.
• To demonstrate that quantum attacks on NTRU are feasible only when the condition number is small, implying that large condition numbers are essential for security.

Proposed method

• Reduce equality and inequality constraints in optimization problems to Boolean polynomial systems over ℂ, transforming them into B-POSSO (Boolean Polynomial System Solving over ℂ) problems.
• Use a quantum algorithm from prior work [12] to solve the resulting B-POSSO problems, leveraging amplitude amplification and quantum state preparation.
• Represent variables as binary strings and encode constraints using polynomial equations in Boolean variables, enabling quantum computation over complex numbers.
• Define the condition number κ of the problem based on the spectral properties of matrices derived from the system, which governs the runtime complexity.
• Apply the algorithm to specific cryptographic problems by reformulating them as optimization or system-solving tasks over finite fields or integers.
• Use the objective function to minimize the degree of the private key in NTRU, reducing the problem to a B-POSSO instance with a bounded objective function.

Experimental results

Research questions

• RQ1 Can quantum algorithms solve polynomial systems over finite fields and bounded integer optimization problems in polynomial time?
• RQ2 Under what conditions does the proposed quantum algorithm achieve exponential speedup over classical methods?
• RQ3 How does the condition number of a system affect the quantum complexity of solving polynomial systems and optimization problems?
• RQ4 Can the proposed quantum algorithms break widely used lattice-based cryptosystems like NTRU, and under what conditions?
• RQ5 Is the condition number a viable new security criterion for post-quantum cryptosystems based on lattice problems?

Key findings

• The quantum algorithm solves polynomial systems over finite fields with success probability at least 1−ε in time Õ(T_F^{3.5} D^{3.5} m^{5.5} log^{4.5}p κ² log(1/ε)), where T_F is total sparseness, D is a degree-related parameter, and κ is the condition number.
• For optimization problems over finite fields and bounded integers, the algorithm achieves polynomial runtime complexity in input size, constraint degrees, and the condition number κ, enabling exponential speedup when κ is small.
• The quantum algorithm for the polynomial system with noise (PSWN) problem has complexity Õ(n^{3.5} T_F^{3.5} log^8 p κ²), showing feasibility when the condition number is small.
• The quantum attack on NTRU achieves complexity Õ(N^{4.5} log^{4.5}q κ² log(1/ε)), with concrete estimates showing 2^{45}κ² for (N,p,q)=(107,3,64), indicating feasibility only if κ is large.
• The paper establishes that lattice-based post-quantum cryptosystems, including NTRU and SIS, are secure against quantum attacks only if their associated equation systems have large condition numbers.
• The condition number is proposed as a new security criterion for post-quantum cryptosystems, replacing or supplementing traditional assumptions like worst-case hardness.