\documentclass[11pt]{article}
\include{lecture}
\usepackage{subfigure}

\begin{document}
\lecture{14}{10/05/10}{Computing Discrete Logarithms}{John Gamble}
Last class, we discussed how to apply order finding to efficiently factor numbers
using a quantum computer. We then outlined how this capability presents
problems to certain cryptographic systems, such as RSA. In this lecture, we will
discuss a quantum algorithm for period finding of which order-finding is a
a special case. We then develop a similar algorithm
efficiently compute the discrete logarithm. Finally, we conclude by outlining 
Diffie-Hellman key exchange, whose security relies on the discrete logarithm
 being difficult to compute.

\section{Period finding}
Suppose that we are given some function $f:  \mathbb Z \rightarrow\{0,1\}^m$, and are
promised that it is periodic with period $r>0$. That is, for all $x$, we know that $f(x+r)=f(x)$.
Further, we are guaranteed that no value repeats between periods, so that for all $s$ such that
$0<s<r$, $f(x) \neq f(x+s)$. Our task is to determine the value of $r$. In order to develop the algorithm, we will first assume
that we are also given another integer $N$ such that $r \vert N$. We will then relax this
assumption, so that $N$ need only be an upper bound for $r$.

\subsection{Special case: $r$ divides $N$}
First, we initialize our system in the state
\begin{equation}
\ket{\psi_0} = \ket{0^n}\ket{0^m},
\end{equation}
where $n=\lceil \log{N}\rceil$, so that $N$ can be represented in the first register. Next, we create a uniform superposition
over $\{0,...,N-1\}$ in the first register. Operating on our
our state with the quantum oracle and storing its output in the second register gives us
\begin{equation}
\ket{\psi_1} = \frac{1}{\sqrt{N}}\sum_{x=0}^{N-1}\ket{x}\ket{f(x)}.
\end{equation}
Then, we observe the second register, leaving us in the state
\begin{equation}
\ket{\psi_2} = \frac{1}{\sqrt{N/r}}\sum_{x}\ket{x}\ket{z},
\end{equation}
where z is chosen uniformly at random from $\{f(0),f(1),\dots,f(r-1)\}$ and the sum runs over all $x$ such 
that $f(x)=z$. Note that there are $N/r$ such values of $x$, hence the normalization. We now call the
smallest $x$ in our sum $x_0$ and note that since $f$ has period $r$, each $x$ can be written as
$x=x_0+jr$ for an integer $j$. Hence, our state is
\begin{equation}
\ket{\psi_2} = \frac{1}{\sqrt{N/r}}\sum_{j=0}^{N/r-1}\ket{x_0+jr},
\end{equation}
where we have suppressed the second register, as we will not need it again. Now, we apply the inverse 
discrete Fourier transform over $\mathbb Z_N$ to the state, which leads to
\begin{eqnarray}
\ket{\psi_3} &=& F_{N}^{-1}\ket{\psi_2} \frac{1}{\sqrt{N/r}}\sum_{j=0}^{N/r-1}\frac{1}{\sqrt{N}}\sum_{j=0}^{N-1}
e^{-2 \pi i (x_0+jr)y/N }\ket{y} \nonumber \\
&=& \frac{\sqrt{r}}{N} \sum_{y=0}^{N-1}e^{-2 \pi i x_0y/N }
 \sum_{j=0}^{N/r-1}\left(e^{-2 \pi i r y/N}\right)^{j} \ket{y}.
\end{eqnarray}
Note that the second summation constitutes a geometric sum, so if $ry/N$ is an integer, 
\begin{equation}
\sum_{j=0}^{N-1} e^{-2 \pi i (x_0+jr)y/N } = \frac{N}{r},
\end{equation}
otherwise it is zero. Thus, we only ever observe a state $\ket{y}$ such that $ry/N\in \mathbb Z$.
This means that we observe $y$, a multiple of $N/r$, distributed uniformly such that $0\leq y <N$.

Now, we proceed as we did in order finding. We run the algorithm twice,
generating two outcomes $y_1=a(N/r)$ and $y_2=b(N/r)$. Since $a$ and $b$ are picked uniformly
at random, with high probability $\gcd(a,b)=1$ and so $\gcd(y_1,y_2)=N/r$. Since we were given $N$,
we can compute $r$ and we are done. 

Next, we relax the assumption that $r \vert N$. Intuitively, instead of yielding only random multiples
of $N/r$, the above algorithm will return a distribution of values that are concentrated around 
integer multiples of $N/r$, where the concentration will be higher for higher $N$.

