a590003

number of distinct component values other than ⊥. Notice that p + d ≤ q. Then there are ( k−p)
l−p
different sets T of size l for which all of the values of the components lie in T . Thus, the coefficient
of P r is
( )
q∑ k − p
a l (−1) i (l − 1) d
l − p
l=p
Therefore, we need values a l such that
( )
q∑ k − p
a l (l − 1) d = (k − 1) d (3.5)
l − p
l=p
for all d, p. Notice that we can instead phrase this problem as a polynomial interpolation problem.
The right hand side of Equation 3.5 is a polynomial P of degree d ≤ q − p, evaluated at k − 1. We
can interpolate this polynomial using the points l = p, ..., q, obtaining
P (k − 1) =
q∑
P (l − 1)
l=p
The numerator of the product evaluates to
q∏
j=p,j≠l
(k − p)!
(k − l)(k − q − 1)!
k − p
l − p .
while to evaluate the bottom, we split it into two parts: j = p, ..., l − 1 and j − l + 1, ..., q. The first
part evaluates to (l − p)!, and the second part evaluates to (−1) q−l (q − l)!. With a little algebraic
manipulation, we have that
(( ) )( )
q∑
k − l − 1
k − p
P (k − 1) = P (l − 1)
(−1) q−l
k − q − 1
l − p
l=p
for all polynomials P (x) of degree at most q − p. Setting P (x) = x d for d = 0, ..., q − l, we see
that Equation 3.5 is satisfied if ( )
k − 1 − l
a l =
(−1) q−l .
k − 1 − q
3.1 An Example
Suppose our task is to, given one quantum query to an oracle H : X → Y, produce two distinct
pairs (x 0 , y 0 ) and (x 1 , y 1 ) such that H(x 0 ) = y 0 and H(x 1 ) = y 1 . Suppose further that H is drawn
from a pairwise independent set H. We will now see that the rank method leads to a bound on the
success probability of any quantum algorithm A.
Corollary 3.4. No quantum algorithm A, making a single query to a function H : X → Y drawn
from a pairwise independent set H, can produce two distinct input/output pairs of H, except with
probability at most |X |/|Y|.
11
8. Quantum-Secure Message Authentication Codes