Grover's oracle for the Shortest Vector Problem and its application in hybrid classical-quantum solvers

Abstract

Finding the shortest vector in a lattice is a problem that is believed to be hard both for classical and quantum computers. Many major post-quantum secure cryptosystems base their security on the hardness of the Shortest Vector Problem (SVP). Finding the best classical, quantum or hybrid classical-quantum algorithms for SVP is necessary to select cryptosystem parameters that offer sufficient level of security. Grover's search quantum algorithm provides a generic quadratic speed-up, given access to an oracle implementing some function which describes when a solution is found. In this paper we provide concrete implementation of such an oracle for the SVP. We define the circuit, and evaluate costs in terms of number of qubits, number of gates, depth and T-quantum cost. We then analyze how to combine Grover's quantum search for small SVP instances with state-of-the-art classical solvers that use well known algorithms, such as the BKZ, where the former is used as a subroutine. This could enable solving larger instances of SVP with higher probability than classical state-of-the-art records, but still very far from posing any threat to cryptosystems being considered for standardization. Depending on the technology available, there is a spectrum of trade-offs in creating this combination.