Optimal Merging in Quantum k -xor and k -sum Algorithms Mara - PowerPoint PPT Presentation

Optimal Merging in Quantum k -xor and k -sum Algorithms María Naya-Plasencia, André Schrottenloher Inria, France

Merging with many Solutions Quantum Merging With a Single Solution Outline Merging with many Solutions 1 Quantum Merging 2 With a Single Solution 3 María N.-P., André S. Quantum Merging Algorithms 2/28

Merging with many Solutions Quantum Merging With a Single Solution Generalized Birthday Problem(s) In this talk ( ⊕ can be replaced by + ): Problem 1: “oracle” Given oracle access to a random n -bit to n -bit function H , find x 1 , . . . x k such that H ( x 1 ) ⊕ . . . ⊕ H ( x k ) = 0. Problem 2: “unique solution” Given oracle access to a random n / k -bit to n -bit function H , find the single k -tuple x 1 , . . . x k such that H ( x 1 ) ⊕ . . . ⊕ H ( x k ) = 0. María N.-P., André S. Quantum Merging Algorithms 3/28

Merging with many Solutions Quantum Merging With a Single Solution Applications Subset-sum: given n integers a 0 , . . . a n − 1 on poly ( n ) bits, find a binary ¯ e such that a · ¯ ¯ e = 0 = ⇒ reduces to k -sum Parity check problem: given P ( X ) of degree n , find a low-weight multiple of P = ⇒ reduces to k -sum LPN: given samples a , a · s + e with n -bit uniform random a and Bernoulli noise e , find s = ⇒ reduces to k -sum Multiple-encryption: given a few plaintext-ciphertext pairs ( x , E k 1 ◦ . . . ◦ E k r ( x )) , find the independent keys k 1 , . . . k r = ⇒ similar algorithms applicable María N.-P., André S. Quantum Merging Algorithms 4/28

Merging with many Solutions Quantum Merging With a Single Solution Merging with many Solutions María N.-P., André S. Quantum Merging Algorithms 5/28

Merging with many Solutions Quantum Merging With a Single Solution Known classical complexities To get a k -xor on n bits (with oracle access to H : { 0 , 1 } n → { 0 , 1 } n ): The optimal query complexity is Θ( 2 n / k ) � 2 n / ( 1 + ⌊ log 2 ( k ) ⌋ ) � The time complexity is O * Logarithmic improvements in time (but we focus on exponents ) * Wagner, “A Generalized Birthday Problem” , CRYPTO 02 María N.-P., André S. Quantum Merging Algorithms 6/28

Merging with many Solutions Quantum Merging With a Single Solution Wagner’s algorithm in a single slide Merging From two lists L 1 , L 2 of outputs of H , compute the join L 1 ⊲ ⊳ u L 2 : the pairs x 1 , x 2 ∈ L 1 × L 2 with x 1 ⊕ x 2 | u = 0 (partial collision on u bits). All lists are presumed sorted, the time is: MAX ( | L 1 ⊲ ⊳ u L 2 | , MIN ( | L 1 | , | L 2 | )) Wagner’s algorithm is a sequence of pairwise joins The strategy (optimal u ) depends on ⌊ log 2 ( k ) ⌋ ; we merge 2 ⌊ log 2 ( k ) ⌋ lists Wagner, “A Generalized Birthday Problem” , CRYPTO 02 María N.-P., André S. Quantum Merging Algorithms 7/28

Merging with many Solutions Quantum Merging With a Single Solution An example with k = 4 Query 2 n / 3 elements for each list 1 L 1 of size L 2 of size L 3 of size L 4 of size 2 n / 3 2 n / 3 2 n / 3 2 n / 3 María N.-P., André S. Quantum Merging Algorithms 8/28

