Theory and Applications of Quantum Hashing

Abstract

We review recent results on quantum one-way functions, including quantum fingerprinting or quantum hashing (we use these two terms as synonyms even though they have very small difference). This includes the analysis of their properties, different modifications, circuit implementation on an IBM Q platform, as well as on an experimental quantum setup. We discuss computational aspects of quantum hashing, its cryptographic properties and possible usage in communication protocols and algorithms.

1. Introduction

Quantum computing [1,2,3] has been one of the hottest topics in computer science over the last few decades. There are many problems in which quantum algorithms outperform the best known classical ones [4]. One of the useful techniques for constructing algorithms in different computational models is quantum hashing or quantum fingerprinting. In classical computation, hash functions are widely used in algorithms and data structure design [5,6]. As an example, we can consider the Rabin–Karp algorithm for the string matching problem [7], the hash table data structure [8,9,10], and the comparison of objects in standard libraries of programming languages [11]. One of the popular applications is cryptography [6,12]. Cryptography applications involve the use of one-way functions as hash functions because of their cryptographic properties.

In quantum computing, hash functions also have many applications in algorithm design, including cryptography [13,14,15,16,17,18,19], where one-way property is crucial. Quantum one-way functions can be categorized into four types. The categorization is based on their input–output formats:

• Classical–classical: These functions retain a classical nature but satisfy the properties of quantum one-wayness. Their relevance is demonstrated in statistical zero-knowledge protocols and quantum oracle indistinguishability tasks [20,21].
• Classical–quantum: This type is extensively explored in the context of quantum hash functions [22,23,24,25]. Applications include signing classical data [26] and quantum digital signature schemes [27].
• Quantum–classical: These functions enable the authentication of quantum states via classical strings. The work of Behera et al. illustrates their utility in enhanced quantum money schemes [28].
• Quantum–quantum: These directly transform quantum states into other quantum states. The first implementation, proposed by Shang et al. [29], combines “quantum–classical” and “classical–quantum” quantum one-way functions. This approach is successfully applied in quantum identity authentication protocols, where one quantum state verifies the authenticity of another.

In this paper, we focus on the Classical–quantum type of one-way functions as quantum hash functions.

Another name for the same technique is “fingerprinting”. The probabilistic (randomized) technique was developed by Frievalds [30,31]. The main idea of the technique is to randomly choose one of specially constructed hash functions from a given set and to use it for comparing objects for equality. Here, the value of a hash function is called a “fingerprint” of an object.

A thoughtful reader can see a difference between the “hash function technique” and the “fingerprinting technique”. At the same time, the nature and key idea of the techniques are the same. That is why we use these terms as synonyms in this paper.

The quantum version of the fingerprinting technique was developed by Ambainis and Frievalds [32] for automata and later improved by Ambainis and Nahimovs in [33,34]. Later, Buhrman et al. in [22] provided an explicit definition of the quantum fingerprinting algorithm to construct an efficient quantum communication protocol for equality testing. The technique was applied to branching programs by Ablayev, Vasiliev, and Gainutdinova [35,36,37], this computational model can be considered as a non-uniform automata. They show examples of Boolean functions that can be computed by a quantum branching program with exponentially smaller complexity (width or states in terms of automata) than the deterministic ones. Based on this research, they developed the concept of cryptographic quantum hashing [23,24]. Later, they generalized the technique and suggested a family of quantum hashes that allow us to see a trade-off between one-way resistance and collision resistance of the hash function [25,38,39]. Different versions of hash functions were applied that are hash functions in the case of finite abelian groups [40] and arbitrary groups [41], as well as functions based on graphs [26,42]. An alternative approach for cryptographic ideas was presented in [43]. The connection of the approach with the quantum Fourier transform is presented in [44,45]. We define the concept of quantum hashing and discuss its properties in Section 3.

Similarly to classical hash functions, quantum hash functions have parameters that allow them to satisfy required properties and to be useful for comparing objects. We discuss procedures for computing parameters of the quantum hash functions in Section 5.

Turaykhanov, Akat’ev, and coauthors implemented a technique in a photon-based real quantum device [46]. The technique was extended to qudits, and this extension was used in the experimental implementation [47]. Alternative photon-based real quantum device implementation was developed by Plachta, Hiekkamäki, Yakaryılmaz, and Fickler [48] and Zhao, Li, Li, Zheng, and He [49]. The experiments and the qudit version of the method are presented in Section 4.

In the discussed experiments, the algorithm was embedded in this device. When we discuss the implementation of the algorithm for “universal” quantum devices such as IBMQ quantum computers or similar, we should represent the algorithm as a quantum circuit. It is important to minimize the number of quantum gates in the circuit with respect to the architecture restrictions of a quantum device. Optimization for quantum computer emulators was explored in [50]. A shallow circuit for the algorithm was suggested in [51,52]. Its implementation on a real quantum computer’s noisy simulators was discussed in [45,53,54,55]. We present the results in Section 6.

This approach has been widely used in various areas such as stream processing algorithms [56], query model algorithms [57,58], online algorithms [59,60], quantum online algorithms with restricted size of memory [61,62], branching programs [63,64], development of quantum devices [65], automata [66,67,68], and others. Several applications are discussed in Section 7.

2. Preliminaries and Definitions

Here, we present short notes on quantum computation. The reader can find more information about quantum circuits in [1,3].

The notion of a quantum bit (qubit) is the basis of quantum computations. The qubit is the quantum version of the classical binary bit physically realized with a two-state device. Formally, the qubit’s state is the column vector $|\psi \rangle$ of two-dimensional Hilbert space ${\mathcal{H}}^2$, that is, $\left|\psi \right.〉=\alpha \left|0\right.〉+\beta \left|1\right.〉.$ Here, the pair of vectors $\left|0\right.〉$ and $\left|1\right.〉$ is an orthonormal basis of ${\mathcal{H}}^2$, where $\alpha ,\beta \in \mathbb{C}$ such that ${\left|\alpha \right|}^2+{\left|\beta \right|}^2=1$. The numbers $\alpha ,\beta$ are called amplitudes. Consider a qubit in a state such that ${\left|\alpha \right|}^2+{\left|\beta \right|}^2=1$. Then, we can represent the amplitudes as $\left|\psi \right.〉=cos{\displaystyle \frac{\theta }{2}}\left|0\right.〉+e^{i\varphi }sin{\displaystyle \frac{\theta }{2}}\left|1\right.〉,$ where $0\le \varphi <2\pi$, $0\le \theta \le \pi$.

A quantum state $\left|\psi \right.〉$ of a quantum n-qubit register is a complex-valued unit vector in $2^n$-dimensional Hilbert space ${\mathcal{H}}^{2^n}$ that is described as a linear combination of basis vectors: $\left|i\right.〉$, $i\in \{0,\dots ,2^n-1\}$: $\left|\psi \right.〉={\displaystyle \sum _{i=0}^{2^n-1}}{\alpha }_i\left|i\right.〉, \mathrm{with}{\displaystyle \sum _{i=0}^{2^n-1}}{\left|{\alpha }_i\right|}^2=1.$

Quantum mechanics postulates that transformations of quantum states $\left|\psi \right.〉\in {\left({\mathcal{H}}^2\right)}^{\otimes n}$ (of the quantum n-qubit register) are mathematically determined by unitary operators: $\left|{\psi }^{\prime }\right.〉=U\left|\psi \right.〉,$ where U is a $2^n\times 2^n$ unitary matrix for transforming a vector that represents a state of a quantum n-qubit register.

There is only one way to extract information from the state of a quantum n-register to a “macro world”. It is a measurement of the state of the quantum register. If we measure the quantum state ${\sum }_i{\alpha }_i\left|i\right.〉$, then we obtain one of the basis states, $\left|i\right.〉$, with probability $|{\alpha }_i{|}^2$.

2.1. Quantum Computational Models

In this paper, we consider different computational models.

2.1.1. Quantum Circuits

One of the most common is the quantum circuit that consists of qubits and gates (unitary transformations). Graphically, on a circuit, qubits are presented as lines.

As basic gates, we consider the following ones:

$$\begin{array}{c}\hfill H={\displaystyle \frac{1}{\sqrt{2}}}\left(\begin{array}{cc}1& 1\\ 1& -1\end{array}\right),X=\left(\begin{array}{cc}0& 1\\ 1& 0\end{array}\right),R_y\left(\xi \right)=\left(\begin{array}{cc}cos(\xi /2)& -sin(\xi /2)\\ sin(\xi /2)& cos(\xi /2)\end{array}\right),\\ \hfill R_z\left(\xi \right)=\left(\begin{array}{cc}{e}^{-{\displaystyle \frac{i\xi }{2}}}& 0\\ 0& e^{{\displaystyle \frac{i\xi }{2}}}\end{array}\right),P\left(\xi \right)=\left(\begin{array}{cc}1& 0\\ 0& e^{i\xi }\end{array}\right),CNOT=\left(\begin{array}{cccc}1& 0& 0& 0\\ 0& 1& 0& 0\\ 0& 0& 0& 1\\ 0& 0& 1& 0\end{array}\right).\end{array}$$

(1)

Additionally, we consider five nonbasic gates:

$$\begin{array}{c}\hfill R_k=\left(\begin{array}{cc}1& 0\\ 0& e^{{\displaystyle \frac{i\pi }{2^{k-1}}}}\end{array}\right),C{R}_k=\left(\begin{array}{cccc}1& 0& 0& 0\\ 0& 1& 0& 0\\ 0& 0& 1& 0\\ 0& 0& 0& e^{{\displaystyle \frac{i\pi }{2^{k-1}}}}\end{array}\right),C{R}_z\left(\xi \right)=\left(\begin{array}{cccc}1& 0& 0& 0\\ 0& 1& 0& 0\\ 0& 0& e^{-{\displaystyle \frac{i\xi }{2}}}& 0\\ 0& 0& 0& e^{{\displaystyle \frac{i\xi }{2}}}\end{array}\right),\\ \hfill SWAP=\left(\begin{array}{cccc}1& 0& 0& 0\\ 0& 0& 1& 0\\ 0& 1& 0& 0\\ 0& 0& 0& 1\end{array}\right),C{R}_y\left(\xi \right)=\left(\begin{array}{cccc}1& 0& 0& 0\\ 0& 1& 0& 0\\ 0& 0& cos(\xi /2)& -sin(\xi /2)\\ 0& 0& sin(\xi /2)& cos(\xi /2)\end{array}\right).\end{array}$$

(2)

The two-qubit gates (for example, the CNOT gate) is the most “expensive” for physical implementation. By “expensive”, we mean that both computational error and the difficulty of implementation on a real device are high. So, we consider the number of CNOT gates as a main complexity measure for a circuit. We call it CNOT cost.

