Patent Application
20230188342
The present disclosure generally relates to a method of designing a one-way computational system in quotient algebra partition-based homomorphic encryption (QAPHE), particularly, to a method of designing a one-way computational system in quotient algebra partition-based homomorphic encryption (QAPHE), which is based on the framework of quotient algebra partition (QAP) and the computation of homomorphic encryption (HE).
Fully Homomorphic Encryption (HE) is commonly known as the Holy Grail of Encryption, which is a method that permits users to perform computations on encrypted data without first decrypting it, which highly improves the security level of data processing.
In the historical perspective, the concept of HE was firstly proposed by Rivest et al. in 1978 to provide a possible solution of conducting computations with no decryption. While, all attempts of achieving fully HE were unsuccessful over 30 years until the work given by C. Gentry in 2009. In his dissertation, a technique called bootstrapping is introduced in ideal lattices to reduce the noise occurring in each step of computation, an addition of a multiplication, on encrypted data, such that it is possible to attain unlimited computations homomorphically for each function. Yet, this technique is impractical because of the need of nearly infinite resources. As a consequence, many different methods are implemented to improve the approach of HE according to Gentry's work, such as relinearization and key switching.
Current schemes of HE are built on the so-called lattice-based cryptography, a class of post-quantum cryptosystems allowing to prevent data from attacks of quantum algorithms Although a lot of HE schemes have been proposed, it is implausible to claim that they approach the fully HE. One of major observations is that with the noise occurring in every step of computation, each method of noise reduction leads to approximated solutions, not exact ones, through a recursive process. On the other hand, an exponential overhead of computation is needed to reduce noises during the process. Thus, practical fully HE may not be attained through these strategies.
The current scheme of HE design cannot conduct blind evaluations without secret disclosure. The algorithms and operators are revealed during the computation. Besides, as mentioned above, it takes an extremely high cost of computation to reduce noises during the process to avoid too many errors.
Therefore, it is an urgent problem to be solved that how to provide a method of designing one-way computational system in QAP-based HE to rewrite the fault tolerant encode into a one-way mix form.
In light of solving the foregoing problems of the prior art, the present inventive concept provides a method of designing a one-way computational system in quotient algebra partition-based homomorphic encryption (QAPHE), which is based on the framework of quotient algebra partition (QAP) and the computation of homomorphic encryption (HE), wherein a fault tolerant encode of a k-qubit arithmetic operation, M, is constructed in a quantum code [n, k, C], wherein the method comprises:
S1. decomposing a tensor-product operator, =I2
1M2, into two parts, wherein the tensor-product operator is composed of elementary gates, and let
=
1† and
2=
;
S2. providing a correction operator , wherein the correction operator is composed of elementary gates, wherein the elementary gates comprise a set of identities, and the set of identities includes Id-GateELIM, Id-GateEx and Id-GateREP;
S3. decomposing a modified encoding into two operators, W1 and W2;
S4. obtaining a modified operator by applying the operator W1 via the set of identities;
S5. deriving a merging operator via the set of identities by choosing corresponding permutations, P, P0 and P1, wherein the merging operator satisfies the nilpotent condition; and a mixed modified operator is derived from the modified operator by the set of identities and the permutation; and
S6. obtaining a one-way mixing encode by multiplying the merging operator and the mixed modified operator in the step of S5.
In an embodiment of the present inventive concept, the elementary gate comprises a spinor, a CNOT, a Toffoli Gate, a SWAP, a Controlled SWAP or a Multi-Controlled Gate.
In an embodiment of the present inventive concept, the correction operator according to the step of S2 is composed of the CNOT.
In an embodiment of the present inventive concept, the operator W1 in the step of S3 comprises the SWAP and the operator W2 is composed of the CNOT and the SWAP.
In an embodiment of the present inventive concept, the set of identities in the step of S4 is Id-GateREP.
In an embodiment of the present inventive concept, the one-way computational system designed by the method is applied to construct a public-key system in QAPHE.
