Martin Roetteler

We study the quantum query complexity of the Boolean hidden shift problem. Given oracle access to f(x+s) for a known Boolean function f, the task is to determine the n-bit string s. The quantum query complexity of this problem depends strongly on f. We demonstrate that the easiest instances of this problem correspond to bent functions, in the sense that an exact one-query algorithm exists if and only if the function is bent. We partially characterize the hardest instances, which include delta functions. Moreover, we show that the problem is easy for random functions, since two queries suffice. Our algorithm for random functions is based on performing the pretty good measurement on several copies of a certain state; its analysis relies on the Fourier transform. We also use this approach to improve the quantum rejection sampling approach to the Boolean hidden shift problem.

Elliptic curves over finite fields GF(2^n) play a prominent role in modern cryptography. Published quantum algorithms dealing with such curves build on a short Weierstrass form in combination with affine or projective coordinates. In this paper we show that changing the curve representation allows a substantial reduction in the number of T-gates needed to implement the curve arithmetic. As a tool, we present a quantum circuit for computing multiplicative inverses in GF(2^n) in depth O(n log n) using a polynomial basis representation, which may be of independent interest.

Finite fields of the form GF(2^m) play an important role in coding theory and cryptography. We show that the choice of how to represent the elements of these fields can have a significant impact on the resource requirements for quantum arithmetic. In particular, we show how the use of Gaussian normal basis representations and of `ghost-bit basis' representations can be used to implement inverters with a quantum circuit of depth O(m log(m)). To the best of our knowledge, this is the first construction with subquadratic depth reported in the literature. Our quantum circuit for the computation of multiplicative inverses is based on the Itoh-Tsujii algorithm which exploits that in normal basis representation squaring corresponds to a permutation of the coefficients. We give resource estimates for the resulting quantum circuit for inversion over binary fields GF(2^m) based on an elementary gate set that is useful for fault-tolerant implementation.

Rejection sampling is a well-known method to sample from a target distribution, given the ability to sample from a given distribution. The method has been first formalized by von Neumann (1951) and has many applications in classical computing. We define a quantum analogue of rejection sampling: given a black box producing a coherent superposition of (possibly unknown) quantum states with some amplitudes, the problem is to prepare a coherent superposition of the same states, albeit with different target amplitudes. The main result of this paper is a tight characterization of the query complexity of this quantum state generation problem. We exhibit an algorithm, which we call quantum rejection sampling, and analyze its cost using semidefinite programming. Our proof of a matching lower bound is based on the automorphism principle which allows to symmetrize any algorithm over the automorphism group of the problem. Our main technical innovation is an extension of the automorphism principle to continuous groups that arise for quantum state generation problems where the oracle encodes unknown quantum states, instead of just classical data. Furthermore, we illustrate how quantum rejection sampling may be used as a primitive in designing quantum algorithms, by providing three different applications. We first show that it was implicitly used in the quantum algorithm for linear systems of equations by Harrow, Hassidim and Lloyd. Secondly, we show that it can be used to speed up the main step in the quantum Metropolis sampling algorithm by Temme et al.. Finally, we derive a new quantum algorithm for the hidden shift problem of an arbitrary Boolean function and relate its query complexity to "water-filling" of the Fourier spectrum.

The k-pair problem in network coding theory asks to send k messages simultaneously between k source-target pairs over a directed acyclic graph. In a previous paper [ICALP 2009, Part I, pages 622--633] the present authors showed that if a classical k-pair problem is solvable by means of a linear coding scheme, then the quantum k-pair problem over the same graph is also solvable, provided that classical communication can be sent for free between any pair of nodes of the graph. Here we address the main case that remained open in our previous work, namely whether nonlinear classical network coding schemes can also give rise to quantum network coding schemes. This question is motivated by the fact that there are networks for which there are no linear solutions to the k-pair problem, whereas nonlinear solutions exist. In the present paper we overcome the limitation to linear protocols and describe a new communication protocol for perfect quantum network coding that improves over the previous one as follows: (i) the new protocol does not put any condition on the underlying classical coding scheme, that is, it can simulate nonlinear communication protocols as well, and (ii) the amount of classical communication sent in the protocol is significantly reduced.

Most quantum algorithms that give an exponential speedup over classical algorithms exploit the Fourier transform in some way. In Shor's algorithm, sampling from the quantum Fourier spectrum is used to discover periodicity of the modular exponentiation function. In a generalization of this idea, quantum Fourier sampling can be used to discover hidden subgroup structures of some functions much more efficiently than it is possible classically. Another problem for which the Fourier transform has been recruited successfully on a quantum computer is the hidden shift problem. Quantum algorithms for hidden shift problems usually have a slightly different flavor from hidden subgroup algorithms, as they use the Fourier transform to perform a correlation with a given reference function, instead of sampling from the Fourier spectrum directly. In this paper we show that hidden shifts can be extracted efficiently from Boolean functions that are quadratic forms. We also show how to identify an unknown quadratic form on n variables using a linear number of queries, in contrast to the classical case were this takes Theta(n^2) many queries to a black box. What is more, we show that our quantum algorithm is robust in the sense that it can also infer the shift if the function is close to a quadratic, where we consider a Boolean function to be close to a quadratic if it has a large Gowers U_3 norm.

Attempts to separate the power of classical and quantum models of computation have a long history. The ultimate goal is to find exponential separations for computational problems. However, such separations do not come a dime a dozen: while there were some early successes in the form of hidden subgroup problems for abelian groups--which generalize Shor's factoring algorithm perhaps most faithfully--only for a handful of non-abelian groups efficient quantum algorithms were found. Recently, problems have gotten increased attention that seek to identify hidden sub-structures of other combinatorial and algebraic objects besides groups. In this paper we provide new examples for exponential separations by considering hidden shift problems that are defined for several classes of highly non-linear Boolean functions. These so-called bent functions arise in cryptography, where their property of having perfectly flat Fourier spectra on the Boolean hypercube gives them resilience against certain types of attack. We present new quantum algorithms that solve the hidden shift problems for several well-known classes of bent functions in polynomial time and with a constant number of queries, while the classical query complexity is shown to be exponential. Our approach uses a technique that exploits the duality between bent functions and their Fourier transforms.

Many exponential speedups that have been achieved in quantum computing are obtained via hidden subgroup problems (HSPs). We show that the HSP over Weyl-Heisenberg groups can be solved efficiently on a quantum computer. These groups are well-known in physics and play an important role in the theory of quantum error-correcting codes. Our algorithm is based on non-commutative Fourier analysis of coset states which are quantum states that arise from a given black-box function. We use Clebsch-Gordan decompositions to combine and reduce tensor products of irreducible representations. Furthermore, we use a new technique of changing labels of irreducible representations to obtain low-dimensional irreducible representations in the decomposition process. A feature of the presented algorithm is that in each iteration of the algorithm the quantum computer operates on two coset states simultaneously. This is an improvement over the previously best known quantum algorithm for these groups which required four coset states.