Sieving Xavier Bonnetain

André Chailloux

André Schrottenloher

Yixin Shen

Finding many Collisions via Reusable Quantum Walks Application to Lattice

Keywords: Quantum algorithms, quantum walks, collision search, lattice sieving

Abstract. Given a random function f with domain [2 n ] and codomain [2 m ], with m ≥ n, a collision of f is a pair of distinct inputs with the same image. Collision finding is an ubiquitous problem in cryptanalysis, and it has been well studied using both classical and quantum algorithms. Indeed, the quantum query complexity of the problem is well known to be Θ(2 m/3 ), and matching algorithms are known for any value of m. The situation becomes different when one is looking for multiple collision pairs. Here, for 2 k collisions, a query lower bound of Θ(2 (2k+m)/3 ) was shown by Liu and Zhandry (EUROCRYPT 2019). A matching algorithm is known, but only for relatively small values of m, when many collisions exist. In this paper, we improve the algorithms for this problem and, in particular, extend the range of admissible parameters where the lower bound is met. Our new method relies on a chained quantum walk algorithm, which might be of independent interest. It allows to extract multiple solutions of an MNRS-style quantum walk, without having to recompute it entirely: after finding and outputting a solution, the current state is reused as the initial state of another walk. As an application, we improve the quantum sieving algorithms for the shortest vector problem (SVP), with a complexity of 2 0.2563d+o(d) instead of the previous 2 0.2570d+o (d) .

Introduction

Quantum walks are a powerful algorithmic tool which has been used to provide state-of-the-art algorithms for various important problems in post-quantum ©IACR 2023. This article is the full version of the paper submitted by the authors to the IACR and to Springer-Verlag in February 2023. Part of this work was done while the author was at CWI, Amsterdam, The Netherlands.

cryptography, such as the shortest vector problem (SVP) via lattice sieving [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF], the subset sum problem [START_REF] Bonnetain | Improved classical and quantum algorithms for subset-sum[END_REF], information set decoding [START_REF] Kachigar | Quantum information set decoding algorithms[END_REF], etc.

These applications are all established under a particular quantum walk framework called the MNRS framework [START_REF] Magniez | Search via quantum walk[END_REF], and the quantum walks look for marked nodes in a so-called Johnson graph [START_REF] Kachigar | Quantum information set decoding algorithms[END_REF] (or a product of Johnson graphs). When walking on this particular graph, the MNRS framework is somewhat rigid. First, it requires to setup the uniform superposition of all nodes along with their attached data structure, then it applies multiple times reflection operators which move this quantum state close to the uniform superposition of all marked nodes.

Due to this rigidity, previously, the best way to find k different marked nodes was to run the whole quantum walk (including the setup) k times. In [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] the authors noticed that a way to output multiple solutions instead of a single one with quantum walks would improve the quantum time complexity of their algorithm for solving the SVP.

A natural observation which guides us throughout this paper is that in certain cases, after obtaining the uniform superposition of all marked nodes via the MNRS quantum walk, it is possible to retrieve part of the solution and start another MNRS quantum walk using the remaining part of the quantum state as the new starting state. By doing so, we avoid repeating the setup cost for each new quantum walk, and we now benefit from a trade-off.

In particular, using this observation, we tackle the following problem:

Problem 1 (Multiple collision search). Let f : {0, 1} n → {0, 1} m , n ≤ m ≤ 2n be a random function. Let k ≤ 2n -m. Find 2 k collision pairs, that is, pairs of distinct x, y such that f (x) = f (y).

The constraints on the input and output domain are such that a significant (Θ 2 2n-m ) number of collisions pairs exist in the random case. This problem has several applications both in asymmetric and symmetric cryptography. For example, the problem of finding multiple vectors close to a target vector, which appears in lattice sieving (as mentioned above) can be seen as a special case. The limited-birthday problem in symmetric cryptanalysis (e.g., impossible differential attacks and rebound distinguishers [START_REF] Hosoyamada | Improved attacks on sliscp permutation and tight bound of limited birthday distinguishers[END_REF]) is another example.

Lower Bounds. While quantum query lower bounds for the collision problem (with a single solution) had been known for a longer time, Liu and Zhandry proved more recently in [START_REF] Liu | On finding quantum multi-collisions[END_REF] a query lower bound in Ω 2 2k/3+m/3 to find 2 k solutions, which holds for all values of m ≥ n.

For relatively small values of k and m (precisely, k ≤ 3n -2m, as we explain in Section 6), the BHT collision search algorithm [START_REF] Brassard | Quantum cryptanalysis of hash and claw-free functions[END_REF] allows to reach this bound. Besides this algorithm, Ambainis' algorithm [START_REF] Ambainis | Quantum Walk Algorithm for Element Distinctness[END_REF] uses a quantum walk to find one collision in time O 2 m/3 . However, no matching algorithm was known for other values, neither in time nor in queries.

Contributions. Our main contribution in this paper is a chained quantum walk algorithm to solve the multiple collision search problem. We formalize the intuitive idea that the output state of a quantum walk can be reused, to some extent, as the starting state of another. For any admissible values of k, n, m such that k ≤ m 4 , our algorithm requires O 2 Theorem 4 (Section 4). Let f : {0, 1} n → {0, 1} m , n ≤ m ≤ 2n be a random function. Let k ≤ min(2n -m, m/4). There exists a quantum algorithm making O 2 2k/3+m/3 quantum queries to f and with a gate count O 2 2k/3+m/3 , that outputs 2 k collision pairs of f . By combining our algorithm with the BHT approach, we can now meet the lower bound over all values of k, n, m, except a range of (k, m) contained in n 3 , n × [n, 1.6n], as summarized in Figure 1. Nevertheless, our approach also improves the known complexities in this range. and n. Both our algorithm and the BHT approach can be extended to the whole triangle, but we show only the one achieving the best complexity. In the purple region (bottom left), both approaches reach the same complexity exponent 2k 3 + m 3 .

Using our new algorithm, we improve the state-of-the-art time complexity of quantum sieving to solve the SVP in [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] from 2 0.2570d+o(d) to 2 0.2563d+o(d) quantum gates. We also provide time-memory trade-offs that are conjectured to be tight [START_REF] Hamoudi | Quantum time-space tradeoff for finding multiple collision pairs[END_REF]: Theorem 7 (Section 4). Let f : {0, 1} n → {0, 1} m , n ≤ m ≤ 2n be a random function. For all k ≤ ≤ max(2n -m, m/2), there ex-ists an algorithm that computes 2 k collisions using O 2 qubits and O 2 k+m/2-/2 quantum gates and quantum queries to f . Organization. In Section 2 we provide several technical preliminaries on quantum algorithms, especially Grover's quantum search algorithm. Indeed, an MNRS quantum walk actually emulates a quantum search, and these results are helpful in analyzing the behavior of such a walk. In Section 3, we give important details on the MNRS framework, and in particular, the vertex-coin encoding, which is a subtlety often omitted from depictions of the framework in the previous literature. In Section 4 we detail our algorithm assuming a suitable quantum data structure is given, and in Section 5 we detail the quantum radix trees. While they were already proposed in [START_REF] Jeffery | Frameworks for Quantum Algorithms[END_REF], we give new (or previously omitted) details relative to the radix tree operations, memory allocation, and how we can efficiently and robustly extract collisions. We give a general summary of the multiple collision search problem in Section 6 and our applications in Section 7.

Preliminaries

In this section, we give some preliminaries on collision search, quantum algorithms and Grover search, which are important for the analysis of quantum walks and their data structures.

Collision Search

In this paper, we study the problem of collision search in random functions.

Problem 2. Let f : {0, 1} n → {0, 1} m (n ≤ m) be a random function. Find a collision of f , that is, a pair (x, y), x = y such that f (x) = f (y).

The case m < n can be solved by the same algorithms as the case m = n by reducing f to a subset of its domain. This is why in the following, we focus only on m ≥ n. The average number of collisions is O 2 2n-m . When m ≥ 2n, we can assume that exactly one collision exists, or none. Distinguishing between these two cases is the problem of element distinctness, which is solved by searching for the collision. In all cases, the collision problem can be solved in:

• Θ(2 m/2 ) classical time (and queries to f ). When m = n, the problem is the easiest, as it requires only O 2 n/2 time and poly(n) memory using Pollard's rho method. When m = 2n, the problem is harder since the best algorithm also uses Θ(2 n ) memory. • Θ(2 m/3 ) quantum time (and quantum queries to f ). A first algorithm was given by Brassard, Høyer and Tapp to reach this for m = n [START_REF] Brassard | Quantum cryptanalysis of hash and claw-free functions[END_REF], then the lower bound was proven to be Ω(2 m/3 ) [START_REF] Aaronson | Quantum lower bounds for the collision and the element distinctness problems[END_REF], and afterwards, Ambainis solved the element distinctness problem (the case m = 2n) by a quantum walk algorithm [START_REF] Ambainis | Quantum Walk Algorithm for Element Distinctness[END_REF] which can be adapted for any value of m.

In our case, we want to solve the problem of multiple collision search: as there will be expectedly many collisions in the outputs of f , we want to find a significant (exponential in n) number of them.

Problem 3. Let f : {0, 1} n → {0, 1} m , n ≤ m ≤ 2n, k ≤ 2n-m. Find 2 k distinct collisions of f .
Here the state of the art differ classically and quantumly:

• Classically, it is well known that the problem can be solved for any m and k in Θ(2 (k+m)/2 ) queries (as long as 2 k does not exceed the average number of collisions of f ). • Quantumly, Liu and Zhandry [START_REF] Liu | On finding quantum multi-collisions[END_REF] gave a query lower bound Ω(2 2k/3+m/3 ).

