Quantum Algorithm for Identifying Hidden Polynomial Function Graphs

Transcription

1 Quantum Algorithm for Identifying Hidden Polynomial Function Graphs Thomas Decker Jan Draisma Pawel Wocjan Abstract We introduce the Hidden Polynomial Function Graph Problem as a natural generalization of an abelian Hidden Subgroup Problem (HSP) where the subgroups and their cosets correspond to graphs of linear functions over a finite field F with d elements. For the Hidden Polynomial Function Graph Problem the functions are not restricted to be linear but can also be m-variate polynomial functions of total degree n 2. For fixed m and bounded n the problem is hard on a classical computer as the black box query complexity is polynomial in d. In contrast, we reduce it to a quantum state identification problem so that its query complexity is n m +n m n, independent of d. We derive an efficient measurement for distinguishing the resulting quantum states provided that the characteristic of F is sufficiently large. Its success probability and implementation are closely related to a classical problem involving polynomial equations. 1 Introduction Shor s algorithm for factoring integers and calculating discrete logarithms [18] is one of the most important and well known examples of quantum computational speedups. This algorithm as well as other fast quantum algorithms for number-theoretic problems [11, 12, 17] essentially rely on the efficient solution of an abelian hidden subgroup problem (HSP) [3]. This has naturally raised the questions of what interesting problems can be reduced to the non-abelian HSP and of whether the general non-abelian HSP can also be solved efficiently on a quantum computer. It is known that an efficient quantum algorithm for the dihedral HSP would give rise to efficient quantum algorithms for certain lattice problems [19], and that an efficient quantum algorithm for the symmetric group would give rise to an efficient quantum Department of Computer Science & Engineering, University of Washington, Seattle, WA 98195, USA. Electronic address: decker@ira.uka.de Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, PO Box 513, 5600 MB Eindhoven, The Netherlands. Electronic address: j.draisma@tue.nl School of Electrical Engineering and Computer Science, University of Central Florida, Orlando, FL 32816, USA. Electronic address: wocjan@cs.ucf.edu 1

2 algorithm for the graph isomorphism problem [9]. Despite the fact that efficient algorithms have been developed for several non-abelian HSP (see, for example, [15] and the references therein), the HSP over the dihedral group and the symmetric group have withstood all attempts so far. Moreover, there is evidence that the non-abelian HSP might be hard for some groups such as the symmetric group [13]. Another idea for the generalization of the abelian HSP is to consider Hidden Shift Problems [4, 7] or problems with hidden non-linear structures [5]. In the latter context, we define a new black-box problem, called the Hidden Polynomial Function Graph Problem, and present efficient quantum algorithms. More specific, the Hidden Polynomial Function Graph Problem is a natural generalization of the abelian HSP over groups of the special form G := F m+1, where the hidden subgroups are generated by the m generators (0,..., 1,..., 0, q i ) F m+1 with q i F and the 1 is in the ith component. Therefore, the hidden subgroups H Q and their cosets H Q,z are given by H Q := {(x, Q(x)) : x F m } and H Q,z := {(x, Q(x) + z) : x F m }, where z F and Q runs over all polynomials Q(X 1,..., X m ) = q 1 X q m X m. In the Hidden Polynomial Function Graph Problem the polynomials are no longer restricted to be linear but can also be of degree n 2. The subgroups and their cosets are generalized to graphs of polynomial multivariate functions going through the origin and to translated function graphs, respectively. We solve this problem by generalizing standard techniques for the HSP. First, we reduce it to a quantum state identification problem. Second, we design a measurement scheme for distinguishing the quantum states. Third, we relate the success probability and implementation of the measurement to a classical algebro-geometric problem. This paper is organized as follows. In Section 2 we define the Hidden Polynomial Function Graph Problem and show that it suffices to solve the univariate case on a quantum computer. In Section 3 we reduce this case to a state distinguishing problem. To illustrate the basic ideas of our algorithm, we present an idealized measurement relying on the solution of an algebro-geometric problem which we thoroughly analyze in Section 4. In Section 5 we complete our proof by showing that the hidden polynomial function states can be efficiently identified by an approximate measurement. In Section 6 we conclude and discuss possible objectives for further research. 2 Hidden Polynomial Function Graph Problem Definition 2.1 (Hidden Polynomial Function Graph Problem). Let F be a finite field of size d and let Q(X 1,..., X m ) F[X 1,..., X m ] be an arbitrary polynomial with total degree deg(q) n and vanishing constant term. Furthermore, let B : F m+1 F be a black-box function with B(r 1,..., r m, s) := π(s Q(r 1,..., r m )) where π is an arbitrary and unknown permutation of the elements of F. The Hidden Polynomial Function Graph Problem is to identify the polynomial Q if only the blackbox function B is given. 2

