Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

On Quantum Sieve Approaches to the Lattice Shortest Vector Problem

Daniel Epelbaum

Published Jan 1, 2014• 0 citations
OpenAlex

Abstract

The lattice hortest vector problem, or lattice SVP, has gained a lot of attention in the field of quantum computing. There are a number of reasons for this, including the fact that the hardness of lattice SVP is the foudation of a number of post-quantum cryptosystems and that approximate-SVP is in NP ∩ coNP, so it is a prime target to use in searching for exponential speedups over classical algorithms [5, 7, 4].

Related papers

Finding shortest lattice vectors faster using quantum search

Thijs Laarhoven, Michele Mosca, Joop van de Pol

Abstract By applying a quantum search algorithm to various heuristic and provable sieve algorithms from the literature, we obtain improved asymptotic quantum results for solving the shortest vector problem on lattices. With quantum computers we can provably find a shortest vector in time 21.799n+o(n), improving upon the classical time complexities of 22.465n+o(n) of Pujol and Stehle ́ and the 22n+o(n) of Micciancio and Voulgaris, while heuristically we expect to find a shortest vector in time 20.286n+o(n), improving upon the classical time complexity of 20.337n+o(n) of Laarhoven. These quantum complexities will be an important guide for the selection of parameters for post-quantum cryptosystems based on the hardness of the shortest vector problem. Keywords lattices · shortest vector problem · sieving · quantum search 1

•Jan 1, 2014•1 citation

Grover's Oracle for the Shortest Vector Problem and Its Application in Hybrid Classical–Quantum Solvers

Miloš Prokop, Petros Wallden, David Joseph

Finding the shortest vector in a lattice is a problem that is believed to be hard both for classical and quantum computers. Many major postquantum secure cryptosystems base their security on the hardness of the shortest vector problem (SVP) (Moody, 2023). Finding the best classical, quantum, or hybrid classical–quantum algorithms for the SVP is necessary to select cryptosystem parameters that offer a sufficient level of security. Grover's search quantum algorithm provides a generic quadratic speedup, given access to an oracle implementing some function, which describes when a solution is found. In this article, we provide concrete implementation of such an oracle for the SVP. We define the circuit and evaluate costs in terms of the number of qubits, the number of gates, depth, and T-quantum cost. We then analyze how to combine Grover's quantum search for small SVP instances with state-of-the-art classical solvers that use well-known algorithms, such as the block Korkine Zolotorev (Schnorr and Euchner, 1994), where the former is used as a subroutine. This could enable solving larger instances of SVP with higher probability than classical state-of-the-art records, but still very far from posing any threat to cryptosystems being considered for standardization. Depending on the technology available, there is a spectrum of tradeoffs in creating this combination.

arXiv:2402.13895•IEEE Transactions on Quantum Engineering•Nov 18, 2024•7 citations

Finding shortest lattice vectors faster using quantum search

Thijs Laarhoven, Michele Mosca, Joop van de Pol

By applying a quantum search algorithm to various heuristic and provable sieve algorithms from the literature, we obtain improved asymptotic quantum results for solving the shortest vector problem on lattices. With quantum computers we can provably find a shortest vector in time $$2^{1.799n + o(n)}$$ , improving upon the classical time complexities of $$2^{2.465n + o(n)}$$ of Pujol and Stehlé and the $$2^{2n + o(n)}$$ of Micciancio and Voulgaris, while heuristically we expect to find a shortest vector in time $$2^{0.268n + o(n)}$$ , improving upon the classical time complexity of $$2^{0.298n + o(n)}$$ of Laarhoven and De Weger. These quantum complexities will be an important guide for the selection of parameters for post-quantum cryptosystems based on the hardness of the shortest vector problem.

