An Efficient Quantum Multi-Collision Search Algorithm

In this article, we propose an efficient quantum <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-collision search algorithm with low quantum memory <inline-formula> <tex-math notation="LaTeX">$O(n)$ </tex-math></inline-formula>. The previous quantum <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-collision algorithms can not be converted into a low quantum memory <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-collision algorithm directly, because the time complexity of the converted algorithm is larger than the basic <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-collision algorithm. To solve this problem, we shall not only divide our low memory quantum <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-collision algorithm into several subroutines, but also need to achieve some balances between these subroutines. The time complexity of our <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-collision search algorithm is <inline-formula> <tex-math notation="LaTeX">$\widetilde {O}\left({2^{\frac {(2^{k}-2)n}{2^{k+1}-3}}}\right)$ </tex-math></inline-formula>, and the classical memory and quantum memory complexities are <inline-formula> <tex-math notation="LaTeX">$\widetilde {O}\left({2^{\frac {(2^{k-1}-1)n}{2^{k+1}-3}}}\right)$ </tex-math></inline-formula> and <inline-formula> <tex-math notation="LaTeX">$O(n)$ </tex-math></inline-formula> respectively. In addition, we propose an efficient <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-claw search algorithm, which can output a <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-claw with <inline-formula> <tex-math notation="LaTeX">$O(n)$ </tex-math></inline-formula> qubits. Given <inline-formula> <tex-math notation="LaTeX">$2^{s}$ </tex-math></inline-formula> quantum processors, we can construct our quantum <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-collision and <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-claw parallel algorithm with the time of <inline-formula> <tex-math notation="LaTeX">$\widetilde {O}\left({2^{\frac {(2^{k}-2)n-(2^{k+1}-2^{k-1}-3)s}{2^{k+1}-3}}}\right)$ </tex-math></inline-formula>, while the classical memory and quantum memory complexities are <inline-formula> <tex-math notation="LaTeX">$\widetilde {O}\left({2^{\frac {(2^{k-1}-1)n+s\cdot 2^{k-2}}{2^{k+1}-3}}}\right)$ </tex-math></inline-formula> and <inline-formula> <tex-math notation="LaTeX">$O(n)$ </tex-math></inline-formula>, respectively.


