Quantum Lower Bounds for the Goldreich-Levin Problem

Transcription

1 Quatum Lower Bouds for the Goldreich-Levi Problem Mark Adcock 1, Richard Cleve 1, Kazuo Iwama, Raymod Putra,4, Shigeru Yamashita 3, 1 Departmet of Computer Sciece, Uiversity of Calgary, Caada Graduate School of Iformatics, Kyoto Uiversity / QCI, ERATO, JST, Japa 3 Nara Istitute of Sciece ad Techology, Japa 4 School of Computer Sciece, McGill Uiversity, Caada Abstract At the heart of the Goldreich-Levi Theorem is the problem of determiig a -bit strig a by makig queries to two oracles, referred to as IP (ier product) ad EQ (equivalece). The IP oracle, o iput x, returs a bit that is biased towards a x (the modulo two ier product of a with x) i the followig sese. For a radom x, the probability that IP(x) =a xis at least 1 The EQ oracle, o iput x, returs a bit specifyig whether or ot x = a. It has bee show that a quatum algorithm ca solve this problem with O(1/ε) IP ad EQ queries, whereas ay classical algorithm requires Ω(/ε ) such queries. We show that the above quatum algorithm is optimal i terms of both EQ ad IP queries. Specifically, Ω(1/ε) EQ queries are ecessary, ad Ω(1/ε) IP queries are ecessary if the umber of EQ queries o( ). Keywords: computatioal complexity, quatum computig, cryptography. 1 Itroductio ad summary of results The Goldreich-Levi Theorem is a cryptographic reductio which eables a cryptographically hard predicate to be based o the computatioal difficulty of a oe-way fuctio [GL89]. It ca be abstracted as the followig problem, which we heceforth refer to as the GL problem. Leta {0,1} ad ε satisfy 0 < ε 1. Let iformatio about a be available oly from IP (ier product) ad EQ (equivalece) oracle queries. The IP oracle has the property that, for a uiformly-distributed radom x {0,1}, Pr[IP(x) =a x] 1 The EQ oracle, o iput x {0,1}, returs a bit specifyig whether or ot x = a. The task is to determie a. For a algorithm solvig the GL problem, its efficiecy correspods to the overhead i the uderlyig cryptographic reductio. The more efficiet a algorithm for the GL problem is, the tighter the correspodece is betwee the cryptographic primitives that it is applied to. Determiig the most efficiet algorithm for the GL problem is therefore a matter of iterest i complexity-theory based cryptography i both classical ad quatum frameworks (see, e.g., [AC0] for further discussio). Whe there are o errors (i.e., ε = 1), it is straightforward to show that queries are ecessary ad sufficiet for ay classical algorithm; however, with a quatum algorithm, oe query suffices [BV97, TS98]. mark.adcock@cdcgy.com cleve@cpsc.ucalgary.ca raymod@kuis.kyoto-u.ac.jp iwama@kuis.kyoto-u.ac.jp ger@is.aist-ara.ac.jp 1

