Notes for Lecture 5. 1 Grover Search. 1.1 The Setting. 1.2 Motivation. Lecture 5 (September 26, 2018)

Transcription

1 COS 597A: Quatum Cryptography Lecture 5 (September 6, 08) Lecturer: Mark Zhadry Priceto Uiversity Scribe: Fermi Ma Notes for Lecture 5 Today we ll move o from the slightly cotrived applicatios of quatum algorithms we discussed previously, ad we ll talk about a quatum algorithm that has serious implicatios for cryptography Grover Search The Settig Grover s algorithm allows us to solve the followig promise problem (which we ll show how to exted by the ed of the lecture) We have a fuctio f : {0, } {0, }, ad we kow there is exactly oe s {0, } such that f(s) = We re goig to imagie that we re livig i a oracle world where someoe has implemeted f ad we ca make black box access to it Or we ca also thik of f as beig implemeted by some really complicated circuit that we do t wat to ope up How do we solve this? Classically, this problem basically takes time We simply brute force search over all iputs I compariso, we ca use a quatum algorithm to do this i Θ( / ) time It s importat to ote that this divisio by is happeig i the expoet, so it s a quadratic savig Motivatio Why do we care about this i cryptography? A oe way fuctio g : {0, } {0, } is a fuctio that (iformally) is easy to evaluate ad hard to ivert I ca take a x ad compute g(x), but give g(x) I caot (computatioally) fid ay pre-image of g(x) (icludig x of course) Later o i this course we ll look at more complicated cryptographic objects, ad we ll see that a lots of them really have oe way fuctios hidig i them All this is to say that oe way fuctios are oe of the most fudametal objects i cryptography, so uderstadig the hardess of breakig them is fudametal I practice, is chose to thwart kow attacks So oe kow attack that works for ay g is to the brute force attack, where I go over all iputs x util I fid a pre-image that matches the g(x) I was give The time complexity of this is What we do the is set to be so large as to make this itractable, which i practice meas settig

2 to be somethig like 8 For some oe way fuctios, these brute force attacks are the best attacks that we kow This feels extremely similar to the setup for the Grover search, but there s a slight mismatch So for ow let s assume that the oe way fuctio g is actually ijective (equivaletly, oe-to-oe), which meas if I m give y, my goal is to fid the uique x such that g(x) = y Now I defie f(x) to be the fuctio that is if g(x) = y, ad 0 else The ijectivity of g meas that f(x) is oly at a sigle poit x, so we ca ow ivoke Grover search The implicatio of this is that with a Grover search, I ca perform iversio o (ijective) oe way fuctios i 64 time So if we re aggressive with oe-way fuctio parameter settigs ad we actually have = 8, this ca be broke i 64 time by a quatum computer (meaig we lose security agaist brute force attacks) At the ed of this lecture we ll remove this ijectivity requiremet 3 Grover s Algorithm: Descriptio Step I prepare the uiform superpositio over all iputs x {0,} x If we recall from last time, we ca easily prepare this state by startig with a bit strig that is all 0 s ad applyig Hadamard to it: (H 0 ) Step I alterate betwee doig two thigs I apply f usig a phase kickback The map is x ( ) f(x) x from applyig a uitary U f (essetially the same idea we used for Deutsch s algorithm last time) Grover iteratio Here we map x ( y y ) x It turs out that this is a uitary trasformatio, though it might ot appear uitary at first glace Step 3 Measure (ad hope that I get the right aswer) How may times do we step? It turs out / times is the right amout 4 Grover s Algorithm: Descriptio Now we give a secod descriptio of Grover s algorithm The poit of the first descriptio is that it s clear that we ca implemet it give f The poit of this secod descriptio is that it s actually equivalet to the first descriptio, but ow we write it i such a way that illumiate why each step is uitary

3 Step Apply uitary U s = I s s This s s correspods to a o the diagoal etry correspodig to the secret iput s such that f(s) = ad 0 everywhere else We ca see that this is the same as step i descriptio, sice i that descriptio the uitary is really the idetity everywhere except at x, where it is = Step We apply U ψ = ψ ψ I where ψ = x x Now we ca see how this is the same operatio as i Step i descriptio I the first term the terms multiply ad give the term i the descriptio The the idetity I applied to x just gives x This is uitary sice we re just substitutig i ψ for s i the uitary i step, ad the flippig the sig 4 Ituitio for Step If I imagie I m i the Fourier domai, the uiform ψ i the primal correspods to 0 i the Fourier domai The flippig ψ i the primal meas I m just flippig 0 i the Fourier domai, which is what happes whe you apply U 0 (takig s = 0 i the U s defiitio i step ) So this mea step is just H U 0 H The rightmost Hadamard takes me to the Fourier domai The U 0 is just flippig the 0, ad the we apply aother Hadamard to get back The mius sig is just because i step we re flippig the sig (Note that the U ψ i step should really be U ψ, but we wo t worry about the mius sigs) 5 Picture Ituitio for Grover iteratios We re lookig at graphs where the horizotal axis is over the all differet states, ad 3

