A framework for reducing the overhead of the quantum oracle for use with Grover’s algorithm with applications to cryptanalysis of SIKE

Definition 2.3

(Cost notation) If 𝒜 is any quantum algorithm or quantum gate, we denote the execution cost of 𝒜 by the notation C_𝒜. Costs will be provided in terms of components that are executed in serial, so that C_𝒜 can be substituted for circuit-size, circuit-depth or either metric applied to a subset of quantum gates.

Definition 2.4

(Quantum bit oracle) The quantum bit oracle O χ ( b ) acting upon n+1 qubit computational basis states |x₁ . . . x_n〉 |b〉, where b ∈ {0, 1}, maps

Quantum oracles will be used in conjunction with Grover’s algorithm, which we state and provide a cost for without proof. Our modifications will simply be alterations of the quantum bit oracle and are used with Grover’s algorithm.

Theorem 2.5

(Grover’s algorithm [4, 12]) Let χ : { 0 , 1 } n ⟶ { 0 , 1 } define the search problem where M = |χ⁻¹(1)| is known. Then there exists a quantum algorithm that solves the search problem defined by χ with probability at least max { 1 − M 2 n , M 2 n } and which has a cost of C H ⊗ n + π 4 ⋅ 2 n / 2 M ⋅ C χ + C D n where C H ⊗ n , C χ C_χ and C D n are respectively the cost of implementing the Hadamard transform on n qubits, the quantum bit oracle O χ ( b ) and the diffusion operator D_n on n qubits, where cost is either quantum circuit-size or quantum circuit-depth. H^⊗n is the parallel application of n Hadamard gates, each of which cost 1 Clifford gate and the diffusion operator on n qubits is can be assigned a circuit-size of 44n − 105 Clifford+T gates for n ≥ 7 [17, 18] and circuit-depth of 44n − 103. Our framework will enable the cost expressed in Theorem 2.5 to be optimised by trading off between the cost C χ + C D n and the query-complexity term π 4 ⋅ 2 n / 2 M . Much as we require memory to implement classical functions efficiently, we often require ancilla qubits to implement the action of quantum bit oracle. In this paper we use a decomposition of the quantum bit oracle that captures this fact.

Definition 2.6

(Bitwise decomposition of the oracle) A bitwise decomposition of quantum bit oracle O χ ( b ) consists of the n +1 unitary operators U χ ∗ , U χ n , … , U χ 1 acting upon n +w+1 qubits, such that for any x₁ . . . x_n ∈ {0, 1}ⁿ and b ∈ {0, 1}

where U χ i = U χ i ′ ⊗ I ⊗ n − i + 1 so that U χ i ′ acts upon w + i qubits, with

with g i ( x 1 , … , x i ) ∈ { 0 , 1 } w derived from x₁, ..., x_i only, g 0 ∈ { 0 , 1 } w and

We there have that I ⊗ w ⊗ O χ ( b ) = U χ 1 † ⋯ U χ n † U χ ∗ U χ n ⋯ U χ 1 and that U χ i should be interpreted as producing a memory state g i ( x 1 , … , x i ) ∈ { 0 , 1 } w computed using only the first i bits of a possible solution to the search problem. The memory state g₀ ∈ {0, 1}^w can be considered as an initial memory-state which does not depend upon any of the bits x₁, ... , x_n. Typically, we can take g₀ = 0^w. This decomposition applies trivially to quantum bit oracles constructed using only reversible boolean primitives (we define U χ ∗ = O χ ( b ) and U χ ∗ = O χ ( b ) but non-trivial decompositions may require special design. The single-target preimage search problem (see Definition 2.2) can be modelled by simply by setting U χ n ⋯ U χ 1 to compute | h ( x 1 … x n ) ⊕ 1 m and setting U χ ∗ := ∧ m ( X )

Theorem 3.1

(Secondary classical search) Given a cut of a quantum oracle parameterised by 0 < k < n, we can implement a modified quantum bit oracle

and whose cost is

Proof. We first execute U_n−kto compute

then simply follow the procedure of executing the sequence U k † U ∗ U k on all possible assignments of the final k values of the search-space. This can be performed efficiently via using the k qubits following the register |x₁ . . . x_n−k〉 as additional input z₁ . . . z_k ∈ {0, 1}^k for U k † U ∗ U k and simply cycling through all possible values of z₁ . . . z_k ∈ {0, 1}^k. If we use a binary reflected Gray Code [11], we can start in the state 0^k and cycle through all 2^k elements of {0, 1}^k, ending in the state 10^k−1 by flipping only a single bit at a time, which can be accomplished via using an X gate on the relevant qubit and if we wish to return the state to |0^k〉, then we need only execute an additional X gate for a total cost of 2^k X gates. After this, we simply execute the unitary U n − k † leaving us with the computational basis state

