Quantum complexity of LWE

Question

As per my understanding, LWE is quantum secure because there is no known quantum algorithm to solve LWE in polynomial time. Due to the reductions given by Regev et al., if there is any algorithm that solves LWE in polynomial time, it will imply that one can solve worst-case lattice problems easily.

My question is: if someone discovers a poly-LWE solver tomorrow, what will be its implication on complexity theory? Is there any analog in classical complexity theory to the quantum setting? To elaborate further, we don't know yet where the factorization problem belongs in complexity classes. So, even if someone discovers a poly-fact algorithm tomorrow, it won't affect our current understanding of complexity classes.

Does this mean we can expect that a poly-fact algorithm is possible which will be true for LWE problems too?

Answer 1

We already know that $P$ $ \subseteq $ $BPP$ $\subseteq $ $BQP$. So, since the problems involved in the reductions are "hard", at first glance, such a LWE solver might have some impact on the following famous questions:

1. Is $P$ equal to $NP$?
2. Is $NP$ contained in $BQP$ ?

But analyzing it more carefully, we see that the first one is not really related to that setting, because, by Regev's results, given a quantum algorithm to LWE, we have a quantum algorithm to the lattice problems. But both $P$ and $NP$ are defined with respect to "classical" algorithms.

The second question makes more sense because because at least it involves quantum algorithms: if we had a quantum polynomial-time algorithm for LWE and some $NP$-Hard problem that reduces to LWE, then we would have a quantum polynomial-time algorithm for any $NP$ problem (therefore, $NP$ would be a subset of $BQP$).

However, the detail now is that the lattice problems involved in Regev's quantum reduction are not known to be NP-Hard.

That occurs because, roughly speaking, Regev's reduction states that a quantum solver for LWE with parameters $n$, $q$, and $\alpha$, where $0 < \alpha < 1$, gives us a quantum solver for the approximate GapSVP and SIVP over lattices of dimension $n$ with approximation factor $\gamma \approx \frac{n}{\alpha} $.

So, even if the LWE solver worked for $\alpha$ arbitrarily close to $1$, the approximation factor would still be greater than $n$. But we are far away from proving that those lattice problems are NP-Hard for linear approximation factors. And there are even negative results for the hardness of those approximate problems for $\gamma \ge \sqrt{n}$.

Therefore, with the current reductions we know, a quantum polynomial-time algorithm for LWE would (obviously) put LWE inside $BQP$, but would not impact questions 1 and 2.

Of course, from a practical point of view, that is a huge breakthrough. On one hand those approximate versions of the lattice problems are not known to be NP-Hard, on the other hand, we don't know efficient algorithms to solve them.