We propose a fully homomorphic encryption scheme -- i.e., a scheme that allows one to evaluate circuits over encrypted data without being able to decrypt. Our solution comes in three steps. First, we provide a general result -- that, to construct an encryption scheme that permits evaluation of arbitrary circuits, it suffices to construct an encryption scheme that can evaluate (slightly augmented versions of) its own decryption circuit; we call a scheme that can evaluate its (augmented) decryption circuit bootstrappable.Next, we describe a public key encryption scheme using ideal lattices that is almost bootstrappable.Lattice-based cryptosystems typically have decryption algorithms with low circuit complexity, often dominated by an inner product computation that is in NC1. Also, ideal lattices provide both additive and multiplicative homomorphisms (modulo a public-key ideal in a polynomial ring that is represented as a lattice), as needed to evaluate general circuits.Unfortunately, our initial scheme is not quite bootstrappable -- i.e., the depth that the scheme can correctly evaluate can be logarithmic in the lattice dimension, just like the depth of the decryption circuit, but the latter is greater than the former. In the final step, we show how to modify the scheme to reduce the depth of the decryption circuit, and thereby obtain a bootstrappable encryption scheme, without reducing the depth that the scheme can evaluate. Abstractly, we accomplish this by enabling the encrypter to start the decryption process, leaving less work for the decrypter, much like the server leaves less work for the decrypter in a server-aided cryptosystem.

/pdf/fully-homomorphic-encryption-using-ideal-lattices-3oirjo0huq.pdf

Fully homomorphic encryption using ideal lattices

Noisy Intermediate-Scale Quantum (NISQ) technology will be available in the near future. Quantum computers with 50-100 qubits may be able to perform tasks which surpass the capabilities of today's classical digital computers, but noise in quantum gates will limit the size of quantum circuits that can be executed reliably. NISQ devices will be useful tools for exploring many-body quantum physics, and may have other useful applications, but the 100-qubit quantum computer will not change the world right away --- we should regard it as a significant step toward the more powerful quantum technologies of the future. Quantum technologists should continue to strive for more accurate quantum gates and, eventually, fully fault-tolerant quantum computing.

/pdf/quantum-computing-in-the-nisq-era-and-beyond-4jnwt61yqa.pdf

Quantum Computing in the NISQ era and beyond

Quantum computers promise to efficiently solve important problems that are intractable on a conventional computer. For quantum systems, where the physical dimension grows exponentially, finding the eigenvalues of certain operators is one such intractable problem and remains a fundamental challenge. The quantum phase estimation algorithm efficiently finds the eigenvalue of a given eigenvector but requires fully coherent evolution. Here we present an alternative approach that greatly reduces the requirements for coherent evolution and combine this method with a new approach to state preparation based on ansatze and classical optimization. We implement the algorithm by combining a highly reconfigurable photonic quantum processor with a conventional computer. We experimentally demonstrate the feasibility of this approach with an example from quantum chemistry--calculating the ground-state molecular energy for He-H(+). The proposed approach drastically reduces the coherence time requirements, enhancing the potential of quantum resources available today and in the near future.

/pdf/a-variational-eigenvalue-solver-on-a-photonic-quantum-2nxrfjmr5w.pdf

A variational eigenvalue solver on a photonic quantum processor

Our main result is a reduction from worst-case lattice problems such as SVP and SIVP to a certain learning problem. This learning problem is a natural extension of the 'learning from parity with error' problem to higher moduli. It can also be viewed as the problem of decoding from a random linear code. This, we believe, gives a strong indication that these problems are hard. Our reduction, however, is quantum. Hence, an efficient solution to the learning problem implies a quantum algorithm for SVP and SIVP. A main open question is whether this reduction can be made classical.Using the main result, we obtain a public-key cryptosystem whose hardness is based on the worst-case quantum hardness of SVP and SIVP. Previous lattice-based public-key cryptosystems such as the one by Ajtai and Dwork were only based on unique-SVP, a special case of SVP. The new cryptosystem is much more efficient than previous cryptosystems: the public key is of size O(n2) and encrypting a message increases its size by O(n)(in previous cryptosystems these values are O(n4) and O(n2), respectively). In fact, under the assumption that all parties share a random bit string of length O(n2), the size of the public key can be reduced to O(n).

/pdf/on-lattices-learning-with-errors-random-linear-codes-and-2dvfl9suqh.pdf

On lattices, learning with errors, random linear codes, and cryptography

Noisy Intermediate-Scale Quantum (NISQ) technology will be available in the
near future. Quantum computers with 50-100 qubits may be able to perform tasks
which surpass the capabilities of today's classical digital computers, but
noise in quantum gates will limit the size of quantum circuits that can be
executed reliably. NISQ devices will be useful tools for exploring many-body
quantum physics, and may have other useful applications, but the 100-qubit
quantum computer will not change the world right away --- we should regard it
as a significant step toward the more powerful quantum technologies of the
future. Quantum technologists should continue to strive for more accurate
quantum gates and, eventually, fully fault-tolerant quantum computing.

/pdf/quantum-computing-in-the-nisq-era-and-beyond-3utyn832f7.pdf

We present a new efficient algorithm for the search version of the approximate Closest Vector Problem with Preprocessing (CVPP). Our algorithm achieves an approximation factor of O(n/sqrt{log n}), improving on the previous best of O(n^{1.5}) due to Lag arias, Lenstra, and Schnorr {hkzbabai}. We also show, somewhat surprisingly, that only O(n) vectors of preprocessing advice are sufficient to solve the problem (with the slightly worse approximation factor of O(n)). We remark that this still leaves a large gap with respect to the decisional version of CVPP, where the best known approximation factor is O(sqrt{n/log n}) due to Aharonov and Regev {AharonovR04}. To achieve these results, we show a reduction to the same problem restricted to target points that are close to the lattice and a more efficient reduction to a harder problem, Bounded Distance Decoding with preprocessing (BDDP). Combining either reduction with the previous best-known algorithm for BDDP by Liu, Lyubashevsky, and Micciancio {LiuLM06} gives our main result. In the setting of CVP without preprocessing, we also give a reduction from (1+eps)gamma approximate CVP to gamma approximate CVP where the target is at distance at most 1+1/eps times the minimum distance (the length of the shortest non-zero vector) which relies on the lattice sparsification techniques of Dadush and Kun {DadushK13}. As our final and most technical contribution, we present a substantially more efficient variant of the LLM algorithm (both in terms of run-time and amount of preprocessing advice), and via an improved analysis, show that it can decode up to a distance proportional to the reciprocal of the smoothing parameter of the dual lattice {MR04}. We show that this is never smaller than the LLM decoding radius, and that it can be up to an wide tilde{Omega}(sqrt{n}) factor larger.

On the Closest Vector Problem with a Distance Guarantee

Kneser graphs are like Swiss cheese, Discrete Analysis 2018:2, 18 pp.

This paper relates two very interesting areas of research in extremal combinatorics: removal lemmas, and influence of variables. A _removal lemma_ is a result that states that if $S$ is a set that contains only few copies of a certain structure, then one can remove just a few elements from $S$ to create a set $S'$ that has no copies of that structure. For instance, the triangle removal lemma states that a graph with few triangles can be approximated by a graph with no triangles. Removal lemmas play a very important role in extremal and additive combinatorics. As for the influence of variables, the aspect that is of interest here is that there are many interesting theorems that state that if a function has a certain property, it must be because in a certain sense it depends on only a few variables. For example, a famous result of the first author shows that if a monotone graph property fails to have a sharp threshold, then the property can be approximated by one for which the minimal graphs that satisfy it are all small, with the result that the "influence" of individual edges on whether the graph has the property is substantial.

The main result of this paper is an "edge removal lemma" for various families of graphs. It states that if $G$ is a graph in one of these families, then for every set $X$ of vertices in $G$ that spans only a few edges one can throw away just a small proportion of $X$ to obtain a subset $X'$ that is independent. Of course, a result like this is completely false in general: one has only to take a sparse random graph, and then every subset will span few edges but no large subset will be independent. But it is true, for example, for complete bipartite graphs, since a set of vertices that spans a sparse subgraph will have to be contained almost entirely in one of the two vertex sets, and then one can throw away the vertices that are in the other set. 

One of the families for which the authors prove an edge-removal lemma is that of Kneser graphs. For $0<m<n/2$, the Kneser graph $K(n,m)$ has as its vertex set the set of all subsets of $\{1,2,\dots,n\}$ of size $m$, with two such subsets joined by an edge if and only if they are disjoint. Kneser graphs have large sparse sets, but the natural examples seem to depend on just a few variables: for example, one can take all sets that contain a particular element. (Note that an independent set in $K(n,m)$ is just an intersecting family of $m$-sets.) The authors wanted to prove a precise conjecture that would say that every set of vertices that spans a sparse subgraph can be approximated by a set of vertices that (i) depends on just a few variables and (ii) spans an independent set. Before this paper a weaker statement was known where instead of (ii) one had a sparse set. In this paper the authors settle the conjecture completely by showing that a sparse set of vertices can be approximated by an independent set of vertices.

