Abstract:One of the main candidates of post-quantum cryptography is lattice-based cryptography. Its cryptographic security against quantum attackers is based on the worst-case hardness of lattice problems like the shortest vector problem (SVP), which asks to find the shortest non-zero vector in an integer lattice. Asymptotic quantum speedups for solving SVP are known and rely on Grover's search. However, to assess the security of lattice-based cryptography against these Grover-like quantum speedups, it is necessary to carry out a precise resource estimation beyond asymptotic scalings. In this work, we perform a careful analysis on the resources required to implement several sieving algorithms aided by Grover's search for dimensions of cryptographic interests. For such, we take into account fixed-point quantum arithmetic operations, non-asymptotic Grover's search, the cost of using quantum random access memory (QRAM), different physical architectures, and quantum error correction. We find that even under very optimistic assumptions like circuit-level noise of $10^{-5}$, code cycles of 100 ns, reaction time of 1 $\mu$s, and using state-of-the-art arithmetic circuits and quantum error-correction protocols, the best sieving algorithms require $\approx 10^{13}$ physical qubits and $\approx 10^{31}$ years to solve SVP on a lattice of dimension 400, which is roughly the dimension for minimally secure post-quantum cryptographic standards currently being proposed by NIST. We estimate that a 6-GHz-clock-rate single-core classical computer would take roughly the same amount of time to solve the same problem. We conclude that there is currently little to no quantum speedup in the dimensions of cryptographic interest and the possibility of realising a considerable quantum speedup using quantum sieving algorithms would require significant breakthroughs in theoretical protocols and hardware development.

Quantum Algorithm for Shortest Vector Problems with Folded Spectrum Method

Analysis of the shortest vector problems with quantum annealing to search the excited states

Analysis of the shortest vector problems with the quantum annealing to search the excited states

Quantum algorithmic solutions to the shortest vector problem on simulated coherent Ising machines

Variational quantum solutions to the Shortest Vector Problem

Two quantum Ising algorithms for the shortest-vector problem

Two quantum Ising algorithms for the Shortest Vector Problem: one for now and one for later

Space-efficient classical and quantum algorithms for the shortest vector problem

Folded Spectrum VQE : A quantum computing method for the calculation of molecular excited states

Not-so-adiabatic quantum computation for the shortest vector problem

Improved Classical and Quantum Algorithms for the Shortest Vector Problem via Bounded Distance Decoding

Grover's oracle for the Shortest Vector Problem and its application in hybrid classical-quantum solvers

Solving the Shortest Vector Problem in Lattices Faster Using Quantum Search

Iterative quantum optimization with an adaptive problem Hamiltonian for the shortest vector problem

Performance analysis of a filtering variational quantum algorithm

On the practicality of quantum sieving algorithms for the shortest vector problem

Space-efficient binary optimization for variational quantum computing

Implementation of spectral methods on Ising machines: toward flow simulations on quantum annealers

Indirect Quantum Approximate Optimization Algorithms: application to the TSP

Larger Sparse Quadratic Assignment Problem Optimization Using Quantum Annealing and a Bit-Flip Heuristic Algorithm

Implementation of spectral methods on Ising machines: toward flow simulations on quantum annealer