4 the y axis is the amplitude o each state At the very start of the Grover iteratios, we re i the top left graph where the amplitude o each state is (First stage of first Grover iteratio) Now whe I apply f, this flips the sig o the secret iput This gives the secod graph o the left Now the secret iput has a amplitude of, ad everythig else is left uchaged (Secod stage of first Grover iteratio) I the secod stage of a Grover iteratio, recall that we flip about 0 i the Fourier domai Ituitively, 0 correspods to the mea (but ot exactly) To see this ituitio, recall the form of the Fourier trasform: α x x y ( ( ) x y α x ) x x y What is the amplitude o 0? We simply plug i y = 0 ad get x α x, which ituitively correspods to the mea) So we ca thik of what happes i the primal as a flip about the mea What happes is we ed up at the third graph o the left side of the picture All of the amplitudes at states ot correspodig to the secret iput were very slightly above the mea, ad they get flipped to very slightly below the mea O the other had, the amplitude of the secret iput gets flipped all the way up to approximately 3 (First stage of secod Grover iteratio) Now I flip the secret poit across the mea agai, ad it goes to approximately 3 (Secod stage of secod Grover iteratio) The mea is still basically The result is that I m at roughly the same picture as before, except the secret poit is at approximately 5 After t steps, the amplitude is approximately t Oce this amplitude is some costat fractio, whe we measure we ll get the correct aswer with some reasoable probability The we ca repeat a few times to boost correctess What happes if we keep goig past this poit? At some poit, these errors are goig to get too big Also keep i mid that everythig is reversible, ad it turs out that if we keep doig the iteratios we ll get back to where we started 4

5 6 A More Careful Proof Defie ψ 0 i = P x6=s xi, ad write the startig state as r ψi = 0 ψ i + si Whe I apply a full Grover iteratio, what happes to si is si Uψ Us si = Uψ ( si) = ( ψihψ I)( si) = ψihψ si + si What happes to ψ 0 i is that Us does t do aythig to ψ 0, so it s just ψ 0 i Uψ Us ψ 0 i = Uψ ψ 0 i = ( ψihψ I) ψ 0 i = ψihψ ψ 0 i ψ 0 i We ote that both of these terms o the RHS are i the spa of ( ψ 0 i, si) So every time I apply a Grover iteratio, I stay i the plae spaed by ψ 0 i ad si Also it s worth otig that ψ 0 i ad si are orthogoal, sice the oly place si has ay weight is where ψ 0 i has 0 weight I ca go to aother picture where I have si ad ψi ad ψ 0 i Also ote that we re livig i the real plae ψi ad ψ 0 i have some small agle θ/ (we ll work out the agle i just a momet) 5

6 Now whe I apply U s, what happes is I reflect about ψ So U s is flippig ψ to U s ψ that has a agle θ/ below ψ What happes whe I apply U ψ? Let s forget the overall mius sig, sice we ve said those do t really matter The I ca thik of this as reflectig about s, ad I ed up at U ψ U s ψ (which is o the lefthad side, but whe we accout for the mius sig we re back o the righthad side) So I keep doig this process of reflectig about ψ ad the reflectig about s (but with a mius sig), which produces the agles above Oe way to view this is to ote that it s similar to what was goig o before, except ow the icrease of θ i each step is exact Let ψ t be the state after t steps The let θ t be the agle from ψ The θ t = ( + t)θ The we measure, ad the probability of gettig state s is si (( + t)θ) So the probability I do t get s is goig to be cos (( + t)θ) So what is θ? We kow that the origial vector, my probability of gettig s was so its amplitude i the directio of s is So we have si(θ/) = If we use our small θ approximatios for si, the we have θ I order to get a high success probability I wat si (( + t)θ) to be somethig like, so we eed the iput to si to be aroud π/ If we solve ( + t) = π The I get t = (π/4) It s importat that we actually do stop here 7 May Acceptig Iputs So this all works because there was oly oe acceptig iput But what if there are more acceptig iputs? Let S be the set of r acceptig iputs The I defie φ to be the superpositio to be all acceptig iputs, which geeralizes the s from before Basically what we ca do is write ψ = α ψ + β φ (for some α ad β that we wo t work out) If we ru the same aalysis as before, we ll coclude that the results of both steps of the Grover iteratio is some state that is i the spa of ψ, φ So just as before, we ca zoom i o this plae The resultig picture looks idetical, ad the oly poit is that θ has chaged φ replaces s i the picture, where φ is the state where if I measure, I get oe of the r acceptig iputs Now si(θ/) = r/ This meas that as log as r is relatively small, θ is about r/, so I eed π/4 /r steps If I have more acceptig iputs We ca just try all the powers of 6