Quanum computing. What is quantum computation? New model of computing based on quantum mechanics. Quantum circuits, quantum Turing machines More powerful

Quanum computing

What is quantum computation?

• New model of computing based on quantum mechanics.

• Quantum circuits, quantum Turing machines

• More powerful than conventional models.

Quantum algorithms

• Factoring: given N=pq, find p and q.

• Best algorithm 2O(n1/3), n -number of digits.

• Many cryptosystems based on hardness of factoring.

• O(n2) time quantum algorithm [Shor, 1994]

• Similar quantum algorithm solves discrete log.

Quantum algorithms

• Find if there exists i for which xi=1.

• Queries: input i, output xi.

• Classically, n queries.

• Quantum, O(n) queries [Grover, 1996].

• Speeds up exhaustive search.

0 1 0 0...

x1 x2 xnx3

Quantum cryptography

• Key distribution: two parties want to create a secret shared key by using a channel that can be eavesdropped.

• Classically: secure if discrete log hard.

• Quantum: secure if quantum mechanics valid [Bennett, Brassard, 1984].

• No extra assumptions needed.

Quantum communication

• Dense coding: 1 quantum bit can encode 2 classical bits.

• Teleportation: quantum states can be transmitted by sending classical information.

• Quantum protocols that send exponentially less bits than classical.

Experiments

• ~10 different ideas how to implement QC.

• NMR, ion traps, optical, semiconductor, etc.

• 7 quantum bit QC [Knill et.al., 2000].

• QKD has been implemented.

Outline

• Today: basic notions, quantum key distribution.

• Tomorrow: quantum algorithms, factoring.

• Friday: current research in quantum cryptography, coin flipping.

Model

• Quantum states

• Unitary transformations

• Measurements

Quantum bit

• 2-dimensional vector of length 1.

• Basis states |0>, |1>.• Arbitrary state:

|0>+|1>, , complex,

||2+ ||2=1.

|1>

|0>

Physical quantum bits

• Nuclear spin = orientation of atom’s nucleus in magnetic field. = |0>, = |1>.

• Photons in a cavity.

• No photon = |0>, one photon = |1>

Physical quantum bits (2)

• Energy states of an atom

• Polarization of photon

• Many others.

|0> |1>

ground state excited state

General quantum states

• k-dimensional quantum system.

• Basis |1>, |2>, …, |k>.

• General state

1|1>+2|2>+…+k|k>,

|1|^2+…+ |k|^2=1

• 2k dimensional system can be constructed as a tensor product of k quantum bits.

Unitary transformations

• Linear transformations that preserve vector norm.

• In 2 dimensions, linear transformations that preserve unit circle (rotations and reflections).

Examples

• Bit flip

• Hamamard transform

0|1|

1|0|

1|2

10|

2

11|

1|2

10|

2

10|

Linearity

• Bit flip

|0>|1>

|1>|0>

By linearity,|0>+|1> |1>+|0>

Sufficient to specify U|0>, U|1>.

Examples

|1>

|0>

1|2

10|

2

1

1|2

10|

2

1

• Measuring |0>+|1> in basis |0>, |1> gives: 0 with probability | |2, 1 with probability | |2.

• Measurement changes the state: it becomes |0> or |1>.

• Repeating measurement gives the same outcome.

Measurements

Measurements

1|2

10|

2

1Probability 1/2

Probability 1/2

|0>

|1>

General measurements

• Let |0>, | 1> be two orthogonal one-qubit

states.• Then,

|> = 0|0> + 1|1>.

• Measuring | > gives | i> with probability |i|2.

• This is equivalent to mapping |0>, | 1> to |0>, |1> and then measuring.

Measurements

1|2

10|

2

1

1|2

10|

2

1

Probability 1

Measurements

1|2

10|

2

1 1|

2

10|

2

1

Probability 1/2Probability 1/2

|1>

Measurements

• Measuring

1|1>+2|2>+…+k|k>

in the basis |1>, |2>, …, |k> gives |i> with probability |i|2.

• Any orthogonal basis can be used.

Partial measurements

• Example: two quantum bits, measure first.

102

101

2

100

2

1

01|2

100|

2

1 10|

Result 0 Result 1

Classical vs. Quantum

Classical bits:• can be measured

completely,• are not changed by

measurement,• can be copied,• can be erased.

Quantum bits:• can be measured

partially,• are changed by

measurement,• cannot be copied,• cannot be erased.

Copying

One nuclear spin Two spins

Impossible!

