Abstract
Given a function f as an oracle, the collision problem is to find two distinct inputs i and j such that f(i) = f(j) under the promise that such inputs exist. In this paper, we prove that any quantum algorithm for finding a collision in an r -to-one function must evaluate the function \Omega (({n \mathord{\left/ {\vphantom {n r}} \right. \kern-\nulldelimiterspace} r}){1 \mathord{\left/ {\vphantom {1 {3)}}} \right. \kern-\nulldelimiterspace} {3)}} times, where n is the size of the domain and {r \mathord{\left/ {\vphantom {r n}} \right. \kern-\nulldelimiterspace} n}. This lower bound matches, up to a constant factor, the upper bound of Brassard, H?yer, and Tapp [ACM SIGACT News, 28:14-19, 1997], which uses the quantum algorithm of Grover [Proceedings of the Twenty-Eighth Annual ACM Symposium on the Theory of Computing, pages 212-219, 1996] in a novel way. The previously best quantum lower bound is \Omega (({n \mathord{\left/ {\vphantom {n {r)^{{1 \mathord{\left/ {\vphantom {1 5}} \right. \kern-\nulldelimiterspace} 5}} }}} \right. \kern-\nulldelimiterspace} {r)^{{1 \mathord{\left/ {\vphantom {1 5}} \right. \kern-\nulldelimiterspace} 5}} }}) evaluations, due to Aaronson [Proceedings of the Thirty-Fourth Annual ACM Symposium on the Theory of Computing, pages 635-642, 2002]. Our result implies a quantum lower bound of \Omega (n^{{2 \mathord{\left/ {\vphantom {2 3}} \right. \kern-\nulldelimiterspace} 3}}) queries to the inputs for another well studied problem, the element distinctness problem, which is to determine whether or not the given n real numbers are distinct. The previous best lower bound is \Omega (\sqrt n ) queries in the black-box model; and \Omega (\sqrt n \log n) comparisons in the comparisons-only model, due to H?yer, Neerbek, and Shi [Lecture Notes in Computer Science, Vol. 2076, pp. 346-357, 2001].