A Note on Quantum Collision Resistance of Double-Block-Length Compression Functions

Abstract

In 2005, Nandi presented a class of double-block-length compression functions specified as $h^{\pi }(x):=(h(x),h(\pi (x)))$, where h is assumed to be a random oracle producing an n-bit output and $\pi$ is a non-cryptographic permutation. He showed that the collision resistance of $h^{\pi }$ is optimal if $\pi$ has no fixed point. This manuscript discusses the quantum collision resistance of $h^{\pi }(x)$. First, it shows that the quantum collision resistance of $h^{\pi }$ is not always optimal even if $\pi$ has no fixed point: One can find a colliding pair of inputs for $h^{\pi }$ with only $O(2^{n/2})$ queries to h by using the Grover search if $\pi$ is an involution. Second, this manuscript shows that there really exist cases that the quantum collision resistance of $h^{\pi }$ is optimal. More precisely, a sufficient condition on $\pi$ is presented for the optimal quantum collision resistance of $h^{\pi }$, that is, any collision attack needs ${\varOmega }(2^{2n/3})$ queries to find a colliding pair of inputs. The proof uses the recent technique of Zhandry’s compressed oracle. Finally, this manuscript makes some remarks on double-block-length compression functions using a block cipher.

This work was supported by JSPS KAKENHI Grant Number JP20K21798.