Quantum algorithms ( CO 781 , Winter 2008 )

The subgroups of DN are either cyclic or dihedral. The possible cyclic subgroups are of the form 〈(x, 0)〉 where x ∈ ZN is either 0 or some divisor of N . The possible dihedral subgroups are of the form 〈(y, 1)〉 where y ∈ ZN , and of the form 〈(x, 0), (y, 1)〉 where x ∈ ZN is some divisor of N and y ∈ Zx. A result of Ettinger and Høyer reduces the general dihedral HSP, in which the hidden subgroup could be any of these possibilities, to the dihedral HSP with the promise that the hidden subgroup is of the form 〈(y, 1)〉 = {(0, 0), (y, 1)}, i.e., a subgroup of order 2 generated by the reflection (y, 1). The basic idea of the Ettinger-Høyer reduction is as follows. Suppose that f : DN → S hides a subgroup H = 〈(x, 0), (y, 1)〉. Then we can consider the function f restricted to elements from the abelian group ZN × {0} ≤ DN . This restricted function hides the subgroup 〈(x, 0)〉, and since the restricted group is abelian, we can find x efficiently using Shor’s algorithm. Now 〈(x, 0)〉EDN (since (z, a)(x, 0)(z, a)−1 = (z+(−1)ax, a)(−(−1)az, a) = ((−1)ax, 0) ∈ ZN×{0}), so we can define the quotient group DN/〈(x, 0)〉. But this is simply a dihedral group (of order N/x), and if we now define a function f ′ as f evaluated on some coset representative, it hides the subgroup 〈(y, 1)〉. Thus, in the rest of this lecture, we will assume that the hidden subgroup is of the form 〈(y, 1)〉 for some y ∈ ZN without loss of generality.