一种改进的量子多冲突发现算法
Improved Quantum Multicollision-Finding Algorithm
摘要：
本文改进了Hosoyamada等人在Asiacrypt 2017上提出的先前量子多碰撞发现算法的查询次数。假设$l$冲突是导致目标函数的相同输出的$l$不同输入的元组。在密码学中，重要的是研究需要多少查询才能找到$l$ -对于域大于范围的随机函数的冲突。该算法通过递归调用$(l-1)$-冲突查找算法，为随机函数查找$l$-冲突，实现了平均量子查询复杂度为$O(N^{(3^{l-1}-1) / (2 \cdot 3^{l-1})})$，其中$N$是目标函数的范围大小.新算法消除了原有递归算法的冗余，使得不同的递归调用可以分担一部分计算。新算法发现了一个$l$ -碰撞的随机函数的平均量子查询复杂度为$O(N^{(2^{l-1}-1) / (2^{l}-1)})$，这提高了以前的界限为所有$l\ge 3$（新的和以前的算法实现的最佳界限为$l=2$）。更一般地，新算法实现了对于随机函数$f\colon X\to Y$的平均量子查询复杂度为$O\left(c^{3/2}_N N^{\frac{2^{l-1}-1}{ 2^{l}-1}}\right)$，使得对于任何$1\le c_N \in o(N^{\frac{1}{2^l - 1}})$的$|X| \geq l \cdot |Y| / c_N$。在相同的查询复杂度下，它还发现了随机函数的多重律，这比多重冲突更难找到。
英文摘要：
The current paper improves the number of queries of the previous quantum multi-collision finding algorithms presented by Hosoyamada et al. at Asiacrypt 2017. Let an $l$-collision be a tuple of $l$ distinct inputs that result in the same output of a target function. In cryptology, it is important to study how many queries are required to find $l$-collisions for random functions of which domains are larger than ranges. The previous algorithm finds an $l$-collision for a random function by recursively calling the algorithm for finding $(l-1)$-collisions, and it achieves the average quantum query complexity of $O(N^{(3^{l-1}-1) / (2 \cdot 3^{l-1})})$, where $N$ is the range size of target functions. The new algorithm removes the redundancy of the previous recursive algorithm so that different recursive calls can share a part of computations. The new algorithm finds an $l$-collision for random functions with the average quantum query complexity of $O(N^{(2^{l-1}-1) / (2^{l}-1)})$, which improves the previous bound for all $l\ge 3$ (the new and previous algorithms achieve the optimal bound for $l=2$). More generally, the new algorithm achieves the average quantum query complexity of $O\left(c^{3/2}_N N^{\frac{2^{l-1}-1}{ 2^{l}-1}}\right)$ for a random function $f\colon X\to Y$ such that $|X| \geq l \cdot |Y| / c_N$ for any $1\le c_N \in o(N^{\frac{1}{2^l - 1}})$. With the same query complexity, it also finds a multiclaw for random functions, which is harder to find than a multicollision.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
