Abstract:One of the main candidates of post-quantum cryptography is lattice-based cryptography. Its cryptographic security against quantum attackers is based on the worst-case hardness of lattice problems like the shortest vector problem (SVP), which asks to find the shortest non-zero vector in an integer lattice. Asymptotic quantum speedups for solving SVP are known and rely on Grover's search. However, to assess the security of lattice-based cryptography against these Grover-like quantum speedups, it is necessary to carry out a precise resource estimation beyond asymptotic scalings. In this work, we perform a careful analysis on the resources required to implement several sieving algorithms aided by Grover's search for dimensions of cryptographic interests. For such, we take into account fixed-point quantum arithmetic operations, non-asymptotic Grover's search, the cost of using quantum random access memory (QRAM), different physical architectures, and quantum error correction. We find that even under very optimistic assumptions like circuit-level noise of $10^{-5}$, code cycles of 100 ns, reaction time of 1 $\mu$s, and using state-of-the-art arithmetic circuits and quantum error-correction protocols, the best sieving algorithms require $\approx 10^{13}$ physical qubits and $\approx 10^{31}$ years to solve SVP on a lattice of dimension 400, which is roughly the dimension for minimally secure post-quantum cryptographic standards currently being proposed by NIST. We estimate that a 6-GHz-clock-rate single-core classical computer would take roughly the same amount of time to solve the same problem. We conclude that there is currently little to no quantum speedup in the dimensions of cryptographic interest and the possibility of realising a considerable quantum speedup using quantum sieving algorithms would require significant breakthroughs in theoretical protocols and hardware development.

Time and Query Complexity Tradeoffs for the Dihedral Coset Problem

Minimizing CNOT-count in Quantum Circuit of the Extended Shor’s Algorithm for ECDLP

On the impossibility of a quantum sieve algorithm for graph isomorphism: unconditional results

Learning with Errors and Extrapolated Dihedral Cosets

Robust Quantum Circuit for Clique Problem with Intermediate Qudits

MDL Denoising Revisited

A benchmarking study of quantum algorithms for combinatorial optimization

On the quantum time complexity of divide and conquer

Complexity-Theoretic Limitations on Quantum Algorithms for Topological Data Analysis

The Quantum Approximate Optimization Algorithm performance with low entanglement and high circuit depth

A reduction from LWE problem to dihedral coset problem

Quantum Algorithms for Graph Coloring and other Partitioning, Covering, and Packing Problems

Scaling Up the Quantum Divide and Conquer Algorithm for Combinatorial Optimization

On the practicality of quantum sieving algorithms for the shortest vector problem

Single-Layer Digitized-Counterdiabatic Quantum Optimization for $p$-spin Models

In Quantum Computing Speedup Illusory?: The False Coin of "Counting Function Evaluations"

Quantum Sieving for Code-Based Cryptanalysis and Its Limitations for ISD

A streamlined quantum algorithm for topological data analysis with exponentially fewer qubits

Hidden Translation and Translating Coset in Quantum Computing

Quantum Algorithms for Simon's Problem Over General Groups

An Optimized Quantum Maximum or Minimum Searching Algorithm and its Circuits