Abstract:The hardness of finding short vectors in ideals of cyclotomic number fields (hereafter, Ideal-SVP) can serve as a worst-case assumption for numerous efficient cryptosystems, via the average-case problems Ring-SIS and Ring-LWE. For a while, it could be assumed the Ideal-SVP problem was as hard as the analog problem for general lattices (SVP), even when considering quantum algorithms.But in the last few years, a series of works has lead to a quantum algorithm for Ideal-SVP that outperforms what can be done for general SVP in certain regimes. More precisely, it was demonstrated (under certain hypotheses) that one can find in quantum polynomial time a vector longer by a factor at most documentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$alpha = exp ({widetilde{O}(n^{1/2})})$$end{document} than the shortest non-zero vector in a cyclotomic ideal lattice, where n is the dimension.In this work, we explore the constants hidden behind this asymptotic claim. While these algorithms have quantum steps, the steps that impact the approximation factor documentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$alpha $$end{document} are entirely classical, which allows us to estimate it experimentally using only classical computing. Moreover, we design heuristic improvements for those steps that significantly decrease the hidden factors in practice. Finally, we derive new provable effective lower bounds based on volumetric arguments.This study allows to predict the crossover point with classical lattice reduction algorithms, and thereby determine the relevance of this quantum algorithm in any cryptanalytic context. For example we predict that this quantum algorithm provides shorter vectors than BKZ-300 (roughly the weakest security level of NIST lattice-based candidates) for cyclotomic rings of rank larger than about 24000.

Variational Quantum Attacks Threaten Advanced Encryption Standard Based Symmetric Cryptography

Hacking Cryptographic Protocols with Advanced Variational Quantum Attacks

Quantum-enhanced symmetric cryptanalysis for S-AES

Quantum attacks on some feistel block ciphers

Evolution of an Emerging Symmetric Quantum Cryptographic Algorithm

Quantum Differential and Linear Cryptanalysis

A quantum circuit design of AES

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

Quantum Attacks on 1K-AES and PRINCE

On the Shortness of Vectors to Be Found by the Ideal-SVP Quantum Algorithm

Development of Cybersecurity Technology and Algorithm Based on Quantum Computing

Performance Comparison of Various Modes of Advanced Encryption Standard

Variational quantum algorithms

A quantum encryption design featuring confusion, diffusion, and mode of operation

Quantum Advantage in Cryptography

Information scrambling and entanglement in quantum approximate optimization algorithm circuits

Optimized Quantum Circuit of AES With Interlacing-Uncompute Structure

Computational Security of Quantum Encryption

Universal Hamming Weight Preserving Variational Quantum Ansatz

Symmetry-preserved cost functions for variational quantum eigensolver