4. Quantum hashing

In this section, we present notion of quantum (δ, ε)-resistant hash function based on [21].

#### 4.1. One-way δ resistance

We present the following definition of a quantum δ-resistant one-way function. Let "information extracting" mechanism M be a function M : ℋ<sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> ! X. Informally speaking, mechanism M makes some measurements to state |ψ〉∈(ℋ<sup>2</sup> ) <sup>⊗</sup><sup>s</sup> and decodes the result of measurement to X.

Definition 2 ([21]) Let X be a random variable distributed over X f g Pr½ � X ¼ w : w ∈ X . Let <sup>ψ</sup> : <sup>X</sup> ! <sup>ℋ</sup><sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> be a quantum function. Let Y be any random variable over <sup>X</sup> obtained by some mechanism M making measurement to the encoding ψ of X and decoding the result of the measurement to X. Let δ > 0. We call a quantum function ψ a one-way δ-resistant function if


$$\Pr[Y = X] \le \delta. \tag{12}$$

For the cryptographic purposes, it is natural to expect (and we do this in the rest of the paper) that random variable X is uniformly distributed.

A quantum state of s ≥ 1 qubits can theoretically record an infinite amount of information. On the other hand, the Holevo's theorem [22] states that by a quantum measurement, one can extract O(s) bits of information about the state. Here, we use the result of [23] motivated by the Holevo's theorem.

Property 1 ([23]) Let X be a random variable uniformly distributed over {0, 1}<sup>k</sup> . Let ψ: {0, 1}<sup>k</sup> !(ℋ<sup>2</sup> ) ⊗s be a quantum function. Let Y be a random variable over {0, 1}<sup>k</sup> obtained by some mechanism M making some measurement of the encoding ψ of X and decoding the result of measurement to {0, 1}<sup>k</sup> . Then, the probability of correct decoding is given by

$$\Pr[Y=X] \le \frac{2^s}{2^k}.\tag{13}$$

So, extracting an information on input σ from state |ψ(σ)〉 in conditions of Property 1 is "hard." The effectiveness of computation |ψ(σ)〉 depends on construction of quantum hash function ψ. In Section 4.4, we consider quantum hash function construction based on small-biased sets and prove effectiveness of this construction.

#### 4.2. Collision ε resistance

Pracceptð Þ¼ <sup>σ</sup> <sup>X</sup>

read classical bits as control variables for unitary operations (see Figure 1).

to X. Let δ > 0. We call a quantum function ψ a one-way δ-resistant function if

Property 1 ([23]) Let X be a random variable uniformly distributed over {0, 1}<sup>k</sup>

3.2.2. Circuit representation

24 Advanced Technologies of Quantum Key Distribution

4. Quantum hashing

4.1. One-way δ resistance

extracting" mechanism M be a function M : ℋ<sup>2</sup> � � <sup>⊗</sup> <sup>s</sup>

makes some measurements to state |ψ〉∈(ℋ<sup>2</sup>

that random variable X is uniformly distributed.

probability of correct decoding is given by

polynomial-time algorithm.

Holevo's theorem.

i ∈ Accept

Quantum circuits are good formalism for quantum algorithms representation [19, 20]. A quantum branching programs can be viewed as a quantum circuit aided with an ability to

In this section, we present notion of quantum (δ, ε)-resistant hash function based on [21].

We present the following definition of a quantum δ-resistant one-way function. Let "information

Definition 2 ([21]) Let X be a random variable distributed over X f g Pr½ � X ¼ w : w ∈ X . Let <sup>ψ</sup> : <sup>X</sup> ! <sup>ℋ</sup><sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> be a quantum function. Let Y be any random variable over <sup>X</sup> obtained by some mechanism M making measurement to the encoding ψ of X and decoding the result of the measurement

1. it is easy to compute, i.e., a quantum state |ψ(w)〉 for a particular w ∈ X can be determined using a

2. for any mechanism M, the probability Pr[Y = X] that M successfully decodes Y is bounded by δ

For the cryptographic purposes, it is natural to expect (and we do this in the rest of the paper)

A quantum state of s ≥ 1 qubits can theoretically record an infinite amount of information. On the other hand, the Holevo's theorem [22] states that by a quantum measurement, one can extract O(s) bits of information about the state. Here, we use the result of [23] motivated by the

be a quantum function. Let Y be a random variable over {0, 1}<sup>k</sup> obtained by some mechanism M making

some measurement of the encoding ψ of X and decoding the result of measurement to {0, 1}<sup>k</sup>

)

<sup>α</sup><sup>i</sup> j j<sup>2</sup>

: (11)

! X. Informally speaking, mechanism M

<sup>⊗</sup><sup>s</sup> and decodes the result of measurement to X.

Pr½ � Y ¼ X ≤ δ: (12)

. Let ψ: {0, 1}<sup>k</sup>

!(ℋ<sup>2</sup> ) ⊗s

. Then, the

The following definition was presented in [24].

Definition 3 Let <sup>ε</sup> > 0. We call a quantum function <sup>ψ</sup> : <sup>X</sup> ! <sup>ℋ</sup><sup>2</sup> <sup>⊗</sup> <sup>s</sup> a collision ε-resistant function if for any pair w, w<sup>0</sup> of different inputs, |〈ψ(w)|ψ(w<sup>0</sup> )〉| ≤ ε.

Informally speaking, we need two states |ψ(w)〉 and |ψ(w<sup>0</sup> )〉 that is almost orthogonal in order to get small probability of collision, that is, if one tests states |ψ(w)〉 and |ψ(w<sup>0</sup> )〉 for equality, then a testing procedure should give positive result with a small probability. We start with quantum testing procedures.

#### 4.2.1. Testing equality

The crucial procedure for quantum hashing is an equality test for |ψ(v)〉 and |ψ(w)〉 that can be used to compare encoded classical messages v and w. This procedure can be a well-known SWAP test [5] or something that is adapted for specific hashing function, like REVERSE test, see for example [6].

The SWAP test is the known quantum test for the equality of two unknown quantum states |ψ〉 and |ψ<sup>0</sup> 〉 (see [6, 25] for more information).

We denote PrSWAP[v = w] a probability that the SWAP test having quantum hashes |ψ(v)〉 and |ψ(w)〉 outputs the result "v = w" (outputs the result "|ψ(v)〉 = |ψ(w)〉").