However, a matching algorithm is only known for small m. For example, this lower bound is matched for m = n by adapting the BHT algorithm [START_REF] Liu | On finding quantum multi-collisions[END_REF][START_REF] Hosoyamada | Improved quantum multicollision-finding algorithm[END_REF].

Note that we assume that the collision pairs are fully distinct. In the case m < n, k ≥ m, there are not enough distinct images, and we only obtain multicollision tuples. The lower bound of [START_REF] Liu | On finding quantum multi-collisions[END_REF] does not apply here. If m < n and k ≤ m, we restrict the inputs of the function to a set of size {0, 1} m , and this case is covered by a variant of the BHT algorithm. Thus, like in the case of a single collision, we will only consider n ≤ m.

On the Memory Complexity. For m = n, the best known classical algorithm for multiple collision-finding is the parallel collision search (PCS) algorithm by van Oorschot and Wiener [START_REF] Van Oorschot | Parallel collision search with cryptanalytic applications[END_REF]. It generalizes Pollard's rho method which finds a single collision in O 2 n/2 time and poly(n) memory. Dinur [START_REF] Dinur | Tight time-space lower bounds for finding multiple collision pairs and their applications[END_REF] showed that in this regime, the time-space trade-off of the PCS algorithm is optimal. Using a restricted model of computation, it can also be shown optimal for larger values of m.

Quantumly, a time-space lower bound of T 3 S ≥ Ω 2 3k+m has been shown [START_REF] Hamoudi | Quantum time-space tradeoff for finding multiple collision pairs[END_REF]. However, the authors conjecture this bound can be improved to T 2 S ≥ Ω 2 2k+m . All known quantum algorithms for collisions, including our new algorithms, match this conjectured lower bound.

Quantum Algorithms

We refer to [START_REF] Nielsen | Quantum computation and quantum information[END_REF] for an introduction to quantum computation. We write our quantum algorithms in the standard quantum circuit model, where algorithms are written as a sequence of standard quantum gates. We are interested in the minimal achievable gate count. This means that we do not consider any parallelization trade-offs, even though there is some literature on the topic for SVP algorithms [START_REF] Kirshanova | Quantum algorithms for the approximate k-list problem and their application to lattice siev-ing[END_REF]. By default, we use the (universal) Clifford+T gate set, although our complexity analysis remains asymptotic, and we do not detail our algorithms at the gate level.

Memory Models. Many memory-intensive quantum algorithms require some kind of quantum random-access model (qRAM), which can be stronger than the standard quantum circuit model. One can encounter two types of qRAM:

• Classical memory with quantum random access (QRACM): a classical memory of size M can be addressed in quantum superposition in polylog(M ) operations. • Quantum memory with quantum random access (QRAQM): M qubits can be addressed in quantum superposition in polylog(M ) operations.

The QRAQM model is required by most quantum walk based algorithms for cryptographic problems, e.g., subset-sum [START_REF] Bernstein | Quantum algorithms for the subset-sum problem[END_REF][START_REF] Bonnetain | Improved classical and quantum algorithms for subset-sum[END_REF], information set decoding [START_REF] Kachigar | Quantum information set decoding algorithms[END_REF] and the most recent quantum algorithm for lattice sieving [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF]. It requires to augment the set of gates available with a "qRAM" gate addressing all M memory cells (e.g., individual bits) in superposition. In this paper, we use a definition taken from [START_REF] Ambainis | Quantum Walk Algorithm for Element Distinctness[END_REF]:

|y 1 , . . . , y M |x |i qRAM ---→ |y 1 , . . . , y i-1 , x, y i+1 , . . . y M |y i |i . (1)
This operation implies the ability to read in superposition by querying the cell at index i, but also to write. This is necessary for efficient data structures such as the ones studied in [START_REF] Ambainis | Quantum Walk Algorithm for Element Distinctness[END_REF] or the quantum radix trees from the literature (see Section 5).

While the qRAM gate can be simulated with O (M ) Clifford+T gates, in the following, the gate count of our algorithms is given asymptotically on the "Clifford + T + qRAM" gate set, so we assume the qRAM has unit cost, as is required by previous works.

Collision Finding without qRAM. To date, the best quantum algorithms for collision finding, and the ones that reach the query lower bound, require the qRAM model: the BHT algorithm [START_REF] Brassard | Quantum cryptanalysis of hash and claw-free functions[END_REF] uses QRACM and Ambainis' quantum walk uses QRAQM [START_REF] Ambainis | Quantum Walk Algorithm for Element Distinctness[END_REF] to define gate-efficient quantum data structures. Initially Ambainis used a skip list. We will focus on the more recent quantum radix tree, but the QRAQM requirement remains the same.

To some extent, it is possible to get rid of qRAM. For m = n, the complexity rises from O 2 m/3 to O 2 2m/5 gates [START_REF] Chailloux | An efficient quantum collision search algorithm and implications on symmetric cryptography[END_REF]. For m = 2n, the complexity rises to O 2 3m/7 [START_REF] Jaques | Low-gate quantum golden collision finding[END_REF]. These algorithms can also be adapted for multiple collision finding, where they will outperform the classical ones for some parameter ranges (but not all).

Grover's Algorithm

In this section, we recall Grover's quantum search algorithm [START_REF] Grover | A Fast Quantum Mechanical Algorithm for Database Search[END_REF] and give a few necessary results for the rest of our analysis. Indeed, as shown in [START_REF] Magniez | Search via quantum walk[END_REF], an MNRS quantum walk actually emulates a quantum search, up to some error. If we manage to put this error aside, the analysis of the walk follows from the following lemmas.

Original Quantum Search. In the original setting of Grover's search, we have a function g : {0, 1} n → {0, 1} and the goal is to find x st. g(x) = 1 using queries to g. In the quantum setting, we have access to the unitary O g : |x |b → |x |b ⊕ g(x) , which is an efficient quantum unitary if g is efficiently computable. In particular we can compute

|ψ U = 1 √ 2 n x∈{0,1} n |x |g(x) with a single call to O g . Let ε = |{x:g(x)=1}| 2 n
. We also define the normalized states

|ψ B = 1 (1 -ε)2 n x:g(x)=0 |x |g(x) , |ψ G = 1 √ ε2 n x:g(x)=1
|x |g(x)

and |ψ U = √ 1 -ε |ψ B + √ ε |ψ G . Let H = span({|ψ B , |ψ G }).
Let Rot θ be the θ-rotation unitary in H:

Rot θ (cos(α) |φ B + sin(α) |ψ G ) = cos(α + θ) |ψ B + sin(α + θ) |ψ G .
For a fixed ε, let α = arcsin( √ ε) so that

|φ U = √ 1 -ε |ψ B + √ ε |ψ G = cos(α) |ψ B + sin(α) |ψ G ,
For a state |ψ ∈ H, let Ref |ψ be the reflection over |ψ in H:

Ref |ψ |ψ = |ψ and Ref |ψ ψ ⊥ = -ψ ⊥
where ψ ⊥ is any state in H orthogonal to |ψ 5 We have

Ref |ψ U Ref |ψ B = Rot 2α .
Assume that we have access to a checking oracle O check which performs:

O check |ψ B |0 = |ψ B |0 O check |ψ G |0 = |ψ G |1
In the standard setting described above, this is just copying the last register. Starting from an "initial state" |ψ U , we apply repeatedly an iterate consisting of a reflection over |ψ U , and a reflection over |ψ B . This progressively transforms the current state into the "good state" |ψ G . Typically Ref |ψ U is constructed from a circuit that computes |ψ U and Ref |ψ B is implemented using the checking oracle above: in that case, we are actually performing an amplitude amplification [START_REF] Brassard | Quantum amplitude amplification and estimation[END_REF].

Proposition 1 (Grover's algorithm, known α). Consider the following algorithm, with α ≤ π/4:

1. Start from |ψ U . 2. Apply Rot 2α = Ref |ψ U Ref |ψ B N times on |ψ U with N = π/2-α 2α .
3. Apply O check and measure the last qubit. This procedure measures 1 wp. at least 1 -4α 2 and the resulting state is |ψ G .

Proof. Let us define γ = α + 2N α. We have

(Rot 2α ) n |ψ U = cos(α+2N α) |ψ B +sin(α+2N α) |ψ G = cos(γ) |ψ B +sin(γ) |ψ G . Notice that we chose N st. γ ≤ π 2 < γ + 2α so π 2 -γ ∈ [0, 2α
). After applying the checking oracle, we obtain the state

cos(γ) |ψ B |0 + sin(γ) |ψ G |1 .
Measuring the last qubit gives outcome 1 with probability sin 2 (γ) and the resulting state in the first register is |ψ G . In order to conclude, we compute

sin 2 (γ) = cos 2 (π/2 -γ) ≥ cos 2 (2α) ≥ 1 -4α 2 .
In our algorithms, we will start not from the uniform superposition |ψ U , but from the bad subspace |ψ B . We show that this makes little difference.

Proposition 2 (Starting from |ψ B , known α). Consider the following algorithm, with α ≤ π/4:

1. Start from |ψ B . 2. Apply Rot 2α = Ref |ψ U Ref |ψ B N times on |ψ B with N = π/2
2α . 3. Apply the checking oracle and measure the last qubit. This procedure measures 1 with probability at least 1-4α 2 and the resulting state is |ψ G .