I. INTRODUCTION
The collision search problem is an important object in cryptography. Due to the birthday paradox, we need O(2 n/2 ) time to find a collision of a random n-bit function. There are some techniques to construct an efficient collision finding algorithm in the classical setting, such as Floyd's cycle-finding algorithm [1] and the parallel collision search algorithm (PCS) [2]. Floyd's cycle-finding algorithm can be used to construct a memoryless collision-finding algorithm [3], while the PCS algorithm can be used to improve the time complexity of finding multiple collisions [4].
In the quantum setting, adversaries can construct a more effective collision detecting algorithm. It's well known that Grover's algorithm [5] can solve the search problem with quadratic speed-up. Based on Grover's algorithm, Brassard et al. [6] proposed the BHT algorithm, which could find a collision of a random n-bit function with O(2 n/3 ) quantum queries and O(2 n/3 ) quantum memory. In [7], Zhandry proposed a new algorithm for detecting collision by The associate editor coordinating the review of this manuscript and approving it for publication was Mohamad Afendee Mohamed . adopting Ambainis's k-distinctness algorithm [8]. Zhandry's algorithm improved the restrictions of the BHT algorithm, which could be applied even if the function H : X → Y is random and |X | = (2 n/2 ). At ASIACRYPT 2017, Chailloux et al. [9] proposed an quantum collision search algorithm with O(2 2n/5 ) quantum time, while the classical memory is O(2 n/5 ) and quantum memory is O(n) (where O hides a poly-logarithmic factor).
Similar to the collision search problem, the multi-collision search problem is also a fundamental object in cryptography, which can be explained as follows. Given a random function H : X → Y with |X | = k · |Y | = k · 2 n , a k-collision for H denotes a tuple of k distinct inputs x 1 , x 2 , . . . , x k satisfying H (x 1 ) = H (x 2 ) = . . . = H (x k ). We can divide the previous k-collision detecting algorithms into two main parts: the classical setting and the quantum setting.
Previous k-collisions detecting algorithms in the classical setting. Given a target y, a k-collision of H (x) can be found with the time cost of O(k · 2 n ) and the memory cost of M = O(1) by applying a classical brute-force preimage attack k times. Note that we cannot remove k in the time cost of the multi-collision search problem, because k is a variable. ) times. In [11], Joux and Lucks proposed an improved 3-collision algorithm by utilizing PCS, which could obtain a time-memory tradeoffs of T = 2 (1−α)n and M = 2 αn for α ≤ 1/3. In addition, they extended the above 3-collision search algorithm to a new k-collision search algorithm. In [12], Joux proposed a more effective multi-collision search algorithm on the iterated hash function, which adopted the Merkle-Damgård structure. That is, he could concatenate a sequence of k ordinary 2-collisions so that the 2 k different inputs are hash to the same output. With this observation, Joux could construct 2 k -collision on a n-bit Hash function with the time cost of O(k · 2 n/2 ), rather than O(2 n(k−1) k ). These are some attacks based on the ''Joux-style'' Multi-collision search algorithm. For interested readers, please refer to the paper [13]- [16].
Previous k-collisions detecting algorithms in the quantum setting. Given a target y, the simple k-collision quantum search algorithm can be constructed with the queries of O(k · 2 n/2 ) by adopting Grover's algorithm k times. We call this basic k-collision algorithm Multi-Grover in the following. In other words, a k-collision search algorithm is meaningful, only if the quantum queries complexity of this k-collision search algorithm is fewer than O(k · 2 n/2 ). By combining the BHT algorithm with Grover's algorithm, Hosoyamada et al. in [17] proposed a new k-collision quantum search algorithm (call HSX17) with ) quantum queries and O(2 n/3 ) quantum memory. In 2018, Liu and Zhandry [18] proposed an improved quantum k-collision search algorithm (call LZ18) with (2 (2 k−1 −1)n (2 k −1) ) quantum queries and (2 (2 k−1 −1)n 2 k −1 ) quantum memory. The details of these two quantum k-collision search algorithms are described in Section 3.2 and Section 3.3, respectively.
The k-claw algorithm can be seen as a generalization of the k-collision search problem, which can be explained as follows. Given k different functions f i : Hosoyamada et al. proposed an efficient quantum k-claw algorithm by using Grover's algorithm. We show the detail of their k-claw quantum algorithm in Section 3.4.

A. OUR CONTRIBUTION
The previous quantum k-collision search algorithms required exponential quantum memory. In this paper, we want to propose some new k-collision search algorithms in the low quantum memory environment. In order to construct our new k-collision search algorithms, we need to solve the following problem. That is, HSX17 or LZ18 can not be converted into a low quantum k-collision search algorithm directly, because the time complexity of the converted algorithm is larger than Multi-Grover. Our new low quantum memory k-collision search algorithm can solve this problem by dividing the k-collision search problem into some small problems iteratively. In detail, our new k-collision algorithm can be constructed by combining the low quantum memory collision search algorithm [9] with Grover's algorithm. Besides, we extend our low quantum memory k-collision search algorithm to a k-claw search algorithm. Furthermore, we show how to construct our quantum k-collision and k-claw parallel algorithm.

B. PAPER OUTLINE
This paper is organized as follows. Section 2 shows some basic notions of quantum computing and building blocks for our new algorithms. In Section 3, we recall the previous k-collision search algorithms. Section 4 shows our new low quantum memory algorithm for k-collision problem. We propose our k-claw algorithm in Section 5. Section 6 shows how to construct our parallel quantum algorithms for k-collision and k-claw. We conclude this paper in Section 7.

II. PRELIMINARIES
In this section we show some notions that will be used through this paper. For interested reader who wants a comprehensive introduction to quantum algorithms, please refer to [20].

