Solving Binary \(\mathcal {MQ}\) with Grover’s Algorithm

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10076)


The problem of solving a system of quadratic equations in multiple variables—known as multivariate-quadratic or \(\mathcal {MQ}\) problem—is the underlying hard problem of various cryptosystems. For efficiency reasons, a common instantiation is to consider quadratic equations over \(\mathbb {F}_2\). The current state of the art in solving the \(\mathcal {MQ}\) problem over \(\mathbb {F}_2\) for sizes commonly used in cryptosystems is enumeration, which runs in time \(\varTheta (2^n)\) for a system of n variables. Grover’s algorithm running on a large quantum computer is expected to reduce the time to \(\varTheta (2^{n/2})\). As a building block, Grover’s algorithm requires an “oracle”, which is used to evaluate the quadratic equations at a superposition of all possible inputs. In this paper, we describe two different quantum circuits that provide this oracle functionality. As a corollary, we show that even a relatively small quantum computer with as little as 92 logical qubits is sufficient to break \(\mathcal {MQ}\) instances that have been proposed for 80-bit pre-quantum security.


Grover’s algorithm Multivariate quadratics Quantum resource estimates 

1 Introduction

The effects of large quantum computers on the world of modern cryptography are often summarized roughly as follows: “All factoring-based and discrete-log based cryptosystems are broken in polynomial time by Shor’s algorithm [Sho94, Sho97] and “symmetric crypto is affected by Grover’s algorithm [Gro96], but we just have to double the key size”. A more detailed look also reveals applications of Grover’s algorithm in various asymmetric schemes (as in this paper); an even more detailed look considers the question what exactly “large quantum computer” means, i.e., how many logical qubits and how much time is required to implement Shor’s and Grover’s algorithm. In the following, when we say “time” we always refer to the cumulative number of gates that need to be executed. This is obviously very different from the number of gates that might be physically implemented. For example, implementing a loop of length 100 around a certain circuit increases the number of executed gates (i.e., the time) by a factor of 100, but does not increase the number of physical gates (except maybe for the loop counter).

Recently, multiple papers have taken this more detailed approach of analyzing the cost of quantum attacks against cryptographic primitives. For example, in [GLRS16], Grassl, Langenberg, Roetteler, and Steinwandt describe how to attack AES-128 with Grover’s algorithm using a quantum computer with 2953 logical qubits in time about \(2^{87}\). We note that with the results of [GLRS16] it would also be possible to perform this computation on a quantum computer with only 984 qubits, however, then increasing time by a factor of 3. In [AMG+16], Amy, Di Matteo, Gheorghiu, Mosca, Parent and Schanck describe how to compute SHA-2 preimages with Grover’s algorithm on a quantum computer with 2402 logical qubits in time about \(2^{148}\) and how to compute SHA-3 preimages using 3200 qubits in time about \(2^{154}\). For Shor’s algorithm the common estimate is that one needs approximately 2n qubits to factor an n-bit number1. Breaking RSA-1024 thus needs a quantum computer with at least 2048 logical qubits.

These results seem to suggest that quantum computers only affect cryptography once they can be scaled to at least about one thousand qubits. In this paper we show that much smaller quantum computers can be used to break cryptographic schemes. Ironically, the schemes we are targeting are “post-quantum” schemes, i.e., schemes that have been proposed to replace factoring-based systems like RSA and discrete-log based systems like DSA to resist attacks by quantum computers. Specifically, we describe how to use Grover’s algorithm to solve multivariate systems of equations over \(\mathbb {F}_2\). This problem is known as the \(\mathcal {MQ}\) problem and it is in general NP-complete [GJ79]. It is the underlying hard problem of various signature schemes like HFEv\(^-\) [PCG01, PCY+15] and (variants of) Unbalanced Oil-and-Vinegar (UOV) [KPG99, DS05], and the identification scheme proposed in [SSH11].

It is long known that Grover’s algorithm provides a square-root speedup in enumeration attacks against this problem. What is new in this paper are two implementations together with a detailed analysis of the cost of this attack in terms of the number of required qubits and time (in the number of gates). These numbers for Grover’s algorithm are largely determined by the number of qubits and time required in an oracle that evaluates the target function. In the case of \(\mathcal {MQ}\), evaluating the target function means evaluating the system of quadratic equations at a superposition of all possible inputs. In this paper we describe two such oracles for systems of quadratic equations over \(\mathbb {F}_2\). The first oracle is easy to describe and for \(m-1\) quadratic equations in \(n-1\) variables it only needs \(m+n+2\) qubits and at most \(2m(n^2+2n)+1\) gates executed. The second oracle is more sophisticated and requires only \(3 + n + \lceil \log _2 m \rceil \) qubits, but approximately double the number of gates executed of the first oracle.