Proof. The proof is essentially the same as the previous one. Let γ = 2N α. We have

(Rot 2α ) N |ψ B = cos(2N α) |ψ B +sin(2N α) |ψ G = cos(γ ) |ψ B +sin(γ ) |ψ G .
Notice that we chose N st. γ ≤ π 2 < γ + 2α so π 2 -γ ∈ [0, 2α). After applying the checking oracle, we obtain the state

cos(γ ) |ψ B |0 + sin(γ ) |ψ G |1 .
Measuring the last qubit gives 1 wp. sin 2 (γ ) and the resulting state in the first register is |φ G . In order to conclude, we compute

sin 2 (γ ) = cos 2 (π/2 -γ ) ≥ cos 2 (2α) ≥ 1 -4α 2 .
After applying the check and measuring, if we don't succeed, we obtain the state |ψ B again. So we can run the quantum search again.

In Grover's algorithm, we have a procedure to construct |ψ U and we use this procedure to initialize the algorithm and to perform the operation Ref |ψ U . A quantum walk will have the same general structure as Grover's algorithm, but we will manipulate very large states |ψ U . Though |ψ U is long to construct (the setup operation), performing Ref |ψ U will be less costly.

In the MNRS framework, |ψ U is chosen as the unique eigenvector of eigenvalue 1 of an operator related to a random walk in a graph. To perform Ref |ψ U efficiently, we use phase estimation on this operator.

Quantum Walks for Collision Finding

In this section, we present MNRS quantum walks, which underlie most cryptographic applications of quantum walks to date, and give important details on their actual implementation using a vertex-coin encoding.

Definition and Example

We consider a regular, undirected graph G = (V, E), which in cryptographic applications (e.g., collision search), is usually a Johnson graph (as in this paper) or a product of Johnson graphs (a case detailed e.g. in [START_REF] Kachigar | Quantum information set decoding algorithms[END_REF]).

Definition 1 (Johnson graph). The Johnson graph J(N, R) is a regular, undirected graph whose vertices are the subsets of [N ] containing R elements, with an edge between two vertices v and v iff |v ∩ v | = R -1. In other words, v is adjacent to v if v can be obtained from v by removing an element and adding an element from [N ]\v in its place.

In collision search, a vertex in the graph specifies a set of R inputs to the function f under study, where its domain {0, 1} n is identified with [2 n ]. Let M ⊆ V be a set of marked vertices, e.g., all the subsets S ⊆ {0, 1} n which contain a collision of f : ∃x, y ∈ S, x = y, f (x) = f (y). A classical random walk on G finds a marked vertex using Algorithm 1. [START_REF] Magniez | Search via quantum walk[END_REF] show how to translate this generically in the quantum setting, provided that quantum analogs of these operations (SETUP, UPDATE, CHECK) can be implemented.

Theorem 1 (From [START_REF] Magniez | Search via quantum walk[END_REF]). Assume that quantum algorithms SETUP, UP-DATE and CHECK are given. Then there exists a quantum algorithm that finds a marked vertex with gate count:

O S + 1 √ ε 1 √ δ U + C instead of O 1 √ ε (S + C) with a naive search.
Using this framework generically, we can recover the complexity of Ambainis' algorithm for collision search: O 2 m/3 for any codomain bit-size m. We use the Johnson graph J(2 n , 2 m/3 ). Its spectral gap is approximately 2 -m/3 . A vertex is marked if and only if it contains a collision, so the probability of being marked is approximately 2 2m/3-m = 2 -m/3 . Using a quantum data structure for unordered sets, we can implement SETUP in gate count O 2 m/3 , UPDATE and CHECK in poly(n). The formula of Theorem 1 gives the complexity O 2 m/3 .

Details of the MNRS Framework

In the d-regular graph G = (V, E), for each x ∈ V , let N x be the set of neighbors of x, of size d. In the case G = J(N, R), we have d = R(N -R). For a vertex x, let |x be an arbitrary encoding of x as a quantum state, let D(x) be a data structure associated to x, and let | x = |x |D(x) .

Remark 1. The encoding of x is commonly thought of as the set itself, and the data structure as the images of the set by f . But whenever we look at quantum walks from the perspective of gate count (and not query complexity), an efficient quantum data structure is already required for x itself, i.e., an unordered set data structure in the case of a Johnson graph, and one cannot really separate x from D(x). This is why we will favor the notation | x .

For a vertex x, let |p x be the uniform superposition over its neighbors: From now on, we consider a walk on edges rather than vertices in the graph, and introduce: To reflect over |ψ U , we perform a phase estimation of the unitary W , which allows to separate the part with eigenvalue 1, from the part with eigenvalue e iθ with θ ∈ [2 √ δ, π/2]. The phase estimation circuit needs to call W a total of

|p x = 1
             |ψ U = 1 √ |V | x∈V | x
O 1 √ δ
times to estimate θ up to sufficient precision. It has some error, which can be made insignificant with a polynomial increase in complexity; thus in the following, we will consider the reflection Ref U to be exact.

To construct W , we need to implement Ref A and Ref B . We first remark that:

Ref B = SWUP • Ref A • SWUP , (2)
where SWUP | x |y = | y |x . This SWUP (Swap-Update) operation can furthermore be decomposed into an update of the database (UP D ) followed by a register swap:

| x |y = |x |D(x) |y UP D ---→ |x |D(y) |y Swap ---→ |y |D(y) |x = | y |x , (3)
so SWUP = Swap • UP D . We would then implement Ref A using an update unitary that, from a vertex x, constructs the uniform superposition of neighbors. However this would require us to write log 2 (|V |) data, and in practice, |V | is doubly exponential (the vertex is represented by an exponential number of bits). Thankfully, in d-regular graphs, and in particular in Johnson graphs, we can avoid this loophole by making the encoding of edges more compact. Instead of storing a pair of vertices (x, y), which will eventually result in having to rewrite entire vertices, we can store a single vertex and a direction, or coin.

Vertex-coin Encoding

The encoding is a reversible operation: O Enc | x |y = | x |c x→y , which compresses an edge (x, y) by replacing y by a much smaller register of size log 2 (d) . Note that we only need the existence of such a circuit. We never use it during the algorithms; all operations are directly performed using the compact encoding.

Let Enc . So we define

ψ coin Unif = 1 √ d c |c
     Ref A = I ⊗ Ref |ψ coin Unif = O Enc • Ref A • O -1 Enc Ref B = SWUP • Ref A • SWUP = O Enc • Ref B • O -1 Enc W = Ref B • Ref A (4)
By putting everything together, we have

W = O Enc • W • O -1 Enc .
Since O Enc is a unitary operator, W and W are unitarily equivalent, i.e., they have the same eigenvalues. Thus, Proposition 3 applies to W the same as it does to W , and gives its spectral properties. We can perform phase estimation on W , and combine afterwards with Proposition 1. Since constructing the uniform superposition of coins is trivial, all relies on the unitary SWUP .

Theorem 2 (MNRS, adapted). Let | x be an encoding of the vertex x (incl. data structure) and assume that a vertex-coin encoding is given. Let α = arcsin √ ε.

Starting from the state:

1 √ |V | x∈V | x ψ coin Unif , apply π/2-α 2α
iterates of: • a checking procedure which flips the phase of marked vertices; • a phase estimation of W ; then apply the checking again and measure. With probability at least 1 -4α 2 , we measure 1 and collapse on the uniform superposition of marked vertices.

Finally, we can adapt this analysis by starting from the bad vertices, with a proof that is the same as Proposition 2. This will be the main building block of our new algorithm. iterates of: • a checking procedure which flips the phase of marked vertices;

• a phase estimation of W ; then apply the checking again and measure. With probability at least 1 -4α 2 , we measure 1 and collapse on the uniform superposition of marked vertices. Otherwise, we collapse on the uniform superposition of unmarked vertices.

Coins for a Johnson Graph. In a Johnson graph J(N, R), a coin c = (j, z) is a pair where:

• j ∈ [R]
is the index of the element that will be removed from the current vertex (given an arbitrary ordering, e.g. the lexicographic ordering of bitstrings).

• z ∈ [N -R]
is the index of an element that does not belong to the current vertex, and will be added as a replacement.

A Chained Quantum Walk to Find Many Collisions

In this section, we prove our main result.

Theorem 4. Let f : {0, 1} n → {0, 1} m , n ≤ m ≤ 2n be a random function. Let k ≤ min(2n -m, m/4). There exists a quantum algorithm making O 2 2k/3+m/3 quantum queries to f and using O 2 2k/3+m/3 Clifford+T+qRAM gates, that outputs 2 k collision pairs of f .

Our new algorithm, which is detailed in Section 4.1 and Section 4.2, solves the case k ≤ m 4 . The case k ≤ 2n -m was already solved by adapting the BHT algorithm, as detailed in Section 6.

Note that if we are only interested in the query complexity, our technique is still necessary to improve over previous results, but the radix tree data structure that we detail in Section 5 can be replaced by a simple ordered list with expensive update operations (see [START_REF] Jaques | Quantum cryptanalysis in the RAM model: Claw-finding attacks on SIKE[END_REF]).

New Algorithm

We detail here our chained quantum walk algorithm. Recall that the Johnson graph J(N, R) is the regular, undirected graph whose vertices are subsets of size R of [N ], and edges connect each pair of vertices which differ in exactly one element. We identify [N ] with {0, 1} n , the domain of f .

We assume that an efficient quantum unordered set data structure is given, which makes vertices in the Johnson graph correspond to quantum states, while allowing to implement efficiently the operations required for the MNRS quantum walks. It will be detailed in Section 5. In the following we write |S for the quantum state corresponding to a set S.

