Not-so-adiabatic quantum computation for the shortest vector problem

Abstract

Since quantum computers are known to break the vast majority of currently-used cryptographic protocols, a variety of new protocols are being developed that are conjectured, but not proven to be safe against quantum attacks. Among the most promising is lattice-based cryptography, where security relies upon problems like the shortest vector problem. We analyse the potential of adiabatic quantum computation for attacks on lattice-based cryptography, and give numerical evidence that even outside the adiabatic regime such methods can facilitate the solution of the shortest vector and similar problems. I. B. Quantum Computing in Lattice-Based CryptographySo far, most efforts towards quantum attacks on cryptographic protocols have concentrated on gate model quantum algorithms and their applications as subrou-arXiv:1910.10462v2 [quant-ph]

Two quantum Ising algorithms for the shortest-vector problem

“…The algorithms described in Sec. III go a way to establishing the vector optimization framework first proposed in [29], and the work described in Sec. IV signals emphatically that quantum cryptanalysis is drawing into the empirical realm and is no longer purely a theoretical endeavor.…”

“…Lattice problems in certain algebraic number fields can be solved using quantum HSP algorithms that compute unit groups [27] and principal ideals [28]. A recent work [29] proposed a different approach to finding short vectors, encoding vector norms into a Hamiltonian of a system of ultracold bosons trapped in a potential landscape. While broadly in the adiabatic quantum optimization regime, sweeps are performed subadiabatically to obtain results from a distribution over lowenergy eigenstates (consequently, "short" vectors).…”

“…In this section we describe how the encoding of the SVP problem into the Ising coefficients J i j , h i that define the energy of the system is performed. The coefficients are derived directly from the input basis, following a process similar to that for the Bose-Hubbard quantum SVP algorithm [29].…”

“…Assuming such qudits are available, we can writeQ ( j) to mean the qudit operator acting on qudit j. Then, following [29], the problem Hamiltonian can be written as…”

“…3(b) it is found for 7 log T 10. In this "Goldilocks zone" [29], the sweep is sufficiently fast to excite the system from its ground state but also sufficiently slow to avoid excitations to highly excited states.…”