At the same time, one two-qubit gate (CNOT gate as an example) and one-qubit gate are the basis for quantum circuits [69].

2.1.2. Quantum Query Model

Another popular model is the quantum query model. Let $f:D\to \{0,1\},D\subseteq {\{0,1\}}^M$ be an M variable function. We wish to compute on an input $x\in D$. We are given an oracle access to the input x, i.e., it is realized by a specific unitary transformation usually defined as $\left|i\right.〉\left|z\right.〉\left|w\right.〉\to \left|i\right.〉\left|z+x_i(mod2)\right.〉\left|w\right.〉$, where the $\left|i\right.〉$ register indicates the index of the variable we are querying, $\left|z\right.〉$ is the output register, and $\left|w\right.〉$ is some auxiliary work space. An algorithm in the query model consists of alternating applications of arbitrary unitary transformations independent of the input and the unitary query, and a measurement in the end. The smallest number of queries for an algorithm that outputs $f\left(x\right)$ with probability $\ge {\displaystyle \frac{2}{3}}$ on all x is called the quantum query complexity of the function f.

The model can be considered as a circuit with alternating unitary transformations of two types. The first one is a regular unitary transformation, the second one is a transformation that is controlled by input variables.

Search problem

Suppose that we have a set of objects named $\{1,2,\dots ,M\}$, of which some are targets. Suppose that $\mathcal{O}$ is an oracle that identifies the targets. The goal of a search problem is to find a target $i\in \{1,2,\dots ,M\}$ by making queries to the oracle $\mathcal{O}$.

In search problems, one will try to minimize the number of queries to the oracle. In the classical setting, one needs $O\left(M\right)$ queries to solve such a problem. Grover, on the other hand, constructed a quantum algorithm that solves the search problem with only $O\left(\sqrt{M}\right)$ queries [70], provided that there is a unique target. When the number of targets is unknown, Brassard et al. designed a modified Grover algorithm that solves the search problem with $O\left(\sqrt{M/\lambda }\right)$ queries [71], where $\lambda$ is the number of targets, which is of the same order as the query complexity of the Grover search.

2.1.3. Branching Programs

A quantum branching program (QBPs) is a known model of computations, a generalization of the classical branching program (BP) model of computations. We refer to [36,64] for more information on QBPs. Quantum branching programs and the quantum query model are closely related. They can be considered as a specific variant of each other depending on the point of view. For example, in the content of this work, QBPs can be considered as a special variant of the quantum query model, which can test only one input variable on a level of computation. Here, we define a QBP as found in [3,72]. Another point of view of the model is the data stream processing algorithms.

3. Quantum Hashing Technique

In this section, we present recent results on quantum hashing developed in our research group.

3.1. One-Way $\delta$-Resistance

We present the following definition of a quantum $\delta$-resistant one-way function. Let the “information extracting” mechanism M be a function $M:{\left({\mathcal{H}}^2\right)}^{\otimes s}\to \mathbb{X}$. Informally speaking, the mechanism M makes some measurement to state $\left|\psi \right.〉\in {\left({\mathcal{H}}^2\right)}^{\otimes s}$ and decodes the result of the measurement to $\mathbb{X}$.

Definition 1. 

Let X be a random variable distributed over $\mathbb{X}$ like $\left\{Pr\right[X=w]:w\in \mathbb{X}\}$. Let $\psi :\mathbb{X}\to {\left({\mathcal{H}}^2\right)}^{\otimes s}$ be a quantum function. Let Y be any random variable over $\mathbb{X}$ obtained by some mechanism M, causing a measurement to encode ψ of X and decoding the measurement result into $\mathbb{X}$. Let $\delta >0$. We call a quantum function ψ a one-way δ-resistant function if the following apply:

• It is easy to compute, i.e., a quantum state $\left|\psi \left(w\right)\right.〉$ for a particular $w\in \mathbb{X}$ can be determined using a polynomial-time algorithm;
• For any mechanism M, the probability $Pr[Y=X]$ that M successfully decodes Y is bounded by δ:

  $$Pr[Y=X]\le \delta .$$

  (3)

For cryptographic purposes, it is natural to expect (and this is applied in the rest of the paper) that the random variable X is uniformly distributed.

A quantum state of $s\ge 1$ qubits can “carry” an infinite amount of information. On the other hand, the fundamental result of quantum informatics known as Holevo’s Theorem [73] states that a quantum measurement can only give $O\left(s\right)$ bits of information about the state. Here, we use the result of [74] motivated by Holevo’s Theorem.

Property 1. 

Let X be a random variable uniformly distributed over ${\{0,1\}}^k$. Let $\psi :{\{0,1\}}^k\to {\left({\mathcal{H}}^2\right)}^{\otimes s}$ be a $(2^k;s)$ quantum function. Let Y be a random variable over ${\{0,1\}}^k$ obtained by some mechanism M making some measurement of the encoding ψ of X and decoding the measurement result to ${\{0,1\}}^k$. Then, the probability of correct decoding is given by

$$Pr[Y=X]\le {\displaystyle \frac{2^s}{2^k}}.$$

(4)

3.2. Collision $ϵ$-Resistance

The following definition was presented in [75].

Definition 2. 

Let $ϵ>0$. We call a quantum function $\psi :\mathbb{X}\to {\left({\mathcal{H}}^2\right)}^{\otimes s}$ a collision ϵ-resistant function if for any pair $w,w^{\prime }$ of different inputs,

$$\left|\langle \psi \left(w\right)\mid \psi \left(w^{\prime }\right)\rangle \right|\le ϵ.$$

(5)

Testing equality.

The crucial procedure for quantum hashing is an equality test for $\left|\psi \left(v\right)\right.〉$ and $\left|\psi \left(w\right)\right.〉$ that can be used to compare encoded classical messages v and w; see, for example, [27]. This procedure can be a well-known SWAP-test [22] or one that is adapted for specific hashing functions, like the REVERSE-test; see [23].

3.3. Balanced Quantum $(\delta ,ϵ)$-Resistance

The above two definitions and considerations lead to the following formalization of the quantum cryptographic (one-way and collision resistant) function.

Definition 3. 

Let $K=\left|\mathbb{X}\right|$ and $s\ge 1$. Let $\delta >0$ and $ϵ>0$. We call a function $\psi :\mathbb{X}\to {\left({\mathcal{H}}^2\right)}^{\otimes s}$ a quantum $(\delta ,ϵ)$-resistant $(K;s)$-hash function (or just quantum $(\delta ,ϵ)$-hash function) iff ψ is a one-way δ-resistant and a collision ϵ-resistant function.

Let $K={\Sigma }^m$ for some finite alphabet Σ, with an integer $m\gg s$. In which case, we call the function (m,ϵ,s)-quantum hash function if ψ is ϵ-resistant.

We present below the following two examples to demonstrate how one-way $\delta$-resistance and collision $ϵ$-resistance are correlated. The first example was presented in [32] in terms of quantum automata.

Example 1. 

Let us encode numbers v from $\{0,\dots ,2^k-1\}$ by a single qubit as follows:

$$\psi :v\mapsto cos\left({\displaystyle \frac{2\pi v}{2^k}}\right)\left|0\right.〉+sin\left({\displaystyle \frac{2\pi v}{2^k}}\right)\left|1\right.〉.$$

(6)

Extracting information from $\left|\psi \right.〉$ by measuring $\left|\psi \right.〉$ with respect to the basis $\{\left|0\right.〉,\left|1\right.〉\}$ gives the following result. The function $\psi$ is one-way ${\displaystyle \frac{2}{2^k}}$-resistant (see Property 1) and collision $cos\left(\pi /2^{k-1}\right)$-resistant. Thus, the function $\psi$ has a good one-way property, but has a bad collision resistance property for large k.

Example 2. 

Let $v={\sigma }_1\dots {\sigma }_k\in {\{0,1\}}^k$. We encode v by k qubits: $\psi :v\mapsto \left|v\right.〉=\left|{\sigma }_1\right.〉\dots \left|{\sigma }_k\right.〉$.

Extracting information from $\left|\psi \right.〉$ by measuring $\left|\psi \right.〉$ with respect to the basis $\{\left|0\dots 0\right.〉$,…, $\left|1\dots 1\right.〉\}$ gives the following result. The function $\psi$ is one-way 1-resistant and collision 0-resistant. So, in contrast to Example 1, the encoding $\psi$ from Example 2 is collision-free, that is, for different words v and w, the quantum states $\left|\psi \left(v\right)\right.〉$ and $\left|\psi \left(v\right)\right.〉$ are orthogonal and therefore reliably distinguished; but we lose the one-way property, i.e., $\psi$ is easily invertible.

The following result [75] shows that a quantum collision $ϵ$-resistant $(K;s)$ function needs at least $loglogK-c\left(ϵ\right)$ qubits.

Property 2. 

Let $s\ge 1$ and $K=\left|\mathbb{X}\right|\ge 4$. Let $\psi :\mathbb{X}\to {\left({\mathcal{H}}^2\right)}^{\otimes s}$ be a collision ϵ-resistant quantum hash function. Then,

$$s\ge loglogK-loglog\left(1+\sqrt{2/(1-ϵ)}\right)-1.$$

(7)

Proof. 

See [75] for the proof. □

Properties 1 and 2 provide a basis for building a “balanced” one-way $\delta$-resistance and collision $ϵ$-resistance properties. That is, roughly speaking, if we need to hash elements w from the domain $\mathbb{X}$ with $\left|\mathbb{X}\right|=K$ and if one can build for an $ϵ>0$ a collision $ϵ$-resistant $(K;s)$ hash function $\psi$ with $s\approx loglogK-c\left(ϵ\right)$ qubits, then the function f is one-way $\delta$-resistant with $\delta \approx (logK/K)$. Such a function is balanced with respect to Property 2.