Idea of Our Algorithm. After running a quantum walk on a Johnson graph, we obtain a superposition of vertices which contain a collision. We remove the collision from the vertex, and we measure the elements that form this collision: we still obtain a superposition of sets, which might be exploited for the next walk. The sets in this superposition have a very important property: because we just removed the collision (more generally, we will remove all collisions that the vertex contains), they actually do not contain one with certainty. Thus, we do not have the uniform superposition of vertices of our next MNRS walk, but the uniform superposition of unmarked vertices. However, we have seen that this made little difference, and we can continue using Theorem 3. When we measure the result of a walk step, it will succeed with at least constant probability. In the case of failure, we collapse on the superposition of unmarked vertices again, which means we simply have to restart the walk. The extraction of collisions modifies the walk parameters (vertex size, graph, marked vertices) in a way that we track throughout the algorithm, and is detailed below.

Technical Details. Let C be a table in classical memory of all the multi-collisions found so far. This table contains entries of the form: u : (x 1 , . . . , x r ) where f (x 1 ) = . . . = f (x r ) = u forms a multicollision of f , indexed by the image. We define the size of C, its set of preimages and its set of images:

Given the table C, given a size parameter R, we define the two sets of sets:

     V C R := {S ⊆ ({0, 1} n \Preim(C)) , |S| = R} M C R := {S ⊆ ({0, 1} n \Preim(C)) , |S| = R, (∃x = y ∈ S, f (x) = f (y) ∨ ∃z ∈ S, f (z) ∈ Im(C))} (6)
The first one will be the set of vertices for the current walk, and the second one its set of marked vertices. As we can see, the current walk excludes a set of previously measured inputs, and a vertex is marked if it leads to a new collision, or to a preimage of one of the previously measured images. The second case simply extends one of the currently known multicollision tuples. The probability for a vertex to be marked can be easily computed, and we just need to bound it as follows:

max R|Im(C)| 2 m , R(R -1) 2 m+1 ≤ ε R,C ≤ R|Im(C)| 2 m + R(R -1) 2 m+1 ,
since any vertex containing a collision, or a preimage from the table C, is marked.

In Section 5, we will show that with an appropriate data structure, there exists an extraction algorithm EXTRACT which does the following:

EXTRACT : C, R, 1
|M C R | S∈M C R |S → C , R , 1
|V C R \M C R | S∈V C R \M C R |S ,
where R = R -r for some value r, and C contains exactly r new elements (collisions adding new entries, or preimages going into previous entries). Thus, EXTRACT transforms the output of a successful walk into the set of unmarked vertices for the next walk.

We can now give Algorithm 2, depending on a tunable parameter .

Complexity Analysis

Theorem 5 (Time-memory tradeoff ). For all k ≤ ≤ min(2k/3+m/3, m/2), Algorithm 2 computes 2 k collisions using O 2 qubits and O 2 k+m/2-/2 Clif-ford+T+qRAM gates.

Proof. We start by noticing that although Algorithm 2 outputs a set of multicollisions rather than collisions, the number of collisions and multicollisions that are actually obtained are closely related. Indeed, for a function from [2 n ] to [2 n ], there is a polynomial (in n) limit to the width of multicollisions that can appear for a non-negligible fraction of the functions. Indeed, by Theorem 4

Algorithm 2: Chained quantum walk algorithm for multiple collisions.

Input: quantum access to f : {0, 1} n → {0, 1} m , parameter k Output: a table of multicollisions C such that |Im(C)| ≥ 2 k C ← ∅, R ← 2 /*
S∈V C R \M C R
|S for the previous R and C. There is nothing to extract from it, C and R remain unchanged.

*/ return C in [START_REF] Flajolet | Random mapping statistics[END_REF], the average number of r-collisions in such a random function is 2 n e -1 r! . Thus, there exists a universal constant c such that with probability 1 -o(2 -n ), such a random function does not have any r-collision with r ≥ cn.

This means that regardless of the state of the current table C, we have:

|Im(C)| ≤ |Preim(C)| ≤ cn|Im(C)| .
In particular, by taking 2 greater than cn2 k+1 , we ensure that during the algorithm, R > 2 -1 . This means that we never run out of elements. Secondly, we can bound ε R,C ≥ R(R-1) 2 m+1 . This allows to upper bound easily the time complexity of any of the walks: if the current vertex size is R then it runs for O 2 m/2 /R iterates, and each iterate contains O √ R operations. The constants in the O are the same throughout the algorithm. This means that we can upper bound the complexity of each walk by O 2 m/2 / √ R ≤ O 2 m/2-/2 . By Theorem 3, the success probability of this walk is bigger than 1 -4ε R,C . If we do not succeed, the CHECK followed by a measurement make the current state collapse again on the superposition of unmarked vertices, and we run the exact same walk again. Note that for this algorithm to work, we must have ε R,C < 0.5. This corresponds to the probability that the list contains a collision, or a new preimage of Im(C), which is O 2 2 -m . Hence, we must have ≤ m/2.

Then, as ≤ 2k/3 + m/3, the final complexity of the algorithm is

O 2 + 2 k 2 m/2-/2 = O 2 k+m/2-/2 ,
where 2 is the cost of the SETUP, and the second term accounts for all the walk steps.

Quantum Radix Trees and Extractions

In this section, we detail the quantum radix tree data structure, a historyindependent unordered set data structure introduced in [START_REF] Jeffery | Frameworks for Quantum Algorithms[END_REF]. We show that it allows to perform, exactly and in a polynomial number of Clifford+T+qRAM gates, the two main operations required for our walk: SWUP and EXTRACT.

We describe these operations in pseudocode, while ensuring that they are reversible and polynomial.

Logical Level

Following [START_REF] Jeffery | Frameworks for Quantum Algorithms[END_REF], the quantum radix tree is an implementation of a radix tree storing an unordered set S of n-bit strings. It has one additional property: its concrete memory layout is history-independent. Indeed, there are many ways to encode a radix tree in memory, and as elements are inserted and removed, we cannot have a unique bit-string T (S) representing a set S. We use instead a uniform superposition of all memory layouts of the tree, which makes the quantum state |T (S) unique, and independent of the order in which the elements were inserted or removed. Only the entry point (the root) has a fixed position. We separate the encoding of S into |T (S) in two levels: first, a logical level, in which S is encoded as a unique radix tree R(S); second, a physical level, in which R(S) is encoded into a quantum state |T (S) . The logical mapping S → R(S) is standard.

Definition 2 (From [START_REF] Jeffery | Frameworks for Quantum Algorithms[END_REF]). Let S be a set of n-bit strings. The radix tree R(S) is a binary tree in which each leaf is labeled with an element of S, and each edge with a substring, so that the concatenation of all substrings on the path from the root to the leaf yields the corresponding element. Furthermore, the labels of two children of any non-leaf node start with different bits.

By convention, we put the "0" bit on the left, and "1" on the right. In addition to the n-bit strings stored by the tree, we append to each node the value of an -bit invariant which can be computed from its children, and depends only on the logical structure of the radix tree, not its physical structure. Typically the invariant can count the number of elements in the tree.

Memory Representation

We now detail the correspondence from R(S) to |T (S) . We suppose that a quantum bit-string data structure is given, that handles bit-strings of length between 0 and n and performs operations such as concatenation, computing shared prefixes, testing if the bit-string has a given prefix, in time poly(n).

State of the Memory. We suppose that O (M n) qubits of memory are given, where M ≥ R will be set later on. We divide these qubits into M cells of O (n) qubits each, which we index from 0 to M -1. We encode cell addresses on m = log 2 M + 1 bits, and we also define an "empty" address ⊥. Each cell will be either empty, or contain a node of the radix tree, encoded as a tuple (i, a l , a r , l , r ) where:

• i is the value of the invariant • a l and a r (m-bit strings) are respectively the memory addresses of the cells holding the left and right children, either valid indices or ⊥. A node with a l = a r = ⊥ is a leaf. • l and r are the labels of the left and right edges. (ε if the node is a leaf, where ε is the empty string).

In other words, we have added to the tree R(S) a choice of memory locations for the nodes, which we name informally the memory layout of the tree. The structure of R(S) itself remains independent on its memory layout.

The root of the tree is stored in cell number 0. In Figure 3, we give an example of a memory representation of the tree R(S) of Figure 2. We take as invariant the number of leaves which, at the root, gives the number of elements in the set. It is important to note that memory cells have an "empty" default state, which allows the radix tree to support size changes. Whether a cell is empty or not depends on the memory layout.

A radix tree encoding a set of size R contains 2R -1 nodes (including the root), which means that we need (a priori) no more than M = 2R -1 cells in our memory. In addition to the bit-strings x, we could add any data d x to which x serves as a unique index. (This means adding another register which is nonempty for leaf nodes only). Finally, it is possible to account for multiplicity of elements in the tree by adding multiplicity counters, but since this is unnecessary for our applications, we will stick to the case of unique indices.