3 The Hidden Polynomial Function Graph Problem is related to the Hidden Polynomial Problem defined in [5] which can be equivalently reformulated as follows. The black-box function h : F m F is given by h(r 1,..., r m ) := σ(q(r 1,..., r m )), where σ is an arbitrary permutation of F and Q(X 1,..., X m ) is the hidden polynomial. It is readily seen that the black-boxes h can be obtained from the black-boxes B by querying B only at points of the form (r 1,..., r m, 0). For this reason the black-boxes B offer more flexibility in designing quantum algorithms. We are able to design an efficient quantum algorithm for the black-boxes B hiding m-variate polynomials of degree n (for fixed m and n), whereas no algorithms are known for the black-boxes h. The classical query complexity of the Hidden Polynomial Function Graph Problem is polynomial in d. This is because for univariate polynomials (i.e., m = 1) at least n different points (r (1), s (1) ),..., (r (n), s (n) ) satisfying B(r (1), s (1) ) =... = B(r (n), s (n) ) are required in order to determine the hidden polynomial Q of degree n. The probability of obtaining such an n-fold collision is smaller than 1/d n 1. Simple calculations using the upper bound on the number of copies in [14] imply that information-theoretically at most 4 ( ) n+m m quantum queries are required to attain a success probability of at least 1/2 [8]. Similar arguments establish that at least ( ) n+m m /m 1 queries are necessary. Theorem 2.2. The Hidden Polynomial Function Graph problem can be solved by a quantum algorithm whose query complexity is n m + n m n and whose running time is polylogarithmic in d. Lemma 2.3 shows that it suffices to solve the univariate case in polylogarithmic time on a quantum computer in order to obtain an efficient quantum algorithm for the multivariate case. The quantum algorithm for the univariate problem is derived in the following sections. Lemma 2.3. The m-variate Hidden Polynomial Function graph problem can be solved by using the quantum algorithm for the univariate case as a subroutine which is invoked n m 1 + n m times. Proof. Rewrite Q as Q(X 1,..., X m ) = α Q α(x m ) X α X α m 1 m 1, where the vector α := (α 1,..., α m 1 ) contains the exponents of the variables X 1,..., X m 1. For a recursion we assume that we have an efficient algorithm for polynomials with m 1 variables or less. Then we solve the m-variate problem with the following two steps. 1. Set X 1,..., X m 1 to 0 and obtain Q (0,...,0) (X m ) := Q(0,..., 0, X m ). This is a univariate problem with no constant term which can be solved by assumption. 2. For n different fixed t j F we consider 1 the polynomials Q(X 1,..., X m 1, t j ) = α Q α(t j ) X α Xα m 1 m 1 where Q α(t j ) is a constant coefficient. By assumption we can determine all Q α (t j ) for α (0,..., 0). Denote by α = j α j the degree of the monomial defined by α. Since for α 1 the polynomial Q α (X m ) has degree n α and since we know n function values, we can determine Q α efficiently with Lagrange interpolation [10]. Let κ m be the number of invocations of the algorithm for univariate polynomials. We have κ 1 = 1 and κ m = κ 1 + n κ m 1. This leads to the expression of κ m. 1 Note that the degree of the polynomials is w.l.o.g. smaller than the size of F after reducing exponents modulo d 1. 3

