a590003

first indexes such that y i = 0 If there are more than q indexes, the function truncates to the first q.
F is realizable by a simple classical algorithm, so it can be implemented as a quantum algorithm.
Apply this algorithm to |ψ 1 〉, obtaining the state
|ψ 2 〉 =
1
√
Ck,q,n
∑
y:∆(y)≤q
|y, F (y)〉
Next, let G : Y k → Y q be the function that takes in vector y, computes x = F (y), and outputs
the vector (y x1 , y x2 , ..., y xq ). In other words, it outputs the vector of the non-zero components of y,
padding with zeros if needed. This function is also efficiently computable by a classical algorithm,
so we can apply if to each part of the superposition:
|ψ 3 〉 =
1
√
Ck,q,n
∑
y:∆(y)≤q
|y, F (y), G(y)〉
Now we apply the Fourier transform to the G(y) part, obtaining
1 ∑
|ψ 4 〉 = √ |y, F (y)〉 ∑ e −i 2π n 〈z,G(y)〉 |z〉
Ck,q,n
z
y:∆(y)≤q
Now we can apply H to the F (y) part using q non-adaptive queries, adding the answer to the z
part. The result is the state
1 ∑
|ψ 5 〉 = √ |y, F (y)〉 ∑ e −i 2π n 〈z,G(y)〉 |z + H(F (y))〉
Ck,q,n
z
y:∆(y)≤q
We can rewrite this last state as follows:
1 ∑
|ψ 5 〉 = √ e i 2π n 〈H(F (y)),G(y)〉 |y, F (y)〉 ∑ Ck,q,n
y:∆(y)≤q z
e −i 2π n 〈z,G(y)〉 |z〉
Now, notice that H(F (y)) is the vector of H applied to the indexes where y is non-zero, and
that G(y) is the vector of values of y that those points. Thus the inner product is
〈H(F (y), G(y)〉 = ∑
k∑
H(i) × y i = H(i)y i = 〈H([k]), y〉 .
i:y i ≠0
i=0
The next step is to uncompute the z and F (y) registers, obtaining
1 ∑
|ψ 6 〉 = √ e i 2π n 〈H([k]),y〉 |y〉
Ck,q,n
y:∆(y)≤q
Lastly, we perform a Fourier transform the remaining space, obtaining
⎛
⎞
1 ∑
|ψ 7 〉 = √
⎝
∑
e i 2π n 〈H([k])−z,y〉 ⎠|z〉
C k,q,n n k z
y:∆(y)≤q
Now measure. The probability we obtain H([k]) is
∣ ∣∣∣∣∣
1 ∑
2
C k,q,n n k 1
∣
as desired.
y:∆(y)≤q
16
= C k,q,n
n k
8. Quantum-Secure Message Authentication Codes