(5, 1, 2, 00, 1)

(2, 3, 4, 00, 10)

(1, ⊥, ⊥, ε, ε) (1, ⊥, ⊥, ε, ε) (3, 5, 7, 0, 111)
(2, 8, 9, 01, 11) Definition. Let S be a set of size R, encoded in a radix tree with 2R-1 nodes. We can always take an arbitrary ordering of the nodes in the tree, for example the lexicographic ordering of the paths to the root (left = 0, right = 1). This means that, for any sequence of non-repeating cell addresses I, of length 2R -1, we can define a mapping: S, I → T I (S) which specifies the writing of the tree in memory, by choosing the addresses I = (i 1 = 0, . . . , i 2R-1 ) for the elements. For example, the tree of Figure 3 would correspond to the sequence (0, 1, 3, 4, 2, 5, 8, 9, 7). We can then define the quantum radix tree encoding S as the quantum state:

(1, ⊥, ⊥, ε, ε) (1, ⊥, ⊥, ε, ε) (1, ⊥, ⊥, ε, ε)
|T (S) = valid sequences I |T I (S) , (7)
where we take a uniform superposition over all valid memory layouts.

For two different sets S and S , and for any pair I, I (even if I = I), we have T I (S) = T I (S ): the encodings always differ. This means that, as expected, we have T (S)|T (S ) = 0.

Memory Allocator. In order to maintain this uniform superposition over all possible memory layouts, we need an implementation of a memory allocator. This unitary ALLOC takes as input the current state of the memory, and returns a uniform superposition over the indices of all currently unoccupied cells. Possible implementations of ALLOC are detailed in Section 5.4.

Basic Operations

We show how to operate on the quantum radix trees in poly(n) Clifford+T +qRAM gates. We start with the basics: lookup, insertion and deletion.

Lookup. We define a unitary LOOKUP which, given S and a new element x, returns whether x belongs to S:

LOOKUP : |x |T (S) |0 → |x |T (S) |x ∈ S . ( 8
)
Algorithm 3: LOOKUP as a classical algorithm.

Input: element x, quantum radix tree T (S) Output: whether x ∈ S (i, a l , ar, l , r ) ← root y ← ε (empty string) while a l = ⊥ (node is not a leaf ) do if y|| l is a prefix of x then y ← y||a l (i, a l , ar, l , r ) ← node at address a l else if y|| r is a prefix of x then y ← y||a l (i, a l , ar, l , r ) ← node at address ar else Break (not a solution)

return true if y = x
We implement LOOKUP by descending in the radix tree R(S); the pseudocode is given in Algorithm 3. Since the "while" loop contains at most n iterates, quantumly these n iterates are performed controlled on a flag that says whether the computation already ended. After obtaining the result, they are recomputed to erase the intermediate registers.

Insertion. We define a unitary INSERT, which, given a new element x, inserts x in the set S. If x already belongs to S, its behavior is unspecified.

INSERT : |x |T (S) → |x |T (S ∪ {x}) . ( 9
)
The implementation of INSERT is more complex, but the operation is still reversible. The pseudocode is given in Algorithm 4. At first, we find the point of insertion in the tree, then we call ALLOC twice to obtain new memory addresses for two new nodes. We modify locally the layout to insert these new nodes, including a new leaf for the new element x. Then, we update the invariant on the path to the new leaf. Finally, we uncompute the path to the new leaf (all the addresses of the nodes on this path). To do so, we perform a loop similar to LOOKUP, given the knowledge of the newly inserted element x.

Deletion. The deletion can be implemented by uncomputing INSERT, since it is a reversible operation. It performs:

INSERT † : |x |T (S ∪ {x}) → |x |T (S) . (10)
The deletion of an element that is not in S is unspecified.

Quantum Lookup. We can implement a "quantum lookup" unitary QLOOKUP which produces a uniform superposition of elements in S having a specific property P . The only requirement is that the invariant of nodes has to store the Algorithm 4: INSERT as a classical algorithm.

Input: element x, quantum radix tree T (S) Output: element x, quantum radix tree T (S ∪ {x}) Find the first node j1 : (i, a l , ar, l , r ) such that y is a prefix of x, y|| l is not a prefix of x and y|| r is not a prefix of x either. Write all the addresses of the nodes on the path from the root to j1 /* If at this point we have found that the element belongs to S instead, then the rest of the computation is meaningless. */ /* By construction l starts with 0 and r starts with 1. One of them shares a non-empty prefix z with the remaining part of x.

Without loss of generality, we assume that it is l . */ Let l = z||t and x = y||z||x Call ALLOC to obtain an address j2 Replace a l with j2 in the node j1 : (i, a l , ar, l , r ) (move a l to a temporary register) Call ALLOC to obtain an address j3 Write at address j3: ( * , ⊥, ⊥, ε, ε) /* Information at this point: x, a l , j2, j3, the path to j1 and the tree */ if t starts with 0 then Move a l and cut l to modify the two nodes in positions j1 and j2 as follows: j1 : (i, j2, ar, z, r ) and j2 : ( * , a l , j3, t, x ). else Move a l and cut l to modify the two nodes in positions j1 and j2 as follows: j1 : (i, j2, ar, z, r ) and j2 : ( * , j3, a l , t, x ).

/* We make this choice so that the left edge is always labeled starting with a 0 and the right edge with a 1 */ /* Since we have moved j3 and a l , the remaining information is: x, the modified tree, j2 and the path to j1 (actually the path to x in the new tree) */ Recompute the invariants on the path to x, in reverse order (starting from the address j2). /* The recomputation of the invariants is reversible (but we still know the path to x) */ Do a lookup of x to uncompute the path to x. /* Now the only information that remains is x, T (S ∪ {x}).

*/ number of nodes in the subtree having this property (and so, leaf nodes will indicate if the given x satisfies P (x) or not).

QLOOKUP :

|T (S) |0 → |T (S) x∈S|P (x) |x . ( 11
)
This unitary is implemented by descending in the tree coherently (i.e., in superposition over the left and right paths) with a weight that depends on the number of solutions in the left and right subtrees. First, we initialize an address register |a to the root. Then, for n times (the maximal depth of the tree), we update the current address register as follows:

• We count the number of solutions in the left and right subtrees of the node at address |a (say, t l and t r ).

• We map |a to |a t l t l +tr |left child of a + tr t l +tr |right child of a . (We do nothing if |a is a leaf).
In the end, we obtain a uniform superposition of the paths to all elements satisfying P . We can query these elements, then uncompute the paths using an inverse LOOKUP. Likewise, we can also perform a quantum lookup of pairs satisfying a given property, e.g., retrieve a uniform superposition of all collision pairs in S.

Quantum Memory Allocators

We now define the unitary ALLOC, which given the current state of the memory, creates the uniform superposition of unallocated cells:

ALLOC : |current memory |0 → |current memory i unoccupied |i . (12)
We do not need to define a different unitary for un-allocation; we only have to recompute ALLOC to erase the addresses of cells that we are currently cleaning.

To implement ALLOC, we add to each memory cell a flag indicating if it is allocated. We propose two approaches.

Quantum search allocation. Classically, we can allocate new cells by simply choosing addresses at random and checking if they are already allocated or not. Quantumly, we can follow this approach using a quantum search over all the cells for unallocated ones. Obviously, for this approach to be efficient, we need the proportion of unallocated cells to be always constant. Besides, if we keep a counter of the number of allocated cells (which does not vary during our quantum walk steps anyway), we can make this operation exact using Amplitude Amplification (Theorem 4 in [START_REF] Brassard | Quantum amplitude amplification and estimation[END_REF]). Indeed, this counter gives the proportion of allocated cells, so we know exactly the probability of success of the amplified algorithm.

We can implement this procedure with a single iteration of quantum search as long as we have a 33% overhead on the maximal number of allocated cells (similarly to the case of searching with a single query studied in [START_REF] Chi | Quantum database search by a single query[END_REF]).

Quantum tree allocation. A more standard, but less time-efficient approach to implement ALLOC is to organize the memory cells in a complete binary tree (a heap), so that each node of the tree stores the number of unallocated cells in its children. This tree is not a quantum radix tree, since its size never changes, and no elements are inserted or removed. In order to obtain the uniform superposition of free cell addresses, we mimic the approach of QLOOKUP.

Higher-level Operations for Collision Walks

We now implement efficiently the higher-level operations required by our algorithms: setting up the initial vertex (SETUP), performing a quantum walk update (SWUP ), looking for collisions (CHECK) and extracting them (EXTRACT).

Representation. We consider the case of (multi-)collision search. Here the set S is a subset of [N ] = {0, 1} n , but we also need to store the images of these elements by the function f : {0, 1} n → {0, 1} m . Let F = {f (x)||x, x ∈ S}. A collision of f is a pair (f (x)||x), (f (y)||y) such that f (x) = f (y), i.e., the bit-strings have the same value on the first m bits.

Since our goal is to retrieve efficiently the collision pairs, we will store both a radix tree T (S) to keep track of the elements, and T (F ) to keep track of the collisions. One should note that the sets F and S have the same size. When inserting or deleting elements, we insert and delete both in T (S) and T (F ). These trees are stored in two separate chunks of memory cells.

SETUP. The unitary SETUP starts from an empty state |0 and initializes the tree to a uniform superposition of subsets of a given set. As long as sampling uniformly at random from this set is efficient, we can implement SETUP using a sequence of insertions in a tree that starts empty. SWUP'. We show an efficient implementation of the unitary SWUP :

SWUP |T (S) |T (F ) |c S→S = |T (S ) |T (F ) |c S →S (13)
Where c S→S is the coin register which contains information on the transition of a set S to a set S . As we have detailed before, the coin is encoded as a pair (j, z) where j ∈ [R] is the index of an element in S, which has to be removed, and z ∈ [N -R] is the index of an element in {0, 1} n \S, which has to be inserted. We implement SWUP as follows:

1. First, we convert the coin register to a pair x, y where: • y is the z-th element of {0, 1} n which is not in S and • x is the j-th element of S (according to the lexicographic ordering of bit-strings). For the first, we need a specific algorithm detailed in Appendix B, which accesses the tree T (S). The second can be done easily if the invariant of each node stores the number of leaves in its subtree. Note that both the mapping from z to y, and from j to x, are reversible. At this point the state is |T (S) |T (F ) |x, y .