Designs Codes and Cryptography•Apr 13, 2015•91 citations

Space-efficient classical and quantum algorithms for the shortest vector problem

Yanlin Chen, Kai-Min Chung, Ching–Yi Lai

A lattice is the integer span of some linearly independent vectors. Lattice problems have many significant applications in coding theory and cryptographic systems for their conjectured hardness. The Shortest Vector Problem (SVP), which asks to find a shortest nonzero vector in a lattice, is one of the well-known problems that are believed to be hard to solve, even with a quantum computer. In this paper we propose space-efficient classical and quantum algorithms for solving SVP. Currently the best time-efficient algorithm for solving SVP takes 2^{n+o(n)} time and 2^{n+o(n)} space. Our classical algorithm takes 2^{2.05n+o(n)} time to solve SVP and it requires only 2^{0.5n+o(n)} space. We then adapt our classical algorithm to a quantum version, which can solve SVP in time 2^{1.2553n+o(n)} with 2^{0.5n+o(n)} classical space and only poly(n) qubits.

arXiv:1709.00378•Quantum Information and Computation•Mar 1, 2018•3 citations

Upper bounds of complexity of quantum oracle for problem of finding shortest vector on integer lattice

Alexander Olegovich Bakharev

Due to the development of quantum computing, there is a need for development and analysis of cryptosystems resistant to attacks with using a quantum computer - post-quantum algorithms cryptography. The strength of many well-known post-quantum cryptosystems, based on the theory of lattices, is based on the complexity of solving the problem finding the shortest vector in the lattice (SVP). For the previously proposed models of the quantum oracle used in the hybrid quantum-classical algorithm for solving the SVP problem, new refined estimates of implementation complexity. Designed and analyzed a new quantum oracle model that uses classical memory to storing a list of vectors.

Academician O.B. Lupanov International Scientific Seminar "Discrete Mathematics and Its Applications"•Jan 1, 2022•0 citations

ANNEALING-BASED ALGORITHM FOR SOLVING CVP AND SVP

Junpei Yamaguchi, Toshiya Shimizu, Kazuyoshi Furukawa +6 more

Inspired by quantum annealing, digital annealing computers specified for annealing computations have been realized on a large scale, such as the Digital Annealer (DA) developed by Fujitsu and the CMOS Annealing Machine developed by Hitachi. With the progress achieved using these computers, it has become necessary to estimate the computational hardness of cryptographic problems. This paper focuses on lattice problems, such as the closest vector problem (CVP) and shortest vector problem (SVP), which are a class of optimization problems. These problems form the basis of the security of lattice-based cryptography, which is a prime candidate for the NIST post-quantum cryptography standardization. For these lattice problems, we propose methods for generating an Ising model and solving the Ising model on annealing computers with a bit representation as the input, which represents encodings to map each integer variable in the SVP into binary variables. We propose two methods for SVPs, a basic method and a variant incorporating approximately the concept of the classical lattice enumeration. In our experimental results obtained using the second-generation DA, we succeeded in finding a shortest nonzero lattice vector in 40- and 45-dimensional lattices in the Darmstadt SVP Challenge. The basic method with a hybrid bit representation was the fastest among our methods with a bit representation, and the expected running time was estimated as 664 and 13,750 seconds for the 40- and 45-dimensional lattices, respectively. These results provide a benchmark for solving the SVP with annealing computers.