?

Related to impossiblity of measuring a state perfectly.

No-cloning theorem

• Imagine we could copy quantum states.

• Then, by linearity

• Not the same as two copies of |0>+|1>.

1|1|2

10|0|

2

11|

2

10|

2

1

1|1|1|

0|0|0|

Key distribution

• Alice and Bob want to create a shared secret key by communicating over an insecure channel.

• Needed for symmetric encryption (one-time pad, DES etc.).

Key distribution

• Can be done classically.

• Needs hardness assumptions.

• Impossible classically if adversary has unlimited computational power.

• Quantum protocols can be secure against any adversary.

• The only assumption: quantum mechanics.

BB84 states

1|2

10|

2

1

1|2

10|

2

1|> = |1>

|> = |0>

| >=| >=

BB84 QKD

...

...

...No Yes Yes Yes

...

0 0 1

Alice Bob

BB84 QKD

• Alice sends n qubits.

• Bob chooses the same basis n/2 times.

• If there is no eavesdropping/transmission errors, they share the same n/2 bits.

Eavesdropping

• Assume that Eve measures some qubits in , | basis and resends them.

• If the qubit she measures is |> or |>, Eve resends a different state ( or | ).

• If Bob chooses |>, |> basis, he gets each answer with probability 1/2.

• With probability 1/2, Alice and Bob have different bits.

Eavesdropping

• Theorem: Impossible to obtain information about non-orthogonal states without disturbing them.

• In this protocol:

Check for eavesdropping

• Alice randomly chooses a fraction of the final string and announces it.

• Bob counts the number of different bits.

• If too many different bits, reject (eavesdropper found).

• If Eve measured many qubits, she gets caught.

Next step

• Alice and Bob share a string most of which is unknown to Eve.

• Eve might know a few bits.

• There could be differences due to transmission errors.

Classical post-processing

• Information reconciliation: Alice and Bob apply error correcting code to correct transmission errors.

• They now have the same string but small number of bits might be known to Eve.

• Privacy amplification: apply a hash function to the string.

QKD summary

• Alice and Bob generate a shared bit string by sending qubits and measuring them.

• Eavesdropping results in different bits.

• That allows to detect Eve.

• Error correction.

• Privacy amplification (hashing).

Eavesdropping models

• Simplest: Eve measures individual qubits.

• Most general: coherent measurements.

• Eve gathers all qubits, performs a joint measurement, resends.

Security proofs

• Mayers, 1998.

• Lo, Chau, 1999.

• Preskill, Shor, 2000.

• Boykin et.al., 2000.

• Ben-Or, 2000.

EPR state

1|1|2

10|0|

2

1

• First qubit to Alice, second to Bob.• If they measure, same answers.

||2

1||

2

1

• Same for infinitely many bases.

Bell’s theorem

• Alice’s basis:

• Bob’s basis: y instead of x. |0>

|1>

1sin0cos xx

1cos0sin xx

Bell’s theorem

yx 2cos2

1

yx 2cos2

1

yx 2sin2

1

yx 2sin2

1

Pr[b=0]

Pr[a=1]

Pr[a=0]

Pr[b=1]

Classical simulation

• Alice and Bob share random variables.

• Someone gives to them x and y.

• Can they produce the right distribution without communication?

Bell’s theorem

• Classical simulation impossible:

• Bell’s inequality: constraint satisfied by any result produced by classical randomness.

4

3,

4,

4

3,

4

yx

Ekert’s QKD

• Alice generates n states

sends 2nd qubits to Bob.

• They use half of states for Bell’s test.

• If test passed, they error-correct/amplify the rest and measure.

1|1|2

10|0|

2

1

Equivalence

• In BB84 protocol, Alice could prepare the state

keep the first register and send the second to Bob.

32

12

2

11

2

10

2

1

Ekert and BB84 states

1|1|2

10|0|

2

1E

32

12

2

11

2

10

2

1BB

32

12

2

11

2

11|

32

12

2

10

2

10|

U

U

UI

QKD summary

• Key distribution requires hardness assumptions classically.

• QKD based on quantum mechanics.

• Higher degree of security.

• Showed two protocols for QKD.

QKD implementations

• First: Bennett et.al., 1992.

• Currently: 67km, 1000 bits/second.

• Commercially available: Id Quantique, 2002.

Quantum Factoring

Quantum Algorithms

Quantum Algorithms should exploit quantum parallelism and quantum interference.

We have already seen some elementary algorithms.

Quantum Algorithms

These algorithms have been computing essentially classical functions on quantum superpositions

This encoded information in the phases of the basis states: measuring basis states would provide little useful information

But a simple quantum transformation translated the phase information into information that was measurable in the computational basis

Extracting phase information with the Hadamard operation

nH

nH

x y

yx

ny)1(

2

1

y

yx

ny)1(

2

1x

Overview

Quantum Phase Estimation Eigenvalue Kick-back Eigenvalue estimation and order-findi

ng/factoring Shor’s approach Discrete Logarithm and Hidden Subgr

oup Problem (if there’s time)

Quantum Phase Estimation

Suppose we wish to estimate a numbergiven the quantum state )1,0[

12

0y

i2n

yye

Note that in binary we can express321 xxx.0

321 xx.x2

1nn1n3211n xx.xxxx2


1e ik2 Since for any integer k, we have

...)xx.0(i2...)xx.0(i2ix2...)xx.x(i2)(i2 32321321 eeee2e

...)xx.0(i2)k(i2 2k1ke2e


1x.0 If then we can do the following

H 1x2

1)1(02

1e0

1

1

x

)x.0(i2

Useful identity

We can show that

1e0

1e01e0

1e0

1e01e0

yye

...)xx.0(i2

...)xxx.0(i2...)xx.0(i2

)(i2

)2n2(i2)1n2(i2

12

0y

i2

21

1nn1n1nn

n


21xx.0 So if then we can do the following

H 2x

2

1e0 )xx.0(i2 21

2

1e0 )x.0(i2 2

H 1x12R

k2/i2k e0

01R


321 xxx.0 So if then we can do the following

H 3x

2

1e0 )xx.0(i2 32

2

1e0 )x.0(i2 3

H 2x12R

2

1e0 )xxx.0(i2 321H 1x1

2R 13R


Generalizing this network (and reversing the order of the qubits at the end) gives us a network with O(n2) gates that implements

xyyx

e12

0y

n2i2

n

Discrete Fourier Transform

The discrete Fourier transform maps vectors of dimension N by transforming the elementary vector according to

1N

0y

Ni2

yyx

ex

)e,,e,e,1()0,...0,1,0,...,0,0( Nx)1N(

i2Nx2

i2Nx

i2

thx

The quantum Fourier transform maps vectors in a Hilbert space of dimension N according to


Thus we have illustrated how to implement (the inverse of) the quantum Fourier transform in a Hilbert space of dimension 2n

Estimating arbitrary

What if is not necessarily of the formfor some integer x?

)1,0[

12

0x

i2n

zze The QFT will map to a

superposition

n2x

where

y

y y~

Ny

1Oy2

8N1

Ny

obPr

For any real


H

1x

2

10 22 )( ie

2

10 42 )( ie

H 2x12R

2

1e0 )(i2

H

3x

12R 1

3R

)1,0[

With high probability ω8

24 321 xxx

Recall the “trick”:

Eigenvalue kick-back

x

)x(f10

x)1( )x(f

)10(x)1(

)10()1(x)x(f

)x(f

10

)1)x(f)x(f(x)10(x

Consider a unitary operation U with eigenvalue and eigenvector


i2e 1

1e i2

1e

e1i2

i2 U11

U


0

0

U


10

1e0 i2

U

As a relative phase, becomes measurable

i2e

If we exponentiate U, we get multiples of


1

1xe i2

xU


10

1xe0 i2

xU


10

1e0 i2

U

10 1e0 )2(i2 1n

10

10 1e0 )2(i2

U2U U

1n2 2n2

1e0 )2(i2 2n

Phase estimation

1e0 i2

1e0 )2(i2 1n

1e0 )2(i2

1e0 )2(i2 2n

H

1x

H

2x

12R

nn2

2n1

1n

2

xx2x2

nx

12R 1

3R

1nx

H

Eigenvalue estimation

10

10

2U U 4U

10 H

1x

2x12R

H

3x

12R 1

3R

H


xU

0

1x

2x

3x

00

8QFT 18QFT


U Given with eigenvector and eigenvalue we thus have an algorithm that maps

i2e

~0 IQFT,Uc,IQFT 1x


U Given with eigenvectors and respective eigenvalues we thus have an algorithm that maps

kki2

e

kkk~0

k

kkkk

kkk

kk~00

and therefore


Measuring the first register of

k

kkk~

is equivalent to measuring with probability

k~

2

k

kkkk

kkkk

kkkk

Tr

~~

~~ *

22

i.e.

