Summary
Finding two inputs that give the same output in a function, called collision finding, can be sped up by quantum computers if enough memory is used. The authors show that any quantum algorithm that treats the function outputs as interchangeable must balance the number of queries and the amount of memory used, following precise mathematical limits. Their results prove that known quantum algorithms already achieve the best possible tradeoff between speed and memory in this setting. They developed new techniques to analyze how much information a quantum algorithm can keep during its execution, which helps explain these limits.
What this means in practice
- •For cryptographic system designers: Understand the fundamental quantum memory and query limits for collision resistance in hash functions to guide secure system design choices.
- •For quantum algorithm engineers: Optimize quantum algorithms for collision finding and element distinctness by knowing the proven optimal memory-query tradeoffs within symmetric settings.
A theory result. No direct application yet.
Abstract
How much memory is needed to retain the quantum speedup for collision finding? For a uniformly random function $f:[N]\to [N]$, the BHT algorithm finds a collision using $O(N^{1/3})$ queries and a quantumly accessible classical table containing $O(N^{1/3})$ input-output pairs, whereas a logarithmic-space Grover search uses $O(\sqrt N)$ queries. Determining the optimal query-space tradeoff between these extremes remains a major open problem. We resolve this equation within the class of label-symmetric algorithms, which treat the function $f$'s output labels as interchangeable. We prove that such algorithm that makes $T$ queries, uses $S$ qubits, and finds a collision in a uniformly random function $f:[M]\to [N]$ with constant probability satisfies $$T=Ω(N^{1/3}) \qquad\text{and}\qquad T^2S=Ω(N\log N).$$ For the setting where $M=N$, these bounds are matched by a space-efficient implementation of the BHT algorithm. As a consequence of our tradeoff, any label-symmetric algorithm for the search version of Element Distinctness on $f: [n] \to [n^2]$ must satisfy $$T=Ω(n^{2/3}) \qquad\text{and}\qquad T^2S=Ω(n^2\log n),$$ matching Ambainis's quantum walk. Thus, both tradeoffs are optimal within the class of label-symmetric algorithms. To prove these results, we develop a space-sensitive version of the compressed oracle technique. The compressed oracle records the information learned by the algorithm in an evolving superposition of databases. Using label symmetry and representation theory, we show that an algorithm using $S$ qubits can effectively retain information about only $O(S/\log N)$ collision-free database entries. Substituting this estimate into the compressed oracle technique yields the stated tradeoffs.