Property 2 ([6]) Let function ψ: w↦|ψ(w)〉 satisfy the following condition. For any two different elements v, w ∈ X, it is true that |〈ψ(v)|ψ(w)〉| ≤ ε. Then,

$$\Pr\_{\text{swap}}[\upsilon = w] \le \frac{1}{2} \left( 1 + \varepsilon^2 \right). \tag{14}$$

Proof. From the description of SWAP test, it follows that

$$Pr\_{\text{swap}}[\upsilon = \overline{w}] = \frac{1}{2} \left( 1 + \left| \langle \psi(\upsilon) | \psi(w) \rangle \right|^2 \right). \tag{15}$$

#### 4.2.1.1. REVERSE test

The test for equality, which we are presenting here, was first mentioned in [6]. In our paper [25], we call this test a REVERSE test. This test checks if a quantum state |ψ〉 is a hash of an element v by applying the procedure that inverts the creation of a quantum quantum hash. That is, the REVERSE test procedure transforms the quantum hash to the initial quantum state.

Formally, let the procedure of quantum hashing, given initial state |0〉, maps the input w by unitary transformation U(w): i.e., quantum hashing produces quantum state |ψ(w)〉 = U(w)| 0〉. Then, the REVERSE test, given v and |ψ(w)〉, applies U�<sup>1</sup> (v) to the state |ψ(w)〉 and measures the resulting state with respect to initial state |0〉. The output of REVERSE test is "v = w" iff the measurement outcome is |0〉. The output of REVERSE test is "v=¼ w" iff the measurement outcome is different from |0〉. The probability that the REVERSE test having quantum state |ψ(w)〉 and an element v outputs the result v = w are denoted by PrREVERSE[v = w] .

Property 3 ([23]) Let hash function ψ: w↦|ψ(w)〉 satisfies the following condition. For any two different elements, v and w ∈ X, it is true that |〈ψ(v)|ψ(w)〉| ≤ ε. Then,

$$Pr\_{\text{REVERSE}}[\upsilon = \mathfrak{w}] \le \varepsilon^2. \tag{16}$$

be retrieved, i.e., accessed, can be only up to s classical bits. This is a quantum mechanical

The map ψ is one to one. So, there is no collision in a "quantum level." But extracting the result from quantum state is a probabilistic procedure. This means that one can get the situation when some procedure that tests the equality of different quantum hashes |ψ(v)〉, |ψ(w)〉 outputs "the hashes are the same" (equivalently "the numbers v, w are the same"), while the numbers v and w are different. For example, two numbers 0 and 2k� <sup>2</sup> generate orthogonal states |ψ(0)〉 = |1〉 and

Example 2 Binary word v = σ<sup>1</sup> , … , σk∈{0, 1}<sup>k</sup> encoded by k qubits (each bit encoded by a qubit): ψ:

Clearly, we have that such encoding is collision one-way, 1-resistant, and 0-resistant. So, in contrast to Example 1, the encoding ψ from Example 2 for different words v and w, their images (quantum states) |ψ(v)〉 and |ψ(v)〉 are orthogonal and therefore reliably distinguished;

The following result [24] proves that a quantum collision ε-resistant function needs at least

Property 4 ([24]) Let s <sup>≥</sup> <sup>1</sup> and K <sup>¼</sup> <sup>∣</sup>X<sup>∣</sup> <sup>≥</sup> <sup>4</sup>. Let <sup>ψ</sup> : <sup>X</sup> ! <sup>ℋ</sup><sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> be a collision <sup>ε</sup>-resistant quantum

2=ð Þ 1 � ε

of different elements from X, we have that

� � <sup>p</sup> � <sup>1</sup>: (19)

On Quantum Fingerprinting and Quantum Cryptographic Hashing

http://dx.doi.org/10.5772/intechopen.70692

27

h i <sup>ψ</sup>j<sup>ψ</sup> � <sup>p</sup> � of the norm, it follows that

<sup>i</sup>∣∣<sup>2</sup> � <sup>2</sup> <sup>ψ</sup>jψ<sup>0</sup> h i: (20)

2 1ð Þ � <sup>ε</sup> <sup>p</sup> : (21)

=V in this proof. Consider a set Φ ¼ fjψð Þi w :

<sup>c</sup>ð Þ <sup>Δ</sup>=<sup>2</sup> <sup>2</sup>sþ<sup>1</sup> : (22)

<sup>s</sup> <sup>≥</sup> log log <sup>K</sup> � log log 1 <sup>þ</sup> ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi

<sup>i</sup>∣∣<sup>2</sup> <sup>¼</sup> ∣∣∣ψi∣∣<sup>2</sup> <sup>þ</sup> ∣∣∣ψ<sup>0</sup>

∣∣∣ψð Þi � <sup>w</sup> <sup>∣</sup><sup>ψ</sup> <sup>w</sup><sup>0</sup> ð Þi∣∣ <sup>≥</sup> ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi

w ∈ Xg. If we draw spheres of radius Δ/2 with centers |ψ〉∈ Φ, then spheres do not pairwise intersect. All these K spheres are in a large sphere of radius 1 +Δ/2. The volume of a sphere of radius r in V is cr2<sup>s</sup> + 1 for the complex space V. The constant c depends on the metric of V. From this, we have that the number K is bonded by the number of "small spheres" in the "large sphere"

<sup>c</sup>ð Þ <sup>1</sup> <sup>þ</sup> <sup>Δ</sup>=<sup>2</sup> <sup>2</sup>sþ<sup>1</sup>

) ⊗s

K ≤

encoding. But two numbers 0 and 1 cannot be reliably distinguished by encoding ψ.

but ψ is easily invertible: the function ψ is not one-way resistant.

Proof. First, we observe that from the definition ∣∣ <sup>ψ</sup>i∣∣ <sup>¼</sup> ffiffiffiffiffiffiffiffiffiffiffiffi

∣∣∣ψi � ∣ψ<sup>0</sup>

2 1ð Þ � <sup>ε</sup> <sup>p</sup> . For short, we let (ℋ<sup>2</sup>

)〉 = |0〉. So, numbers 0 and 2k� <sup>2</sup> are distinguishably reliable in respect of the above

approach for the one-way property.


v↦|v〉 = |σ1〉, ⋯ , |σk〉.

log log K � c(ε) qubits.

Hence, for an arbitrary pair w, w<sup>0</sup>

We let <sup>Δ</sup> <sup>¼</sup> ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi

Hence,

hash function. Then,

$$\Pr\_{\text{REVERSE}}[\upsilon = w] = |\langle 0 \, \vert \, \text{L}^{-1}(\upsilon)\psi(w) \rangle|^2 = |\langle \, \text{L}^{-1}(\upsilon)\psi(\upsilon) \rangle \, \text{L}^{-1}(\upsilon)\psi(w) \rangle|^2$$

$$= |\langle \, \psi(\upsilon) | \psi(w) \rangle|^2 \in \varepsilon^2. \tag{17}$$

#### 4.3. Balanced quantum (δ, ε) resistance

The combination of one-way and collision-resistant function definitions gives the definition of quantum cryptographic function.

