An efficient quantum algorithm for computing $S$-units and its applications

2025-10-02

AI Summary

This work addresses the quantum computational hardness of computing the $S$-unit group in algebraic number theory, presenting the first polynomial-time quantum algorithm with a rigorous correctness proof. The method unifies quantum computation of the class group, $S$-class group, unit group, and ray class group, while also solving principal ideal testing, norm equation solving, and ideal class decomposition. Its key contributions are threefold: (i) the first complete correctness verification of the Biasse–Song algorithm; (ii) systematic reductions of multiple classical intractable problems—including principal ideal testing and norm equations—to $S$-unit group computation; and (iii) a novel synthesis of ideal decomposition theory and lattice-based cryptanalysis techniques, yielding a new paradigm for constructing short generators and “moderately short vectors” in ideal lattices. The results directly enable post-quantum cryptographic cryptanalysis and substantially broaden the applicability of quantum algorithms in algebraic number theory.

Technology Category

• Machine Learning: Quantum Machine Learning
• Search and Optimization: Non-convex Optimization
• Constraint Satisfaction and Optimization: Satisfiability

Application Category

• Security and Privacy: Applications of cryptography
• Web Mining and Content Analysis: Web data quality in the era of algorithmically-generated content
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for incomplete, noisy, or partially observed Web-related graphs

Abstract

In this paper, we provide details on the proofs of the quantum polynomial time algorithm of Biasse and Song (SODA 16) for computing the $S$-unit group of a number field. This algorithm directly implies polynomial time methods to calculate class groups, S-class groups, relative class group and the unit group, ray class groups, solve the principal ideal problem, solve certain norm equations, and decompose ideal classes in the ideal class group. Additionally, combined with a result of Cramer, Ducas, Peikert and Regev (Eurocrypt 2016), the resolution of the principal ideal problem allows one to find short generators of a principal ideal. Likewise, methods due to Cramer, Ducas and Wesolowski (Eurocrypt 2017) use the resolution of the principal ideal problem and the decomposition of ideal classes to find so-called ``mildly short vectors''in ideal lattices of cyclotomic fields.

Problem

• Computing S-unit groups in number fields efficiently
• Solving principal ideal problems and norm equations
• Finding short generators and vectors in ideal lattices

Innovation

• Quantum polynomial time algorithm for S-unit computation
• Principal ideal problem resolution enables short generator discovery
• Ideal class decomposition finds mildly short lattice vectors