The dihedral hidden subgroup problem

Imin Chen; David Sun

doi:10.1515/jmc-2022-0029

Article Open Access

The dihedral hidden subgroup problem

Imin Chen and David Sun

Published/Copyright: March 16, 2024

Published by

Become an author with De Gruyter Brill

Submit Manuscript Author Information

From the journal Journal of Mathematical Cryptology Volume 18 Issue 1

Abstract

The hidden subgroup problem (HSP) is a cornerstone problem in quantum computing, which captures many problems of interest and provides a standard framework algorithm for their study based on Fourier sampling, one class of techniques known to provide quantum advantage, and which succeeds for some groups but not others. The quantum hardness of the HSP problem for the dihedral group is a critical question for post-quantum cryptosystems based on learning with errors and also appears in subexponential algorithms for constructing isogenies between elliptic curves over a finite field. In this article, we give an updated overview of the dihedral hidden subgroup problem as approached by the “standard” quantum algorithm for HSP on finite groups, detailing the obstructions for strong Fourier sampling to succeed and summarizing other known approaches and results. In our treatment, we “contrast and compare” as much as possible the cyclic and dihedral cases, with a view to determining bounds for the success probability of a quantum algorithm that uses m coset samples to solve the HSP on these groups. In the last sections, we prove a number of no-go results for the dihedral coset problem (DCP), motivated by a connection between DCP and cloning of quantum states. The proofs of these no-go results are then adapted to give nontrivial upper bounds on the success probability of a quantum algorithm that uses m coset samples to solve DCP.

Keywords: quantum computation; hidden subgroup problem

MSC 2010: 81P94; 68Q12; 20C05; 14H52

1 Introduction

Let G be a finite group and H a hidden subgroup of G . A function f : G → S , where S is a known finite set, which is constant on left H -cosets and takes distinct values on distinct left H -cosets, is called a separating function for the subgroup H .

The hidden subgroup problem (HSP) is the problem of finding generators for the hidden subgroup H , given access to evaluations of a separating function f for H . The HSP can be solved in polynomial time using a quantum computer when G is an abelian group [1,2] and has been extensively studied for many classes of finite groups [3,4].

Many problems can be cast in terms of the HSP and there is a “natural” standard quantum algorithm based on the quantum Fourier transform, which is typically used to study the HSP. For instance, Shor’s integer factorization algorithm [5] can be described in terms of the HSP for cyclic groups [6], and in this case, the standard algorithm succeeds in yielding an efficient quantum algorithm. Another example is the HSP on the symmetric group, which can be used to solve the graph isomorphism problem [7–10], but here the standard algorithm fails to provide an efficient quantum algorithm [11].

A polynomial time quantum algorithm for solving the HSP on dihedral groups would imply a polynomial time quantum algorithm to solve certain hard lattice problems that are considered intractable using classical computers [12]. Though the dihedral group is one of the simplest non-abelian groups, from the point of view of the HSP, it has remained a difficult case in terms of definitive results about its hardness. The best known quantum algorithms for the dihedral hidden subgroup problem (DHSP) are currently subexponential [13–16].

A problem closely related to DHSP is the dihedral coset problem (DCP), which is the problem of determining a hidden subgroup H of the dihedral group D N from uniform coset samples obtained from evaluations of the separating function for H .

The latter subexponential algorithms have applications to constructing isogenies between elliptic curves over a finite field [17,18], though we note that the recent breakthroughs in [19–21] have changed the landscape on this problem in the presence of torsion point information.

In the study by Brakersk et al. [22], it is shown that the learning with errors (LWE) problem is the quantum polynomial time equivalent to an extrapolated version of the dihedral coset problem (EDCP). The LWE problem forms the basis for many proposed post-quantum key exchanges; therefore, the quantum hardness of the HSP for groups like the dihedral group becomes a critical question.

In the first sections of this article, we review the standard HSP algorithm as it applies to the dihedral groups D N and detail the obstructions for this algorithm to succeed in this case. We also provide an overview describing other approaches to the HSP for dihedral groups, such as optimal measurements and its relations to the subset sum problem, complementing previous surveys of known results on DHSP [4,23,24] (see also [25] for a self-contained account). In our treatment, we “contrast and compare” as much as possible the cyclic and dihedral cases, with a view to determining bounds for the success probability of a quantum algorithm, which uses m coset samples to solve the HSP on these groups.

In the last sections of this article, we prove a number of a no-go theorems for DCP. The results yield an upper bound on the success probability of any quantum algorithm, which uses a unitary operation and then one measurement to determine the angle a of a hidden reflection in the dihedral group. Viewed in terms of positive operator-valued measurements (POVM), this gives a nontrivial upper bound on the success probability of the optimal measurement using m coset samples to solve DCP in the case when the density ν = m ∕ log 2 N ≥ 1 and the order of the dihedral group is 2 N .

Finally, we describe a connection between DCP and cloning of quantum states that helped motivate the proofs of the no-go results for DCP.

2 Quantum Fourier transform (QFT) for finite groups

Let G be a finite group and G ˆ denote a complete set of representatives for the isomorphism classes of irreducible representations of G over C . For a representation ρ ∈ G ˆ , let d ρ be the dimension of ρ . Recall the QFT on G is defined as the linear transformation:

(2.1) F G : V → V ˆ , F G ≔ ∑ g ∈ G ∑ ρ ∈ G ˆ ∑ i , j = 1 d ρ d ρ ∣ G ∣ ρ ( g ) i , j ∣ ρ , i , j ⟩ ⟨ g ∣ ,

where V is the C -vector space generated by ∣ g ⟩ , g ∈ G , and V ˆ is the C -vector space generated by ∣ ρ , i , j ⟩ , ρ ∈ G ˆ , 1 ≤ i , j ≤ d ρ . Picking an isomorphism V ≅ V ˆ , it is a unitary operator that can be efficiently approximated using quantum circuits for many finite groups: abelian [26], meta-cyclic [10], symmetric group [7].

2.1 Cyclic group case

Suppose that G = C N ≅ Z ∕ N Z is the cyclic group of order N . There are N irreducible representations that are one-dimensional and given by:

Z ∕ N Z → C × , t ↦ ζ N t ,

where ζ N is a choice of N th root of unity.

2.2 Dihedral group case

Suppose that G = D N is the dihedral group of order 2 n , which can be presented as:

D N = ⟨ x , y : x n = e , y 2 = e , y x y − 1 = x − 1 ⟩ .

If n is even, there are four one-dimensional representations given by:

(2.2) ϕ u , v : x ↦ ( − 1 ) u , y ↦ ( − 1 ) v ,

where u , v ∈ Z ∕ 2 Z . These are pullbacks of the four one-dimensional representations of D N ∕ ⟨ x 2 ⟩ ≅ C 2 × C 2 under the quotient homomorphism D N → D N ∕ ⟨ x 2 ⟩ , where C m denotes the cyclic group of order m .

If n is odd, there are two one-dimensional representations given by ϕ 0 , v where v ∈ Z ∕ 2 Z . These are pullbacks of the two one-dimensional representations of D N ∕ ⟨ x ⟩ ≅ C 2 under the quotient homomorphism D N → D N ∕ ⟨ x ⟩ .

There are ⌊ n − 1 2 ⌋ irreducible representations of dimension 2 given by:

(2.3) ρ k : D N → GL 2 ( C ) , x ↦ ω N k 0 0 ω N − k , y ↦ 0 1 1 0 ,

for 0 < k < n 2 , where ω N = e 2 π i ∕ n . These are the induction of the representation ψ k : C n → C × given by ψ k ( x ) = ω N k from C n to D N .

