A quantum algorithm for searching a target solution of fixed weight

NTRU is one of the most widely used public-key cryptosystems and its security has been an active research topic. This paper proposes a new way to find NTRU-2005 private key. The algorithm is based on meet-in-the-middle attack and a quantum algorithm for searching the fixed weight target. Compared with the current classical and quantum meet-in-the-middle attacks, our algorithm has lower time and space complexity. Moreover, this attack can also be applied against different versions of NTRU. The result can help to understand the security of NTRU better. quantum algorithm, NTRU, meet-in-the-middle attack Citation:Wang H, Ma Z, Ma C G. An efficient quantum meet-in-the-middle attack against NTRU-2005. Chin Sci Bull, 2013, 58: 35143518, doi: 10.1007 For all the time, how to use the quantum computational theory to improve the classical cryptanalysis ability is an important issue. NTRU is a public-key cryptosystem based on the shortest lattice vector problem. At equivalent security level, NTRU needs lower memory and smaller computational complexity than RSA. Now, there is no efficient quantum algorithm known that will solve the shortest lattice vector problem. So, it is believed that NTRU is secure in quantum times [1]. In fact, with the rapid development of quantum computation, all cryptosystems based on the problems of large integer factorization and discrete logarithm are potentially fragile. However, it is still unclear what kind of effects the quantum computational theory could make on the security of NTRU till now. Classical meet-in-the-middle (MITM) attack is a generic cryptanalytic method originally developed from cryptanalysis of block ciphers. Recently, this technique is also found to be quite useful in the cryptanalysis of public-key cryptography. MITM attack is the best algorithm for attacking NTRU at present. Grover [2] proposed a generic quantum search algorithm which gives a quadratic speedup over the classical brute-force search. However, it is not yet known whether Grover algorithm can speed up the classical MITM attack.There are some new developments in the classical cryptanalysis of NTRU, such as lattice attack, hybrid attack [3], broadcast attack [4], etc. Ludwig [5] combined lattice reduction technique with Grover algorithm, and put forward a novel quantum attack algorithm against NTRU. However, the attack algorithm in [5] is not better than classical MITM attack. In 2011, a quantum algorithm used to find fixed weight target was proposed [6]. At the same time, the author analyzed the security of NTRU by the proposed algorithm. The computation complexity of Wang's algorithm is significantly lower than a classical brute-force search, but still higher than a classical MITM attack.Xiong et al. [7] combined MITM attack with Grover quantum searching algorithm, and developed a quantum MITM attack method against NTRU. The time complexity

“…Details can be found in [10]. To keep consistent with [6,7], we use the same notation (The versions in [6] is NTRU-2005).…”

Section: Ntru Cryptosystemmentioning

confidence: 99%

“…However, the attack algorithm in [5] is not better than classical MITM attack. In 2011, a quantum algorithm used to find fixed weight target was proposed [6]. At the same time, the author analyzed the security of NTRU by the proposed algorithm.…”

mentioning

confidence: 99%

An efficient quantum meet-in-the-middle attack against NTRU-2005

Wang¹,

Ma²,

Ma³

2013

“…When the number of marked states is no more than 3N 4 , this algorithm requires just a single query, and this achieves exponential speedup over classical algorithm. [6][7][8][9][10], recent interests have been focused on quantum algorithms using duality mode in a quantum register [11,12]. Deleting an item from a database is a routine task in database processing.…”

mentioning

confidence: 99%

“…A quantum large integer factoring algorithm [2] and Grover search algorithm [3] can complete tasks exponentially faster than classical counterparts. Quantum algorithms have attracted much attention and been further developed and applied to various problems [6][7][8][9][10], recent interests have been focused on quantum algorithms using duality mode in a quantum register [11,12].…”