To summarize the above considerations, we can state the following. A quantum $(\delta ,ϵ)$-hash function is a function that satisfies all of the properties that a “classical” hash function should satisfy. Pre-image resistance follows from Property 1. The second pre-image and collision resistance follow, because all inputs are mapped to states that are nearly orthogonal. Therefore, we see that quantum hash functions can satisfy the three properties of a classical cryptographic hash function.

3.4. Quantum $(\delta ,ϵ)$-Hash Function Construction via Small-Biased Sets

This section is based on [40]. We present here a brief background on $ϵ$-biased sets as defined in [76] and discuss their connection to quantum hashing. Note that $ϵ$-biased sets are generally defined for arbitrary finite groups, but here we restrict ourselves to ${\mathbb{Z}}_q$.

For an $a\in {\mathbb{Z}}_q$, a character ${\chi }_a$ of ${\mathbb{Z}}_q$ is a homomorphism ${\chi }_a:{\mathbb{Z}}_q\to {\mu }_q$, where ${\mu }_q$ is the (multiplicative) group of complex q-th roots of unity. That is, ${\chi }_a\left(x\right)={\omega }^{ax}$, where $\omega =e^{{\displaystyle \frac{2\pi i}{q}}}$ is a primitive q-th root of unity. The character ${\chi }_0\equiv 1$ is called a trivial character.

Definition 4. 

A set $S\subseteq {\mathbb{Z}}_q$ is called ϵ-biased if for any nontrivial character $\chi \in \{{\chi }_a:a\in {\mathbb{Z}}_q\}$,

$${\displaystyle \frac{1}{\left|S\right|}}\left|\sum _{x\in S}\chi \left(x\right)\right|\le ϵ.$$

(8)

These sets are interesting when $\left|S\right|\ll |{\mathbb{Z}}_q|$ (as $S={\mathbb{Z}}_q$ is 0-biased). In their seminal paper, Naor and Naor [77] defined these small-biased sets, gave the first explicit constructions of such sets, and demonstrated the power of small-biased sets for several applications.

Remark 1. 

Note that a set S of $O(logq/{ϵ}^2)$ elements selected uniformly at random from ${\mathbb{Z}}_q$ is ϵ-biased with positive probability [78].

Many other constructions of small-biased sets followed over the last few decades.

Vasiliev [40] showed that $ϵ$-biased sets generate ($\delta$,$ϵ$)-resistant hash functions. We present the result of [40] in the following form.

Property 3. 

Let $S\subseteq {\mathbb{Z}}_q$ be an ϵ-biased set. Let

$$H_S=\{h_a\left(x\right)=ax(modq),a\in S,h_a:{\mathbb{Z}}_q\to {\mathbb{Z}}_q\}$$

(9)

be a set of functions determined by S. Then, a quantum function ${\psi }_S:{\mathbb{Z}}_q\to {\left({\mathcal{H}}^2\right)}^{\otimes log\left|S\right|}$

$$\left|{\psi }_S\left(x\right)\right.〉={\displaystyle \frac{1}{\sqrt{\left|S\right|}}}\sum _{a\in S}{\omega }^{h_a\left(x\right)}\left|a\right.〉$$

(10)

is a $(\delta ,ϵ)$-resistant quantum hash function, where $\delta \le \left|S\right|/q$.

Proof. 

The one-way $\delta$-resistance property of ${\psi }_S$ follows from Property 1: the probability of correctly decoding an x from a quantum state $\left|{\psi }_S\left(x\right)\right.〉$ is bounded by $\left|S\right|/q$. The efficient computability of such a function follows from the fact that any quantum transformation on s qubits (including the one that creates a quantum hash) can be performed with $O\left(s^2{4}^s\right)$ elementary quantum gates [1]. Whenever $s=O(log\left|S\right|)=O(loglogq-logϵ)$, this number of steps is polynomial in $logq$ (the binary representation of group elements) and $1/ϵ$.

The collision $ϵ$-resistance property of ${\psi }_S$ follows directly from the corresponding property of [40]. Note that

$$\left|{\psi }_S\left(x\right)\right.〉={\displaystyle \frac{1}{\sqrt{\left|S\right|}}}\sum _{a\in S}{\omega }^{h_a\left(x\right)}\left|a\right.〉={\displaystyle \frac{1}{\sqrt{\left|S\right|}}}\sum _{a\in S}{\chi }_x\left(a\right)\left|a\right.〉.$$

(11)

The remainder of this proof coincides with the proof of the paper [40]. □

Remark 2. 

It is natural to call the set $H_S$ of functions a uniform $ϵ$-biased quantum hash generator in the context of the definition of a quantum hash generator from [24] and the above considerations.

As a corollary of Property 3 and the above considerations, we can state the following.

Property 4. 

For a small sized ϵ-biased set $S=\{s_1,\dots ,s_d\}\subset {\mathbb{Z}}_q$ with $d=O(logq/{ϵ}^2)$, for $\delta \le O\left({\displaystyle \frac{logq}{{ϵ}^{2}q}}\right)$, a quantum hash generator $H_S$ generates the balanced $(\delta ,ϵ)$-resistant quantum hash function ${\psi }_S$ given by

$$\left|{\psi }_S\left(a\right)\right.〉={\displaystyle \frac{1}{\sqrt{d}}}\sum _{j=1}^d{\omega }^{a{s}_j}\left|j\right.〉.$$

(12)

3.5. Quantum Hashing for Finite Abelian Groups

In [40], we proposed the notion of a quantum hash function, which is defined for arbitrary finite abelian groups.

Let G be a finite abelian group with characters ${\chi }_a$, indexed by $a\in G$. Let $S\subseteq G$ be an $\epsilon$-biased set for some $\epsilon \in (0,1)$.

Definition 5. 

We define a quantum hash function ${\psi }_S:G\to {\left({\mathcal{H}}^2\right)}^{\otimes log\left|S\right|}$ as follows:

$$\left|{\psi }_S\left(a\right)\right.〉={\displaystyle \frac{1}{\sqrt{\left|S\right|}}}\sum _{j=1}^{\left|S\right|}{\chi }_a\left(s_j\right)\left|j\right.〉.$$

(13)

We have shown that ${\psi }_S$ has all the properties of a cryptographic quantum hash function (i.e., it is quantum one-way and collision-resistant), which are entirely determined by the $\epsilon$-biased set $S\subseteq G$.

There are two known special cases of quantum hashing for specific finite abelian groups, which turn out to be the known quantum fingerprinting method. In particular, we are interested in hashing binary strings, and thus, it is natural to consider $G={\mathbb{Z}}_2^n$ and $G={\mathbb{Z}}_{2^n}$ (or, more generally, any cyclic group ${\mathbb{Z}}_q$).

Hashing the elements of the Boolean cube.

For $G={\mathbb{Z}}_2^n$, its characters can be written in the form ${\chi }_a\left(x\right)={(-1)}^{(a,x)}$, and the corresponding quantum hash function is the following:

$$\left|{\psi }_S\left(a\right)\right.〉={\displaystyle \frac{1}{\sqrt{\left|S\right|}}}\sum _{j=1}^{\left|S\right|}{(-1)}^{(a,s_j)}\left|j\right.〉.$$

(14)

The resulting hash function is exactly the quantum fingerprinting by Buhrman et al. [22], once we consider an error-correcting code, whose matrix is built from the elements of S. Indeed, as stated in [79] an $\epsilon$-balanced error-correcting code can be constructed out of an $\epsilon$-biased set. Thus, the inner product $(a,x)$ in the exponent is equivalent to the corresponding bit of the codeword, and altogether, this gives the quantum fingerprinting function, which stores information in the phase of quantum states [80].

Hashing the elements of the cyclic group

For $G={\mathbb{Z}}_q$, its characters can be written as ${\chi }_a\left(x\right)=exp\left(2\pi iax/q\right)$, and the corresponding quantum hash function is given by

$$\left|{\psi }_S\left(a\right)\right.〉={\displaystyle \frac{1}{\sqrt{\left|S\right|}}}\sum _{j=1}^{\left|S\right|}{\omega }^{a{s}_j}\left|j\right.〉.$$

(15)

The above quantum hash function is essentially equivalent to the one we have defined earlier in [23], which is in turn based on the quantum fingerprinting function from [37].

3.6. Single-Qubit Version of Quantum Hashing

In [46], we constructed an OAM-based version of the quantum hash function, which was defined as follows.

For the classical input $x\in \{0,1,\dots ,q-1\}$, we create its quantum image composed of s single-photon states:

$$\left|{\psi }_j\left(x\right)\right.〉={\displaystyle \frac{1}{\sqrt{2}}}(\left|0\right.〉+e^{i{\displaystyle \frac{2\pi b_{j}x}{q}}}\left|1\right.〉),$$

(16)

$$\left|\psi \left(x\right)\right.〉=\left|{\psi }_1\left(x\right)\right.〉\otimes \cdots \otimes \left|{\psi }_s\left(x\right)\right.〉,$$

(17)

where $b_j\in \{0,1,\dots ,q-1\}$ are numeric parameters of the quantum hash function that provide its collision resistance.

The main idea behind quantum hashing is to provide the minimal fidelity of different quantum hash codes (collision resistance) with the minimal possible number of qubits (that affects the one-way property). As mentioned in [25], there is always a trade-off between these two properties, so balancing them in a quantum hash function is an important task.