2 For smaller ε, Goldreich ad Levi [GL89] show how to solve this problem classically with a umber of queries ad auxiliary operatios that is polyomial i /ε, ad this ca be refied ito a algorithm that makes O(/ε ) IP queries followed by O(1/ε ) EQ queries [Gol99]. Adcock ad Cleve [AC0] show that the classical IP query complexity for solvig the GL problem with bouded-error probability is Ω(/ε ) wheever the umber of EQ queries is at most (for a reasoable rage of values of ε). It ca also be show that Ω(1/ε ) EQ queries are ecessary classically. For quatum algorithms, Adcock ad Cleve [AC0] show that O(1/ε) IP ad O(1/ε) EQ queries are sufficiet to solve the GL problem; however, they do ot address the questio whether these costs are ecessary. We address this questio by showig the followig. Theorem 1 Ay quatum algorithm solvig the GL problem with costat success probability requires Ω(1/ε) EQ queries, wheever ε ( 1 )/. It is ot possible to lower boud the umber of IP queries idepedetly of the umber of EQ queries, because O( ) EQ queries would elimiate the eed for ay IP queries [Gro96]. The ext theorem implies that, wheever the umber of EQ queries is o( ), the umber of IP queries must be Ω(1/ε). Theorem Ay quatum algorithm solvig the GL problem with costat success probability requires either Ω( ) EQ queries or Ω(1/ε) IP queries, wheever ε ( 1 )/. For the quatum case, a query that, o iput x {0,1}, returs oe bit ca be regarded as a uitary operatio U, where the output bit is uderstood to be the last qubit of U x 0. The stochastic property of IP queries is i terms of the measured result of the output qubit (see [AC0] for further discussio about formalizig quatum IP queries). Our proof techique for the former theorem is by combiig a lower boud arisig i the list decodig of adamard codes (which we show explicitly), i cojuctio with kow lower bouds for quatum searchig [BBBV97]. The latter theorem is proved by cosiderig a special class of amplitude amplificatio problems that easily reduce to the GL problem ad ca be lower bouded by a stadard hybrid argumet. Proof of Theorem 1 For ay eve k such that 0 <k, defie f k : {0, 1} {0,1}as f k (x 1,x,...,x )=x 1 x x 3 x 4 x k 1 x k. Let ε ( 1 )/ be give, ad set k to the uique eve umber such that ( 1 )k/+1 <ε ( 1 )k/. Now fix the IP oracle to IP(x) =f k (x). Note that fixig the IP oracle makes all IP queries i the algorithm redudat. We will show that this particular settig of the IP oracle has the iterestig property that there are Ω(1/ε ) differet a {0,1} that are cosistet with it i the sese that Pr x [f k (x) =a x] 1 Sice there are Ω(1/ε ) cadidates for the actual solutio which must be foud usig EQ queries the well-kow lower boud for searchig [BBBV97] implies that the umber of EQ queries ecessary (for costat success probability) is Ω( 1/ε )=Ω(1/ε). We ow provide the techical details of the proof, startig with the followig simple lemma. Lemma 3 Let k be eve ad x 1,...,x k be idepedet uiformly distributed radom bits. The Pr[x 1 x x k 1 x k =0]= 1 (1 + ( 1 )k/ ). Proof. Defie Y =( 1) x 1x x k 1 x k. The E[Y]=E[( 1) x 1x ] E[( 1) x k 1x k ]=( 1 )k/,from which it follows that Pr[x 1 x x k 1 x k =0]= 1 (1 + E[Y ]) = 1 (1 + ( 1 )k/ ).

3 The followig propositio provides a characterizatio of several a {0,1} that are cosistet with the IP oracle. Propositio 4 For all a {0,1} such that f k (a) =0ad a k+1 = a k+ = =a =0,ifx {0,1} is radomly chose the Pr[f k (x) =a x] 1 Proof. Pr[f k (x) =a x] = Pr[(x 1 x x k 1 x k ) (a 1 x 1 a k x k )=0] = Pr[(x 1 x a 1 x 1 a x ) (x k 1 x k a k 1 x k 1 a k x k )=0] = Pr[(x 1 a )(x a 1 ) (x k 1 a k )(x k a k 1 ) f k (a) =0] = Pr[x 1 x x k 1 x k =0] = 1 (1 + ( 1 )k/ ) (by Lemma 3) 1 The followig propositio, i cojuctio with Propositio 4, lower bouds the umber of a {0,1} that are cosistet with the IP oracle. Propositio 5 The umber of a {0,1} such that f k (a) =0ad a k+1 = a k+ = =a =0is at least 1 8 (1/ε ). Proof. Lemma 3 implies that the umber of a {0,1} k such that f k (a) =0is 1 (1 + ( 1 )k/ ) k = k 1 + k/ 1 > 1 8 k+ > 1 8 (1/ε ). 3 Proof of Theorem Let ε>( 1 )/ be give. For each a {0,1} such that a 0, defie two oracles. The first is the aforemetioed EQ oracle (that, o iput x {0,1}, returs a bit specifyig whether or ot x = a). To defie the secod type of oracle, first defie the uitary operatio A actig o qubits such that, for all y {0,1}, A y = 1 ε y +iε a y. (1) Note that a A 0 = ε. The secod type of query is a cotrolled-a operatio, deoted as cot-a, where cot-a y b =(A b y ) b, for all y {0,1} ad b {0,1}. Cosider the followig amplitude amplificatio problem. There is a ukow a {0,1} such that a 0. Iformatio about a is available by EQ, cot-a, adcot-a queries. The goal is to determie a. The well-kow amplitude amplificatio algorithm [BMT0] solves this problem usig O(1/ε) EQ,cot-A,adcot-A queries. We first show that this is optimal i the followig sese. Lemma 6 The amplitude amplificatio problem requires either Ω( ) EQ queries or Ω(1/ε) cot-a or cot-a queries, wheever ε ( 1 )/. Proof. This is straightforward to prove by modifyig the quatum lower boud for searchig that uses the hybrid method [BBBV97]. That lower boud proof shows that there is a state φ such that, if oly t EQ queries are available, the, averagig over all values of a, the fial state of the algorithm has distace oly t(/ 1) from φ (ote that, sice a 0, the size of the search space is 1). 3

