QUESTIONS, How can quantum computers do the amazing things that they are able to do, such. cryptography quantum computers

Transcription

1 2O cryptography quantum computers cryptography quantum computers QUESTIONS, Quantum Computers, and Cryptography A mathematcal metaphor for the power of quantum algorthms Mark Ettnger How can quantum computers do the amazng thngs that they are able to do, such as factorng large numbers and fndng dscrete logarthms? What makes them so dfferent from classcal computers? These questons are often asked, and they have proved to be surprsngly dffcult to answer at least to the satsfacton of everyone! In ths short artcle, I ll try to address these questons by comparng the operaton of a quantum computer wth playng the game of 20 questons But frst, let s consder an unusual perspectve on computers n general What Is a Computer? Well, a computer s really just some physcal machne that you prepare n a certan way, manpulate n certan ways, and then watch to observe the results t dsplays That s how physcsts mght descrbe the entre physcal process that mathematcans call a computaton Ths vew seems a bt strange at frst because we have become accustomed to the more abstract vew of the computer scentst, who sees a computaton as a certan type of process that acts on an nput n order to produce an output But our physcal descrpton s not really so dfferent It just emphaszes the physcal nature of the computaton, somethng that falls by the waysde n the abstracted vew The ntal preparaton s what a computer scentst calls an nput, the actual computaton s the physcal manpulaton, and the observaton at the end results n gettng the output So, whereas a computaton can be vewed abstractly as a process, ts physcal nature can also be emphaszed Ths vew wll help us make the transton to understandng what a quantum machne s dong n a specal way Unlke classcal computers, whch are physcal devces manpulated accordng to the laws of classcal physcs, quantum computers are physcal devces manpulated accordng to the laws of quantum physcs 46 Los Alamos Scence Number

2 Quantum Computers and the 20 Questons Game Havng understood that a computaton s ultmately a physcal process, let s go on to see how usng a quantum machne s much lke playng the game of 20 questons Twenty questons s played as follows I thnk of a number between and 2 20 You try to guess my secret number by askng questons such as, Is your secret number less than 2378? If you ask your questons well, you can guess my secret number n, at the most, 20 questons Why? Well, wth each queston, you can elmnate half of the remanng canddates Computer scentsts call ths process bnary search, and t allows you to fnd a secret number less than 2 n n log 2 n = n questons at the most The key dea s that, by cuttng the number of possbltes n half wth each queston, you are left wth one possblty after only n questons Ths prncple generalzes For example, f you are searchng for a secret tem among N possbltes and wth each queston you are able to elmnate a fracton /c of the possbltes, then you can fnd the secret n log c N questons In general, you mght not be lookng for a number You mght be lookng for a secret element x n a set S called a search space The key to quck success s stll to be able to elmnate a constant fracton of the remanng canddates Now, let s consder a slghtly dfferent verson of ths game, whch we call random 20 questons In playng random 20 questons, you don t get to choose your queston Instead, you randomly select a subset Q (used for the word queston ) consstng of half of the N elements n the search space, and you ask, Is the secret element n Q? After I gve you the honest answer, you choose a new random subset Q and ask agan Surprsngly, agan after only about log N questons, you wll almost surely have narrowed the possbltes down to the one correct answer We say almost surely because there s a tny, tny chance that you wll get unlucky and never be able to elmnate one of the elements that s not the secret element Ths tny chance s the result of each queston havng been selected randomly rather than determnstcally, whch s the case when playng the orgnal 20 questons game After 2 log N questons, for example, that possblty s ncredbly small So, even by askng random questons, you can dscover the secret element quckly The reason s that, as n the orgnal 20 questons game, you are able to elmnate each ncorrect element as a possblty Although n the random 20 questons game ths process of elmnaton s only very hghly probable, t s so close to beng certan that, for all practcal purposes, we won t worry about t Now, let s talk about playng quantum 20 questons In ths game, I choose a secret quantum state ρ from a search space of quantum states S ={ρ, ρ 2, ρ Ν }, and I supply a copy of the secret state whenever you request one Your task s to dscover my secret quantum state by askng quantum questons, that s, by dong measurements on each requested quantum state and thus gettng nformaton about the state Now, let s back up a bt and clarfy these terms What s a quantum state? A pure state ψ s smply a vector n a Hlbert space A mxed state, or more smply a state, s a convex combnaton of pure states ψ, that s, a classcal probablstc mxture of pure states: ρ = p ψ ψ, where p = () Number Los Alamos Scence 47