The representations ϕ u , v and ρ k form the complete list of irreducible representations of D N up to isomorphism.

3 Standard HSP algorithm

In the standard algorithm for finding hidden subgroups from a separating function, we perform the following steps:

We form the state

(3.1) 1 ∣ G ∣ ∑ g ∈ G ∣ g ⟩ ∣ f ( g ) ⟩ ,

where f : G → S is the given separating function.

This can be achieved by starting with the state ∣ e G ⟩ ∣ 0 ⟩ , where e G is the identity element of G , then performing the following computations:

(3.2) ∣ e G ⟩ ∣ 0 ⟩ ↦ 1 ∣ G ∣ ∑ g ∈ G ∣ g ⟩ ∣ 0 ⟩ , apply the QFT over G ↔ Z ∕ ∣ G ∣ Z , e G ↔ 0 to first register. ↦ 1 ∣ G ∣ ∑ g ∈ G ∣ g ⟩ ∣ f ( g ) ⟩ , compute f into second register.

Measuring the second register and discarding it, we obtain a state of the form:

(3.3) 1 ∣ H ∣ ∑ h ∈ H ∣ c h ⟩ ,

where c ∈ G .

We apply the QFT to the aforementioned state to obtain

(3.4) ∑ ρ ∈ G ˆ d ρ ∣ G ∣ ∣ H ∣ ∑ i , j = 1 d ρ ∑ h ∈ H ρ ( c h ) i , j ∣ ρ , i , j ⟩ .

In the case of G being an abelian group, measuring ρ gives sufficient information to determine H efficiently after running this process repeatedly and using post-processing [1].

3.1 Cyclic group case

Fix an integer N > 1 . Let S be a finite set, and G ≔ ( Z ∕ N Z , + ) . Suppose that we have a function f : G → S , which separates a subgroup H ⊂ G , where H = ⟨ d ⟩ . Let M ≔ # H . Assume that we have a quantum machine capable of computing the unitary transformation on two registers U f : ∣ x ⟩ ∣ y ⟩ → ∣ x ⟩ ∣ f ( x ) ⊕ y ⟩ (recall that we can take ∣ x ⟩ ∣ y ⟩ as ∣ x ⟩ ⊗ ∣ y ⟩ ).

Suppose that we do not know M , d , nor H and we only know G and have a machine computing f . We want to determine a generating set for H , calling the “black-box” function f as few times as possible.

Let F N be the QFT for the cyclic group G . Explicitly, this is an operator on a register with n ≥ log 2 N qubits given by:

F N ≔ 1 N ∑ j , k = 0 N − 1 exp 2 π i j k N ∣ k ⟩ ⟨ j ∣ .

The F N is a unitary transformation. If we let ω ≔ exp 2 π i N be the primitive N th root of unity, then

F N = 1 N 1 1 1 ⋯ 1 1 ω ω 2 ⋯ ω N − 1 1 ω 2 ω 4 ⋯ ω 2 ( N − 1 ) ⋮ ⋮ ⋮ ⋮ 1 ω N − 1 ω 2 ( N − 1 ) ⋯ ω ( N − 1 ) ( N − 1 ) .

One can check that F N ⋅ F N * = I N , where I N is the N × N identity matrix.

We map G = { 0 , 1 , … , N − 1 } onto the basis of the quantum state { ∣ 0 ⟩ , ∣ 1 ⟩ , … , ∣ N − 1 ⟩ } . Suppose that the hidden subgroup is given by H = { ∣ 0 ⟩ , ∣ d ⟩ , ∣ 2 d ⟩ , … , ∣ ( M − 1 ) d ⟩ } .

Computing on two registers:

∣ 0 ⟩ ∣ 0 ⟩ ⟶ F N on 1st 1 N ∑ j = 0 N − 1 ∣ j ⟩ ∣ 0 ⟩ ⟶ apply f 1 N ∑ j = 0 N − 1 ∣ j ⟩ ∣ f ( j ) ⟩ .

Note that we put ∣ f ( j ) ⟩ inside the sum since tensor product is distributive. Measuring in ∣ f ( j 0 ) ⟩ on the second register for some 0 ≤ j 0 ≤ N − 1 collapses our state, leaving only those values g ∈ G such that f ( g ) = f ( j 0 ) in the first register. Since f separates cosets of H , we obtain (for simplicity, we now drop our second register that remains ∣ f ( j 0 ) ⟩ ):

⟶ measure 1 M ∑ h ∈ H ∣ j 0 + h ⟩ = 1 M ∑ s = 0 M − 1 ∣ j 0 + s d ⟩ ⟶ apply F N 1 M ∑ s = 0 M − 1 1 N ∑ k = 0 N − 1 exp 2 π i ( j 0 + s d ) k N ∣ k ⟩ = 1 M N ∑ k = 0 N − 1 exp 2 π i j 0 k N ∣ k ⟩ ∑ s = 0 M − 1 exp 2 π i s d k N = 1 d ∑ t = 0 d − 1 exp 2 π i j 0 t M N ∣ t M ⟩ ,

using the fact that

∑ s = 0 M − 1 exp 2 π i s d k N = ∑ s = 0 M − 1 exp 2 π i k M s = 0 , if M ∤ k , M , if M ∣ k ,

for 0 ≤ k ≤ N − 1 and that M N = 1 d .

Now, measurement at this point gives a multiple of M in { 0 , M , … , ( d − 1 ) M } with uniform probability. We repeat this whole process many times to obtain a collection of multiples of M and take the greatest common divisor (GCD) to obtain M with high probability.

To estimate how many trials m ≥ 2 we need, suppose that we have t 1 , … , t m ∈ { 0 , 1 , … , d − 1 } . We want to estimate the probability that gcd ( t 1 , … , t m ) = 1 ; in particular, we have the lower bound:

(3.5) P ( gcd ( t 1 , … , t m ) = 1 ) ≥ ζ ( m ) − 1 + O ( log d ∕ d ) ,

where ζ ( s ) is the Riemann zeta function by Nymann [27]. Thus, a few runs of this algorithm determine H with high probability for any N and “most” d .

Lemma 3.6

We have that

ζ ( m ) − 1 > 1 − 3 ⋅ 2 − m ,

for every m ≥ 2 .

Proof

We first recall that

ζ ( s ) = ∑ n = 1 ∞ n − s and ζ ( s ) − 1 = ∑ n = 1 ∞ μ ( n ) n s ,

for real s ≥ 2 , where μ is the Möbius function. Then,

□ 1 − ζ ( s ) − 1 2 − s = ∑ n ≥ 2 − μ ( n ) ( n ∕ 2 ) s ≤ ∑ n ≥ 2 1 ( n ∕ 2 ) 2 = 4 ( ζ ( 2 ) − 1 ) < 3 .

We may therefore view the standard algorithm for HSP on the cyclic group G as producing a quantum state of the form:

(3.7) ∑ t 1 , … , t m α t 1 , … , t m ∣ t 1 M ⟩ … ∣ t m M ⟩ .

We may compute the greatest common divisor of the aforementioned registers into a blank register:

(3.8) ∑ t 1 , … , t m α t 1 , … , t m ∣ t 1 M ⟩ … ∣ t m M ⟩ ∣ 0 ⟩ ↦ ∑ t 1 , … , t m α t 1 , … , t m ∣ t 1 M ⟩ … ∣ t m M ⟩ ∣ gcd ( t 1 M , … t m M ) ⟩ .

