arXivDaily arXiv每日学术速递 周一至周五更新
arXiv quant-ph/0112086quant-ph
收藏

碰撞和元素区分问题的量子下界

Quantum lower bounds for the collision and the element distinctness problems

Yaoyun Shi

摘要:

给定一个函数f作为预言机,冲突问题是找到两个不同的输入i和j,使得f(i)=f(j),在这样的输入存在的承诺下。由于许多基本密码原语的安全性依赖于发现碰撞的难度,碰撞问题的量子下界将为免疫量子密码分析的密码原语的存在提供证据。本文证明了任何在r对1函数中寻找碰撞的量子算法都必须对函数Ω((n/r)^{1/3})次求值,其中n是域的大小,r| n.由于Aaronson [quant-ph/0111102],这改进了Omega((n/r)^{1/5})评估的先前最佳下限,并且紧到常数因子。我们的结果也暗示了一个Omega(n^{2/3})查询的量子下界,用于确定给定的n个实数是否是不同的元素区别性问题的输入。之前的最佳下限是黑盒模型中的Omega(sqrt{n}}查询;以及仅比较模型中的Omega(sqrt{n}log{n})比较,这是由于Høyer、Neerbek和Shi [ICALP'01,quant-ph/0102078]。

英文摘要:

Given a function f as an oracle, the collision problem is to find two distinct inputs i and j such that f(i)=f(j), under the promise that such inputs exist. Since the security of many fundamental cryptographic primitives depends on the hardness of finding collisions, quantum lower bounds for the collision problem would provide evidence for the existence of cryptographic primitives that are immune to quantum cryptanalysis. In this paper, we prove that any quantum algorithm for finding a collision in an r-to-one function must evaluate the function Omega((n/r)^{1/3}) times, where n is the size of the domain and r|n. This improves the previous best lower bound of Omega((n/r)^{1/5}) evaluations due to Aaronson [quant-ph/0111102], and is tight up to a constant factor. Our result also implies a quantum lower bound of Omega(n^{2/3}) queries to the inputs for the element distinctness problem, which is to determine whether or not the given n real numbers are distinct. The previous best lower bound is Omega(sqrt{n}} queries in the black-box model; and Omega(sqrt{n}log{n}) comparisons in the comparisons-only model, due to Høyer, Neerbek, and Shi [ICALP'01, quant-ph/0102078].

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