3 Quantum Questons Playng search games s much lke tryng to break codes If you try to break a code, you want to look for a cryptographc key To solve classcal cyptographc problems wth quantum computers, you are lookng for a secret key from among a known set of possble secret keys What s a quantum queston? A quantum queston s typcally called an observable We ll thnk of a quantum queston as smply an orthonormal bass The answer to a quantum queston wll be one of the bass vectors So, suppose the secret quantum state s a pure state ϕ and the quantum queston s { φ, φ 2,, φ Μ }, a bass of the M-dmensonal Hlbert space Accordng to the basc rules of quantum mechancs, we get the answer φ wth probablty φ ϕ 2 If we have a mxed state nstead of a pure state, the probablty formula s extended by convexty, as usual How many quantum questons does t take to guess the secret quantum state? That depends on lots of thngs It depends on what quantum questons you are allowed to ask me And t also depends on how dfferent the states n S are from each other In ths context, the word dfferent means how dstngushable the states are from each other For example, two orthogonal pure states are as dfferent as two states can be Two very nearly parallel pure states are almost ndstngushable n that t takes many experments and questons to tell them apart based on the outcome statstcs The standard measure of smlarty between two pure states s smply ther overlap φ ϕ There are measures for the smlarty or overlap of mxed states as well, but we won t need the formula We just need to know that to tell apart two smlar states requres many experments whereas to tell apart two very dfferent states requres few experments So, gong back to quantum 20 questons, let s assume you can ask any quantum queston you want; that s, you can choose any orthonormal bass as the observable If all the states n S are suffcently dfferent from each other, you can fnd my secret state after only a few questons Usually, when we use the word few n ths context, we mean log S or log 2 S or somethng lke that (A computer scentst would say that few means a polynomal functon of the logarthm of the sze of the search space) The key to a fast search s that all the states must be qute dfferent from each other It turns out that playng search games s much lke tryng to break codes If you try to break a code, you want to look for a cryptographc key The key s what allows you to decpher the code and read the message One popular code s the RSA Named after ts nventors Ronald Rvest, Ad Shamr, and Leonard Adleman the RSA uses as ts key the secret factors of a large number N Now, suppose you are tryng to break a code by fndng a secret key k from among a very large set of possble keys K = {k, k 2, k Μ } Further suppose that, by some process and wthout knowng the key, you can prepare a quantum state ρ correspondng to the key k So, you now have a state ρ, whch you know comes from the search space S ={ρ,, ρ M }, whch s the set of states correspondng to all the possble secret keys, but you don t know exactly whch of the states you have If the states of S are all suffcently dfferent, then you can ask quantum questons to determne the secret state effcently And f you can fnd the secret state, then you can easly fgure out the orgnal secret key correspondng to that secret state! Indeed, ths s precsely how quantum computers would solve varous classcal cryptographc problems, such as factorng and fndng dscrete logarthms A factorng problem s one n whch you are gven a very large number N (say, one wth 2000 dgts), whch s the product of two prmes N = pq, and your task s to fnd p and q For the dscrete logarthm problem, you are gven a large prme number p (say, once agan, one wth 2000 dgts) and two numbers a and b less than p Your task s to fnd n such that a n = b (mod p) In both cases, you are lookng for a secret key k from among a known set of possble secret keys Also, n both cases there s a process by whch you can prepare a quantum state from whch k can be deduced Sgnfcantly, ths preparaton process does not requre knowng k Ths last pont s mportant because, f you had to know the key frst, then the codebreakng machne would not be very useful We wll later llustrate ths process n an 48 Los Alamos Scence Number

