A Note on Quantum Collision Resistance of Double-Block-Length Compression Functions
A Note on Quantum Collision Resistance of Double-Block-Length Compression Functions
复制标题
DOI：
10.1007/978-3-030-92641-0_8
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Shoichi Hirose;H. Kuwakado
中科院分区：
文献类型：
--
作者：
Shoichi Hirose;H. Kuwakado
2005年，Nandi提出了一类双块长压缩函数，其中假设是一个产生n比特输出的随机预言，是一个非密码置换。他指出，如果没有固定点，防撞性是最优的。这份手稿讨论了的量子碰撞抗性。首先，它表明，即使没有不动点，量子碰撞抵抗力也不总是最优的：如果是对合，人们可以通过使用Grover搜索找到仅有查询的一对碰撞输入。其次，这篇手稿表明确实存在量子碰撞抵抗力最优的情况。更确切地说，给出了最优量子碰撞抵抗的一个充分条件，即任何碰撞攻击都需要找到碰撞输入对。该证明使用了Zhandry的压缩先知的最新技术。最后，本文对使用分组密码的双块长压缩函数作了一些评论。
In 2005, Nandi presented a class of double-block-length compression functions specified as, wherehis assumed to be a random oracle producing ann-bit output andis a non-cryptographic permutation. He showed that the collision resistance ofis optimal ifhas no fixed point. This manuscript discusses the quantum collision resistance of. First, it shows that the quantum collision resistance ofis not always optimal even ifhas no fixed point: One can find a colliding pair of inputs forwith onlyqueries tohby using the Grover search ifis an involution. Second, this manuscript shows that there really exist cases that the quantum collision resistance ofis optimal. More precisely, a sufficient condition onis presented for the optimal quantum collision resistance of, that is, any collision attack needsqueries to find a colliding pair of inputs. The proof uses the recent technique of Zhandry’s compressed oracle. Finally, this manuscript makes some remarks on double-block-length compression functions using a block cipher.