The fidelity of $\left|\psi \left(x_1\right)\right.〉$ and $\left|\psi \left(x_2\right)\right.〉$ is given by ${\left|\langle \psi \left(x_1\right)\mid \psi \left(x_2\right)\rangle \right|}^2$, and for the OAM-based hash function above, it is equal to

$$\begin{array}{cc}\hfill {\left|\langle \psi \left(x_1\right)\mid \psi \left(x_2\right)\rangle \right|}^2& ={\displaystyle \frac{1}{2^{2s}}}\prod _{j=1}^s{\left|1+e^{i{\displaystyle \frac{2\pi b_j(x_2-x_1)}{q}}}\right|}^2=\hfill \\ \hfill & ={\displaystyle \frac{1}{2^{2s}}}\prod _{j=1}^s\left[{\left(1+cos{\displaystyle \frac{2\pi b_j(x_2-x_1)}{q}}\right)}^2+{\left(sin{\displaystyle \frac{2\pi b_j(x_2-x_1)}{q}}\right)}^2\right]=\hfill \\ \hfill & ={\displaystyle \frac{1}{2^{2s}}}\prod _{j=1}^s\left(2+2cos{\displaystyle \frac{2\pi b_j(x_2-x_1)}{q}}\right)=\hfill \\ \hfill & ={\displaystyle \frac{1}{2^s}}\prod _{j=1}^s\left(1+cos{\displaystyle \frac{2\pi b_j(x_2-x_1)}{q}}\right)=\hfill \\ \hfill & ={\displaystyle \frac{1}{2^s}}\prod _{j=1}^s\left(2{cos}^2{\displaystyle \frac{\pi b_j(x_2-x_1)}{q}}\right)=\hfill \\ \hfill & =\prod _{j=1}^s{cos}^2{\displaystyle \frac{\pi b_j(x_2-x_1)}{q}}.\hfill \end{array}$$

(18)

Thus, from (18), the set of parameters $B=\{b_1,\dots ,b_s\}\subset {\mathbb{Z}}_q$ should give the minimal fidelity of all pairs of unequal $\left|\psi \left(x_1\right)\right.〉$ and $\left|\psi \left(x_2\right)\right.〉$, i.e.,

$$B=\underset{b_1,\dots ,b_s\in {\mathbb{Z}}_q}{argmin}\underset{\begin{array}{c}{x}_1,x_2\in {\mathbb{Z}}_q\\ x_1\ne x_2\end{array}}{max}{\displaystyle \frac{1}{2^s}}\prod _{j=1}^s{cos}^2{\displaystyle \frac{\pi b_j(x_2-x_1)}{q}}=\underset{b_1,\dots ,b_s\in {\mathbb{Z}}_q}{argmin}\underset{\begin{array}{c}x\in {\mathbb{Z}}_q\\ x\ne 0\end{array}}{max}{\displaystyle \frac{1}{2^s}}\prod _{j=1}^s{cos}^2{\displaystyle \frac{\pi b_{j}x}{q}}.$$

(19)

In [81], we proved the existence of the parameter set $B=\{b_1,\dots ,b_s\}$ described by Formula (19). The proof develops the ideas from [32] and uses a similar notion of the “good” parameters. The following lemma has been proven.

Lemma 1. 

There is a set $B=\{b_1,\dots ,b_s\}$ with $\left|B\right|=s=\lceil 16lnq\rceil$, which is “good” for all $g\ne 0modq$.

In [82], the following connection between the single-qubit version and the “entangled” version was shown. Let $m=logd$ be the number of qubits. Let $B=\{b_1,b_2,\dots ,b_m\}\subseteq {\mathbb{Z}}_q$, and consider a special case where elements of $S=\{s_0,s_1,\dots ,s_{(d-1)}\}\subseteq {\mathbb{Z}}_q$ are equal to sums of all possible subsets of B, i.e., for $j=j_1{j}_2\dots j_m$,

$$s_j=j_1{b}_1+j_2{b}_2+\cdots +j_m{b}_m.$$

(20)

Then, the following holds:

$$\begin{array}{c}\hfill \left[{\displaystyle \frac{1}{\sqrt{2}}}(\left|0\right.〉+e^{i{\displaystyle \frac{2\pi b_{1}x}{q}}}\left|1\right.〉)\right]\otimes \cdots \otimes \left[{\displaystyle \frac{1}{\sqrt{2}}}(\left|0\right.〉+e^{i{\displaystyle \frac{2\pi b_{m}x}{q}}}\left|1\right.〉)\right]=\\ \hfill {\displaystyle \frac{1}{\sqrt{2^m}}}\left[\sum _{j_1=0}^1{e}^{i{\displaystyle \frac{2\pi (j_1\ast b_1)x}{q}}}\left|j_1\right.〉\right]\otimes \cdots \otimes \left[\sum _{j_m=0}^1{e}^{i{\displaystyle \frac{2\pi (j_m\ast b_m)x}{q}}}\left|j_m\right.〉\right]=\\ \hfill {\displaystyle \frac{1}{\sqrt{2^m}}}\sum _{j_1=0}^1\dots \sum _{j_m=0}^1{e}^{i{\displaystyle \frac{2\pi (j_1\ast b_1+\dots +j_m\ast b_m)x}{q}}}\left|j_1\cdots j_m\right.〉={\displaystyle \frac{1}{\sqrt{d}}}\sum _{j=0}^{d-1}{e}^{i{\displaystyle \frac{2\pi s_{j}x}{q}}}\left|j\right.〉.\end{array}$$

(21)

Thus, the quantum hash function ${\psi }_S$ can be computed by a circuit that has just two layers—the first layer contains Hadamard gates for all qubits, and the second layer contains single-qubit gates equivalent to $R_z$ rotations. To do so, we need to choose the set of parameters $B=\{b_1,\dots ,b_m\}$ that generates the $\epsilon$-biased set S according to Equation (20).

3.7. Multiqudit Quantum Hashing

In [47], we defined another version of the quantum hashing technique for a cyclic group, i.e., we considered $\mathbb{X}={\mathbb{Z}}_q$ and $\left|\mathbb{X}\right|=q$. It is based on small-biased sets and high-dimensional states (qudits). But first, we note the following equivalence between $\epsilon$-biased sets.

Property 5. 

Let $S=\{s_1,\dots ,s_d\}$ and $S^{\prime }=\{0,(s_2-s_1),\dots ,(s_d-s_1)\}$. Then, for any $x\in {\mathbb{Z}}_q$$bias(S,x)=bias(S^{\prime },x)$, i.e., the set S is equivalent (in terms of its bias) to $S^{\prime }$.

Proof. 

The proof of this statement is based on the following considerations:

$${\displaystyle \frac{1}{d}}\left|\sum _{k=1}^d{e}^{2\pi s_{k}x/q}\right|={\displaystyle \frac{1}{d}}\left|e^{2\pi s_{1}x/q}\right|\left|\sum _{k=1}^d{e}^{2\pi (s_k-s_1)x/q}\right|={\displaystyle \frac{1}{d}}\left|\sum _{k=1}^d{e}^{2\pi (s_k-s_1)x/q}\right|;$$

(22)

therefore,

$$bias(S,x)={\displaystyle \frac{1}{d}}\left|\sum _{k=1}^d{e}^{2\pi s_{k}x/q}\right|={\displaystyle \frac{1}{d}}\left|\sum _{k=1}^d{e}^{2\pi (s_k-s_1)x/q}\right|=bias(S^{\prime },x).$$

(23)

□

Now, let $S_1,S_2,\dots ,S_m\subset {\mathbb{Z}}_q$ be the $\epsilon$-biased subsets of ${\mathbb{Z}}_q$, and we denote $S_j=\{s_{j,1},\dots ,s_{j,d}\}$ for $j=1,\dots ,m$. By Property 5, without loss of generality, we may consider all $s_{j,1}$ to be equal 0. In other words, for all $j=1,\dots ,m$ it holds that

$$\underset{x\ne 0}{max}{\displaystyle \frac{1}{d}}|1+e^{i{\displaystyle \frac{2\pi s_{j,2}x}{q}}}+\dots +e^{i{\displaystyle \frac{2\pi s_{j,d}x}{q}}}|\le \epsilon .$$

(24)

Then, for $x\in {\mathbb{Z}}_q$, we define a multiqudit quantum hash function in the following way:

$$\left|{\psi }_j\left(x\right)\right.〉={\displaystyle \frac{1}{\sqrt{d}}}(\left|{\ell }_1\right.〉+e^{i2\pi s_{j,2}x/q}\left|{\ell }_2\right.〉+\dots +e^{i2\pi s_{j,d}x/q}\left|{\ell }_d\right.〉),$$

(25)

$$\left|\psi \left(x\right)\right.〉=\left|{\psi }_1\left(x\right)\right.〉\otimes \dots \otimes \left|{\psi }_m\left(x\right)\right.〉,$$

(26)

where $\left|{\ell }_k\right.〉$ are the basis states ($k=1\dots d$; d is the dimension of the qudit state space), q is the size of the input state space, $x\in \{0,1,\dots ,q-1\}$ is a classical input that is encoded by the relative phase of m qudit states, and $s_{i,k}$ are numeric parameters (elements of the $\epsilon$-biased sets) of the quantum hash function that provide its collision resistance. The main idea of the collision resistance property is to provide minimum fidelity between different quantum hashes (quantum hash function images) with the minimum possible number of quantum information carriers. Furthermore, reaching a reasonable balance between collision resistance property and one-way property for a quantum hash function is also an important task.

Note that the formula for $\left|\psi \left(x\right)\right.〉$ gives the classical–quantum function that transforms a classical input into the quantum state composed of m qudits (d-dimensional systems). The same state can be constructed with an appropriate number of 2-dimensional systems (qubits); however, this would imply creating entangled states, which are harder to create and maintain.

Theorem 1. 

The classical–quantum function $\psi :{\mathbb{Z}}_q\to {\mathcal{H}}^{d^m}$ given by Equations (25) and (26) is a $\left({\displaystyle \frac{d^m}{q}},{\epsilon }^m\right)$-resistant quantum hash function.

Proof. 

