Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1703.00263

Quantum Information Set Decoding Algorithms

Ghazal Kachigar, Jean–Pierre Tillich

Published Mar 1, 2017• 11 citations
arXivHTMLPDF

Abstract

The security of code-based cryptosystems such as the McEliece cryptosystem relies primarily on the difficulty of decoding random linear codes. The best decoding algorithms are all improvements of an old algorithm due to Prange: they are known under the name of information set decoding techniques. It is also important to assess the security of such cryptosystems against a quantum computer. This research thread started in Overbeck and Sendrier's 2009 survey on code-based cryptography, and the best algorithm to date has been Bernstein's quantising of the simplest information set decoding algorithm, namely Prange's algorithm. It consists in applying Grover's quantum search to obtain a quadratic speed-up of Prange's algorithm. In this paper, we quantise other information set decoding algorithms by using quantum walk techniques which were devised for the subset-sum problem by Bernstein, Jeffery, Lange and Meurer. This results in improving the worst-case complexity of $2^{0.06035n}$ of Bernstein's algorithm to $2^{0.05869n}$ with the best algorithm presented here (where $n$ is the codelength).

DOI
10.48550/arxiv.1703.00263

Related papers

From Subset-Sum to Decoding: Improved Classical and Quantum Algorithms via Ternary Representation Technique

Yang Li

The subset-sum problem, a foundational NP-hard problem in theoretical computer science, serves as a critical building block for cryptographic constructions. This work introduces novel classical and quantum heuristic algorithms for the random subset-sum problem at density d=1, where exactly one solution is expected. Classically, we propose the first algorithm based on a ternary tree representation structure, inspired by recent advances in lattice-based cryptanalysis. Through numerical optimization, our method achieves a time complexity of 𝒪˜20.2400n and space complexity of 𝒪˜20.2221n, improving upon the previous best classical heuristic result of 𝒪˜20.2830n. In the quantum setting, we develop a corresponding algorithm by integrating the classical ternary representation technique with a quantum walk search framework. The optimized quantum algorithm attains a time and space complexity of 𝒪˜20.1843n, surpassing the prior state-of-the-art quantum heuristic of 𝒪˜20.2182n. Furthermore, we apply our algorithms to information set decoding in code-based cryptography. For half-distance decoding, our classical algorithm improves the time complexity to 𝒪˜20.0453n, surpassing the previous best of 𝒪˜20.0465n. For full-distance decoding, we achieve a quantum complexity of 𝒪˜20.058326n, advancing beyond the prior best quantum result of 𝒪˜20.058696n. These findings demonstrate the broad applicability and efficiency of our ternary representation technique across both classical and quantum computational models.

Information•Oct 12, 2025•0 citations

Improving the Efficiency of Quantum Circuits for Information Set Decoding

Simone Perriello, Alessandro Barenghi, Gerardo Pelosi

Code-based cryptosystems are a promising option for Post-Quantum Cryptography, as neither classical nor quantum algorithms provide polynomial time solvers for their underlying hard problem. Indeed, to provide sound alternatives to lattice-based cryptosystems, U.S. National Institute of Standards and Technology (NIST) advanced all round 3 code-based cryptosystems to round 4 of its Post-Quantum standardization initiative. We present a complete implementation of a quantum circuit based on the Information Set Decoding (ISD) strategy, the best known one against code-based cryptosystems, providing quantitative measures for the security margin achieved with respect to the quantum-accelerated key recovery on AES, targeting both the current state-of-the-art approach and the NIST estimates. Our work improves the state-of-the-art, reducing the circuit depth by 2 19 to 2 30 for all the parameters of the NIST selected cryptosystems, mainly due to an improved quantum Gauss–Jordan elimination circuit with respect to previous proposals. We show how our Prange’s-based quantum ISD circuit reduces the security margin with respect to its classical counterpart. Finally, we address the concern brought forward in the latest NIST report on the parameters choice for the McEliece cryptosystem, showing that its parameter choice yields a computational effort slightly below the required target level.

ACM Transactions on Quantum Computing•Jul 6, 2023•14 citations

Subset Sum Quantumly in 1.17^n

Alexander Helm, A. May

We study the quantum complexity of solving the subset sum problem, where the elements a_1, ..., a_n are randomly chosen from Z_{2^{l(n)}} and t = sum_i a_i in Z_{2^{l(n)}} is a sum of n/2 elements. In 2013, Bernstein, Jeffery, Lange and Meurer constructed a quantum subset sum algorithm with heuristic time complexity 2^{0.241n}, by enhancing the classical subset sum algorithm of Howgrave-Graham and Joux with a quantum random walk technique. We improve on this by defining a quantum random walk for the classical subset sum algorithm of Becker, Coron and Joux. The new algorithm only needs heuristic running time and memory 2^{0.226n}, for almost all random subset sum instances.

