Researchers have extended a proof technique for modeling quantum queries to hash-related functions, pushing its guarantee from the old N1/12 query range to the square-root scale for a permutation domain of size N. The bound supports explicit preimage and collision estimates for idealized constructions behind SHA-3 and SHA-1/SHA-2, but does not demonstrate an attack on those hash functions.
A compressed oracle models quantum permutation queries
A compressed permutation oracle is a mathematical model that tracks a quantum algorithm’s access to a permutation as a small database of input-output pairs, rather than storing the full permutation. Its soundness guarantee measures how closely that simplified model behaves like a uniformly random permutation. Earlier analysis covered only about N1/12 queries before its simulation error could dominate the resulting security bound.
New map limits the oracle-model error to O(q/√N)
Joseph Carolan and Christian Majenz construct the compression map from a generalized quantum measurement on a coherent representation of a random permutation. They separate overlapping partial-permutation states into orthogonal levels to make that map preserve the relevant state norms.
For q quantum queries to a permutation on N elements, the paper bounds the distinguishing advantage by O(q/√N). The compressed model therefore remains sound when q grows more slowly than √N. The same guarantee applies to ideal ciphers, including queries made in superposition over keys, without a penalty that grows with the number of keys.
SHA-3 and Davies–Meyer bounds rely on idealized models
The authors apply the result to preimage search, which seeks an input for a chosen digest, and collision search, which seeks two inputs with the same digest. For SHA3-256’s sponge construction, their table says a success probability of at least one-half requires a query budget T of at least 2124 for preimages and 283 for collisions. T also counts queries used to produce and verify the candidate messages, so it is not simply the attacker’s oracle-call total.
The SHA-3 result assumes its underlying permutation is uniformly random; the authors say it does not establish that the fixed Keccak permutation in SHA-3 behaves that way. Their separate Davies–Meyer bounds for constructions used in SHA-1 and SHA-2 rely on an ideal-cipher model. The paper therefore strengthens formal lower bounds, not a measured assessment of deployed hash functions.
Sources
- Original paper: “Compressed Permutation Oracles Revisited” (arXiv:2609.28469v1).
- NIST FIPS 202, SHA-3 Standard.
- Lead image: FlyD’s “Padlock on laptop with light trails” photo, used under the Unsplash License.
Author note: The paper’s AI-use statement says GPT-6 Astra performed calculations for the proof’s intertwining bound, worked out explicit SHA-3 constants, helped prepare the technical overview and introduction, and formatted the bibliography. The authors say they verified and assembled the output, and credit the core idea and applications to themselves.