 Good day! Thanks for clicking on my talk. I'm going to try to make you excited about the quantum complexity of the continuous hidden sub-core problem. I am Kunde Boer and this is joint work with Leo Duca and Serv-Sphere. Let's get started with an overview. What is the continuous hidden sub-core problem? It turns out to be a generalization of the hidden sub-core problem, which is a well-known problem from quantum computing. This hidden sub-core problem covers both factoring and discrete log. Those two problems are still at the base of many cryptosystems practiced today. The continuous hidden sub-core problem also has its influence on cryptography. It has also many other interesting applications. Our contribution is a quantitative and modular analysis of a quantum algorithm that solves the continuous hidden sub-core problem. Our work also identifies bottlenecks and therefore uncovers interesting challenges in this area. To give you a feeling of those challenges, I would like to list five open questions in the hope that you might want to tackle them. What is the continuous hidden sub-core problem? As I already said, it's the generalization of the ordinary hidden sub-core problem. In this problem, you need to find a hidden sub-corp different function on the ambient group that is periodic with respect to this particular hidden sub-corp. In the continuous version of the hidden sub-corp problem, this ambient group is the real vector space, r to the power m, and the hidden sub-corp is a lattice. So this oracle function is periodic with respect to a lattice. Another subtle difference between the continuous hidden sub-core problem and the ordinary hidden sub-core problem is that in the continuous version, the oracle function is allowed to be quantum. The output might be a quantum state. So to be precise, the continuous hidden sub-corp problem consists of finding an approximate basis of the period lattice of a sufficiently nice periodic oracle function on r to the power m, and this oracle function is allowed to be quantum. So in pictures, it looks like this. This is a periodic function, and we are allowed to sample this finitely many times. And we would like to see an approximate basis of this lattice. Why is the continuous hidden sub-corp problem relevant for a cryptanalysis? First of all, I want to mention that the continuous hidden sub-corp problem has many applications. One of them is in number theory. Eisen Treger et al. proved that the computation of unit groups can be reduced to the continuous hidden sub-corp problem. Later, this result was extended by Bjarz and Zon to S-unit groups and principal ideal problems. A sequence of works from Campbell et al. and Cramer et al. showed that we can then solve ideal SVP in certain cyclotomic number fields within sub-exponential approximation factors. This means that we can find relatively short vectors in ideal lattices. And that is where it touches crypto foundations because it was believed that problems in structured lattices are as hard as those in arbitrary lattices. From the work of Eisen Treger et al. and what is confirmed in our work in a more quantified manner, this entire chain is in quantum polynomial time. Which means that in the quantum world certain structured lattices are easier than arbitrary lattices. Our contributions are two-fold. We simplified the quantum algorithm that solves the continuous hidden sub-corp problem and we made a quantified and modular analysis. The quantified part of the analysis gave us a complexity with explicit polynomials and dependencies on all parameters involved. And the modular part makes that other researchers can improve the algorithm and analysis and maybe even specialize it. Our result looks like this, but it can be summarized as follows. For an oracle function for which the Lipschitz constant is not too large, the algorithm requires a cubic amount of qubits, a quadratic amount of quantum gates and a linear amount of quantum queries to the oracle. And here M is the dimension of your hidden lattice. I would like to stress that the periodic oracle function also needs to be not too constant. It needs to be like strictly periodic. If the function is too constant, we are not able to extract useful information out of it. So how to approach the continuous hidden sub-corp problem? So let's repeat what we tried to find. So given a periodic function f, we would like to find the period lattice lobster of this function f. At a very high level, this algorithm has only three steps. The first step is the only quantum step, and it consists of extracting a dual lattice point by a quantum querying f and applying a quantum Fourier transform. The second step consists of assembling many of those approximate dual lattice points to get an approximate basis of the dual lattice. The dual lattice is sort of the inverse lattice of your period lattice. So from inverting the dual basis, you get the basis of your period lattice, that is called the primal basis. And now you arrive at an approximate primal basis of your period lattice lambda. In this talk, we will focus on the first step. This is the quantum step. So let's look at the global idea of the first step, the quantum step, that extracts dual lattice points. We will for now assume that we have an infinite number of qubits. This allows us to describe the states as quantum wave functions, and the algorithm is way easier to understand in terms of those wave functions. So let's start. The initial wave function is the Gaussian superposition. This particular choice is our contribution. It makes it way easier to analyze later on. After that, we query the periodic oracle function in superposition. This leads to a sort of wave packet. After that, we apply the continuous Fourier transform. This leads to a function, a wave function, that peaks at the dual lattice point. And then we measure. We know that this particular algorithm with an infinite number of qubits would work. But the problem is that quantum computers, as we know them, only have finitely many qubits. Therefore, we need to discretize and window the quantum waves involved. And this leads to two kinds of errors. And the technical challenge is to explicitly bound these errors. So let's focus a bit on what happens with the algorithm if you discretize and window the quantum wave function. The initial Gaussian state will become a discrete Gaussian. The amplitudes follow the black dots in this picture. After querying the periodic oracle function, it will look like this. We then applied the quantum Fourier transform. In an ideal world, we will hope that the outcome would resemble the wave after the continuous Fourier transform. So that the amplitudes will also peak at the dual lattice points. In reality, the quantum computer can only access those points. So the quantum computer cannot see the lines in between. It doesn't see the curve behind it. So there's a loss of information. And that causes errors. You can see that in this picture. In order to show that those errors don't matter too much in the overall algorithm, we need to show that those two states are close in the L2 norm. In our work, we gave explicit bounds on this L2 error. We did that by comparing three types of Fourier transforms. The first Fourier transform we considered was the quantum Fourier transform on a grid. It looks like this. We compare this Fourier transform with the Fourier transform over the hypercube. So we remove discreteness. This Fourier transform is then compared with the Fourier transform over the real vector space. So we remove compactness. And this last Fourier transform is what we would like to see. For comparing the first two Fourier transforms, we had to generalize a theorem of Eudin. This theorem is about optimal trigonometric approximations. For the second comparison, we needed the Poisson summation formula. This is about the interplay between Fourier transforms and restriction and periodization of functions. This was a quick overview of our analysis. We will now go to five challenges in this area. The first challenge is to estimate the complexity of oracle functions for S-unit groups and BIP computations as initiated by BIOS and TRON. This is one of the reductions in a few slides back that influenced cryptography. And it is really important to quantify those reductions. The two main ingredients for those oracle functions are that they use quantum discrete gaussians of lattices and that they need to run LLL quantumally. The second challenge is trying to exploit symmetries of lattices. For example, in the case of Galois number fields, we could use the Galois action to generate more dual lattice points. Also, in general, symmetrical lattices behave more regularly. Maybe there's a way to exploit that regular behavior in the quantum algorithm. The next challenge is trying to use known, almost full-ranked sublattices of the hidden lattice. This is especially interesting in the case of the principal ideal problem. Another challenge is trying to improve the numerical stability in the classical post-processing step in the algorithm. Namely, going from an approximate generating set of lattice to an approximate basis increases errors very badly. We would like to have those increased as less as possible. Another challenge is trying to find assumptions on the oracle function that improves the complexity. In our work, we only assumed the oracle function to be Lipschitz. We might think what happens if the function is way more smooth. Well, that's all and thank you for listening. Thank you for clicking on my talk and I hope you learned a bit from my talk.