Should practical quantum computing become a reality, I am wondering if there are any public key cryptographic algorithms that are based on NP-complete problems, rather than integer factorization or discrete logarithms.
Edit:
Please check out the “Quantum computing in computational complexity theory” section of
the wiki article on quantum computers. It points out that the class of problems quantum computers can answer (BQP) is believed to be strictly easier than NP-complete.
Edit 2:
‘Based on NP-complete’ is a bad way of expressing what I’m interested in.
What I intended to ask is for a Public Key encryption algorithm with the property that any method for breaking the encryption can also be used to break the underlying NP-complete problem. This means breaking the encryption proves P=NP.
I am responding to this old thread because it is a very common and important question, and all of the answers here are inaccurate.
The short answer to the original question is an unequivocal “NO”. There are no known encryption schemes (let alone public-key ones) that are based on an NP-complete problem (and hence all of them, under polynomial-time reductions). Some are “closer” that others, though, so let me elaborate.
There is a lot to clarify here, so let’s start with the meaning of “based on an NP-complete problem.” The generally agreed upon interpretation of this is: “can be proven secure in a particular formal model, assuming that no polynomial-time algorithms exist for NP-complete problems”. To be even more precise, we assume that no algorithm exists that always solves an NP-complete problem. This is a very safe assumption, because that’s a really hard thing for an algorithm to do – it’s seemingly a lot easier to come up with an algorithm that solves random instances of the problem with good probability.
No encryption schemes have such a proof, though. If you look at the literature, with very few exceptions (see below), the security theorems read like the following:
Note the “random instances” part. For a concrete example, we might assume that no polynomial-time algorithm exists for factoring the product of two random n-bit primes with some good probability. This is very different (less safe) from assuming that no polynomial-time algorithm exists for always factoring all products of two random n-bit primes.
The “random instances” versus “worst case instances” issue is what is tripped up several responders above. The McEliece-type encryption schemes are based on a very special random version of decoding linear codes – and not on the actual worst-case version which is NP-complete.
Pushing beyond this “random instances” issue has required some deep and beautiful research in theoretical computer science. Starting with the work of Miklós Ajtai, we have found cryptographic algorithms where the security assumption is a “worst case” (safer) assumption instead of a random case one. Unfortunately, the worst case assumptions are for problems that are not known to be NP complete, and some theoretical evidence suggests that we can’t adapt them to use NP-complete problems. For the interested, look up “lattice based cryptography”.