4 3 Distinguishing Polynomial Function States Generalizing the standard approach for hidden subgroup problems, we query the black box in superposition and measure the output register (see Appendix). We refer to the resulting states ρ Q as the Polynomial Function States. Structure of Polynomial Function States For a polynomial Q F[X] with zero constant term the corresponding polynomial function state ρ Q can be written as ρ Q := 1 φ Q,z φ Q,z with φ Q,z := 1 r Q(r) + z. d d z F To obtain a compact expression we introduce the shift operator S := x F +x x for F which directly leads to ρ Q = 1 d 2 b c S Q(b) Q(c). b,c F Now we use the fact that the shift operators S for all F can be diagonalized simultaneously with the Fourier transform DFT F := (1/ d) x,y F ωtr(xy) p x y over F, where Tr : F F p is the trace map of the field extension F/F p and ω p := e 2πi/p is a primitive complex pth root of unity. The Fourier transform DFT F can be approximated to within error ɛ in time polynomial in log( F ) and log(1/ɛ) [7]. For simplicity, we assume that it can be implemented perfectly (as the error can be made exponentially small with polynomial resources only). We have DFT F S DFT F = x F r F ω Tr( x) p x x. Switching to the Fourier basis, the density matrices have the block diagonal form ρ Q := (I d DFT F ) ρ Q (I d DFT F ) = 1 ( ) d 2 χ [Q(b) Q(c)]x b c x x, b,c,x F where χ(z) := ωp Tr(z) for all z F and I d denotes the identity matrix of size d. By repeating the standard approach k times for the same black-box function B, we obtain the density matrix ρ k Q. After rearranging the registers we can write ρ k Q = 1 k d 2k χ [Q(b j ) Q(c j )] x j b c x x b,c,x F k j=1 [ = 1 k n ] d 2k χ q i (b i j c i j) x j b c x x b,c,x F k j=1 i=1 = 1 n k d 2k q i (b i j c i j)x j b c x x = 1 d 2k b,c,x F k χ b,c,x F k χ i=1 j=1 ( ) q Φ n (b) Φ n (c) x b c x x, 4

5 where q, Φ n (b), Φ n (c), and x are defined as follows: q := (q 1, q 2,..., q n ) F 1 n is the row vector whose entries are the coefficients of the hidden polynomial Q(X) = n i=1 q ix i, Φ n (b) is the n k matrix Φ n (b) := n i=1 j=1 k b i j i j = b 1 b 2 b k b 2 1 b 2 2 b 2 k... b n 1 b n 2 b n k, and x := (x 1,..., x k ) T F k is the column vector whose entries are those of x. Algebro-Geometric Problem We now show how to construct an orthogonal measurement for distinguishing the states ρ k Q based on the pretty good measurement techniques [1, 2, 4]. Both the success probability and the efficient implementation of our measurement are closely related to the following algebro-geometric problem: determine all b F k for given x F k and w F n such that Φ n (b) x = w, i.e., b 1 b 2 b k x 1 w 1 b 2 1 b 2 2 b 2 k x 2 w 2... b n 1 b n 2 b n k. x k = We denote the set of solutions to these polynomial equations and its cardinality by. w n S x w := {b F k : Φ n (b) x = w } and η x w := S x w, respectively. We also define the quantum states Sw x to be the equally weighted superposition of all solutions Sw x := 1 b η x w if ηw x > 0 and Sw x to be the zero vector otherwise. Using this notation we can write the state ρ k Q as ρ k Q = 1 ( η d 2k q w q v ) x w ηv x Sw S x v x x x. (2) χ x F k w,v F n The block structure of the states ρ k Q in Eq. (2) implies that the second register can be measured in the computational basis without any loss of information. The probability of obtaining a particular x is ( ) Tr ρ k Q (I d k x x ) = 1 d 2k ηw x = 1 d k. w F n The resulting reduced state is ρ x Q := 1 d k w,v F n χ b S x w (1) ( η q w q v ) x w ηv x Sw S x v x. (3) 5