Thus, the standard HSP algorithm for G can be viewed as a unitary operation of the form:

(3.9) ∣ A ⟩ ∣ ψ d 1 ⟩ ⋯ ∣ ψ d m ⟩ ∣ 0 ⟩ ↦ ∑ e ∣ Σ e ⟩ ∣ N ∕ e ⟩ ↦ ∑ e ∣ Σ e ⟩ ∣ e ⟩ ,

satisfying

∣ Σ d ∣ 2 ≥ λ ( m , d ) ,

for every m . We remark the second map sending e ↦ N ∕ e in the last register is unitary (if e ∤ N , the map leaves e alone).

Remark 3.10

Assume that for any guess for d , there is a quantum circuit that can decide whether d is correct. For a fixed m , we can improve the success probability above by the following method. Let us, instead, consider the probability of achieving a multiple k M of M for 1 ≤ k ≤ C for some C ∈ N . For the given guess of M and hence for d , we can check if it is the correct value, and if not, adjust it to the correct value because we know the true value is d ∕ k for some 1 ≤ k ≤ C and d ∕ k being an integer. This increases the success parameter for a fixed number of samples m ≥ 2 . For instance, if m = 2 and C = 10 , then the success parameter improves from ≈ 0.6079 to ≈ 0.9892 .

The aforementioned example motivates the next definition.

Definition 3.11

Let ℐ d = { ∣ ψ d ⟩ } be a collection of possible input states depending on the parameter d . The problem of determining d from a list of m samples in ℐ d is unitarily solvable with success parameter λ ( m , d ) if there is a unitary operator that has the effect:

(3.12) ∣ A ⟩ ∣ ψ d 1 ⟩ ⋯ ∣ ψ d m ⟩ ∣ 0 ⟩ ↦ ∣ Σ d ( ψ d ) ⟩ ∣ d ⟩ + ∑ e ≠ d ∣ Σ e ( ψ d ) ⟩ ∣ e ⟩ ,

where

∣ Σ d ( ψ d ) ∣ 2 ≥ λ ( m , d ) ,

for every m and d .

We may view (3.12) as computing a main term:

(3.13) ∣ Σ d ( ψ d ) ⟩ ∣ d ⟩ ,

with error term

(3.14) ∑ e ≠ d ∣ Σ e ( ψ d ) ⟩ ∣ e ⟩ .

The next theorem is stated for completeness and for later comparison to the case of DCP. It summarizes the well-known standard algorithm for HSP on a finite cyclic group in terms of the aforementioned definitions.

Theorem 3.15

The problem of determining a generator for a hidden subgroup of a finite cyclic group, given a list of m HSP coset samples, is unitarily solvable with success parameter ζ ( m ) − 1 + O ( log d ∕ d ) , where ζ ( s ) is the Riemann zeta function.

Remark 3.16

Here, M = N ∕ d , so we may view the standard quantum algorithm as producing uniform samples in H ⊥ = ⟨ d ⟩ ⊥ = ⟨ N ∕ d ⟩ , where H ⊥ = ∩ h ∈ H ker χ h = ker χ d (see [28, §4.1, §6.1] for more details). For a general finite abelian group G , the uniform samples in H ⊥ from the standard quantum algorithm are used to determine H by a classical probabilistic algorithm.

3.2 Dihedral group case

In [29], it is shown that the HSP for G = D N for a general subgroup H is reduced to the case of a single reflection subgroup H = H a .

For H = H a = ⟨ y x a ⟩ , the probability of obtaining ∣ ρ , i , j ⟩ is 1 ∣ G ∣ when d ρ = 2 , which does not allow us to distinguish the groups H a . Explicitly, in the complex basis (2.3):

If ρ = ρ k , then

(3.17) ∑ h ∈ H ρ ( x α h ) = ω N α k ω N − ( a − α ) k ω N ( a − α ) k ω N − α k ,

(3.18) ∑ h ∈ H ρ ( y x α h ) = ω N ( a − α ) k ω N − α k ω N α k ω N − ( a − α ) k .

If ρ = ϕ u , v , then

(3.19) ∑ h ∈ H ρ ( x α h ) = ( − 1 ) α u + ( − 1 ) v + ( a − α ) u = ( − 1 ) α u ( − 1 + ( − 1 ) v + a u ) ,

(3.20) ∑ h ∈ H ρ ( y x α h ) = ( − 1 ) ( a − α ) u + ( − 1 ) v + α u = ( − 1 ) ( a − α ) u ( − 1 + ( − 1 ) v + a u ) .

If one changes to the real basis, we obtain a probability distribution dependent on a , but it is very flat, making it hard to distinguish the subgroups H a .

More generally, in order for the QFT to be an unitary operator, we require that ρ k ( g ) be unitary for every k and g ∈ D N ⇒ ∣ ρ k ( g ) i , j ∣ ≤ 1 for 1 ≤ i , j ≤ 2 . In particular, for any set of two-dimensional irreducible representations ρ k , we have that

(3.21) P ( ρ k , i , j ) = 1 n ∣ ( ρ k ( c y x a ) + ρ k ( c ) ) i , j ∣ 2 ≤ 1 N ( ∣ ρ k ( c y x a ) i , j ∣ + ∣ ρ k ( c ) i , j ∣ ) 2 ≤ 4 N ,

where P ( ρ k , i , j ) is the probability of observing the state ∣ ρ k , i , j ⟩ . Although the choice of basis may result in probability distributions of states that depend on a , if N is very large, the aforementioned inequalities show that the probabilities will always be very flat.

In the study by Moore and Russell [30], it is shown that the POVM to determine a from a single DCP sample exists and is given by the the pretty good measurement (PGM), and this has success probability:

(3.22) P success = 2 N 1 − 1 2 N .

Theorem 3.23

The standard algorithm for DHSP cannot implement the optimal measurement using one coset sample.

Proof

This follows because (3.21) and (3.22) are incompatible.□

3.3 Dihedral coset sampling

In the standard HSP algorithm, after the first step, we are left with random coset samples as in (3.3). In the case of G = D N , the dihedral group of order n , and H = H a = ⟨ y x a ⟩ , this is explicitly of the form:

(3.24) 1 ∣ H ∣ ∑ h ∈ H ∣ c h ⟩ = 1 2 ( ∣ c ⟩ + ∣ c y x a ⟩ ) = 1 2 ( ∣ y β x α ⟩ + ∣ y β x α y x a ⟩ ) = 1 2 ( ∣ y β x α ⟩ + ∣ y β + 1 x a − α ⟩ ) = 1 2 ( ∣ x α ⟩ + ∣ y x a − α ⟩ ) , if β = 0 1 2 ( ∣ x a − α ⟩ + ∣ y x α ⟩ ) , if β = 1

where c = y β x α .

Remark 3.25

The second case is reduced to the first by the transformation α → a − α if this transformation leaves the distribution of α invariant.

Given samples of the form

(3.26) ψ a = ψ a ; α = 1 2 ( ∣ x α ⟩ + ∣ y x a − α ⟩ ) ,

the DCP is the problem of finding generators for the hidden subgroup H = H a . The states ψ a = ψ a ; α are called the DCP samples for a .

For HSP samples produced from the standard algorithm, where α is from the uniform distribution, we may view HSP samples as DCP samples by Remark 3.25.

Remark 3.27

We can encode a DCP sample ψ a ; α as:

1 2 ( ∣ 0 ⟩ ∣ α ⟩ + ∣ 1 ⟩ ∣ a − α ⟩ ) .

Using the fact that y x α = x − α y , this can be encoded (after negating a ) as:

1 2 ( ∣ 0 ⟩ ∣ α ⟩ + ∣ 1 ⟩ ∣ a + α ⟩ ) ,

which is another commonly used form used in the literature, especially in the context of the “hidden shift problem”.

