## 1 Introduction

Solving polynomial systems and optimization over finite fields are fundamental computation problems in mathematics and computer science, which are also typical NP hard problems. In this paper, we give quantum algorithms to these problems, which could be exponential faster than the traditional methods under certain conditions.

### 1.1 Main results

Let be a finite field, where for a prime number and . Let be a set of polynomials in variables and with total sparseness , where denotes the number of terms in . For , we show that

###### Theorem 1.1.

There is a quantum algorithm which decides whether has a solution in and computes one if does have solutions in , with success probability at least and complexity , where , is the total sparseness of , and is the condition number of (see Theorem 3.13 for definition).

The complexity of a quantum algorithm is the number of quantum gates needed to solve the problem. Since are smaller than the input size, the complexity of the algorithm is polynomial in the input size and the condition number, which means that we can solve polynomial systems over finite fields using quantum computers with any given success probability and in polynomial-time if the condition number of is small, say when is poly.

We also give a quantum algorithm to solve the following optimization problem.

subject to | ||||

where , , , and . The complexity of the algorithm is polynomial in the size of the input, , , and the condition number of the problem (see Theorem 5.4 for definition). Since Problem 1.1 is NP-hard, the algorithm gives an exponential speedup over traditional methods if the condition number is small, say poly.

Note that for , Problem (1.1) includes polynomial system solving over as a special case. Problem (1.1) is meaningless for with and , since cannot be embedded into .

We apply our methods to three computational problems widely used in cryptography: the polynomial systems with noise problem (PSWN) [2, 17, 20], the short integer solution problem (SIS) [1], the shortest vector problem (SVP) [4, 23, 6]. We also show how to recover the private keys for the latticed based cryptosystem NTRU with our algorithm. The complexity for solving all of these problems is polynomial in the input size and their condition numbers.

The latticed based computational problems SVP and LWE are the bases for 23 of the 69 submissions for the call by NIST to standardize the post-quantum public-key encryption systems [4]. LWE is another important problem in cryptography and can be reduced to the SIS problem [25]. In theory, our results imply that the 23 proposed cryptosystems can against the attack of quantum computers only if the related condition numbers are large. So, the condition number could be used as a new criterion for lattice based post-quantum cryptosystems.

Let be a prime and with . The PSWN is to find an which satisfies the maximal number of equations in . The problem is also called MAX-POSSO [2, 20]. Our quantum algorithm for PSWN has complexity , where is the condition number of the problem. The PSWN is very hard in the sense that, even for the linear system with noise (LSWN) over , to find an satisfying more than of the equations is NP hard [17, 30].

Lattice-based cryptography began in 1996 with a seminal work by Ajtai [1], who presented a family of one-way functions based on the SIS. The SIS problem is to find a solution of a homogenous linear system for , such that is smaller than a given bound. Our quantum algorithm for SIS has complexity , where is the number of nonzero elements in and is the condition number of the problem.

The SVP and CVP are two basic NP-hard problems widely used in cryptography. The SVP is to find a nonzero vector with the smallest Euclidean norm in a lattice in . The CVP is to find a vector in a lattice, which is closest to a given vector. The SIS [1] and LWE [25] are the randomized versions of SVP and CVP, respcetively. Our quantum algorithm for SVP has complexity , where is the rank of the lattice, is the maximal value in the generators of the lattice, and is the condition number of the problem. Our quantum algorithm for CVP has a similar complexity.

NTRU is a lattice-based public key cryptosystem proposed by Hoffstein, Pipher and Silverman [19], which is one of the most promising candidates for post-quantum cryptosystems. Our quantum algorithm can be used to recover the private key from the public key in time for an NTRU with parameters with . In particular, we show that the three versions of NTRU recommended in [19] have the desired security against quantum computers only if their condition numbers are large.

### 1.2 Main idea of the algorithm

Let be a set of polynomials over .
A solution of is called Boolean if its components
are either or . Similarly, a variable is called a Boolean variable if it satisfies .
In [12], we give a quantum algorithm^{1}^{1}1No knowledge of quantum algorithm is needed to read this paper. What we do is to use traditional methods to reduce the problems
to be solved to this result. to find
Boolean solutions of a polynomial system over ,
which is called B-POSSO in the rest of
this paper.
The main idea of the quantum algorithms proposed in this paper
is to reduce the problem to be solved to B-POSSO,
under the condition that the number of variables and the
total sparseness of the new polynomial system is polynomial
in the size of the original polynomial system.

