Title: Time and Query Complexity Tradeoff for the Dihedral Coset Problem

Abstract: The Dihedral Coset Problem (DCP) in $Z_N$ is an important quantumly defined problem to which for instance the learning with errors problem reduces. There are several algorithms for solving it. On one hand, we have algorithms \`a la Ettinger-H{\o}yer running in $O(2^{c_{SS}\log{N}})$ time but using $O(\log{N})$ queries, for some constant $c_{SS}$. On the other hand, algorithms \`a la Kuperberg need $\widetilde{O}(2^{\sqrt{c_{DCP}\log{N}}})$ time and queries, for some constant $c_{DCP}$. Despite being the subject of a lot of studies, no algorithm using an intermediate number of queries was known up till now. It means that an attacker who has, for cost or time reasons, limited queries, will be forced to use a linear query algorithm running in exponential time. We propose an algorithm taking as a parameter the number $Q$ of queries we are allowed to do, therefore interpolating between existing algorithms. We thus explicitly show that it takes $\widetilde{O}(2^{c_{SS}\left(\log{N}-\frac{1}{c_{DCP}}\log^2{Q}\right)})$ time. Our algorithm improves over algorithms \`a la Ettinger-H{\o}yer when $Q$ is minimal and matches algorithms \`a la Kuperberg when $Q$ is maximal, while offering new possibilities in between. The key point of our algorithm is to give a degree of freedom in the way coset states are preprocessed, that we then link to the parameter $Q$ to obtain an optimal algorithm with respect to $Q$. We also introduce a new sieving procedure to assemble the constructed coset states, allowing us to retrieve the secret $s$.