Quantum Query Research Articles

On the Quantum Security of OCB

The OCB mode of operation for block ciphers has three variants, OCB1, OCB2 and OCB3. OCB1 and OCB3 can be used as secure authenticated encryption schemes whereas OCB2 has been shown to be classically insecure (Inoue et al., Crypto 2019). Even further, in the presence of quantum queries to the encryption functionality, a series of works by Kaplan et al. (Crypto 2016), Bhaumik et al. (Asiacrypt 2021) and Bonnetain et al. (Asiacrypt 2021) have shown how to break the unforgeability of the OCB modes. However, these works did not consider the confidentiality of OCB in the presence of quantum queries.We fill this gap by presenting the first formal analysis of the IND-qCPA security of OCB. In particular, we show the first attacks breaking the IND-qCPA security of the OCB modes. Surprisingly, we are able to prove that OCB2 is IND-qCPA secure when used without associated data, while relying on the assumption that the underlying block cipher is a quantum-secure pseudorandom permutation. Additionally, we present new quantum attacks breaking the universal unforgeability of OCB. Our analysis of OCB has implications for the post-quantum security of XTS, a well-known disk encryption standard, that was considered but mostly left open by Anand et al. (PQCrypto 2016).

Quantum and classical query complexities for generalized Simon's problem

Simon's problem is an essential example demonstrating the faster speed of quantum computers than classical computers for solving some problems. The optimal separation between exact quantum and classical query complexities for Simon's problem has been proved by Cai & Qiu. Generalized Simon's problem can be described as follows. Given a function f:{0,1}n→{0,1}m, with the property that there is some unknown hidden subgroup S such that f(x)=f(y) iff x⊕y∈S, for any x,y∈{0,1}n, where |S|=2k for some 0≤k≤n(m≥n−k). The goal of generalized Simon's problem is to find S. For the case of k=1, it is Simon's problem exactly. In this paper, we propose an exact quantum algorithm with O(n−k) queries and an non-adaptive deterministic classical algorithm with O(k2n−k) queries for solving the generalized Simon's problem. Also, we prove that their lower bounds are Ω(n−k) and Ω(k2n−k), respectively. Therefore, we obtain a tight exact quantum query complexity Θ(n−k) and an almost tight non-adaptive classical deterministic query complexities Ω(k2n−k)∼O(k2n−k) for this problem.

A tight lower bound for non-coherent index erasure

The index erasure problem is a quantum state generation problem that asks a quantum computer to prepare a uniform superposition over the image of an injective function given by an oracle. We prove a tight $\Omega(\sqrt{n})$ lower bound on the quantum query complexity of the non-coherent case of the problem, where, in addition to preparing the required superposition, the algorithm is allowed to leave the ancillary memory in an arbitrary function-dependent state. This resolves an open question of Ambainis et al., who gave a tight bound for the coherent case, the case where the ancillary memory must return to its initial state. To prove our main result, we first extend the automorphism principle}of Hoyer et al. to the general adversary method of Lee et al. for state generation problems, which allows one to exploit the symmetries of these problems to lower bound their quantum query complexity. Using this method, we establish a strong connection between the quantum query complexity of non-coherent symmetric state generation problems and the Krein parameters of an association scheme defined on injective functions. In particular, we use the spherical harmonics a finite symmetric Gelfand pair associated with the space of injective functions to obtain asymptotic bounds on certain Krein parameters, from which the main result follows.

Open Problems Related to Quantum Query Complexity

I offer a case that quantum query complexity still has loads of enticing and fundamental open problems—from relativized QMA versus QCMA and BQP versus IP , to time/space tradeoffs for collision and element distinctness, to polynomial degree versus quantum query complexity for partial functions, to the Unitary Synthesis Problem and more.

Testing Boolean Functions Properties

The goal in the area of functions property testing is to determine whether a given black-box Boolean function has a particular given property or is ɛ-far from having that property. We investigate here several types of properties testing for Boolean functions (identity, correlations and balancedness) using the Deutsch-Jozsa algorithm (for the Deutsch-Jozsa (D-J) problem) and also the amplitude amplification technique. At first, we study here a particular testing problem: namely whether a given Boolean function f, of n variables, is identical with a given function g or is ɛ-far from g, where ɛ is the parameter. We present a one-sided error quantum algorithm to deal with this problem that has the query complexity O(1ε). Moreover, we show that our quantum algorithm is optimal. Afterwards we show that the classical randomized query complexity of this problem is Θ(1ε). Secondly, we consider the D-J problem from the perspective of functional correlations and let C(f, g) denote the correlation of f and g. We propose an exact quantum algorithm for making distinction between |C(f, g)| = ɛ and |C(f, g)| = 1 using six queries, while the classical deterministic query complexity for this problem is Θ(2n) queries. Finally, we propose a one-sided error quantum query algorithm for testing whether one Boolean function is balanced versus ɛ-far balanced using O(1ε) queries. We also prove here that our quantum algorithm for balancedness testing is optimal. At the same time, for this balancedness testing problem we present a classical randomized algorithm with query complexity of O(1/ɛ2). Also this randomized algorithm is optimal. Besides, we link the problems considered here together and generalize them to the general case.

Quantum algorithms and approximating polynomials for composed functions with shared inputs

We give new quantum algorithms for evaluating composed functions whose inputs may be shared between bottom-level gates. Letfbe anm-bit Boolean function and consider ann-bit functionFobtained by applyingfto conjunctions of possibly overlapping subsets ofnvariables. Iffhas quantum query complexityQ(f), we give an algorithm for evaluatingFusingO~(Q(f)⋅n)quantum queries. This improves on the bound ofO(Q(f)⋅n)that follows by treating each conjunction independently, and our bound is tight for worst-case choices off. Using completely different techniques, we prove a similar tight composition theorem for the approximate degree off.By recursively applying our composition theorems, we obtain a nearly optimalO~(n1−2−d)upper bound on the quantum query complexity and approximate degree of linear-size depth-dAC0circuits. As a consequence, such circuits can be PAC learned in subexponential time, even in the challenging agnostic setting. Prior to our work, a subexponential-time algorithm was not known even for linear-size depth-3 AC0circuits.As an additional consequence, we show that AC0∘⊕circuits of depthd+1require sizeΩ~(n1/(1−2−d))≥ω(n1+2−d)to compute the Inner Product function even on average. The previous best size lower bound wasΩ(n1+4−(d+1))and only held in the worst case (Cheraghchi et al., JCSS 2018).

Quantum algorithms for escaping from saddle points

We initiate the study of quantum algorithms for escaping from saddle points with provable guarantee. Given a functionf:Rn→R, our quantum algorithm outputs anϵ-approximate second-order stationary point usingO~(log2⁡(n)/ϵ1.75)queries to the quantum evaluation oracle (i.e., the zeroth-order oracle). Compared to the classical state-of-the-art algorithm by Jin et al. withO~(log6⁡(n)/ϵ1.75)queries to the gradient oracle (i.e., the first-order oracle), our quantum algorithm is polynomially better in terms oflog⁡nand matches its complexity in terms of1/ϵ. Technically, our main contribution is the idea of replacing the classical perturbations in gradient descent methods by simulating quantum wave equations, which constitutes the improvement in the quantum query complexity withlog⁡nfactors for escaping from saddle points. We also show how to use a quantum gradient computation algorithm due to Jordan to replace the classical gradient queries by quantum evaluation queries with the same complexity. Finally, we also perform numerical experiments that support our theoretical findings.

Provably Quantum-Secure Tweakable Block Ciphers

Recent results on quantum cryptanalysis show that some symmetric key schemes can be broken in polynomial time even if they are proven to be secure in the classical setting. Liskov, Rivest, and Wagner showed that secure tweakable block ciphers can be constructed from secure block ciphers in the classical setting. However, Kaplan et al. showed that their scheme can be broken by polynomial time quantum superposition attacks, even if underlying block ciphers are quantum-secure. Since then, it remains open if there exists a mode of block ciphers to build quantum-secure tweakable block ciphers. This paper settles the problem in the reduction-based provable security paradigm. We show the first design of quantum-secure tweakable block ciphers based on quantum-secure block ciphers, and present a provable security bound. Our construction is simple, and when instantiated with a quantum-secure n-bit block cipher, it is secure against attacks that query arbitrary quantum superpositions of plaintexts and tweaks up to O(2n/6) quantum queries. Our security proofs use the compressed oracle technique introduced by Zhandry. More precisely, we use an alternative formalization of the technique introduced by Hosoyamada and Iwata.

Quantum query complexity of symmetric oracle problems

We study the query complexity of quantum learning problems in which the oracles form a group G of unitary matrices. In the simplest case, one wishes to identify the oracle, and we find a description of the optimal success probability of a t-query quantum algorithm in terms of group characters. As an application, we show that Ω(n) queries are required to identify a random permutation in Sn. More generally, suppose H is a fixed subgroup of the group G of oracles, and given access to an oracle sampled uniformly from G, we want to learn which coset of H the oracle belongs to. We call this problem coset identification and it generalizes a number of well-known quantum algorithms including the Bernstein-Vazirani problem, the van Dam problem and finite field polynomial interpolation. We provide character-theoretic formulas for the optimal success probability achieved by a t-query algorithm for this problem. One application involves the Heisenberg group and provides a family of problems depending on n which require n+1 queries classically and only 1 query quantumly.

Partial Boolean Functions with Exact Quantum Query Complexity One.

We provide two sufficient and necessary conditions to characterize any n-bit partial Boolean function with exact quantum query complexity 1. Using the first characterization, we present all n-bit partial Boolean functions that depend on n bits and can be computed exactly by a 1-query quantum algorithm. Due to the second characterization, we construct a function F that maps any n-bit partial Boolean function to some integer, and if an n-bit partial Boolean function f depends on k bits and can be computed exactly by a 1-query quantum algorithm, then is non-positive. In addition, we show that the number of all n-bit partial Boolean functions that depend on k bits and can be computed exactly by a 1-query quantum algorithm is not bigger than an upper bound depending on n and k. Most importantly, the upper bound is far less than the number of all n-bit partial Boolean functions for all efficiently big n.

Classical algorithms for quantum mean values

We consider the task of estimating the expectation value of an $n$-qubit tensor product observable $O_1\otimes O_2\otimes \cdots \otimes O_n$ in the output state of a shallow quantum circuit. This task is a cornerstone of variational quantum algorithms for optimization, machine learning, and the simulation of quantum many-body systems. Here we study its computational complexity for constant-depth quantum circuits and three types of single-qubit observables $O_j$ which are (a) close to the identity, (b) positive semidefinite, (c) arbitrary. It is shown that the mean value problem admits a classical approximation algorithm with runtime scaling as $\mathrm{poly}(n)$ and $2^{\tilde{O}(\sqrt{n})}$ in cases (a,b) respectively. In case (c) we give a linear-time algorithm for geometrically local circuits on a two-dimensional grid. The mean value is approximated with a small relative error in case (a), while in cases (b,c) we satisfy a less demanding additive error bound. The algorithms are based on (respectively) Barvinok's polynomial interpolation method, a polynomial approximation for the OR function arising from quantum query complexity, and a Monte Carlo method combined with Matrix Product State techniques. We also prove a technical lemma characterizing a zero-free region for certain polynomials associated with a quantum circuit, which may be of independent interest.

From the sum-of-squares representation of a Boolean function to an optimal exact quantum query algorithm

In quantum computation, designing an optimal exact quantum query algorithm (i.e., a quantum decision tree algorithm) for any small input Boolean function is a fundamental and abstract problem. As we are aware, there is not a general method for this problem. Due to the fact that every Boolean function can be represented by a sum-of-squares of some multilinear polynomials, in this paper a primary algorithm framework is proposed with three basic steps: The first basic step is to find sum-of-squares representations of the Boolean function and its negation function; the second basic step is to construct a state which is assumed to be the final state of an optimal exact quantum query algorithm; the third basic step is to find each unitary operator in the undetermined algorithm. However, there still exist some intractable problems such that the algorithm framework may not be feasible in some cases, but it can be used to investigate the quantum query model with low complexity, such as Deutsch’s problem, a five-bit symmetric Boolean function and the characterization of Boolean functions with exact quantum 2-query complexity.

A Quantum Evolving Secret Sharing Scheme

An evolving secret sharing scheme is supposed to accommodate unbounded number (potentially infinite) of new participants over time and the dealer should not know the set of participants in advance. In this paper we initiate the study of quantum evolving schemes to share a quantum secret and show how to construct such a scheme where the qualified subsets (the sets which can reconstruct the secret) of participants are of increasing size as the number of participants increases with time. Share is given to new participants without modifying shares of old participants. While quantum secret sharing schemes which can accommodate new participants over time have been constructed before, a quantum scheme which can handle an unbounded and unspecified number of participants has not been considered so far. We also discuss the resilience of our scheme against a bounded number of quantum queries by an adversary/eavesdropper. This is achieved by using special functions for which lower bounds on their quantum query complexity is known.

Revisiting Deutsch-Jozsa algorithm

The Deutsch-Jozsa algorithm is essentially faster than any possible deterministic classical algorithm for solving a promise problem that is in fact a symmetric partial Boolean function, named as the Deutsch-Jozsa problem. The Deutsch-Jozsa problem can be equivalently described as a partial function DJn0:{0,1}n→{0,1} defined as: DJn0(x)=1 for |x|=n/2, DJn0(x)=0 for |x|=0,n, and it is undefined for the remaining cases, where n is even, and |x| is the Hamming weight of x. The Deutsch-Jozsa algorithm needs only one query to compute DJn0 but the classical deterministic algorithm requires n2+1 queries to compute it in the worse case.We present all symmetric partial Boolean functions with degree 1 and 2; We prove the exact quantum query complexity of all symmetric partial Boolean functions with degree 1 and 2. We prove Deutsch-Jozsa algorithm can compute any symmetric partial Boolean function f with exact quantum 1-query complexity.

Quantum algorithm for the multicollision problem

The current paper presents a new quantum algorithm for finding multicollisions, often denoted by ℓ-collisions, where an ℓ-collision for a function is a set of ℓ distinct inputs that are mapped by the function to the same value. In cryptology, it is important to study how many queries are required to find an ℓ-collision for a random function of which domain is larger than its range. However, the problem of finding ℓ-collisions for random functions has not received much attention in the quantum setting. The tight bound of quantum query complexity for finding a 2-collisions of a random function has been revealed to be Θ(N1/3), where N is the size of the range of the function, but neither the lower nor upper bounds are known for general ℓ-collisions. The paper first integrates the results from existing research to derive several new observations, e.g., ℓ-collisions can be generated only with O(N1/2) quantum queries for any integer constant ℓ. It then provides a quantum algorithm that finds an ℓ-collision for a random function with the average quantum query complexity of O(N(2ℓ−1−1)/(2ℓ−1)), which matches the tight bound of Θ(N1/3) for ℓ=2 and improves upon the known bounds, including the above simple bound of O(N1/2). More generally, the algorithm achieves the average quantum query complexity of O(cN⋅N(2ℓ−1−1)/(2ℓ−1)), and runs over O˜(cN⋅N(2ℓ−1−1)/(2ℓ−1)) qubits in O˜(cN⋅N(2ℓ−1−1)/(2ℓ−1)) expected time for a random function F:X→Y such that |X|≥ℓ⋅|Y|/cN for any 1≤cN∈o(N1/(2ℓ−1)), where it is assumed that QRAM is available. With the same query complexity, it is actually able to find a multiclaw for random functions, which is harder to find than a multicollision.

Quantum and classical query complexities for generalized Deutsch–Jozsa problems

The Deutsch–Jozsa algorithm is one of the first examples of a quantum algorithm that is exponentially faster than any possible deterministic classical algorithm. We generalize the Deutsch–Jozsa problem from the perspective of functional correlation, i.e., given two unknown n-bit Boolean functions f, g, the testing problem is to determine whether $$|C(f,g)|=0$$ or $$|C(f,g)|=\epsilon $$, where $$1/2^{(n-1)}\le \epsilon \le 1$$, promised that one of these is the case. Firstly, we propose two exact quantum algorithms for making distinction between $$|C(f,g)|=0$$ and $$|C(f,g)|=\epsilon $$ using the Deutsch–Jozsa algorithm and also the amplitude amplification technique with query complexity of $$O(1/\epsilon )$$, where C(f, g) denotes the correlation between two Boolean functions f, g. Secondly, we present a lower bound $${\varOmega }(1/\epsilon )$$ on the above promised problem, which proves that our quantum algorithms are optimal. Thirdly, we can accurately distinguish $$|C(f,g)|=\varepsilon $$ from $$|C(f,g)|=1$$ using the similar methods mentioned above, where $$0\le \varepsilon \le 1-1/2^{(n-1)}$$, promised that one of these is the case. We give a lower bound $${\varOmega }(1/\sqrt{1-\varepsilon })$$ and an upper bound $$O(4/\sqrt{1-\varepsilon ^{2}})$$ on this promised problem, which implies that the two bounds are almost tight. However, the query complexity of classical deterministic algorithms for two promised problems is $${\varTheta }(2^{n})$$.

Quantum attacks on some feistel block ciphers

Post-quantum cryptography has attracted much attention from worldwide cryptologists. However, most research works are related to public-key cryptosystem due to Shor’s attack on RSA and ECC ciphers. At CRYPTO 2016, Kaplan et al. showed that many secret-key (symmetric) systems could be broken using a quantum period finding algorithm, which encouraged researchers to evaluate symmetric systems against quantum attackers. In this paper, we continue to study symmetric ciphers against quantum attackers. First, we convert the classical advanced slide attacks (introduced by Biryukov and Wagner) to a quantum one, that gains an exponential speed-up in time complexity. Thus, we could break 2/4K-Feistel and 2/4K-DES in polynomial time. Second, we give a new quantum key-recovery attack on full-round GOST, which is a Russian standard, with $$2^{114.8}$$ quantum queries of the encryption process, faster than a quantum brute-force search attack by a factor of $$2^{13.2}$$.

Quantum Speedup Based on Classical Decision Trees

Lin and Lin \cite{LL16} have recently shown how starting with a classical query algorithm (decision tree) for a function, we may find upper bounds on its quantum query complexity. More precisely, they have shown that given a decision tree for a function f:{0,1}n→[m] whose input can be accessed via queries to its bits, and a guessing algorithm that predicts answers to the queries, there is a quantum query algorithm for f which makes at most O(GT) quantum queries where T is the depth of the decision tree and G is the maximum number of mistakes of the guessing algorithm. In this paper we give a simple proof of and generalize this result for functions f:[ℓ]n→[m] with non-binary input as well as output alphabets. Our main tool for this generalization is non-binary span program which has recently been developed for non-binary functions, and the dual adversary bound. As applications of our main result we present several quantum query upper bounds, some of which are new. In particular, we show that topological sorting of vertices of a directed graph G can be done with O(n3/2) quantum queries in the adjacency matrix model. Also, we show that the quantum query complexity of the maximum bipartite matching is upper bounded by O(n3/4m+n) in the adjacency list model.

Characterization of exact one-query quantum algorithms

The quantum query models is one of the most important models in quantum computing. Several well-known quantum algorithms are captured by this model, including the Deutsch-Jozsa algorithm, the Simon algorithm, the Grover algorithm and others. In this paper, we characterize the computational power of exact one-query quantum algorithms. It is proved that a total Boolean function $f:\{0,1\}^n \rightarrow \{0,1\}$ can be exactly computed by a one-query quantum algorithm if and only if $f(x)=x_{i_1}$ or ${x_{i_1} \oplus x_{i_2} }$ (up to isomorphism). Note that unlike most work in the literature based on the polynomial method, our proof does not resort to any knowledge about the polynomial degree of $f$.

Quantum period finding based on the Bernstein-Vazirani algorithm

Quantum period finding algorithms have been used to analyze symmetric cryptography. For instance, the 3-round Feistel construction and the Even-Mansour construction could be broken in polynomial time by using quantum period finding algorithms. In this paper, we firstly provide a new algorithm for finding the nonzero period of a vectorial function with O(n) quantum queries, which uses the Bernstein-Vazirani algorithm as one step of the subroutine. Afterwards, we compare our algorithm with Simon's algorithm. In some scenarios, such as the Even-Mansour construction and the function satisfying Simon's promise, etc, our algorithm is more efficient than Simon's algorithm with respect to the tradeoff between quantum memory and time. On the other hand, we combine our algorithm with Grover's algorithm for the key-recovery attack on the FX construction. Compared with the Grover-Meets-Simon algorithm proposed by Leander and May at Asiacrypt 2017, the new algorithm could save the quantum memory.