3.4 Generalizations of DCP

Let A be a finite abelian group (written multiplicatively) with identity e . Let f 0 , f 1 : A → S be the injective functions to a finite set S and such that f 1 ( x ) = f 0 ( x s ) for all x ∈ A and some s ∈ A . The hidden shift problem is the problem of determining the hidden shift s ∈ A from evaluations of the functions f 0 and f 1 . We refer the reader to previous studies [17, §5] for a discussion of the hidden shift problem without the condition of injectivity.

Let G = C 2 ⋉ A , where C 2 = ⟨ τ ⟩ acts from the left on A by inversion. In the resulting semi-direct product, let y = ( τ , e ) . Then, for elements in the normal subgroup A ˜ of G corresponding to A , i.e., elements of the form α ˜ = ( e , α ) , we have that y α ˜ y − 1 = α ˜ − 1 , and every element in G can be written in the form y α ˜ or α ˜ .

The HSP for subgroups of the form:

(3.28) H = ⟨ ( τ , s ) ⟩ = { ( e , e ) , ( τ , s ) }

is equivalent to the hidden shift problem with shift s ∈ A . Indeed, an element in Z [ G ] , which is constant on left H -cosets, is a linear combination of sums of the form:

(3.29) ∑ h ∈ H y β α ˜ h = y β α ˜ + y β + 1 s ˜ α ˜ − 1 ,

which are (up to scaling) left H -coset samples that result from applying the standard algorithm to the group G to find hidden subgroups of the form (3.28). After mapping S injectively into Z , the function f 0 + f 1 corresponds to an element in Z [ G ] , which is distinctly constant on left H -cosets so it is a separating function for H . Hence, a solution to the HSP on G implies a solution to the hidden shift problem on A . For a complete proof of equivalence, see [13, Proposition 6.1].

In the application to constructing isogenies between elliptic curves over finite fields with identical endomorphism ring (i.e., horizontal isogenies), the hidden shift problem is applied in the following way [17]. Let O be an order in an imaginary quadratic field K , and consider the set

(3.30) Ell q , n ( O ) = { elliptic curves E ∕ F q , with # E ( F q ) = n and End F q ( E ) ≅ O } ∕ ≅ F q .

The class group Cl ( O ) of the order O acts freely on Ell q , n ( O ) assuming this set is non-empty for the given q a power of a prime p , with one orbit if p is not inert in O and two orbits otherwise (see [31, Theorem 4.5]). Given [ b ] ∈ Cl ( O ) and E ∈ Ell q , n ( O ) denote the action by [ b ] ⋆ E . Now, suppose E 1 = [ s ] ⋆ E 0 for some hidden s ∈ Cl ( O ) . For i = 0 , 1 , define f i ( [ b ] ) = [ b ] ⋆ E i . Then, it holds that f 1 ( [ b ] ) = f 0 ( [ b ] [ s ] ) and both f 0 and f 1 are the injective functions to S = Ell q , n ( O ) . A solution to the hidden shift problem on Cl ( O ) allows us to recover the hidden shift s . The subexponential algorithm of Childs et al. [17] consists of applying a subexponential algorithm for the hidden shift problem to find s and applying a subexponential algorithm to compute the ⋆ operator.

Remark 3.31

In the study by Childs et al. [17], the set in (3.30) is taken up to isomorphism over F ¯ q . We use isomorphism over F q because this is the form used in the reference we cite for the class group action.

In the EDCP, one considers the infinite abelian group:

G = Z × ( Z ∕ N Z ) n ,

where n ∈ N , and hidden subgroups of the form:

(3.32) H = ⟨ ( 1 , s ) ⟩ .

Let y = ( 1 , 0 ) ∈ G and f β : H → C be a weight function satisfying

(3.33) ∑ h ∈ H ∣ f β ( h ) ∣ 2 = 1 .

A weighted left H -coset sample has the form:

y β x α ∑ h ∈ H f β ( h ) h = y β x α ∑ j ∈ Z f β ( j ) y j x s j = ∑ j ∈ Z f β ( j ) y β + j x α + s j = ∑ j ∈ Z f ( j ) y j x α − s β + s j ,

where we assume f β ( j − β ) = f ( j ) and we use the multiplicative notation to make the comparison with the hidden shift and dihedral cases more clearly. Here, x α is the multiplicative notation for the element corresponding to α = ( α 1 , … , α n ) ∈ ( Z ∕ N Z ) n .

If the transformation α → α + s β leaves the distribution of α invariant, we are left with samples of the form:

(3.34) ∑ j ∈ Z f ( j ) y j x α + s j .

The problem of recovering s from such samples (EDCP) is shown to be equivalent to LWE up to polynomial loss in parameters [22].

Remark 3.35

When f is the normalized indicator function of { 0 , 1 } , an extrapolated dihedral coset sample reverts to a dihedral coset sample. Also, the study by Brakerski et al. [22] imposes a stronger condition than (3.33).

4 Other approaches to DHSP and DCP

4.1 Subexponential algorithms

The first row of (3.17) can be encoded as:

1 2 N ∑ k ( ω N α k ∣ k ⟩ ∣ 0 ⟩ + ω N ( a − α ) k ∣ k ⟩ ∣ 1 ⟩ ) = 1 N ∑ k ω N α k ⊗ 1 2 ( ∣ 0 ⟩ + ω N a k ∣ 1 ⟩ ) .

Measuring the first register yields the samples of the form:

(4.1) ∣ Ψ k ⟩ = 1 2 ( ∣ 0 ⟩ + ω N a k ∣ 1 ⟩ ) ,

where k is known from the measurement.

Let N = 2 t for simplicity and m = ⌈ t − 1 ⌉ . The idea behind the subexponential algorithm in the study by Kuperberg [13] is to combine states of the form (4.1). In particular, we see that

(4.2) ∣ Ψ p ⟩ ∣ Ψ q ⟩ = 1 2 ( ∣ Ψ p + q ⟩ ∣ 0 ⟩ + ω N a q ∣ Ψ p − q ⟩ ∣ 1 ⟩ ) .

If p and q have the same m j least significant bits, then p ± q strictly increases the number of least significant bits p and q share.

With sufficiently many samples of the form Ψ p that have m j common least significant bits, it is shown in the study by Kuperberg [13] that combining the states as in (4.2) produces enough states with m ( j + 1 ) common least significant bits. Thus, sieving from enough samples at the outset, we eventually produce states of the form:

Ψ 2 t − 1 = ∣ 0 ⟩ + ( − 1 ) a ∣ 1 ⟩ ,

which are sufficient to determine the parity of a . It is shown in the study by Kuperberg [13] that the aforementioned method yields an algorithm that requires 2 O ( log N ) time, space, and queries. In the study by Regev [12], a modified algorithm is given that requires 2 O ( log N log log N ) time and poly ( log N ) space. An abstract description of this sieving process is given in previous studies [13, §9] and further improvements and generalizations can be found in the study by Kuperberg [15], in particular the so-called “collimation sieve.”

Remark 4.3

In the study by Kuperberg [13], it is shown that HSP for D 2 t reduces to determining the parity of a .

4.2 Query complexity

In the study by Ettinger and Høyer [29], it is shown that a polynomial number of HSP samples is sufficient to recover H a using exponential time post-processing. A related result in the study by Ettinger and Høyer [32] using different methods shows that the HSP problem in a general finite group has polynomial quantum query complexity.

Transposing i ↔ j , and applying a Hadamard gate to the state in (3.17), gives the state

(4.4) 1 2 1 1 1 − 1 ω N α k ω N ( a − α ) k ω N − ( a − α ) k ω N − α k = 1 2 ω N α k ( 1 + ω N − a k ) ω N − α k ( 1 + ω N a k ) ω N α k ( 1 − ω N − a k ) ω N − α k ( 1 − ω N a k ) .

The probability of observing the first row is

(4.5) 1 2 n ( 1 + cos ( 2 π a k ∕ N ) ) = 1 n cos 2 ( π a k ∕ N ) .

For the second row, it is

(4.6) 1 2 n ( 1 − cos ( 2 π a k ∕ N ) ) = 1 n sin 2 ( π a k ∕ N ) .

We are now in the situation of the study by Ettinger and Høyer [29] and can apply the post-processing algorithm described (which is exponential in time) to determine a with high probability, for large N .

4.3 Relation to the subset sum problem

Given x = ( x 1 , … , x m ) ∈ ( Z ∕ N Z ) m and r ∈ Z ∕ N Z , the problem of finding b ∈ { 0 , 1 } m such that b ⋅ x = r is called the subset sum problem over Z ∕ N Z .

The vector b corresponds to specifying a subset of the x 1 , … , x m that sum to r . Denote by

S r x = { b ∈ { 0 , 1 } m : b ⋅ x = r }

the set of subset sums for ( x , r ) .

If such a b exists, then ( x , r ) is called a legal instance. In the decision version of the subset sum problem, the problem is to determine whether a given ( x , r ) is a legal instance.

In the study by Regev [12], it is shown that the ability to efficiently find an element b ∈ S r x for a large fraction of legal instances gives an efficient algorithm to solve DHSP. Furthermore, the study by Bacon et al. [24] shows that the ability to quantum sample from S r x allows us to efficiently implement an optimal measurement to determine a from m DCP samples.

The subset sum problem over Z is known to be an NP-complete problem. Since one can reduce the subset sum problem over Z to the subset sum problem over Z ∕ N Z , by choosing a large enough modulus N , it follows that the subset sum problem over Z ∕ N Z is also NP-complete.

4.4 Optimal measurements

It is shown in the study by Ettinger and Høyer [33] that efficient elimination observables do not exist for the dihedral group. Further results can be found in the study by Bacon et al. [24]. In particular, let

ν = m ∕ log 2 N

be the density defined in the study by Bacon et al. [24].

It is shown in [24, Theorem 2] that if ν > 1 + 4 ∕ log 2 N , the probability of determining a using the optimal measurement on m DCP samples is ≥ 1 ∕ 8 . Furthermore, for any N and m , the probability of determining a is

(4.7) ≤ 2 m ∕ N = 2 ( ν − 1 ) log 2 N ,

which is exponentially small in log 2 N for any fixed ν < 1 , and gives a trivial upper bound when ν ≥ 1 .

More general results on optimal measurements to distinguish conjugate hidden subgroups in certain groups can be found in the study by Moore and Russell [30].

In the study by Bacon et al. [24], the success probability of the optimal measurement is determined as:

p m , N = 1 2 m N m + 1 ∑ x ∈ ( Z ∕ N Z ) m ∑ r ∈ Z ∕ N Z η r x 2 ,

where η r x ≔ ∣ S r x ∣ .

Remark 4.8

For example, let m = 2 , N = 2 m , and ν = 1 . Computer calculations show that p m , N ≈ 0.6665 . On the other hand, we saw in Remark 3.10 that we can achieve a success probability of ≈ 0.9892 for m = 2 in the cyclic group case.

In the study by Moore and Russell [30], it is shown that the optimal POVM measurement to determine a from m DCP samples exists and is given by PGM. The theorem of Naimark states that a POVM measurement on a system can be realized by augmenting the system with ancilla registers, applying a unitary operator, and then a projection-valued measurement on the ancilla. Seen in this light, the result in the study by Ettinger and Høyer [29] implies that the success probability of the optimal measurement is > 1 − 1 2 N if ν > 89 , though no efficient implementation is known.

Remark 4.9

In the classical world, if we have a probabilistic algorithm that succeeds with probability > 1 2 , we can run the algorithm multiple times on the same input to make the success probability arbitrarily close to 1. In the quantum world, we cannot, in general, reuse inputs that are quantum states, so running the quantum algorithm multiple times requires more quantum samples, unless one can clone the input samples. However, we will see in the last section that for some problems such as DCP, cloning the input samples is essentially equivalent to solving the original problem.

5 A probabilistic no-go result for DCP

First, a unitary no-go result for DCP.

Theorem 5.1

There is no unitary operation to compute the value of a into a register from a list of DCP samples for a.

Proof

Suppose there is a unitary operator U , which has the effect:

(5.2) U ∣ A ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ 0 ⟩ = ∣ Σ a ( ψ a ) ⟩ ∣ a ⟩ ,

for every a , i.e., U takes a list of DCP samples for fixed but unknown a , a blank initialization state ∣ 0 ⟩ , and an ancilla state ∣ A ⟩ , and then computes a into the blank register.

For any other b ≠ a , we must also have

(5.3) U ∣ A ⟩ ∣ ψ b 1 ⟩ ⋯ ∣ ψ b m ⟩ ∣ 0 ⟩ = ∣ Σ b ( ψ b ) ⟩ ∣ b ⟩ .

There are choices of ψ c i for i = 1 , … , m such that

(5.4) ⟨ ψ a i ∣ ψ b i ⟩ = 1 2 ,

for all a ≠ b and i = 1 , … m . To see this, recall the states

ψ a = 1 2 ( ∣ x α ⟩ + ∣ y x a − α ⟩ ) , ψ b = 1 2 ( ∣ x β ⟩ + ∣ y x b − β ⟩ ) ,

which have possible inner product ⟨ ψ a ∣ ψ b ⟩ ∈ 0 , 1 2 , 1 , and there are choices of ψ a and ψ b such that

(5.5) ⟨ ψ a ∣ ψ b ⟩ ≠ 0 , 1 ,

for instance, if a ≠ b and a − α = b − β or α = β . In particular, taking

ψ c i = ∣ x c ⟩ + ∣ y x 0 ⟩ ,

for c ∈ Z ∕ N Z , satisfies (5.4).

Taking the inner product of (5.2) and (5.3), we obtain

(5.6) ⟨ ψ a 1 ∣ ψ b 1 ⟩ ⋯ ⟨ ψ a m ∣ ψ b m ⟩ = ⟨ Σ a ( ψ a ) ∣ Σ b ( ψ b ) ⟩ ⟨ a ∣ b ⟩ = 0 ,

a contradiction as we have shown that there are choices of ψ a i and ψ b i , making the left-hand side of (5.6) non-zero.□

We will give yet another proof of Theorem 5.1 in Theorem 6.15. The proof of Theorem 5.1 mirrors the proof of the no cloning theorem [34] and precludes unitary operations, but not more general quantum algorithms, which may allow for approximate outputs, probabilistic processes, or post-processing. Indeed, computing the exact value of a into a register is rather strong: even in the finite cyclic group case, the standard algorithm only determines a generator for the hidden subgroup using a process of the type given in Theorem 3.15.

The following is a probabilistic no-go result for DCP based on modifying the proof of the unitary no-go result for DCP.

Theorem 5.7

The problem of determining a, given a list of m DCP samples for unknown a, is not unitarily solvable with a success parameter independent of a, i.e., ≥ 1 − 1 9 ⋅ 2 − 2 m .

Proof

To ease notation, we let

(5.8) ψ a = ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ,

(5.9) ψ b = ∣ ψ b 1 ⟩ ⋯ ∣ ψ b m ⟩ .

Suppose that there is a unitary operator U , which has the effect:

(5.10) U ∣ A ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ 0 ⟩ = ∣ Σ a ( ψ a ) ⟩ ∣ a ⟩ + ∑ c ≠ a ∣ Σ c ( ψ a ) ⟩ ∣ c ⟩ ,

(5.11) U ∣ A ⟩ ∣ ψ b 1 ⟩ ⋯ ∣ ψ b m ⟩ ∣ 0 ⟩ = ∣ Σ b ( ψ b ) ⟩ ∣ b ⟩ + ∑ c ≠ b ∣ Σ c ( ψ b ) ⟩ ∣ c ⟩ ,

where

(5.12) ∣ Σ a ( ψ a ) ∣ 2 ≥ 1 − 2 − δ , ∣ Σ b ( ψ b ) ∣ 2 ≥ 1 − 2 − δ ,

and δ is to be chosen.

Because of (5.12), we have that

(5.13) ∑ c ≠ a ∣ Σ c ( ψ a ) ∣ 2 < 2 − δ , ∑ c ≠ b ∣ Σ c ( ψ b ) ∣ 2 < 2 − δ .

Taking the inner product of (5.10) and (5.11), we obtain

(5.14) ⟨ ψ a 1 ∣ ψ b 1 ⟩ ⋯ ⟨ ψ a m ∣ ψ b m ⟩ ≤ ∣ ⟨ Σ a ( ψ a ) ∣ Σ a ( ψ b ) ⟩ ∣ + ∣ ⟨ Σ b ( ψ a ) ∣ Σ b ( ψ b ) ⟩ ∣ + ∑ c ≠ a , b ∣ ⟨ Σ c ( ψ a ) ∣ Σ c ( ψ b ) ⟩ ∣ ≤ ∣ ⟨ Σ a ( ψ a ) ∣ Σ a ( ψ b ) ⟩ ∣ + ∣ ⟨ Σ b ( ψ a ) ∣ Σ b ( ψ b ) ⟩ ∣ + 2 − δ ≤ 2 − δ + 2 ⋅ 2 − δ ∕ 2 < 3 ⋅ 2 − δ ,

using Cauchy–Schwartz repeatedly. Arrange the left-side of (5.14) to be 2 − m as in (5.5), and we see that choosing δ ≥ 2 ( m + log 2 3 ) gives a contradiction to the aforementioned inequality.□

Remark 5.15

At fixed ν = m ∕ log 2 N , Theorem 5.7 gives an upper bound on the success parameter of

(5.16) 1 − 2 − 2 ( ν log 2 N + log 2 3 ) = 1 − 1 9 N − 2 ν .

Although the bound in (5.16) seems far from optimal (see Remark 4.8), it is still stronger than trivial bounds, which result from (4.7) [24, Theorem 2] or [30] when ν ≥ 1 .

6 Quantum cloning and DCP

In this section, we explain a connection between DCP and quantum cloning. Although the topics in this section are not needed for the results of the previous section, the connection with quantum cloning helped motivate the proofs of the previous section, so we have included it for completeness.

By copying a state ∣ ψ ⟩ , we mean forming the composite state ∣ A ⟩ ∣ ψ ⟩ ∣ 0 ⟩ for a blank initialization state ∣ 0 ⟩ and ancilla state ∣ A ⟩ , and applying a quantum algorithm to produce the state ∣ Σ ( ψ ) ⟩ ∣ ψ ⟩ ∣ ψ ⟩ .

The no cloning theorem asserts that there is no unitary operation that can copy a general unknown quantum state. However, if the states are chosen from a known set of mutually orthogonal states, it is well known that cloning is possible, as shown for completeness in the following proposition.

Proposition 6.1

Let ∣ ψ a ; 1 ⟩ , … , ∣ ψ a ; m ⟩ be a set of mutually orthogonal states that depend on a parameter a. Suppose ∣ ψ ⟩ = ∣ ψ a , i ⟩ for some index i (which is unknown).

If the value of a is known and we can encode a unitary operator U a such that U a ∣ ψ a ; i ⟩ = ∣ i ⟩ , then there is a unitary operation that copies ∣ ψ ⟩ .

Proof

First, note that we can copy any state ∣ i ⟩ of the computational basis. Start with

∣ i ⟩ ∣ 0 ⟩ = ∣ i n ⟩ … ∣ i 0 ⟩ ∣ 0 ⟩ … ∣ 0 ⟩ ,

where we have encoded the last two registers into n qubits, for n large enough.

Applying a CNOT gate to the j th and ( j + n + 1 ) th qubits ∣ i j ⟩ ∣ 0 ⟩ produces ∣ i j ⟩ ∣ i j ⟩ for every j . Hence, we can produce the state

∣ i n ⟩ … ∣ i 0 ⟩ ∣ i n ⟩ … ∣ i 0 ⟩ = ∣ i ⟩ ∣ i ⟩ .

The unitary operator U a has the effect:

U a ∣ ψ a ; i ⟩ = ∣ i ⟩ .

Starting with

∣ ψ a ; i ⟩ ∣ 0 ⟩ ,

apply U a to the first register to obtain

∣ i ⟩ ∣ 0 ⟩ .

Copy the state ∣ i ⟩ to obtain

∣ i ⟩ ∣ i ⟩ .

Applying U a − 1 to both pairs of registers gives

□ ∣ ψ a ; i ⟩ ∣ ψ a ; i ⟩ .

Remark 6.2

Since a is known, to encode U a , we can use universality results (c.f. [35, §4.5] or the Solovay–Kitaev Theorem [35, Appendix 3] for a fault-tolerant version).

Later, we will need a slightly stronger version of Proposition 6.1.

Proposition 6.3

Let ∣ ψ a ; 1 ⟩ , … , ∣ ψ a ; m ⟩ be a set of mutually orthogonal states that depend on a parameter a, and assume that we can encode a unitary operator T such that T ∣ a ⟩ ∣ ψ a ; i ⟩ = ∣ a ⟩ ∣ i ⟩ .

Suppose ∣ ψ ⟩ = ∣ ψ a ; i ⟩ for some index i (which is unknown). If we have the value of a in a register, then there is a unitary operation that copies ∣ ψ ⟩ .

Proof

Starting with

∣ a ⟩ ∣ ψ a , i ⟩ ∣ 0 ⟩ ∣ 0 ⟩ ,

apply T to obtain

∣ a ⟩ ∣ i ⟩ ∣ 0 ⟩ ∣ 0 ⟩ .

Copy the states ∣ a ⟩ and ∣ i ⟩ to obtain

∣ a ⟩ ∣ i ⟩ ∣ a ⟩ ∣ i ⟩ .

Applying T − 1 to both pairs of registers gives

∣ a ⟩ ∣ ψ a , i ⟩ ∣ a ⟩ ∣ ψ a , i ⟩ ,

which we can permute to obtain

□ ∣ a ⟩ ∣ ψ a , i ⟩ ∣ ψ a , i ⟩ ∣ a ⟩ .

Proposition 6.4

If we can copy any given DCP sample

(6.5) ψ a ; α = 1 2 ( ∣ x α ⟩ + ∣ y x a − α ⟩ ) ,

to produce a state of the form:

(6.6) ψ a ; α ⊗ ψ a ; α = 1 2 ( ∣ x α ⟩ + ∣ y x a − α ⟩ ) ⊗ 1 2 ( ∣ x α ⟩ + ∣ y x a − α ⟩ ) ,

then we can determine the value of a from DCP samples for a.

If a is known, then we can copy any given DCP sample for a using a unitary operation.

Proof

Given samples of the form (6.6), we measure both registers, and with probability 1/2, we obtain

(6.7) ∣ x α ⟩ ∣ y x a − α ⟩ or ∣ y x a − α ⟩ ∣ x α ⟩ .

The sum of the observed exponents of the two registers gives a .

If a is known, then DCP samples for a ,

ψ a ; α = 1 2 ( ∣ x α ⟩ + ∣ y x a − α ⟩ ) ,

are chosen from a set of mutually orthogonal states depending on the parameter a . By Proposition 6.1, for each sample of the form (6.5), we can copy it to produce a sample of the form (6.6).□

Remark 6.8

Copying a DCP sample up to parity would allow us to determine the parity of a , and vice versa.

Theorem 6.9

If a is unknown, there is no unitary operation, which from a list of DCP samples for a, copies an additional DCP sample for the same a, while leaving the list of DCP samples alone.

Proof

Suppose that there is a unitary operator U that transforms

(6.10) U ∣ A ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ ψ a ⟩ ∣ 0 ⟩ = ∣ Σ a ( ψ a ) ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ ψ a ⟩ ∣ ψ a ⟩ ,

where ψ a = ψ a ; α = 1 2 ( ∣ x α ⟩ + ∣ y x a − α ⟩ ) is a DCP sample for a fixed, and α randomly chosen for each such state. We are supposing that U performs the aforementioned operation for any (unknown) a . Thus, we also have that

(6.11) U ∣ A ⟩ ∣ ψ b 1 ⟩ ⋯ ∣ ψ b m ⟩ ∣ ψ b ⟩ ∣ 0 ⟩ = ∣ Σ b ( ψ b ) ⟩ ∣ ψ b 1 ⟩ ⋯ ∣ ψ b m ⟩ ∣ ψ b ⟩ ∣ ψ b ⟩ ,

for any other b .

Taking the inner product of both sides of (6.10) and (6.11), we deduce

(6.12) ⟨ ψ a 1 ∣ ψ b 1 ⟩ ⋯ ⟨ ψ a m ∣ ψ b m ⟩ ⟨ ψ a ∣ ψ b ⟩ = ⟨ ψ a 1 ∣ ψ b 1 ⟩ ⋯ ⟨ ψ a m ∣ ψ b m ⟩ ⟨ ψ a ∣ ψ b ⟩ 2 ⟨ Σ a ( ψ a ) ∣ Σ b ( ψ b ) ⟩ .

However, there are choices of ψ a i , ψ b i for i = 1 , … , m , and ψ a , ψ b , which do not satisfy (6.12) from (5.5).

We may thus suppose without loss of generality that ⟨ ψ a i ∣ ψ b i ⟩ ≠ 0 , 1 for all i = 1 , … , N , and hence, (6.12) becomes

⟨ ψ a ∣ ψ b ⟩ = ⟨ ψ a ∣ ψ b ⟩ 2 ⟨ Σ a ( ψ a ) ∣ Σ b ( ψ b ) ⟩ .

We obtain a contradiction again by choosing ψ a and ψ b so that ⟨ ψ a ∣ ψ b ⟩ ≠ 0 , 1 as then

(6.13) ∣ ⟨ ψ a ∣ ψ b ⟩ ∣ = 1 2 ,

(6.14)□ ∣ ⟨ ψ a ∣ ψ b ⟩ 2 ⟨ Σ a ( ψ a ) ∣ Σ b ( ψ b ) ⟩ ∣ ≤ 1 4 .

The following is another proof of Theorem 5.1 using the connection with quantum cloning.

Theorem 6.15

There is no unitary operation to compute the value of a into a register from a list of DCP samples for a.

Proof

Suppose that there is a unitary operator U , which has the effect

(6.16) U ∣ A ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ 0 ⟩ = ∣ Σ a ( ψ a ) ⟩ ∣ a ⟩ ,

i.e., U takes a list of DCP samples for fixed but unknown a , a blank initialization state ∣ 0 ⟩ , and an ancilla state ∣ A ⟩ , and then computes a into the blank register.

Using an additional blank register and copying ∣ a ⟩ , there is a unitary operator U ′ with the effect:

(6.17) U ′ ∣ A ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ 0 ⟩ ∣ 0 ⟩ = ∣ Σ a ( ψ a ) ∣ a ⟩ ∣ a ⟩ .

Use U − 1 and permute ∣ a ⟩ and ∣ 0 ⟩ to obtain

(6.18) ∣ A ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ a ⟩ ∣ 0 ⟩ .

Thus, without loss of generality, we may assume the unitary operator U has the effect:

U ∣ A ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ 0 ⟩ = ∣ A ⟩ ∣ ψ a 1 ⟩ ⋯ ∣ ψ a m ⟩ ∣ a ⟩ ,

i.e., U takes a list of DCP samples for fixed but unknown a , a blank initialization state ∣ 0 ⟩ , and an ancilla state ∣ A ⟩ , and then computes a into the blank register, while leaving the list of DCP samples alone.

Now, note that DCP samples ψ a ; α can be encoded using two registers as:

1 2 ( ∣ 0 ⟩ ∣ α ⟩ + ∣ 1 ⟩ ∣ a − α ⟩ ) .

The unitary operator V , which sends

V ∣ a ⟩ ∣ 0 ⟩ ∣ α ⟩ = ∣ a ⟩ ∣ 0 ⟩ ∣ α ⟩ , V ∣ a ⟩ ∣ 1 ⟩ ∣ α ⟩ = ∣ a ⟩ ∣ 1 ⟩ ∣ a − α ⟩ ,

will have the effect:

V ∣ a ⟩ ∣ ψ a ; α ⟩ = ∣ a ⟩ 1 2 ( ∣ 0 ⟩ + ∣ 1 ⟩ ) ∣ α ⟩ .

Using a Hadamard gate, we can encode a unitary operator U 0 such that

U 0 1 2 ( ∣ 0 ⟩ + ∣ 1 ⟩ ) ∣ α ⟩ = ∣ 0 ⟩ ∣ α ⟩ , U 0 1 2 ( ∣ 0 ⟩ − ∣ 1 ⟩ ) ∣ α ⟩ = ∣ 1 ⟩ ∣ α ⟩ .

Then, the unitary operator ( I ⊗ U 0 ) V has the effect:

( I ⊗ U 0 ) V ∣ a ⟩ ∣ ψ a ; α ⟩ = ∣ a ⟩ ∣ 0 ⟩ ∣ α ⟩ .

We can thus apply Proposition 6.3 to copy an additional DCP sample for the same a using a unitary operation, while leaving the list of DCP samples alone. This contradicts Theorem 6.9.□

7 Conclusion

The quantum hardness of the HSP for the dihedral group has important implications for post-quantum cryptography due to connections with LWE. The standard algorithm fails to provide a quantum speedup compared to cyclic groups, and there is a qualitative difference in the success probabilities of the optimal measurements for solving the coset sampling problem on the two groups.

Further work on understanding obstructions to efficiently implementing optimal measurements or new methods for quantum speed up are needed to resolve the question of its quantum hardness. On the other hand, it may be possible that DCP is harder than LWE, so EDCP could be the more relevant problem to study.

Acknowledgements

We would like to thank P. Høyer for helpful comments and bringing to our attention [13]. We also thank R. Goenka and N. de Silva for stimulating discussions related to the topics of this article.

Funding information: This work was supported by a NSERC Discovery Grant RGPIN-2017-03892 (Imin Chen) NSERC USRA 2020 (David Sun).
Author contributions: The authors contributed equally to the conception, design, execution, or interpretation of the reported study.
Conflict of interest: The authors state no conflict of interest.
Data availability statement: All data generated or analyzed during this study are included in this published article.

References

[1] Kitaev A. Quantum computations: Algorithms and error correction. Russian Math Surveys. 1997;52:1191–249. 10.1070/RM1997v052n06ABEH002155Search in Google Scholar

[2] Mosca M. The abelian hidden subgroup problem. in: Encyclopedia of Algorithms M.-Y. Kao, (Ed.), New York: Springer; 2016. p. 1–4. 10.1007/978-1-4939-2864-4_1Search in Google Scholar

[3] Grigni M, Schulman L, Vazirani M, Vazirani U. Quantum mechanical algorithms for the nonabelian hidden subgroup problem. Combinatorica. 2004;24(1):137–54. 10.1007/s00493-004-0009-8Search in Google Scholar

[4] Hallgren S, Russell A, Ta-Shma A. The hidden subgroup problem and quantum computation using group representations. SIAM J Comput. 2003;32(4):916–834. 10.1137/S009753970139450XSearch in Google Scholar

[5] Shor P. Algorithms for quantum computation: discrete logarithms and factoring. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS);1994. p. 124–34. 10.1109/SFCS.1994.365700Search in Google Scholar

[6] Jozsa R. Quantum factoring, discrete logarithms, and the hidden subgroup problem. Comput Sci Eng. March–April 2001;3(2):34–43, https://doi.org/10.1109/5992.909000. Search in Google Scholar

[7] Beals R. Quantum computation of Fourier transforms over symmetric groups. in: Proceedings 29th Annual ACM Symposium on Theory of Computing (El Paso, Texas), ACM Press, 1997. 10.1145/258533.258548Search in Google Scholar

[8] Boneh R, Lipton R. Quantum cryptoanalysis of hidden linear functions. Advances in Cryptology - Crypto ’95, Lecture Notes in Computer Science. vol. 963, Berlin: Springer-Verlag; 1995. p. 424–37. 10.1007/3-540-44750-4_34Search in Google Scholar

[9] Ettinger M, Høyer P. A quantum observable for the graph isomorphism problem. 1999, https://arxiv.org/abs/quant-ph/9901029. Search in Google Scholar

[10] Høyer P. Efficient quantum transforms. 1997. https://arxiv.org/abs/quant-ph/9702028. Search in Google Scholar

[11] Moore C, Russell A, Schulman L. The symmetric group defies strong Fourier sampling. SIAM J Comput. 2008;37(6):1842–64. 10.1137/050644896Search in Google Scholar

[12] Regev O. Quantum computation and lattice problems. SIAM J Comput. 2004;33(3):738–60. 10.1137/S0097539703440678Search in Google Scholar

[13] Kuperberg G. A subexponential-time quantum algorithm for the dihedral hidden subgroup problem. SIAM J Comput. 2005;35(1):170–88. 10.1137/S0097539703436345Search in Google Scholar

[14] Regev O. A subexponential time algorithm for the dihedral hidden subgroup problem with polynomial space. 2004. https://arxiv.org/abs/:quant-ph/0406151. Search in Google Scholar

[15] Kuperberg G. Another subexponential-time quantum algorithm for the dihedral hidden subgroup problem, 8th Conference on the theory of quantum computation. Communication and Cryptography. vol. 22, 2013, p. 20–34. Search in Google Scholar

[16] Castryck W, Dooms A, Emerencia C, Lemmens A. A fusion algorithm for solving the hidden shift problem in finite Abelian groups, post-quantum cryptography. Lecture Notes in Computer Science. vol. 12841, Cham: Springer; 2021. p. 133–53. 10.1007/978-3-030-81293-5_8Search in Google Scholar

[17] Childs A, Jao D, Soukharev V. Constructing elliptic curve isogenies in quantum subexponential time. J Math Cryptol. 2014;8:1–29. 10.1515/jmc-2012-0016Search in Google Scholar

[18] Biasse JF, Jao D, Sankar A. A quantum algorithm for computing isogenies between supersingular elliptic curves. in: Meier, W., Mukhopadhyay, D. (eds) Progress in Cryptology - INDOCRYPT 2014, Lecture Notes in Computer Science, vol. 8885, Cham: Springer; 2014. 10.1007/978-3-319-13039-2_25Search in Google Scholar

[19] Castryck W, Decru T. An efficient key recovery attack on SIDH, Cryptology ePrint Archive. 2022, https://eprint.iacr.org/2022/975. Search in Google Scholar

[20] Maino L, Martindale C. An attack on SIDH with arbitrary starting curve. Cryptology ePrint Archive. 2022. https://eprint.iacr.org/2022/1026. Search in Google Scholar

[21] Robert D. Breaking SIDH in polynomial time. Cryptology ePrint Archive. 2022. https://eprint.iacr.org/2022/1038. Search in Google Scholar

[22] Brakerski Z, Kirshanova E, Stehlé D, Wen W. Learning with errors and extrapolated dihedral cosets. In: Abdalla, M., Dahab, R. (eds) Public-Key Cryptography - PKC 2018. Lecture Notes in Computer Science, vol. 10770, Cham: Springer; 2018. 10.1007/978-3-319-76581-5_24Search in Google Scholar

[23] Kobayashi H, Le Gall F. Dihedral hidden subgroup problem: a survey. IPSJ J. 2005;46(10):2409–16. 10.2197/ipsjdc.1.470Search in Google Scholar

[24] Bacon D, Childs A, van Dam W. Optimal measurements for the dihedral hidden subgroup problem. Chicago J Theoretical Comp Sci. 2006;2006:2. Search in Google Scholar

[25] Lomont C. The hidden subgroup problem - review and open problems. 2004, https://arxiv.org/abs/quant-ph/0411037. Search in Google Scholar

[26] Hales L, Hallgren S. Improved quantum Fourier transform algorithm and applications. in: Proceedings of the 41st Annual Symposium on Foundations of Computer Science (Redondo Beach, California), FOCS, 2000. Search in Google Scholar

[27] Nymann J. On the probability that k positive integers are relatively prime. J Number Theory. 1972;4:469–73. 10.1016/0022-314X(72)90038-8Search in Google Scholar

[28] Childs A. Lecture Notes on Quantum Algorithms. https://www.cs.umd.edu/amchilds/qa/. Search in Google Scholar

[29] Ettinger M, Høyer P. On quantum algorithms for noncommutative hidden subgroups. Adv Appl Math. 2000;25:239–251. 10.1006/aama.2000.0699Search in Google Scholar

[30] Moore C, Russell A. For distinguishing conjugate hidden subgroups, the pretty good measurement is as good as it gets. Quantum Inform Comput. 2007;7:752–65. 10.26421/QIC7.8-5Search in Google Scholar

[31] Schoof R. Nonsingular plane cube curves over finite fields. J Comb Theory Series A. 1987;46(2):183–211. 10.1016/0097-3165(87)90003-3Search in Google Scholar

[32] Ettinger M, Høyer P. The quantum query complexity of the hidden subgroup problem is polynomial. Inform Process Lett. 2004;91(1):43–8. 10.1016/j.ipl.2004.01.024Search in Google Scholar

[33] Ettinger M, Høyer P. Quantum state detection via elimination. 1999. https://arxiv.org/abs/quant-ph/9905099. Search in Google Scholar

[34] Wootters WK, Zurek WH. A single quantum cannot be cloned. Nature. 1982;299:802–3. 10.1038/299802a0Search in Google Scholar

[35] Nielsen M, Chuang I. Quantum computation and quantum information. Cambridge: Cambridge University Press; 2000. Search in Google Scholar

Received: 2022-10-06

Revised: 2023-04-25

Accepted: 2023-08-23

Published Online: 2024-03-16

This work is licensed under the Creative Commons Attribution 4.0 International License.

Articles in the same Issue

https://doi.org/10.1515/jmc-2022-0029

Keywords for this article

quantum computation; hidden subgroup problem

Creative Commons

BY 4.0