As a consequence, we show that the “80-bit secure” parameters (84 equations in 80 variables) used, for example, in the identification scheme described in [SSH11] can be broken on a quantum computer with only 168 logical qubits in time about \(2^{60}\) or on a quantum computer with only 92 logical qubits in time about \(2^{61}\).

Organization of this paper. Section 2 gives a very brief introduction to quantum computing to establish notation and to give the basic background required to follow the remainder of the paper. Section 3 collects the quantum gates we need in our oracles. Section 4 describes in detail our first Grover oracle for the \(\mathcal {MQ}\) problem over binary fields with a careful analysis of the complexity. Section 5 continues with a description of the more complex second oracle which requires fewer qubits. Finally, in Sect. 6, we briefly sketch how to optimize for circuit depth instead of number of qubits. In Appendix A we provide quipper code to generate the oracles and Python code to generate the first oracle. We place this code into the public domain.

2 Preliminaries

In this section we will first give a concise definition of the problem we solve in this paper. Then we introduce the bare essentials of quantum computing to apply Grover’s algorithm. For a proper introduction, see [NC10].

2.1 Problem Definition

Problem 1

A system of quadratic equations over \(\mathbb {F}_2\) is given by a “cube” \((\lambda ^{(k)}_{ij})_{i,j,k}\) over \(\mathbb {F}_2\) and a vector \((v_1, \ldots , v_m) \in \mathbb {F}_2^m\). The goal is to find \((x_1, \ldots , x_n) \in \mathbb {F}_2^n\) such that
$$\begin{aligned} \sum _{1 \le i,j \le n} \lambda ^{(1)}_{ij} x_i x_j = v_1 \quad \ldots \quad \sum _{1 \le i,j \le n} \lambda ^{(m)}_{ij} x_i x_j = v_m. \end{aligned}$$

Note that the system also contains linear terms as \(x_i^2 = x_i\).

For sizes of this problem commonly used in cryptography, the best classical algorithm known is (Gray-code) enumeration [BCC+14]. Specifically, [YCC04, Sect. 2.2] estimates that asymptotically faster algorithms take over only for systems with about \(n=200\) variables. On a quantum computer, however, one can use Grover’s algorithm [Gro96, BHT98]. To apply Grover’s algorithm, we need to provide a suitable oracle: a quantum circuit that checks whether a vector \((x_i)\) is a solution for a given system \((\lambda ^{(k)}_{ij}), (v_k)\). Every Boolean circuit can be translated into an equivalent quantum circuit, however, naïve translations typically require a vast amount of ancillary registers.

For notational convenience, we will solve the following equivalent problem.

Problem 2

A system of quadratic equations over \(\mathbb {F}_2\) in convenient form is given by a ‘cube’ \((\lambda ^{(k)}_{ij})_{i,j,k}\) in \(\mathbb {F}_2\) where \(\lambda ^{(k)}_{ij} = 0\) whenever \(i > j\). The goal is to find \(x_1, \ldots , x_n \in \mathbb {F}_2\) such that
$$\begin{aligned} \sum _{1 \le i \le j \le n} \lambda ^{(1)}_{ij} x_i x_j = 1 \quad \ldots \quad \sum _{1 \le i \le j \le n} \lambda ^{(m)}_{ij} x_i x_j = 1. \end{aligned}$$
Clearly every system in convenient form is also a regular system. Now we describe how to turn any system \((\lambda _{i,j}^{(k)}), (v_k)\) of m equations in n variables into an equivalent system \(({\lambda '}_{i,j}^{(k)})\) of \(m+1\) equations in \(n+1\) variables that is in convenient form. For \(1 \le i ,j \le n+1\) and \(1 \le k \le m\) define
$$\begin{aligned} {\lambda '}_{i,j}^{(k)} := {\left\{ \begin{array}{ll} \lambda _{i,j}^{(k)} &{} i = j \le n\\ \lambda _{i,j}^{(k)} + \lambda _{j,i}^{(k)} &{} i < j \le n \\ 1 + v_k &{} i = j =n+1 \\ 0 &{} \text {otherwise} \end{array}\right. } \qquad {\lambda '}^{(m+1)}_{i,j} := {\left\{ \begin{array}{ll} 1 &{} i = j = n+1 \\ 0 &{} \text {otherwise}. \end{array}\right. } \end{aligned}$$
The new equation forces \(x_{n+1}=1\) and so the new terms \({\lambda '}^{(k)}_{n+1,n+1} = 1+v_k\) compensate for having a constant term 1.

