Cost analysis of hash collisions: will quantum computers make - PDF document

Cost analysis of hash collisions: will quantum computers make SHARCS obsolete? D. J. Bernstein University of Illinois at Chicago NSF ITR–0716498

Quantum vs. SHARCS Exactly how expensive is it to break RSA-1024, ECC-160, etc.? Many papers on the topic. Widespread interest today.

Quantum vs. SHARCS Exactly how expensive is it to break RSA-1024, ECC-160, etc.? Many papers on the topic. Widespread interest today. But quantum computing says: “All your circuit designs will soon be obsolete! Our quantum computers will break RSA and ECC in polynomial time.”

Exactly how expensive is it to invert a hash function, find a cipher key, etc.? b “operations” for b -bit key; 2 how expensive is an “operation”? Many papers on the topic. Widespread interest today.

Exactly how expensive is it to invert a hash function, find a cipher key, etc.? b “operations” for b -bit key; 2 how expensive is an “operation”? Many papers on the topic. Widespread interest today. But quantum computing says: “All your circuit designs will soon be obsolete! Our quantum computers b -bit key will find a b= 2 .” in time only 2

Exactly how expensive is it to find collisions in a hash function? b= 2 “operations” for b -bit hash; 2 how expensive is an “operation”? Many papers on the topic. Widespread interest today.

Exactly how expensive is it to find collisions in a hash function? b= 2 “operations” for b -bit hash; 2 how expensive is an “operation”? Many papers on the topic. Widespread interest today. But quantum computing says: “All your circuit designs will soon be obsolete! Our quantum computers b -bit collision will find a b= 3 .” in time only 2

Main point of my paper: All known quantum algorithms are fundamentally slower than traditional collision circuits, despite optimistic assumptions re quantum-computer speed.

Main point of my paper: All known quantum algorithms are fundamentally slower than traditional collision circuits, despite optimistic assumptions re quantum-computer speed. Extra point of this talk: Optimization experience for ASICs/FPGAs/other meshes will be even more valuable in a quantum-computing world. “Quantum SHARCS”?

Two quantum algorithms 1994 Shor: Fast quantum period-finding. Gives polynomial-time quantum solution to DLP. 1996 Grover, 1997 Grover: Fast quantum search. Practically all quantum algorithms are Shor/Grover applications. See 2003 Shor, “Why haven’t more quantum algorithms been found?”; 2004 Shor.

Grover explicitly constructs F ) a quantum circuit Gr( F , to find a root of assuming root is unique. p N steps.” “Only b if N = 2 F maps b -bit input to 1-bit output. � 1 = 2. Success probability Can use fewer steps but probability degrades quadratically.

F : any computable function. F by a Can specify classical combinatorial circuit: a directed acyclic graph of NAND computations b input bits from to 1 output bit.

F : any computable function. F by a Can specify classical combinatorial circuit: a directed acyclic graph of NAND computations b input bits from to 1 output bit. Without serious overhead (and maybe reducing power!) can replace NAND gates by reversible “Toffoli gates” r ; s; t 7! r ; s; t � r s . x; t 7! x; F ( x ) � t . Obtain

The basic quantum conversion: replace each Toffoli gate by a quantum Toffoli gate. Resulting quantum circuit x; t 7! x; F ( x ) � t computes x is a quantum where b -bit inputs. superposition of

The basic quantum conversion: replace each Toffoli gate by a quantum Toffoli gate. Resulting quantum circuit x; t 7! x; F ( x ) � t computes x is a quantum where b -bit inputs. superposition of Grover builds a superposition x ; of all possible strings applies this circuit; applies an easy quantum flip x ; to build a new result b= 2 ) times. repeats Θ(2

F has more roots? What if 1996 Boyer–Brassard–Høyer– p Tapp, generalizing Grover: O ( N =t )” “time in t roots. if there are

F has more roots? What if 1996 Boyer–Brassard–Høyer– p Tapp, generalizing Grover: O ( N =t )” “time in t roots. if there are Don’t need generalization. Can simply apply Grover x 7! F ( R ( x )) where to x has � b � lg t bits, R is random affine map.

F has more roots? What if 1996 Boyer–Brassard–Høyer– p Tapp, generalizing Grover: O ( N =t )” “time in t roots. if there are Don’t need generalization. Can simply apply Grover x 7! F ( R ( x )) where to x has � b � lg t bits, R is random affine map. t ? Simply guess. Unknown : : : but BBHT is more streamlined.

Grover space and time F Don’t have to unroll into a combinatorial circuit. A Take any circuit of area (using reversible gates!) x; t at the top, that reads x; F ( x ) � t at the top, ends with x is a b -bit string. where Convert gates to quantum gates. Obtain quantum circuit x; t at the top, that reads x; F ( x ) � t at the top, ends with x is a quantum where b -bit strings. superposition of

Don’t unroll Grover iterations. Need some extra space for quantum flip etc., but total Grover circuit size A . will be essentially

Don’t unroll Grover iterations. Need some extra space for quantum flip etc., but total Grover circuit size A . will be essentially “Aren’t quantum gates much larger than classical gates?” — Yes. Constants matter! But this talk makes best-case assumption that the overhead A . doesn’t grow with

p O ( N )” “Time in F time. fails to account for Assume that original circuit F in time T . computes Each Grover iteration T . p takes time essentially T N . Total time essentially

p O ( N )” “Time in F time. fails to account for Assume that original circuit F in time T . computes Each Grover iteration T . p takes time essentially T N . Total time essentially “Aren’t quantum gates much slower than classical gates?” — Yes, but again assume A; T )-dependent penalty. no (

“Can quantum gates operate with just as much parallelism as original gates?” — Best-case assumption: Yes. x 7! A [ x ] Example: RAM lookup is actually computing A [0]( x = 0) + A [1]( x = 1) + � � � ; n terms if A has size n . The basic quantum conversion n ) quantum gates produces Ω( : : : which, presumably, can all operate in parallel. p Realistic mesh/speed of light ) wire delay ) time Ω( n ).

Guessing a collision Consider a hash function b +1 b H : F ! F 2 . 2 b +1 b +1 F : F � F ! F 2 Define F ( 2 x; y ) = 2 as follows: x y and H ( x ) = H ( y ); 0 if 6 = x = y or H ( x ) H ( y ). 1 if 6 = H is, A collision in F . by definition, a root of Easiest way to find collision: F . search randomly for root of

A Assume circuit of area H in time T . computes � A Then circuit of area F in time � T . computes A ?” — Roughly.) (“You mean 2 b +1 for � 1 = 2 Collision chance 0 ). x; x a uniform random pair ( b +1 pairs Trying 2 b � 2 T takes time � A . on circuit of area b= 2 � 2 T Grover takes time � A . on quantum circuit of area

Table lookups Generate many random inputs b= 3 . x 1 ; x 2 ; : : : ; x M = 2 M ; e.g. M pairs Compute and sort H ( x 1 ) ; x 1 ), ( H ( x 2 ) ; x 2 ), : : : , ( H ( x ; x M ) M ) in lex order. ( y . Generate a random input H ( y ) in sorted list. Check for y ’s Keep trying more until collision is found.

b � M = 2 Collision chance y . for each Naive free-communication model: � 1. Table lookup takes time b � ( M + 2 = M )( T + 1) Total time � A + M . on circuit of area � 2 2 b= 3 T e.g. time b= 3 . � A + 2 on circuit of area p Realistic model: � M . Table lookup takes time p Total time b � ( M + 2 = M )( T + M ) � A + M . on circuit of area

F ( y ) as 0 iff Define there is a collision among x 1 ; y ) ; ( x 2 ; y ) ; : : : ; ( x ; y ). M ( F . We’re guessing root of 1998 Brassard–Høyer–Tapp: Instead use quantum search; b= 3 if b= 3 . M = 2 “time” 2 b= 2 ! Wow, faster than 2 Many people say this is scary. ECRYPT Hash Function Website: “For collision resistance at least 384 bits are needed.”

Let’s look at the actual costs of 1998 Brassard–Høyer–Tapp. p Naive free-communication model: b � ( M + = M )( T +1) Total time 2 on quantum circuit � A + M . of area (Realistic model: Slower. See paper for details.) b= 3 : M = 2 e.g. b= 3 � 2 T , time b= 3 . � A + 2 area

2003 Grover–Rudolph, “How significant are the known collision and element distinctness quantum algorithms?”: With such a huge machine, b= 3 can simply run 2 parallel quantum searches 0 ). x; x for collisions ( High probability of success b= 3 . within “time” 2

But these algorithms are giant steps backwards! Standard collision circuits, 1994 van Oorschot–Wiener: b= 4 � 2 T , time b= 4 � 2 A . area This is much faster than 1998 Brassard–Høyer–Tapp, on a much smaller circuit. My paper presents newer, faster quantum collision algorithms, but I conjecture optimality for the standard circuits.