4 example (see the secton Smon s Problem ) Fnally, ths process has the specal and mportant qualty that, for two dfferent keys, k and k 2, the resultng quantum states, ρ and ρ 2, are qute dfferent, or clearly dstngushable from one another, as dscussed before We can therefore ask quantum questons, whch allow us to dstngush among states and dentfy secret keys Ths ablty to dstngush among the states s usually accomplshed by elmnatng the possblty of a constant fracton, say /2, of the remanng states As we saw n the game of 20 questons, elmnatng a constant fracton after each queston allows us to narrow the possble states down to the one true state n only log N questons However, snce the quantum formula gves probabltes for certan outcomes, we elmnate the false states wth hgh probablty (not wth certanty), as n the game of random 20 questons Identfyng Secret Quantum States Let us fll n some of the techncal detals of our sketch Frst, can we really ask any quantum queston? No, we can t, but fortunately we are able to ask the questons that let us solve factorng and dscrete logarthm problems Recallng our observaton that a computaton s actually a physcal process, we must be sure to carry out effcently the physcal process correspondng to the quantum queston we wsh to ask We accomplsh ths task by breakng down the observable nto elementary quantum gates Elementary quantum gates are analogous to the basc logcal gates and, or, and not, whch are the buldng blocks of crcuts n classcal computers (for more detals, see Shor 997) In the case of factorng and dscrete logarthm problems, t turns out that we have to ask only one quantum queston over and over agan n order to obtan enough nformaton for dentfyng the secret quantum state Called the quantum Fourer transform, ths quantum queston allows us to dstngush among the states that arse n the two search spaces for the factorng and dscrete logarthm problems These states are called hdden subgroup states because, n those problems, the key we are lookng for corresponds to an unknown subgroup H of a fnte abelan group G The search space corresponds to the set {ρ Η, ρ H2, ρ H }, where H to H s a range over all the possble subgroups of G, and ρ H s the mxed state that corresponds to a unform mxture of the pure coset states In factorng and dscrete logarthm problems, we must ask only one quantum queston over and over agan n order to obtan nformaton for dentfyng the secret quantum state c + Η = c + h H h H (2) It can be shown that for H and H 2, two dfferent subgroups, the correspondng states ρ Η and ρ H2 are suffcently dfferent Mathematcally speakng, the overlap of ρ Η and ρ H2 s less than /2 (Ettnger et al 999) For a dscusson of the hdden subgroup problem and the reasons why the quantum Fourer transform s the rght quantum queston, see Ettnger and Peter Hoyer (999) Smon s Problem To llustrate everythng we have dscussed, let s consder a concrete example known as Smon s problem Smon s problem and the quantum algorthm to solve t contan the essence of what s gong on n the factorng and dscrete logarthm problems; the latter set of problems, however, also contans a number of techncal twsts that obscure the man deas The set of all bt strngs of length n, denoted Z 2 n, s a commutatve group f Number Los Alamos Scence 49

5 Our quantum algorthm for solvng Smon s problem allows dstngushng among dfferent states and thus dscoverng the underlyng secret bt strng we add bt strngs usng bnary add wthout carry Ths group wll be our search space I wll secretly choose an element s of ths group and provde you wth a functon n the form of a black box, f s on Z 2 n, wth the followng specal property: I guarantee that f s (x) =f s (y) f and only f x y = s So, the functon f s encodes the secret bt strng s Because f depends entrely on s, the latter becomes a subscrpt on f If you compute the functon on the elements of the group f s (a), f s (b), f s (c), eventually you ll get a collson, whch means that you ll fnd f s (g) =f s (t) and then you ll know that the secret bt strng s s = g t But notce that the search space, or the group, has 2 n elements, whch s a very large number In the worst case, t could take you 2 n + calculatons to get a collson, and on average t wll take about 2 n/2 because of the so-called brthday paradox That s stll a lot of tme! But the quantum algorthm can solve ths problem much more quckly n about n tres only Here s how Smon s problem works: You start wth a quantum computer whose qubts are conceptually dvded nto two regsters Then you prepare the pure state ψ = /2 n/2 b b, where b Z 2 n Thus, n the frst regster, there s a superposton of all the bs Now, because you have the black box functon f s, you can compute f s (b) n the second regster to obtan the pure state ψ s = /2 n/2 b b f s (b), where agan b Z 2 n Notce that ths procedure for preparng the state ψ s s easly accomplshed wthout any knowledge of the secret bt strng s Of course, for dfferent secret bt strngs, we obtan dfferent states In fact, ths s the key pont Our quantum algorthm s really just a method used to dstngush among these dfferent states and thus dscover the underlyng secret bt strng We now observe, or perform a measurement, on the second regster Because of the way quantum mechancs works, ths observaton collapses ψ s, producng a specfc value n the second regster, say c, and the frst regster s left n a superposton of bt strngs that map to c under f s Because f s has the specal property descrbed earler, the bt strngs that map to c wll dffer by the secret bt strng s Therefore, the state of the computer s ψ = a c + a + s c as, 2 2, (3) where a and a + s are elements of Z 2 n such that f s (a) = c and f s (a + s) =c The only use of the second regster s to produce ths specal superposton n the frst regster We wll no longer use the second regster or ts contents, so we drop t from our notaton and wrte ψ = a + a + s as, 2 2 When c s chosen, the resultng mxed state can be wrtten as ρs = ψ ψ n as as 2,, a Recall that we don t know the secret bt strng s, and therefore we don t know that the state we just prepared s ρ s All we know s that we have prepared a state that s n the search space of quantum states {ρ s } s Z2 n Each of these possble quantum states corresponds to a possble secret bt strng Our task s to dentfy the secret quantum state (4) (5) The brthday paradox derves ts name from the surprsng result that you only need 23 people (a slghtly larger number than 365 /2 ) to have a 50 percent chance that at least two of them have the same brthday 50 Los Alamos Scence Number