The first oracle we construct, will use at most \(n+m+2\) qubit-registers and \(O(mn^2)\) time for a system of m quadratic equations in convenient form with n variables. Our second oracle will only use \(n+3\) qubit-registers, but require approximately double the amount of time.

To conveniently describe our circuit later on, define
$$\begin{aligned} y^{(k)}_i = \sum _{1 \le j \le n} \lambda ^{(k)}_{ij} x_j \qquad E^{(k)} = \sum _{1 \le i \le n} x_i y^{(k)}_i. \end{aligned}$$
Then \((x_i)\) is a solution if and only if \(E^{(k)}=1\) for every \(1 \le k \le m\).

Example 1

As a running example throughout the paper, we will use the following small system:
$$\begin{aligned} x_1(1+ x_2 + x_3) + x_2x_3&= 1\\ x_2(1+x_3)&= 1 \end{aligned}$$

Before we continue with a step-by-step definition of the circuit for the first oracle, we will review with the basics of quantum computing and in particular Grover’s algorithm.

2.2 Quantum Computing

We start with finite classical computing and describe finite quantum computing later in a similar fashion. Write \(\underline{n}\) for the set of natural numbers less than n. Clearly \(\underline{2^n}\) is the set of possible states of an n-bit unsigned integer. Classically every function from \(f:\underline{2^n} \rightarrow \underline{2^m}\) is computable. However, some are easy to compute and others are practically infeasible. One measure of complexity is the size of the smallest Boolean circuit containing just NAND-gates that computes f.

Later we will see that it is not easy for a quantum computer to efficiently compute any classical function f, because every quantum gate must be invertible. For every classical simple reversible gate, however, there exists a counterpart quantum gate. In the construction of our oracles we will only use (the quantum counterparts of) classical reversible gates.

The state of a quantum computer with n qubits is a tuple \((a_0, \ldots , a_{2^n-1}) \) of \(2^n\) complex numbers with \( |a_0|^2 + \cdots + |a_{2^n-1}|^2 = 1\). It is convenient to write subscripts of a in binary, e.g. \(a_{1\ldots 1} := a_{2^n-1}\). If one opens up the quantum computer and looks at the qubits, one will find that they collapse into some classical state of just n bits in a non-deterministic fashion. The chance to find all qubits in the classical state 0 is \(|a_{0\ldots 0}|^2\). Similarly \(|a_{b_1 \ldots b_n}|^2\) is the chance to find the first qubit as the classical bit \(b_1\), the second qubit as the classical bit \(b_2\) and so on.

It is customary to define \(\left| {b_1 \ldots b_n}\right\rangle \) to be the state which is zero everywhere except for on the \(b_1\ldots b_n^{\mathrm {th}}\) place. For example \(\left| {0\ldots 0}\right\rangle = (1, 0, \ldots , 0)\), \(\left| {1\ldots 1}\right\rangle = (0,\ldots ,0, 1)\) and \(\frac{\left| {00}\right\rangle + \left| {11}\right\rangle }{\sqrt{2}} = (\frac{1}{\sqrt{2}}, 0,0,\frac{1}{\sqrt{2}})\). This last state is interesting: if one measures the first qubit to be 0 (resp. 1), one is sure that the second qubit must be 0 (resp. 1) as well. The two qubits are said to be entangled.

Every unitary complex \(2^n \times 2^n\) matrix U preserves length and thus will send a state a to a new state Ua. Every operation a quantum computer can perform (except for measurement) will be of this form. Conversely, every unitary (matrix) is realizable by a universal quantum computer.

However, just like in the classical case, not every unitary is efficient to compute. It is not yet clear what the primitive operations of the first practical quantum computer will be and thus what would be the appropriate basic gates of this quantum computer — or whether gate-count itself would be the most apt measure of complexity. For instance, some gates (the Toffoli gates) in the gate set we will use are more costly to make fault tolerant with the current quantum error correcting codes than the others. For now we will make do.

If \(f:\underline{2^n} \rightarrow \underline{2^n}\) is a reversible map, there is a unitary \(U_f\) fixed by \(U_f \left| {b_1 \ldots b_n}\right\rangle = \left| {f(b_1 \ldots b_n)}\right\rangle \). In this way a reversible function corresponds to a quantum program.

