Abstract The shortest vector problem (SVP) is one of the lattice problems and is the mathematical basis for lattice-based cryptography, which is expected to be post-quantum cryptography. The SVP can be mapped onto the Ising problem, which in principle can be solved by quantum annealing (QA). However, one issue in solving the SVP using QA is that the solution of the SVP corresponds to the first excited state of the problem Hamiltonian. Therefore, QA, which searches for ground states, cannot provide a solution with high probability. In this paper, we propose to adopt an excited-state search of the QA to solve the shortest vector problem. We numerically show that the excited-state search provides a solution with a higher probability than the ground-state search.
Abstract The shortest vector problem (SVP) is one of the lattice problems and is the mathematical basis for lattice-based cryptography, which is expected to be post-quantum cryptography. The SVP can be mapped onto the Ising problem, which in principle can be solved by quantum annealing (QA). However, one issue in solving the SVP using QA is that the solution of the SVP corresponds to the first excited state of the problem Hamiltonian. Therefore, QA, which searches for ground states, cannot provide a solution with high probability. In this paper, we propose to adopt an excited-state search of the QA to solve the shortest vector problem. We numerically show that the excited-state search provides a solution with a higher probability than the ground-state search.
Quantum annealing has been recently studied to solve the shortest vector problem (SVP), where the norm of a lattice point vector is mapped to the problem Hamiltonian with the qudit encoding, Hamming-weight encoding, or binary encoding, and the problem to find the shortest vector is mapped to a problem to find a non-trivial first excited state. We here propose an alternative encoding and alternative quantum algorithm to solve the SVP: the one-hot encoding and the quantum imaginary-time algorithm with the folded spectrum (FS) method. We demonstrate that our approach is applicable to find the shortest vector with a variational quantum algorithm. The application of the FS method to the quantum annealing and simulated annealing is also discussed to solve the SVP. Our study shows wide potential applicability of the SVP in quantum computing frameworks.
Inspired by quantum annealing, digital annealing computers specified for annealing computations have been realized on a large scale, such as the Digital Annealer (DA) developed by Fujitsu and the CMOS Annealing Machine developed by Hitachi. With the progress achieved using these computers, it has become necessary to estimate the computational hardness of cryptographic problems. This paper focuses on lattice problems, such as the closest vector problem (CVP) and shortest vector problem (SVP), which are a class of optimization problems. These problems form the basis of the security of lattice-based cryptography, which is a prime candidate for the NIST post-quantum cryptography standardization. For these lattice problems, we propose methods for generating an Ising model and solving the Ising model on annealing computers with a bit representation as the input, which represents encodings to map each integer variable in the SVP into binary variables. We propose two methods for SVPs, a basic method and a variant incorporating approximately the concept of the classical lattice enumeration. In our experimental results obtained using the second-generation DA, we succeeded in finding a shortest nonzero lattice vector in 40- and 45-dimensional lattices in the Darmstadt SVP Challenge. The basic method with a hybrid bit representation was the fastest among our methods with a bit representation, and the expected running time was estimated as 664 and 13,750 seconds for the 40- and 45-dimensional lattices, respectively. These results provide a benchmark for solving the SVP with annealing computers.
A fundamental computational problem is to find a shortest non-zero vector in Euclidean lattices, a problem known as the Shortest Vector Problem (SVP). This problem is believed to be hard even on quantum computers and thus plays a pivotal role in post-quantum cryptography. In this work we explore how (efficiently) Noisy Intermediate Scale Quantum (NISQ) devices may be used to solve SVP. Specifically, we map the problem to that of finding the ground state of a suitable Hamiltonian. In particular, (i) we establish new bounds for lattice enumeration, this allows us to obtain new bounds (resp. estimates) for the number of qubits required per dimension for any lattices (resp. random q-ary lattices) to solve SVP; (ii) we exclude the zero vector from the optimization space by proposing (a) a different classical optimisation loop or alternatively (b) a new mapping to the Hamiltonian. These improvements allow us to solve SVP in dimension up to 28 in a quantum emulation, significantly more than what was previously achieved, even for special cases. Finally, we extrapolate the size of NISQ devices that is required to be able to solve instances of lattices that are hard even for the best classical algorithms and find that with approximately 103 noisy qubits such instances can be tackled.