6 Idealized Measurement for Identifying the States To explain the intuition behind the measurement we assume that the unitary transformation U x satisfying U x S x w = w (4) for all (x, w) with ηw x > 0 can be efficiently implemented. In Section 5 we show that it suffices to realize an approximate version V x of U x. We apply U x to the state ρ x Q of Eq. (3) and obtain U x ρ x QU x = 1 ( η d k q w q v ) x w ηv x w v. w,v F n χ We now measure in the Fourier basis which is defined by the states ψ Q := 1 ( ) q w w. (5) d n w F n χ The probability for the correct identification of the state ρ x Q is ( ) 2 ψ Q ρ x Q ψ Q = 1 η d k+n x w. (6) w F n Consequently, the probability to correctly identify Q is given by ( ) 2 1 η d 2k+n x w. (7) x F k w F n The problem with this idealization is that there are pairs (x, w) where η x w is in the order of d. It is not clear how to implement the unitary (4) efficiently in this case. Therefore, we restrict the pairs (x, w) to cases where we know an upper bound for η x w when implementing V x. Then, an efficient implementation exists. Of course, we have to show that these cases include almost all (x, w). 4 Analysis of the Algebro-Geometric Problem We want to implement a unitary V x that maps S x w to w for a sufficiently large fraction of all (x, w). Hence, for these cases we need a uniform upper bound on ηx w which depends on n but not on d, and an efficient procedure for enumerating Sw x on a classical computer. Both requirements can be satisfied if we choose the number of copies to be equal to the maximally possible degree of the hidden polynomial, i.e., we set k = n. To prove this statement we reformulate this problem as follows. We define the n polynomials f j F[X 1,..., X n, B 1,..., B n ] as f 1 f 2. f n := B 1 B 2 B n B1 2 B2 2 Bk 2... B1 n B2 n Bn n 6 X 1 X 2. X n

7 where the product of the matrix and the vector corresponds to the left-hand side of Eq. (1). Furthermore, let f be the n-tuple f = (f 1,..., f n ) which defines a map from F n F n to F n with f(x, b) = (f 1 (x, b),..., f n (x, b)). Using this notation S x w can be expressed as S x w = {b F n : f(x, b) = w} with w F n. For a fixed x the tuple f defines a map from F n to F n and the sets S x w are the preimages of w F n under this map. The following general proposition allows us to make statements about the size of the preimages independently of the underlying field F. It deals with a general morphism f : A m A n A n, which should be thought of as a family of morphisms from the n-dimensional affine space A n to itself, parameterized by A m. Proposition 4.1. Consider a morphism f : A m A n A n defined over Z, that is, f is given by an n-tuple f = (f 1,..., f n ) of polynomials in Z[X, B], where X = (X 1,..., X m ) and B = (B 1,..., B n ) are the coordinates on A m and on the first copy of A n, respectively. Suppose that the Jacobian determinant det( f i / B j ) ij is a non-zero element 2 of Z[X, B]. Then there exists a real number γ with 0 < γ 1 and a non-zero polynomial g Z[X] such that for all finite fields F and x F m with g(x) 0 we have f({x} F n ) γ F n. Proof. By the condition on the Jacobian determinant f 1,..., f n Q(X, B) are algebraically independent over Q(X). 3 As Q(X, B) has transcendence degree n over Q(X), every B i is algebraic over Q(X, f 1,..., f n ), i.e., there exist non-zero polynomials P 1,..., P n Z[X, W, T ] such that P i (X, f, B i ) = 0 Z[X, B]. View P i as a polynomial of degree d i N in T with coefficients from Z[X, W ], and let Q i Z[X, W ] be the (non-zero) coefficient of T d i in P i. Then h := n i=1 Q i(x, W ) is a non-zero polynomial in Z[X, W ]. By the algebraic independence of the f i, h(x, f(x, B)) is a non-zero polynomial in Z[X, B]; viewing this as a polynomial of degree e in B with coefficients from Z[X], let g Z[X] be any non-zero coefficient of a monomial B α of degree e. Now let F be any finite field, and let x F m be such that g(x) 0. Then q := h(x, f(x, B)) is a non-zero polynomial in F[B] of degree e. For any b F n outside the zero set of q we have Q i (x, f(x, b)) 0 so that P i (x, f(x, b), T ) F[T ] has degree d i, for all i = 1,..., n. Again by construction, any b F n satisfying f(x, b ) = f(x, b) satisfies the system of polynomial equations P i (x, f(x, b), b i ) = 0 for i = 1,..., n, which has at most D := i d i solutions. We conclude that the fiber of f(x, ) over f(x, b) has cardinality at most D, and therefore f({x} F n ) {b Fn q(b) 0} D The Schwartz-Zippel theorem applied to q shows that the right-hand side of this inequality is at least ( F n e F n 1 )/D. From this the existence of γ follows. 2 This condition on f says that generic morphisms in this family are dominant. When we work over algebraically closed fields F this means that the image is dense in F n. The proposition states that over finite fields the generic morphism still hits a large subset of F n. 3 If P Q(X)[W 1,..., W n ] is of minimal degree with P (f) = P (f 1,..., f n ) = 0, then differentiation with respect to B j and the chain rules gives i P W i (f) fi B j Jacobian matrix, and non-zero by minimality of deg(p ) whence det( fi B j ) = 0. 7 = 0, so that ( P W i (f)) i is in the row kernel of the