Example

Suppose we have a group and we wish to find the order of (I.e. the smallest positive such that )

If we can efficiently do arithmetic in the group, then we can realize a unitary operator that maps

Notice that

GGa

r 1ar

aU axx I

aUaU r

r

This means that the eigenvalues of are of the form where k is an integer

aU

rki2

e

(Aside: more on reversible computing)

If we know how to efficiently compute and then we can efficiently and reversibly map

x

bfU

x

)(xfb

c

y1f

U)(1 yfc

y

f1f

(Aside: more on reversible computing)

And therefore we can efficiently map

x

0fU 1f

U0

)(xf

)(xfx

Example

Let Then We can easily implement, for example,

14,13,12,11 2441

5mod}4,3,2,1{ZG *5

010001U2

The eigenvectors of include

100001U 22

011001U 32

2U

00100142 U

2U

5mod2e j3

0j

4

jki2

k

Example

011e100e010e001

011e100e010e001

41

i242

i243

i2

49

i246

i243

i2

3

Example

343

i2

41

i242

i243

i243

i2

41

i242

i243

i2

32

e

)001011e100e010e(e

001e011e100e010

U

Example

343

i2

32

242

i2

22

141

i2

12

002

eU

eU

eU

U

00121

3210

Example

343

i2

32

242

i2

22

141

i2

12

002

1e010Uc

1e010Uc

1e010Uc

1010Uc

Example

342

i2

32

2

222

2

142

i2

12

2

002

2

1e010Uc

1010Uc

1e010Uc

1010Uc

Eigenvalue Kickback

10

3

10

22U 2U

1e0 )1.0(i2

1e0 )11.0(i2

Eigenvalue Kickback

10

3

10

22U 2U

1H12R

H

3

1

1123

Eigenvalue Kickback

10

k

10

22U 2U

1kH12R

H

k

2k

21 kk2k

Eigenvalue Kickback

10

3

0kk2

1

1

10

22U 2U

H12R

H

3

0kkk

21

Quantum Factoring

• The security of many public key cryptosystems used in industry today relies on the difficulty of factoring large numbers into smaller factors.

• Factoring the integer N into smaller factors can be reduced to the following task: Given integer a, find the smallest positive integer r so that ar Nmod1

Example

Let We can easily implement

1ar *NZGa

axxUa

The eigenvectors of include

xaxa

UxU 22

2a

aUj

1r

0j

r

jki2

k ae

xaxa

UxUn2

n2

n2a

Example

krki2

1rrk)1r(

i22rk2

i2rki2

rki2

rrk)1r(

i23rk2

i22rki2

1rrk)1r(

i22rk2

i2rki2

aka

e

)aeaeae1(e

aeaeaea

)aeaeae1(UU

Example

1r1

1r210

krk2

i2

kj21e010

aUc

j


U Given with eigenvectors and respective eigenvalues we thus have an algorithm that maps

krki2

e

kk rk~

0

k

kkk

kkk

kk rk~

00

and therefore

Eigenvalue Estimation

10

1r

0kkr

1

1

10

22U 2U

n21QFT

1r

0kkr

k~

21

10

2U21n


Measuring the first register of

k

krk~

r1

is equivalent to measuring with probability r

k~

r1

Finding r

For most integers k, a good estimate of

(with error at most ) allows us to determine r (even if we don’t know k). (using continued fractions)

rk

2r21

(aside: how does factoring reduce to order-finding??)

• The most common approach for factoring integers is the difference of squares technique:– “Randomly” find two integers x and y

satisfying

– So N divides– Hope that is non-trivial

• If r is even, then let so that

Nyx mod22

),gcd( yxN ))((22 yxyxyx

Nax r mod2/Nx mod122

Shor’s approach

This eigenvalue estimation approach is not the original approach discovered by Shor

Kitaev developed an eigenvalue estimation approach (to the more general “Hidden Stabilizer Problem”)

We’ve presented the CEMM version here


The discrete Fourier transform maps uniform periodic states, say with period r dividing N, and offset w, to a periodic state with period N/r.