mentioning

confidence: 99%

A quantum algorithm that deletes marked states from an arbitrary database

Liu

Ouyang

2013

We present a general quantum deletion algorithm that deletes M marked states from an N-item quantum database with arbitrary initial distribution. The general behavior of this algorithm is analyzed, and analytic result is given. When the number of marked states is no more than 3N 4 , this algorithm requires just a single query, and this achieves exponential speedup over classical algorithm. [6][7][8][9][10], recent interests have been focused on quantum algorithms using duality mode in a quantum register [11,12]. Deleting an item from a database is a routine task in database processing. In classical computing, deleting operation is an essential method to preserve data structure for convenient searching and visiting. For instance, in the basis technique of well-known Google search engine -PageRank algorithm [13,14], the most frequently clicked N items are selected from the magnanimity of information. Then the first N nodes form a heap structure and web pages with respect to the marked nodes are deleted to preserve the first N nodes Deleting items in a database is a widely met scientific problem in quantum computing. Some certain items do not satisfy the computing demands, then one should delete them. We have proposed quantum deletion algorithm [17] that deletes a marked item from unsorted N = 2 n item database. However, in a variety of practical cases, it would be desirable to apply it to deleting multiple number of marked items and non-uniform initial distribution, where N is not essentially the power of 2. This could arise in situations where the deletion is used as a subroutine in a large quantum computation. Another example would be the given that initial distribution is intrinsically non-uniform and the marked solution is not unique.In this article, we generalize a quantum deletion algorithm [17] to the case that the number of marked items is more than one, the initial amplitudes are complex and follow an arbitrary distribution. Moreover we analyze the general behavior of deletion operator and give analytic results. Finally, we

“…In 1996, Grover [2] presented a quantum searching algorithm that reduces the computational complexity of current exhaustive search attacks from O(2 n ) to O(2 n/2 ). To overcome this problem, scholars [3][4][5][6][7][8][9][10][11] in China and abroad have since intensively investigated quantum computation and quantum cryptology. Although the correctness of quantum computation and Shor's algorithm has been proved to hold true [12], it is still difficult to break 2048-bit RSA or 191-bit ECC in the case of the quantum computer for the reason that the kilobit quantum computer does not exist.…”

mentioning

confidence: 99%

t-bit semiclassical quantum Fourier transform

Bao

Zhou

et al. 2012

Self Cite

Because of the difficulty of building a high-dimensional quantum register, this paper presents an implementation of the high-dimensional quantum Fourier transform (QFT) based on a low-dimensional quantum register. First, we define the t-bit semiclassical quantum Fourier transform. In terms of probability amplitude, we prove that the transform can realize quantum Fourier transformation, illustrate that the requirement for the two-qubit gate reduces obviously, and further design a quantum circuit of the transform. Combining the classical fixed-window method and the implementation of Shor's quantum factorization algorithm, we then redesign a circuit for Shor's algorithm, whose required computation resource is approximately equal to that of Parker's. The requirement for elementary quantum gates for Parker's algorithm is , and the quantum register for our circuit requires t1 more dimensions than Parker's. However, our circuit is t 2 times as fast as Parker's, where t is the width of the window. Quantum computing has a strong ability for parallel computing, which poses a great challenge to the security of the modern cipher. In 1994, Shor [1] presented a polynomial-time quantum algorithm for factorization. Apparently, the emergence of this algorithm greatly threatens the public-key cryptography, such as RSA cryptography, whose security is based on factorization and a discrete logarithm. In 1996, Grover [2] presented a quantum searching algorithm that reduces the computational complexity of current exhaustive search attacks from O(2 n ) to O(2 n/2 ). To overcome this problem, scholars [3][4][5][6][7][8][9][10][11] in China and abroad have since intensively investigated quantum computation and quantum cryptology. Although the correctness of quantum computation and Shor's algorithm has been proved to hold true [12], it is still difficult to break 2048-bit RSA or 191-bit ECC in the case of the quantum computer for the reason that the kilobit quantum computer does not exist. Thus, how to reduce the computation resource required for Shor's algorithm is an issue of common concern.In 1996, Vedral et al.[13] published a circuit with a 7n+1-dimensional quantum register and O(n 3 ) elementary gates for modular exponentiation (where n denotes the length of the integer to be factorized). It has been mentioned that the quantum register requirement can be reduced to 4n+3 if unbounded Toffoli gates (n-controlled NOT gates) are available. Also in 1996, Beckman et al. [14] presented an extended analysis of modular exponentiation, with a circuit of a 4n+1-dimensional quantum register if unbounded Toffoli gates are available. In 1998, Zalka [15] described a method for factorization with a 3n+O(logN)-dimensional quantum register using only elementary gates. However, these achievements are the optimization of Shor's algorithm, which is based only on reducing the dimensions of the quantum register.Generally speaking, in the implementation of the quantum Fourier transform (QFT), the n-bit quantum state is once inputted into a n-dimensional...