In an embodiment of the present inventive concept, the step of S2 further comprises decomposing the correction operator into two components, which defines the correction operator =
1
2, wherein any component of the correction operator is composed of the CNOT.
In an embodiment of the present inventive concept, the merging operator 2
1 is obtained by the set of identities of elementary gates, and the set of identities includes Id-GateELIM and Id-GateEx.
In an embodiment of the present inventive concept, according to the step of S3, wherein the modified encoding is defined as Qen†V†=W1W2.
In an embodiment of the present inventive concept, according to the step of S4, wherein two modified operators are obtained by applying the operator W1 via the set of identities, wherein the two modified operators are W1†2
1W1 and W14†
2 W1.
In an embodiment of the present inventive concept, according to the step of S5, wherein the mixed modified operators are P1†W1†2
1W1P1 and P0†W1†
2W1P0 via the set of identities of elementary gate which is Id-GateREP.
In an embodiment of the present inventive concept, according to the step of S5, wherein the merging operator is derived as PW1P1=I2
In an embodiment of the present inventive concept, according to the step of S6, wherein the one-way mixing encode is Uen=(P1†W1†2
1W1P1)(P1†P0)(P0†W1†
2W1P0)(P0†W2)=P
Qen†V†.
In an embodiment of the present inventive concept, the one-way computational system designed by the method is applied to construct a semi-public-key system in QAPHE.
In an embodiment of the present inventive concept, the correction operator is defined as
=I2
In an embodiment of the present inventive concept, according to the step of S3, wherein the encoding is defined as QP=W1W2.
In an embodiment of the present inventive concept, according to the step of S4, wherein a modified operator W1†2 W1 is obtained by applying the operator W1 via the set of identities.
In an embodiment of the present inventive concept, according to the step of S5, the mixed modified operator is P0†W1†2 W1P0 via the set of identities of elementary gate which is Id-GateREP.
In an embodiment of the present inventive concept, according to the step of S5, wherein the merging operator is derived as PW1P0=I2
In an embodiment of the present inventive concept, according to the step of S6, wherein the one-way mixing encode is Uen=(P0†W1†2 W1P0)(P0†W2)=P
MQp†.
All the operation process in the system is conducted by invertible gates designed dedicatedly in Hilbert space. Through some theoretical derivations and numerical experiments, compared to the existing HE computation, the present invention illustrates strong advantages over current schemes of HE computation, such as providing exact solutions instead of approximated ones, conducting blind evaluations without secret disclosures, and allowing problem-dependent optimizations with modest overheads.
The present inventive concept is described by the following specific embodiments. Those with ordinary skills in the arts can readily understand other advantages and functions of the present inventive concept after reading the disclosure of this specification. Any changes or adjustments made to their relative relationships, without modifying the substantial technical contents, are also to be construed as within the range implementable by the present inventive concept.
Moreover, the word “exemplary” or “embodiment” is used herein to mean serving as an example, instance, or illustration. Any aspect or design described herein as exemplary or an embodiment is not necessarily to be construed as preferred or advantageous over other aspects or designs. Rather, use of the word “exemplary” or “embodiment” is intended to present concepts and techniques in a concrete fashion.
As used in this application, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or.” That is, unless specified otherwise or clear from context, “X employs A or B” is intended to mean any of the natural inclusive permutations. That is, if X employs A; X employs B; or X employs both A and B, then “X employs A or B” is satisfied under any of the foregoing instances. In addition, the articles “a” and “an” as used in this application and the appended claims should generally be construed to mean “one or more,” unless specified otherwise or clear from context to be directed to a singular form.
