System and method

Abstract

A system according to one aspect of the present disclosure comprises: an input unit for inputting the quantum state of n quantum bits to a quantum computer; and a calculation unit for executing, by controlling the quantum computer, a quantum calculation that involves repeating a unitary transformation in which is included a pseudo-random function taking a bit string of n / 2 bits as input / output, a Hadamard transform, and swapping between high-order n / 2 quantum bits and low-order n / 2 quantum bits on the quantum state a predetermined number of times.

Description

Systems and methods

[0001] The present disclosure relates to systems and methods.

[0002] In recent years, there has been active research into cryptographic technologies (hereinafter referred to as "quantum cryptography") that assume users have access to quantum computers. Quantum money is one example of quantum cryptography, and its realization requires the operation of "randomly selecting unitary transformations."

[0003] Since it is practically impossible to select a unitary transformation completely at random, a unitary transformation (hereinafter also referred to as a "pseudo-random unitary transformation") that is indistinguishable from a unitary transformation selected completely at random has been proposed (for example, Non-Patent Document 1).

[0004] Zhengfeng Ji, Yi-Kai Liu, Fang Song: Pseudorandom quantum states. (Crypto2018)

[0005] However, the pseudorandom unitary transformation described in Non-Patent Document 1 has a problem in that it is not efficient to implement.

[0006] The present disclosure has been made in view of the above points, and aims to realize a pseudo-random unitary transformation with good implementation efficiency.

[0007] A system according to one aspect of the present disclosure includes an input unit that inputs a quantum state of n qubits to a quantum computer, and a calculation unit that controls the quantum computer to perform quantum calculations that repeat a unitary transform including a pseudorandom function with n / 2-bit bit strings as input and output, a Hadamard transform, and an operation of swapping the upper n / 2 qubits and the lower n / 2 qubits a predetermined number of times on the quantum state.

[0008] A pseudorandom unitary transformation with good implementation efficiency is realized.

[0009] FIG. 1 is a diagram showing an example of a conventional pseudo-random unitary transformation; FIG. 2 is a diagram showing an example of a pseudo-random unitary transformation according to a proposed method; FIG. 3 is a diagram showing an example of the configuration of a quantum computing system according to this embodiment; FIG. 4 is a diagram showing an example of the hardware configuration of a control device according to this embodiment; FIG. 5 is a diagram showing an example of the functional configuration of a control device according to this embodiment; and FIG. 6 is a flowchart showing an example of a pseudo-random unitary transformation process according to this embodiment.

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0011] <Random bit strings and pseudorandom permutations> How to obtain random values ​​is one of the most fundamental and important issues in cryptography, regardless of whether quantum computers are available or not. The security of various cryptographic techniques is based on the premise that the keys are chosen completely uniformly and randomly from a specific range. Therefore, if there is a bias in the distribution of selected keys, it could lead to unexpected attacks.

[0012] Choosing a key isn't the only time cryptography requires random values. Various public key cryptosystems use randomized encryption algorithms. More specifically, each time an encryption operation is performed, a random value r is chosen, and then that value is used for encryption. As with key selection, if r is not completely random, it can lead to unexpected attacks.

[0013] For the reasons mentioned above, secure cryptography often requires large amounts of truly random values, but generating large amounts of truly random values ​​efficiently is not easy.

[0014] If you want to obtain a large number of truly random values ​​r, one of the first methods that comes to mind is as follows. For simplicity, let r be an n-bit string. Also, let us consider the set {0, 1} of bit strings. ｎ and the set of integers {0, 1, 2, ..., 2 ｎ -1}.

[0015] Step a-1: First, {0, 1} ｎ The above permutation (i.e., {0, 1} ｎto {0, 1} ｎ A permutation is chosen uniformly at random from the set of all permutations (bijections to S). Hereafter, the chosen permutation will be written as S.

[0016] Step a-2: By inputting a large number of appropriate inputs into permutation S, a large number of random values ​​can be obtained as output, even if the inputs are not random, because permutation S is selected randomly.

[0017] However, in reality, the method shown in steps a-1 and a-2 above cannot be implemented efficiently. ｎ The set of all permutations above is huge (specifically, 2 ｎ This is because it is practically impossible to select a truly random permutation S from it. Therefore, in practice, what is called a pseudorandom permutation is used instead of a truly random permutation S.