Definition 4 ([21]) Let K <sup>¼</sup> <sup>∣</sup>X<sup>∣</sup> and s <sup>≥</sup> 1. Let <sup>δ</sup> > 0 and <sup>ε</sup> > 0. We call a function <sup>ψ</sup> : <sup>X</sup> ! <sup>ℋ</sup><sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> <sup>a</sup> quantum (δ, ε)-hash function iff ψ is one-way δ-resistant and is collision ε-resistant function.

We present below the following two examples to demonstrate how one-way δ resistance and collision ε resistance are correlated. The first example was presented in [4] in terms of quantum automata.

Example 1 Let v∈ {0, … , 2<sup>k</sup> � 1}. Number v is encoded by a single qubit as follows:

$$\psi: v \mapsto \cos\left(\frac{2\pi v}{2^k}\right)|0\rangle + \sin\left(\frac{2\pi v}{2^k}\right)|1\rangle. \tag{18}$$

Extracting information from |ψ〉 by measuring |ψ〉 with respect to the basis {|0〉, |1〉} gives the following result. The function ψ is one-way <sup>2</sup> <sup>2</sup><sup>k</sup> resistant (see Property 1) and collision cos(π/2<sup>k</sup> � <sup>1</sup> ) resistant. Thus, the function ψ has a good one-way property but has a bad collision resistance property for large k.

Clearly, that one can store (to hash) in this way an arbitrary large amount of classical information, that is, for arbitrary large k one can store all numbers from {0, … , 2<sup>k</sup> � 1} in a single qubit. Holevo bound [22] proves that given s ≥ 1 qubits, the amount of classical information that can be retrieved, i.e., accessed, can be only up to s classical bits. This is a quantum mechanical approach for the one-way property.

The map ψ is one to one. So, there is no collision in a "quantum level." But extracting the result from quantum state is a probabilistic procedure. This means that one can get the situation when some procedure that tests the equality of different quantum hashes |ψ(v)〉, |ψ(w)〉 outputs "the hashes are the same" (equivalently "the numbers v, w are the same"), while the numbers v and w are different. For example, two numbers 0 and 2k� <sup>2</sup> generate orthogonal states |ψ(0)〉 = |1〉 and |ψ(2k� <sup>2</sup> )〉 = |0〉. So, numbers 0 and 2k� <sup>2</sup> are distinguishably reliable in respect of the above encoding. But two numbers 0 and 1 cannot be reliably distinguished by encoding ψ.

Example 2 Binary word v = σ<sup>1</sup> , … , σk∈{0, 1}<sup>k</sup> encoded by k qubits (each bit encoded by a qubit): ψ: v↦|v〉 = |σ1〉, ⋯ , |σk〉.

Clearly, we have that such encoding is collision one-way, 1-resistant, and 0-resistant. So, in contrast to Example 1, the encoding ψ from Example 2 for different words v and w, their images (quantum states) |ψ(v)〉 and |ψ(v)〉 are orthogonal and therefore reliably distinguished; but ψ is easily invertible: the function ψ is not one-way resistant.

The following result [24] proves that a quantum collision ε-resistant function needs at least log log K � c(ε) qubits.

Property 4 ([24]) Let s <sup>≥</sup> <sup>1</sup> and K <sup>¼</sup> <sup>∣</sup>X<sup>∣</sup> <sup>≥</sup> <sup>4</sup>. Let <sup>ψ</sup> : <sup>X</sup> ! <sup>ℋ</sup><sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> be a collision <sup>ε</sup>-resistant quantum hash function. Then,

$$\text{Is } \mathbf{s} \ge \log \text{ log } K-\log \log \left( 1 + \sqrt{2/(1-\varepsilon)} \right) - 1. \tag{19}$$

Proof. First, we observe that from the definition ∣∣ <sup>ψ</sup>i∣∣ <sup>¼</sup> ffiffiffiffiffiffiffiffiffiffiffiffi h i <sup>ψ</sup>j<sup>ψ</sup> � <sup>p</sup> � of the norm, it follows that

$$\|\|\|\psi\rangle - |\psi'\rangle\|\|^2 = \|\|\psi\rangle\|\|^2 + \|\|\psi'\rangle\|\|^2 - \Im \langle \psi | \psi' \rangle. \tag{20}$$

Hence, for an arbitrary pair w, w<sup>0</sup> of different elements from X, we have that

$$\|\|\psi(w)\rangle - |\psi(w')\rangle\| \ge \sqrt{2(1-\varepsilon)}.\tag{21}$$

We let <sup>Δ</sup> <sup>¼</sup> ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi 2 1ð Þ � <sup>ε</sup> <sup>p</sup> . For short, we let (ℋ<sup>2</sup> ) ⊗s =V in this proof. Consider a set Φ ¼ fjψð Þi w : w ∈ Xg. If we draw spheres of radius Δ/2 with centers |ψ〉∈ Φ, then spheres do not pairwise intersect. All these K spheres are in a large sphere of radius 1 +Δ/2. The volume of a sphere of radius r in V is cr2<sup>s</sup> + 1 for the complex space V. The constant c depends on the metric of V. From this, we have that the number K is bonded by the number of "small spheres" in the "large sphere"

$$K \le \frac{c(1 + \Lambda/2)^{2^{\*+1}}}{c\left(\Lambda/2\right)^{2^{\*+1}}}.\tag{22}$$

Hence,

hash. That is, the REVERSE test procedure transforms the quantum hash to the initial

Formally, let the procedure of quantum hashing, given initial state |0〉, maps the input w by unitary transformation U(w): i.e., quantum hashing produces quantum state |ψ(w)〉 = U(w)|

measures the resulting state with respect to initial state |0〉. The output of REVERSE test is "v = w" iff the measurement outcome is |0〉. The output of REVERSE test is "v=¼ w" iff the measurement outcome is different from |0〉. The probability that the REVERSE test having quantum state |ψ(w)〉 and an element v outputs the result v = w are denoted by

Property 3 ([23]) Let hash function ψ: w↦|ψ(w)〉 satisfies the following condition. For any two

PrREVERSE½ � <sup>v</sup> <sup>¼</sup> <sup>w</sup> <sup>≤</sup> <sup>ε</sup><sup>2</sup>

(v)ψ(w)〉|2 = ∣〈U�<sup>1</sup>

<sup>2</sup> ≤ ε<sup>2</sup> :

The combination of one-way and collision-resistant function definitions gives the definition of

Definition 4 ([21]) Let K <sup>¼</sup> <sup>∣</sup>X<sup>∣</sup> and s <sup>≥</sup> 1. Let <sup>δ</sup> > 0 and <sup>ε</sup> > 0. We call a function <sup>ψ</sup> : <sup>X</sup> ! <sup>ℋ</sup><sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> <sup>a</sup>

We present below the following two examples to demonstrate how one-way δ resistance and collision ε resistance are correlated. The first example was presented in [4] in terms of quantum

Extracting information from |ψ〉 by measuring |ψ〉 with respect to the basis {|0〉, |1〉} gives the

Clearly, that one can store (to hash) in this way an arbitrary large amount of classical informa-

Holevo bound [22] proves that given s ≥ 1 qubits, the amount of classical information that can

� 1}. Number v is encoded by a single qubit as follows:

) resistant. Thus, the function ψ has a good one-way property but has a bad collision

j i<sup>0</sup> <sup>þ</sup> sin <sup>2</sup>π<sup>v</sup>

2k � �

quantum (δ, ε)-hash function iff ψ is one-way δ-resistant and is collision ε-resistant function.

2πv 2k � � (v) to the state |ψ(w)〉 and

: (16)

(v)ψ(w)〉|2

j1i: (18)

� 1} in a single qubit.

<sup>2</sup><sup>k</sup> resistant (see Property 1) and collision

(17)

(v)ψ(v)|U�<sup>1</sup>

0〉. Then, the REVERSE test, given v and |ψ(w)〉, applies U�<sup>1</sup>

different elements, v and w ∈ X, it is true that |〈ψ(v)|ψ(w)〉| ≤ ε. Then,

D

ψ : v ↦ cos

tion, that is, for arbitrary large k one can store all numbers from {0, … , 2<sup>k</sup>

following result. The function ψ is one-way <sup>2</sup>

¼ ∣ ψð Þv j ij ψð Þ w

PrREVERSE[v = w] = ∣〈0|U�<sup>1</sup>

4.3. Balanced quantum (δ, ε) resistance

quantum cryptographic function.

Example 1 Let v∈ {0, … , 2<sup>k</sup>

resistance property for large k.

automata.

cos(π/2<sup>k</sup> � <sup>1</sup>

quantum state.

26 Advanced Technologies of Quantum Key Distribution

PrREVERSE[v = w] .

$$s \ge \log\_e \log K - \log\_e \log \left( 1 + \sqrt{2/(1 - \varepsilon)} \right) - 1. \tag{23}$$

Proof. One-way δ-resistance property of ψHS follows from Property 1: a probability of correct

Collision ε-resistance property of ψHS follows directly from the corresponding property of [26].

<sup>ω</sup>ha ð Þ<sup>x</sup> <sup>j</sup>a〉 <sup>¼</sup> <sup>1</sup>

(x)〉 is bounded by ∣S∣/q.

ffiffiffiffiffi <sup>∣</sup>S<sup>∣</sup> <sup>p</sup> <sup>X</sup> a∈ S

∈ ℤq, it is true that

On Quantum Fingerprinting and Quantum Cryptographic Hashing

<sup>v</sup>ð Þx χv0ð Þx . χ(x) is nontrivial character of ℤq, since χvð Þx =� χv0ð Þx

<sup>v</sup>ð Þx χvð Þ� x 1, where 1 is a trivial character of ℤq. Thus, the state-

1 ∣S∣ j X a∈ S

0

<sup>v</sup>ð Þa χv0ð Þj ¼ a

In this section, we give two explicit examples of the quantum hashing for specific finite abelian

χxð Þa jai: (26)

http://dx.doi.org/10.5772/intechopen.70692

29

<sup>v</sup>ð Þa χv0ð Þj a ≤ ε: (27)

<sup>v</sup>ð Þx is also a character of ℤ<sup>q</sup> and so the

χð Þj a ≤ ε: (28)

, and the corresponding

ð Þ �<sup>1</sup> ð Þ <sup>a</sup>;sj <sup>j</sup>ji: (29)

decoding an x from a quantum state |ψHS

jψHS

�

following function is <sup>χ</sup>ð Þ¼ <sup>x</sup> <sup>χ</sup><sup>∗</sup>

<sup>v</sup>ð Þ<sup>x</sup> <sup>χ</sup>v0ð Þ<sup>x</sup> <sup>=</sup>� <sup>χ</sup><sup>∗</sup>

j〈ψHS

4.5.1. Hashing the elements of the Boolean cube

quantum hash function is the following

the phase of quantum states de Wolf [30].

4.5.2. Hashing the elements of the cyclic group

and <sup>χ</sup>ð Þ¼ <sup>x</sup> <sup>χ</sup><sup>∗</sup>

For <sup>G</sup> <sup>¼</sup> <sup>ℤ</sup><sup>n</sup>

We will prove that for arbitrary different elements v, v

ψHS

Let χv(x) and χv0(x) be characters of group ℤq. Then, χ<sup>∗</sup>

ment of Theorem 1 follows from the definition of an ε-biased set.

ð Þj <sup>v</sup> <sup>ψ</sup>HS <sup>v</sup><sup>0</sup> ð Þ〉j ¼ <sup>1</sup>

4.5. Quantum fingerprinting functions as hash functions

∣S∣ j X a∈ S χ∗

groups, which turn out to be the known quantum fingerprinting schemas.

<sup>j</sup>ψSð Þ<sup>a</sup> �

For group G = ℤq, the corresponding quantum hash function is given by

<sup>2</sup>, its characters can be written in the form <sup>χ</sup>a(x)=(�1)(a, <sup>x</sup>)

<sup>¼</sup> <sup>1</sup> ffiffiffiffiffi <sup>∣</sup>S<sup>∣</sup> <sup>p</sup> <sup>X</sup> ∣S∣

j¼1

The resulting hash function is exactly the quantum fingerprinting by Buhrman et al. [5], once we consider an error-correcting code, whose matrix is built from the elements of S. Indeed, as stated in [29] an ε-balanced error-correcting code can be constructed out of an ε-biased set. Thus, the inner product (a, x) in the exponent is equivalent to the corresponding bit of the code word, and altogether, this gives the quantum fingerprinting function that stores information in

ð Þ<sup>x</sup> 〉 <sup>¼</sup> <sup>1</sup>

ffiffiffiffiffi <sup>∣</sup>S<sup>∣</sup> <sup>p</sup> <sup>X</sup> a∈S

ð Þj v ψHS v<sup>0</sup> ð Þ �D E �

� � � <sup>¼</sup> <sup>1</sup> ∣S∣ j X a∈S χ∗

Note that

Properties 1 and 4 provide a basis for building a "balanced" one-way δ-resistance and collision ε-resistance properties. That is, roughly speaking, if we need to hash elements w from the domain X with ∣X∣ ¼ K and if one can build for an ε > 0 a collision ε-resistant (K;s) hash function ψ with s ≈ loglogK � c(ε) qubits, then the function f is one-way δ resistant with δ ≈ (logK/K). Such a function is balanced with respect to Property 4.

