Abstract:The hardness of finding short vectors in ideals of cyclotomic number fields (hereafter, Ideal-SVP) can serve as a worst-case assumption for numerous efficient cryptosystems, via the average-case problems Ring-SIS and Ring-LWE. For a while, it could be assumed the Ideal-SVP problem was as hard as the analog problem for general lattices (SVP), even when considering quantum algorithms.But in the last few years, a series of works has lead to a quantum algorithm for Ideal-SVP that outperforms what can be done for general SVP in certain regimes. More precisely, it was demonstrated (under certain hypotheses) that one can find in quantum polynomial time a vector longer by a factor at most documentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$alpha = exp ({widetilde{O}(n^{1/2})})$$end{document} than the shortest non-zero vector in a cyclotomic ideal lattice, where n is the dimension.In this work, we explore the constants hidden behind this asymptotic claim. While these algorithms have quantum steps, the steps that impact the approximation factor documentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$alpha $$end{document} are entirely classical, which allows us to estimate it experimentally using only classical computing. Moreover, we design heuristic improvements for those steps that significantly decrease the hidden factors in practice. Finally, we derive new provable effective lower bounds based on volumetric arguments.This study allows to predict the crossover point with classical lattice reduction algorithms, and thereby determine the relevance of this quantum algorithm in any cryptanalytic context. For example we predict that this quantum algorithm provides shorter vectors than BKZ-300 (roughly the weakest security level of NIST lattice-based candidates) for cyclotomic rings of rank larger than about 24000.

A spectral resolution of the large sieve

Diagonal cubic forms and the large sieve

On the Spectral Large Sieve Inequality for $\mathrm{PGL}_2 (\mathbb{Z}[i]) \backslash \mathrm{PGL}_2 (\mathbb{C})$

The Quantum Rabi model: Towards Braak's conjecture

Spectra of quadratic vector fields on $\mathbb{C}^2$: The missing relation

On the Symmetric Square Large Sieve for $\mathrm{PSL}_2 (\mathbb{Z} {[i]}) \backslash \mathrm{PSL}_2 (\mathbb{C}) $ and the Prime Geodesic Theorem for $ \mathrm{PSL}_2 (\mathbb{Z} {[i]}) \backslash \mathbb{H}^3 $

Large Sieve Inequalities with Quadratic Amplitudes

First moment of Hecke eigenvalues at the integers represented by binary quadratic forms

On the Shortness of Vectors to Be Found by the Ideal-SVP Quantum Algorithm

Regularity of laws via Dirichlet forms -- Application to quadratic forms in independent and identically distributed random variables

Large $N$ limit and $1/N$ expansion of invariant observables in $O(N)$ linear $σ$-model via SPDE

Numerical Computation of Non-Equilateral Quantum Graph Spectra

An almost sharp quantitative version of the Duffin-Schaeffer conjecture

Spherical higher order Fourier analysis over finite fields I: equidistribution for nilsequences

A large sieve inequality for characters to quadratic moduli

Quantitative Diophantine approximation and Fourier dimension of sets: Dirichlet non-improvable numbers versus well-approximable numbers

Behavior of large eigenvalues for the two-photon asymmetric quantum Rabi model

Spectral invariance and maximality properties of the frequency spectrum of quantum neural networks

Regularity of laws via Dirichlet forms: application to quadratic forms in independent and identically distributed random variables

On q-series and the moment problem associated to local factors