Our algorithm for problem (1.1) consists of three main steps: (1) The equational constraints are reduced into polynomial equations in Boolean variables over . (2) The inequality constraints are reduced into polynomial equations in Boolean variables over . (3) The problem of finding the minimal value of the objective function is reduced several B-POSSOs. We will give a brief introduction to each of these three steps below.

A key method used in our algorithm is to use a polynomial in Boolean variables to represent the integers for . Let , where is a set of Boolean variables. Then, the values of are exactly .

For and , we use three steps to reduce the problem of finding a solution of in to a B-POSSO. (1) is reduced to a quadratic polynomial system (MQ) by introducing new variables. (2) Each variable in is expanded as and is reduced to another MQ in Boolean variables . Since is quadratic, the total sparseness of is well controlled. (3) We obtain a polynomial over from as follows , where is a set of Boolean variables. It is shown that solutions of in can be recovered from Boolean solutions of , which can be found with the quantum algorithm from [12].

We also reduce an inequality constraint for and into a B-POSSO. There exist and such that if and only if has a solution for , , and , where is a set of Boolean variables. We reduce into a polynomial in Boolean variables by first reducing into an MQ and then expanding the variables into Boolean variables by using the function. Let be the degree of . Then the values of is exponential in and hence the number of Boolean variables needed is polynomial in . This is why the complexity of the algorithm depends on .

Since all variables are bounded, the objective function is also bounded, and we can assume for some . We design a novel search scheme to reduce the minimization of to several B-POSSOs. The minimal value of is found by bisecting the feasible interval recursively into subintervals of the form and deciding whether has a solution, which is equivalent to solving the equation for Boolean variables . As a consequence, we can find the minimal value of by solving several B-POSSOs.

### 1.3 Relation with existing work

Problem (1.1) includes many important problems as special cases, such as the polynomial system solving over finite fields [14], PSWN [2, 17, 20, 30], SIS [1], SVP/CVP [4, 23, 6], the -programming problem [16], the quadratic unconstrained binary optimization problem which is the mathematical problem that can be solved by the D-Wave System [21], which are all important computation problems and were widely studied.

Comparing to the existing work, our algorithm has two major advantages. First, we give a universal approach to a very general problem. Second, the complexity of our algorithm is polynomial in the inputs size, the degree of the inequalities, and the condition number of the problem. Since the problems under consideration are NP hard, existing algorithms are exponential in some of the parameters such as the number of variables. In this aspect, we give a new way of looking at these NP hard problems by reducing the computational difficulty to the size of the condition number.

Our algorithm is based on the quantum algorithm to solve B-POSSOs proposed in [12], which in turn is based on the HHL quantum algorithm and its variants to solve linear systems [18, 5, 13]. Comparing to the HHL algorithm, we can give the exact solution, while the HHL algorithm can only give the quantum state. The speedup of our algorithms comes from the HHL algorithm. The limitation on the condition number is inherited from the HHL algorithm, and it is proved in [18] that the dependence on condition number cannot be substantially improved. Also note that, the best classic numerical method for solving an order linear equation has complexity , which also depends on the condition number of [26].

The method of treating the inequality constraints with the function simplifies the computational significantly. The binary representation for is often used in the literature to represent the integers . The values of is , which may contain integers strictly larger than and cannot be used to represent inequalities. In [7, 3], the inequality is reduced to . Our reduction is better, which does not increase the degree of the equation and the size of the equation is increased in the logarithm scale, while the method used in [7, 3] increases the degree by a factor and increases the size of the equation exponentially.

The rest of this paper is organized as follows. In Section 2, we define the function and give an explicit formula to reduce a polynomial system into an MQ. In Section 3, we present the algorithm for solving polynomial systems over finite fields. In Section 4, we show how to reduce the inequality constraints in problem (1.1) to a B-POSSO. In Section 5, we present the algorithm for solving problem (1.1). In Section 6, we present a quantum algorithm for PSWN. In Section 7, we present a quantum algorithm for SIS. In Section 8, we present a quantum algorithm for SVP/CVP. In Section 9, we present a quantum algorithm to recover the private key for NTRU. In Section 10, conclusions are given.

## 2 Two basic reductions

In this section, we give two basic reductions frequently used in the paper: to represent an integer interval with a Boolean polynomial and to reduce a polynomial system to an MQ.

### 2.1 Represent an integer interval with a Boolean polynomial

A variable is called a Boolean variable if it satisfies . In this paper, we use uppercase symbols to represent Bollean variables. A polynomial is called a Boolean polynomial if it is in a set of Boolean variables. In this section, we will construct a Boolean polynomial whose values are exactly the integers for a given positive integer .

Set and introduce Boolean variables . Inspired by , we introduce the function : and for

(3) |

###### Lemma 2.1.

When evaluated in or with , is a surjective map from to . Furthermore, .

###### Proof.

We first assume that is evaluated over . It is easy to check this lemma when . When , from the definition of , we have and hence . Since the values of are , for any integer , has a preimage of map , where . Now consider an integer . Since , we have . Since , we have . Thus , and then has a preimage of map , where . It is clear . Since , we have +1. The lemma is also valid when is evaluated over , since all values in the computation are . ∎

For instance, , , .

###### Remark 2.2.

It is easy to check that is injective if and only if for some positive integer . For instance, is not injective: has two preimages and .

### 2.2 Reduce polynomial system to MQ

It is well known that a polynomial system can be reduced to an MQ by introducing some new indeterminates. In this section, we give an explicit reduction which is needed in the complexity analysis in this paper.

For any field , let be the polynomial ring over in the indeterminates . Denote the sparseness (number of terms) of as . For , denote to be the total sparseness of , to be the number of indeterminates in , to be the degree of in , to be the set of all monomials in , and to be the size of the coefficients of the polynomials in , to be the ideal generated by in .

We want to introduce some new indeterminates to rewrite as an MQ.

###### Lemma 2.3.

Let . We can introduce a set of new indeterminates and an MQ such that . Furthermore, we have , , , , and , where and .

###### Proof.

If is already an MQ, set and . First, we introduce new indeterminates for and new polynomials and for . It is clear that . Without loss of generality, we assume and if , then we do not need these . Let be a monomial of , and be the binary representation of , where and . Thus

Rewrite these as and we have , where . To rewrite this product as an MQ, we introduce new indeterminates and quadratic polynomials , for and . Denote . Finally, we obtain an MQ

(5) | |||||

where and is obtained by replacing by in . For convenience, we denote

(6) |

Let be the set of new indetermiantes. It is clear that the number of these is . To represent , we need new indeterminates . In total, we have . Then, , since . , since . contains polynomials and binomials. Then . Since we only introduce new coefficients , we have . ∎

###### Example 2.4.

Let . We have , , and . Then , , where . Finally, . Note that the above representation is not optimal and we can use less new variables to represent , where .

## 3 Polynomial system solving over finite fields

Let be a finite set of polynomials over the finite field , , and . In this section, we give a quantum algorithm to find a solution of in . Denote the solutions of in by . For a prime number , we use the standard representation .

### 3.1 Reduce MQ over to MQ in Boolean variables over

Let be an MQ, , and . In this section, we will construct a set of Boolean polynomials over , from which we can obtain . The reduction procedure consists of the following two steps.

Step 1. We reduce to a set of polynomials in Boolean variables over . If , then the are already Boolean and we can skip this step. We thus assume and set

(7) | |||||

(8) | |||||

where is defined in (3) and are Boolean variables. Let , where . Substituting (8) into , we have

(9) | |||||

For any set , set

We have

###### Lemma 3.1.

There is a surjective morphism , where . Furthermore, and the total sparseness of is .

###### Proof.

Step 2. We introduce new Boolean indeterminates and reduce each into a Boolean polynomial over . Let and let

(10) | |||||

(11) | |||||

(12) | |||||

(13) | |||||

(14) |

and we have

###### Lemma 3.2.

There is a surjective morphism ,
where

.