\subsection{General analysis}
We now analyze the above algorithm for arbitrary $r$ and $N$, where $N$ is an upper bound for $r$.
We start from the state
\begin{equation}\label{14_startingstate}
\ket{\psi_1} = \frac{1}{\sqrt{N}}\sum_{x=0}^{N-1}\ket{x}\ket{f(x)}.
\end{equation}
Next, for analysis purposes we create a modified Fourier transform that makes sense for our periodic function $f$. 
Specifically, if we restrict ourselves to the domain $x \in \{0,1,\dots,r-1\}$, we can use $\ket{f(x)}$
rather than $\ket{x}$ as our base states. This is because $f$ is not permitted
to have any duplicate values each part of the domain. This modified Fourier transform is now defined as
\begin{equation}
\ket{\hat f(y)} = \frac{1}{\sqrt{r}} \sum_{x=0}^{r-1}e^{2 \pi i x y/r} \ket{f(x)},
\end{equation}
which is defined for $0\leq y <r$. By the general properties of the Fourier transform, we can write
\begin{equation}\label{14_modifiedtransform}
\ket{f(x)} = \frac{1}{\sqrt{r}} \sum_{y=0}^{r-1}e^{-2 \pi i x y/r} \ket{\hat f(y)},
\end{equation}
for $0\leq x <r$. However, note that since both $f$ and the amplitudes in (\ref{14_modifiedtransform}) are periodic 
with period $r$, expression (\ref{14_modifiedtransform}) actually holds for any $x$. Thus, we can write (\ref{14_startingstate}) as
\begin{eqnarray}
\ket{\psi_1} 
&=&  \frac{1}{\sqrt{N}}\sum_{x=0}^{N-1}\ket{x}\left( \frac{1}{\sqrt{r}} \sum_{y=0}^{r-1}
e^{-2 \pi i x y/r} \ket{\hat f(y)}\right) \nonumber \\
&=&  \frac{1}{\sqrt{r}} \sum_{y=0}^{r-1}\left( \frac{1}{\sqrt{N}} \sum_{x=0}^{N-1}
e^{-2 \pi i x y /r}\ket{x} \right) \ket{\hat f (y) }
\end{eqnarray}
Then, we measure the second register, which gives us a $y$ uniformly at random in
$\{0,\dots,r-1\}$. Neglecting the second register, our state is now
\begin{equation} \label{14_pointa}
\ket{\psi_2} = \frac{1}{\sqrt{N}} \sum_{x=0}^{N-1} e^{-2 \pi i x y /r}\ket{x}.
\end{equation}
Next, we apply a standard inverse Fourier transform over $\mathbb Z_N$ to this state, in a procedure
that we identify as phase estimation with $\omega = y/r$. Hence, measuring the
first register gives a state $\ket{\widetilde{y/r}}$, which is concentrated around
$\ket{y/r}$. Now, just as we did for order finding, we can apply the continued 
fraction expansion to obtain $r$ with finite probability after two independent runs. As anticipated, the only 
difference between this general treatment and the special case where $r \vert N$
is that we needed to use phase estimation and a continued fraction expansion.

In order to see that order finding is a special case of period finding, consider the 
function $f(x) \equiv a^x \mod M$, which has period equal to the order of $a$. In fact,
if we draw the period finding  circuit, we can identify an exact correspondence
to the eigenvalue estimation and order-finding algorithms:
\begin{equation}
   \Qcircuit @C=1em @R=2.0em 
   {
   & & &(a) & & & \\
    \lstick{\ket{+}} & \Big{/}^n \qw & \multigate{1}{U_f} & \qw & \gate{F^{-1}}& \qw   & \meter  \\
    \lstick{\ket{0}} & \Big{/}^m \qw & \ghost{U_f} & \qw &\meter & & 
   }
\end{equation}
%
% ::NOTE:: Change the below to cross-references when compiling together with other notes
%
Point $(a)$ in the above diagram, corresponding to expression (\ref{14_pointa}), is the same state as (5) in lecture 10, with $\omega = y/r$.
Thus, our oracle $U_f$ is equivalent to running the controlled powers of $U$ in figure 
2 of lecture 10 (for period-finding) and in the diagram of lecture 12 (for order-finding).
 Note also that since we do not ever use the result of the lower register,
measurement of it is not necessary for the algorithm.
%
% end ::NOTE::
%

\section{The discrete logarithm}
Now, we turn our attention to computing the discrete logarithm. Suppose we are given an
integer $M>0$ and a generator $g$ of $\mathbb Z_M^{*}$, the group of all integers mod $M$ that are
relatively prime with $M$ under multiplication. Further, suppose that we know the order of 
 $\mathbb Z_M^{*}$, say $R= \left| \mathbb Z_M^{*} \right|$
\footnote{Note that this is not a further restriction, as $R$ can be computed from the Euler totient
function, and it can be shown that the totient can be efficiently computed using the factorization
algorithm.}

Note that this is a cyclic group in which 
every element is a power of $g$. Further, suppose we are given some $a \in Z_M^{*}$.
Then, our goal is to find the smallest integer $l \geq 0$ such that $g^l \equiv a \mod M$.
Note that checking that we have a multiple of $l$ is efficient, as it only requires modular
exponentiation. However, classically the best known algorithms for finding $l$ are 
exponential.