Merging with many Solutions Quantum Merging With a Single Solution An example with k = 4 Query 2 n / 3 elements for each list 1 Compute the joins L 1 ⊲ ⊳ n / 3 L 2 and L 3 ⊲ ⊳ n / 3 L 4 2 L 1 of size L 2 of size L 3 of size L 4 of size 2 n / 3 2 n / 3 2 n / 3 2 n / 3 L 1 ⊲ ⊳ n / 3 L 2 L 3 ⊲ ⊳ n / 3 L 4 of size 2 n / 3 of size 2 n / 3 María N.-P., André S. Quantum Merging Algorithms 8/28

Merging with many Solutions Quantum Merging With a Single Solution An example with k = 4 1. Query 4 lists of x , H ( x ) : L 1 , L 2 , L 3 , L 4 of size 2 n / 3 ⊳ n / 3 L 4 of size 2 n / 3 2. Compute the joins L 1 ⊲ ⊳ n / 3 L 2 and L 3 ⊲ 3. Compute the join ( L 1 ⊲ ⊳ n / 3 L 2 ) ⊲ ⊳ 2 n / 3 ( L 3 ⊲ ⊳ n / 3 L 4 ) of size 1 L 1 of size L 2 of size L 3 of size L 4 of size 2 n / 3 2 n / 3 2 n / 3 2 n / 3 L 1 ⊲ ⊳ n / 3 L 2 L 3 ⊲ ⊳ n / 3 L 4 of size 2 n / 3 of size 2 n / 3 Single 4-xor to 0 on n bits María N.-P., André S. Quantum Merging Algorithms 8/28

Merging with many Solutions Quantum Merging With a Single Solution Known quantum complexities To get a k -xor on n bits (with quantum oracle access to H ): � 2 n / ( k + 1 ) � The optimal query complexity is Θ * � 2 n / 3 � � 2 n / 3 � For k = 2 (collisions), the time is � O using O classical memory with quantum access (QACM) 1 For any k , exponent α k = 2 + ⌊ log 2 ( k ) ⌋ ) using quantum memory with quantum access (QAQM) * Belovs and Spalek, “Adversary lower bound for the k -sum problem” , ACM 13 Brassard, Høyer, and Tapp, “Quantum Cryptanalysis of Hash and Claw-Free Functions” , LATIN Grassi, Naya-Plasencia, and S., “Quantum Algorithms for the k -xor Problem” , AC 18 María N.-P., André S. Quantum Merging Algorithms 9/28

Merging with many Solutions Quantum Merging With a Single Solution Previous exponents (with QAQM) Classical time 0 . 5 Quantum time [AC 18] time = � 0 . 4 O ( 2 α k n ) α k 0 . 3 0 . 2 0 . 1 5 10 15 20 k María N.-P., André S. Quantum Merging Algorithms 10/28

Merging with many Solutions Quantum Merging With a Single Solution Our results (with QACM) Classical 0 . 5 [AC 18] New 0 . 4 time = � O ( 2 α k n ) α k 0 . 3 0 . 2 0 . 1 5 10 15 20 k María N.-P., André S. Quantum Merging Algorithms 11/28

Merging with many Solutions Quantum Merging With a Single Solution Quantum Merging María N.-P., André S. Quantum Merging Algorithms 12/28

Merging with many Solutions Quantum Merging With a Single Solution Classical search Let X = G ∪ B ���� ���� ���� Search space, Good ones, Bad ones, size N − T size N size T Let Sample and Test be functions to sample x from X and test if x ∈ G , in time t Sample and t Test . There exists a function Sample G that samples from G in time: � � N t Sample + t Test T ⇒ we transform a sampling procedure for the “search space” into a sampling procedure for the “solution space”. María N.-P., André S. Quantum Merging Algorithms 13/28

Merging with many Solutions Quantum Merging With a Single Solution Quantum search X = G ∪ B ���� ���� ���� Search space, Good ones, Bad ones, size N − T size N size T Let QSample and QTest be quantum algorithms to sample X and test if x ∈ G , in time t Sample and t Test . There exists an algorithm QSample G that samples G in time: � � � N t QSample + t QTest T Grover, “A Fast Quantum Mechanical Algorithm for Database Search” , STOC 96 Brassard et al., “Quantum amplitude amplification and estimation” , Contemp. Math. 02 María N.-P., André S. Quantum Merging Algorithms 14/28