Another holy grail in the field of quantum information science is the realization of scalable fault tolerance quantum computation, which permits to protect quantum states from corruptions of errors due to computations or environments. The method of the present inventive concept is to construct fault tolerant encodes of every action in every error-correcting code. The success of this methodology is based on the framework Quotient Algebra Partition, QAP, whose partition structure is inherited by every stabilizer code. In the procedure of QAP-based Fault Tolerance Quantum Computation, QAPFTQC, a k-qubit state is encoded into an n-qubit codeword by an encoding in a QAP [n, k, C]. With an error appearing in the computation being represented by a spinor of a coset in [n, k, C], each corrupted state applied by a fault encode of this partition can be corrected by every member of the same coset. Meanwhile, it allows to design the dual process of QAPFTQC. That is, given a message state of k qubits, a k-qubit action M and a QAP [n, k, C], the encryption of message is conducted by an encoding and a random error, and the fault tolerant of M serves as the role of HE evaluation. Furthermore, the security is guaranteed by an exponential choices of errors in [n, k, C], which is post-quantum. The QAPHE is superior to current schemes of HE. In particular, since a computation is realized by rotations acting on the Hilbert space, each solution after an encoded computation is exact and requires small resources, achieving fully HE. In addition, the computation of QAPHE is blind and problem-dependently optimized because the rotations composing computation are all reversible and are admitted to mix up. Moreover, the quantum gates with one-way algorithm in the method of the present inventive concept make the scheme of QAPHE not only conductible on a quantum computer, but also achievable on a classical computer.
Please refer to
S1. decomposing a tensor-product operator, =I2
1
2, into two parts, wherein the tensor-product operator is composed of elementary gates, and let
=
1† and
2=
;
S2. providing a correction operator , wherein the correction operator is composed of elementary gates, wherein the elementary gates comprise a set of identities, and the set of identities includes Id-GateELIM, Id-GateEx and Id-GateREP;
S3. decomposing a modified encoding into two operators, W1 and W2;
S4. obtaining a modified operator by applying the operator W1 via the set of identities;
S5. deriving a merging operator via the set of identities by choosing corresponding permutations, P, P0 and P1, wherein the merging operator satisfies the nilpotent condition; and a mixed modified operator is derived from the modified operator by the set of identities and the permutation; and
S6. obtaining a one-way mixing encode by multiplying the merging operator and the mixed modified operator in the step of S5.
Please refer to
Please refer to
In an embodiment of the present inventive concept, the correction operator according to the step of S2 may be composed of the CNOT.
In an embodiment of the present inventive concept, the operator W1 in the step of S3 may comprise the SWAP and the operator W2 may be composed of the CNOT and the SWAP.
In an embodiment of the present inventive concept, the set of identities in the step of S4 may be Id-GateREP.
In an embodiment of the present inventive concept, the one-way computational system designed by the method may be applied to construct a public-key system in QAPHE.
In an embodiment of the present inventive concept applied to construct a public-key system, the step of S2 may further comprise decomposing the correction operator into two components, which defines the correction operator =
1
2, wherein any component of the correction operator may be composed of the CNOT.
In a preferred embodiment of the present inventive concept, the merging operator 2
1 may be obtained by the set of identities of elementary gates, and the set of identities may include Id-GateELIM and Id-GateEx.
In an embodiment of the present inventive concept applied to construct a public-key system, according to the step of S3, the modified encoding may be defined as Qen†V†=W1W2.
In an embodiment of the present inventive concept applied to construct a public-key system, according to the step of S4, wherein two modified operators may be obtained by applying the operator W1 via the set of identities, wherein the two modified operators may be W1†2
1W1 and W1†
2 W1.
In an embodiment of the present inventive concept applied to construct a public-key system, according to the step of S5, the mixed modified operator may be P1†W1†2
1W1P1 and P0†W1†
2W1P0 via the set of identities of elementary gates, wherein the set of identities of elementary gates may be Id-GateREP.
In an embodiment of the present inventive concept applied to construct a public-key system, according to the step of S5, wherein the merging operator may be derived as PW1P1=I2
In an embodiment of the present inventive concept applied to construct a public-key system, according to the step of S6, wherein the one-way mixing encode may be Uen=(P1†W1†2
1W1P1)(P1†P0)(P0†W1†
2W1P0)(P0†W2)=P
Qen†V†.
In an embodiment of the present inventive concept, the one-way computational system designed by the method may be applied to construct a semi-public-key system in QAPHE.