2. We use INSERT † to delete x from T (S), and delete f (x)||x from T (F ).

3. We use INSERT to insert y in T (S) and f (y)||y in T (F ). At this point the state is: |T (S ) |T (F ) |x, y where S = (S\{x}) ∪ {y} and F is the set of corresponding images. 4. Finally, we convert the pair x, y back to a coin register.

Remark 2 (Walking in a reduced set). In our walk, we actually reduce the set of possible elements, due to the previously measured collisions. So the coin does not encode an element of {0, 1} n \S, but of {0, 1} n \S\Preim(C), where C is our current table of multicollisions. An adapted algorithm is also given in Appendix B for this case.

Checking. We make the CHECK operation trivial, by defining an appropriate invariant of the tree T (F ). For each node in the tree, we count the number of multicollisions and preimages of Im(C) that the subtree rooted at this node contains. Then, the unitary CHECK simply tests whether the invariant at the root is zero.

During the operations of insertion and deletion in the tree, the invariant can be updated appropriately. Besides checking if the inserted element creates a new collision (resp., the deleted element removes one), we also need to check whether the image belongs to the set Im(C). During the run of the algorithm, Im(C) is classical, and can be stored in quantum-accessible classical memory.

Extracting. The most important property for our chained quantum walk is the capacity to extract multicollisions from the radix tree, in a way that preserves the rest of the state, and allows to reuse a superposition of marked vertices for the current walk, as a superposition of unmarked vertices for the next one. Recall from Section 4.1 that we have defined a table of multicollisions C, a set V C R of sets of size R in {0, 1} n \Preim(C), and a set M C R ⊆ V C R of marked vertices, which contain either a new element mapping to Im(C), or a new collision. Recall also from the proof of Theorem 5 that a random function, with probability 1-o(2 -n ), does not admit an r-collision (x 1 , . . . , x r ) with r = O (n) for some appropriate constant. This limit on the size of multicollisions ensures that the extraction does not reduce too much the size of the current vertex.

The operation EXTRACT does: We now prove the correctness of Algorithm 5. We start with the uniform superposition of marked vertices, i.e., sets S ⊆ {0, 1} n \Preim(C) of size R, which

EXTRACT : C, R, 1
|M C R | S∈M C R |S → C , R , 1
|V C R \M C R | S∈V C R \M C R |S , i.e.,
We select one of the solutions (x 1 , . . . , x r ) at random, remove it, and measure the tuple x 1 , . . . , x r . Let u = h(x 1 ). After measurement, the state collapses on all sets that do not contain x 1 , . . . , x r , and contain no preimage of u.

Since we update R and C accordingly, we obtain the sets:

S ⊆ ({0, 1} n \Preim(C )) , |S| = R , ∀z ∈ S, f (z) / ∈ Im(C ) .
After repeatedly calling CHECKC and measuring, we will continue extracting collisions until CHECKC returns 0, i.e., we have collapsed on the sets which do not contain a collision. At this point, we have a uniform superposition of:

S ⊆ ({0, 1} n \Preim(C )) , |S| = R , ∀z ∈ S, f (z) / ∈ Im(C ) ∧ ∀x, y ∈ S, f (x) = f (y) .
This is, by definition, the set of unmarked vertices (see Equation ( 6)).

Note that for this algorithm to work, we need to maintain invariants of the number of solutions (new preimages and multicollisions) that any subtree contains. These invariants only decrease during the loop iterates, and they are updated accordingly when we remove the solutions from the tree.

Searching for Many Collisions, in General

As we have seen, our new algorithm is valid (and tight) for all values of n, m and k ≤ 2n -m such that k ≤ m 4 . Two approaches can be used for higher k.

BHT. A standard approach to find multiple collisions, which works when m is small, is to extend the BHT algorithm [START_REF] Brassard | Quantum cryptanalysis of hash and claw-free functions[END_REF]. We select a parameter , then make 2 queries, and look for 2 k collisions on this list of queries. This is done by a quantum search on {0, 1} n for an input colliding with the list. There are on average 2 2n-m collision pairs in the function, so a random element of {0, 1} n has a probability O (2 n-m ) to be in a collision pair. This gives O 2 -m+n collision pairs for the initial list.

Thus, a search for a collision with the list has O 2 -m+n solutions in a search space of size 2 n , and it requires

2 n
2 +m-n = 2 (m-)/2 iterates. If this procedure is to output 2 k collisions, we need such that 2 -m+n ≥ 2 k i.e. -m + n ≥ k. By trying to equalize the complexity of the two steps, we obtain: = k + m- 2 =⇒ = 2k 3 + m 3 which is only valid for k ≤ 3n -2m. For a bigger k, we can repeat this. We find 2 3n-2m collisions in time (and memory) 2 2n-m , and we do this 2 k-(3n-2m) times, for a total time O 2 k+m-n . If we want to restrict the memory then we obtain the tradeoff of O 2 k+m/2-/2 time using O 2 memory.

Using our method. If k > m/4, then the memory limitation in Theorem 5 on becomes relevant. In that case, as we are restricted to ≤ m/2, the minimal achievable time is O 2 k+m/2-/2 = O 2 k+m/4 . R d . We call d the rank of the lattice and (b 1 , . . . , b d ) a basis of the lattice. The most important computational problem on lattices is the Shortest Vector Problem (SVP). Given a basis for a lattice L ⊆ R d , SVP asks to compute a nonzero vector in L with the smallest Euclidean norm. The main lattice reduction algorithm used for lattice-based cryptanalysis is the famous BKZ algorithm [START_REF] Schnorr | A hierarchy of polynomial time lattice basis reduction algorithms[END_REF]. It internally uses an algorithm for solving (near) exact SVP in lower-dimensional lattices. Therefore, finding faster algorithms to solve exact SVP is critical to choosing security parameters of cryptographic primitives.

Previously, the fastest quantum algorithm solved SVP under heuristic assumptions in 2 0.2570d+o(d) time [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF]. It applies the MNRS quantum walk technique to the state-of-the-art classical algorithm called lattice sieving, where we combine close vectors together to obtain shorter vectors at each step. It was noted in [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] that the algorithm could be slightly improved if we could find many marked vertices in a quantum walk without repaying the setup each time, which is exactly what we showed in Section 4. We redid the analysis of [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] with this improvement and show the following Proposition 4. There exists a quantum algorithm that solves SVP under heuristic assumptions in 2 0.2563d+o (d) Proving this statement requires to restate the whole framework and analysis of [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF], which we do in Appendix C.

Solving the Limited Birthday Problem

The following problem is very common in symmetric cryptanalysis. It appears for example in impossible differential attacks [START_REF] Boura | Scrutinizing and improving impossible differential attacks: Applications to clefia, camellia, lblock and simon[END_REF], but also in rebound distinguishers [START_REF] Hosoyamada | Improved attacks on sliscp permutation and tight bound of limited birthday distinguishers[END_REF]. In the former case we use generic algorithms to solve the problem for a black-box E, and in the latter, a valid distinguisher for E is defined as an algorithm outputting the pairs faster than the generic one.

Problem 4 (Limited Birthday). Given access to a black-box permutation E : {0, 1} n → {0, 1} n and possibly its inverse E -1 , given two vector spaces D in and D out of sizes 2 ∆in and 2 ∆out respectively, find 2 k pairs x, x such that

x = x , x ⊕ x ∈ D in , E(x) ⊕ E(x ) ∈ D out .
For simplicity, we will focus only on the time complexity of the problem, although some parameter choices require a large memory as well. Classically the best known time complexity is given in [START_REF] Boura | Scrutinizing and improving impossible differential attacks: Applications to clefia, camellia, lblock and simon[END_REF]:

max min ∆∈{∆in,∆out} √ 2 k+n+1-∆ , 2 k+n+1-∆in-∆out . ( 15
)
This complexity is known to be tight for 2 k = 1 [START_REF] Hosoyamada | Improved attacks on sliscp permutation and tight bound of limited birthday distinguishers[END_REF].

In the quantum setting, we need to consider superposition access to E and possibly E -1 to have a speedup on this problem. Previously the methods used [START_REF] Kaplan | Quantum differential and linear cryptanalysis[END_REF] involved only individual calls to Ambainis' algorithm (when there are few solutions) or an adaptation of the BHT algorithm (when there are many solutions).

The quantum algorithm, as the classical one, relies on the definition of structures of size 2 ∆in , which are subsets of the inputs of the form T x = {x⊕v, v ∈ D in } for a fixed x. For a given structure T x , we can define a function h x : {0, 1} ∆in → {0, 1} n-∆out such that any collision of h x yields a pair solution to the limited birthday problem. The expected number of collisions of a single h x is C := 2 2∆in+∆out-n , and there are three cases:

1. C < 1: we follow the approach of [START_REF] Kaplan | Quantum differential and linear cryptanalysis[END_REF], which is to repeat 2 k times a Grover search among structures, to find one that contains a pair (this is done with Ambainis' algorithm). The time exponent is k + n-∆out 2 -∆in 3 . 2. 1 < C < 2 k : we need to consider several structures and to extract all of their collision pairs. Using Theorem 6 this gives a time exponent:

max k + 2 3 (n -∆ in -∆ out ), k + min n -∆ out -∆ in , n -∆ out 4
3. 2 k < C: we need only one structure. To recover 2 k pairs, we need a time exponent (by Theorem 6):

max 2k 3 + n -∆ out 3 , k + min n -∆ out -∆ in , n -∆ out 4
Finally, we can swap the roles of ∆ in and ∆ out and take the minimum. Unfortunately this does not lead to an equation as simple as Equation (15).