8 Note that the polynomials P i, g, and h can all be computed effectively, e.g., using Gröbner basis methods [10]. In general, the running time will depend very strongly on the particular form of the morphism f, but is independent of the field size d, which is sufficient for our purposes. It is possible that a more refined analysis taking into account the structure of f could lead to an improved performance for certain types of morphisms. We emphasize that we cannot rule out that the polynomial g Z[X] is zero when considered as a polynomial over F. This can only happen if all coefficients of g are multiples of the characteristic p of F. For this reason, we have to assume that p is sufficiently large so that this case can be excluded. In what follows we will use the additional notation: X good := {x F m g(x) 0}, W x good := {w F n h(x, w) 0} for x X good, and B x good := {b F n f(x, b) W x good } for x X good. If the image of g in F[X] is non-zero then by the Schwartz-Zippel theorem at least F m deg(g) F m 1 of the elements x F m lie in X good. Similarly, for all x X good most w F n lie in Wgood x, and for such w the fiber Sx w of f(x, ) has at most d elements and also most b F n are in Bgood x. For x X good and w Wgood x the fiber Sx w can be computed efficiently: By computing the zeros of the univariate polynomials P i (x, w, T ) in F we find the possible values for each of the b i, and then we need only to determine 4 those combinations that are mapped to w. In our application we have m = n and the Jacobian determinant det( f i / B j ) is non-zero as after specializing all X i to 1 it is a non-zero scalar times the Vandermonde determinant det(bj i 1 ) ij, which is a non-zero polynomial. So the above results apply. 5 Approximate Measurement Assume we have obtained x X good in the first measurement step. Let P good be the projector onto the subspace spanned by b for all b Bgood x. Clearly, the measurement with respect to this decomposition can be carried out efficiently as membership in Wgood x can be tested efficiently. The probability to be in the good subspace is ) Tr (P good ρ x QP good = Bx good d k and the resulting reduced density operator is ρ x Q,good := 1 ( η Bgood x χ q w q v ) x w ηv x Sw S x v x. (8) w,v W x good In the following we use the fact that for x X good and all w Wgood x the cardinality ηw x is bounded from above by a constant independent of the field size d and that the 4 This can be done more efficiently by the replacement of the P i with a triangular system that can be used to find the elements of S x w consecutively. 8

