Martin Roetteler

Experimental comparison of two quantum computing architectures

Significance Quantum computers are an emerging technology promising to be vastly more powerful at solving certain problems than any conventional computer. These devices are now moving out of the laboratory and becoming generally programmable. This allows identical quantum tasks or algorithms to be implemented on radically different technologies to inform further development and scaling. We run a series of algorithms on the two leading platforms: trapped atomic ions and superconducting circuits. Whereas the superconducting system offers faster gate clock speeds and a solid-state platform, the ion-trap system features superior qubits and reconfigurable connections. The performance of these systems is seen to reflect the topology of connections in the base hardware, supporting the idea that quantum computer applications and hardware should be codesigned. We run a selection of algorithms on two state-of-the-art 5-qubit quantum computers that are based on different technology platforms. One is a publicly accessible superconducting transmon device (www.research.ibm.com/ibm-q) with limited connectivity, and the other is a fully connected trapped-ion system. Even though the two systems have different native quantum interactions, both can be programed in a way that is blind to the underlying hardware, thus allowing a comparison of identical quantum algorithms between different physical systems. We show that quantum algorithms and circuits that use more connectivity clearly benefit from a better-connected system of qubits. Although the quantum systems here are not yet large enough to eclipse classical computers, this experiment exposes critical factors of scaling quantum computers, such as qubit connectivity and gate expressivity. In addition, the results suggest that codesigning particular quantum applications with the hardware itself will be paramount in successfully using quantum computers in the future.

Efficient Synthesis of Universal Repeat-Until-Success Quantum Circuits

Recently it was shown that the resources required to implement unitary operations on a quantum computer can be reduced by using probabilistic quantum circuits called repeat-until-success (RUS) circuits. However, the previously best-known algorithm to synthesize a RUS circuit for a given target unitary requires exponential classical runtime. We present a probabilistically polynomial-time algorithm to synthesize a RUS circuit to approximate any given single-qubit unitary to precision ϵ over the Clifford+T basis. Surprisingly, the T count of the synthesized RUS circuit surpasses the theoretical lower bound of 3 log_{2}(1/ϵ) that holds for purely unitary single-qubit circuit decomposition. By taking advantage of measurement and an ancilla qubit, RUS circuits achieve an expected T count of 1.15 log_{2}(1/ϵ) for single-qubit z rotations. Our method leverages the fact that the set of unitaries implementable by RUS protocols has a higher density in the space of all unitaries compared to the density of purely unitary implementations.

EFFICIENT SYNTHESIS OF PROBABILISTIC QUANTUM CIRCUITS WITH FALLBACK

Recently it has been shown that Repeat-Until-Success (RUS) circuits can approximate a given single-qubit unitary with an expected number of T gates of about 1/3 of what is required by optimal, deterministic, ancilla-free decompositions over the Clifford+T gate set. In this work, we introduce a more general and conceptually simpler circuit decomposition method that allows for synthesis into protocols that probabilistically implement quantum circuits over several universal gate sets including, but not restricted to, the Clifford+T gate set. The protocol, which we call Probabilistic Quantum Circuits with Fallback (PQF), implements a walk on a discrete Markov chain in which the target unitary is an absorbing state and in which transitions are induced by multi-qubit unitaries followed by measurements. In contrast to RUS protocols, the presented PQF protocols terminate after a finite number of steps. Specifically, we apply our method to the Clifford+T , Clifford+V , and Clifford+π/12 gate sets to achieve decompositions with expected gate counts of logb(1/ε)+O(log(log(1/ε))), where b is a quantity related to the expansion property of the underlying universal gate set.

Applying Grover's Algorithm to AES: Quantum Resource Estimates

We present quantum circuits to implement an exhaustive key search for the Advanced Encryption Standard AES and analyze the quantum resources required to carry out such an attack. We consider the overall circuit size, the number of qubits, and the circuit depth as measures for the cost of the presented quantum algorithms. Throughout, we focus on Clifford

A note on quantum related-key attacks

+T

Quantum algorithm for the Boolean hidden shift problem

gates as the underlying fault-tolerant logical quantum gate set. In particular, for all three variants of AES key size 128, 192, and 256i¾źbit that are standardized in FIPS-PUB 197, we establish precise bounds for the number of qubits and the number of elementary logical quantum gates that are needed to implement Grovers quantum algorithm to extract the key from a small number of AES plaintext-ciphertext pairs.

Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms

We determine the cost of performing Shors algorithm for integer factorization on a ternary quantum computer, using two natural models of universal fault-tolerant computing: (i) a model based on magic state distillation that assumes the availability of the ternary Clifford gates, projective measurements, classical control as its natural instrumentation set; (ii) a model based on a metaplectic topological quantum computer (MTQC). A natural choice to implement Shors algorithm on a ternary quantum computer is to translate the entire arithmetic into a ternary form. However, it is also possible to emulate the standard binary version of the algorithm by encoding each qubit in a three-level system. We compare the two approaches and analyze the complexity of implementing Shors period finding function in the two models. We also highlight the fact that the cost of achieving universality through magic states in MTQC architecture is asymptotically lower than in generic ternary case.

Q#: Enabling Scalable Quantum Computing and Development with a High-level DSL

We consider a quantum version of the Winternitz-Hellman related-key attack model.Main result: this model gives a quantum attackers big advantage.Any block cipher can be broken via a quantum related key attack.This includes most block ciphers of practical relevance (AES, DES).Secret key is found via quantum algorithm for Simons problem. In a basic related-key attack against a block cipher, the adversary has access to encryptions under keys that differ from the target key by bit-flips. In this short note we show that for a quantum adversary such attacks are quite powerful: if the secret key is (i) uniquely determined by a small number of plaintext-ciphertext pairs, (ii) the block cipher can be evaluated efficiently, and (iii) a superposition of related keys can be queried, then the key can be extracted efficiently.