a590003

The algorithm is similar to the algorithm of [vD98], though generalized to handle arbitrary range
sizes. This algorithm has the same success probability as in Theorem 4.1, showing that both our
attack and lower bound of Theorem 4.1 are optimal. This proves the second part of Theorem 1.1.
Proof. Assume that Y = {0, ..., n − 1}. For a vector y ∈ Y k , let ∆(y) be the number of coordinates
of y that do not equal 0. Also, assume that x i = i.
Initially, prepare the state that is a uniform superposition of all vectors y ∈ Y k such that
∆(y) ≤ q:
|ψ 1 〉 = √ 1 ∑
|y〉
V
y:∆(y)≤q
Notice that the number of vectors of length k with at most q non-zero coordinates is exactly
( q∑ k
(n − 1)
r)
r = C k,q,n .
r=0
We can prepare the state efficiently as follows: Let Setup k,q,n : [C k,q,n ] → [n] k be the following
function: on input l ∈ [C k,q,n ],
• Check if l ≤ C k−1,q,n . If so, compute the vector y ′ = Setup k−1,q,n (n), and output the vector
y = (0, y ′ ).
• Otherwise, let l ′ = l − C k−1,q,n . It is easy to verify that l ′ ∈ [(n − 1)C k−1,q−1,n ].
• Let l ′′ ∈ C k−1,q−1,n and y 0 ∈ [n]\{0} be the unique such integers such that l ′ = (n−1)l ′′ +y 0 −n.
• Let y ′ = Setup k−1,q−1,n (l ′′ ), and output the vector y = (y 0 , y ′ ).
The algorithm relies on the observation that a vector y of length k with at most q non-zero
coordinates falls into one of either two categories:
• The first coordinate is 0, and the remaining k − 1 coordinates form a vector with at most q
non-zero coordinates
• The first coordinate is non-zero, and the remaining k − 1 coordinates form a vector with at
most q − 1 non-zero coordinates.
There are C k−1,q,n vectors of the first type, and C k−1,q−1,n vectors of the second type for each
possible setting of the first coordinate to something other than 0. Therefore, we divide [A k,q,n ] into
two parts: the first C k−1,q,n integers map to the first type, and the remaining (n − 1)C k−1,q−1,n
integers map to vectors of the second type.
We note that Setup is efficiently computable, invertible, and its inverse is also efficiently
computable. Therefore, we can prepare |ψ 1 〉 by first preparing the state
1
√
Ck,q,n
∑
l∈[C k,q,n ]
and reversibly converting this state into |φ 1 〉 using Setup k,q,n .
Next, let F : Y k → [k] q be the function that outputs the indexes i such that y i ≠ 0, in order of
increasing i. If there are fewer than q such indexes, the function fills in the remaining spaces the
|l〉
15
8. Quantum-Secure Message Authentication Codes