[0018] A pseudorandom permutation is, very roughly speaking, a function P that satisfies the following properties:

[0019] ・P takes a secret key k as input in addition to the normal input x. Hereinafter, the output corresponding to the secret key k is called P ｋ The private key k is a set of bit strings {0, 1} κ Also, from the input x and secret key k, ｋ It is easy to calculate (x), where κ is an integer equal to or greater than 1 and is called a security parameter or the like.

[0020] If you do not know the private key k, ｋ It is impossible to distinguish the output of S from the output of a truly random permutation S (or even if it could be distinguished, it would require enormous cost).

[0021] Set of keys {0, 1} κ is "{0, 1} ｎThe set of all permutations above is very small, so the operation of randomly selecting a single key k can be performed efficiently. For example, a secure block cipher such as AES can be considered a pseudo-random permutation, and the process of selecting a key for AES and encrypting with AES can be performed efficiently. If a single random key k is selected initially, then, for example, r ０ =P ｋ (0), r １ =P ｋ (1), ... etc., a large number of random values ​​r ０ , r １ , ... can be obtained efficiently.

[0022] <Basics of quantum computing> In classical computers (i.e., ordinary computers that are not quantum computers; hereafter referred to as classical computers), data and computer states are represented by bit strings of 0s and 1s. On the other hand, quantum computers can hold "quantum superpositions" of bit strings as states. For example, for two n-bit strings x and y, they can hold the following state, which is an equal superposition of them.

[0023]

[0024] In general, a quantum superposition state of an n-bit string is expressed as follows: This is also called an n-qubit superposition state.

[0025] where α ｘ is a complex number that specifies how much weight to assign to each bit string x, and satisfies the following:

[0026]

[0027] By considering each |x〉 as an orthogonal vector, the quantum superposition state is 2 ｎ It can be thought of as a vector of length 1 in a complex vector space of dimension. In this case, the set {|x〉|x∈{0, 1} ｎ} is 2 ｎ This is an orthonormal basis of the 2-dimensional complex vector space. ｎ Let C be the complex vector space of dimension. ２＾ｎ I will write it as follows.

[0028] A classical computer holds a bit string as an internal state and performs calculations by rewriting this bit string. On the other hand, a quantum computer holds the above quantum superposition state (i.e., a complex vector) as a state (hereinafter also referred to as a quantum state) and performs calculations by applying a unitary transformation to this state. For example, if an n-bit quantum state is represented by a complex vector |ψ〉, then a unitary transformation U:C can be applied to this quantum state |ψ〉. ２＾ｎ →C ２＾ｎ When a calculation is performed such that multiplication is performed, the quantum state after the calculation is expressed as U|ψ〉.

[0029] Calculations using classical computers (hereinafter also referred to as classical computation) are realized by combining basic operations of 1 to 2 bits, such as AND, OR, and NOT. In this case, it can be said that the fewer the number of basic operations required, the more efficient the calculation. The situation is similar for quantum computers, where calculations using quantum computers (hereinafter also referred to as quantum computation) are realized by combining several basic operations of 1 to 2 quantum bits. By skillfully combining these basic operations, classical computation operations such as AND, OR, and NOT can be efficiently simulated. In particular, functions that can be efficiently calculated on classical computers can also be efficiently calculated on quantum computers.

[0030] <Random quantum states and pseudorandom unitary transformations> One of the notable properties of quantum states is that quantum states cannot be freely copied or duplicated (no-cloning theorem). By utilizing this unique property of quantum states, it has been shown that it is theoretically possible to realize cryptographic techniques that cannot be realized using classical computers alone, such as a quantum version of electronic money (also known as quantum money) that is guaranteed to be unclonable. When realizing these cryptographic techniques, the operation of randomly selecting quantum states can sometimes be important.

[0031] The operation of randomly selecting a quantum state can be considered analogous to the operation of selecting a random bit string in classical cryptography (i.e., cryptography that does not assume the use of quantum computers). Furthermore, the quantum computing analog of the operation of randomly selecting a permutation in classical cryptography can be considered to be the operation of "randomly selecting a unitary transformation." Since "randomly selecting a permutation can be useful (i.e., it can generate a large number of random bit strings)," the natural thought arises: "Perhaps randomly selecting a unitary transformation could also be useful in quantum computing."