4 The preset sceario is differet i that cot-a ad cot-a queries ca be iterleaved ito the computatio. This is addressed by showig that each cot-a ad cot-a query ca have a limited effect o a quatum state. The precise result is that, for ay quatum state ψ, ψ cot-a ψ ε. This iequality ca be prove by otig that the eigevalues of cot-a are all either 1 or 1 ε ± iε. Thus, each eigevalue is distace at most ε away from 1. It follows that, if there are s cot-a ad cot-a queries ad t EQ queries, the, averagig over all values of a, the fial state of the algorithm has distace oly s( ε)+t(/ 1) from φ, from which the result follows. Next, we observe that a cot-a query ca be used to simulate a IP query. The simulatio is give by the circuit i Figure 1, deoted as C, wheredeotes the adamard gate ad S is defied as S b =( i) b b,forb {0,1}. x 1 x. x A. 0 S Figure 1: Simulatig a IP query usig a cot-a query. The last qubit, whe measured, is biased towards a x. Lemma 7 If the last output qubit i the above circuit is measured the the probability that the outcome is a x is 1 Proof. It is sufficiet to show that 1+ε i( 1)a x 1 ε x, a x C x, 0 =, () for all x {0,1}, sice this implies that x, a x C x, 0 = 1 Oe way of establishig Eq. is as follows. If circuit C is executed up to the stage of the cot-a gate o state x, 0, the resultig state is 1 1 y {0,1} ( 1) x y y ( 1) x y y {0,1} ( i ) 1 ε +( 1) a x ε y 1. (3) Also, if the last stage of circuit C is executed o state x, a x, the resultig state is 1 1 ( 1) x y y ( 1) x y ( 1) a x y 1. (4) y {0,1} y {0,1} Eq. is obtaied as the ier product betwee the states i Eq. 3 ad Eq. 4. Sice Lemma 7 implies that a violatio of Theorem leads to a violatio of Lemma 6, this completes the proof. 4

5 Ackowledgmets We are grateful to Vekatesa Guruswami ad Roald de Wolf for valuable commets. R.C. is partially supported by Caada s NSERC, MITACS, ad CIAR. Refereces [AC0] M. Adcock ad R. Cleve. A quatum Goldreich-Levi theorem with cryptographic applicatios. I elmut Alt ad Alfoso Ferreira, editors, Proc. 19th It. Symp. o Theoretical Aspects of Computer Sciece (STACS 00), volume 85 of Lecture Notes i Computer Sciece, pages Spriger-Verlag, 00. [BBBV97] C. Beett, E. Berstei, G. Brassard, ad U. Vazirai. Stregths ad weakesses of quatum computig. SIAM Joural of Computig, 6(5): , [BMT0] G. Brassard, P. øyer, M. Mosca, ad A. Tapp. Quatum amplitude amplificatio ad estimatio. Quatum Computatio ad Quatum Iformatio: A Milleium Volume, AMS Cotemporary Mathematics Series, 305, 00. [BV97] [GL89] E. Berstei ad U. Vazirai. Quatum complexity theory. SIAM Joural o Computig, 6(5): , O. Goldreich ad L. Levi. ard-core predicates for ay oe-way fuctio. I Proc. 1th A. ACM Symp. o Theory of Computig (STOC 1989), pages 5 3, [Gol99] O. Goldreich. Moder Cryptography, Probabilistic Proofs ad Pseudoradomess. Spriger, [Gro96] L. K. Grover. A fast quatum mechaical algorithm for database search. I Proc. 8th A. ACM Symp. o Theory of Computig (STOC 1996), pages 1 19, [TS98] B. Terhal ad J. Smoli. Sigle quatum queryig of a database. Phys. Rev. A, 58(3):18 186,