6 and thus the secret bt strng We now defne the Fourer observable For each bt strng b n Z 2 n, defne χ b The orthonormal bass s { χ b }, where b Z n 2 s called the Fourer bass or the Fourer observable Mathematcans mght recognze ths bass as beng composed of the characters of the group Z n 2 A character χ of a fnte abelan group s a homomorphsm from the group to the crcle n the complex plane Formally, the Hlbert space n whch we are workng s C[G], the group algebra, whch s the complex vector space wth the canoncal bass, or the pont mass bass, ndexed by the elements of the group A character can be vewed as a vector n C[G] va the followng dentfcaton: χ = n 2 d Z = χ( g) g G g G n 2 bd ( ) d where b d = bd ( 2) It s a fundamental fact (Tolmer et al 997) that the set of characters vewed as vectors n ths way s an orthonormal bass for C[G] Indeed, a Fourer transform s nothng other than a change of bass from the pont mass bass, { g } g G, to the bass of characters, { χ } χ It s easy to show (Jozsa 998) that, f we now observe the contents of the remanng regster n the Fourer bass, we observe χ b wth nonzero probablty f and only f s b = 0 (mod 2) Ths s the mportant relatonshp between the secret bt strng s and the only possble outcomes of the experment Therefore, f the actual outcome of the observaton s χ b, then we have elmnated half of the possble secret states We have therefore elmnated all states ρ d such that d b = (mod 2) By repeatng the state preparaton procedure followed by a measurement n the Fourer bass approxmately n tmes, we elmnate all possble states except the true secret state ρ s, mod (6) (7) Mark Ettnger graduated from the Massachusetts Insttute of Technology n 987 wth Bachelor s degrees n physcs and mathematcs In 996, Mark receved hs PhD n mathematcs from the Unversty of Wsconsn at Madson He frst came to Los Alamos Natonal Laboratory n 993, as a graduate student, then entered the postdoctoral program after graduaton n 996, and became a staff member n 999 Mark worked on the group-theoretcal approach to quantum algorthms for four years and s now prmarly nterested n (classcal) algorthmc problems n postgenomc computatonal bology Further Readng Ettnger, M, and P Hoyer 999 Quantum State Detecton va Elmnaton [Onlne]: (quant-ph/ ) Ettnger, M, P Hoyer, and E Knll 999 Hdden Subgroup States are Almost Orthgonal[Onlne]: (quant-ph/990034) Jozsa, R 998 Quantum Algorthms and the Fourer Transform Proc R Soc London, Ser A 454: 323 Shor, P W 997 Polynomal-Tme Algorthms for Prme Factorzaton and Dscrete Logarthms on Logarthms on a Quantum Computer SIAM J Computng 26: 484 Tolmer, R, M An, and C Lu 997 Mathematcs of Multdmensonal Fourer Transform Algorthms New York: Sprnger Number Los Alamos Scence 5