2.3 Applying Grover’s Algorithm

Problem 3

Let \(f:\underline{2^n} \rightarrow \underline{2}\) be a function which is valued 0 everywhere except on one place. The problem is to find, given a Boolean circuit for f, the place where f is valued 1.

Classically one cannot do better in general than to try every possible input. On average one will have to execute f for \(2^{n-1}\) times. With a quantum computer this problem can be solved with high probability by executing the quantum analogue of f just \(2^{\frac{1}{2}n}\) times using just n qubits. This is done using Grover’s algorithm. Actually, Grover’s algorithm (with the quantum counting extension [BHT98]) solves the more general problem where f has arbitrarily many places where it is valued 1 and one is interested in any preimage of 1. In this paper, however, we only need the simpler version.

Clearly f is not reversible. How can we then feed it to a quantum computer where every operation should be invertible? One way is to define a new classical reversible function \(R_f:\underline{2^{n+1}} \rightarrow \underline{2^{n+1}}\) by
$$\begin{aligned} R_f(b_1 \ldots b_n y) = {\left\{ \begin{array}{ll} b_1 \ldots b_n y &{} f(b_1 \ldots b_n) = 0, \\ b_1 \ldots b_n \overline{y} &{} f(b_1 \ldots b_n) = 1. \end{array}\right. } \end{aligned}$$
Here overline denotes negation. For Grover’s algorithm it is sufficient to provide a quantum circuit, the oracle, which is the quantum analogue of \(R_f\). We claimed Grover only needs n qubits. This is true, however in practice the oracle might not be efficient to compute with just n qubits. Often the oracle itself requires some ancillary qubits, say m, as scratch space to be efficient. In that case Grover uses a total of \(n+m\) qubits.

The gist of Grover’s algorithm. To understand the remainder of this paper, it is not required to know how Grover’s algorithm works (if the reader accepts that the core part are evaluations of the oracle). However, for completeness, we provide a brief summary of Grover’s algorithm.

Let \(f:\underline{2^n} \rightarrow \underline{2}\) be any function for which we want to find a \(w \in \underline{2^n}\) with \(f(w)=1\). Write a, g, b respectively for the standard uniform superposition of all basisvectors, the basisvectors marked 1 by f, and the basisvectors marked 0 by f. Concretely, with \(N=2^n\) and \(M = |f^{-1}(1)|\):
$$\begin{aligned} a = \sum _{w \in \underline{2^n}} \frac{1}{\sqrt{N}} \left| {w}\right\rangle \qquad g = \sum _{\begin{array}{c} w \in \underline{2^n} \\ f(w)=1 \end{array}} \frac{1}{\sqrt{M}} \left| {w}\right\rangle \qquad b = \sum _{\begin{array}{c} w \in \underline{2^n} \\ f(w)=0 \end{array}} \frac{1}{\sqrt{N-M}} \left| {w}\right\rangle \end{aligned}$$

If we can put the quantum computer in state g, then a measurement will give a bitstring w with \(f(w)=1\) as desired. It is easy to see that a is actually a linear combination of b and g: \(a = \frac{\sqrt{M}}{\sqrt{N}} g + \frac{\sqrt{N-M}}{\sqrt{N}} b\). As b and g are orthogonal, we can visualize a as a point on a grid with axes g and b. Let O be the unitary with \(O \left| {w}\right\rangle =\left| {w}\right\rangle \) if \(f(w)=0\) and \(O \left| {w}\right\rangle = -\left| {w}\right\rangle \) if \(f(w)=1\). It is not hard to construct O from the oracle discussed above (the quantum analogue of \(R_f\)). In our picture, O is simply a reflection over the b axis. Note how an arbitrary v on the grid is reflected to Ov. Let R denote the unitary that reflects over a. By adding some angles in the picture and a moments thought, one can see the action of RO is a counter-clockwise rotation in our grid by twice the angle a has with b. If M is known, this angle is straight-forward to compute. Grover’s algorithm is to prepare the quantum computer in state a and then to execute as many times the unitary RO until the state of the computer is close to g. Measuring the bits will then give a bitstring w with \(f(w)=1\) with high probability. The number of times that RO has to be executed can be shown [NC10, Eq. 6.17] to be at most \(\lceil \frac{\pi }{4}\sqrt{\nicefrac {N}{M}}\rceil \).

3 A Collection of Quantum Gates

In this section we collect the quantum gates that we will use for the oracles presented in Sects. 4 and 5. All quantum gates we will use are the quantum counterparts of reversible classical gates.