To summarize the above considerations, we can state the following. A quantum (δ, ε)-hash function is a function that satisfies all of the properties that a "classical" hash function should satisfy. Preimage resistance follows from Property 1. Second preimage resistance and collision resistance follow, because all inputs are mapped to states that are nearly orthogonal. Therefore, we see that quantum hash functions can satisfy the three properties of a classical cryptographic hash function.

#### 4.4. Quantum hash functions construction via small-biased sets

This section is based on the paper [26]. We first present a brief background on ε-biased sets. For more information, see [27]. Note that ε-biased sets are generally defined for arbitrary finite groups, but here we restrict ourselves to ℤq.

For an a ∈ ℤq, a character χ<sup>a</sup> of ℤ<sup>q</sup> is a homomorphism χ<sup>a</sup> : ℤq!μq, where μ<sup>q</sup> is the (multiplicative) group of complex <sup>q</sup>-th roots of unity. That is, <sup>χ</sup>a(x) = <sup>ω</sup>ax, where <sup>ω</sup> <sup>¼</sup> <sup>e</sup> 2πi <sup>q</sup> is a primitive q-th root of unity. The character χ<sup>0</sup> � 1 is called a trivial character.

Definition 5 A set S⊆ ℤ<sup>q</sup> is called ε biased, if for any nontrivial character χ∈ {χ<sup>a</sup> : a ∈ ℤq}

$$\frac{1}{|\mathcal{S}|} |\sum\_{\mathbf{x} \in \mathcal{S}} \chi(\mathbf{x})| \le \varepsilon. \tag{24}$$

These sets are interesting when ∣S∣≪∣ℤq∣ (as S = ℤ<sup>q</sup> is 0 biased). In their seminal paper, Naor and Naor [13] defined these small-biased sets, gave the first explicit constructions of such sets, and demonstrated the power of small-biased sets for several applications.

Remark 1 Note that a set S of O(log q/ε<sup>2</sup> ) elements selected uniformly at random from ℤ<sup>q</sup> is ε biased with positive probability [28].

Many other constructions of small-biased sets followed during the last decades.

Vasiliev [26] showed that ε-biased sets generate (δ,ε)-resistant hash functions. We present the result of [26] in the following form.

Theorem 1 Let S⊆ ℤ<sup>q</sup> be an ε-biased set. Let HS = {ha(x) = ax(mod q), a ∈S, ha : ℤq!ℤq} be a set of functions determined by S. Then, a quantum function <sup>ψ</sup>HS : <sup>ℤ</sup>q!(ℋ<sup>2</sup> ) ⊗ log ∣S∣

$$|\psi\_{H\_{\mathbb{S}}}(\mathbf{x})\rangle = \frac{1}{\sqrt{|\mathbf{S}|}} \sum\_{a \in \mathcal{S}} a^{h\_{\mathbf{s}}(x)} |a\rangle \tag{25}$$

is a (δ, ε)-resistant quantum hash function, where δ ≤ ∣S∣/q.

Proof. One-way δ-resistance property of ψHS follows from Property 1: a probability of correct decoding an x from a quantum state |ψHS (x)〉 is bounded by ∣S∣/q.

Collision ε-resistance property of ψHS follows directly from the corresponding property of [26]. Note that

$$|\psi\_{H\_{\mathcal{S}}}(\mathbf{x})\rangle = \frac{1}{\sqrt{|\mathbf{S}|}} \sum\_{a \in \mathcal{S}} \omega^{h\_{\mathbf{x}}(\mathbf{x})} |a\rangle = \frac{1}{\sqrt{|\mathbf{S}|}} \sum\_{a \in \mathcal{S}} \chi\_{\mathbf{x}}(a) |a\rangle. \tag{26}$$

We will prove that for arbitrary different elements v, v 0 ∈ ℤq, it is true that

$$\left| \left< \psi\_{H\_{\mathcal{S}}}(\boldsymbol{\upsilon}) | \psi\_{H\_{\mathcal{S}}}(\boldsymbol{\upsilon}') \right> \right| = \frac{1}{|\mathcal{S}|} \left| \sum\_{a \in \mathcal{S}} \chi\_{\boldsymbol{\upsilon}}^\*(a) \chi\_{\boldsymbol{\upsilon}'}(a) \right| \leq \varepsilon. \tag{27}$$

Let χv(x) and χv0(x) be characters of group ℤq. Then, χ<sup>∗</sup> <sup>v</sup>ð Þx is also a character of ℤ<sup>q</sup> and so the following function is <sup>χ</sup>ð Þ¼ <sup>x</sup> <sup>χ</sup><sup>∗</sup> <sup>v</sup>ð Þx χv0ð Þx . χ(x) is nontrivial character of ℤq, since χvð Þx =� χv0ð Þx and <sup>χ</sup>ð Þ¼ <sup>x</sup> <sup>χ</sup><sup>∗</sup> <sup>v</sup>ð Þ<sup>x</sup> <sup>χ</sup>v0ð Þ<sup>x</sup> <sup>=</sup>� <sup>χ</sup><sup>∗</sup> <sup>v</sup>ð Þx χvð Þ� x 1, where 1 is a trivial character of ℤq. Thus, the statement of Theorem 1 follows from the definition of an ε-biased set.

$$|\langle \psi\_{H\_{\mathcal{S}}}(\mathbf{z}) | \psi\_{H\_{\mathcal{S}}}(\mathbf{z}') \rangle| = \frac{1}{|\mathcal{S}|} |\sum\_{a \in \mathcal{S}} \chi\_{\upsilon}^\*(a) \chi\_{\upsilon'}(a)| = \frac{1}{|\mathcal{S}|} |\sum\_{a \in \mathcal{S}} \chi(a)| \le \varepsilon. \tag{28}$$

#### 4.5. Quantum fingerprinting functions as hash functions

In this section, we give two explicit examples of the quantum hashing for specific finite abelian groups, which turn out to be the known quantum fingerprinting schemas.

#### 4.5.1. Hashing the elements of the Boolean cube

<sup>s</sup> <sup>≥</sup> log log <sup>K</sup> � log log 1 <sup>þ</sup> ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi

δ ≈ (logK/K). Such a function is balanced with respect to Property 4.

4.4. Quantum hash functions construction via small-biased sets

root of unity. The character χ<sup>0</sup> � 1 is called a trivial character.

tive) group of complex <sup>q</sup>-th roots of unity. That is, <sup>χ</sup>a(x) = <sup>ω</sup>ax, where <sup>ω</sup> <sup>¼</sup> <sup>e</sup>

and demonstrated the power of small-biased sets for several applications.

functions determined by S. Then, a quantum function <sup>ψ</sup>HS : <sup>ℤ</sup>q!(ℋ<sup>2</sup>

is a (δ, ε)-resistant quantum hash function, where δ ≤ ∣S∣/q.

jψHS

Many other constructions of small-biased sets followed during the last decades.

Definition 5 A set S⊆ ℤ<sup>q</sup> is called ε biased, if for any nontrivial character χ∈ {χ<sup>a</sup> : a ∈ ℤq} 1 ∣S∣ j X x∈ S

groups, but here we restrict ourselves to ℤq.

28 Advanced Technologies of Quantum Key Distribution

Remark 1 Note that a set S of O(log q/ε<sup>2</sup>

result of [26] in the following form.

with positive probability [28].

Properties 1 and 4 provide a basis for building a "balanced" one-way δ-resistance and collision ε-resistance properties. That is, roughly speaking, if we need to hash elements w from the domain X with ∣X∣ ¼ K and if one can build for an ε > 0 a collision ε-resistant (K;s) hash function ψ with s ≈ loglogK � c(ε) qubits, then the function f is one-way δ resistant with

To summarize the above considerations, we can state the following. A quantum (δ, ε)-hash function is a function that satisfies all of the properties that a "classical" hash function should satisfy. Preimage resistance follows from Property 1. Second preimage resistance and collision resistance follow, because all inputs are mapped to states that are nearly orthogonal. Therefore, we see that quantum hash functions can satisfy the three properties of a classical cryptographic hash function.

This section is based on the paper [26]. We first present a brief background on ε-biased sets. For more information, see [27]. Note that ε-biased sets are generally defined for arbitrary finite

For an a ∈ ℤq, a character χ<sup>a</sup> of ℤ<sup>q</sup> is a homomorphism χ<sup>a</sup> : ℤq!μq, where μ<sup>q</sup> is the (multiplica-

These sets are interesting when ∣S∣≪∣ℤq∣ (as S = ℤ<sup>q</sup> is 0 biased). In their seminal paper, Naor and Naor [13] defined these small-biased sets, gave the first explicit constructions of such sets,

Vasiliev [26] showed that ε-biased sets generate (δ,ε)-resistant hash functions. We present the

Theorem 1 Let S⊆ ℤ<sup>q</sup> be an ε-biased set. Let HS = {ha(x) = ax(mod q), a ∈S, ha : ℤq!ℤq} be a set of

ffiffiffiffiffi <sup>∣</sup>S<sup>∣</sup> <sup>p</sup> <sup>X</sup> a∈S

ð Þ<sup>x</sup> 〉 <sup>¼</sup> <sup>1</sup>

2=ð Þ 1 � ε

� � <sup>p</sup> � <sup>1</sup>: (23)

2πi

χð Þj x ≤ ε: (24)

) elements selected uniformly at random from ℤ<sup>q</sup> is ε biased

) ⊗ log ∣S∣

<sup>ω</sup>ha ð Þ<sup>x</sup> <sup>j</sup>a<sup>i</sup> (25)

<sup>q</sup> is a primitive q-th

For <sup>G</sup> <sup>¼</sup> <sup>ℤ</sup><sup>n</sup> <sup>2</sup>, its characters can be written in the form <sup>χ</sup>a(x)=(�1)(a, <sup>x</sup>) , and the corresponding quantum hash function is the following

$$\left|\psi\_S(a)\right\rangle = \frac{1}{\sqrt{|S|}} \sum\_{j=1}^{|S|} \left(-1\right)^{\left(a,s\_j\right)} \left|j\right\rangle. \tag{29}$$

The resulting hash function is exactly the quantum fingerprinting by Buhrman et al. [5], once we consider an error-correcting code, whose matrix is built from the elements of S. Indeed, as stated in [29] an ε-balanced error-correcting code can be constructed out of an ε-biased set. Thus, the inner product (a, x) in the exponent is equivalent to the corresponding bit of the code word, and altogether, this gives the quantum fingerprinting function that stores information in the phase of quantum states de Wolf [30].

#### 4.5.2. Hashing the elements of the cyclic group

For group G = ℤq, the corresponding quantum hash function is given by

$$|\psi\_S(a)\rangle = \frac{1}{\sqrt{|S|}} \sum\_{j=1}^{|S|} a^{a\circ j} |j\rangle. \tag{30}$$

Q ¼ T; ψ<sup>0</sup>

is determined by the variable xj tested on the step j, and Uj(0) and Uj(1) are unitary trans-

ω<sup>a</sup>12<sup>j</sup>

2. The j-th instruction of Q reads the input symbol xj (the value of x) and applies the transition

log Y q�1

@

j¼0

We consider the following notations. For the QBP Q from Theorem 2, we let width(Q) = s and

Þ ¼ minwidth Qð Þ, timeðψHS

Uj xj � � <sup>0</sup>

⋱

, ωa12<sup>j</sup>

ω<sup>a</sup>02<sup>j</sup>

We define a computation of <sup>Q</sup> on an input <sup>x</sup> <sup>=</sup> <sup>x</sup><sup>0</sup> , … , <sup>x</sup>log<sup>q</sup> � <sup>1</sup>∈{0, 1}log<sup>q</sup> as follows:

where |ψ0〉 is the initial state and T is a sequence of log q instructions:

Ujð Þ¼ 1

1. A computation of Q starts from the initial state |ψ0〉.

matrix Uj(xj) to the current state |ψ〉 to obtain the state |ψ

jψHS

time Qð Þ¼ ∣T∣. Next for quantum hash function ψHS (6), we let

where minimum is taken over all QBPs that compute ψHS

Then from Theorem 2, we have the following corollary

widthðψHS

ð Þx 〉 ¼

widthðψHS

timeðψHS

formations in (ℋ<sup>2</sup>

3. The final state is

5.1.1. Upper bounds

Theorem 3

5.1. Complexity measures

zero. That is,

) ⊗s

matrix whose diagonal entries are ωa02<sup>j</sup>

� � � �

, � (36)

http://dx.doi.org/10.5772/intechopen.70692

31

On Quantum Fingerprinting and Quantum Cryptographic Hashing

, …, ωaT � <sup>12</sup><sup>j</sup> and the off-diagonal elements are all

: (38)

� (39)

Þ ¼ mintime Qð Þ (40)

Þ ¼ Oð Þ log log q , (41)

Þ ¼ Oð Þ log q : (42)

<sup>T</sup><sup>j</sup> <sup>¼</sup> xj; Ujð Þ<sup>0</sup> ; Ujð Þ<sup>1</sup> � � (37)

. More precise Uj(0) is T � T identity matrix. Uj(1) is the T � T diagonal

ωaT�12<sup>j</sup>

0

1 A ψ<sup>0</sup> � : �

.

〉 = Uj(xj)|ψ〉.

The above quantum hash function is essentially equivalent to the one we have defined earlier in [25], which is in turn based on the quantum fingerprinting function from [11].

• In the content of the definition of quantum hash generator [24] and the above consideration, it is natural to call the set HS of functions (formed from ε-biased set S) a uniform quantum (δ, ε)-hash generator for δ = O(| S| /(q log q)).

As a corollary from Theorem 1 and the above consideration, we can state the following.

Property 5 For an <sup>ε</sup>-biased set S <sup>¼</sup> f g <sup>a</sup>1;…; aT <sup>⊂</sup>F<sup>q</sup> with T <sup>=</sup> <sup>O</sup>(logq/ε<sup>2</sup> ), for s = logT, for δ = O(1/(qε<sup>2</sup> )), a quantum uniform (δ, ε)-hash generator HS generates quantum (δ, ε)-hash function

$$
\psi\_{\rm{H\_{\rm{S}}}} : \mathbb{F}\_{\rm{q}} \to \left(\mathcal{H}^{2}\right)^{\otimes s} \tag{31}
$$

$$|\psi\_{H\_8}(\mathbf{x})\rangle = \frac{1}{\sqrt{T}} \sum\_{j=0}^{T-1} w^{a\_j \mathbf{x}}\,\mathrm{},\tag{32}$$

#### 5. Computing a quantum hash |ψHS (x)〉 by QBP

Theorem 2 Quantum (δ, ε)-hash function (6)

$$
\psi\_{H\_{\mathbb{S}}} : \mathbb{F}\_q \to \left(\mathcal{H}^2\right)^{\otimes s} \tag{33}
$$

can be computed by quantum branching program Q composed from s = O(log log q) qubits in log q steps.

Proof. Quantum function ψHS (6) for an input x ∈F<sup>q</sup> determines quantum states (7)

$$|\psi\_{H\_8}(\mathbf{x})\rangle = \frac{1}{\sqrt{T}} \sum\_{j=0}^{T-1} a^{\mathbf{a};\mathbf{x}} |j\rangle\_{\prime} \tag{34}$$

which is a result of quantum Fourier transformation (QFT) of the initial state

$$|\psi\_0\rangle = \frac{1}{\sqrt{T}} \sum\_{j=0}^{T-1} |j\rangle. \tag{35}$$

Such a QFT is controlled by the input x. QBP Q for computing quantum hash |ψHS (x)〉 determined as follows. We represent an integer x∈{0, …, q� 1} as the bit-string x = x0…xlogq� <sup>1</sup> that is, x = x<sup>0</sup> + 21 x<sup>1</sup> + … + 2log<sup>q</sup>� <sup>1</sup> xlogq� 1. For a binary string x = x0…xlogq� <sup>1</sup> a quantum branching program Q over the space (ℋ<sup>2</sup> ) <sup>⊗</sup><sup>s</sup> for computing |ψHS (x)〉 (composed of s = log T qubits) is defined as

On Quantum Fingerprinting and Quantum Cryptographic Hashing http://dx.doi.org/10.5772/intechopen.70692 31

$$Q = \langle \mathbb{T}, |\psi\_0\rangle\rangle,\tag{36}$$

where |ψ0〉 is the initial state and T is a sequence of log q instructions:

$$\mathbb{T}\_{\rangle} = \left( \mathbf{x}\_{\rangle}, \mathcal{U}\_{\rangle}(\mathbf{0}), \mathcal{U}\_{\rangle}(\mathbf{1}) \right) \tag{37}$$

is determined by the variable xj tested on the step j, and Uj(0) and Uj(1) are unitary transformations in (ℋ<sup>2</sup> ) ⊗s . More precise Uj(0) is T � T identity matrix. Uj(1) is the T � T diagonal matrix whose diagonal entries are ωa02<sup>j</sup> , ωa12<sup>j</sup> , …, ωaT � <sup>12</sup><sup>j</sup> and the off-diagonal elements are all zero. That is,

$$\mathbf{U}\_{\!/\!1}(\mathbf{1}) = \begin{bmatrix} \omega^{a\_{0}2^{i}} \\ & \omega^{a\_{1}2^{i}} \\ & & \ddots \\ & & & \omega^{a\_{T-1}2^{i}} \\ & & & & \end{bmatrix}. \tag{38}$$

We define a computation of <sup>Q</sup> on an input <sup>x</sup> <sup>=</sup> <sup>x</sup><sup>0</sup> , … , <sup>x</sup>log<sup>q</sup> � <sup>1</sup>∈{0, 1}log<sup>q</sup> as follows:

1. A computation of Q starts from the initial state |ψ0〉.

2. The j-th instruction of Q reads the input symbol xj (the value of x) and applies the transition matrix Uj(xj) to the current state |ψ〉 to obtain the state |ψ 0 〉 = Uj(xj)|ψ〉.

3. The final state is

<sup>j</sup>ψSð Þ<sup>a</sup> 〉 <sup>¼</sup> <sup>1</sup>

in [25], which is in turn based on the quantum fingerprinting function from [11].

a quantum uniform (δ, ε)-hash generator HS generates quantum (δ, ε)-hash function

jψHS

quantum (δ, ε)-hash generator for δ = O(| S| /(q log q)).

5. Computing a quantum hash |ψHS

Theorem 2 Quantum (δ, ε)-hash function (6)

30 Advanced Technologies of Quantum Key Distribution

steps.

x = x<sup>0</sup> + 21

x<sup>1</sup> + … + 2log<sup>q</sup>� <sup>1</sup>

)

gram Q over the space (ℋ<sup>2</sup>

Property 5 For an <sup>ε</sup>-biased set S <sup>¼</sup> f g <sup>a</sup>1;…; aT <sup>⊂</sup>F<sup>q</sup> with T <sup>=</sup> <sup>O</sup>(logq/ε<sup>2</sup>

ffiffiffiffiffi <sup>∣</sup>S<sup>∣</sup> <sup>p</sup> <sup>X</sup> ∣S∣

The above quantum hash function is essentially equivalent to the one we have defined earlier

• In the content of the definition of quantum hash generator [24] and the above consideration, it is natural to call the set HS of functions (formed from ε-biased set S) a uniform

As a corollary from Theorem 1 and the above consideration, we can state the following.

ð Þ<sup>x</sup> 〉 <sup>¼</sup> <sup>1</sup>

ffiffiffi T <sup>p</sup> <sup>X</sup> T�1

can be computed by quantum branching program Q composed from s = O(log log q) qubits in log q

ffiffiffi T <sup>p</sup> <sup>X</sup> T�1

ffiffiffi T <sup>p</sup> <sup>X</sup> T�1

mined as follows. We represent an integer x∈{0, …, q� 1} as the bit-string x = x0…xlogq� <sup>1</sup> that is,

j¼0

j¼0

ωajx

xlogq� 1. For a binary string x = x0…xlogq� <sup>1</sup> a quantum branching pro-

Proof. Quantum function ψHS (6) for an input x ∈F<sup>q</sup> determines quantum states (7)

ð Þ<sup>x</sup> 〉 <sup>¼</sup> <sup>1</sup>

<sup>j</sup>ψ0〉 <sup>¼</sup> <sup>1</sup>

Such a QFT is controlled by the input x. QBP Q for computing quantum hash |ψHS

jψHS

which is a result of quantum Fourier transformation (QFT) of the initial state

<sup>⊗</sup><sup>s</sup> for computing |ψHS

j¼0

(x)〉 by QBP

ωajx

j¼1

ωasj

jj〉: (30)

), for s = logT, for δ = O(1/(qε<sup>2</sup>

, (32)

jji, (34)

jji: (35)

(x)〉 (composed of s = log T qubits) is defined as

(x)〉 deter-

<sup>ψ</sup>HS : <sup>F</sup><sup>q</sup> ! <sup>ℋ</sup><sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> (31)

<sup>ψ</sup>HS : <sup>F</sup><sup>q</sup> ! <sup>ℋ</sup><sup>2</sup> � � <sup>⊗</sup> <sup>s</sup> (33)

)),

$$|\psi\_{H\_S}(\mathbf{x})\rangle = \left(\prod\_{j=0}^{\log q - 1} \mathcal{U}\_j(\mathbf{x}\_j)\right) |\psi\_0\rangle. \tag{39}$$

#### 5.1. Complexity measures

We consider the following notations. For the QBP Q from Theorem 2, we let width(Q) = s and time Qð Þ¼ ∣T∣. Next for quantum hash function ψHS (6), we let

$$
\text{with}(\psi\_{H\_\mathcal{G}}) = \text{min} \text{width}(\mathcal{Q}), \qquad \text{time}(\psi\_{H\_\mathcal{G}}) = \text{minute}(\mathcal{Q}) \tag{40}
$$

where minimum is taken over all QBPs that compute ψHS .

#### 5.1.1. Upper bounds

Then from Theorem 2, we have the following corollary

#### Theorem 3

$$
overline{(\psi\_{H\_\mathcal{S}})} = O(\log|\log q|).\tag{41}$$

$$time(\psi\_{H\_S}) = O(\log \, q). \tag{42}$$

#### 5.1.2. Lower bounds

Here, we show that the quantum branching program from Theorem 2 is optimal for function ψHS

#### Theorem 4

$$
overline{(\psi\_{H\_\mathcal{S}})} = \Omega(\log|\log q|).\tag{43}$$

$$\text{time}(\psi\_{H\_\mathcal{S}}) = \Omega(\log \ q). \tag{44}$$

Author details

References

sity Press; 1995

839; 1977. pp. 842

Berlin; 1979. p. 57-69

Letters. 2001;87(16):167902

Computation. 2013;13(7–8):583-606

332-342

Farid Ablayev\* and Marat Ablayev

Kazan Federal University, Kazan, Russia

\*Address all correspondence to: fablayev@gmail.com

[1] Motwani R, Raghavan P. Randomized Algorithms. New York, USA: Cambridge Univer-

On Quantum Fingerprinting and Quantum Cryptographic Hashing

http://dx.doi.org/10.5772/intechopen.70692

33

[2] Rusins Freivalds. Probabilistic machines can use less running time. In: IFIP Congress. Vol.

[3] Freivalds R. Fast probabilistic algorithms. In: Becvar J, editor. Mathematical Foundations of Computer Science — Lecture Notes in Computer Science. Vol. 74. Heidelberg: Springer

[4] Andris Ambainis, Rusins Freivalds. 1-way quantum finite automata: Strengths, weaknesses and generalizations. In: Proceeding of the 39th IEEE Conference on Foundation of Computer Science, FOCS '98, Washington DC USA: IEEE Computer Society; 1998. pp.

[5] Buhrman H, Cleve R, Watrous J, Wolf R d. Quantum fingerprinting. Physical Review

[6] Gottesman D, IC. Quantum digital signatures technical report arXiv:Quant-ph/0105032 [7] Gavinsky D, Ito T. Quantum fingerprints that keep secrets. Quantum Information &

[8] Li D, Zhang J, Guo F-Z, Huang W, Wen Q-Y, Chen H. Discrete-time interacting quantum walks and quantum hash schemes. Quantum Information Processing. 2013;12(3):1501-1513

[9] Li D, Zhang J, Ma X-W, Zhang W-W, Wen Q-Y. Analysis of the two-particle controlled interacting quantum walks. Quantum Information Processing. 2013;12(6):2167-2176 [10] Yang Y-G, Peng X, Yang R, Zhou Y-H, Shi W-M. Quantum hash function and its application to privacy amplification in quantum key distribution, pseudo-random number gen-

[11] Ablayev F, Vasiliev A. Algorithms for quantum branching programs based on fingerprinting. Electronic Proceedings in Theoretical Computer Science. 2009;9:1-11

[12] Ambainis A, Nahimovs N. Improved constructions of quantum automata. In: Kawano Y, Mosca M, editors. Theory of Quantum Computation, Communication, and Cryptography — Lecture Notes in Computer Science. Vol. 5106. Berlin/Heidelberg: Springer; 2008. p. 47-56

eration and image encryption. Scientific Reports. 2016;6:19788

Proof. Let Q be a QBP for the function ψHS computation. ψHS presented by Q as follows:

$$\left\{\psi\_{\mathcal{H}\_{\mathcal{S}}} : \left\{ |\psi\_{0}\rangle\right\} \times \left\{ 0, 1 \right\}^{\log q} \to \left(\mathcal{H}^{2}\right)^{\otimes s}.\tag{45}$$

The lower bound (10) for width(ψHS ) follows immediately from Property 4

$$s \ge \log\_e \log q - \log \log \left( 1 + \sqrt{2/(1 - \varepsilon)} \right). \tag{46}$$

The lower bound (11) for time(ψHS ) follows from the fact that ψHS is collision ε-resistant function. Indeed, the assumption that QBP Q for ψHS can test less than logq (that is, not all logq) variables of inputs x ∈F<sup>q</sup> means existence of (at least) two different inputs w, w<sup>0</sup> ∈F<sup>q</sup> such that Q produces the same quantum hashes |ψ(w)〉 and |ψ(w<sup>0</sup> )〉 for w and w<sup>0</sup> , that is, |ψ(w)〉 = |ψ(w<sup>0</sup> )〉 = |ψ〉. The last contradicts to the fact that states |ψ(w)〉 and |ψ(w<sup>0</sup> )〉 are ε orthogonal.

$$|\langle \psi(w) | \psi(w') \rangle| \le \varepsilon. \tag{47}$$