In an embodiment of the present inventive concept applied to construct a semi-public-key system, the correction operator may be defined as
=I2
In an embodiment of the present inventive concept applied to construct a semi-public-key system, according to the step of S4, wherein a modified operator W1†2W1 may be obtained by applying the operator W1 via the set of identities.
In an embodiment of the present inventive concept applied to construct a semi-public-key system, according to the step of S5, the mixed modified operator may be P0†W1†2W1P0 via the set of identities of elementary gates, wherein the set of identities of elementary gate may be Id-GateREP.
In an embodiment of the present inventive concept applied to construct a semi-public-key system, according to the step of S5, wherein the merging operator may be derived as PW1P0=I2
In an embodiment of the present inventive concept applied to construct a semi-public-key system, according to the step of S6, wherein the one-way mixing encode may be Uen=(P0†W1†2W1P0) (P0†W2)=P
MQp†.
Please refer to
According to the present inventive concept, a stabilizer code [n, k, C] with a stabilizer C⊂su(2n) is a quotient algebra partition {Q(C)}. The quotient algebra partition is generated by the k-th maximal bi-subalgebra C=
[k] of a Cartan subalgebra in su(2n). Specifically, there exists an isomorphism between the stabilizer C of [n, k, C] under the multiplication and the k-th maximal bi-subalgebra
[k], i.e. C=
[k]. Therefore, the stabilizer code [n, k, C] inherits the partition structure from the QAP {
Q(C)}. There is a duality between the n-qubit encrypted state in the Hilbert space and the partition structure [n, k, C] have duality, which verifies the orthogonality connecting spinors and the codewords. A significant concept of the coset spinor is illustrated in the QAP structure, which implies the n-s condition for the error-correctability in a QAP.
In the partition structure [n, k, C], an error set ε is correctable iff two arbitrary spinors of ε are either in different blocks or in a same coset of a block within this partition structure. Besides, there are two implications of the concept of the coset spinor, the correction equivalence and the code degeneracy. The former one indicates that an error may be corrected by any operator in the same coset and the latter one expresses that a correctable error set allows spinors in a same coset, thereby obtaining two immediate results. One is that if there is no spinor of the error set, ε, in the subspace, Γ0−C, [n, k, C] may detect the error set ε; and the other one is that if two errors exist in different cosets of the same block, then the two errors in [n, k, C] are not correctable. Consequently, the n−s condition for the error-correctability is affirmed.
The partition structure [n, k, C] is regarded as a quantum version of the classical Hamming code [n, k]. For every classical linear code, [n, k], there exists an only partition structure [n, k, C] determined by the code. For every partition structure [n, k, C], there exists an only symplectic linear code [2n, n+k] determined by the partition structure. In the partition structure [n, k, C], it requires an encoding built by the partition structure in the intrinsic coordinate to encode a k-qubit state into an n-qubit codeword.
In the partition structure [n, k, C], an encoding Qen∈SU(2n) is an n-qubit spinor-to-spinor mapping transforming [n, k, C] into an intrinsic coordinate [n, k, Ĉ] generated by the intrinsic bi-subalgebra Ĉ={S0ζ⊗S00: ζ∈Z2n-k}=Qen\CQen. In the intrinsic coordinate, the partition structure [n, k, Ĉ] is generated by the intrinsic bi-subalgebra Ĉ={S0ζ⊗s00: ζ∈Z2n-k} that is the k-th maximal bi-subalgebra of the intrinsic Cartan subalgebra, [0]. In this partition structure, cosets of a block,
=∪μ∈Z
, may be in the form of
={
⊗
: ζ∈Z2n-k}. In fact, an encoding Qen is a QAP-preserving spinor-to-spinor transformation mapping the partition structure [n, k, C] into the intrinsic [n, k, Ĉ]. In the partition structure [n, k, C], each fault tolerant encode, U∈SU(2n), requires meeting two standards, the eigen-invariance of SU|ψ
=U|ψ
for each spinor S∈C and each codeword, |ψ
and the error-correction against an error set ε wherein USβ|ψ
=Σα∈Z
in each coset Wα,v from each block, Γα, v∈Z22k and Sβ∈ε.