[0032] In classical computing, it is practically impossible to select a permutation completely randomly, so pseudo-random permutations are used instead. In quantum computing, it is also practically impossible to select a unitary transformation completely randomly. This naturally leads to the concept of a pseudo-random unitary transformation, which, like pseudo-random permutations in classical computing, is "indistinguishable from something chosen pseudo-randomly, rather than completely randomly." Non-Patent Document 1 introduces this concept of pseudo-randomness in the sense commonly used in cryptography.

[0033] The correspondence between classical computation and quantum computation is shown in Table 1 below.

[0034] As shown in Table 1 above, the quantum computing concept corresponding to a random bit string in classical computing is a random quantum state. Similarly, the quantum computing concept corresponding to a random permutation in classical computing is a random unitary transformation, and the quantum computing concept corresponding to a pseudo-random permutation in classical computing is a pseudo-random unitary transformation.

[0035] The pseudorandom unitary transformation will now be described.

[0036] First, if we select one key k, we can obtain the unitary transformation U ｋ (That is, 2 ｎ Unitary transformation U of dimensional complex vector space ｋ For simplicity, we will assume that the key k is {0, 1}κ The number of keys is 2. κ According to the unitary transformation U ｋ Also 2 κ In practice, unitary transformations are realized as quantum circuits (i.e., combinations of the basic operations of quantum computing), so we can think of it as "one quantum circuit being determined for each key k being determined." However, we assume that this quantum circuit can be computed efficiently (i.e., it is composed of a small number of basic operations of quantum computing).

[0037] When using a pseudorandom unitary transformation, first select a key k randomly. Then, the unitary transformation (quantum circuit) U ｋ Depending on the application, an n-bit quantum state |ψ〉 is freely selected and input to the quantum circuit, and the quantum state U is output. ｋ |ψ〉 and use it for something else.

[0038] Unitary transformation U ｋ must be pseudo-random. ｋ If you are given only a quantum circuit, cannot see the contents of the quantum circuit, do not know the time required for the quantum circuit to be calculated, and only know "what kind of input will produce what kind of output", it is difficult to say "the given quantum circuit is really U ｋ The quantum circuit must satisfy the property that it is impossible to distinguish whether it is a quantum circuit with a random unitary transformation or a quantum circuit with a completely random unitary transformation.

[0039] Random quantum states and pseudorandom unitary transformations can be applied to quantum cryptography such as quantum money (Non-Patent Document 1, Reference Document 1). If efficient pseudorandom unitary transformations (i.e., those requiring a small number of basic operations in quantum circuits) are available, they may lead to the realization of quantum money and other technologies with more efficient implementations in the future.

[0040] <Conventional Pseudo-Random Unitary Transformation> A candidate structure for a pseudo-random unitary transformation is given in Non-Patent Document 1. This structure uses classical pseudo-random permutations.

[0041] First, let us consider a classical pseudorandom permutation of n bits as Pｋ where k is {0, 1} κ The private key belongs to P. ｋ Assume that a quantum circuit that calculates is implemented on a quantum computer. Mathematically, this quantum circuit is a unitary transformation that transforms the complex vector shown in Equation 2 above into the following:

[0042] In the following, we will write the above unitary transformation as follows.

[0043] However, in the text of this specification, the unitary transformation shown in the above equation 5 is referred to as U Ｐ_ｋ Similarly, in the text of this specification, a subscript of a subscript will be written as "_".

[0044] When an n-bit quantum state is given as an input, the pseudorandom unitary transformation described in Non-Patent Document 1 is composed of the following steps b-1 to b-3.

[0045] Step b-1: A key k is randomly selected, an appropriate number of repetitions T is determined in advance, and the following steps b-2 to b-3 are repeated T times.

[0046] Step b-2: Pseudo-random permutation P ｋ A quantum circuit that computes the unitary transformation U Ｐ_ｋ ) to transform the quantum state.

[0047] Step b-3: Transform the quantum state using the Hadamard transform of n quantum bits.

[0048] Here, the Hadamard transform of n quantum bits is a unitary transformation that transforms the complex vector shown in the above equation 2 into the following:

[0049] where x·w is a one-bit value calculated as the formal dot product of bit string x and bit string w.

