Exact quantum lower bound for Grover's problem — mentioned by amluto

Tue, 21 Apr 2026 00:17:06 GMT

Yes and no. Grover's algorithm is provably optimal [0]. No quantum algorithm will ever find an n-bit key by queries to any reasonable sort of oracle faster than Grover's algorithm, and Grover's algorithm is way too slow to be a serious problem. But symmetric ciphers are not black boxes. They're mostly built on some variant of a Feistel network, which is a very nice construction for turning a messy function into an invertible function that, in a potentially very strong sense, acts like a cryptographically secure permutation. When I was in grad school, one project I contemplated but never spent…

Paper and discussion history. A mention is not an endorsement.

Exact quantum lower bound for Grover's problem · HackerPapers discussions

Exact quantum lower bound for Grover's problem — mentioned by amluto