Regev's reduction as a candidate quantum algorithm for the discrete logarithm problem in finite abelian groups

TL;DR

This paper explores whether Regev's quantum reduction can solve the discrete logarithm problem in finite abelian groups by analyzing its application to Reed--Solomon code decoding, revealing limitations due to efficiency constraints.

Contribution

It generalizes the hardness of Reed--Solomon decoding to finite abelian groups and evaluates Regev's reduction, identifying efficiency as the main obstacle.

Findings

Reed--Solomon decoding is NP-hard at zero rate, but known NP-hard radius exceeds the Cheng--Wan decoding radius.

Regev's reduction falls short of the Cheng--Wan threshold by a constant factor when evaluated with efficient decoders.

The Pretty Good Measurement can solve the decoding problem but requires exponential resources, limiting practical use.

Abstract

We revisit the reduction of Cheng and Wan, which transforms instances of the discrete logarithm problem (DLOG) over finite fields into a decoding problem for Reed--Solomon codes, and study how Regev's reduction can be used to solve these instances. Regev's reduction turns a decoder for a code into a quantum solver for a decoding problem on the dual code. The quantum advantage depends on the dual problem being classically hard, which has proven difficult to establish. The Cheng--Wan reduction offers a natural source of such instances: solving them would solve discrete logarithm. Since Shor's algorithm already solves discrete logarithm, the goal is not a new quantum speedup but to understand whether Regev's reduction, applied to a problem we have independent reasons to believe is hard, can solve discrete logarithm, and if not, where it falls short. We generalize the hardness consequence of the Cheng--Wan reduction for Reed--Solomon bounded distance decoding -- from solving DLOG in $\mathbb{F}_{q^h}^\times$ to solving DLOG in finite abelian groups, and we prove that bounded distance decoding for Reed--Solomon codes is NP-hard even at asymptotically zero rate, though the known NP-hard radius lies well above the Cheng--Wan decoding radius. We then carry out Regev's reduction on the Cheng--Wan instances and evaluate it with known efficient decoders. All fall short of the Cheng--Wan threshold by a constant factor, and under an assumption on the Cheng--Wan instances we identify the QDP parameter a decoder would need to reach in order to solve discrete logarithm. The obstruction is one of efficiency rather than solvability: the Pretty Good Measurement solves the corresponding decoding problem on every instance, including NP-hard instances, but its implementation requires exponential resources in general.