[0050] The pseudorandom unitary transformation consisting of the above steps b-1 to b-3 is shown in Figure 1. As shown in Figure 1, in the conventional pseudorandom unitary transformation, for an n-bit quantum state given as input, a unitary transformation U Ｐ_ｋ The transformation by the Hadamard transformation of n quantum bits and the transformation by the .times. ...

[0051] The pseudorandom unitary transformation described in Non-Patent Document 1 is performed when T is larger than a certain value and P ｋ is indistinguishable from a random permutation, it is expected that it will also be indistinguishable from a random unitary transformation.

[0052] <Problems with Conventional Pseudo-Random Unitary Transformation> In the pseudo-random unitary transformation described in Non-Patent Document 1, a pseudo-random permutation P ｋ On the other hand, it can be said that the smaller the input / output size of a function including pseudorandom permutation, the better the implementation efficiency (for example, the number of basic operations required to implement a quantum circuit). For this reason, the pseudorandom unitary transformation described in Non-Patent Document 1 has the problem of poor implementation efficiency.

[0053] <Proposed Method> Hereinafter, a method (hereinafter also referred to as the proposed method) for constructing a pseudo-random unitary transformation using pseudo-random permutation of n / 2-bit inputs and outputs will be proposed.

[0054] Let Q be the (classical) pseudorandom permutation of n / 2-bit inputs and outputs. ｋ Note that k is {0, 1} κ κ is an integer equal to or greater than 1 (security parameter).

[0055] In this case, the unitary transformation V Ｑ_ｋ is defined as follows:

[0056] where α ｘ is a complex number that specifies how much weight to assign to each bit string x, and satisfies the above equation 3. Also, for each n-bit string x, Ｌ is the bit string of the upper n / 2 bits of x, x Ｒis a bit string of the lower n / 2 bits of x. Furthermore, ∥ represents a combination of bit strings, and the following symbols represent XOR (between n / 2 bit strings):

[0057] However, in the text of this specification, the symbol representing the above XOR will be written as (+).

[0058] In addition, "x" on the right side of the above equation 7 Ｌ ||(Q ｋ (x Ｌ ) (+) x Ｒ ) is a string whose upper n / 2 bits are x Ｌ , the lower n / 2 bits are Q ｋ (x Ｌ ) (+) x Ｒ represents an n-bit string such that

[0059] Pseudorandom permutation Q ｋ If can be implemented efficiently on a classical computer, the above unitary transformation V Ｑ_ｋ can also be efficiently implemented as quantum circuits.

[0060] When an n-bit quantum state is given as input, the pseudorandom unitary transformation according to the proposed method is composed of the following steps 1 to 4.

[0061] Step 1: A key k is randomly selected, an appropriate number of repetitions T is determined in advance, and steps 2 to 4 below are repeated T times.

[0062] Step 2: The above unitary transformation V Ｑ_ｋ That is, the quantum state is transformed by the above unitary transformation V Ｑ_ｋ The quantum state is transformed using a quantum circuit that implements the above.

[0063] Step 3: Transform the quantum state using the n-qubit Hadamard transformation.

[0064] Step 4: Swap the upper n / 2 quantum bits with the lower n / 2 quantum bits.

[0065] Mathematically, the exchange operation in step 4 above is a unitary transformation that converts the complex vector shown in the following equation 9 into the complex vector shown in the following equation 10.

[0066]

[0067] The pseudorandom unitary transformation consisting of the above steps 1 to 4 is shown in Figure 2. As shown in Figure 2, in the pseudorandom unitary transformation according to the proposed method, for an n-bit quantum state given as input, a unitary transformation V Ｑ_ｋ The transformation by the Hadamard transformation of n qubits, and the swapping of the upper n / 2 qubits and the lower n / 2 qubits are repeated T times. Note that SWAP in the configuration of the pseudorandom unitary transformation shown in Figure 2 corresponds to the swapping operation of the upper n / 2 qubits and the lower n / 2 qubits.

[0068] A quantum computing system 10 that realizes the pseudorandom unitary transformation according to the proposed method will be described below.

[0069] <Configuration Example of Quantum Computing System 10> A configuration example of the quantum computing system 10 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the quantum computing system 10 according to this embodiment is composed of a control device 100 and a quantum processor 200. The quantum processor 200 may also be called a quantum computer.

