quantum walks daniel j bernstein university of illinois
play

Quantum walks Daniel J. Bernstein University of Illinois at Chicago - PDF document

Nov 30, 2022 •348 likes •2.22k views

1 Quantum walks Daniel J. Bernstein University of Illinois at Chicago Focusing on quantum walks as an algorithm-design tool: e.g. Grovers algorithm. e.g. Ambainiss algorithm. Can also study quantum walks on much more general graphs.

  1. 7 Normalized graph of q �→ a q for an example with n = 12 after 60 × (Step 1 + Step 2): 1.0 0.5 0.0 −0.5 −1.0

  2. 7 Normalized graph of q �→ a q for an example with n = 12 after 70 × (Step 1 + Step 2): 1.0 0.5 0.0 −0.5 −1.0

  3. 7 Normalized graph of q �→ a q for an example with n = 12 after 80 × (Step 1 + Step 2): 1.0 0.5 0.0 −0.5 −1.0

  4. 7 Normalized graph of q �→ a q for an example with n = 12 after 90 × (Step 1 + Step 2): 1.0 0.5 0.0 −0.5 −1.0

  5. 7 Normalized graph of q �→ a q for an example with n = 12 after 100 × (Step 1 + Step 2): 1.0 0.5 0.0 −0.5 −1.0 Very bad stopping point.

  6. 8 q �→ a q is completely described by a vector of two numbers (with fixed multiplicities): (1) a q for roots q ; (2) a q for non-roots q .

  7. 8 q �→ a q is completely described by a vector of two numbers (with fixed multiplicities): (1) a q for roots q ; (2) a q for non-roots q . Step 1 + Step 2 act linearly on this vector.

  8. 8 q �→ a q is completely described by a vector of two numbers (with fixed multiplicities): (1) a q for roots q ; (2) a q for non-roots q . Step 1 + Step 2 act linearly on this vector. Easily compute eigenvalues and powers of this linear map to understand evolution of state of Grover’s algorithm. ⇒ Probability is ≈ 1 after ≈ ( ı= 4)2 n= 2 iterations.

  9. 9 Ambainis’s algorithm Unique-collision-finding problem: Say f has n -bit inputs, exactly one collision { p; q } : i.e., p � = q , f ( p ) = f ( q ). Problem: find this collision.

  10. 9 Ambainis’s algorithm Unique-collision-finding problem: Say f has n -bit inputs, exactly one collision { p; q } : i.e., p � = q , f ( p ) = f ( q ). Problem: find this collision. Cost 2 n : Define S as the set of n -bit strings. Compute f ( S ), sort.

  11. 9 Ambainis’s algorithm Unique-collision-finding problem: Say f has n -bit inputs, exactly one collision { p; q } : i.e., p � = q , f ( p ) = f ( q ). Problem: find this collision. Cost 2 n : Define S as the set of n -bit strings. Compute f ( S ), sort. Generalize to cost r , success probability ≈ ( r= 2 n ) 2 : Choose a set S of size r . Compute f ( S ), sort.

  12. 10 Data structure D ( S ) capturing the generalized computation: the set S ; the multiset f ( S ); the number of collisions in S .

  13. 10 Data structure D ( S ) capturing the generalized computation: the set S ; the multiset f ( S ); the number of collisions in S . Very efficient to move from D ( S ) to D ( T ) if T is an adjacent set: # S = # T = r , #( S ∩ T ) = r − 1.

  14. 10 Data structure D ( S ) capturing the generalized computation: the set S ; the multiset f ( S ); the number of collisions in S . Very efficient to move from D ( S ) to D ( T ) if T is an adjacent set: # S = # T = r , #( S ∩ T ) = r − 1. 2003 Ambainis, simplified 2007 Magniez–Nayak–Roland–Santha: Create superposition of states ( D ( S ) ; D ( T )) with adjacent S; T . By a quantum walk find S containing a collision.

  15. 11 How the quantum walk works: Start from uniform superposition. Repeat ≈ 0 : 6 · 2 n =r times: Negate a S;T if S contains collision. Repeat ≈ 0 : 7 · √ r times: For each T : Diffuse a S;T across all S . For each S : Diffuse a S;T across all T . Now high probability that T contains collision. Cost r + 2 n = √ r . Optimize: 2 2 n= 3 .