Quantum annealing (QA) is one of the ways to search the ground state of the problem Hamiltonian. Here, we propose the QA scheme to search arbitrary excited states of the problem Hamiltonian. In our scheme, an n-th excited state of the trivial Hamiltonian is initially prepared and is adiabatically changed into an n-th excited state of the target Hamiltonian. Although our scheme is general such that we can search any excited states, we especially discuss the first excited state search in this paper. As a comparison, we consider a non-adiabatic scheme to find the first excited state with non-adiabatic transitions from the ground state. By solving the Lindblad master equation, we evaluate the performance of each scheme under the influence of decoherence. Our conclusion is that the adiabatic scheme show better performance than the non-adiabatic scheme as long as the coherence time of qubits is sufficiently long. These results are important for applications in the area of quantum chemistry, quantum simulation, and post-quantum cryptography.
Lattice-based cryptography has emerged as one of the most prominent candidates for postquantum cryptography, projected to be secure against the imminent threat of large-scale fault-tolerant quantum computers. The Shortest Vector Problem (SVP) is to find the shortest nonzero vector in a given lattice. It is fundamental to lattice-based cryptography and believed to be hard even for quantum computers. We study a natural generalization of the SVP known as the K -Densest Sublattice Problem ( K -DSP): to find the densest K -dimensional sublattice of a given lattice. We formulate K -DSP as finding the first excited state of a Z -basis Hamiltonian, making K -DSP amenable to investigation via an array of quantum algorithms, including Grover search, quantum Gibbs sampling, adiabatic, and variational quantum algorithms. The complexity of the algorithms depends on the basis through which the input lattice is presented. We present a classical polynomial-time algorithm that takes an arbitrary input basis and preprocesses it into inputs suited to quantum algorithms. With preprocessing, we prove that O ( K N 2 ) qubits suffice for solving K -DSP for N -dimensional input lattices. We empirically demonstrate the performance of a quantum approximate optimization algorithm K -DSP solver for low dimensions, highlighting the influence of a good preprocessed input basis. We then discuss the hardness of K -DSP in relation to the SVP, to see if there is a reason to build postquantum cryptography on K -DSP. We devise a quantum algorithm that solves K -DSP with runtime exponent ( 5 K N log 2 N ) / 2 . Therefore, for fixed K , K -DSP is no more than polynomially harder than the SVP. The central insight we use is similar in spirit to those underlying the best-known classical K -DSP algorithm due to Dadush and Micciancio. Whether the exponential dependence on K can be lowered remains an open question. Published by the American Physical Society 2024
We introduce excited local quantum annealing (ExcLQA), a classical, physics-inspired algorithm that extends local quantum annealing (LQA) to identify excited states of classical Ising Hamiltonians. LQA simulates quantum annealing while constraining the quantum state to remain in a product state and uses a gradient-based approach to find approximate solutions to large-scale quadratic unconstrained binary optimization problems. ExcLQA extends this framework by adding a penalty term in the cost function to target excited states, with a single hyperparameter that can be tuned via binary search to set the desired penalization level. We benchmark ExcLQA on fully connected Ising models with random interactions and on the shortest vector problem (SVP). The latter is a fundamental lattice problem underlying the security of many post-quantum cryptographic schemes, and its solution can be mapped to the first excited state of an Ising Hamiltonian. For the fully connected Ising models, we show that, on the tested instances, ExcLQA outperforms both a matrix-product-state-based method and simulated annealing. Notably, even when only a lower bound on the ground-state energy is provided, rather than the exact ground-state information required by these competing methods, ExcLQA still achieves superior performance. For the SVP, ExcLQA finds exact solutions for instances up to rank 46, and outperforms the Metropolis-Hastings algorithm in terms of solved ratio, number of shots, and approximation factor on the tested instances.