□

Corollary 3.2

The modified quantum bit oracle O χ ′ ( b ) as described in Theorem 3.1 can be used with Grover’s algorithm defined on the search-space of n−k qubits and terminates with an x ∈ {0, 1}^n−k that can be extended to a full solution with probability at least x ∈ { 0 , 1 } n − k if 1 ≤ M ≤ 2 ( n − k ) / 2

Proof. This can easily be seen as the modified quantum oracle will mark any element x 1 … x n − k ∈ { 0 , 1 } n − k such that x 1 … x n − k ∈ { 0 , 1 } n − k can be extended to a full solution for some z 1 … z k ∈ { 0 , 1 } k Hence M^′ = z 1 … z k ∈ { 0 , 1 } k if there are no collisions on the first n − k bits of solutions, for which a standard lower bound exists. If M = 1, then there can obviously be no such collision.□

Such stategies are possible with classical computation, but require state to be stored. By their nature, reversible logic circuits store state implicitly and by using this fact we avoid increasing the number of qubits. There is no guarantee that a non-trivial advantageous cut will be possible, but we can simply follow a design heuristic where as much cost as possible is shifted towards U_n−k. As we can simply compute the costs C U n − k C_Uk and C_U* as a function of k, we can easily find an optimal k via numerical simulation of the costs involved (often a simple formula) on all values of 0 ≤ k ≤ n, which is a negligible classical computation.

Example 3.3

We consider the case where C U χ 1 = ⋯ = C U χ n = C U χ ∗ and these costs dominate that of the diffusion step, so that C U n − k = ( n − k ) D , C U k = k D and C U ∗ = D for some constant D. Choosing k = log₂ n and using Equation (8) in conjunction with the Theorem 2.5 gives us a cost of

which gives us an asymptotic cost of ( O 2 n / 2 ⋅ n 1 / 2 ( log 2 ⁡ n ) D compared to using Grover with the unmodified oracle for an asymptotic cost of O 2_n^/2 · nD.

Corollary 3.4 (Evaluation via backtracking) Let the conditions be as in Theorem 3.1. The same procedure can be implemented for a cost of

Proof. This can be easily seen as if we denote via X_i the application of an X gate to the i^th qubit of the search-space then each subsequence of unitary operators

that appears in the unitary U_k can be replaced by the subsequence

Corollary 3.5

(Commuting bitwise invariant components) Given a modified quantum bit oracle Oχ′(b) parameterised by 0 ≤ k ≤ n as in Theorem 3.1 such that Uχn−k+1,…,Uχn all commute and the action of each Uχi is invariant upon any choice of z_j ≠ z_i, the cost of Oχ′(b) can be reduced to

Proof. Again using the notation X_i for the application of an X gate to the i^th, we can adapt Theorem 3.1 by simply replacing any subsequence

that appears in the unitary U_k by

by the commuting property of each U χ n ⋯ U χ n − k + 1 and invariance of the unitary sequence U χ n ⋯ U χ n − k + 1 upon the variable z_i. From there it is a simple matter to note that the inner unitaries cancel each other out and we must first fully compute the sequence U χ n ⋯ U χ 1 and end with the sequence U χ 1 † ⋯ U χ n †

Example 3.6

We again consider the case where each unitary operator a cost of D as in Example 3.3, but where we can instead apply Theorem 3.5. The choice of k = log₂ n can now be seen to be optimal if we take the derivative of the full cost equation for Grover’s algorithm with the modified quantum bit oracle. This gives an asymptotic cost for Grover’s algorithm with this modified quantum bit oracle of O 2 n / 2 ⋅ n 1 / 2 D whereas

Theorem 3.1 gave us a cost of O 2 n / 2 ⋅ n 1 / 2 log 2 ⁡ n D and the unmodified quantum bit oracle with Grover was O 2 n / 2 ⋅ n D

Theorem 3.7

(Ancilla qubits allow shifting of unitary costs) Any component of the circuit that computes U χ n − k + i for 1 ≤ i ≤ k that is dependent solely on | x 1 … x n − k | z 1 … z j | g n − k + j ( x 1 , … , x n − k , z 1 , … , z j ) for 0 ≤ j ≤ i can be computed and stored on ancilla qubits during the computation of U χ n − k + j

Proof. The proof of this is trivial and relies solely upon the definition of the bitwise decomposition of the quantum bit oracle. □

In an ideal situation, the unitary costs will be shifted as much as possible to U_n−k.