To correct an error set ε⊂su(2n) with an encoding Qen∈SU(2n) in the partition structure [n, k, C], a fault tolerant encode of the k-qubit operator M∈SU(2k) may be denoted as the form, Uen=QenQen†, where
is a tensor product of M and the (n−k)-qubit identity I2
=I2
∈SU(2n) is an operator of input coset associated with ε,
∈SU(2n) is an operation of an output coset and
∈SU(2n) is a transfer amplitude.
Quantum Circuit
Basic arithmetic, such as addition and multiplication, are illustrated in the following details of quantum circuit.
Every finite field Fq=Fpm is composed of elements q=pm for a prime number p and a positive integer m. The finite field is isomorphic to the quotient ring Zp[x]/ƒ(x) of a polynomial ring Zp [x] and an irreducible polynomial function ƒ(x) of degree m.
Currently, major post-quantum cryptosystems, such as lattice-based code system, code-based system and multivariate-based system, are described by polynomial rings, rather than linear operations. The QAP structure may be composed of operatees dual to states of a Hilbert space and allows applications of invertible linear transformations to these states inherently. This reveals essential differences between the solution of QAP-based HE and that based on a polynomial ring.
A quantum circuit exists to perform an addition Σi=1Nmi of a number N of 1-bit message mi∈Z2l. For the addition of two 1-bit numbers, there is a more effective space-time implementation. For example, build a circuit with its linear size of O(l) in depth O(l) with O(l) ancilla qubit. Then, provide a circuit with its size of O(l) in logarithmic depth O(log l) with O(l/log l) ancilla qubit.
A quantum circuit exists to conduct a multiplication of two 1-bit numbers, which permits the circuit design of multiplying two numbers with lower cost. For example, the Karatsuba-based multiplication requires a circuit size O(llog
Construction of Public-Key Scheme
The solution based on the QAPHE in a public key system is illustrated as follows.
The scheme of QAPHE is a dual process of QAP-based Fault Tolerance Quantum Computation, QAPFTQC. Assuming that a number of N of plaintexts, {xi∈Z2k
Three stages of a QAPHE over [n, k, C] are illustrated as follows, i.e., the encryption, the computation, and the decryption. In the stage of encryption, a message is going to be encoded by the public key. Every partition structure [n, k, C] makes the encrypted public key, Keypub, transform a k-qubit plaintext into n-qubit ciphertext. In the partition structure [n, k, C]. The cost of encryption via a public key Keypub has an upper bound O(n2). The complexity of breaking the encryption via the public key Keypub has a lower bound O(2L) and an upper bound O(22n), where δ<L≤n−k, and δ is a postquantum security level.
A k-qubit encoded state |x is transformed to an n-qubit codeword |ψen
by a given public key Keypub in a partition structure, where |ψen
=ĒVQen|0
⊗|x
, x∈Z2k. The homomorphic computation of a k-qubit computation M|x
with an action M is realized by the fault tolerant encode Uen, where M∈SU(2k).
U
en
=P
Q
en
†
V
†
=(PW1P1)(P1†W1†1W1P1)(P1†P0)(P0†W1†
2W1P0)(P0†W2) Eq. 1
In the above Eq. 1, =I2
=
1
2 is factorized into two operators
1 and
2∈SU(2n). Qen†V†, a product of two operators, W1 and W2∈SU(2n), may be written as Qen†V†=W1W2. The four operators
, P, P1 and P0∈SU(2n) are chosen to mix up the encoded and PW1P1=I2n.
The practical application of Uen is performed by the mixed composition of 2nd line of Eq. 1. Specifically, each of , P, P1 and P0 is a composition of spinor-to-spinor s-rotations. Initially, the correction operator
=
1
2 is written as a product of two unitary actions,
1 and
2. The operator
is chosen to mix up the composition
1. By factorizing Qen†V† into two actions, W1 and W2, let the operator W1 be conducted as in the 2nd line of Eq. 1 and W2 stays. The two unitary actions P1 and P0 are inserted into the components of Eq. 1 to further mingle quantum gates. P0†W1†
2 W1P0 is a modified action of
2 by absorbing the spinor-to-spinor operation W1P0. Similarly, P1†W1†
1W1P1 is a modified action of
1 by absorbing the spinor-to-spinor operation W1P1.