Gate 1

We will use a CNOT gate (controlled not — also called the Feynman gate) to compute XOR. CNOT is usually drawn as shown below on the left. As unitary it is defined on the computational basis by \(\mathrm {CNOT} \left| {x}\right\rangle \left| {y}\right\rangle = \left| {x}\right\rangle \left| {x + y}\right\rangle \). It corresponds to the classical reversible Boolean function on the right.

Gate 2

To compute AND, we will use the Toffoli gate T. It’s drawn below on the left. As unitary it is defined by \(\mathrm {T} \left| {x}\right\rangle \left| {y}\right\rangle \left| {z}\right\rangle = \left| {x}\right\rangle \left| {y}\right\rangle \left| {z + xy}\right\rangle \) (on the computation basis). It corresponds to the classical invertible Boolean function on the right.

Gate 3

To compute NOT, we use the  X-gate, usually depicted by

As unitary it is defined by \(X \left| {x}\right\rangle = \left| {\overline{x}}\right\rangle = \left| {1+x}\right\rangle \) (on the computational basis).

Gate 4

To compute the AND of multiple bits, we will use the  n-qubit Toffoli gate (\(T_n\)). It is a controlled not-gate with \(n-1\) control-bits. That is: its action as a unitary on the computational basis is
$$\begin{aligned} T_n \left| {x_1}\right\rangle \cdots \left| {x_n}\right\rangle = \left| {x_1}\right\rangle \cdots \left| {x_{n-1}}\right\rangle \left| {x_n + (x_1 \cdot \cdots \cdot x_{n-1})}\right\rangle \!. \end{aligned}$$
Note that \(T_1 =X\), \(T_2 =\mathrm {CNOT}\) and \(T_3 =T\). The n-qubit Toffoli gate is drawn similarly to the regular Toffoli gate. For instance, this is the 4-qubit Toffoli gate:

Gate 5

For the second oracle we want to swap bits, which is done with the 2-qubit swap-gateS. It’s drawn below on the left2 As a unitary it is defined by \(S\left| {x}\right\rangle \left| {y}\right\rangle =\left| {y}\right\rangle \left| {x}\right\rangle \) (on the computational basis). It corresponds to the classical invertible Boolean function on the right.

It is expected that the X, SWAP and CNOT gates will be cheap to execute and error correct on a quantum computer, whereas (n-qubit) Toffoli gates will be expensive. This is why papers often list gate-counts separately for ‘easy’ and ‘hard’ gates.

4 The First Grover Oracle for \(\mathcal {MQ}\) over \(\mathbb {F}_2\)

Our circuit \(U_\lambda \) to check whether \((x_i)_i\) is a solution (of a system of m quadratic equations in n variables in convenient form), will use \(n+m+2\) registers. It will act as follows, where \(r=\left| {1}\right\rangle \) if \((x_i)_i\) is a solution and \(\left| {0}\right\rangle \) else.

The first n registers are the input and should be initialized with \(x_1, \ldots , x_n\). The circuit will not change them – not even temporarily. The next register will be an ancillary register labelled t. It is intended to be initialized to \(\left| {0}\right\rangle \). The next m registers we will label \(e_1\), ..., \(e_m\) and should all be initialized to \(\left| {0}\right\rangle \). The final register is an output register labelled y.

We will construct our circuit \(U_\lambda \) step by step. Note that \(1+z = \overline{z}\). Thus, with at most \(n-1\) CNOT gates and possibly an X-gate, we can put \(y_1^{(1)}\) into t. In our example (see Sect. 2):

Using one Toffoli gate, we put \(x_1y_1^{(1)}\) into \(e_1\). In our example:

Then, by applying the inverse circuit used to put \(y_1^{(1)}\) into t, we can return t to \(\left| {0}\right\rangle \). As all the gates we use are self-inverse, the inverse circuit is simply the horizontal mirror-image. In our example:

Using a similar circuit with at most \(2n-4\) CNOT-gates, two X-gate and a Toffoli-gate, we can add \(y_2^{(1)}\) to \(e_1\), leaving the remaining registers untouched. In our example \(y_2^{(1)}=x_2 x_3\), hence we obtain the following:

We continue with \(n-2\) similar circuits, to add \(y^{(1)}_2\), ..., \(y^{(1)}_n\) to \(e_1\). Our complete circuit up to this point, has put \(E^{(1)}\) into \(e_1\) with at most \(n^2 + 2n\) gates. (In our example we are already done.) The remaining registers are as they were.

