Quantum algorithms for the hidden shift problem of Boolean functions - PowerPoint PPT Presentation

Quantum algorithms for the hidden shift problem of Boolean functions Maris Ozols University of Waterloo, IQC and NEC Labs Joint work with: Martin R¨ otteler (NEC Labs) (NEC Labs) J´ er´ emie Roland Andrew Childs (University of Waterloo, IQC) arXiv:1103.2774 Quantum rejection sampling arXiv:1103.3017 Quantum algorithm for the Boolean hidden shift problem 19/09/2011 Dagstuhl 1

Motivation Hidden shift and subgroup problems Legendre symbol Factoring ❦ ◗ ✑ ✸ ◗ ✑✑✑ [van Dam et al. , 2003] ◗ [Shor, 1994] ◗ Discrete ✿ ✘ ✘✘ Hidden Hidden logarithm [Shor, 1994] shift subgroup ❳❳ ❳ ③ problem problem Pell’s equation Dihedral ❩❩ [Hallgren, 2002] group ? � Symmetric ⑦ ❩ ? � group Lattice � � ✠ ? ? problems ❄ ❄ New algorithms [Regev, 2002] Attacks on Graph cryptosystems isomorphism 19/09/2011 Dagstuhl 2

Boolean hidden shift problem (BHSP) Problem ◮ Given: Complete knowledge of f : Z n 2 → Z 2 and access to a black-box oracle for f s ( x ) := f ( x + s ) x ⇒ ⇒ f s ( x ) ◮ Determine: The hidden shift s 19/09/2011 Dagstuhl 3

Boolean hidden shift problem (BHSP) Problem ◮ Given: Complete knowledge of f : Z n 2 → Z 2 and access to a black-box oracle for f s ( x ) := f ( x + s ) x ⇒ ⇒ f s ( x ) ◮ Determine: The hidden shift s Delta functions are hard ◮ f ( x ) := δ x,x 0 f ( x ) 1 0 0 n x 0 1 n 19/09/2011 Dagstuhl 3

Boolean hidden shift problem (BHSP) Problem ◮ Given: Complete knowledge of f : Z n 2 → Z 2 and access to a black-box oracle for f s ( x ) := f ( x + s ) x ⇒ ⇒ f s ( x ) ◮ Determine: The hidden shift s Delta functions are hard ◮ f ( x ) := δ x,x 0 f s ( x ) 1 s 0 0 n x 0 1 n x 0 + s 19/09/2011 Dagstuhl 3

Boolean hidden shift problem (BHSP) Problem ◮ Given: Complete knowledge of f : Z n 2 → Z 2 and access to a black-box oracle for f s ( x ) := f ( x + s ) x ⇒ ⇒ f s ( x ) ◮ Determine: The hidden shift s Delta functions are hard ◮ f ( x ) := δ x,x 0 √ ◮ Equivalent to Grover’s search: Θ( 2 n ) f s ( x ) 1 s 0 0 n x 0 1 n x 0 + s 19/09/2011 Dagstuhl 3

Fourier transform of Boolean functions The ± 1 -function (normalized) 1 2 n ( − 1) f ( x ) ◮ F ( x ) := √ 19/09/2011 Dagstuhl 4

Fourier transform of Boolean functions The ± 1 -function (normalized) 1 2 n ( − 1) f ( x ) ◮ F ( x ) := √ Fourier transform � � 1 1 1 H := √ 1 − 1 2 ◮ ˆ F ( w ) := � w | H ⊗ n | F � 19/09/2011 Dagstuhl 4

Fourier transform of Boolean functions The ± 1 -function (normalized) 1 2 n ( − 1) f ( x ) ◮ F ( x ) := √ Fourier transform � � 1 1 1 H := √ 1 − 1 2 ◮ ˆ F ( w ) := � w | H ⊗ n | F � = 1 2 ( − 1) w · x F ( x ) √ � x ∈ Z n 2 n 19/09/2011 Dagstuhl 4

Fourier transform of Boolean functions The ± 1 -function (normalized) 1 2 n ( − 1) f ( x ) ◮ F ( x ) := √ Fourier transform � � 1 1 1 H := √ 1 − 1 2 ◮ ˆ F ( w ) := � w | H ⊗ n | F � = 1 2 ( − 1) w · x F ( x ) √ � x ∈ Z n 2 n Function f is bent if ∀ w : | ˆ 1 F ( w ) | = √ 2 n 19/09/2011 Dagstuhl 4