Merging with many Solutions Quantum Merging With a Single Solution Classical merging as a sampling procedure Sampling from L List L 1 List L 2 We sample from list L 1 u -bit prefix u -bit prefix We try to match against list L 2 � 2 c � List L = L 1 ⊲ ⊳ c L 2 t Sample ( L ) = max | L 2 | , 1 t Sample ( L 1 ) size | L | = | L 1 || L 2 | / 2 c prefix u + c Computing the full “join” ⊲ ⊳ means sampling from L repeatedly. María N.-P., André S. Quantum Merging Algorithms 15/28

Merging with many Solutions Quantum Merging With a Single Solution Depth-first traversal of Wagner’s tree We sample from L 0 (the solution) once. L 1 of size L 2 of size L 3 of size L 4 of size 2 n / 3 2 n / 3 2 n / 3 2 n / 3 L 1 ⊲ ⊳ n / 3 L 2 L 3 ⊲ ⊳ n / 3 L 4 of size 2 n / 3 of size 2 n / 3 L 0 of size 1 María N.-P., André S. Quantum Merging Algorithms 16/28

Merging with many Solutions Quantum Merging With a Single Solution Depth-first traversal of Wagner’s tree We sample from L 0 (the solution) once. ⊳ L 2 2 n / 3 times. = ⇒ we sample from L 1 ⊲ L 1 of size L 2 of size L 3 of size L 4 of size 2 n / 3 2 n / 3 2 n / 3 2 n / 3 L 1 ⊲ ⊳ n / 3 L 2 L 3 ⊲ ⊳ n / 3 L 4 of size 2 n / 3 of size 2 n / 3 L 0 of size 1 María N.-P., André S. Quantum Merging Algorithms 16/28

Merging with many Solutions Quantum Merging With a Single Solution Depth-first traversal of Wagner’s tree We sample from L 0 (the solution). ⊳ L 2 2 n / 3 times. = ⇒ we sample from L 1 ⊲ ⇒ we sample from L 1 2 n / 3 times. = L 1 of size L 2 of size L 3 of size L 4 of size 2 n / 3 2 n / 3 2 n / 3 2 n / 3 L 1 ⊲ ⊳ n / 3 L 2 L 3 ⊲ ⊳ n / 3 L 4 of size 2 n / 3 of size 2 n / 3 L 0 of size 1 María N.-P., André S. Quantum Merging Algorithms 16/28

Merging with many Solutions Quantum Merging With a Single Solution Quantum merging Sampling from L List L 1 List L 2 We sample from list L 1 u -bit prefix u -bit prefix We try to match against list L 2 We have a square-root speedup List L = L 1 ⊲ ⊳ c L 2 size | L | = | L 1 || L 2 | / 2 c � � 2 c � prefix u + c t QSample ( L ) = max | L 2 | , 1 t QSample ( L 1 ) María N.-P., André S. Quantum Merging Algorithms 17/28

Merging with many Solutions Quantum Merging With a Single Solution 4-xor example “The time of the red branch is reduced to a square-root.” (Quantum) sampling from L 1 : time 1 Sampling from L 1 ⊲ ⊳ n / 3 L 2 : time 1 again Sampling from L 0 : 2 n / 6 instead of 2 n / 3 L 1 of size L 2 of size L 3 of size L 4 of size 2 n / 3 2 n / 3 2 n / 3 2 n / 3 L 1 ⊲ ⊳ n / 3 L 2 L 3 ⊲ ⊳ n / 3 L 4 of size 2 n / 3 of size 2 n / 3 L 0 of size 1 María N.-P., André S. Quantum Merging Algorithms 18/28