Breaking Cryptosystems With Quantum Computers
By: Silen Naihin
Tags: Cryptocurrency, Computer Science, Quantum Computing, Future, Algorithms

Quantum computers are incredible feats of engineering and cutting edge research. Quantum computers claim to be faster then classical computers, but have quantum computers actually been proven to have a speedup over classical ones? The answer is not intuitive at all. It also wasn’t clear whether they actually did, until Dan Simon created an oracle problem that provided an exponential speedup over the classical computer in 1993. Peter Shor used the main ideas in Simon’s algorithm and invented Shors algorithm, which has the theoretical capabilities to factor large numbers. It has a huge speedup over classical computers, with capabilities to break some cryptosystems and encryption.

Later, in 1996 Lov Grover invented a quantum database search algorithm. The speedup is quadratic, and while the speedup is not as dramatic as Shors algorithm, it still has huge implications. Grover’s algorithm is what I will be focusing on today. (For this article, I am going to assume you know all of the basic functions of a quantum computer, such as what a qubit is, and how unitary matrices affect them. If you need any clarification on anything, refer to my other article.)

Speedup Provided by Grover’s Algorithm

Imagine you have a set of 8 upside down cups, and a ball is placed into one of those cups. They are then shuffled around, so that you have no idea which cup the ball was placed in. Your best bet is to guess, with a maximum of 7 guesses for you to be certain in which cup the ball is in. It is essentially the same as starting from the rightmost cup, and lifting up each one on the way to the left, to see which ball the cup is under. You could find it in 1 guess, but 7 guesses would be your worst case scenario if the ball ended up being in the leftmost cup (you don’t have to check the last cup to know that the ball is there).

This is essentially how a regular computer algorithm works, denoted O(N). N stands for the size of the database, and O denotes the polynomial hierarchy, which in this case is linear. Imagine you could find the right cup in O(√N) searches (a quadratic speedup). A quantum computer running Grover’s algorithm allows us to do just that!

Grover’s algorithm is quadratic, while classical algorithms are linear

In this example, that’s less than 3 quantum searches — opposed to 7 classical- to find the correct result! Now that may only be a speedup of about 4 searches, but imagine the implications on a larger scale. With a limit of a million searches, regular computers would be limited to searching through just a million possibilities in an unstructured database (a database with no organization). A quantum computer with a million operations could search through hundreds of billions of possibilities.

Applications of the Algorithm

So that’s an overview of how Grover’s algorithm is faster than classical algorithms, now I’m going to move onto the applications of the algorithm, so that you aren’t just looking at some code thinking “Why does this really matter? Why should I care?” when I go into more depth later in this article. There are many abstract applications of Grover’s algorithm, such as the collision problem and speeding up the solution to NP-complete problems, but I’m going to list a couple of applications that are more intuitive with links to where you could learn more.

Quantum unstructured search of database : Find values in a large database significantly faster then a classical computer. Useful if you have a large amount of unordered data coming in and you need to find items in it. This is the application I explain in detail in this article.

: Find values in a large database significantly faster then a classical computer. Useful if you have a large amount of unordered data coming in and you need to find items in it. This is the application I explain in detail in this article. Quantum searching and cryptography: Breaking block ciphers, hash functions and password hashing faster than a classical computer. Useful for breaking encryption and possibly breaking cryptosystems (hash functions — SHA2).

Any problem that must be solved by a random, brute force search, can take advantage of the quadratic speedup this algorithm provides.

How The Algorithm Works

The input of Grover’s algorithm is a quantum register (system made of of multiple qubits) or an unstructured quantum database. The algorithm finds x for which f(x)=1, with f equaling 0 for all other values.

To search for the right cup in those 8 cups (entries in a database) mentioned previously, we would need a 3 qubit search space (2³). We are searching for the ball, so f(x)=1 would be satisfied by x=ball. Grover’s algorithm is applied, and after π/4*√2n iterations (according to Lov Grover, in order to achieve optimal probability that the state we end up observing is the correct one, we want the overall rotation of the phase to be π/4 radians, which occurs on average after π/4*√2n iterations), the output should be f(x)=1 for x=ball.

There are two caveats of this algorithm:

It is difficult to actually execute Grover’s algorithm on a regular unstructured database, as it requires at least linear complexity.

You have to perform quantum counting efficiently, because running Grover’s algorithm requires knowing how many solutions exist.

I won’t get into how and why here, but I linked some resources you could check out.

Hard Coding Oracle

To start, we hard code an oracle, that always marks only the entry k = N -1 for N = 2^n. k is a database entry index, N is the amount of values in a database, and n is the number of qubits needed to encode the item k. The oracle targets the the entry you are looking for, with an X operation, which is controlled by whether the composition of the register corresponds with the item. The X gate rotates the qubit π degrees, flipping |0> to |1> and |1> to |0>. It is commonly referred to as a bit flip. The way that this is applied in Q# is with the following lines of code:

In this code, the input values are the qubit/item we are looking for, and the register. The body of this operation is quite simple, an X gate is executed only if state of the system corresponds to the target qubit. This flips the value of the target qubit only to the |1> state from the |0> state (the hard code oracle is only applied when you already know the position of the entry you are looking for, it’s more for simulation/testing purposes. An actual implementation of Grover’s algorithm would start from the Hadamard Transform).

