2 ms·

The main basis for the computation seems to be this: "The paper notes: “The main difficulty is that the coherence time of physical qubits is finite. Noise in t

by Bud 10y ago

The main basis for the computation seems to be this: "The paper notes: “The main difficulty is that the coherence time of physical qubits is finite. Noise in the physical system will eventually corrupt the state of any long computation.”" However, just yesterday, I read that new research had once again lengthened the qubit coherence time, this time by a factor of ten. A little quick googling reveals that this time is growing. Rapidly.

acqq 10y ago
https://eprint.iacr.org/2016/992.pdf https://eprint.iacr.org/2016/992.pdf "While our cost model ties us to a particular quantum architecture, we segment our analysis into several layers so that the impact of a different assumptions at any particular level can be readily evaluated." "Our estimates are by no means a lower bound, as they are based on a series of assumptions. First, we optimized our T-count by optimizing each component of the SHA oracle individually, which of course is not optimal. Dedicated optimization schemes may achieve better results. Second, we considered a surface code fault-tolerant implementation, as such a scheme looks the most promising at present. However it may be the case that other quantum error correcting schemes perform better. Finally, we considered an optimistic per-gate error rate of about 10^5, which is the limit of current quantum hardware. This number will probably be improved in the future. Improving any of the issues listed above will certainly result in a better estimate and a lower number of operations, however the decrease in the number of bits of security will likely be limited." Which remains huge for these hashes. In short: "Diffie-Hellman key exchange, RSA encryption, and RSA signatures will all need to be replaced before quantum computers are available. The situation is less dire for hash functions and symmetric ciphers."

by Bud 10y ago

acqq 10y ago

https://eprint.iacr.org/2016/992.pdf https://eprint.iacr.org/2016/992.pdf "While our cost model ties us to a particular quantum architecture, we segment our analysis into several layers so that the impact of a different assumptions at any particular level can be readily evaluated." "Our estimates are by no means a lower bound, as they are based on a series of assumptions. First, we optimized our T-count by optimizing each component of the SHA oracle individually, which of course is not optimal. Dedicated optimization schemes may achieve better results. Second, we considered a surface code fault-tolerant implementation, as such a scheme looks the most promising at present. However it may be the case that other quantum error correcting schemes perform better. Finally, we considered an optimistic per-gate error rate of about 10^5, which is the limit of current quantum hardware. This number will probably be improved in the future. Improving any of the issues listed above will certainly result in a better estimate and a lower number of operations, however the decrease in the number of bits of security will likely be limited." Which remains huge for these hashes. In short: "Diffie-Hellman key exchange, RSA encryption, and RSA signatures will all need to be replaced before quantum computers are available. The situation is less dire for hash functions and symmetric ciphers."