量子次指数时间上椭圆曲线同构的构造
Constructing elliptic curve isogenies in quantum subexponential time
摘要：
给定有限域上的两条椭圆曲线具有相同的基数和自同态环，已知这两条曲线允许它们之间的同构，但找到这样的同构被认为是计算困难的。已知最快的经典算法需要指数时间，而在我们的工作之前，还没有更快的量子算法。最近，公钥密码系统的基础上，这个问题的假定硬度已被提出作为候选人的后量子密码。在本文中，我们给出了一个次指数时间量子算法构造同构，假设广义黎曼假设（但没有其他假设）。我们的算法是基于减少到一个隐藏的移位问题，再加上一个新的次指数时间算法，用于评估isogenies从内核理想（下只有GRH），并代表了第一个非平凡的应用Kuperberg的量子算法的隐藏移位问题。这一结果表明，基于同源性的密码系统可能无法与更主流的抗量子密码系统（如基于格的密码系统）竞争。
英文摘要：
Given two elliptic curves over a finite field having the same cardinality and endomorphism ring, it is known that the curves admit an isogeny between them, but finding such an isogeny is believed to be computationally difficult. The fastest known classical algorithm takes exponential time, and prior to our work no faster quantum algorithm was known. Recently, public-key cryptosystems based on the presumed hardness of this problem have been proposed as candidates for post-quantum cryptography. In this paper, we give a subexponential-time quantum algorithm for constructing isogenies, assuming the Generalized Riemann Hypothesis (but with no other assumptions). Our algorithm is based on a reduction to a hidden shift problem, together with a new subexponential-time algorithm for evaluating isogenies from kernel ideals (under only GRH), and represents the first nontrivial application of Kuperberg's quantum algorithm for the hidden shift problem. This result suggests that isogeny-based cryptosystems may be uncompetitive with more mainstream quantum-resistant cryptosystems such as lattice-based cryptosystems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