Hadamard Transform

Grover’s algorithm relies on the principles of superposition heavily, so make sure you know what that is (refer to this article if you are unsure). To execute the algorithm, you begin by putting the quantum computer into an equal superposition of all the possible 2n states of the n-qubit register (16 states in a 3 qubit register). This way, there is an equal amplitude associated with every possible configuration of qubits in that system, and an equal probability that the system will be in any of the 2n states. All of the possible states of the qubits, correspond to all of the possible configurations in the quantum database. Simply, this means that all of the entries in the database are in a equal superposition, and they each correspond to a qubit (this means that each entry is equally 12.5% in superposition for a 8 entry database).

The Hadamard Transform (denoted H⊗) is the first operation applied to the quantum unstructured database. A Hadamard gate is applied to all of the qubits, to put the state of the quantum register into an equal superposition. This can be considered as preparation to run the algorithm, as a lot of quantum speedup comes from the superposition phenomena.

I will be using Quirk (quantum circuit simulator) to help show what the operation actually looks like. The circuit diagrams I will be showing is a representation of a register when searching through a database with 64 entries, hence here are 8 qubits (2⁸). The picture below shows the circuit visualization of the Hadamard Transform, along with a tool in Quirk that checks the probability of the entry being found in a certain spot. The superposition is equal, so all of the probabilities are equal as well:

The way that this is applied in Q# is with the following lines of code:

As you can see, the input for the operation is a register of qubits. The name of the register is the databaseRegister, and the operation will perform on a qubit with a certain index. The output type is a Unit. The for loop inside the body of the operation iterates through the register of qubits, and applies a Hadamard gate to each one, putting them into an equal superposition. Next, we will be moving on to take a look at the Grover iteration, the bulk of the algorithm.

The Grover Iteration

After the initialization of all of the qubits in a superposition, the Grover iteration is applied. The Grover iteration consists of an Oracle (a black box function — it can observe and modify the system without collapsing it to a classical state), and the diffusion transform.

Oracle

The Oracle searches through each state/entry in the list, and modifies the entry you are looking for depending on its value. If the item is in the correct state, the oracle will rotate the phase by π radians, otherwise it will do nothing. The phase shift (shift in the waveform) leaves the probabilities of the system the same, but the amplitude is negated. This means that the item that we are looking for is effectively reversed, without collapsing the system of probabilities. In Quirk, this is implemented using a Controlled Z gate. The Z gate maps |1> to |-1> and does nothing to the |0> state, reversing the amplitude of the state we are looking for, so that in further computations we could utilize this. An oracle could look like this in a circuit:

Diffusion Transform

Grover’s algorithm uses another quantum phenomena known as amplitude amplification. It uses the qualities of quantum amplitudes, which are different from regular amplitudes. The key is to shift the phase of the one state of the system that satisfies the condition we are looking for at each iteration of the diffusion transform. By applying the Z gate, the amplitude of a state changes (recall — |0> to |0> and |1> to |-1>), but the probability of being in that state stays the same (probability disregards amplitude). The way that the state is isolated, is through subsequent transformations that take advantage of the difference in amplitude to single out that state, singling out the state that we are looking for, and increasing the probability of the system being in that state once it is measured.

This is another demonstration of quantum speedup, operations that do that would not be possible with a regular computer, as quantum amplitudes hold extra information regarding the phase of the state on top of the probability. Put simply, the diffusion transform transforms the amplitude of each state in the register so that its amplitude is equivalent to before the computation happens, but inverted. The way this is actually done, is by first applying the Hadamard Transform, then a Z gate (|0> to |0> and |1> to |-1>), and then another Hadamard Transform. A circuit visualization of this in Quirk would look like this:

As you can see, after the first iteration of the algorithm, there is already a probability that is rising above all others, but still only at 3.4% relative to every other state at 0.38%. This is done in Q# in the following manner:

This piece of code does exactly what we talked about previously. The X symbols on either side, do the equivalent thing as the Hadamard Transform, and as you can see, they appear on either side of the Controlled Z gate which the actual phase shift.

Putting It All Together!

To put it all together, we need to combine the Grover iteration into one operation to make it easier to execute:

In this operation, the StatePreperationOracle, prepares the register so that the Grover iteration could be executed, applying the Hard Coding Oracle, and the initial Hadamard Transform. The for loop iterates through the Grover iteration the necessary amount of times, with ReflectStart applying the bulk of the Grover iteration — the Oracle, and the Diffusion Transform. Next we put it all together to get the final operation:

The mutable variables at the start store the measurement results once the algorithm is performed, and the ‘using’ keyword allocates a certain amount of qubits that are needed for the operation to run. The first let statement defines the qubit that we are looking for (remember, the hard coded oracle is only for a simulation where the result we are looking for is already known), and the second let statement assigns all of the qubits to the database register.

Then the actual algorithm is implemented, which is only one line long thanks to the grouping we did into one operation earlier. The rest of the algorithm is just measuring the marked qubit to make sure that the operation was successful, resetting all of the qubits to the |0> state, and returning the result. And that’s it! That’s the entire search algorithm!

Put all together, this is the true beauty of Grover’s algorithm in a circuit: