Improved Quantum Algorithms for the k-XOR Problem

Abstract

The k-XOR problem can be generically formulated as the following: given many n-bit strings generated uniformly at random, find k distinct of them which XOR to zero. This generalizes collision search (two equal elements) to a k-tuple of inputs. This problem has become ubiquitous in cryptanalytic algorithms, including variants in which the XOR operation is replaced by a modular addition (k-SUM) or other non-commutative operations (e.g., the composition of permutations). The case where a single solution exists on average is of special importance. At EUROCRYPT 2020, Naya-Plasencia and Schrottenloher defined a class of quantum merging algorithms for the k-XOR problem, obtained by combining quantum search. They represented these algorithms by a set of merging trees and obtained the best ones through linear optimization of their parameters. In this paper, we give a simplified representation of merging trees that makes their analysis easier. We give better quantum algorithms for the Single-solution k-XOR problem by relaxing one of the previous constraints, and making use of quantum walks. Our algorithms subsume or improve over all previous quantum algorithms for Single-solution k-XOR. For example, we give an algorithm for 4-XOR (or 4-SUM) in quantum time O(2 7n/24 ).

Quantum Implementation of the SAND Algorithm and Its Quantum Resource Estimation for Brute-Force Attack

“…r can be determined through the key size k and branch size n, i.e., r ≥ ⌈k/n⌉ [17]. So, r must be at least (2,4) for SAND-128 and SAND-64. In the U w operator of the Grover algorithm, 2r SA instances are required for parallel testing of a brute-force attack.…”

“…The CNOT gates establish connections between different components. 2 The consumption of the round constant for all rounds. 3 The data in the table represent the quantum resource consumption for SAND-64 and SAND-128.…”

“…The advent of quantum computers and quantum algorithms has dramatically changed the cryptography community. The quantum computation model is expected to bring about profound alterations in the current landscape of cryptanalysis [1,2]. Due to the emergence of two pioneering quantum algorithms-the Shor algorithm [3] and Grover algorithm [4]-the current classical cryptosystem is under threat.…”