According to Definition 3, we need to show two main properties for the function $\psi$:

• $\delta$-One-wayness: The dimension of the input space is q, and the quantum state space has dimension $d^m$. Thus, $\psi$ is $\delta$-one-way for

  $$\delta ={\displaystyle \frac{d^m}{q}}.$$

  (27)
• $\epsilon$-Collision resistance: The maximal inner product between unequal quantum hashes is bounded by

  $$\begin{array}{cc}\hfill \underset{x_1\ne x_2}{max}|\langle \psi \left(x_1\right)\mid \psi \left(x_2\right)\rangle |& =\underset{x_1\ne x_2}{max}\prod _{j=1}^m\left[{\displaystyle \frac{1}{d}}|1+e^{i{\displaystyle \frac{2\pi s_{j,2}(x_2-x_1)}{q}}}+\dots +e^{i{\displaystyle \frac{2\pi s_{j,d}(x_2-x_1)}{q}}}|\right]\hfill \\ \hfill & =\underset{x\ne 0}{max}|\langle \psi \left(x\right)\mid \psi \left(0\right)\rangle |\hfill \\ \hfill & =\underset{x\ne 0}{max}\prod _{j=1}^m\left[{\displaystyle \frac{1}{d}}|1+e^{i{\displaystyle \frac{2\pi s_{j,2}x}{q}}}+\dots +e^{i{\displaystyle \frac{2\pi s_{j,d}x}{q}}}|\right]\le {\epsilon }^m,\hfill \end{array}$$

  (28)

  if all $S_j=\{s_{j,1},\dots ,s_{j,d}\}$ are $\epsilon$-biased sets.

Thus, $\psi$ corresponds to the balanced $\left({\displaystyle \frac{d^m}{q}},{\epsilon }^m\right)$-resistant quantum hash function according to [25]. □

Note that the proof above also suggests that comparing hashes of two different values $x_1$ and $x_2$ is equivalent to comparing hashes of $x=(x_2-x_1)$ and 0.

Remark 3. 

Although ε-biased sets give guaranteed collision resistance to our multiqudit quantum hash function, for small sizes of input and output spaces, better bounds on collision resistance can be obtained by numeric optimization (see Table 1 for details).

At the moment, this approach can be used only for relatively small values of $d,m$ and q since it implies an exhaustive search for optimal values of $s_{j,k}$ that give minimum to the following function:

$$\underset{\left\{s_{j,k}\right\}}{min}\underset{x\ne 0}{max}{\displaystyle \frac{1}{d^m}}\prod _{j=1}^m|1+e^{i{\displaystyle \frac{2\pi s_{j,2}x}{q}}}+\dots +e^{i{\displaystyle \frac{2\pi s_{j,d}x}{q}}}|.$$

(29)

Note that the general lower bound suggests that, for an input state space of size q, a collision probability bounded by ${\epsilon }^m$ implies that a target quantum state space should have a size of at least $\mathsf{\Omega }((logq)/{\epsilon }^m$). On the other hand, there exist $\epsilon$-biased sets of size $d=O\left(\right(logq)/\epsilon )$, and thus, our construction gives the output state space of $d^m=O({(logq)}^m/{\epsilon }^m)$.

Table 1. The worst-case values of collision probability with parameters from $\epsilon$-biased sets and from the numeric optimization, $q=256$.

Number of Qudits	$\mathit{\epsilon }$-Biased Sets	Exhaustive Search
	$d=2$
1	0.9998	0.9998
2	0.9996	0.959
3	0.9994	0.7519
4	0.9992	0.4378
5	0.999	0.2031
6	0.9988	0.0806
7	0.9986	0.0279
	$d=3$
1	0.9681	0.9681
2	0.9372	0.5422
3	0.9073	0.1483
4	0.8784	0.0368
5	0.8504	0.0063
	$d=4$
1	0.8329	0.8329
2	0.6937	0.2174
3	0.5778	0.0429
4	0.4813	0.0072

Table 1. The worst-case values of collision probability with parameters from $\epsilon$-biased sets and from the numeric optimization, $q=256$.

Number of Qudits	$\mathit{\epsilon }$-Biased Sets	Exhaustive Search
	$d=2$
1	0.9998	0.9998
2	0.9996	0.959
3	0.9994	0.7519
4	0.9992	0.4378
5	0.999	0.2031
6	0.9988	0.0806
7	0.9986	0.0279
	$d=3$
1	0.9681	0.9681
2	0.9372	0.5422
3	0.9073	0.1483
4	0.8784	0.0368
5	0.8504	0.0063
	$d=4$
1	0.8329	0.8329
2	0.6937	0.2174
3	0.5778	0.0429
4	0.4813	0.0072

4. Implementation of the Multiqudit Quantum Hashing on Real Devices

In the previous section, we suggested quantum hash functions as a sequence of independent qubits, where the classical information was encoded in the qubit phase. Now, we propose a quantum hashing protocol, where the information carriers are high-dimensional states with an orbital angular momentum. In this case, the structure of the quantum hash can be represented by Equations (25) and (26).

Here, we propose the implementation of a verification procedure whereby for a given quantum hash $\left|\psi \left(x_1\right)\right.〉$ and a classical value $x_2$, it checks whether or not $x_1=x_2$. The ideal quantum experiment that verifies a multiqubit quantum hash can be set as follows:

• We receive a quantum hash of some generally unknown value $x_1$ as a sequence of m single photons in the overall state $\left|\psi \left(x_1\right)\right.〉$:

  $$\left|\psi \left(x_1\right)\right.〉=\left|{\psi }_1\left(x_1\right)\right.〉\otimes \dots \otimes \left|{\psi }_m\left(x_1\right)\right.〉,$$

  (30)

  where the j-th qudit is expected to be in the state $\left|{\psi }_j\left(x_1\right)\right.〉$ as described by Equation (25).
• Then, we check whether $x_1$ is equal to some predefined $x_2$ or not. To execute this, we perform measurements that project $\left|{\psi }_j\left(x_1\right)\right.〉$ onto $\left|{\psi }_j\left(x_2\right)\right.〉$ and $d-1$-phase orthogonal states:

  $$\left|{\psi }_j^{\perp ,g}\left(x_2\right)\right.〉={\displaystyle \frac{1}{\sqrt{d}}}(\left|{\ell }_1\right.〉+e^{i{\displaystyle \frac{2\pi s_{j,2}{x}_2}{q}}+i{\varphi }_{g,2}}\left|{\ell }_2\right.〉+\dots +e^{i{\displaystyle \frac{2\pi s_{j,d}{x}_2}{q}}+i{\varphi }_{g,d})}\left|{\ell }_d\right.〉),$$

  (31)

  where $|\langle {\psi }_j\left(x_2\right)\mid {\psi }_j^{\perp ,g}\left(x_2\right)\rangle {|}^2=0$, $g=1,\dots ,d-1$, and ${\varphi }_{g,d}$ are additional phases responsible for the orthogonality of the states. For example, if we use qutrits (3-dimensional states) as information carriers, the set of $\left\{{\varphi }_{g,d}\right\}$ is equal to {{$2\pi /3,-2\pi /3$},{$-2\pi /3,2\pi /3$}}.
• The projection measurements of these states may be sequential or parallel. In the latter case, we have to prepare a complex phase mask on part 2 of SLM1, which is an appropriate superposition of detection masks for $\left|{\psi }_j\left(x_2\right)\right.〉$ and $d-1$ states $\left|{\psi }_j^{\perp ,g}\left(x_2\right)\right.〉$. The complex mask directs the photons into d detection channels corresponding to the states $\left|{\psi }_j\left(x_2\right)\right.〉,\left|{\psi }_j^{\perp ,1}\left(x_2\right)\right.〉,\dots ,\left|{\psi }_j^{\perp ,d-1}\left(x_2\right)\right.〉$, respectively. The single-photon detector click in $\left|{\psi }_j\left(x_2\right)\right.〉$ or $\left|{\psi }_j^{\perp ,g}\left(x_2\right)\right.〉$ channels corresponds to the outcome $\left|{\psi }_j\left(x_1\right)\right.〉=\left|{\psi }_j\left(x_2\right)\right.〉$ or $\left|{\psi }_j\left(x_1\right)\right.〉\ne \left|{\psi }_j\left(x_2\right)\right.〉$, respectively.
• If $x_1=x_2$, the detector of the output $\left|{\psi }_j\left(x_2\right)\right.〉$ would always click, while the other detectors would never click.
• If $x_1\ne x_2$, each of the detectors might click, but the probability of the erroneous outcome “$x_1=x_2$” is bounded by the construction of the quantum hash function $\left|\psi \left(x\right)\right.〉$.
• If none of the detectors clicked, then the qudit is lost, and we either request for it to be sent again or tolerate the higher error probability.
• If all of m measurements end up with the outcome "$\left|{\psi }_j\left(x_1\right)\right.〉=\left|{\psi }_j\left(x_2\right)\right.〉$", then the final result of the experiment is considered to be “$x_1=x_2$”. Otherwise, if at least one qudit leads to $\left|{\psi }_j\left(x_1\right)\right.〉\ne \left|{\psi }_j\left(x_2\right)\right.〉$, then the overall result is also "$x_1\ne x_2$".

The error probability comes from the fidelity between two different quantum hashes, which is

$$|\langle \psi \left(x_1\right)\mid \psi \left(x_2\right)\rangle {|}^2={\displaystyle \frac{1}{d^{2m}}}\prod _{j=1}^m|1+e^{i{\displaystyle \frac{2\pi s_{j,2}(x_1-x_2)}{q}}}+\dots +e^{i{\displaystyle \frac{2\pi s_{j,d}(x_1-x_2)}{q}}}{|}^2.$$

(32)

The parameter set $\left\{s_{j,k}\right\}$ is chosen in such a way that the pairs of hashes $\left|\psi \left(x_1\right)\right.〉$ and $\left|\psi \left(x_2\right)\right.〉$ give the minimal fidelity for $x_1\ne x_2$. To measure the collision probability, we compare different quantum hashes in the worst-case scenario when quantum hashes for $x_1$ and $x_2$ have the maximum fidelity for a given set $\left\{s_{j,k}\right\}$.