  16. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 0 negations and 0 diffusions: Pr[class (0 ; 0)] ≈ 0 : 938; + Pr[class (0 ; 1)] ≈ 0 : 000; + Pr[class (1 ; 0)] ≈ 0 : 000; + Pr[class (1 ; 1)] ≈ 0 : 060; + Pr[class (1 ; 2)] ≈ 0 : 000; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 001; + Right column is sign of a S;T .

  17. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 1 negation and 46 diffusions: Pr[class (0 ; 0)] ≈ 0 : 935; + Pr[class (0 ; 1)] ≈ 0 : 000; + Pr[class (1 ; 0)] ≈ 0 : 000; − Pr[class (1 ; 1)] ≈ 0 : 057; + Pr[class (1 ; 2)] ≈ 0 : 000; + Pr[class (2 ; 1)] ≈ 0 : 000; − Pr[class (2 ; 2)] ≈ 0 : 008; + Right column is sign of a S;T .

  18. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 2 negations and 92 diffusions: Pr[class (0 ; 0)] ≈ 0 : 918; + Pr[class (0 ; 1)] ≈ 0 : 001; + Pr[class (1 ; 0)] ≈ 0 : 000; − Pr[class (1 ; 1)] ≈ 0 : 059; + Pr[class (1 ; 2)] ≈ 0 : 001; + Pr[class (2 ; 1)] ≈ 0 : 000; − Pr[class (2 ; 2)] ≈ 0 : 022; + Right column is sign of a S;T .

  19. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 3 negations and 138 diffusions: Pr[class (0 ; 0)] ≈ 0 : 897; + Pr[class (0 ; 1)] ≈ 0 : 001; + Pr[class (1 ; 0)] ≈ 0 : 000; − Pr[class (1 ; 1)] ≈ 0 : 058; + Pr[class (1 ; 2)] ≈ 0 : 002; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 042; + Right column is sign of a S;T .

  20. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 4 negations and 184 diffusions: Pr[class (0 ; 0)] ≈ 0 : 873; + Pr[class (0 ; 1)] ≈ 0 : 001; + Pr[class (1 ; 0)] ≈ 0 : 000; − Pr[class (1 ; 1)] ≈ 0 : 054; + Pr[class (1 ; 2)] ≈ 0 : 002; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 070; + Right column is sign of a S;T .

  21. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 5 negations and 230 diffusions: Pr[class (0 ; 0)] ≈ 0 : 838; + Pr[class (0 ; 1)] ≈ 0 : 001; + Pr[class (1 ; 0)] ≈ 0 : 001; − Pr[class (1 ; 1)] ≈ 0 : 054; + Pr[class (1 ; 2)] ≈ 0 : 003; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 104; + Right column is sign of a S;T .

  22. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 6 negations and 276 diffusions: Pr[class (0 ; 0)] ≈ 0 : 800; + Pr[class (0 ; 1)] ≈ 0 : 001; + Pr[class (1 ; 0)] ≈ 0 : 001; − Pr[class (1 ; 1)] ≈ 0 : 051; + Pr[class (1 ; 2)] ≈ 0 : 006; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 141; + Right column is sign of a S;T .

  23. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 7 negations and 322 diffusions: Pr[class (0 ; 0)] ≈ 0 : 758; + Pr[class (0 ; 1)] ≈ 0 : 002; + Pr[class (1 ; 0)] ≈ 0 : 001; − Pr[class (1 ; 1)] ≈ 0 : 047; + Pr[class (1 ; 2)] ≈ 0 : 007; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 184; + Right column is sign of a S;T .

  24. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 8 negations and 368 diffusions: Pr[class (0 ; 0)] ≈ 0 : 708; + Pr[class (0 ; 1)] ≈ 0 : 003; + Pr[class (1 ; 0)] ≈ 0 : 001; − Pr[class (1 ; 1)] ≈ 0 : 046; + Pr[class (1 ; 2)] ≈ 0 : 007; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 234; + Right column is sign of a S;T .

