A fundamental computational problem is to find a shortest non-zero vector in Euclidean lattices, a problem known as the Shortest Vector Problem (SVP). This problem is believed to be hard even on quantum computers and thus plays a pivotal role in post-quantum cryptography. In this work we explore how (efficiently) Noisy Intermediate Scale Quantum (NISQ) devices may be used to solve SVP. Specifically, we map the problem to that of finding the ground state of a suitable Hamiltonian. In particular, (i) we establish new bounds for lattice enumeration, this allows us to obtain new bounds (resp.~estimates) for the number of qubits required per dimension for any lattices (resp.~random q-ary lattices) to solve SVP; (ii) we exclude the zero vector from the optimization space by proposing (a) a different classical optimisation loop or alternatively (b) a new mapping to the Hamiltonian. These improvements allow us to solve SVP in dimension up to 28 in a quantum emulation, significantly more than what was previously achieved, even for special cases. Finally, we extrapolate the size of NISQ devices that is required to be able to solve instances of lattices that are hard even for the best classical algorithms and find that with approximately $10^3$ noisy qubits such instances can be tackled.

翻译：一个基础性计算问题是寻找欧几里得格中的最短非零向量，即所谓的最短向量问题（SVP）。该问题即便在量子计算机上也被认为难以求解，因此在后量子密码学中发挥着关键作用。本研究探索了噪声中等规模量子（NISQ）设备如何（高效地）用于求解SVP。具体地，我们将该问题映射为寻找合适哈密顿量的基态问题。其中：（i）我们为格枚举建立了新界限，从而为任意格（或随机q元格）求解SVP时每维所需的量子比特数提供了新界限（或估计值）；（ii）我们通过提出（a）不同的经典优化循环或（b）到哈密顿量的新映射，将零向量排除在优化空间之外。这些改进使我们能在量子仿真中求解维度高达28的SVP，远超此前甚至针对特殊案例所取得的成果。最后，我们推断了所需NISQ设备的规模以求解即便对最佳经典算法也具有难度的格实例，并发现约需$10^3$个带噪声量子比特即可攻克此类实例。