Bent functions are easy Preparing the “phase state” ◮ Phase oracle O f s : | x � �→ ( − 1) f s ( x ) | x � 19/09/2011 Dagstuhl 5

Bent functions are easy Preparing the “phase state” ◮ Phase oracle O f s : | x � �→ ( − 1) f s ( x ) | x � | 0 � ⊗ n O f s H ⊗ n H ⊗ n | Φ( s ) � 2 ( − 1) s · w ˆ ◮ | Φ( s ) � := � F ( w ) | w � w ∈ Z n 19/09/2011 Dagstuhl 5

Bent functions are easy Preparing the “phase state” ◮ Phase oracle O f s : | x � �→ ( − 1) f s ( x ) | x � | 0 � ⊗ n O f s H ⊗ n H ⊗ n | Φ( s ) � 2 ( − 1) s · w ˆ ◮ | Φ( s ) � := � F ( w ) | w � w ∈ Z n Algorithm [R¨ otteler’10] ◮ Prepare | Φ( s ) � 19/09/2011 Dagstuhl 5

Bent functions are easy Preparing the “phase state” ◮ Phase oracle O f s : | x � �→ ( − 1) f s ( x ) | x � | 0 � ⊗ n O f s H ⊗ n H ⊗ n | Φ( s ) � 2 ( − 1) s · w ˆ ◮ | Φ( s ) � := � F ( w ) | w � w ∈ Z n Algorithm [R¨ otteler’10] ◮ Prepare | Φ( s ) � 2 ( − 1) s · w | ˆ ◮ D | Φ( s ) � = � F ( w ) || w � w ∈ Z n � | ˆ � F ( w ) | where D := diag [Curtis & Meyer’04] ˆ F ( w ) 19/09/2011 Dagstuhl 5

Bent functions are easy Preparing the “phase state” ◮ Phase oracle O f s : | x � �→ ( − 1) f s ( x ) | x � | 0 � ⊗ n O f s H ⊗ n H ⊗ n | Φ( s ) � 2 ( − 1) s · w ˆ ◮ | Φ( s ) � := � F ( w ) | w � w ∈ Z n Algorithm [R¨ otteler’10] ◮ Prepare | Φ( s ) � 2 ( − 1) s · w | ˆ ◮ D | Φ( s ) � = � F ( w ) || w � w ∈ Z n � | ˆ � F ( w ) | where D := diag [Curtis & Meyer’04] ˆ F ( w ) ◮ If f is bent then H ⊗ n D | Φ( s ) � = | s � 19/09/2011 Dagstuhl 5

Bent functions are easy Preparing the “phase state” ◮ Phase oracle O f s : | x � �→ ( − 1) f s ( x ) | x � | 0 � ⊗ n O f s H ⊗ n H ⊗ n | Φ( s ) � 2 ( − 1) s · w ˆ ◮ | Φ( s ) � := � F ( w ) | w � w ∈ Z n Algorithm [R¨ otteler’10] ◮ Prepare | Φ( s ) � 2 ( − 1) s · w | ˆ ◮ D | Φ( s ) � = � F ( w ) || w � w ∈ Z n � | ˆ � F ( w ) | where D := diag [Curtis & Meyer’04] ˆ F ( w ) ◮ If f is bent then H ⊗ n D | Φ( s ) � = | s � ◮ Complexity: Θ(1) 19/09/2011 Dagstuhl 5

All Boolean functions 19/09/2011 Dagstuhl 6

All Boolean functions In total there are 2 2 n Boolean functions with n arguments. For n = 8 this is roughly 10 77 . 19/09/2011 Dagstuhl 6

All Boolean functions In total there are 2 2 n Boolean functions with n arguments. For n = 8 this is roughly 10 77 . ◭ Easy ( bent function ) 19/09/2011 Dagstuhl 6

All Boolean functions In total there are 2 2 n Boolean functions with n arguments. For n = 8 this is roughly 10 77 . ◭ Easy ( bent function ) Hard ( delta function ) ◮ 19/09/2011 Dagstuhl 6

All Boolean functions In total there are 2 2 n Boolean functions with n arguments. For n = 8 this is roughly 10 77 . What about the rest? ◭ Easy ( bent function ) Hard ( delta function ) ◮ 19/09/2011 Dagstuhl 6