  25. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 9 negations and 414 diffusions: Pr[class (0 ; 0)] ≈ 0 : 658; + Pr[class (0 ; 1)] ≈ 0 : 003; + Pr[class (1 ; 0)] ≈ 0 : 001; − Pr[class (1 ; 1)] ≈ 0 : 042; + Pr[class (1 ; 2)] ≈ 0 : 009; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 287; + Right column is sign of a S;T .

  26. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 10 negations and 460 diffusions: Pr[class (0 ; 0)] ≈ 0 : 606; + Pr[class (0 ; 1)] ≈ 0 : 003; + Pr[class (1 ; 0)] ≈ 0 : 002; − Pr[class (1 ; 1)] ≈ 0 : 037; + Pr[class (1 ; 2)] ≈ 0 : 013; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 338; + Right column is sign of a S;T .

  27. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 11 negations and 506 diffusions: Pr[class (0 ; 0)] ≈ 0 : 547; + Pr[class (0 ; 1)] ≈ 0 : 004; + Pr[class (1 ; 0)] ≈ 0 : 003; − Pr[class (1 ; 1)] ≈ 0 : 036; + Pr[class (1 ; 2)] ≈ 0 : 015; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 394; + Right column is sign of a S;T .

  28. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 12 negations and 552 diffusions: Pr[class (0 ; 0)] ≈ 0 : 491; + Pr[class (0 ; 1)] ≈ 0 : 004; + Pr[class (1 ; 0)] ≈ 0 : 003; − Pr[class (1 ; 1)] ≈ 0 : 032; + Pr[class (1 ; 2)] ≈ 0 : 014; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 455; + Right column is sign of a S;T .

  29. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 13 negations and 598 diffusions: Pr[class (0 ; 0)] ≈ 0 : 436; + Pr[class (0 ; 1)] ≈ 0 : 005; + Pr[class (1 ; 0)] ≈ 0 : 003; − Pr[class (1 ; 1)] ≈ 0 : 026; + Pr[class (1 ; 2)] ≈ 0 : 017; + Pr[class (2 ; 1)] ≈ 0 : 000; + Pr[class (2 ; 2)] ≈ 0 : 513; + Right column is sign of a S;T .

  30. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 14 negations and 644 diffusions: Pr[class (0 ; 0)] ≈ 0 : 377; + Pr[class (0 ; 1)] ≈ 0 : 006; + Pr[class (1 ; 0)] ≈ 0 : 004; − Pr[class (1 ; 1)] ≈ 0 : 025; + Pr[class (1 ; 2)] ≈ 0 : 022; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 566; + Right column is sign of a S;T .

  31. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 15 negations and 690 diffusions: Pr[class (0 ; 0)] ≈ 0 : 322; + Pr[class (0 ; 1)] ≈ 0 : 005; + Pr[class (1 ; 0)] ≈ 0 : 004; − Pr[class (1 ; 1)] ≈ 0 : 021; + Pr[class (1 ; 2)] ≈ 0 : 023; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 623; + Right column is sign of a S;T .

  32. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 16 negations and 736 diffusions: Pr[class (0 ; 0)] ≈ 0 : 270; + Pr[class (0 ; 1)] ≈ 0 : 006; + Pr[class (1 ; 0)] ≈ 0 : 005; − Pr[class (1 ; 1)] ≈ 0 : 017; + Pr[class (1 ; 2)] ≈ 0 : 022; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 680; + Right column is sign of a S;T .

  33. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 17 negations and 782 diffusions: Pr[class (0 ; 0)] ≈ 0 : 218; + Pr[class (0 ; 1)] ≈ 0 : 007; + Pr[class (1 ; 0)] ≈ 0 : 005; − Pr[class (1 ; 1)] ≈ 0 : 015; + Pr[class (1 ; 2)] ≈ 0 : 024; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 730; + Right column is sign of a S;T .

  34. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 18 negations and 828 diffusions: Pr[class (0 ; 0)] ≈ 0 : 172; + Pr[class (0 ; 1)] ≈ 0 : 006; + Pr[class (1 ; 0)] ≈ 0 : 005; − Pr[class (1 ; 1)] ≈ 0 : 011; + Pr[class (1 ; 2)] ≈ 0 : 029; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 775; + Right column is sign of a S;T .

