P vs NP and Quantum Computation Sandy Kutin

P vs. NP and Quantum Computation Sandy Kutin CSPP 532 8/21/01

Overview z. We’ll define some classes of problems y. P: Polynomial time (quick calculations) y. NP: Search problems (most crypt problems) y. NP-complete: The hardest search problems z. We’ll discuss a little bit about quantum computation: y. Why it may one day break RSA y. How we could design a system which quantum computers can’t break (we think)

Computability Theory z. What is a “computer”, and what can it do? z 1936: Alan Turing defines Turing Machine y. Idealized computer: internal state, I/O tape z 1936: Church-Turing thesis: Any “reasonable” computing device is the same z. Focus was on computability of a function: y. Is there a Turing machine which computes the function, and never gets stuck in a loop?

Complexity Theory z. Pre-1960 s: “Can it be done? ” z. Now: “How much work does it take? ” z. Measurements of algorithmic complexity y. Time complexity: how many steps y. Space complexity: how much memory z. Example: find a collision in an n-bit hash: y. Brute-force: 2 n steps, constant memory y. Birthday: roughly 2 n/2 steps, 2 n/2 memory

P z. Cobham, ‘ 64; Edmonds, ‘ 65: P = decision problems computable in polynomial time z. Decision problem: yes/no answer z. Polynomial time: number of steps a Turing Machine takes is < nd, where n is the length of the input (in bits), d = degree z. Different definitions of “Turing Machine”, “step”, but polynomial time doesn’t change y. Example: Euclid’s algorithm takes 2 n steps, or 2 n 3 bit operations; both polynomial

Rates of Growth Solvable problem size as a function of time Moore’s Law: Computer speed doubles every 18 months So “ 1000 years” today could be 1 day in 2029

Problems in P z. Input: A, B. Output: is gcd(A, B) = 1? z. Input: A, N. Output: does A divide N? z. Input: A, N. Output: is A a Miller-Rabin witness to N being composite? z. Decryption (if DK is polynomial-time) y. Input: ciphertext C, key K. y. Output: is there ASCII text M, so EK(M) = C? y. Algorithm: let M = DK(C), see if it’s ASCII x(i. e. , see if each byte in M is printable ASCII)

Graph 2 -colorability z. A graph has n vertices; edges go between z. Adjacent vertices must get different colors z. Input: graph. Output: Is it 2 -colorable? Yes No

Exponential time z. Some problems take more than polynomial time (we think) y. Input: N. Output: Is N composite? y. Input: N, K. Output: Does N have a factor less than K? y. Input: Ciphertext C. Output: Is there a key K and an ASCII message M so EK(M) = C? z. EXP is the class of decision problems which take exponential time to solve z. But: we can be more precise

NP z. Informally, NP means “search problems” z. Two formal characterizations z#1: Non-deterministic polynomial time y. Machine starts by making all possible guesses y. Works on each simultaneously (polynomial time) y. If any “computation path” (guess) produces a “yes” answer, output “yes” y. Otherwise, output “no”

Example: Is N composite? z Our initial “guess” is a 589 possible factor F z We check to see if 2 3 5 7 9 11 13 15 17 19 21 23 each F divides N; this takes polynomial time NN N N N Y N N z If any F divides N, then “N is composite” z Also solves: Does N have a factor less than K? z Could be lots of guesses, very few leading to “Yes”; that’s fine

More NP examples z. Could do Miller-Rabin for “Is N composite? ” y. Guess is a number A < N y. Computation: is A a Miller-Rabin witness? y. If there’s a witness, answer “Yes”. If not, “No”. z. Another example: Decryption problem y. Input: Ciphertext C. Output: Is there a key K and an ASCII message M so EK(M) = C? y. Guess is a possible key K y. Computation: is DK(C) an ASCII message?

Another characterization z. A problem in P looks like: f(x) = 1? yf(x) is polynomial-time in the length of x z. A problem in NP is: ( y)(f(x, y) = 1) ? y. In words: does there exist a number y such that f(x, y) is 1? (We’re “searching” for y. ) yy is the proof, or witness; polynomial-size in x yy corresponds to the non-deterministic “guess” y. Again, f(x, y) is polynomial-time y. Polynomial-time verifiable proof

P = NP ? z. Intuitively: P is the class of “easy” problems, NP the class of “hard” problems z. Conjecture (Edmonds, 1965)? P ≠ NP z. Nobody knows NP COMP P FACT

NP-completeness z(Cook, 1971) A problem is NP-complete if: y. It’s in NP, and it’s as hard as anything in NP z. Cook-Levin Theorem: uses “reduction” idea z. Example (Karp, 1972): graph 3 -colorability No Yes ?

Quantum Computation z. Quantum mechanics: y. If you send a photon through a polarizer, it’s half in one orientation, half in another y. Combine n photons: you’re simultaneously in 2 n states (this is called a superposition) y. The system collapses when you measure it z. Weird idea (Feynman, 1982): y. This is kind of like non-determinism y. Maybe we could build a “quantum computer”

Quantum Cats z Two cats in a box z Based on a photon, one is released z Quantum cat is a superposition of cats z See a tail – superposition of tails z Look at face; collapse into one classical cat Elwood and Jake

What’s a qubit? z Unit of computation: 589 quantum bit, or qubit z Enter superposition 2 3 5 7 9 11 13 15 17 19 21 23 z Do computation “in alternate universes” NN N N N Y N N z If we just measure, this is probabilistic; chance of success may be small z If we can use quantum interference, we can increase chance of observing the right answer

Quantum Computers: Theory z. QP = class of problems solvable in polynomial time by a quantum computer y. Could we actually build a quantum computer? y. Are any interesting problems in QP, but not P? z. Grover (1996): n-bit search in 2 n/2 y. Nice, but still exponential time z. Shor (1994): factoring, discrete log in QP z. A quantum computer could break RSA z. We still have a long way to go to build one

Complexity (we think) NP-complete NP COMP FACT P QP z. Usual assumption: P smaller than QP, which is smaller than NP z. Many people believe “Is N composite? ” is in P; most believe factoring is not in P

The Future of Cryptography z. Can we design a cryptosystem based on an NP-complete problem? y. As secure as it can be; quantum won’t work y. Problem: 3 -colorability is hard in the worst-case y. We need average-case hardness; we want to generate graphs so 3 -colorings are hard to find y. This is an active area of research z. Quantum Key Exchange (1984) y. Eve can’t listen without being detected, by Heisenberg’s Uncertainty Principle