First-hand information for everyone
Main discovery This compendium presents a structured collection of computational problems that have credible prospects for realizing meaningful quantum advantage. It emphasizes problem characteristics rather than particular algorithms. It is intended for non‑quantum researchers and practitioners with strong computational backgrounds. (F1, F17)
Scope and key definition The work restricts attention to offline, non‑relativized time complexity. It focuses on super‑quadratic speedups. A super‑quadratic speedup means the best known classical cost grows faster than the square of the corresponding quantum cost (up to qualifications such as logarithmic factors). Quadratic speedups (e.g., reducing cost from N to √N) are outside the scope. (F2)
Structure and how to read it Entries are organized with Stage II (concrete instances exhibiting advantage) presented before Stage I (primitives with evidence for advantage). Stage II requires both hard classical instances and a quantum algorithm that gives a super‑quadratic speedup on those instances or a clear method to generate hard instances. (F3)
What is excluded Oracle‑based separations and other results that rely on oracles with no known efficient instantiation are excluded. The compendium focuses on problems whose assumptions are concrete enough to support searches for practical instances. (F4)
How evidence is handled Entries emphasize the structural constraints that real‑world instances must satisfy to realize an advantage. They distinguish worst‑case asymptotic complexity from average‑case or promise‑problem results. The work flags when an asymptotic speedup is practically relevant by discussing I/O, state preparation, and output extraction. (F5)
Algorithms vs heuristics The compendium distinguishes algorithms (procedures with performance guarantees) from heuristics (empirical procedures without general guarantees). Heuristics are included only when quantum and classical procedures can be compared under clearly specified and commensurate criteria for solution quality, success probability, instance distribution, and computational cost. (F7)
Concrete comparisons reported - Integer factoring: Best known classical algorithms (quadratic sieve and the general number field sieve) are heuristic subexponential in log N. Shor’s quantum algorithm runs in time polynomial in log N. This yields a superpolynomial separation versus the classical state of the art in the cryptanalytic semiprime regime relevant to RSA‑style targets. (F8, F9)
- Discrete logarithm: For finite fields, classical index‑calculus methods are subexponential in log q, while Shor’s algorithm is polynomial in log q. For elliptic‑curve discrete logarithm, classical attacks remain Pollard‑type with roughly square‑root complexity in subgroup size, whereas Shor’s algorithm is polynomial‑time—producing a particularly clear separation in the elliptic‑curve setting. (F10)
- Pell’s equation / regulator computations: Best classical approaches are subexponential in the discriminant and thus superpolynomial in input length in many formulations. Hallgren’s quantum algorithm computes the regulator in time polynomial in log d, giving a polynomial‑time quantum procedure versus classical superpolynomial methods (under standard problem formulations). (F11)
- Point counting on algebraic curves: Classical algorithms can be polynomial in log q when genus g is fixed. Kedlaya proposed a quantum algorithm that computes the zeta function in time polynomial in both g and log q. A meaningful quantum separation arises in regimes where both genus and log q grow with input size. Kedlaya’s approach represents the Jacobian as a finite Abelian black‑box group and uses quantum Abelian‑group algorithms to determine orders from which the zeta function is reconstructed. (F12, F13)
- Exponential congruences af^x + bg^y = c over F_q: Current classical worst‑case upper bounds are about q^{3/4+o(1)} (with improved bounds for almost all c). Van Dam and Shparlinski combined Shor’s discrete‑logarithm algorithm with Grover search and character‑sum bounds to obtain a quantum worst‑case runtime bound of approximately q^{3/8}(log q)^{O(1)} in the regimes analyzed. (F14)
Important caveats and limitations An asymptotic quantum speedup does not by itself imply a practical finite‑size advantage. Constant factors and algorithmic overheads (e.g., state preparation, oracle construction, data encoding, and measurement) can affect the crossover point. Implementation and system costs (e.g., I/O, error correction, compilation, hardware clock rates, and parallel classical computation) can further determine or prevent a practical advantage. Large algorithmic speedups can be negated when I/O or data‑loading costs dominate. (F6, F18)
Moving classical baselines Speedup claims are relative to the best‑known classical algorithms at the time of writing. These classical baselines are moving targets. Comparisons with the state of the art should not be interpreted as unconditional classical lower bounds unless explicitly stated. (F15)