On multicollision-finding

A natural extension of this work would be to look for multicollisions.

Problem 5 (r-collision search). Let f : {0, 1} n → {0, 1} m be a random function. Find an r-collision of f , that is, a tuple (x 1 , . . . , x r ) of distinct elements such that f (x 1 ) = . . . = f (x r ).

As with collisions, the lower bound by Liu and Zhandry [START_REF] Liu | On finding quantum multi-collisions[END_REF] is known to be tight when m ≤ n. The corresponding algorithm is an extension of the BHT algorithm which constructs increasingly smaller lists of i-collisions, starting with 1-collisions (evaluations of the function f on arbitrary points) and ending with a list of r-collisions.

This algorithm, given in [START_REF] Hosoyamada | Improved quantum multicollision-finding algorithm[END_REF][START_REF] Hosoyamada | Quantum algorithm for the multicollision problem[END_REF], finds 2 k r-collisions in time and memory:

O 2 k 2 (r-1) 2 r -1 2 m 2 (r-1) -1 2 r -1

.

As with 2-collisions, it is possible to extend it when m > n. Of course, there's a constraint: the list i must contain more tuples that are part of an i + 1-collision than the size of the list i + 1.

The size of each i-collision list is N i = 2 k 2 r -2 r-i 2 r -1 2 m 2 r-i -1

2 r -1 . The probability that an i-collision extends to an i + 1-collision is of order 2 n-m . Hence, for the algorithm to work, we must have, for all i, N i+1 /N i ≤ 2 n-m . This means:

k 2 r-i-1 2 r -1 -m 2 r-i-1 2 r -1 ≤ n -m .
This constraint is the most restrictive for the largest possible i, r -1. We obtain the following constraint, which subsumes the others:

k 1 2 r -1 + m 1 - 1 2 r -1 ≤ n .
This gives the point up to which this algorithm meets the lower bound. We could use our new algorithm as a subroutine in this one, to find 2-collisions, and this would allow to relax the constraint over N 2 /N 1 . Unfortunately, this cannot help to find multicollisions, as the other constraints are more restrictive. More generally, these constraints show that it is not possible to increase the range of the BHT-like r-collision algorithm solely by using an r -i-collision algorithm with an increased range. Proposition 6 ([9]). For a parameter c 1 , let .

• β st. V d (β) = 1 N c 1 . • ρ 0 st. N ρ0 = V d (β)
In order to solve F AS 1 with parameter c 1 , it is enough to perform N ρ0 quantum walks on a Johnson graph J(c, c 1 ) and, each time, and to find a constant fraction of its marked vertices. This quantum walk has the following properties

S = N c1 , δ = N -c1 , ε = N 2c1-ρ0 V d-1 (θ * α ), U = 1, C = 1.
from which we can deduce that the number of marked vertices is N ζ-ρ0 . The total running time of F AS 1 is therefore

F AS 1 = N ρ0 • N ζ-ρ0 S + 1 √ ε 1 √ δ U + C . ( 17
)
In the above proposition, for each of the quantum walks, there is the multiplicative term N ζ-ρ0 which comes from the fact that we want to find N ζ-ρ0 marked elements in each quantum walk. However, with our new results, we are able to avoid this multiplicative cost in front of the setup. Using Theorem 4, we can replace Equation [START_REF] Hosoyamada | Improved quantum multicollision-finding algorithm[END_REF] with

F AS 1 = N ρ0 • S + N ζ-ρ0 √ ε 1 √ δ U + C . ( 18
)
This is justified because the quantum walks described above are actually walks for collision finding (with a different condition on marked elements), and the optimized parameters of the walk we obtain are, as we will show, consistent with the requirements of Theorem 4.

With this improvement, we redid the optimization of [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] and obtained the following new running time for quantum sieving. We take the following set of parameters: c ≈ 0.3875, c 1 ≈ 0.27 which gives ζ ≈ 0.1568 and ρ 0 ≈ 0.1214. Notice that with these parameters, we are indeed in the range of Theorem 4 since the number of solutions we extract is 2 k = N ζ-ρ0 ≈ N 0.0354 and the range of the function f on which we collision is 2 m = 2 c1 ≈ N 0.27 (the number of points in the code), so we indeed have k ≤ m 4 . The parameters of the quantum walk become: S ≈ N 0.27 , ε ≈ N -0.2 , δ ≈ N -0.27 , U = C = 1 . This gives F AS 1 ≈ N 0.27 . Plugging this into Equation ( 16), we get a total running time of N 1.2347 which is equal to 2 0.2563d+o(d) improving slightly the previous running time of 2 0.2570d+o (d) .

2 3 k+ m 3 queries, and also O 2 2 3 k+ m 3 quantum

 3233 gates (i.e., time) and space in the qRAM model.

Fig. 1 .

 1 Fig.1. Gate count exponent in the algorithm depending on the relative values of k, m and n. Both our algorithm and the BHT approach can be extended to the whole triangle, but we show only the one achieving the best complexity. In the purple region (bottom left), both approaches reach the same complexity exponent 2k 3 + m 3 .

Algorithm 1 : 1 R 1 δ

 111 Classical random walk on G Setup an arbitrary vertex x ∈ V repeat repeat Update: move to a random adjacent vertex until the current vertex is uniformly random Check if the current vertex is marked until the current vertex is marked The quantum walk is analogous to this process. Let ε = |M | |V | be the proportion of marked vertices and δ be the spectral gap of G. Starting from any vertex, after O 1 δ updates, we sample a vertex of the graph uniformly at random. For a Johnson graph J(N, R), δ = N R(N -R) . Let S be the time to Setup, U the time to Update, C the time to Check a given vertex. Then Algorithm 1 finds a marked vertex in time: O S + 1 ε U + C . Magniez et al.

  √ d y∈Nx |y , and: | p x = 1 √ d y∈Nx | y .

  |p x the superposition of vertices (and neighbors) |ψ M = 1 √ |M | x∈M | x |p x the superposition of marked vertices A = span{| x |p x } x∈V B = span{| p y |y } y∈V Let Ref A and Ref B be respectively the reflection over the space A and the space B. The core of the MNRS framework is to use these operations to emulate a reflection over |ψ U . By alternating such reflections with reflections over |ψ M (using the checking procedure), the quantum walk behaves exactly as a quantum search, and the analysis of Section 2.3 applies. Proposition 3 (From [27]). Let W = Ref B Ref A . We have ψ U | W |ψ U = 1. For any other eigenvector |ψ of W , we have ψ| W |ψ = e iθ with θ ∈ [2 √ δ, π/2].

  be the uniform superposition of coins. In the vertexcoin encoding, Ref A corresponds to I ⊗ Ref |ψ coin Unif : Ref A = O -1 Enc • I ⊗ Ref |ψ coin Unif • O Enc . Now, for the SWUP operation, we have to decompose again UP D and Swap in the encoded space. First, we define UP D such that: |x |D(x) |c x→y U P D ---→ |x |D(y) |c x→y . Moreover, we define Swap such that: |x |c x→y Swap ----→ |y |c y→x . and we define SWUP = Swap • UP D (we abuse notation here, by extending Swap where we apply the identity to the middle register), so: SWUP | x |c x→y = | y |c y→x , and SWUP = O Enc • SWUP • O -1

Theorem 3 ( 1 √

 31 MNRS, starting from bad vertices). Starting from the state: |V |-|M | x∈V \M | x ψ coin Unif (the superposition of unmarked vertices), apply π/2 2α

  Preim(C) := u:(x1,...,xr)∈C {x 1 , . . . , x r } Im(C) := u:(x1,...,xr)∈C {u}

Fig. 2 .

 2 Fig.2. Tree R(S) representing the set S = {0000, 0010, 1001, 1011, 1111} (the example is taken from[START_REF] Jeffery | Frameworks for Quantum Algorithms[END_REF]).

2 ,Fig. 3 .

 23 Fig. 3. Example of memory layout for the tree of Figure 2, holding the set S = {0000, 0010, 1001, 1011, 1111}.

W

  d (β,θ * α ) , where W d (β, θ * α ) = poly(d) • 1 -2 cos 2

  Apply CHECK and measure the result: let flag be the output if flag is true then /* The state collapses on:

		Initialize an empty table	*/
	2 |ψ ← S∈V C	|S /* SETUP	*/
	while |Im(C)| < 2 k do
	Run the quantum walk:
	• Starting state: |ψ = S∈V C R \M C R • Graph: J({0, 1} n \Preim(C), R) (Johnson graph with vertices of size R, |S
	excluding the preimages of C)
	• Marked vertices: M C R • Iterates: (π/2)/(2α) , where α = arcsin	√ εR,C
	• Spectral gap: δ	1 R
			S∈M C R	|S	*/
	Apply EXTRACT (contains measurements)
	• Update the table C
	• Update the current width R
	• Update the state: |ψ = S∈V C R \M C

R

|S

/* Otherwise, the state collapses on:

  it updates the current vertex state, but also reduces R to a smaller value R , and updates the table C into a bigger table C . It is implemented as Algorithm 5. Although it is not strictly necessary, we have separated the subroutine CHECK into: CHECKP, which finds whether the set contains a new preimage of C, and CHECKC, which finds whether there is a new collision.