Journal of the Operations Research Society of Japan•Jul 12, 2022•1 citation
The lattice hortest vector problem, or lattice SVP, has gained a lot of attention in the field of quantum computing. There are a number of reasons for this, including the fact that the hardness of lattice SVP is the foudation of a number of post-quantum cryptosystems and that approximate-SVP is in NP ∩ coNP, so it is a prime target to use in searching for exponential speedups over classical algorithms [5, 7, 4].
Abstract By applying a quantum search algorithm to various heuristic and provable sieve algorithms from the literature, we obtain improved asymptotic quantum results for solving the shortest vector problem on lattices. With quantum computers we can provably find a shortest vector in time 21.799n+o(n), improving upon the classical time complexities of 22.465n+o(n) of Pujol and Stehle ́ and the 22n+o(n) of Micciancio and Voulgaris, while heuristically we expect to find a shortest vector in time 20.286n+o(n), improving upon the classical time complexity of 20.337n+o(n) of Laarhoven. These quantum complexities will be an important guide for the selection of parameters for post-quantum cryptosystems based on the hardness of the shortest vector problem. Keywords lattices · shortest vector problem · sieving · quantum search 1
Finding the shortest vector in a lattice is a problem that is believed to be hard both for classical and quantum computers. Many major postquantum secure cryptosystems base their security on the hardness of the shortest vector problem (SVP) (Moody, 2023). Finding the best classical, quantum, or hybrid classical–quantum algorithms for the SVP is necessary to select cryptosystem parameters that offer a sufficient level of security. Grover's search quantum algorithm provides a generic quadratic speedup, given access to an oracle implementing some function, which describes when a solution is found. In this article, we provide concrete implementation of such an oracle for the SVP. We define the circuit and evaluate costs in terms of the number of qubits, the number of gates, depth, and T-quantum cost. We then analyze how to combine Grover's quantum search for small SVP instances with state-of-the-art classical solvers that use well-known algorithms, such as the block Korkine Zolotorev (Schnorr and Euchner, 1994), where the former is used as a subroutine. This could enable solving larger instances of SVP with higher probability than classical state-of-the-art records, but still very far from posing any threat to cryptosystems being considered for standardization. Depending on the technology available, there is a spectrum of tradeoffs in creating this combination.
By applying a quantum search algorithm to various heuristic and provable sieve algorithms from the literature, we obtain improved asymptotic quantum results for solving the shortest vector problem on lattices. With quantum computers we can provably find a shortest vector in time 21.799n+o(n)2^{1.799n + o(n)}21.799n+o(n) , improving upon the classical time complexities of 22.465n+o(n)2^{2.465n + o(n)}22.465n+o(n) of Pujol and Stehlé and the 22n+o(n)2^{2n + o(n)}22n+o(n) of Micciancio and Voulgaris, while heuristically we expect to find a shortest vector in time 20.268n+o(n)2^{0.268n + o(n)}20.268n+o(n) , improving upon the classical time complexity of 20.298n+o(n)2^{0.298n + o(n)}20.298n+o(n) of Laarhoven and De Weger. These quantum complexities will be an important guide for the selection of parameters for post-quantum cryptosystems based on the hardness of the shortest vector problem.
A lattice is the integer span of some linearly independent vectors. Lattice problems have many significant applications in coding theory and cryptographic systems for their conjectured hardness. The Shortest Vector Problem (SVP), which asks to find a shortest nonzero vector in a lattice, is one of the well-known problems that are believed to be hard to solve, even with a quantum computer. In this paper we propose space-efficient classical and quantum algorithms for solving SVP. Currently the best time-efficient algorithm for solving SVP takes 2^{n+o(n)} time and 2^{n+o(n)} space. Our classical algorithm takes 2^{2.05n+o(n)} time to solve SVP and it requires only 2^{0.5n+o(n)} space. We then adapt our classical algorithm to a quantum version, which can solve SVP in time 2^{1.2553n+o(n)} with 2^{0.5n+o(n)} classical space and only poly(n) qubits.
Due to the development of quantum computing, there is a need for development and analysis of cryptosystems resistant to attacks with using a quantum computer - post-quantum algorithms cryptography. The strength of many well-known post-quantum cryptosystems, based on the theory of lattices, is based on the complexity of solving the problem finding the shortest vector in the lattice (SVP). For the previously proposed models of the quantum oracle used in the hybrid quantum-classical algorithm for solving the SVP problem, new refined estimates of implementation complexity. Designed and analyzed a new quantum oracle model that uses classical memory to storing a list of vectors.
Inspired by quantum annealing, digital annealing computers specified for annealing computations have been realized on a large scale, such as the Digital Annealer (DA) developed by Fujitsu and the CMOS Annealing Machine developed by Hitachi. With the progress achieved using these computers, it has become necessary to estimate the computational hardness of cryptographic problems. This paper focuses on lattice problems, such as the closest vector problem (CVP) and shortest vector problem (SVP), which are a class of optimization problems. These problems form the basis of the security of lattice-based cryptography, which is a prime candidate for the NIST post-quantum cryptography standardization. For these lattice problems, we propose methods for generating an Ising model and solving the Ising model on annealing computers with a bit representation as the input, which represents encodings to map each integer variable in the SVP into binary variables. We propose two methods for SVPs, a basic method and a variant incorporating approximately the concept of the classical lattice enumeration. In our experimental results obtained using the second-generation DA, we succeeded in finding a shortest nonzero lattice vector in 40- and 45-dimensional lattices in the Darmstadt SVP Challenge. The basic method with a hybrid bit representation was the fastest among our methods with a bit representation, and the expected running time was estimated as 664 and 13,750 seconds for the 40- and 45-dimensional lattices, respectively. These results provide a benchmark for solving the SVP with annealing computers.