The protocol starts with a calibration step on which we adjust the coincidence count rate for the “yes” answer (“$x_1=x_2$”). We perform about 200 projection measurements of equal states and calculate the average coincidence count rate between signal and idler photons. The simultaneous clicks in the idler and signal detectors mean that the idler photon has been prepared in the state $\left|\psi \left(x_1\right)\right.〉$ and has been successfully projected on the state $\left|\psi \left(x_2\right)\right.〉$. We pick the average value as the threshold between “yes” and “no”. In this work, we experimentally evaluate the collision probability for a multiqudit quantum hash function with $q=256$ and three groups of parameters: (i) $d=2$ and $m=1,\dots ,7$, (ii) $d=3$ and $m=1,\dots ,5$, and (iii) $d=4$ and $m=1,\dots ,4$, i.e., we perform experiments with varying numbers of qubits, qutrits, and ququarts. We encode the classical message $x_1$ into the phase of states considered in Section 3.7. Since we consider the worst-case situation, without loss of generality, we can focus on the case when $x_2=0$. This can be calculated from

$$x_1=\arg \underset{x\ne 0}{max}{\displaystyle \frac{1}{d^{2m}}}\prod _{j=1}^m|1+e^{i{\displaystyle \frac{2\pi s_{j,2}x}{q}}}+\dots +e^{i{\displaystyle \frac{2\pi s_{j,d}x}{q}}}{|}^2$$

(33)

for an optimal (quasioptimal) set of parameters $\left\{s_{j,k}\right\}$, which in turn is precomputed as

$$\left\{s_{j,k}\right\}=\arg \underset{\left\{s_{j,k}\right\}}{min}\underset{x\ne 0}{max}{\displaystyle \frac{1}{d^{2m}}}\prod _{j=1}^m|1+e^{i{\displaystyle \frac{2\pi s_{j,2}x}{q}}}+\dots +e^{i{\displaystyle \frac{2\pi s_{j,d}x}{q}}}{|}^2.$$

(34)

Figure 1 shows the comparison of experimental and theoretical error rates for the worst-case scenario depending on different dimensions of quantum states. The experimental results suggest that the proposed technique can be useful even for small sizes of input and output states. Moreover, it can be seen that the number of information carriers decreases with an increase in their quantum state dimension for an optimal relation between the collision probability and the decoding probability (the probability of extracting the classical input x from the quantum hash). For instance, if we limit the collision probability by 0.25 and the decoding probability by 0.15, the optimal number of qudits to “compress” an 8-bit classical information proves to be $m=5$ for $d=2$, $m=3$ for $d=3$, and $m=2$ for $d=4$. Moreover, according to the Holevo theorem [73], no more information can be extracted from a quantum d-level system than from a classical d-level system, which means that we have a bounded probability (below 1) to extract the information about classical input x.

5. Searching Coefficients

The main properties of the quantum hash function are defined by the set of coefficients S; therefore, it is important to explore methods to find the sets of coefficients that lead to quantum hash functions with a small probability $\epsilon$ of error. Although there are explicit methods of construction, these are usually slow or their results are worse than those of heuristic methods. This section covers several methods of search, such as brute-force algorithms, random search, genetic algorithms, simulated annealing, and deterministic methods.

Let us define the problem formally. Consider ${\epsilon }_0>0$ and $q\in \mathbb{N}$. First, we choose the size $d=d({\epsilon }_0,q)$ of the parameter set $S=\{s_1,\dots ,s_t\}$, for example, using Property 2 or Remark 1. Second, we search for the parameter set S such that $\epsilon =\epsilon \left(S\right)\le {\epsilon }_0$, where

$$\epsilon \left(S\right)={\displaystyle \frac{1}{d}}|\sum _{j=1}^{t}cos{\displaystyle \frac{2\pi s_j}{q}}|,$$

(35)

or is defined in a similar way for the other variants of quantum hash functions. We compare different methods in terms of their running time expressed as a function of q, d, and ${\epsilon }_0$. Note that we include the time of computing $\epsilon \left(S\right)$ into the whole running time of the algorithm.

In the brute-force method, we systematically check all possible assignments of $s_j\in \{0,\dots ,q-1\}$, $j=1,\dots ,d$. For example, we can start from the assignment $s_1=0,s_2=0,\dots ,s_d=0$, and then move on to the next assignment by increasing the rightmost coefficient $s_k$ that is not equal to $q-1$ along with setting all $s_j=0$ for $j>k$. The running time of the brute-force method is $O\left(d{q}^d\right)$.

The random search method takes advantage of Remark 1, and repeatedly chooses a random set S until it satisfies the condition $\epsilon \left(S\right)\le {\epsilon }_0$. While this process could be infinite, Remark 1 ensures that for properly chosen d, the expected running time of the algorithm is $O\left(dq\right)$.

Heuristic algorithms, such as genetic algorithms or simulated annealing, reduce the amount of search space, but may not find the best solution. For example, genetic algorithms use analogies from the evolutionary process. First, they generate the pool of “organisms” (several random sets S); then, they select those that are best suited (i.e., those with smaller $\epsilon \left(S\right)$) and “breed” them (i.e., for two sets $S^{\left(1\right)}=\{s_1^{\left(1\right)},\dots ,s_d^{\left(1\right)}\}$ and $S^{\left(2\right)}=\{s_1^{\left(2\right)},\dots ,s_d^{\left(2\right)}\}$, they generate the set $S=\{s_1^{\left(1\right)},\dots ,s_k^{\left(1\right)},s_{k+1}^{\left(2\right)},\dots ,s_d^{\left(2\right)}\}$ for some random $k=1,\dots ,t-1$).

Simulated annealing, another heuristic algorithm, likens the search to the heat treatment of steel. It starts with a set $S=\{s_1,\dots ,s_d\}$, and it sets a parameter T (a “temperature”) to a high value, and then starts to slowly decrease it. At each iteration, the probability of changing a random coefficient $s_k$ to another value depends on temperature and $\epsilon \left(S\right)$, with higher temperature permitting larger changes. The heuristic algorithms are presented in [38].

Deterministic methods are usually based on derandomization techniques. For example, Khadieva and Ziiatdinov [68] implemented the algorithm described in [83] to compute the parameter set and performed numerical experiments.

6. Circuit Representation of Quantum Hashing and Implementation on Noisy Simulators

6.1. Full Quantum Circuit for Quantum Hashing

The basic implementation part of quantum hashing circuits is a uniformly controlled rotation operator (see Figure 2). We denote the uniformly controlled rotation operator for n control qubits and one target qubit as the $UC{R}_d$ operator.

Here, $R_a^j$ is the rotation to a ${\displaystyle \frac{2\pi s_j}{q}}$ angle by the a axis, that is, z or y. It depends on the type of hashing function: y for the amplitude form, and z for the phase form.

Many types of quantum computers (for example, quantum devices based on superconductors) do not allow us to apply two-qubit gates to an arbitrary pair of qubits but have a graph that represents such a restriction. Vertices of the graph correspond to qubits, and two-qubit gates can be applied only to qubits corresponding to vertices connected by an edge. We say that such a graph represents the qubit connection graph for a device.

If the qubit connection graph is complete, i.e., we do not have any restriction on the two-qubit gate application, then the CNOT cost of the uniformly controlled rotation operator is as presented in the following lemma.

Theorem 2. 

([84,85]) The CNOT cost of the d-qubit uniformly controlled rotation operator $UC{R}_d$ is $2^d$.

One of the most popular architectures considered by researchers is the linear nearest neighbor (LNN) architecture. The graph for LNN architecture is a chain where the i-th vertex is connected only with vertices $i-1$ and $i+1$ (see Figure 3).

A circuit for the LNN architecture was presented by Möttönen, Vartiainen, Bergholm, and Salomaa in [84,85] (see Figure 4).

The restriction on architecture slightly affects the CNOT cost, which is discussed in the next theorem.

Theorem 3. 

([84,85]) The CNOT cost of the d-qubit uniformly controlled rotation operator $UC{R}_d$ for the LNN architecture is ${\displaystyle \frac{10}{6}}{2}^d+3d-9$.

Zinnatullin, Khadiev, and Khadieva optimized the previous circuit for more complex architectures [50]. A 5-qubit IBM Falcon r4T (Figure 5), 7-qubit IBM Falcon r5.11H (Figure 6), 16-qubit IBM Falcon r4P (Figure 7), and 27-qubit Falcon r5.11(Figure 8) were considered. The CNOT cost for optimized circuits are 20 for a 5-qubit machine, 92 for a 7-qubit machine, 60,716 for a 16-qubit machine, and 100,909,180 for a 27-qubit machine.

An application of the presented technique for the representation of the $UC{R}_d$ operator as a quantum circuit requires a better precision for the rotation angles than the original one. The original angles require the $O(logq)$ bit precision (precisely, it is ${\displaystyle \frac{2\pi }{q}}$). At the same time, the presented circuits use angles with $O(logqloglogq)$ bit precision (precisely, it is ${\displaystyle \frac{2\pi }{q{log}_{2}q}}$). Note that preposition of a rotation angle is a challenging issue for hardware [86]. Khadieva, Salehi, and Yakaryılmaz in [53] proposed a technique that provides a trade-off between CNOT cost and precision for angles. It allows us to obtain any intermediate result between $2^d$ CNOT cost and ${\displaystyle \frac{2\pi }{q{log}_{2}q}}$ precision, and $d{2}^d$ CNOT cost and ${\displaystyle \frac{2\pi }{q}}$ precision.

Each CNOT gate gives us an error probability. Even if the error is very small, the exponential number of CNOT gates dramatically affects the error probability. That is why researchers pay attention to shallow versions of circuits for quantum hashing.

6.2. Shallow Circuit

Kālis (with Ambainis as a supervisor) in his master thesis [51] suggested a shallow circuit for the quantum hashing in amplitude form for 3 qubits. This idea was investigated by Salehi and Yakaryılmaz [87]. Later, the approach was developed in detail and presented in a general way for quantum hashing by Ziatdinov, Khadieva, and Yakaryılmaz [52]. They suggested to use a shallow circuit presented in Figure 9.

If we use the same number of qubits $d={\displaystyle \frac{2}{\epsilon }}{log}_{2}q$ as for the standard circuit with $UC{R}_d$ operator, then only $d=O(logq)$ independent angles can be chosen. For the angles ${\beta }_0,\dots ,{\beta }_d$ used in the shallow circuit, we obtain the angles ${\alpha }_i={\sum }_{j=0}^{{log}_{2}i}bi{n}_i\left[j\right]·{\beta }_j$, where $bi{n}_i\left[j\right]$ is the j-th bit in the binary representation of the integer i. According to [52], it is possible to use generalized arithmetic progressions to find the angles ${\beta }_i$ such that the error probability of the quantum hash is comparable to the full quantum circuit, but that requires a large circuit width. The method of finding the angles ${\beta }_i$ such that both error probability and circuit width are small remains an open problem.