For a fixed |ψ , ψ ⊥ is actually unique up to a global phase.

Acknowledgments. A.S. wants to thank Nicolas David and María Naya-Plasencia for discussions on the limited birthday problem. A.S. has been supported by ERC-ADG-ALGSTRONGCRYPTO (project 740972). Y.S. is supported by EPSRC grant EP/S02087X/1 and EP/W02778X/1. This work received funding from the France 2030 program managed by the French National Research Agency under grant agreement No. ANR-22-PETQ-0007 EPiQ and ANR-22-PETQ-0008 PQ-TLS. All authors would like to thank Schloss Dagstuhl and the organizers of the Dagstuhl Seminar 21421 "Quantum Cryptanalysis" where this work was initiated, and the reviewers of EUROCRYPT 2023 for helpful comments.

The first loop removes all new preimages. Each time we measure an element, we collapse on the superposition of sets which contained it. After CHECKP returns 0 for the first time, the state collapses on the uniform superposition of all sets S such that:

where t is the number of iterates of the loop that we had to perform. There is a variable number of such iterates but we expect only one to occur on average, since the typical case is for vertices to contain only one solution.

The second loop will run until there are no collisions anymore. New preimages cannot appear since we extract entire multicollision tuples. At the first loop iterate, assuming that CHECKC returns 1, we collapse on the uniform superposition of sets:

Conclusion.

The time and memory complexities of the problem are the following (in log 2 and without polynomial factors):

• If k ≤ 3n -2m: 2k 3 + m 3 time and memory using BHT • Otherwise, if k ≤ m 4 : 2k 3 + m 3 time and memory using our algorithm • Otherwise, if m ≤ 4 3 n: k + m -n time and 2n -m memory using BHT • Otherwise, if m ≥ 4 3 n: k + m 4 time and m 2 memory using our algorithm This situation is summarized in Figure 1, and it allows us to conclude:

There exists an algorithm finding 2 k collisions in O 2 C(k,m,n) Clifford+T+qRAM gates, and using O 2 C(k,m,n) quantum queries to f , where:

Proof. We check that:

We conjecture that the best achievable complexity is, in fact, C(k, m, n) = 2k 3 + m 3 for any admissible values of k, m and n. It would however require a nontrivial extension of our algorithm, capable of outputting collisions at a higher rate than what we currently achieve.

In terms of time-memory trade-offs, we can summarize the results as:

Theorem 7 (General Time-memory tradeoff ). For all k ≤ ≤ min(2k/3+ m/3, max(2n -m, m/2)), there exists an algorithm that computes 2 k collisions using O 2 qubits and O 2 k+m/2-/2 Clifford+T+qRAM gates and quantum queries to f .

Similarly, as in [START_REF] Hamoudi | Quantum time-space tradeoff for finding multiple collision pairs[END_REF], we conjecture that the trade-off should be achievable for all ≤ 2k/3 + m/3.

Applications

In this section, we show how our algorithm can be used as a building block for lattice sieving and to solve the limited birthday problem. We also discuss the problem of multicollision search.

Improvements in quantum sieving for solving the Shortest Vector Problem

In this section, we present the improvement of our reusable quantum walks to lattice sieving algorithms. A lattice

Our presentation of the chained quantum walks in Section 4 and Section 5 relies on measurements to extract the collisions, but in some cases, we might want to perform this operation reversibly, i.e., without any measurement. In this section, we explain how this can be done.

Suppose that we want to extract K collisions. The internal state of our algorithm will contain both a vertex in (one step of) our walk, the current parameters of the walk (vertex size, number of solutions. . . ) and O (K) registers to store the produced collisions. We can then create a unitary operator that on the current state:

1. Applies CHECK and stores its result in a new qubit. 2. Controlled on the result of CHECK (i.e., if a collision exists), finds a collision, removes it from the vertex, and updates the parameters of the walk, which determine the number of iterates it has to make. 3. Controlled negatively on the result of CHECK (i.e., if there is no collision), performs a quantum walk with the current parameters.

In this unitary operator, we set the precision of the phase estimation circuit (in the walk step) at the highest level required, i.e., depending on the initial vertex size, and it will work correctly for all walks.

After running a sequence of 2K(1 + o(1)) such operators, the state becomes a superposition which contains, with high probability, at least K collisions. The full algorithm is measurement-free and can be uncomputed by re-inserting the extracted elements and performing the quantum walks backwards, depending on the stored CHECK results.

B z-th Element Outside the Radix Tree

In this section, we solve the following problem:

Find the value y of the z-th element of {0, 1} n which is not in a given subset of {0, 1} n represented by a radix tree T .

We need the following invariant in the tree: each node n of T stores the number of leaves in the subtree rooted at n. We denote this quantity by leaves(n). See Figure 4 for an example.

Assume that T has R elements in {0, 1} n , let N = 2 n . Assume here that we have some easily computable order on {0, 1} n , represented by a map φ : {0, 1} n → [N ] that assigns to each bit-string its index, and its inverse φ -1 also easily computable. Given i ∈ [N -R], the goal is to find the i th element in {0, 1} n \ T . Theorem 8. FindNthNotInTree(i, T ) returns the i th element in {0, 1} n \ T in poly(n) time. Algorithm 7: FindNthNotInTree(i, T )

Input: index i, radix tree T Output: i th element in {0, 1} n \ T Compute the bit-string x of the leftmost leaf of the tree T if i < φ(x) then return φ -1 (i) else return FindNthNotInSubtree(i -φ(x), T , root(T ))

We now consider the same problem where we have two trees T and T and we want to find the i th element in {0, 1} n which is not in T and not in T . We assume that T and T have disjoint leaves. This problem appears in our chained quantum walk in Section 4, where T is a classical radix tree in which we store the collision pairs that were found in previous walk steps, and T is the radix tree inside one node of the current quantum walk. Indeed, in order to walk to a new vertex, we need to exclude both the elements that were previously measured and those that belong to the current vertex. Algorithm 11: FindNthNotInTwoTrees(i, T , T )

Input: index i, radix trees T and T with disjoint leaves Output: i th element in {0, 1} n \ (T ∪ T ) Compute the bit-string x of the leftmost leaf of the tree T /* compute the number of elements on the left of T that are not in

C Redoing the Analysis of [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] with our Chained Quantum Walk

Without going through the whole framework of the [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] algorithm, we present its main parameters and ideas, and how our quantum walks improves it. The sieving algorithm works as follows: we start from N lattice points x 1 , . . . , x N on the d-dimensional sphere of some norm R and we want to find N pairs (x i , x j ) (with i = j) such that the norm of x i -x j is slightly smaller than R. This gives us N new lattice points of slightly smaller norm. This is one sieving step and the full algorithm performs the above sieving step poly(d) times, until we find a small vector.

The original NV-sieve [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF] uses the heuristic that lattice points constructed this way behave like random points on the sphere. For a fixed radius R, we say that a pair of points (x i , x j ) reduces if ||x i -x j || 2 < R. The probability that a pair of random points reduces is known to be V d (π/3) := poly(d) sin d (π/3) .

Since we have O(N 2 ) different pairs (x i , x j ), we take N = Θ( 1V d (π/3) ) = 2 0.2075d+o(d) to ensure that we can construct N different new points at each sieving step. The NV-sieve consists, at each sieving step, in checking all the pairs (x i , x j ) in order to find all reducible pairs. This takes time O(N 2 ) = 2 0.415d+o(d) using a classical computer and O(N 3/2 ) = 2 0.301d+o(d) using a quantum computer that performs Grover's search.

Locality sensitive filtering. The idea of locality sensitive filtering for sieving is the following: instead of checking all the pairs (x i , x j ), we check in priority those that have a higher chance of being close by using locality sensitive functions. There has been an extensive literature on the subject, see for instance [START_REF] Laarhoven | Search problems in cryptography: from fingerprinting to lattice sieving[END_REF]. In the most recent iterations [START_REF] Becker | New directions in nearest neighbor searching with applications to lattice sieving[END_REF], we start from a code C which behaves as a random code but which can be efficiently list-decoded. Then, for each lattice point, we compute the closest codewords (that is, we decode the lattice point), and we split the set of lattice points into buckets identified by each close codeword. Now, we only consider pairs of vectors that are in the same bucket. Of course, two vectors that lie in different buckets might form a reducible pair. Hence, this procedure has to be repeated with new random codes in order to get almost all reducible pairs.

In order to find good pairs, we typically check all pairs within each bucket. In the quantum setting, one can use Grover's algorithm, which corresponds to Laarhoven's algorithm [START_REF] Laarhoven | Search problems in cryptography: from fingerprinting to lattice sieving[END_REF] or a quantum walk, which corresponds to the [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] algorithm.

C.1 The [9] quantum algorithm and our improvement

We need the following definitions. We work on the d-dimensional sphere of radius R. For a point v and angle α, the spherical cap H v,α is the set of points of the sphere at angle at most α from v. For an angle α ∈ [0, π/2], V d (α) is the ratio of the volume of a spherical cap of angle α to the volume of the d-dimensional sphere. We have V d (α) = poly(d) sin d (α) .

We restate (slightly informally) the quantum algorithm for lattice sieving, as presented in [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF]. We fix a dimension d.

where

• F AS 1 is the running time of the F AS 1 subroutine.

The authors of [START_REF] Chailloux | Lattice sieving via quantum random walks[END_REF] use a quantum walk in order to solve the F AS 1 problem.