9 elements of the sets S x w can be computed efficiently. In this case we have an efficiently computable bijection between S x w and the set {(w, j) : j = 0,..., η x w 1}. It is obtained by sorting the elements of S x w according to the lexicographic order on F k and associating to each b S x w the unique j {0,..., η x w 1} corresponding to its position in S x w. We now show how to efficiently implement V x satisfying V x S x w = w. Implement a transformation with b 0 0 w j η x w (9) for all b Bgood x. To make it unitary we can simply map all b Bx good onto some vectors which are orthogonal (e.g., by simply flipping some additional qubit saying that they are bad). Note that b and x determine j and w uniquely and vice versa. Furthermore, we can compute w and j efficiently since ηw x is bounded from above by a constant. Consequently, V x acts on the states Sw x as follows 1 η x w Apply the unitary η x w 1 b S x w b η x w w (F l+1 I d k l 1) l l + l=0 d k 1 l=η x w ηw x j ηw x (10) j=1 I d k l l on the second and third register. This implements the embedded Fourier transform F l of size l controlled by the second register in order to map the superposition of all j with j {0,..., l 1} to 0. The resulting state is w 0 η x w. Uncompute η x w in the third register with the help of w and x. This leads to the state w 0 0 We apply V x to the state of Eq. (8) and obtain V x ρ x Q,good V x 1 ( η = Bgood x χ q w q v ) x w ηv x w v. w,v W x good We measure in the Fourier basis ψ Q defined in Eq. (5). Analogously to the ideal situation we obtain that the probability for the correct detection of the state ρ x Q is ψ Q V x ρ x Q,good V x ψ Q = 1 1 d n Bgood x The overall success probability is 1 d n x X good B x good d n ψ Q V x ρ x Q,good V x ψ Q = 1 d 3n w W x good x F n 2 η x w. (11) w W x good The first factor 1/d n is the probability that we obtain a specific x. 9 2 η x w. (12)

10 Corollary 5.1. Assume that the image of g in F[X] is non-zero. Then the success probability is bounded from below by the expression 1 2 η d 3n x w (13) x X good w W x good which is a positive and non-zero constant independent of d. Proof. By Proposition 4.1, for all x X good the image f({x} F n ) has at least γd n elements. This means that the inner sum in expression (13) is also at least γd n. Therefore, the expression is at least 1 d 3n X good γ 2 d 2n 1 d 3n (dn deg(g) d n 1 ) γ 2 d 2n, whence the corollary follows. Remark 5.2. For the preceding analysis we assumed that the characteristic of F is sufficiently large. For quadratic and cubic polynomials, an alternative analysis based on Gröbner bases shows that our results hold for arbitrary characteristics [8]. This completes the proof of Theorem 2.2 by showing that Hidden Polynomial Function Graph problem for univariate polynomials can be solved by a quantum algorithm whose query complexity is n and whose running time is polylogarithmic in d. 6 Conclusion and Outlook We have shown that the hidden polynomial function graph problem can be solved efficiently on a quantum computer for fixed total degree n and fixed number m of indeterminates provided that the characteristic of the underlying finite field is sufficiently large. We have proved that it suffices to query the black box n m +n m n times. This result relies on a classical reduction of the multivariate problem to the univariate one for which we have provided an efficient quantum algorithm making n queries. The extension of our results to more general algebraic structures, e.g., rings with Fourier transforms, and the extension to a broader class of functions such as rational functions are possible directions of future research. Additionally, it would be important to find other polynomial black-boxes with efficient quantum algorithms and to explore if interesting real-life problems can be reduced efficiently to such black box problems. TD was supported under the ARO/DTO/NSA quantum algorithms grant number W911NSF JD was supported by DIAMANT, a mathematics cluster funded by NWO, the Netherlands Organization for Scientific Research. Appendix: Standard Approach Most quantum algorithms for HSP are based on the standard approach which reduces black box problems to state distinguishing problems. We apply this approach to the Hidden Polynomial Function Graph Problem in the following. 10