  35. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 19 negations and 874 diffusions: Pr[class (0 ; 0)] ≈ 0 : 131; + Pr[class (0 ; 1)] ≈ 0 : 007; + Pr[class (1 ; 0)] ≈ 0 : 006; − Pr[class (1 ; 1)] ≈ 0 : 008; + Pr[class (1 ; 2)] ≈ 0 : 030; + Pr[class (2 ; 1)] ≈ 0 : 002; + Pr[class (2 ; 2)] ≈ 0 : 816; + Right column is sign of a S;T .

  36. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 20 negations and 920 diffusions: Pr[class (0 ; 0)] ≈ 0 : 093; + Pr[class (0 ; 1)] ≈ 0 : 007; + Pr[class (1 ; 0)] ≈ 0 : 007; − Pr[class (1 ; 1)] ≈ 0 : 007; + Pr[class (1 ; 2)] ≈ 0 : 027; + Pr[class (2 ; 1)] ≈ 0 : 002; + Pr[class (2 ; 2)] ≈ 0 : 857; + Right column is sign of a S;T .

  37. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 21 negations and 966 diffusions: Pr[class (0 ; 0)] ≈ 0 : 062; + Pr[class (0 ; 1)] ≈ 0 : 007; + Pr[class (1 ; 0)] ≈ 0 : 006; − Pr[class (1 ; 1)] ≈ 0 : 004; + Pr[class (1 ; 2)] ≈ 0 : 030; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 890; + Right column is sign of a S;T .

  38. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 22 negations and 1012 diffusions: Pr[class (0 ; 0)] ≈ 0 : 037; + Pr[class (0 ; 1)] ≈ 0 : 008; + Pr[class (1 ; 0)] ≈ 0 : 007; − Pr[class (1 ; 1)] ≈ 0 : 002; + Pr[class (1 ; 2)] ≈ 0 : 034; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 910; + Right column is sign of a S;T .

  39. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 23 negations and 1058 diffusions: Pr[class (0 ; 0)] ≈ 0 : 017; + Pr[class (0 ; 1)] ≈ 0 : 008; + Pr[class (1 ; 0)] ≈ 0 : 007; − Pr[class (1 ; 1)] ≈ 0 : 002; + Pr[class (1 ; 2)] ≈ 0 : 034; + Pr[class (2 ; 1)] ≈ 0 : 002; + Pr[class (2 ; 2)] ≈ 0 : 930; + Right column is sign of a S;T .

  40. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 24 negations and 1104 diffusions: Pr[class (0 ; 0)] ≈ 0 : 005; + Pr[class (0 ; 1)] ≈ 0 : 007; + Pr[class (1 ; 0)] ≈ 0 : 007; − Pr[class (1 ; 1)] ≈ 0 : 000; + Pr[class (1 ; 2)] ≈ 0 : 030; + Pr[class (2 ; 1)] ≈ 0 : 002; + Pr[class (2 ; 2)] ≈ 0 : 948; + Right column is sign of a S;T .

  41. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 25 negations and 1150 diffusions: Pr[class (0 ; 0)] ≈ 0 : 000; + Pr[class (0 ; 1)] ≈ 0 : 008; + Pr[class (1 ; 0)] ≈ 0 : 008; − Pr[class (1 ; 1)] ≈ 0 : 000; + Pr[class (1 ; 2)] ≈ 0 : 031; + Pr[class (2 ; 1)] ≈ 0 : 001; + Pr[class (2 ; 2)] ≈ 0 : 952; + Right column is sign of a S;T .

  42. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 26 negations and 1196 diffusions: Pr[class (0 ; 0)] ≈ 0 : 002; − Pr[class (0 ; 1)] ≈ 0 : 008; + Pr[class (1 ; 0)] ≈ 0 : 008; − Pr[class (1 ; 1)] ≈ 0 : 000; − Pr[class (1 ; 2)] ≈ 0 : 035; + Pr[class (2 ; 1)] ≈ 0 : 002; + Pr[class (2 ; 2)] ≈ 0 : 945; + Right column is sign of a S;T .