It is worthy to note that the computation of Uen admits optimized design according to the problem-dependent operation M.
The cost of encoding and the security of encryption will be shown as follows. In a partition structure [n, k, C], the cost of a homomorphic computation given by a public key has the upper bound O(np) for an integer p∈N and the complexity of breaking the encryption via the public key Keypub has a lower bound O(2L).
The decryption of an encoded computation Uen|ψ is accomplished by the operation of a private key. In the present inventive concept, a fault tolerant encode Uen=P
Qen†V†∈SU(2n) of a k-qubit arithmetic operation, M∈SU(2k), and an n-qubit state |ψen
=ĒVQen|0
⊗|x
encoded by the public key Keypub are given.
=I2
is decrypted to M|x
via the private key Keypriv=
\P\.
Notice that the scheme of public-key can be extended to the model of multi-party homomorphic encryption by appropriately increasing the numbers of data receivers, date providers, public keys, and computation providers.
Construction of Semi-Public-Key Scheme
The semi-public key scheme based on a QAPHE is illustrated in detail, which is almost the same as the public-key scheme except that a small resource of communication are allowed in the semi-public key scheme between the data receiver and data owner.
A k-qubit plaintext is encoded into a k-qubit cyphertext via the semi-public key Keys-pub. The cost of encoding a k-qubit state via the semi-public key Keys-pub is O(k). The encryption of a k-qubit plaintext through a semi-public key is more efficient than that of the same plaintext via a public key because it is not necessary to add a random error in the semi-public key scheme. The complexity of breaking the encryption by a semi-public key Keys-pub is identical to that of finding the encoding operation from the encrypted message of this operation. It allows a very high level of post-quantum security with the cryptosystem chosen for Qp, the semi-public-key scheme is more secure than the public-key scheme.
An encoding operator Qp∈SU(2k) generated by a k-qubit semi-public key Keys-pub. The homomorphic computation of a k-qubit evaluation conducted by an arithmetic operation M∈SU(2k) is realized by a fault tolerant encode Uen.
U
en
=P
MQ
p
\
=(P0\W1\MW1P0)(P0†W2) Eq. 2
where Qp† is a product of two operators W1 and W2∈SU(2k) and can be written as Qp†=W1W2. The three operators , P and P0∈SU(2n) are used to mix up the encode and PW1P0=I2
1=
2=I2
The cost of a homomorphic computation by a semi-public key of k qubits has the upper bound O(kt) for an integer t∈N. An overhead of error-correction is no need in the semi-public-key scheme, which implies a computational cost lower than that in the public-key setting. The complexity of breaking a homomorphic computation by a semi-public key of k qubits is limited by v(k)=(ke/(r−d))r-d+k2d, d, e and r∈N.
An encoded operation Uen=PM
Qp†∈SU(2n) of a k-qubit arithmetic operation M∈SU(2k) and n k-qubit state |ψen
=Qp|x
encoded by a semi-public key Keys-pub are given. The homomorphic computation Uen|ψed
is decrypted to M|x
by the private key Keypriv=
\P\.
Similar to the public-key scheme, the concept of multi-party is applicable to the semi-public-key by increasing the numbers of data receivers, data providers, and computation providers, where a single semi-public key is adopted to produce multiple encoding operators for multiple users.
The following illustrates that the feature “every partition structure [n, k, C] makes the encrypted public key, Keypub, transform a k-qubit plaintext into n-qubit ciphertext. In the partition structure [n, k, C]” of the present inventive concept is feasible. Various types of designs of public-key encryptions are permitted in the framework of QAP according to distinct difficult problems. In the following, two designs of encryptions are demonstrated.
