We propose a fully homomorphic encryption scheme -- i.e., a scheme that allows one to evaluate circuits over encrypted data without being able to decrypt. Our solution comes in three steps. First, we provide a general result -- that, to construct an encryption scheme that permits evaluation of arbitrary circuits, it suffices to construct an encryption scheme that can evaluate (slightly augmented versions of) its own decryption circuit; we call a scheme that can evaluate its (augmented) decryption circuit bootstrappable.Next, we describe a public key encryption scheme using ideal lattices that is almost bootstrappable.Lattice-based cryptosystems typically have decryption algorithms with low circuit complexity, often dominated by an inner product computation that is in NC1. Also, ideal lattices provide both additive and multiplicative homomorphisms (modulo a public-key ideal in a polynomial ring that is represented as a lattice), as needed to evaluate general circuits.Unfortunately, our initial scheme is not quite bootstrappable -- i.e., the depth that the scheme can correctly evaluate can be logarithmic in the lattice dimension, just like the depth of the decryption circuit, but the latter is greater than the former. In the final step, we show how to modify the scheme to reduce the depth of the decryption circuit, and thereby obtain a bootstrappable encryption scheme, without reducing the depth that the scheme can evaluate. Abstractly, we accomplish this by enabling the encrypter to start the decryption process, leaving less work for the decrypter, much like the server leaves less work for the decrypter in a server-aided cryptosystem.

/pdf/fully-homomorphic-encryption-using-ideal-lattices-3oirjo0huq.pdf

Fully homomorphic encryption using ideal lattices

Noisy Intermediate-Scale Quantum (NISQ) technology will be available in the near future. Quantum computers with 50-100 qubits may be able to perform tasks which surpass the capabilities of today's classical digital computers, but noise in quantum gates will limit the size of quantum circuits that can be executed reliably. NISQ devices will be useful tools for exploring many-body quantum physics, and may have other useful applications, but the 100-qubit quantum computer will not change the world right away --- we should regard it as a significant step toward the more powerful quantum technologies of the future. Quantum technologists should continue to strive for more accurate quantum gates and, eventually, fully fault-tolerant quantum computing.

/pdf/quantum-computing-in-the-nisq-era-and-beyond-4jnwt61yqa.pdf

Quantum Computing in the NISQ era and beyond

Quantum computers promise to efficiently solve important problems that are intractable on a conventional computer. For quantum systems, where the physical dimension grows exponentially, finding the eigenvalues of certain operators is one such intractable problem and remains a fundamental challenge. The quantum phase estimation algorithm efficiently finds the eigenvalue of a given eigenvector but requires fully coherent evolution. Here we present an alternative approach that greatly reduces the requirements for coherent evolution and combine this method with a new approach to state preparation based on ansatze and classical optimization. We implement the algorithm by combining a highly reconfigurable photonic quantum processor with a conventional computer. We experimentally demonstrate the feasibility of this approach with an example from quantum chemistry--calculating the ground-state molecular energy for He-H(+). The proposed approach drastically reduces the coherence time requirements, enhancing the potential of quantum resources available today and in the near future.

/pdf/a-variational-eigenvalue-solver-on-a-photonic-quantum-2nxrfjmr5w.pdf

A variational eigenvalue solver on a photonic quantum processor

Our main result is a reduction from worst-case lattice problems such as SVP and SIVP to a certain learning problem. This learning problem is a natural extension of the 'learning from parity with error' problem to higher moduli. It can also be viewed as the problem of decoding from a random linear code. This, we believe, gives a strong indication that these problems are hard. Our reduction, however, is quantum. Hence, an efficient solution to the learning problem implies a quantum algorithm for SVP and SIVP. A main open question is whether this reduction can be made classical.Using the main result, we obtain a public-key cryptosystem whose hardness is based on the worst-case quantum hardness of SVP and SIVP. Previous lattice-based public-key cryptosystems such as the one by Ajtai and Dwork were only based on unique-SVP, a special case of SVP. The new cryptosystem is much more efficient than previous cryptosystems: the public key is of size O(n2) and encrypting a message increases its size by O(n)(in previous cryptosystems these values are O(n4) and O(n2), respectively). In fact, under the assumption that all parties share a random bit string of length O(n2), the size of the public key can be reduced to O(n).

/pdf/on-lattices-learning-with-errors-random-linear-codes-and-2dvfl9suqh.pdf

On lattices, learning with errors, random linear codes, and cryptography

Noisy Intermediate-Scale Quantum (NISQ) technology will be available in the
near future. Quantum computers with 50-100 qubits may be able to perform tasks
which surpass the capabilities of today's classical digital computers, but
noise in quantum gates will limit the size of quantum circuits that can be
executed reliably. NISQ devices will be useful tools for exploring many-body
quantum physics, and may have other useful applications, but the 100-qubit
quantum computer will not change the world right away --- we should regard it
as a significant step toward the more powerful quantum technologies of the
future. Quantum technologists should continue to strive for more accurate
quantum gates and, eventually, fully fault-tolerant quantum computing.