Leibniz international proceedings in informatics•Jan 1, 2018•0 citations

The Quantum Decoding Problem

André Chailloux, Jean–Pierre Tillich

One of the founding results of lattice based cryptography is a quantum reduction from the Short Integer Solution problem to the Learning with Errors problem introduced by Regev. It has recently been pointed out by Chen, Liu and Zhandry that this reduction can be made more powerful by replacing the learning with errors problem with a quantum equivalent, where the errors are given in quantum superposition. In the context of codes, this can be adapted to a reduction from finding short codewords to a quantum decoding problem for random linear codes. We therefore consider in this paper the quantum decoding problem, where we are given a superposition of noisy versions of a codeword and we want to recover the corresponding codeword. When we measure the superposition, we get back the usual classical decoding problem for which the best known algorithms are in the constant rate and error-rate regime exponential in the codelength. However, we will show here that when the noise rate is small enough, then the quantum decoding problem can be solved in quantum polynomial time. Moreover, we also show that the problem can in principle be solved quantumly (albeit not efficiently) for noise rates for which the associated classical decoding problem cannot be solved at all for information theoretic reasons. We then revisit Regev's reduction in the context of codes. We show that using our algorithms for the quantum decoding problem in Regev's reduction matches the best known quantum algorithms for the short codeword problem. This shows in some sense the tightness of Regev's reduction when considering the quantum decoding problem and also paves the way for new quantum algorithms for the short codeword problem.

arXiv:2310.20651•Leibniz international proceedings in informatics•Oct 31, 2023•1 citation

Quantum McEliece public-key cryptosystem

Hachiro Fujita

The McEliece cryptosystem is one of the best-known (classical) public-key cryptosystems, which is based on algebraic coding theory. In this paper, we present a quantum analogue of the classical McEliece cryptosystem. Our quantum McEliece public-key cryptosystem is based on the theory of stabilizer codes and has the key generation, encryption and decryption algorithms similar to those in the classical McEliece cryptosystem. We present an explicit construction of the quantum McEliece public-key cryptosystem using Calderbank-Shor-Steane codes based on generalized Reed-Solomon codes. We examine the security of our quantum McEliece cryptosystem and compare it with alternative systems.

Quantum Information and Computation•Mar 1, 2012•17 citations

Improved quantum algorithm for the random subset sum problem

Yang Li, Hongbo Li

Solving random subset sum instances plays an important role in constructing cryptographic systems. For the random subset sum problem, in 2013 Bernstein et al. proposed a quantum algorithm with heuristic time complexity $\widetilde{O}(2^{0.241n})$, where the "$\widetilde{O}$" symbol is used to omit poly($\log n$) factors. In 2018, Helm and May proposed another quantum algorithm that reduces the heuristic time and memory complexity to $\widetilde{O}(2^{0.226n})$. In this paper, a new quantum algorithm is proposed, with heuristic time and memory complexity $\widetilde{O}(2^{0.209n})$.