In a partition structure [n, k, C] with an encoding Qen, it allows a public key of encryption consisting of an operation VQen and an error generator Gen(
Keypub(1)=(VQen,Gen(
Supposed that a number of 1-qubit message xi∈Z2l is N, an l0-qubit blank state |x0 is expressed into a k-qubit basis state by k=l0+lN, which is |x
=|x1
⊗|x2
. . . |xN
⊗|x
. The form of the encoded state is |ψen
=ĒVQen|0
⊗|x
by writing the tensor product state |0
⊗|x
for the n−k qubit basic state |0
.
The cost of encoding a plaintext x to the ciphertext |ψen equals |V∥Qen|+1, where |V|˜O(nk) and |Qen|˜O(n(n−k)) are the numbers of 1- and 2-qubit s-rotations, respectively, in V and Qen, and the number 1 is counted with the application of Ē.
The complexity of breaking the encryption by the public key Keypub(1) is the number of the steps to find the error Ē=(=ĒVQen|0
⊗|x
, where ϵr∈Z2 and 1≤r≤J. A brute force attack leads to the upper bound 2J, hich is the number of all possibilities of the J-bits ϵr. On the other hand, the cost of finding Ē is equivalent to that of the problem of searching the representation of Ē in terms of spinors in a subset SG={
In the known cryptosystem in code-based cryptography, the Muceliece cryptosystem, adopts a Goppa code [n, k] to corrects errors of weight
In this system, given a public key Ĝ∈Z2k×n,t, a message x∈Z2k is encrypted to a cyphertext c=xĜ+e by multiplying Ĝ and adding a randomly chosen error e of weight t. Through a generic attack called information-set decoding, the complexity of restoring x from c is approximately yn/log n, y=(1−k/n)1-k/n.
In a partition structure [n, k, C] with an encoding Qen, a public key of encryption is allowed to be composed of the operation VQen and an error generator Gen(R1, R2; J), where V∈SU(2n) is s spinor-to-spinor transformation. Gen(R1,R2;J) can generate an error Ē=Sγξ∈su(2n) randomly that is a solution of two sets of relations Rq=1,2={ξ·ζq,uq⊂su(2n) sizing 2J
=
1∩
2 forms a bi-subalgebra of size 2J, J<Jq. The public key is written as Eq. 4.
Keypub(2)=(VQen,Gen(R1,R2;J)) Eq. 4
The cost of encoding a plaintext x to the ciphertext |ψen equals |V∥Qen|+1, where |V|˜O(nk) and |Qen|˜O(n(n−k)) are the numbers of 1- and 2-qubit s-rotations, respectively, in V and Qen, and the number 1 is counted with the application of Ē. The complexity of the security of this encryption is the number of the steps to solve the group intersection problem, which has a lower bound O(2j)/2) and an upper bound O(2J).
The present inventive concept illustrates a one-way algorithm based on QAPHE, which may rewrite the original form of the fault tolerant operation Uen=PQen†V† into a one-way mix form and be applied to the algorithm with the public-key scheme and the semi-public key scheme based on QAPHE. Briefly, because the computation may be constructed by well-designed and invertible elementary gates on the Hilbert Space, the computation provides the exact answer and naturally achieves fully HE according to the method provided by the present inventive concept. The ongoing computation can be hidden by the merge and exchange among the elementary gates, which enhances the security level of information processing and allows problem-dependent optimizations with modest overheads. Moreover, the quantum gates with one-way algorithm in the method of the present inventive concept make the scheme of QAPHE not only conductible on a quantum computer, but also achievable on a classical computer.
The foregoing descriptions of the detailed embodiments are only illustrated to disclose the features and functions of the present inventive concept and not restrictive of the scope of the present inventive concept. It should be understood to those in the art that all modifications and variations according to the spirit and principle in the disclosure of the present inventive concept should fall within the scope of the appended claims.
The present application claims the priority of U.S. Provisional Patent Application No. 63/288,536 filed on Dec. 11, 2021, the disclosure of which is hereby incorporated by reference herein in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 63288536 | Dec 2021 | US |
