## Polynomial-Time Quantum Algorithms for Pell's Equation and the Principal Ideal Problem (2001)

Venue: | in Proceedings of the 34th ACM Symposium on Theory of Computing |

Citations: | 82 - 7 self |

### BibTeX

@INPROCEEDINGS{Hallgren01polynomial-timequantum,

author = {Sean Hallgren},

title = {Polynomial-Time Quantum Algorithms for Pell's Equation and the Principal Ideal Problem},

booktitle = {in Proceedings of the 34th ACM Symposium on Theory of Computing},

year = {2001},

pages = {653--658},

publisher = {ACM Press}

}

### Years of Citing Articles

### OpenURL

### Abstract

Besides Shor's polynomial-time quantum algorithms for factoring and discrete log, all progress in understanding when quantum algorithms have an exponential advantage over classical algorithms has been through oracle problems. Here we give efficient quantum algorithms for two more non-oracle problems. The first is Pell's equation. Given a positive non-square integer d, Pell's equation is x² - dy² = 1 and the goal is to find its integer solutions. Factoring integers reduces to finding integer solutions of Pell's equation, but a reduction in the other direction is not known and appears more difficult. The second problem is the principal ideal problem in real quadratic number fields. Solving this problem is at least as hard as solving Pell's equation, and is the basis of a cryptosystem which is broken by our algorithm. We also state some related open problems from the area of computational algebraic number theory.

### Citations

1368 |
Quantum Computation and Quantum Information
- Nielsen, Chuang
- 2000
(Show Context)
Citation Context ...tors for the class group in polynomial time. The best classical algorithms for computing the regulator compute the class group at the same time. The standard quantum algorithm for decomposing a group =-=[NC00]-=- cannot be used since we do not have unique representatives for each group element. After multiplying two elements, we are left with a reduced ideal, but it could be any reduced ideal in the cycle. Th... |

913 |
A Course in Computational Algebraic Number Theory
- Cohen
- 1993
(Show Context)
Citation Context ...e generator # such that #O = I. As with the regulator we cannot find # itself because it may be too big, but we instead compute the distance of I. The generator can then be computed from the distance =-=[Coh93]-=-. To test if an ideal is principal, use the output of the algorithm and check if the ideal really has that distance. If the ideal is not reduced, then it should be reduced first. One application of th... |

878 | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer
- Shor
- 1997
(Show Context)
Citation Context ...rithm. We also state some related open problems from the area of computational algebraic number theory. 1 Introduction Besides Shor's polynomial-time quantum algorithms for factoring and discrete log =-=[Sho97]-=-, all progress in understanding when quantum algorithms might have an exponential advantage over classical algorithms has been through oracle problems. In this paper we give polynomial-time quantum al... |

356 | On the power of quantum computation - Simon - 1994 |

66 | Quantum mechanical algorithms for the nonabelian hidden subgroup problem - Grigni, Schulman, et al. |

55 |
and Umesh Vazirani. Quantum complexity theory
- Bernstein
(Show Context)
Citation Context ...m Computing Background All problems that have quantum algorithms with superpolynomial or exponential speedups over the best known classical algorithm have quantum algorithms that use Fourier sampling =-=[BV97]-=-. Given a quantum state, Fourier sampling is the process of computing the Fourier transform and measuring the result. This is an important primitive to understand because it ignores the phases 2 of th... |

38 | An improved quantum Fourier transform algorithm and applications - Hales, Hallgren - 2000 |

38 | On the calculation of regulators and class numbers of quadratic fields - Lenstra - 1982 |

23 |
Amnon Ta-Shma. Normal subgroup reconstruction and quantum computation using group representations
- Hallgren, Russell
(Show Context)
Citation Context ...s#. The other property used is that the Fourier transform of a state that is uniform over a normal subgroup of a finite group is uniform over representations that contain the subgroup in their kernel =-=[HRTS00]-=-. The subgroup can then be computed (e#ciently when the group is abelian) from polynomially many samples. In our algorithms we will use the first property as is and prove a new generalization of the s... |

20 | Solving the Pell equation - Lenstra |

15 |
H.C.: A Key Exchange System Based on Real Quadratic Fields
- Buchmann, Williams
- 1989
(Show Context)
Citation Context ...nd assuming (only) the GRH it comes down to O(d 1/5 polylog d). There are reductions from factoring to solving Pell's equation, and from solving Pell's equation to solving the principal ideal problem =-=[BW89]-=-. However, Pell's equation and the principal ideal problem appear to be harder than factoring, and there are no reductions known in the other direction (this is reflected in the gap between the runnin... |

4 |
Theory of Linear and Integer Programming, chapter 15.1 : Karmarkar's polynomial--time algorithm for linear programming
- Schrijver
- 1986
(Show Context)
Citation Context ...n the continued fraction expansion of c/d. We will use the fact that if x is any irrational number, a/b # Q, and |x - a/b| # 1 2b 2 , then a/b is a convergent in the continued fraction expansion of x =-=[Sch86]-=-. We will show that | c d - k l | # 1 2l 2 . Given this, choose an irrational number x between c/d and k/l that is within 1 2d 2 of c/d. Then k/l and c/d are convergents of the continued fraction expa... |

2 | Some remarks concerning the complexity of computing class groups of quadratic fields
- Buchmann, Williams
- 1991
(Show Context)
Citation Context ...m techniques, because each group element has a unique e#ciently computable representative. Finally we mention that the following problems for quadratic number fields are in NP #co-NP assuming the GRH =-=[BW91]-=-: deciding if an ideal is principal, deciding if a set of ideals generate the class group, deciding if a set of ideals are a basis for the class group. Acknowledgements: Thanks to Hendrik Lenstra for ... |

1 | Solving pell's equation. Clay - Lenstra |

1 |
Quantum algorithms for some hidden coset problems
- Dam, Hallgren, et al.
(Show Context)
Citation Context ...rier transform and measuring the result. This is an important primitive to understand because it ignores the phases 2 of the amplitudes and only looks at the distribution induced. In fact, except for =-=[vDHI]-=-, all such algorithms (for example [Sim97, Sho97, HRTS00, GSVV01]) use the stronger primitive of Fourier sampling a function. Given a function f , Fourier sampling f is the process of creating the sup... |