arXiv:1912.09264•Dec 18, 2019•3 citations
The security of code-based cryptosystems such as the McEliece cryptosystem relies primarily on the difficulty of decoding random linear codes. The best decoding algorithms are all improvements of an old algorithm due to Prange: they are known under the name of information set decoding techniques. It is also important to assess the security of such cryptosystems against a quantum computer. This research thread started in Overbeck and Sendrier's 2009 survey on code-based cryptography, and the best algorithm to date has been Bernstein's quantising of the simplest information set decoding algorithm, namely Prange's algorithm. It consists in applying Grover's quantum search to obtain a quadratic speed-up of Prange's algorithm. In this paper, we quantise other information set decoding algorithms by using quantum walk techniques which were devised for the subset-sum problem by Bernstein, Jeffery, Lange and Meurer. This results in improving the worst-case complexity of 20.06035n2^{0.06035n}20.06035n of Bernstein's algorithm to 20.05869n2^{0.05869n}20.05869n with the best algorithm presented here (where nnn is the codelength).
The subset-sum problem, a foundational NP-hard problem in theoretical computer science, serves as a critical building block for cryptographic constructions. This work introduces novel classical and quantum heuristic algorithms for the random subset-sum problem at density d=1, where exactly one solution is expected. Classically, we propose the first algorithm based on a ternary tree representation structure, inspired by recent advances in lattice-based cryptanalysis. Through numerical optimization, our method achieves a time complexity of 𝒪˜20.2400n and space complexity of 𝒪˜20.2221n, improving upon the previous best classical heuristic result of 𝒪˜20.2830n. In the quantum setting, we develop a corresponding algorithm by integrating the classical ternary representation technique with a quantum walk search framework. The optimized quantum algorithm attains a time and space complexity of 𝒪˜20.1843n, surpassing the prior state-of-the-art quantum heuristic of 𝒪˜20.2182n. Furthermore, we apply our algorithms to information set decoding in code-based cryptography. For half-distance decoding, our classical algorithm improves the time complexity to 𝒪˜20.0453n, surpassing the previous best of 𝒪˜20.0465n. For full-distance decoding, we achieve a quantum complexity of 𝒪˜20.058326n, advancing beyond the prior best quantum result of 𝒪˜20.058696n. These findings demonstrate the broad applicability and efficiency of our ternary representation technique across both classical and quantum computational models.
Code-based cryptosystems are a promising option for Post-Quantum Cryptography, as neither classical nor quantum algorithms provide polynomial time solvers for their underlying hard problem. Indeed, to provide sound alternatives to lattice-based cryptosystems, U.S. National Institute of Standards and Technology (NIST) advanced all round 3 code-based cryptosystems to round 4 of its Post-Quantum standardization initiative. We present a complete implementation of a quantum circuit based on the Information Set Decoding (ISD) strategy, the best known one against code-based cryptosystems, providing quantitative measures for the security margin achieved with respect to the quantum-accelerated key recovery on AES, targeting both the current state-of-the-art approach and the NIST estimates. Our work improves the state-of-the-art, reducing the circuit depth by 2 19 to 2 30 for all the parameters of the NIST selected cryptosystems, mainly due to an improved quantum Gauss–Jordan elimination circuit with respect to previous proposals. We show how our Prange’s-based quantum ISD circuit reduces the security margin with respect to its classical counterpart. Finally, we address the concern brought forward in the latest NIST report on the parameters choice for the McEliece cryptosystem, showing that its parameter choice yields a computational effort slightly below the required target level.
We study the quantum complexity of solving the subset sum problem, where the elements a_1, ..., a_n are randomly chosen from Z_{2^{l(n)}} and t = sum_i a_i in Z_{2^{l(n)}} is a sum of n/2 elements. In 2013, Bernstein, Jeffery, Lange and Meurer constructed a quantum subset sum algorithm with heuristic time complexity 2^{0.241n}, by enhancing the classical subset sum algorithm of Howgrave-Graham and Joux with a quantum random walk technique. We improve on this by defining a quantum random walk for the classical subset sum algorithm of Becker, Coron and Joux. The new algorithm only needs heuristic running time and memory 2^{0.226n}, for almost all random subset sum instances.
One of the founding results of lattice based cryptography is a quantum reduction from the Short Integer Solution problem to the Learning with Errors problem introduced by Regev. It has recently been pointed out by Chen, Liu and Zhandry that this reduction can be made more powerful by replacing the learning with errors problem with a quantum equivalent, where the errors are given in quantum superposition. In the context of codes, this can be adapted to a reduction from finding short codewords to a quantum decoding problem for random linear codes. We therefore consider in this paper the quantum decoding problem, where we are given a superposition of noisy versions of a codeword and we want to recover the corresponding codeword. When we measure the superposition, we get back the usual classical decoding problem for which the best known algorithms are in the constant rate and error-rate regime exponential in the codelength. However, we will show here that when the noise rate is small enough, then the quantum decoding problem can be solved in quantum polynomial time. Moreover, we also show that the problem can in principle be solved quantumly (albeit not efficiently) for noise rates for which the associated classical decoding problem cannot be solved at all for information theoretic reasons. We then revisit Regev's reduction in the context of codes. We show that using our algorithms for the quantum decoding problem in Regev's reduction matches the best known quantum algorithms for the short codeword problem. This shows in some sense the tightness of Regev's reduction when considering the quantum decoding problem and also paves the way for new quantum algorithms for the short codeword problem.
The McEliece cryptosystem is one of the best-known (classical) public-key cryptosystems, which is based on algebraic coding theory. In this paper, we present a quantum analogue of the classical McEliece cryptosystem. Our quantum McEliece public-key cryptosystem is based on the theory of stabilizer codes and has the key generation, encryption and decryption algorithms similar to those in the classical McEliece cryptosystem. We present an explicit construction of the quantum McEliece public-key cryptosystem using Calderbank-Shor-Steane codes based on generalized Reed-Solomon codes. We examine the security of our quantum McEliece cryptosystem and compare it with alternative systems.
Solving random subset sum instances plays an important role in constructing cryptographic systems. For the random subset sum problem, in 2013 Bernstein et al. proposed a quantum algorithm with heuristic time complexity O~(20.241n)\widetilde{O}(2^{0.241n})O(20.241n), where the "O~\widetilde{O}O" symbol is used to omit poly(log⁡n\log nlogn) factors. In 2018, Helm and May proposed another quantum algorithm that reduces the heuristic time and memory complexity to O~(20.226n)\widetilde{O}(2^{0.226n})O(20.226n). In this paper, a new quantum algorithm is proposed, with heuristic time and memory complexity O~(20.209n)\widetilde{O}(2^{0.209n})O(20.209n).