At the same time, numerical experiments show that we can find a set of angles ${\beta }_0,\dots ,{\beta }_d$ for $d={\displaystyle \frac{2}{\epsilon }}{log}_{2}q$ such that the error probability of the method is at most $2\epsilon$. This research is presented in [52].

Ziatdinov, Khadieva, and Khadiev in [54] invoked both circuits on a noisy simulator of an IBM machine for four qubits (three control and one target) for computing $MO{D}_{17}=\{1^x:x$ mod $17=0\}$ unary language, where $1^x$ means a string of x symbols 1. By recognizing, we mean returning 1 if the input belongs to $MO{D}_{17}$, and 0 otherwise. Note that a classical algorithm requires at least $\lceil {log}_{2}17\rceil =5$ bits of memory for recognizing the language [32].

For solving the problem, the authors did not search for angles that minimize the error in an “ideal” (not noisy) device. They used another strategy; they invoked a brute-force algorithm to find the sequence ${\beta }_0,\dots ,{\beta }_n$ with two properties:

• The probability of accepting member inputs on the noisy simulator should be as high as possible.
• The probability of accepting non-member inputs on the noisy simulator should be as small as possible.

For $q=17$, the authors minimized a value $diff=P(6·q)-max\left\{P\right(r):r$$mod$$q\ne 0$, $1\le r\le 6·q+9\}$, where $P\left(i\right)$ is the probability of returning 1 for an input $1^i$. Then, the circuit was invoked for $1^i$, where $i\le 7·q+9=128$. The program was executed 10,000 times and the number of shots that returned the accepting state was the result of computation. We use the notation $\tilde{P}\left(i\right)$ for this number, where i is the length of the word. The numbers $\tilde{P}\left(i\right)$ for each length i for $1\le i\le 128$ are shown in Figure 10. We can say that it is a statistical representation of probability $P\left(i\right)$.

We can see that each member i of $MO{D}_{17}$ has $\tilde{P}\left(i\right)\ge 1021$. At the same time, each non-member i has $\tilde{P}\left(i\right)\le 925$. So, we can choose a threshold $\tilde{\lambda }=1000$. For any length i, we can say that it is a member iff $\tilde{P}\left(i\right)>\tilde{\lambda }$. Here, we can use the concept of an isolated cutpoint from automata theory [88]. For a cutpoint $\lambda =0.1$ and constant $\epsilon =0.001$, we claim that an input $1^i$ is a member of the language if $\tilde{P}\left(i\right)>\lambda +\epsilon$. If an input $1^i$ is a non-member, then $\tilde{P}\left(i\right)<\lambda -\epsilon$.

The authors invoked the same series of experiments for a standard circuit, that is, $UC{R}_d$ for $d=3$. The number of parameters (angles) was too large (it is $2^3=8$) for the brute-force search because the invocation of the circuit on an IBMQ simulator is time-consuming. That is why the coordinate descent method was used for the first six parameters and brute force for the last two parameters. Then, we invoked the circuit for the same inputs $1^i$ for $i\le 7·p+9=128$. The result is presented in Figure 11.

We can see that only a few members like $i=q$, $i=2q$, $i=4q$, and $i=7q$ can be separated from non-members. Other members of $MO{D}_q$ cannot be separated from members, for example, $i=3p$, $i=5p$, and $i=6q$. In addition, the result for $1^1$ is larger than for $1^q$, where $q=17$. The searching algorithm cannot find a set S that violates this condition. At the same time, we can ignore $i=1$ because it can be checked with additional conditions. Even in this case, the algorithm is only useful for detecting some members with a threshold (or cutpoint) of $\lambda =1000$, but we cannot detect other members.

At the same time, in the case of the shallow circuit, $\tilde{P}\left(q\right)$ is much higher than for the standard circuit. For instance, $\tilde{P}\left(q\right)>5100$ for the shallow circuit, which corresponds to provability $P\left(q\right)>0.51$, while for the standard circuit, the corresponding probability would be much smaller than $0.5$ (approximately $0.1$).

These numerical experiments show us that even if for an “ideal” device, the standard circuit with the $UC{R}_d$ operator has a smaller error probability than the shallow circuit. In contrast, we have the opposite situation for noisy simulators, where the shallow circuit shows much better results than the standard one.

Vasiliev in [82] considered the phase version of quantum hashing. In this work, $R_z$ rotation was used. The author used the equivalence of $R_z$ and P gates, which are presented in Figure 12.

We can use the fact that the target qubit is initially in the $|1\rangle$ state and remove one of two P gates; the remaining P gate can be applied without control. See Figure 13 for the final equivalence of gates.

This allows us to convert the shallow circuit for quantum hashing to the circuit without any CNOT gates (see Figure 14).

6.3. Shallow Circuit for LNN Architecture and for Arbitrary Qubit Connection Graphs

Khadieva, Salehi, and Yakaryılmaz [53] suggested a quantum circuit for an LNN architecture (see Figure 15).

The main idea is to move the target qubit by the chain using the SWAP gate. The control $R_y$ gate has 2 CNOT cost, the SWAP gate has 3 CNOT cost, but control $R_y$ and SWAP together also have 3 CNOT cost (see Figure 16).

So, this idea allowed the authors to reduce the CNOT cost and obtain the CNOT cost of the circuit that applies quantum hashing ℓ times for d qubits, as presented in the next lemma.

Theorem 4. 

([53]) In the case of the LNN architecture, the CNOT cost of a shallow quantum circuit for ℓ applications of quantum hashing with d control qubits is $(3d-7)\ell +2$.

Later, Khadieva [45] generalized the technique for more a complex architecture that involves a cycle with tails (like a “sun” and “two joint suns”) represented by a 16-qubit Falcon r4P (see Figure 7) and a 27-qubit Falcon r5.11 IBMQ (see Figure 7) architectures. The CNOT cost of the shallow circuit for the quantum hashing algorithm for these devices is presented in the next lemma.

Theorem 5. 

([45]) The CNOT cost of the shallow quantum circuit for ℓ applications of quantum hashing with 15 control qubits is $37\ell +4$ (for $\ell \ge 3$) in the case of the 16-qubit Falcon r4P IBMQ device. The CNOT cost for 26 control qubits is $67\ell +4$ (for $\ell \ge 3$) in the case of the 27-qubit Falcon r4P IBMQ device.

The method was generalized for arbitrary qubit connection graphs by Khadiev, Khadieva, Chen, and Wu in [55]. The authors built the shortest path that visits all vertices at least once. Then, they moved the target qubit by this path using the same technique as for an LNN architecture. They obtained the following complexity for ℓ applications of quantum hashing on d qubits:

Theorem 6. 

([55]) Let G be a connected qubit connection graph. The CNOT cost of the circuit for the application of the quantum fingerprinting (quantum hashing) algorithm ℓ times is at most $(3k-4)\ell +2$, where k is the length of the shortest path in the graph G that visits all vertices at least once.

Note that the CNOT cost is between $(3d-4)\ell +2$ and $({\displaystyle \frac{3}{2}}{d}^2+{\displaystyle \frac{3}{2}}d-4)\ell +2$ depending on k. If the graph G has a Hamiltonian path, then the cost is minimal.

The shallow quantum circuit for quantum hashing has a structure very similar to the circuit for the quantum Fourier transform (QFT) algorithm [89]. The technique is used in quantum addition [90], quantum phase estimation (QPE) [89,91], quantum amplitude estimation (QAE)[92], the algorithm for solving linear systems of equations [93], Shor’s factoring algorithm [94], 1D wave equation [95], Quantum walks [96,97,98] with applications to quantum backtracking [99,100], and others. The best known representation of the QFT algorithm for LNN architectures is [101], which is an improvement of a series of results [102,103,104,105,106]. At the same time, the presented technique was not applied to general graphs. The authors of [45,55] applied the ideas used for quantum hashing to the QFT algorithm and obtained the CNOT cost for arbitrary qubit connection graphs. Another interesting technique for several specific graphs was discussed in [107].

7. Applications of Quantum Hashing Technique

The quantum hashing technique has been widely used in various areas. Here, we mention only some of the results.

• Stream processing algorithms. Le Gal [56] considered an automata-like model with non-constant size of memory. The technique allowed him to obtain an advantage in memory size for a quantum version of the model. The technique was used for checking the equality of two strings using a logarithmic size of memory.
• Automata. The technique was introduced for an automata model [32] and later improved in [33,34]. The technique allows us to recognize a unary language $MO{D}_p=\{a^i:i$ mod $p=0\}$ for some prime p. It allows the authors to demonstrate an example of language that can be recognized by a quantum model with an exponentially smaller size of memory compared to the classical (deterministic or probabilistic) counterparts. At the same time, the same technique for the constant number of qubits was used for two-way automata with classical and quantum states [108,109,110,111]. It allows authors to show a language that can be recognizable by the model but cannot be recognizable by the probabilistic two-way automata. Similar results were obtained for one-way models [112,113].
  Later, the same idea was used for one-way automata and promise problems [66,67,114,115,116,117]. The technique allows showing more languages that can be recognized by the quantum model but cannot be recognized by a classical model [68,118].
• Branching programs. The technique was used for the branching program model by Ablayev, Vasiliev, Gainutdinova, and co-authors [35,36,37]. They showed a family of Boolean functions that can be computed by quantum branching programs with polynomial width (logarithmic size of memory) but cannot be computed by deterministic and probabilistic counterparts. Most of the Boolean functions have an equality of objects (binary strings or other objects) as a base.
  Later, Khadiev and Khadieva [63] presented an especially constructed Boolean function that allowed them to show a hierarchy of complexity classes for quantum read-k-time branching programs. The upper bound was proven using the quantum fingerprinting technique.
  Nondeterministic quantum branching programs were investigated by Gainutdinova and co-authors [64,66,119,120,121]. The authors suggested several Boolean functions such that nondeterministic quantum branching programs based on specific versions of quantum hashing can compute them, but classical counterparts cannot.
• Online algorithms with restricted memory size. Quantum algorithms with restricted memory size is a computational model similar to automata but used for online minimization problems [61,62]. Khadiev and Khadieva [59,60] presented a problem that can be solved by quantum online algorithms with a restricted size of memory, but cannot be solved by randomized or deterministic counterparts in the case of logarithmic size of memory. The technique based on one qubit allowed the authors to show a similar result for a constant size of memory [122,123]. The algorithms also used the quantum hashing algorithm for checking the equality of binary strings using a logarithmic size of memory.
  Similar approaches were used in [124].
• Development of quantum devices.
  Vasiliev [65] used the technique for developing communication protocols between parts of quantum devices.
• Query model algorithms. Quantum hashing has numerous applications in addressing the string matching problem. The circuit implementation is discussed in [57,58] and the algorithm is presented in detail in the next section.