With \(m-1\) similar circuits we can store \(E^{(k)}\) into \(e_k\) for the other k. In total we will have used at most \(m (n^2 + 2n)\) gates. In our example the remainder will be:

Next, compute \(E^{(1)} \cdot E^{(2)} \cdot \cdots \cdot E^{(m)}\) and store it in y using an m-qubit Toffoli gate.

The circuit for our example is shown on the right. Finally, we reverse the computation of \(E^{(1)}\), ..., \(E^{(m)}\) to reset all but the output register to their initial state. We have used at most \(2m(n^2+2n)+1\) gates.

One might object to counting the n-qubit Toffoli gate with the same weight as the other gates. Indeed, classically one cannot even compute arbitrarily large reversible circuits if one is restricted to m-register gates and no temporary storage [Tof80, Thm. 5.2]. However, without ancillary qubits and just with CNOTs and one-qubit gates, one can create an n-qubit Toffoli gate. If one allows one ancillary qubit, one only needs O(n) many \(\le 2\)-qubit gates to construct a n-qubit Tofolli gate [MD03]. The gates used in this construction are, however, expensive to error correct with current codes. For the next oracle, we will implicitly construct a \(2^n\)-qubit Toffoli gate from an n-qubit Toffoli gate with n ancillary qubits.

Python and Quipper code to generate the oracle presented in this section are given in Appendix A.

5 The Second Grover Oracle for \(\mathcal {MQ}\) over \(\mathbb {F}_2\)

In this section we will describe a second, more complex oracle, which requires fewer qubits, but approximately twice the number of gates. As for the first oracle, we give Quipper code to generate this second oracle in Appendix A.

In our first oracle we reserved for every equation a qubit register which stores whether that equation is satisfied. At the end the oracle checks whether every equation is satisfied by checking whether every of the corresponding registers is set to \(\left| {1}\right\rangle \). Instead, for our second oracle we will only count the number of equations that are satisfied. Instead of m separate registers, we will only need \(\lceil \log _2 m \rceil \) registers which act as a counter. Instead of storing \(E^{(k)}\) into a separate register, the oracle will do a controlled increment on the counter. At the end the oracle will check whether the value in the counter is m. This can be done with suitably placed X-gates and a multi-qubit Toffoli.

Note that as the value of \(E^{(k)}\) is not kept around anymore, it needs to be computed and uncomputed a second time compared to the first oracle to uncompute the counter qubits. This is the reason the second oracle requires approximately double the number of gates.

We still have to describe the increment circuit for the counter register. Using the standard binary encoding for the counter and the obvious increment is not a good a choice: the incrementation is hard to implement efficiently without using ancillary registers. We can do better by not adhering to the standard binary encoding.

For instance consider the 3-qubit circuit on the right. This circuit has two (classical) cycles: it will send \(\left| {000}\right\rangle \) directly to \(\left| {000}\right\rangle \) and
$$\begin{aligned} \left| {111}\right\rangle \mapsto \left| {101}\right\rangle \mapsto \left| {100}\right\rangle \mapsto \left| {010}\right\rangle \mapsto \left| {001}\right\rangle \mapsto \left| {110}\right\rangle \mapsto \left| {011}\right\rangle \mapsto \left| {111}\right\rangle \!. \end{aligned}$$
This simple 3-qubit circuit can thus be used as a counter up to 7. For instance, to count 5 equations with this circuit one initializes the counter register to \(\left| {100}\right\rangle \), applies the circuit for each valid equation and checks in the end whether the counter register is set to \(\left| {111}\right\rangle \).

Now we will show how to construct a similar simple circuit for any number of qubits. For this construction we will need to think of the state \(\left| {v_1 \ldots v_n}\right\rangle \) as the polynomial \(v_n x^{n-1} + \cdots + v_2x + v_1\) over \(\mathbb {F}_2\). For instance \(\left| {1101}\right\rangle \) corresponds to \(1 + x^2 + x^3\). The circuit above corresponds to multiplying by x in the field \(\mathbb {F}_2[x] / (x^3+x+1)\). Indeed: the ladder of swap gates at the start of the circuit is a rotation down and would correspond to multiplying by x in the ring \(\mathbb {F}_2[x] / (x^3+1)\). The cNOT at the end of the circuit is responsible for the missing x term. The fact that the circuit cycles over all (7) invertible elements of the field is by definition equivalent to the fact that \(x^3 + x + 1\) is a primitive polynomial.

So, to construct a counter on c-qubits, one picks a primitive polynomial p(x) over \(\mathbb {F}_2\) of degree c (eg. from [Wat62]) and builds the corresponding circuit. For instance, \(x^5+x^4+x^3+x^2+1\) is a primitive polynomial and corresponds to the circuit on the right.

The following table lists the maximum number of each gate used in the second oracle compared to the first for a system of 85 equations in 81 variables.






First oracle





one 85-Toffoli

Second oracle





one 7-Toffoli

To find a solution to this example system, the oracle will be executed \({\sim }2^{40}\) times interleaved with reflections, which yields a total of \({\sim }2^{61}\) executed gates when using the second oracle.

6 Circuit Depth

If gates act on separate qubits, they might be executed in parallel. For this reason the depth of a circuit is often considered instead of the total number of gates executed. For our first two oracles we choose to optimize for qubit count instead of circuit depth. We will briefly sketch how to decrease the circuit depth by allowing for more qubit registers.

If one changes the first oracle to use a separate t register for each equation, the value of each equation can be computed practically in parallel and the circuit depth is reduced from \(O(n^2m)\) to \(O(n^2 + m)\) using a total of \(n + 2m + 1\) registers.

There is still room for another trade-off: the terms \(y^{(k)}_{i}\) for a single equation are not computed in parallel. If one uses a separate register for each \(y^{(k)}_i\), one could reduce the circuit depth to \(O(n+m)\) using a total of \(n^2 + m\) registers.

7 Conclusion

We have shown step-by-step how to construct oracles for Grover’s algorithm to solve binary \(\mathcal {MQ}\), implement these in a quantum programming language, and estimate the resources it will use. As a corollary we find that some proposed choice of parameters for some “post-quantum” schemes seem practical to break on a quantum computer with less than a hundred logical qubits.

We finish with a table that shows the upper bound of resources required to solve a system with 84 equations in 80 variables with a single solution. (This is the hard problem underlying the identification scheme described in [SSH11] for “80-bits security”.) We reiterate that the number of gates mentioned is the cumulative number of times that kind is executed.

first oracle

second oracle




X gates



CNOT gates



Toffoli gates



7-qubit Toffoli gates



80-qubit Toffoli gates



85-qubit Toffoli gates



Hadamard gates



Controlled-Z gates



Total number of gates



Fig. 1.

Oracles for the running example generated by Quipper


  1. 1.

    The problem of factoring a number N is reduced to finding the order of an element x modulo N, which requires a bit more than \(2 \log _2 N\) qubits [NC10, §5.3.1].

  2. 2.

    Note that a SWAP gate can be written with CNOTs:Open image in new window

  3. 3.



The authors are grateful to Gauillaume Allais and Peter Selinger for their helpful suggestions. In particular, it was Peter Selinger’s suggestion to construct a counter from a primitive polynomial.


