Strengths and weaknesses of quantum computing

Recently a great deal of attention has been focused on quantum computation following a sequence of results [Bernstein and Vazirani, in Proc. 25th Annual ACM Symposium Theory Comput., 1993, pp. 11-20, SIAM J. Comput., 26 (1997), pp. 1411-1473], [Simon, in Proc. 35th Annual IEEE Symposium Foundations Comput. Sci., 1994, pp. 116-123, SIAM J. Comput., 26 (1997), pp. 1474-1483], [Shor, in Proc. 35th Annual IEEE Symposium Foundations Comput. Sci., 1994, pp. 124-134] suggesting that quantum computers are more powerful than classical probabilistic computers. Following Shor's result that factoring and the extraction of discrete logarithms are both solvable in quantum polynomial time, it is natural to ask whether all of NP can be efficiently solved in quantum polynomial time. In this paper, we address this question by proving that relative to an oracle chosen uniformly at random with probability 1 the class NP cannot be solved on a quantum Turing machine (QTM) in time o(2n/2). We also show that relative to a permutation oracle chosen uniformly at random with probability 1 the class NP ∩ co-NP cannot be solved on a QTM in time o(2n/3). The former bound is tight since recent work of Grover [in Proc. 28th Annual ACM Symposium Theory Comput., 1996] shows how to accept the class NP relative to any oracle on a quantum computer in time O(2n/2).