Two quantum Ising algorithms for the Shortest Vector Problem: one for now and one for later

TL;DR

This paper introduces two quantum Ising algorithms for the Shortest Vector Problem, one optimized for long-term quantum computers with fewer qubits and the other more noise-resistant for near-term devices.

Contribution

It presents two novel quantum Ising algorithms tailored for the Shortest Vector Problem, balancing qubit efficiency and noise robustness.

Findings

The qubit-efficient variant requires O(N log N) qubits.

The noise-robust variant performs better on current quantum annealers.

Long-term performance favors the qubit-efficient algorithm.

Abstract

Quantum computers are expected to break today's public key cryptography within a few decades. New cryptosystems are being designed and standardised for the post-quantum era, and a significant proportion of these rely on the hardness of problems like the Shortest Vector Problem to a quantum adversary. In this paper we describe two variants of a quantum Ising algorithm to solve this problem. One variant is spatially efficient, requiring only O(NlogN) qubits where N is the lattice dimension, while the other variant is more robust to noise. Analysis of the algorithms' performance on a quantum annealer and in numerical simulations show that the more qubit-efficient variant will outperform in the long run, while the other variant is more suitable for near-term implementation.