6 votes
Accepted

Is pairing-based crypto post-quantum secure?

Is pairing-based crypto post-quantum secure? No. That's because solving the Discrete Logarithm Problem in one of the pairing's source groups breaks the pairing's security, and Shor's algorithm ...
fgrieu's user avatar
  • 141k
4 votes
Accepted

Where does the 8 come from? Generic Search Problem with Bounded Probabilities

As the paper states, you should look directly at HRS16, Theorem 1. The proof there seems fairly straightforward, but it seems to depend on theorem 7.2 of Zhandry2012. This itself appears to depend on ...
Mark Schultz-Wu's user avatar
  • 12.9k
2 votes

Tensor product of Pseudorandom States

This is not a PRS. As you note, the tensor product is superposition of $N^2$ possible states and so if it is a PRS it can only be interpreted be with respect to the set $X'=\{0,\ldots,N^2-1\}$ e.g. by ...
Daniel S's user avatar
  • 23.7k
1 vote

Quantum computationally indistinguishable

Wikipedia states it clearly that trace distance gives an upper bound on the probability of distinguishing two states. For a proof, you can use Stinespring's dilation theorem to represent $\mathbf{A}$ ...
Sam Jaques's user avatar
  • 1,135
1 vote

Why doesn't this factoring to order-finding reduction work?

I would have written a comment to extend on Daniel's answer — but since I am not usually on the stack exchange, I am seemingly not able to comment, and so I will write a follow-up answer instead: ...
Martin Ekerå's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible