On the practicality of quantum sieving algorithms for the shortest vector problem

2024-10-17

IACR Cryptology ePrint Archive

AI Summary

This work investigates the quantum feasibility of solving the Shortest Vector Problem (SVP)—a foundational hard problem in lattice-based cryptography—specifically assessing whether quantum sieving algorithms yield practical quantum advantage under NIST-recommended parameters (e.g., dimension 400). Method: We develop the first non-asymptotic, end-to-end resource model integrating quantum random-access memory (QRAM), fixed-point quantum arithmetic, surface-code error correction, multi-physical-qubit architecture, and optimized Grover search. Contribution/Results: Under optimistic hardware assumptions, solving SVP in dimension 400 requires approximately $10^{13}$ physical qubits and $10^{31}$ years of runtime—equivalent to the classical computational effort of a 6 GHz single-core CPU. This confirms no meaningful quantum speedup is attainable with foreseeable hardware. Our model establishes the first realistic, hardware-constrained resource estimation framework for lattice cryptanalysis, systematically refuting the near-term breakability of moderately dimensional lattice schemes and providing a critical security boundary for post-quantum cryptographic migration.

Technology Category

• Machine Learning: Quantum Machine Learning
• Search and Optimization: Non-convex Optimization
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Security and Privacy: Applications of cryptography
• Search and Retrieval-Augmented AI: Efficiency and scalability of Web search engines
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

One of the main candidates of post-quantum cryptography is lattice-based cryptography. Its cryptographic security against quantum attackers is based on the worst-case hardness of lattice problems like the shortest vector problem (SVP), which asks to find the shortest non-zero vector in an integer lattice. Asymptotic quantum speedups for solving SVP are known and rely on Grover's search. However, to assess the security of lattice-based cryptography against these Grover-like quantum speedups, it is necessary to carry out a precise resource estimation beyond asymptotic scalings. In this work, we perform a careful analysis on the resources required to implement several sieving algorithms aided by Grover's search for dimensions of cryptographic interests. For such, we take into account fixed-point quantum arithmetic operations, non-asymptotic Grover's search, the cost of using quantum random access memory (QRAM), different physical architectures, and quantum error correction. We find that even under very optimistic assumptions like circuit-level noise of $10^{-5}$, code cycles of 100 ns, reaction time of 1 $mu$s, and using state-of-the-art arithmetic circuits and quantum error-correction protocols, the best sieving algorithms require $approx 10^{13}$ physical qubits and $approx 10^{31}$ years to solve SVP on a lattice of dimension 400, which is roughly the dimension for minimally secure post-quantum cryptographic standards currently being proposed by NIST. We estimate that a 6-GHz-clock-rate single-core classical computer would take roughly the same amount of time to solve the same problem. We conclude that there is currently little to no quantum speedup in the dimensions of cryptographic interest and the possibility of realising a considerable quantum speedup using quantum sieving algorithms would require significant breakthroughs in theoretical protocols and hardware development.

Problem

• Assess quantum sieving practicality for SVP
• Estimate resources for Grover-aided algorithms
• Determine quantum speedup in cryptography dimensions

Innovation

• Grover's search aids sieving algorithms
• Quantum arithmetic operations enhance precision
• QRAM usage optimizes resource estimation