[0070] The control device 100 controls the quantum processor 200 to realize quantum computation, and also obtains computation results from the quantum processor 200. The control device 100 is realized by, for example, a classical computer or the like.

[0071] The quantum processor 200 configures a quantum two-level system called a quantum bit (physical quantum bit), and performs physical operations such as initialization, gate operation (unitary transformation), and measurement on the physical quantum bit under the control of the control device 100. Note that the quantum system for realizing the quantum bit is not particularly limited, and any quantum system may be used. For example, a quantum system realized by a superconducting circuit, an ion trap, a photon, a quantum dot, or the like may be used.

[0072] <Example of Hardware Configuration of Control Device 100> An example of the hardware configuration of the control device 100 according to this embodiment is shown in Fig. 4. As shown in Fig. 4, the control device 100 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0073] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the control device 100 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0074] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0075] The communication I / F 104 is an interface for transmitting and receiving various signals to and from the quantum processor 200. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device (storage device) such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 108 is an arithmetic device such as a CPU (Central Processing Unit).

[0076] 4 is an example, and the hardware configuration of the control device 100 is not limited to this. For example, the control device 100 may have multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0077] <Example of Functional Configuration of Control Device 100> Fig. 5 shows an example of the functional configuration of the control device 100 according to this embodiment. As shown in Fig. 5, the control device 100 according to this embodiment has a setting unit 110, an input unit 120, a calculation unit 130, and an output unit 140. Each of these units is realized, for example, by processing executed by the processor 108 of one or more programs installed in the control device 100. The control device 100 according to this embodiment also has a storage unit 150. The storage unit 150 is realized, for example, by a storage area of ​​the auxiliary storage device 107 or the like. Note that the storage unit 150 may also be realized, for example, by a storage area of ​​a storage device communicably connected to the control device 100.

[0078] The setting unit 110 sets the secret key k∈{0, 1} κ randomly chosen, and the unitary transformation V Ｑ_ｋ The pseudorandom permutation Q contained in ｋ This sets the unitary transformation V Ｑ_ｋ The quantum processor 200 is equipped with quantum circuits that realize the above steps 2 to 4, including a quantum circuit that realizes the above steps 2 to 4.

[0079] Furthermore, the setting unit 110 sets the number of repetitions T and stores it in the storage unit 150. The value of the number of repetitions T may be determined in advance or by a user, for example. However, the number of repetitions T is assumed to be a value equal to or greater than a certain value.

[0080] The input unit 120 provides the n-bit quantum state |ψ> expressed in the form of the above equation 2 to the quantum processor 200 as an input.

[0081] The calculation unit 130 controls the quantum processor 200 and realizes quantum calculation by repeating the above steps 2 to 4 T times for the quantum state |ψ> given to the quantum processor 200 as an input.

[0082] The output unit 140 measures the quantum state of the quantum processor 200 and outputs the n-bit string obtained as a result of the measurement to a predetermined output destination. Note that the output destination is not limited to a specific output destination, and various output destinations are possible. For example, the output destination may be the storage unit 150, or may be another program, another device, another instrument, another terminal, etc.

[0083] The storage unit 150 stores various data including the number of repetitions T set by the setting unit 110 .

[0084] <Pseudo-random unitary conversion processing> An example of the pseudo-random unitary conversion processing according to this embodiment will be described with reference to Fig. 6. Note that the following steps S101 to S102 are executed in advance before step S103 is executed.

[0085] The setting unit 110 sets the secret key k∈{0, 1} κ randomly chosen, and the unitary transformation V Ｑ_ｋ The pseudorandom permutation Q contained in ｋ (step S101).

[0086] The setting unit 110 sets the number of repetitions T and stores it in the storage unit 150 (step S102).

[0087] The input unit 120 provides the n-bit quantum state |ψ> expressed in the form of the above-mentioned equation 2 to the quantum processor 200 as an input (step S103).

[0088] The following steps S104 to S106 are repeatedly executed T times. Hereinafter, the index representing the number of repetitions is designated as t. Note that t starts from an initial value of t=1, and the value is incremented as t←t+1 each time the following steps S104 to S106 are executed.

[0089] The calculation unit 130 controls the quantum processor 200 to convert the quantum state (quantum state |ψ〉 when t=1, or the quantum state after step S106 at t−1 when t>1) into the unitary transformation V Ｑ_ｋ (step S104).