  43. 12 Classify ( S; T ) according to (#( S ∩ { p; q } ) ; #( T ∩ { p; q } )); reduce a to low-dim vector. Analyze evolution of this vector. e.g. n = 15, r = 1024, after 27 negations and 1242 diffusions: Pr[class (0 ; 0)] ≈ 0 : 011; − Pr[class (0 ; 1)] ≈ 0 : 007; + Pr[class (1 ; 0)] ≈ 0 : 007; − Pr[class (1 ; 1)] ≈ 0 : 001; − Pr[class (1 ; 2)] ≈ 0 : 034; + Pr[class (2 ; 1)] ≈ 0 : 003; + Pr[class (2 ; 2)] ≈ 0 : 938; + Right column is sign of a S;T .

  44. 13 Data structures Moving from D ( S ) to D ( T ): dominated by O (1) evaluations of f if f is extremely slow. But usually f is not so slow.

  45. 13 Data structures Moving from D ( S ) to D ( T ): dominated by O (1) evaluations of f if f is extremely slow. But usually f is not so slow. Store set S and multiset f ( S ) in, e.g., hash tables?

  46. 13 Data structures Moving from D ( S ) to D ( T ): dominated by O (1) evaluations of f if f is extremely slow. But usually f is not so slow. Store set S and multiset f ( S ) in, e.g., hash tables? Minor problem: time to hash S is huge for some sets S .

  47. 13 Data structures Moving from D ( S ) to D ( T ): dominated by O (1) evaluations of f if f is extremely slow. But usually f is not so slow. Store set S and multiset f ( S ) in, e.g., hash tables? Minor problem: time to hash S is huge for some sets S . Fix: randomize hash function (1979 Carter–Wegman), and specify big enough time for whole algorithm to be reliable.

  48. 14 Major problem: hash table depends on history, not just on S . Algorithm fails horribly. Need history-independent D ( S ).

  49. 14 Major problem: hash table depends on history, not just on S . Algorithm fails horribly. Need history-independent D ( S ). 2003 Ambainis: “combination of a hash table and a skip list”. Several pages of analysis.

  50. 14 Major problem: hash table depends on history, not just on S . Algorithm fails horribly. Need history-independent D ( S ). 2003 Ambainis: “combination of a hash table and a skip list”. Several pages of analysis. 2013 Bernstein–Jeffery–Lange– Meurer: radix tree. Simplest radix tree: Left subtree stores { x : (0 ; x ) ∈ S } if nonempty. Right subtree stores { x : (1 ; x ) ∈ S } if nonempty.

  51. 15 Caveats The 2 2 n= 3 analysis assumes cheap random access to memory. Justified by simplicity, not realism.

Recommend

What do quantum computers do? Daniel J. Bernstein University of Illinois at Chicago Quantum

What do quantum computers do? Daniel J. Bernstein University of Illinois at Chicago Quantum

1 What do quantum computers do? Daniel J. Bernstein University of Illinois at Chicago Quantum algorithm means an algorithm that a quantum computer can run. i.e. a sequence of instructions, where each instruction is in a quantum

892 views • 76 slides
Quantum algorithms Daniel J. Bernstein University of Illinois at Chicago Quantum algorithm

Quantum algorithms Daniel J. Bernstein University of Illinois at Chicago Quantum algorithm

1 Quantum algorithms Daniel J. Bernstein University of Illinois at Chicago Quantum algorithm means an algorithm that a quantum computer can run. i.e. a sequence of instructions, where each instruction is in a quantum computers

1.42k views • 138 slides
Post-quantum cryptography Daniel J. Bernstein University of Illinois at Chicago; Ruhr University

Post-quantum cryptography Daniel J. Bernstein University of Illinois at Chicago; Ruhr University

Post-quantum cryptography Daniel J. Bernstein University of Illinois at Chicago; Ruhr University Bochum Wikipedia: Hoover became a controversial figure as evidence of his secretive abuses of power began to surface. He was found to have

1.21k views • 103 slides
Post-quantum cryptography Daniel J. Bernstein & Tanja Lange University of Illinois at

Post-quantum cryptography Daniel J. Bernstein & Tanja Lange University of Illinois at

Post-quantum cryptography Daniel J. Bernstein & Tanja Lange University of Illinois at Chicago; Ruhr University Bochum & Technische Universiteit Eindhoven 12 September 2020 Cryptography Sender Receiver Alice Bob Tsai

