The Power of Few Qubits and Collisions – Subset Sum Below Grover’s Bound

Abstract

Let (Formula Presented) be a solvable subset sum instance, i.e. there exists a subset of the (Formula Presented) that sums to t. Such a subset can be found with Grover search in time (Formula Presented), the square root of the search space, using only (Formula Presented) qubits. The only quantum algorithms that beat Grover’s square root bound – such as the Left-Right-Split algorithm of Brassard, Hoyer, Tapp – either use an exponential amount of qubits or an exponential amount of expensive classical memory with quantum random access (QRAM). We propose the first subset sum quantum algorithms that breaks the square root Grover bound with linear many qubits and without QRAM. Building on the representation technique and the quantum collision finding algorithm from Chailloux, Naya-Plasencia and Schrottenloher (CNS), we obtain a quantum algorithm with time 20.48n. Using the Schroeppel-Shamir list construction technique, we further improve downto run time 20.43n. The price that we have to pay for beating the square root bound is that as opposed to Grover search our algorithms require classical memory, but no QRAM, i.e. we get a time/memory/qubit tradeoff. Thus, our algorithms have to be compared to purely classical time/memory subset sum trade-offs such as those of Howgrave-Graham and Joux. Our quantum algorithms improve on these purely classical algorithms for all memory complexities (Formula Presented). As an example, for memory (Formula Presented) we obtain run time 20.47n as opposed to 20.63n for the best classical algorithm.