[0090] The calculation unit 130 controls the quantum processor 200 to transform the quantum state after the transformation in step S104 above by the Hadamard transformation of n quantum bits (step S105).

[0091] The calculation unit 130 controls the quantum processor 200 to swap the upper n / 2 quantum bits and the lower n / 2 quantum bits of the quantum state after the conversion in step S105 (step S106).

[0092] Finally, the output unit 140 measures the quantum state after step S106 at t=T is executed, and outputs the n-bit string obtained as the measurement result to a predetermined output destination (step S107).

[0093] <Modifications> Modification 1 In the above embodiment, Q ｋ is a pseudorandom permutation with n / 2 bit input and output, ｋ may be a (classical) pseudorandom function with n / 2-bit inputs and outputs. That is, in the above embodiment, the pseudorandom permutation Q ｋ Instead of ｋ A pseudorandom function is a function that is indistinguishable from a truly random function and is not necessarily bijective.

[0094] Modification 2 In the above embodiment, the quantum state after repeating the above steps 2 to 4 T times is measured, and the n-bit string obtained as the measurement result is output, but the output unit 140 may, for example, control the quantum processor 200 to output the quantum state after repeating the above steps 2 to 4 T times to another quantum circuit. This makes it possible to use the output of the pseudo-random unitary transformation according to the proposed method as the input to another quantum circuit.

[0095] As described above, the quantum computing system 10 according to this embodiment can realize a pseudorandom unitary transformation using a pseudorandom function with n / 2-bit inputs and outputs, rather than a pseudorandom permutation with n-bit inputs and outputs. Therefore, the quantum computing system 10 according to this embodiment is expected to enable the implementation of quantum circuits that are more efficient (i.e., require fewer basic operations) than conventional pseudorandom unitary transformations.

[0096] The pseudorandom unitary transformation configuration according to the proposed method is identical to the classical Feistel configuration if there is no Hadamard transformation in step 3. The Feistel configuration has a large number of iterations T and Q ｋ If there are no fatal flaws in the pseudorandom unitary transformation, it is indistinguishable from a completely random permutation. By this analogy, we can expect that the construction of the pseudorandom unitary transformation related to the proposed method will also be indistinguishable from a completely random unitary transformation.

[0097] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0098] [Reference 1] Reference 1: Gorjan Alagic, Christian Majenz, Alexander Russel: Efficient simulation of random states and random unitaries. (Eurocrypt 2020)

[0099] 10 Quantum computing system 100 Control device 101 Input device 102 Display device 103 External I / F 103a Recording medium 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage device 108 Processor 109 Bus 110 Setting unit 120 Input unit 130 Calculation unit 140 Output unit 150 Storage unit 200 Quantum processor

Claims

1. A system having an input unit that inputs a quantum state of n qubits to a quantum computer, and a calculation unit that controls the quantum computer to perform quantum calculations that repeat a unitary transformation including a pseudorandom function with n / 2-bit bit strings as input and output, a Hadamard transform, and an operation to swap the upper n / 2 qubits and the lower n / 2 qubits a predetermined number of times on the quantum state.

2. The unitary transformation is as follows: When the n-bit bit string is x, the quantum state is Σ ｘ α ｘ |x〉 (where α ｘ is a complex number), the quantum state can be expressed as Σ ｘ α ｘ |x Ｌ ||(Q ｋ (x Ｌ ) (+) x Ｒ )> (where x Ｌ is the bit string of the most significant n / 2 bits of the bit string x, Ｒ is the bit string of the lower n / 2 bits of the bit string x, Q ｋ 2. The system of claim 1, wherein (k) is the pseudorandom function with a secret key k, and (+) is XOR.

3. The system of claim 1 or 2, wherein the pseudorandom function is a pseudorandom permutation.

4. A method in which a computer executes the following steps: an input procedure for inputting a quantum state of n qubits into a quantum computer; and a calculation procedure for controlling the quantum computer to perform quantum calculations that repeat a unitary transformation including a pseudorandom function with n / 2-bit bit strings as input and output, a Hadamard transform, and an operation of swapping the upper n / 2 qubits and the lower n / 2 qubits a predetermined number of times on the quantum state.

Images