760 views • 48 slides
Post-quantum cryptography Daniel J. Bernstein & Tanja Lange University of Illinois at Chicago

Post-quantum cryptography Daniel J. Bernstein & Tanja Lange University of Illinois at Chicago

Post-quantum cryptography Daniel J. Bernstein & Tanja Lange University of Illinois at Chicago & Ruhr University Bochum & Technische Universiteit Eindhoven 10 June 2019 Cryptography Motivation #1: Communication channels are spying

1.17k views • 91 slides
The year in post-quantum crypto Daniel J. Bernstein, Tanja Lange University of Illinois at

The year in post-quantum crypto Daniel J. Bernstein, Tanja Lange University of Illinois at

The year in post-quantum crypto Daniel J. Bernstein, Tanja Lange University of Illinois at Chicago, Eindhoven University of Technology Post-quantum cryptography: Cryptography designed under the assumption that the attacker (not the user!) has

1.29k views • 94 slides
The post-quantum Internet Daniel J. Bernstein University of Illinois at Chicago & Technische

The post-quantum Internet Daniel J. Bernstein University of Illinois at Chicago & Technische

1 The post-quantum Internet Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Includes joint work with: Tanja Lange Technische Universiteit Eindhoven 2 Risk management Combining

988 views • 70 slides
The post-quantum Internet Daniel J. Bernstein University of Illinois at Chicago & Technische

The post-quantum Internet Daniel J. Bernstein University of Illinois at Chicago & Technische

1 The post-quantum Internet Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Includes joint work with: Tanja Lange Technische Universiteit Eindhoven 2 IP: Internet Protocol IP communicates

526 views • 38 slides
The post-quantum Internet Risk management Daniel J. Bernstein Combining congruences:

The post-quantum Internet Risk management Daniel J. Bernstein Combining congruences:

1 2 The post-quantum Internet Risk management Daniel J. Bernstein Combining congruences: state-of-the-art pre-quantum University of Illinois at Chicago & attack against original DH, Technische Universiteit Eindhoven RSA, and some

2.34k views • 171 slides
Short generators without quantum computers: the case of multiquadratics Daniel J. Bernstein

Short generators without quantum computers: the case of multiquadratics Daniel J. Bernstein

Short generators without quantum computers: the case of multiquadratics Daniel J. Bernstein University of Illinois at Chicago 31 July 2017 https://multiquad.cr.yp.to Joint work with: Jens Bauch & Henry de Valence & Tanja Lange &

553 views • 41 slides
You thought your communication was secure? Quantum computers are coming! Daniel J. Bernstein 1 , 2

You thought your communication was secure? Quantum computers are coming! Daniel J. Bernstein 1 , 2

You thought your communication was secure? Quantum computers are coming! Daniel J. Bernstein 1 , 2 Tanja Lange 1 1 Technische Universiteit Eindhoven 2 University of Illinois at Chicago 16 April 2016 1 / 33 Cryptography Motivation

1.01k views • 57 slides
PQCHacks: a gentle introduction to post-quantum cryptography Daniel J. Bernstein 1 , 2 Tanja Lange

PQCHacks: a gentle introduction to post-quantum cryptography Daniel J. Bernstein 1 , 2 Tanja Lange

PQCHacks: a gentle introduction to post-quantum cryptography Daniel J. Bernstein 1 , 2 Tanja Lange 1 1 Technische Universiteit Eindhoven 2 University of Illinois at Chicago 27 December 2015 D-Wave quantum computer isnt universal . . .

789 views • 65 slides
The post-quantum Internet IP: Internet Protocol Daniel J. Bernstein IP communicates

The post-quantum Internet IP: Internet Protocol Daniel J. Bernstein IP communicates

1 2 The post-quantum Internet IP: Internet Protocol Daniel J. Bernstein IP communicates packets: limited-length byte strings. University of Illinois at Chicago & Technische Universiteit Eindhoven Each computer on the Internet has

1.36k views • 97 slides
Trapdoor simulation of quantum algorithms Daniel J. Bernstein University of Illinois at Chicago

Trapdoor simulation of quantum algorithms Daniel J. Bernstein University of Illinois at Chicago