  1. [AMG+16]
    Amy, M., Di Matteo, O., Gheorghiu, V., Mosca, M., Parent, A., Schanck, J.: Estimating the cost of generic quantum pre-image attacks on SHA-2 and SHA-3. Preprint 2016.
  2. [BCC+14]
    Bouillaguet, C., Cheng, C.-M., Chou, T., Niederhagen, R., Yang, B.-Y.: Fast exhaustive search for quadratic systems in \(\mathbb{F}_{2}\) on FPGAs. In: Lange, T., Lauter, K., Lisoněk, P. (eds.) SAC 2013. LNCS, vol. 8282, pp. 205–222. Springer, Heidelberg (2014). doi:10.1007/978-3-662-43414-7_11 CrossRefGoogle Scholar
  3. [BHT98]
    Brassard, G., HØyer, P., Tapp, A.: Quantum counting. In: Larsen, K.G., Skyum, S., Winskel, G. (eds.) ICALP 1998. LNCS, vol. 1443, pp. 820–831. Springer, Heidelberg (1998). doi:10.1007/BFb0055105 CrossRefGoogle Scholar
  4. [Chu05]
    Chuang, I.: Quantum circuit viewer: qasm2circ (2005). Accessed 24 June 2016
  5. [DS05]
    Ding, J., Schmidt, D.: Rainbow, a new multivariable polynomial signature scheme. In: Ioannidis, J., Keromytis, A., Yung, M. (eds.) ACNS 2005. LNCS, vol. 3531, pp. 164–175. Springer, Heidelberg (2005). doi:10.1007/11496137_12 CrossRefGoogle Scholar
  6. [GJ79]
    Garey, M.R., Johnson, D.S.: Computers and Intractability: A Guide to the Theory of NP-Completeness. W. H. Freeman and Company (1979)Google Scholar
  7. [GLR+13a]
    Green, A.S., Lumsdaine, P.L.F., Ross, N.J., Selinger, P., Valiron, B.: An introduction to quantum programming in quipper. In: Dueck, G.W., Miller, D.M. (eds.) RC 2013. LNCS, vol. 7948, pp. 110–124. Springer, Heidelberg (2013). doi:10.1007/978-3-642-38986-3_10 CrossRefGoogle Scholar
  8. [GLR+13b]
    Green, A.S., Lumsdaine, P.L., Ross, N.J., Selinger, P., Valiron, B.: Quipper: a scalable quantum programming language. 48(6), 333–342 (2013).
  9. [GLRS16]
    Grassl, M., Langenberg, B., Roetteler, M., Steinwandt, R.: Applying grover’s algorithm to AES: quantum resource estimates. In: Takagi, T. (ed.) PQCrypto 2016. LNCS, vol. 9606, pp. 29–43. Springer, Heidelberg (2016). doi:10.1007/978-3-319-29360-8_3 CrossRefGoogle Scholar
  10. [Gro96]
    Grover, L.K.: A fast quantum mechanical algorithm for database search. In: Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing, pp. 212–219. ACM (1996)Google Scholar
  11. [KPG99]
    Kipnis, A., Patarin, J., Goubin, L.: Unbalanced oil and vinegar signature schemes. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 206–222. Springer, Heidelberg (1999). doi:10.1007/3-540-48910-X_15 Google Scholar
  12. [MD03]
    Maslov, D., Dueck, G.W.: Improved quantum cost for n-bit Toffoli gates. Electron. Lett. 39(25), 1790–1791 (2003)CrossRefGoogle Scholar
  13. [NC10]
    Nielsen, M.A., Chuang, I.L.: Quantum Computation and Quantum Information. Cambridge University Press, Cambridge (2010)CrossRefMATHGoogle Scholar
  14. [PCG01]
    Patarin, J., Courtois, N., Goubin, L.: QUARTZ, 128-bit long digital signatures. In: Naccache, D. (ed.) CT-RSA 2001. LNCS, vol. 2020, pp. 282–297. Springer, Heidelberg (2001). doi:10.1007/3-540-45353-9_21 CrossRefGoogle Scholar
  15. [PCY+15]
    Petzoldt, A., Chen, M.-S., Yang, B.-Y., Tao, C., Ding, J.: Design principles for HFEv- based multivariate signature schemes. In: Iwata, T., Cheon, J.H. (eds.) ASIACRYPT 2015. LNCS, vol. 9452, pp. 311–334. Springer, Heidelberg (2015). doi:10.1007/978-3-662-48797-6_14 CrossRefGoogle Scholar
  16. [Sel]
    Selinger, P.: The quipper language. Accessed 09 Jan 2016
  17. [Sho94]
    Shor, P.W.: Algorithms for quantum computation: discrete logarithms and factoring. In SFCS 1994 Proceedings of the 35th Annual Symposium on Foundations of Computer Science, pp. 124–134. IEEE (1994).
  18. [Sho97]
    Shor, P.W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM J. Comput. 26, 1484–1509 (1997).
  19. [SSH11]
    Sakumoto, K., Shirai, T., Hiwatari, H.: Public-key identification schemes based on multivariate quadratic polynomials. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 706–723. Springer, Heidelberg (2011). doi:10.1007/978-3-642-22792-9_40 CrossRefGoogle Scholar
  20. [Tof80]
    Toffoli, T.: Reversible Computing. Springer, Heidelberg (1980)CrossRefMATHGoogle Scholar
  21. [Wat62]
    Watson, E.J.: Primitive polynomials (mod 2). Math. Comput. 16(79), 368–369 (1962)MathSciNetMATHGoogle Scholar
  22. [YCC04]
    Yang, B.-Y., Chen, J.-M., Courtois, N.T.: On asymptotic security estimates in XL and Gröbner bases-related algebraic cryptanalysis. In: Lopez, J., Qing, S., Okamoto, E. (eds.) ICICS 2004. LNCS, vol. 3269, pp. 401–413. Springer, Heidelberg (2004). doi:10.1007/978-3-540-30191-2_31 CrossRefGoogle Scholar

Copyright information

© Springer International Publishing AG 2016

Authors and Affiliations

  1. 1.Digital Security GroupRadboud UniversityNijmegenThe Netherlands

Personalised recommendations