Does quantum lattice sieving require quantum RAM?

TL;DR

This paper investigates the necessity of quantum RAM in quantum lattice sieving algorithms, establishing lower bounds, trade-offs, and presenting a QRAM-free quantum circuit with improved depth but exponential qubits.

Contribution

It provides the first lower bounds on QRAM requirements, analyzes the trade-off between QRAM size and quantum speedup, and introduces a QRAM-free quantum lattice sieving circuit.

Findings

Quantum speedups require QRAM under reasonable assumptions.

A new interpolation between classical and quantum lattice sieving is established.

A quantum circuit without QRAM achieves better depth but exponential qubits.

Abstract

In this paper, we study the requirement for quantum random access memory (QRAM) in quantum lattice sieving, a fundamental algorithm for lattice-based cryptanalysis. First, we obtain a lower bound on the cost of quantum lattice sieving with a bounded size QRAM. We do so in a new query model encompassing a wide range of lattice sieving algorithms similar to those in the classical sieving lower bound by Kirshanova and Laarhoven [CRYPTO 21]. This implies that, under reasonable assumptions, quantum speedups in lattice sieving require the use of QRAM. In particular, no quantum speedup is possible without QRAM. Second, we investigate the trade-off between the size of QRAM and the quantum speedup. We obtain a new interpolation between classical and quantum lattice sieving. Moreover, we show that further improvements require a novel way to use the QRAM by proving the optimality of some subroutines. An important caveat is that this trade-off requires a strong assumption on the efficient replacement of QRAM data, indicating that even speedups with a small QRAM are already challenging. Finally, we provide a circuit for quantum lattice sieving without using QRAM. Our circuit has a better depth complexity than the best classical algorithms but requires an exponential amount of qubits. To the best of our knowledge, this is the first quantum speedup for lattice sieving without QRAM in the standard quantum circuit model. We explain why this circuit does not contradict our lower bound, which considers the query complexity.