Theorem 3.8

(Classical preprocessing allows strict gains) Let O χ ′ ( b ) be a modified quantum bit oracle parameterised by 0 < k < n as in Theorem 3.1. Then at the cost of classical storage space and/or classical preprocessing and without affecting the correctness of this algorithm, the quantum cost of O χ ′ ( b ) can be reduced and is at worst unchanged, whilst we reduce the number of qubits required by k.

Proof. We will create 2ⁱ circuits for each U χ n − k + i each of which are hardcoded to assume that the bits z₁ . . . z_i ∈ {0, 1}ⁱ are fixed. The first benefit is that as we are implicitly creating a circuit which is hardcoded with a choice of z₁ . . . z_i, we need not include these qubits or any qubits which interact only with them (and not x₁ . . . x_n−k by any circuit-path) in the search-space or the w-bit memory-state.

The second benefit is in a reduction in the complexity of the individual circuits themselves. Ifwe consider purely reversible circuits, then for any unitary U we have that if any z_i appears in the control qubits for ∧_k(U), then this can be hardcoded as a either a ∧ k − 1 ( U ) (U) gate if z_i = 1 or removed completely if z_i = 0.

The third benefit is that further optimisations are possible in the sequence of hardcoded circuits U χ n − k + 1 ⋯ U χ n as a whole. If we consider a simple circuit constructed of multiple ∧ k ( X ) gates, all of which write to the same target qubit and where no cancellation is posible, then any hardcoding of these ∧_k(X) gates that results in a circuit with ∧ k ′ (X) for (k^′ < k) gates with identical controls allows them to be removed if r is even or replaced with a single gate if r is odd.

Thus if we allow for the preprocessing and additional storage or alternatively online computation then these hardcoded quantum circuits are no more expensive to execute and we can always reduce the number of qubits by k.

We briefly mention that we could employ parallelism (communication costs allowing), whereby we compute U_n−k, then create 2^k copies of the resulting state and execute the sequence of unitaries U k † U ∗ U k upon each one. This strategy allows us to bypass some of the increase in circuit-size that is a hard-limit if we treat the quantum oracle as a black-box [28] as this increase only applies to C_Uk and C_U*.

Definition 4.1

(The Multivariate Quadratic (𝓜𝓠) problem over 𝔽₂) We define f ( 1 ) ( x 1 , … , x n ) , … , f ( m ) … , x n ) ∈ F 2 [ x 1 , … , x n ] be m equations of degree two in n variables over the finite field of size 2. The Multivariate Quadratic (𝓜𝓠) problem over 𝔽₂ is to find a solution vector ( x 1 , … , x n ) ∈ F 2 n such that

Several quantum resistant signature schemes [13, 20] have been published which rely upon the hardness of solving the Multivariate Quadratic problem over F₂. Whilst asymptotically more efficient algorithms exist [3, 9], a basic attack [23] using Grover’s algorithm that was later optimised via preprocessing [21] is both captured and improved upon by our framework. We leave explicit details to Appendix A for reasons of space and to avoid duplication of preexisting work [21, 23].

This case-study provides important commentary upon the difficulty in choosing quantum resistant parameters in relation to Grover’s algorithm as the initial quantum resistant parameters were suggested [20] in relation to the query-complexity of O 2 n / 2 for Grover’s algorithm to solve the 𝒨𝒬 problem over 𝔽₂. After publication of an explicit design for a quantum bit oracle to use in conjunction with Grover’s algorithm for this problem [23] which gave the quantum circuit-size O 2 n / 2 ⋅ m n 2 for Grover’s algorithm, new parameters were suggested in a subsequent paper [19] in relation to this cost. These costs were also quoted in several specifications for quantum-resistant cryptosystems in the NIST competition [6, 8]. Our framework demonstrates that one optimisation [21] using preprocessing lowers the cost to O2n/2⋅mn3/2 and that by using our framework this improves to O 2 n / 2 ⋅ m n by using an additional O(m log₂ n) ancilla qubits. We discuss the problem of choosing quantum-resistant cryptographic parameters in relation to anything but the query-complexity of Grover’s algorithm further in Section 5.