Lattice-based cryptography has emerged as one of the most prominent candidates for post-quantum cryptography, projected to be secure against the imminent threat of large-scale fault-tolerant quantum computers. The Shortest Vector Problem (SVP) is to find the shortest non-zero vector in a given lattice. It is fundamental to lattice-based cryptography and believed to be hard even for quantum computers. We study a natural generalization of the SVP known as the $K$-Densest Sub-lattice Problem ($K$-DSP): to find the densest $K$-dimensional sub-lattice of a given lattice. We formulate $K$-DSP as finding the first excited state of a Z-basis Hamiltonian, making $K$-DSP amenable to investigation via an array of quantum algorithms, including Grover search, quantum Gibbs sampling, adiabatic, and Variational Quantum Algorithms. The complexity of the algorithms depends on the basis through which the input lattice is presented. We present a classical polynomial-time algorithm that takes an arbitrary input basis and preprocesses it into inputs suited to quantum algorithms. With preprocessing, we prove that $O(KN^2)$ qubits suffice for solving $K$-DSP for $N$ dimensional input lattices. We empirically demonstrate the performance of a Quantum Approximate Optimization Algorithm $K$-DSP solver for low dimensions, highlighting the influence of a good preprocessed input basis. We then discuss the hardness of $K$-DSP in relation to the SVP, to see if there is reason to build post-quantum cryptography on $K$-DSP. We devise a quantum algorithm that solves $K$-DSP with run-time exponent $(5KN\log{N})/2$. Therefore, for fixed $K$, $K$-DSP is no more than polynomially harder than the SVP.

翻译：格基密码学已成为后量子密码学中最具前景的候选方案之一，预计能够抵御大规模容错量子计算机的迫近威胁。最短向量问题（SVP）旨在给定格中找到最短的非零向量。该问题是格基密码学的基础，且被认为即使对量子计算机而言也是困难问题。我们研究SVP的一个自然推广，即$K$-最稠密子格问题（$K$-DSP）：在给定格中寻找最稠密的$K$维子格。我们将$K$-DSP表述为寻找Z基哈密顿量的第一激发态，这使得$K$-DSP能够通过一系列量子算法进行研究，包括Grover搜索、量子吉布斯采样、绝热量子算法和变分量子算法。这些算法的复杂度取决于输入格所采用的基表示。我们提出一种经典多项式时间算法，该算法接收任意输入基并将其预处理为适合量子算法处理的输入形式。经预处理后，我们证明对于$N$维输入格，$O(KN^2)$量子比特足以求解$K$-DSP。我们通过实验展示了用于低维情况的量子近似优化算法$K$-DSP求解器的性能，凸显了良好预处理输入基的影响。随后我们讨论了$K$-DSP相对于SVP的困难性，以探究是否值得基于$K$-DSP构建后量子密码学。我们设计了一种量子算法来求解$K$-DSP，其运行时间指数为$(5KN\log{N})/2$。因此，对于固定$K$，$K$-DSP的难度至多是SVP的多项式级别。