- Extreme values of ${x^3 + y^3 + z^3 - 3xyz}$ subject to ${ax + by + cz =1}$ using Lagrange Multipliers
- Is $\mathbb{Q} \cap (a,b)$ for irrationals $a,b$ is not compact in the $\mathbb{Q}$ with $d(x,y)=|x-y|$?
- How to use Correlation of variables to predict future pattern
- Can multivariate data analysis (e.g. PLS) account for complicated dependencies involving multiple variables?
- How to compute the expectation of a normalizing constant of an Exponential Family
- Deep Neural Network visualization on multi dimension datasets
- Effect of scaling on the mean of random variables
- Spectral Clustering of a skipgram model
- Total Variation Denoising help
- Is studentized residuals v/s standardized residuals in lm model
- Reducibility between Gaussian Mixture Models and Gaussian Processes
- Can I trust my random forest model with low sample size and unequal class distribution?
- How does using a 2x teleconverter with 70-200 f/2.8 affect use?
- Get metal texture id
- How to toggle fullscreen with lwjgl
- How do I pack my game LWJGL game into a single executable JAR with Maven?
- Pre-rendered visual effects?
- Is it possible to make desktop visible behind drawn object using SDL2?
- Setting adaptive icon for Android from script(C#)
- Difference between old fashioned and quick oats?

# Quantum attack on classical hash functions

Consider a classical hash function that gives $x\rightarrow c = H(x)$, where $c$ is a commitment. I know how to program $H$ on a classical computer so I write the quantum circuit, $U$, for it.

$\vert x\rangle\otimes\vert y\rangle\xrightarrow{U}\vert x\rangle\otimes\vert H(x)\oplus y\rangle$.

I apply a Hadamard on the input state $\vert 0 \rangle$ to get $\sum_{i}\vert x_i\rangle$ - all possible input strings. Next, I build the inverse for the quantum circuit and so, for any given $c_0 = H(x_0)$

$\sum_{i}\vert x_i\rangle\otimes \vert c_0\rangle \xrightarrow{U^{\dagger}} \sum_{i}\vert x_i\rangle \otimes \vert i\rangle$, where $\vert i \rangle$ is something we can't control.

However, if I measure the second register with $\vert 0 \rangle\langle 0 \vert$, this gives me, in the first register $\sum_{i : H(x_i) = c_0} x_i$.

What am I doing wrong here? This seems to suggest that hash functions can be easily broken by a quantum computer although the literature says that th