Abstract
We study quantum period finding algorithms such as Simon and Shor (and its variant Ekerå-Håstad). For a periodic function f these algorithms produce – via some quantum embedding of f – a quantum superposition ∑x |x〉 |f(x)〉, which requires a certain amount of output qubits that represent |f(x)〉. We show that one can lower this amount to a single output qubit by hashing f down to a single bit in an oracle setting.Namely, we replace the embedding of f in quantum period finding circuits by oracle access to several embeddings of hashed versions of f. We show that on expectation this modification only doubles the required amount of quantum measurements, while significantly reducing the total number of qubits. For example, for Simon’s algorithm that finds periods in f : Fn2 → Fn2 our hashing technique reduces the required output qubits from n down to 1, and therefore the total amount of qubits from 2n to n + 1. We also show that Simon’s algorithm admits real world applications with only n + 1 qubits by giving a concrete realization of a hashed version of the cryptographic Even-Mansour construction. Moreover, for a variant of Simon’s algorithm on Even-Mansour that requires only classical queries to Even-Mansour we save a factor of (roughly) 4 in the qubits.Our oracle-based hashed version of the Ekerå-Håstad algorithm for factoring n-bit RSA reduces the required qubits from (3/2 + o(1))n down to (1/2+ o(1))n.
Highlights
Throughout this paper, we consider only logical qubits that are error-free
There is steady progress in constructing larger quantum computers, within the years the number of qubits seems to be too limited for tackling problems of interesting size, e.g
Quantum computers with a very limited number of qubits might still serve as a powerful oracle that assists us in speeding up classical computations
Summary
Throughout this paper, we consider only logical qubits that are error-free. there is steady progress in constructing larger quantum computers, within the years the number of qubits seems to be too limited for tackling problems of interesting size, e.g. Since h(f (x)) = h(f (x )) for x = x happens for universal 1-bit range hash functions with probability 12 , the undesirable collisions put a probability weight of (roughly) 21 on measuring y = 0 in the input qubits This seems to be bad news, since neither in Simon’s algorithm does the zero vector y provide information about s, nor does in Shor’s algorithm the zero-multiple y of 2q−r provide information about d. The Ekerå-Håstad algorithm computes the factorization of an RSA modulus N = pq of bit-size n in time polynomial in n using ( 32 + o(1))n qubits, whereas our oracle-based hashed version reduces this to only ( 12 + o(1))n qubits.
Sign-in/Register to view highlights & summary 
Published Version
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call