/pdf/quantum-computing-in-the-nisq-era-and-beyond-3utyn832f7.pdf

The minrank of a graph $G$ is the minimum rank of a matrix $M$ that can be obtained from the adjacency matrix of $G$ by switching some ones to zeros (i.e., deleting edges) and then setting all diagonal entries to one. This quantity is closely related to the fundamental information-theoretic problems of (linear) index coding (Bar-Yossef et al., FOCS'06), network coding and distributed storage, and to Valiant's approach for proving superlinear circuit lower bounds (Valiant, Boolean Function Complexity '92). 
We prove tight bounds on the minrank of random Erdős-Renyi graphs $G(n,p)$ for all regimes of $p\in[0,1]$. In particular, for any constant $p$, we show that $\mathsf{minrk}(G) = \Theta(n/\log n)$ with high probability, where $G$ is chosen from $G(n,p)$. This bound gives a near quadratic improvement over the previous best lower bound of $\Omega(\sqrt{n})$ (Haviv and Langberg, ISIT'12), and partially settles an open problem raised by Lubetzky and Stav (FOCS '07). Our lower bound matches the well-known upper bound obtained by the "clique covering" solution, and settles the linear index coding problem for random graphs. 
Finally, our result suggests a new avenue of attack, via derandomization, on Valiant's approach for proving superlinear lower bounds for logarithmic-depth semilinear circuits.

The Minrank of Random Graphs

We prove that if L ⊂ R n is a lattice such that det( L ′ ) ≥ 1 for all sublattices L ′ ⊆ L , then X y ∈L y 6 = 0 ( k y k 2 + q ) − s ≤ X z ∈ Z n z 6 = 0 ( k z k 2 + q ) − s for all s > n/ 2 and all 0 ≤ q ≤ (2 s − n ) / ( n + 2), with equality if and only if L is isomorphic to Z n .

A Tight Reverse Minkowski Inequality for the Epstein Zeta Function

Assume Alice and Bob share some bipartite $d$-dimensional quantum state. A well-known result in quantum mechanics says that by performing two-outcome measurements, Alice and Bob can produce correlations that cannot be obtained locally, i.e., with shared randomness alone. We show that by using only two bits of communication, Alice and Bob can classically simulate any such correlations. All previous protocols for exact simulation required the communication to grow to infinity with the dimension $d$. Our protocol and analysis are based on a power series method, resembling Krivine's bound on Grothendieck's constant, and on the computation of volumes of spherical tetrahedra.

Simulating Quantum Correlations with Finite Communication

/pdf/persmith-this-attack-can-be-mounted-when-rsa-is-used-with-a-3h9k1j33u0.pdf

persmith. This attack can be mounted when RSA is used with a low public exponent. The attack is based on an algorithm for finding small solutions to low degree polynomials, which is in turn based on the LLL

Nuclear speckles are a type of membraneless organelle in higher eukaryotic nuclei. Multivalent interactions between residing proteins and RNAs not only drive the formation, but also the layered compositional organization of nuclear speckles. Here, using super-resolution imaging, we demonstrate that nuclear speckle-localized RNA transcripts exhibit preferential intra-speckle positioning and radial orientation. Specifically, we show that transcripts containing a region enriched in SR protein binding motifs and another region enriched in hnRNP binding motifs localize to the outer shell. Moreover, they are oriented so that the SR enriched region is closer to the speckle center relative to the hnRNP enriched region. This differential intra-speckle positioning of RNA transcripts is driven by multivalent interactions between the two motifs and SR/hnRNP proteins respectively, two protein families that exhibit distinct subcellular localization relative to nuclear speckles. Such intra-speckle RNA positioning and orientation might explain the importance of RNAs in maintaining the structural integrity of nuclear speckles, and point at their possible functional roles in RNA splicing.

/pdf/nuclear-speckle-localized-rnas-exhibit-preferential-13uoyfah.pdf

Oded Regev

Papers

The Minrank of Random Graphs

A Tight Reverse Minkowski Inequality for the Epstein Zeta Function

Simulating Quantum Correlations with Finite Communication

persmith. This attack can be mounted when RSA is used with a low public exponent. The attack is based on an algorithm for finding small solutions to low degree polynomials, which is in turn based on the LLL

Nuclear speckle-localized RNAs exhibit preferential positioning and orientation