),0,0,,0,0,,0,0,1(

1

)0,1,0,0,0,1,0,0,0,1,0,0(

12

222

rwr

irw

irwi

eeer

Nr


1

0

21

0

r

k

irN

x

krNr

wk

ewxrNr

The quantum Fourier transform maps vectors in a Hilbert space of dimension N according to

Shor’s Factoring Algorithm

x

/\x /

\ax

/\

/\a

y

r y

( ) /\a

r0

r r1 k

F-1

w0w

0w

x

/\x /

\1w

w

1r

1r

Network for Shor’s Factoring Algorithm

U

F-1

x

F

a/\1

/\0

Eigenvalue Estimation Factoring Algorithm

( ) /\

kk r

k

x /

\xk

e2π ix

rk

/\

k

/\0 /

\1 x /

\xk

/\

k

Network for Eigenvalue Estimation Factoring Algorithm

U

F-1

x

F

a/\1

/\0

Equivalence of Shor&CEMM Shor analysis CEMM analysis

s

s010

s

sxx

xx 1

ss

x

r

sxix

r

x k

xeaxrk 21

0

ss

xr

x

a 1

0 r

s

r

k

rrr

210

Equivalence of Shor&CEMM Shor analysis CEMM analysis

ss

xr

x

a 1

0

s

r

x

1

0

r

k

rrr

210 r

s

r

k

rrr

210 r

k

rrr

210 r

s

r

s

Consider two elements from a group G satisfying

Find s.

Gba ,

1rasab

xU xaa

Discrete Logarithm Problem


We know has eigenvectorsUa

Ua kk k

i2π

e r

j1r

0j

r

kji2-

k aeψ


Thus has the same eigenvectors but with eigenvalues exponentiated to the power of s

Ub

Ub kkk ψψψ ks

i2π

erU sa


1 kΨxaU

k0rF

1rF


kΨkΨx

bU

ks0rF

1rF

Given k and ks, we can compute s mod r (provided k and r are coprime)

Abelian Hidden Subgroup Problem

f ( ) f ( )x

f :

Z Z ZM MM

1

. . .

nG

G X

y iff x y-

KG

K

Find generators for K

0

Network for AHS

U

F-1F/

\0

f

AHS Algorithm in standard basis

( )s

/\

x

/\x /

\f ( )x

f ( )w

s s0

1n

w

F-

/\f ( )ww

/\w K

1

K

AHS for in eigenbasis

/\

( )

s K /\f ( )x- )1(

x.ss

s ss/\

is an eigenvector of f ( )x f ( )x y

x

/\x /

\f ( )xF

-

(Simon’s Problem)

nZ

2

1

K

Other applications of Abelian HSP

• Any finite Abelian group G is the direct sum of finite cyclic groups

• But finding generators satisfying is not always easy, e.g.

for it’s as hard as factoring N• Given any polynomial sized set of generators,

we can use the Abelian HSP algorithm to find new generators that decompose G into a direct sum of finite cyclic groups.

nggg 21

nggg ,,, 21

ngggG 21

*NZG

Examples:

Deutsch’s Problem: }1,0{G X

K }1,0{

}1,0{

}0{ or

Order finding: ZGf

X

)x( K rZ

any group

ax

Example:

Discrete Log of to base :

G rr ZZ X any group

b a

f )y,x( ax by

K 1,

ak

k

Examples:

Self-shift equivalences: n)q(GFG

f

]X,...,X,X)[q(GFX n21

)a,...,a,a( n21

K

)aX,...,aX(P nn11

)}X,...,X(P)aX,...,aX(P

:)a,...,a{(

n1nn11

n1

What about non-Abelian HSP

• Consider the symmetric group• Sn is the set of permutations of n elements• Let G be an n-vertex graph• Let

• Define• Then where

nSG

}|)({ nG SGX ππ

)(GfG ππ GnG XSf :

KKff GG 2121 ππππ GGGAUTK ππ |)(

Graph automorphism problem

• So the hidden subgroup of is the automorphism group of G

• This is a difficult problem in NP that is believed not to be in BPP and yet not NP-complete.

Gf

Other

Progress on the Hidden Subgroup Problem in non-Abelian groups (not an exhaustive list)•Ettinger, Hoyer arxiv.gov/abs/quant-ph/9807029•Roetteler,Beth quant-ph/9812070•Ivanyos,Magniez,Santha arxiv.org/abs/quant-ph/0102014•Friedl,Ivanyos,Magniez,Santha,Sen quant-ph/0211091 (Hidden Translation and Orbit Coset in Quantum Computing); they show e.g. that the HSP can be solved for solvable groups with bounded exponent and of bounded derived series•Moore,Rockmore,Russell,Schulman, quant-ph/0211124

Documents

Quanum computing. What is quantum computation? New model of computing based on quantum mechanics. Quantum circuits, quantum Turing machines More powerful