11 Evaluate the black-box function on an equally weighted superposition of all (r 1, r 2,..., r m, s) F m+1. The resulting state is 1 d m+1 r 1,r 2,...,r m,s F r 1, r 2,..., r m s B(r 1, r 2,..., r m, s) Measure and discard the third register. Assume we have obtained the result π(z). Then the state on the first and second register is ρ Q,z := φ Q,z φ Q,z where φ Q,z := 1 d m r 1,r 2,...,r m F r 1, r 2,..., r m Q(r 1, r 2,..., r m, s) + z with the unknown polynomial Q hidden by B, and z is uniformly at random. The corresponding density matrix is ρ Q := 1 φ Q,z φ Q,z. (14) d z F We refer to the states ρ Q as polynomial function states. We have to distinguish these states in order to solve the black box problem. References [1] D. Bacon, A. Childs, and W. van Dam, Optimal measurements for the dihedral hidden subgroup problem, Chicago Journal of Theoretical Computer Science, Article 2, [2] D. Bacon, A. Childs, and W. van Dam, From optimal measurements to efficient quantum algorithms for the hidden subgroup problem over semidirect product groups, Proc. of the 46th Symposium on Foundations of Computer Science, pp , [3] R. Boneh and R. Lipton, Quantum cryptanalysis of hidden linear functions, Proc. Advances in Cryptology, Lecture Notes in Computer Science 963, pp , [4] A. Childs and W. van Dam, Quantum algorithm for a generalized hidden shift problem, Proc. 18th ACM-SIAM Symposium on Discrete Algorithms, pp , [5] A. Childs, L. Schulman, and U. Vazirani, Quantum algorithms for hidden nonlinear structures, Personal communication and talk given at the QIP Workshop 2007, Brisbane, Australia, January 30 February 3, [6] A. Childs, L. Schulman, U. Vazirani, Quantum algorithms for hidden nonlinear structures, arxiv: v1, [7] W. van Dam, S. Hallgren, L. Ip, Quantum Algorithms for some Hidden Shift Problems, SIAM Journal on Computing, Volume 36, Issue 3, pp , [8] T. Decker, P. Wocjan, Efficient Quantum Algorithm for Hidden Quadratic and Cubic Polynomial Function Graphs, arxiv: quant-ph/ v3 11

12 [9] M. Ettinger and P. Høyer, A quantum observable for the graph isomorphism problem, quant-ph/ [10] J. von zur Gathen, J. Gerhard: Modern Computer Algebra, Cambridge University Press, [11] S. Hallgren, Polynomial-time quantum algorithms for Pell s equation and the principal ideal problem, Proc. 34th ACM Symposium on Theory of Computing, pp , [12] S. Hallgren, Fast quantum algorithms for computing the unit group and class group of a number field, Proc. 37th ACM Symposium on Theory of Computing, pp , [13] S. Hallgren, C. Moore, M. Rötteler, A. Russell, and P. Sen, Limitations of quantum coset states for graph isomorphism, Proc. of 38th ACM Symposium on Theory of Computing, pp , [14] A. Harrow, A. Winter, How many copies are needed for state discrimination?, [15] G. Ivanyos, L. Sanselme, and M. Santha, Quantum algorithm for the hidden subgroup problem in extraspecial groups, Proc. of 24th Annual Symposium on Theoretical Aspects of Computer Science, Lecture Notes in Computer Science 4393, pp , [16] R. Motwani and P. Raghavan, Randomized algorithms, Cambridge University Press, [17] A. Schmidt and U. Vollmer, Polynomial time quantum algorithm for the computation of the unit group of a number field, Proc. 37th ACM Symposium on Theory of Computing, pp , [18] P. W. Shor, Polynomial-time algorithms for prime factorizations and discrete logarithms on a quantum computer, SIAM Journal on Computing 26, pp , [19] O. Regev, Quantum computation and lattice problems, Proc. 43rd Symposium on Foundations of Computer Science, pp ,