Trapdoor simulation of quantum algorithms Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Joint work with: Tung Chou Technische Universiteit Eindhoven Algorithms in CS courses WHAT is your

598 views • 38 slides
Quantum computers: the future attack that breaks todays messages Daniel J. Bernstein &

Quantum computers: the future attack that breaks todays messages Daniel J. Bernstein &

Quantum computers: the future attack that breaks todays messages Daniel J. Bernstein & Tanja Lange University of Illinois at Chicago & Technische Universiteit Eindhoven 14 December 2018 Cryptography Motivation #1:

950 views • 78 slides
Cost-benefit analysis of quantum cryptography D. J. Bernstein University of Illinois at Chicago

Cost-benefit analysis of quantum cryptography D. J. Bernstein University of Illinois at Chicago

Cost-benefit analysis of quantum cryptography D. J. Bernstein University of Illinois at Chicago NSF ITR0716498 2004 PatersonPiperSchack: Why quantum cryptography? 2007 All eaume et al.: SECOQC white paper on quantum key

561 views • 37 slides
Quantum circuits for the CSIDH: optimizing quantum evaluation of isogenies Daniel J. Bernstein

Quantum circuits for the CSIDH: optimizing quantum evaluation of isogenies Daniel J. Bernstein

Quantum circuits for the CSIDH: optimizing quantum evaluation of isogenies Daniel J. Bernstein Tanja Lange Chloe Martindale Lorenz Panny quantum.isogeny.org Key bits where all known attacks take 2 operations (naive serial attack metric,

412 views • 16 slides
The libpqcrypto software library for post-quantum cryptography Daniel J. Bernstein and many

The libpqcrypto software library for post-quantum cryptography Daniel J. Bernstein and many

The libpqcrypto software library for post-quantum cryptography Daniel J. Bernstein and many contributors libpqcrypto.org Daniel J. Bernstein Context libpqcrypto.org Daniel J. Bernstein Redesigning crypto for security New requirements for

541 views • 51 slides
Randomness Daniel J. Bernstein University of Illinois at Chicago Technische Universiteit

Randomness Daniel J. Bernstein University of Illinois at Chicago Technische Universiteit

Randomness Daniel J. Bernstein University of Illinois at Chicago Technische Universiteit Eindhoven Tanja Lange Technische Universiteit Eindhoven Preliminary analysis of some submissions to snakeoil.cr.yp.to Daniel J. Bernstein University

363 views • 32 slides
Boring crypto Daniel J. Bernstein University of Illinois at Chicago & Technische

Boring crypto Daniel J. Bernstein University of Illinois at Chicago & Technische

Boring crypto Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Ancient Chinese curse: May you live in interesting times, so that you have many papers to write. Related mailing list:

871 views • 57 slides
The death of optimizing compilers Daniel J. Bernstein University of Illinois at Chicago &

The death of optimizing compilers Daniel J. Bernstein University of Illinois at Chicago &

The death of optimizing compilers Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Programmers waste enormous amounts of time thinking about, or worrying about, the speed of noncritical parts of

1.16k views • 115 slides
Thomas Jefferson and Apple versus the FBI Daniel J. Bernstein University of Illinois at Chicago

Thomas Jefferson and Apple versus the FBI Daniel J. Bernstein University of Illinois at Chicago

Thomas Jefferson and Apple versus the FBI Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Thomas Jefferson and Apple versus the FBI Daniel J. Bernstein 1919 The Womens Christian Temperance Union

552 views • 29 slides
Quantum algorithms for the subset-sum problem D. J. Bernstein University of Illinois at Chicago

Quantum algorithms for the subset-sum problem D. J. Bernstein University of Illinois at Chicago

Quantum algorithms for the subset-sum problem D. J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven cr.yp.to/qsubsetsum.html Joint work with: Stacey Jeffery University of Waterloo Tanja Lange Technische

1.2k views • 98 slides
Standardization for the black hat Daniel J. Bernstein University of Illinois at Chicago &

Standardization for the black hat Daniel J. Bernstein University of Illinois at Chicago &

1 Standardization for the black hat Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven 1 bada55.cr.yp.to BADA55 Crypto including How to manipulate curve standards: a white paper for the

879 views • 45 slides

More recommend