In order to construct an efficient quantum algorithm for this problem, consider the function
$f:\mathbb Z_R \times \mathbb Z_R \rightarrow \mathbb Z_M$, $f(x,y) = a^xg^y \mod M$. Then,
we begin with the state
\begin{equation}
\ket{\psi_1} = \frac{1}{R} \sum_{x,y=0}^{R-1} \ket{x}\ket{y}\ket{f(x,y)}.
\end{equation}
Note that $f(x,y)=a^xg^y=g^{lx+y}$. Now, suppose we observe the third register, resulting in
a value $g^b$, with $b$ chosen uniformly from $\{0,\dots,R-1\}$. Hence,
our first two registers are in the state
\begin{equation}
\ket{\psi_2} = \frac{1}{\sqrt{R}} \sum_{(x,y)\in\Lambda} \ket{x}\ket{y},
\end{equation} 
where $\Lambda = \{(x,y):0\leq x,y <R \,\, \mathrm{and} \,\, \ell x+y=b \} $, which is just
\begin{equation}
\ket{\psi_2} = \frac{1}{\sqrt{R}} \sum_{x=0}^{R-1} \ket{x}\ket{b-\ell x}.
\end{equation} 
Next, we apply the inverse Fourier transform over $\mathbb Z_R$ to both registers, resulting in
\begin{equation}
\ket{\psi_3} = \frac{1}{R^{3/2}} \sum_{x=0}^{R-1}\sum_{\xi,\eta = 0}^{R-1} 
e^{-2 \pi i \left[\xi x + \eta (b-\ell x)\right]/R}\ket{\xi}\ket{\eta}.
\end{equation} 
Measuring this state gives us
\begin{equation}
\alpha_{\xi,\eta} = \frac{1}{R^{3/2}} e^{-2 \pi i \eta b /R} \sum_{x=0}^{R-1} 
\left(e^{-2 \pi i \left(\xi - \ell \eta \right)/R}\right)^x.
\end{equation}
This is now a geometric sum, so we know that we will only observe states
that satisfy $\xi \equiv \ell \eta \mod R$, since otherwise the sum is zero. What this
gives us is a uniformly chosen state $\ket{ \eta, \ell \xi \mod R }$ for $0 \leq \xi < R$. Hence, if we can compute
$\eta^{-1}$, we can extract $l$ and we are done. For $\eta^{-1}$ to exist, we need
$\gcd(\eta,R)=1$, which can be shown to occur with high probability:
\begin{equation}
\Pr\left[ \gcd(\eta,R)=1 \right] = \frac{\left| \mathbb Z_R^* \right|}{R} \geq \Omega\left( \frac{1}{\log \log R} \right).
\end{equation}
Note that the above procedure can be generalized to other groups. Specifically, the algorithm works
for any cyclic group with unique representation such that the group operation is efficiently computable. 
In the next section, we detail how the computing the discrete logarithm can pose a threat on certain cryptographic
systems.
\section{Breaking Diffie-Hellman}
Consider the Diffie-Hellman protocol, which enables two parties to exchange keys over an insecure channel.
The protocol is as follows:
\begin{enumerate}
\item The two parties (Alice and Bob) agree publicly on a prime $p$ and a generator $g$ for $\mathbb Z_p^*$.
\item Alice picks $a$ randomly from $\mathbb Z_p^*$ and sends $A=g^a\mod p$ to Bob.
\item Bob picks $b$ randomly from $\mathbb Z_p^*$ and sends $B=g^b\mod p$ to Alice.
\end{enumerate}
Now, the key is $K = g^ab \mod p$. Note that $K=A^b \mod p = B^a \mod p$, so that both Alice and Bob can 
easily generate $K$. However, since $a$ and $b$ were never transmitted and were random, it is thought that it is classically
difficult to to construct $K$ due to the discrete logarithm being hard to compute. 

While this remains an open question, what is clear is that being able to compute
the discrete logarithm efficiently trivially breaks the system. The best known classical algorithm for computing
the discrete logarithm takes time $2^{O(n)}$ on $n$-bit inputs, 
while for factoring it takes time $2^{O(n^{1/3})}$, 
so classically this protocol seems more robust than RSA. However, this system of key exchange is still 
vulnerable to an attack by a quantum computer. This also means that certain 
cryptographic systems, such as El-Gamal
encryption, are broken by a quantum computer, as well. 
Further, many more sophisticated key exchange protocols
 involving groups over elliptic curves are still vulnerable to a quantum computer, as the quantum algorithm for the 
 discrete logarithm breaks them, too.
 
 In the next lecture, we will discuss the hidden subgroup problem, which is sufficiently general to encompass almost 
 all the applications of efficient quantum algorithms we have seen so far. We will then develop an efficient quantum
 algorithm to solve it for finitely generated Abelian groups.
\end{document}