The other family of graphs for which the authors prove an edge removal lemma is that of product graphs. If $H$ is a graph, then the product $G=H^n$ is the graph where $x$ and $y$ are joined if for every coordinate $i$ we have that $x_iy_i$ is an edge of $H$. (There are different definitions of product graphs, but this is the one to which the result applies: note that it makes it quite hard for two vertices to be joined.) For example, if $H$ is a complete graph on $r$ coordinates, then $G=[r]^n$ with two vertices joined if and only if they differ in every coordinate.

The proof of the removal lemma uses ideas from Jacob Fox's proof of the triangle removal lemma, which obtains the best known bound for that result.

Finally, what has this to do with Swiss cheese? The rough idea is that these graphs have large and highly structured independent sets, and a part of the graph is sparse if and only if it has a big intersection with one of these independent sets. Likewise a Swiss cheese contains lots of large holes, and a region of space contained within the boundary of the cheese will contain only a small amount of cheese if and only if it is almost entirely contained in one of the holes.

 



Article image [by G. J. Wanderer](https://www.flickr.com/photos/106561245@N07/13515457313/in/photolist-mAjfA6-f7mF8i-Tf5Ler-7i4FtY-bi74Nt-gWVXdj-7XoC4N-okRvp5-77HxiZ-7xt4hx-RSUt3B-qeB17D-as2aAc-7K64uq-oL2GMj-6trVsK-UDq452-SP1xSX-d4u57o-fATSUi-8Km2Qs-dJeLzb-qu9Z4Z-dNNvQ2-7eVY4b-6mtCks-frWJEF-aCerNx-7tyjAW-haiMTG-oysrog-9LJVj8-fzno-4VuER1-b5n85M-Jka6K5-a7vHJZ-5S7Yyt-Uwa6kC-dNU7Mm-5AWGod-YSE7a-bzagV7-8tV58z-8YW1XL-5nvECU-QAdC69-8wG84t-TSsHP4-9eoj6S) and distributed under a [CC-BY-NC-SA licence](https://creativecommons.org/licenses/by-nc-sa/2.0/).

/pdf/kneser-graphs-are-like-swiss-cheese-327m1wz0qv.pdf

Kneser graphs are like Swiss cheese

Gap Hamming Distance is a well-studied problem in communication complexity, in which Alice and Bob have to decide whether the Hamming distance between their respective n-bit inputs is less than n/2 -√n or greater than n/2 + √n. We show that every k-round bounded-error communication protocol for this problem sends a message of at least Ω(n/(k2 log k)) bits. This lower bound has an exponentially better dependence on the number of rounds than the previous best bound, due to Brody and Chakrabarti. Our communication lower bound implies strong space lower bounds on algorithms for a number of data stream computations, such as approximating the number of distinct elements in a stream.

/pdf/better-gap-hamming-lower-bounds-via-better-round-elimination-4alnwoyy5i.pdf

Better gap-hamming lower bounds via better round elimination

We study the Lattice Isomorphism Problem (LIP), in which given two lattices L1 and L2 the goal is to decide whether there exists an orthogonal linear transformation mapping L1 to L2. Our main result is an algorithm for this problem running in time nO(n) times a polynomial in the input size, where n is the rank of the input lattices. A crucial component is a new generalized isolation lemma, which can isolate n linearly independent vectors in a given subset of Zn and might be useful elsewhere. We also prove that LIP lies in the complexity class SZK.

http://www2.mta.ac.il/~ishayhav/papers/latticeiso.pdf

On the lattice isomorphism problem

We introduce quantum XOR games, a model of two-player one-round games that extends the model of XOR games by allowing the referee's questions to the players to be quantum states. We give examples showing that quantum XOR games exhibit a wide range of behaviors that are known not to exist for standard XOR games, such as cases in which the use of entanglement leads to an arbitrarily large advantage over the use of no entanglement. By invoking two deep extensions of Grothendieck's inequality, we present an efficient algorithm that gives a constant-factor approximation to the best performance players can obtain in a given game, both in case they have no shared entanglement and in case they share unlimited entanglement. As a byproduct of the algorithm we prove some additional interesting properties of quantum XOR games, such as the fact that sharing a maximally entangled state of arbitrary dimension gives only a small advantage over having no entanglement at all.

Oded Regev

Papers

On the Closest Vector Problem with a Distance Guarantee

Kneser graphs are like Swiss cheese

Better gap-hamming lower bounds via better round elimination

On the lattice isomorphism problem

Quantum XOR Games