Grover's oracle for the Shortest Vector Problem and its application in hybrid classical-quantum solvers

TL;DR

The paper delivers a concrete Grover oracle for the Shortest Vector Problem (SVP) and a careful resource-based analysis of implementing the SVP oracle on gate-model quantum hardware. It provides a modular circuit design, quantifies space, time, and $T$-gate costs, and shows how Grover's search can be combined with BKZ-based classical solvers in hybrid approaches. Despite the quadratic speedup offered by Grover, the authors conclude that the asymptotic complexity remains exponential and current or near-term quantum technology cannot threaten lattice-based cryptosystems; however, the study clarifies the architectural costs and illuminates potential hybrid strategies for future exploration. The work thus serves as a detailed benchmark for integrating quantum search into lattice-solving routines and informs parameter selection and security assessments under fault-tolerant assumptions.

Abstract

Finding the shortest vector in a lattice is a problem that is believed to be hard both for classical and quantum computers. Many major post-quantum secure cryptosystems base their security on the hardness of the Shortest Vector Problem (SVP). Finding the best classical, quantum or hybrid classical-quantum algorithms for SVP is necessary to select cryptosystem parameters that offer sufficient level of security. Grover's search quantum algorithm provides a generic quadratic speed-up, given access to an oracle implementing some function which describes when a solution is found. In this paper we provide concrete implementation of such an oracle for the SVP. We define the circuit, and evaluate costs in terms of number of qubits, number of gates, depth and T-quantum cost. We then analyze how to combine Grover's quantum search for small SVP instances with state-of-the-art classical solvers that use well known algorithms, such as the BKZ, where the former is used as a subroutine. This could enable solving larger instances of SVP with higher probability than classical state-of-the-art records, but still very far from posing any threat to cryptosystems being considered for standardization. Depending on the technology available, there is a spectrum of trade-offs in creating this combination.

Figures (5)

• Figure 1: Grover's search algorithm
• Figure 2: A single Grover iteration $\hat{G}$
• Figure 3: Experimental resource requirements for SVP oracle circuit as found by quipper. This plots extended dataset of the data found in Table \ref{['tbl:oracleResources']}. The "sudden" jumps at dimensions being power of 2 (x-axis being ..,32,64,..) are due to rounding in determining number of qubits per enumeration coefficient which is $\lceil\log n\rceil$.
• Figure 4: Experimental resource requirements for Grover's search SVP routine as found by quipper. This plots extended dataset of the data found in Table \ref{['tbl:groverResources']}. Similarly as in Figure \ref{['fig:quipperOracleResources']}, the "sudden" jumps are caused by rounding a function of number of qubits to the nearest higher integer. Note that the Space Complexity remains the same for a single oracle and the Grover's search algorithm: once an oracle is constructed, no additional logical qubits are needed to run the full Grover's search. The graph is plotted again due to reference only.
• Figure 5: High-level design of the SVP oracle

Theorems & Definitions (2)

• definition thmcounterdefinition
• definition thmcounterdefinition