All Boolean functions In total there are 2 2 n Boolean functions with n arguments. For n = 8 this is roughly 10 77 . What about the rest? ◭ Easy ( bent function ) Three approaches: 1. Grover-like [Grover’00] / quantum rejection sampling [ORR’11] 2. Pretty good measurement 3. Simon-like [R¨ otteler’10, GRR’11] Hard ( delta function ) ◮ 19/09/2011 Dagstuhl 6

Algorithm 1 : Grover-like / quantum rejection sampling 1 ( − 1) s · w ˆ � � ( − 1) s · w F ( w ) | w � �→ √ 2 n | w � w ∈ Z n w ∈ Z n 2 2 19/09/2011 Dagstuhl 7

Algorithm 1 : Grover-like / quantum rejection sampling 1 ( − 1) s · w ˆ � � ( − 1) s · w F ( w ) | w � �→ √ 2 n | w � w ∈ Z n w ∈ Z n 2 2 ◮ Pick ε ∈ R 2 n such that ∀ w : 0 ≤ ε w ≤ | ˆ F ( w ) | 19/09/2011 Dagstuhl 7

Algorithm 1 : Grover-like / quantum rejection sampling 1 ( − 1) s · w ˆ � � ( − 1) s · w F ( w ) | w � �→ √ 2 n | w � w ∈ Z n w ∈ Z n 2 2 ◮ Pick ε ∈ R 2 n such that ∀ w : 0 ≤ ε w ≤ | ˆ F ( w ) | � » ˆ F ( w ) 2 − ε 2 � 1 ◮ Apply R ε : | w �| 0 � �→ | w � w | 0 � + ε w | 1 � ˆ F ( w ) 19/09/2011 Dagstuhl 7

Algorithm 1 : Grover-like / quantum rejection sampling 1 ( − 1) s · w ˆ � � ( − 1) s · w F ( w ) | w � �→ √ 2 n | w � w ∈ Z n w ∈ Z n 2 2 ◮ Pick ε ∈ R 2 n such that ∀ w : 0 ≤ ε w ≤ | ˆ F ( w ) | � » ˆ F ( w ) 2 − ε 2 � 1 ◮ Apply R ε : | w �| 0 � �→ | w � w | 0 � + ε w | 1 � ˆ F ( w ) ◮ If we would measure the last qubit, we would get outcome “ 1 ” w.p. � ε � 2 2 and the post-measurement state would be 1 ( − 1) s · w ε w | w � � � ε � 2 w ∈ Z n 2 19/09/2011 Dagstuhl 7

Algorithm 1 : Grover-like / quantum rejection sampling 1 ( − 1) s · w ˆ � � ( − 1) s · w F ( w ) | w � �→ √ 2 n | w � w ∈ Z n w ∈ Z n 2 2 ◮ Pick ε ∈ R 2 n such that ∀ w : 0 ≤ ε w ≤ | ˆ F ( w ) | � » ˆ F ( w ) 2 − ε 2 � 1 ◮ Apply R ε : | w �| 0 � �→ | w � w | 0 � + ε w | 1 � ˆ F ( w ) ◮ If we would measure the last qubit, we would get outcome “ 1 ” w.p. � ε � 2 2 and the post-measurement state would be 1 ( − 1) s · w ε w | w � � � ε � 2 w ∈ Z n 2 ◮ Instead of measuring, amplify the amplitude on | 1 � 19/09/2011 Dagstuhl 7

Algorithm 1 : Grover-like / quantum rejection sampling 1 ( − 1) s · w ˆ � � ( − 1) s · w F ( w ) | w � �→ √ 2 n | w � w ∈ Z n w ∈ Z n 2 2 ◮ Pick ε ∈ R 2 n such that ∀ w : 0 ≤ ε w ≤ | ˆ F ( w ) | � » ˆ F ( w ) 2 − ε 2 � 1 ◮ Apply R ε : | w �| 0 � �→ | w � w | 0 � + ε w | 1 � ˆ F ( w ) ◮ If we would measure the last qubit, we would get outcome “ 1 ” w.p. � ε � 2 2 and the post-measurement state would be 1 ( − 1) s · w ε w | w � � � ε � 2 w ∈ Z n 2 ◮ Instead of measuring, amplify the amplitude on | 1 � ◮ Complexity: O (1 / � ε � 2 ) 19/09/2011 Dagstuhl 7