7.1. Quantum Search in a Dictionary and String Matching Problem

The hashing technique for searches in a database is widely used for compressing data, which allows us to accelerate search procedures. We demonstrate compressing effects and possibilities of the quantum hashing technique based on searches for words in a text.

In this section, we consider the string matching problem. The problem is to search for a word w in a text V. Formally, we should find any index i such that the substring $V_i,\dots ,V_{i+m-1}=w$, where $V_i$ is the i-th symbol of V, m is the length of w, and n is the length of V. Here, $1\le i\le n$.

The task of searching for information in a database has been considered in many works and has some specific features. First, the oracle $f_w$, defined by the task, is used to find the occurrence of the word w in the dictionary V, namely $f_w\left(x\right)=1$ if and only if $w=x$. Secondly, to speed up the search for a word in a text in the 1970s and 1980s, including hashing-based algorithms were proposed. The Knuth–Morris–Pratt (KMP) algorithm [9,125,126], the Rabin–Karp algorithm [7,8], and the Matiyasevich algorithm [127] can solve the problem in a linear number of comparisons (in linear time), with $O(n+m)$ complexity. Other possible solutions to the problem are Backward Oracle Matching [128], the Wu–Manber algorithm [129], the Boyer–Moore algorithm [130], the algorithms in [131,132] based on suffix arrays [8,131,133,134] and suffix trees [135,136], and others [128,137,138,139].

It is clear that quantum algorithms for this task, based on Grover’s idea [70,92], provide a quadratic saving in the number of calls to the oracle in the quantum query model. Note that to describe Grover’s algorithm, we first need to specify an efficient oracle circuit for $f_w$ for such an algorithm. Several similar studies in recent decades in the field of developing algorithms for the string matching problem have been devoted to the construction of efficient oracles $f_w$. A number of constructions of such oracles in terms of quantum circuits have been proposed, and the complexity of such circuits have been studied. These include the Practical implementation of a Quantum String Matching Algorithm [140] and the algorithms of Ramesh, Hariharan, and Vinay [141], Montanaro [142], Soni and Rasool [143], and Khadiev and Serov [144]. Note that all of these listed results require $O(logn+m)$ qubits.

7.2. Hashing Technique for Quantum Search in the Text

The first idea of using hashing methods for quantum information retrieval in an unordered database was realized in [58]. In this paper, a hybrid classical–quantum (probabilistic-quantum) algorithm is proposed. The key idea of the hybrid classical–quantum algorithm is as follows: (a) choose a universal hash family $\mathcal{F}$ of hash functions, (b) uniformly randomly choose a hash function $h\in \mathcal{F}$, (c) hash the elements of V with the hash function h, and (d) apply the quantum amplification technique to search for the hash image $h\left(w\right)$ of the word w in the hashed dictionary $h\left(V\right)$. It has been proven that using hashing methods can exponentially reduce the number of qubits required. Specifically, $logn+logm$ qubits are sufficient when using hashing, instead of $logn+m$ qubits in algorithms without hashing.

7.3. Search in a Dictionary Based on the Quantum Hashing Technique

The next step in developing a quantum search in a dictionary is based on quantum fingerprinting–hashing and it is presented in [145].

We begin with a discussion of quantum fingerprinting–hashing features that we explored for search in a dictionary. It is important for the above construction that the size of the quantum hash $s=O(logm)$, that is, we have an exponential compression of information.

The quantum hash function $\psi$ defines for the word $w\in {\Sigma }^m$ a unitary transformation:

$$U_{\psi }:{\left({\mathcal{H}}^2\right)}^{\otimes s}\stackrel{w}{\to }{\left({\mathcal{H}}^2\right)}^{\otimes s}.$$

(36)

That is, the operator $U_{\psi }$ acts on the space ${\left({\mathcal{H}}^2\right)}^{\otimes s}$, having $w\in {\Sigma }^m$ as an external control word. It is also convenient to think of this as $\psi$ defining a set $\{U_{\psi }\left(w\right):w\in {\Sigma }^m\}$ of unitary transformations:

$$U_{\psi }\left(w\right):{\left({\mathcal{H}}^2\right)}^{\otimes s}\to {\left({\mathcal{H}}^2\right)}^{\otimes s}.$$

(37)

In this paper, we assume that the unitary transformation $U_{\psi }\left(w\right)$ always starts from an initial basis state $\left|0\right.〉$, that is, we have

$$U_{\psi }\left(w\right):\left|0\right.〉\mapsto \left|\psi \left(w\right)\right.〉or{U}_{\psi }\left(w\right)\left|0\right.〉=\left|\psi \left(w\right)\right.〉.$$

(38)

For further consideration, we also need the inverse transformation $U_{\psi }^{-1}$ of $U_{\psi }$. Thus, accordingly, for the inverse transformation $U_{\psi }^{-1}$, the following must be true:

$$U_{\psi }^{-1}\left(w\right):\left|\psi \left(w\right)\right.〉\mapsto \left|0\right.〉or{U}_{\psi }^{-1}\left(w\right)\left|\psi \left(w\right)\right.〉=\left|0\right.〉.$$

(39)

Remark 4. 

So, the above definition can be seen as a quantum generalization of the information compression function. On the other hand, we have a quantum hash function ψ and its implementation, the operator $U_{\psi }$. Since the unitary operator $U_{\psi }$ is invertible, this means that there are no collisions “in the quantum world”. That is, two different words w and $w^{\prime }$ have different hash images $\left|\psi \left(w\right)\right.〉$ and $\left|\psi \left(w^{\prime }\right)\right.〉$. But we can obtain a collision “in the macro world” (that is, we can decide that the state $\left|\psi \left(w\right)\right.〉$ is generated by the word $w^{\prime }$) when extracting information about these two different quantum states $\left|\psi \left(w\right)\right.〉$ and $\left|\psi \left(w^{\prime }\right)\right.〉$. Thus, the probability of such an event (the collision probability) is small when ψ is the collision ϵ-resistant function (see Definition 2).

Now, we present the algorithm based on the technique of ($m,ϵ,s$)-quantum hash function works for a quantum solution of the search in a dictionary problem. The sequence $V=\{w_0,\dots ,w_{n-1}\}$ of binary words with length m and a binary word w with length m are given. We want to find any index k, which denotes the word number k such that $w=w_k$.

Note that the string matching problem can be easily represented as the search in a dictionary problem by taking $w_i$ as a substring of the text string with index i and finishing in $i+m-1$.

Thus, the algorithm $\mathcal{A}$ implements the mapping

$$\mathcal{A}:V,w⟼k.$$

(40)

The first part of the algorithmconsists of preparing the initial state.

According to this sequence V, using the transformation $U_{\psi }$, which defines the (m,$ϵ$, s)-quantum hash function $\psi$, a state is prepared:

$$\left|V,\psi \right.〉={\displaystyle \frac{1}{\sqrt{n}}}\sum _{j=0}^{n-1}\left|j\right.〉\otimes \left|\psi \left(w_j\right)\right.〉\otimes \left|1\right.〉,$$

(41)

The second part of the algorithm $\mathcal{A}$—amplification—consists of reading a word to be searched for, w, and finding a number k such that $w=w_k$. The steps are as follows:

• Conversion hash transformation—first level of amplification
  The operator $I^{\otimes logn}\otimes U_{\psi }^{-1}\left(w\right)\otimes I$ is applied to the state $\left|V,\psi \right.〉$, where $U_{\psi }^{-1}\left(w\right)$ is the inverse transformation controlled by the searched word w. We obtain the state

  $$\left|V,\psi ,w\right.〉={\displaystyle \frac{1}{\sqrt{n}}}\sum _{j=0}^{n-1}\left|j\right.〉\otimes \left|\varphi (w_j,w)\right.〉\otimes \left|1\right.〉,$$

  (42)

  where $\left|\varphi (w_j,w)\right.〉=U^{-1}\left(w\right)\left|\psi \left(w_j\right)\right.〉$ for $j\in \{0,\dots ,n-1\}$.
• Amplification
  The amplification of basic states $\left|j\right.〉{\left|0\right.〉}^{\otimes s}\left|1\right.〉$ is when “good states” are applied to state $\left|V,\psi ,w\right.〉$. The procedure is described in [92], and is also discussed in the book [146].
• Measurement
  The first $logn+s$ qubits of the final state are measured in a computational basis. If the last s qubits are all zero, then the measurement result k of the first $logn$ qubits is declared as the index of the word $w_k$ in the sequence V, for which $w_k=w$.

The algorithm has the following complexity characteristics: searching for a word w of length m in a dictionary V of size n requires $O(logn+s)$ qubits. The number of queries (the number of Grover operators applied) is $O\left(\sqrt{n}\right)$. The key point of the algorithm is the use of the $(m,ϵ,s)$-fingerprinting–hash function to obtain the correct result with high probability.

The steps of the algorithm are as follows: In the first step, the quantum state is quantum-parallel inverted by the mapping ${\psi }^{-1}\left(w\right)$ defined by w. This step provides the first level of amplitude gain. Then, in the second step, the known sequence of Grover “amplitude amplification operators” is applied. Finally, the resulting quantum state is measured and the algorithm produces the result.

The high probability of a correct result is based on the properties of the quantum hash function—it provides the first level of amplitude amplification before applying the sequence of Grover amplitude amplification operators.

For the formal proof, we refer to [145].