A. QUANTUM COMPUTING
Compared with classical algorithms, the advantage of quantum algorithm is that quantum computer can access the oracle of H in superposition state: The previous quantum algorithms are measured with the following three quantum complexities, such as quantum query complexity, quantum time complexity, and quantum memory complexity. We give the formal definitions of the above three quantum complexities as follows.
1) The quantum query complexity is measured by the number of superposition oracle calls. That is, the target function H is treated as a black box, and the quantum query complexities are measured as the number of quantum queries to H . Since classical queries can be seen as a particular case of superposition queries, we consider them alike in this paper. 2) A unit of quantum computational time cost is defined as the quantum gates count of the quantum circuit.
3) The quantum memory complexity is defined as the number of logical qubits in the entire quantum computation. Note that the optimal quantum query complexity does not imply optimal quantum time and memory complexity. For example, the BHT algorithm can output a collision with O(2 n/3 ) quantum query complexity. However, the product of time and memory complexities of BHT is O(2 2n/3 ), which is worse than the classical attack.
In this paper, we want to optimize the quantum time and memory complexities of our k-collision and k-claw search algorithms. As a result, we will present the previous k-collision algorithms and our new algorithms with the quantum time complexity rather than the quantum query complexity.
In order to make the quantum time complexity more readable, we make the following convention. First, we count oracle queries and n-qubit register operations such as comparisons between n-bit numbers as a single time unit O(1). We also assume the time cost of H is O(1) so as to simplify the time cost computation in our algorithm for k-collision. Second, we do not consider how to solve the additional factors in the time or memory complexity due to the management of quantum data structures. Because the details of such implementations is out of the scope of our work, we use O to denote the above case, which is similar to [9].

B. GROVER'S ALGORITHM
Grover's algorithm [5] can provide a quadratic speed-up over exhaustive search for symmetric primitives. In detail, Grover's algorithm shall repeat a Grover's iteration (denoted as G) on the input |s = α|s A + β|s 1 A . The Grover's iteration can be written as G = (2|s s| − I )O, where the operator I is identity matrix, and O is a oracle satisfying The oracle O can be constructed as follows, |x |0 −|1 remains the same throughout the oracle O, we just omit this part in the further. With the above description, the attack process of Grover's algorithm can be summarized as follows.
1) Start with a n-qubit initial state |0 = |0 ⊗n . 2) Apply a quantum algorithm A to the n-qubit |0 ⊗n to obtain the initial quantum superposition A(|0 ⊗n ) = |s = α|s A + β|s 1 A . 3) If there are 2 t solution in the 2 n search space, Apply the Grover iteration G on |s about R = 2 (n−t)/2 times to obtain a solution s 0 . That is, s 0 = (2|s s| − I )O R |s . Note that we can determine R as follows.
To sum up, the quantum time complexity of Grover's algorithm is c · 2 n−t 2 (|A| + |O|), where c is a constant, |A| and |O| are the quantum time complexities of A and O, respectively.

C. THE BHT ALGORITHM
Based on Grover's algorithm, Brassard et al. [21] in 1998 proposed a quantum collision search algorithm (BHT) on 2-to-1 function H 1 : X → Y , where |X | = 2|Y | = 2 · 2 n . The attack process of the BHT algorithm can be described as follows. 1) Apply Grover's algorithm on H 2 so as to find 2 t−r elements from S H 2 r . 2) Store these 2 t−r elements from S H 2 r in a list L in the classical memory.

3) Define a new mapping f H
The quantum time complexity of their collision search algorithm can be calculated as follows. In step 1, each element of L could be found in 2 r 2 time with Grover's algorithm. It took 2 t− r 2 time to collect 2 t−r elements in L. As pointed out in [9], times. Since these 2 t−r elements are stored in classical memory, Chailloux et al. should test membership for a set of size 2 t in time O(2 t ) by utilizing sequential membership testing in each iteration. That is, during each iteration, it not only took 2 r 2 time to build the superposition state |φ 0 = 1 2 n/2 x∈{0,1} n |x , but also needed 2 t−r time to do sequentially testing. To sum up, the overall quantum time complexity of their collision search algorithm is 2 5 and r = 2n 5 , they could optimize the time complexity to O(2 2n/5 ), while the classical memory and quantum memory complexities were O(2 n/5 ) and O(n) respectively. VOLUME 8, 2020

III. PREVIOUS QUANTUM ALGORITHM FOR MULTI-COLLISIONS PROBLEM
In this section, we show some previous quantum k-collision search algorithms for a random function F :

A. THE BASIC QUANTUM MULTI-COLLISION FINDING ALGORITHM
In [17], Hosoyamada et al. proposed a multi-collision finding algorithm (call Multi-Grover), which can be explained as follows.
1) Pick a random x 1 ∈ X . Compute and store F( The quantum time complexity of Multi-Grover could be computed as follows. First, it takes O(2 n/2 ) quantum time complexity to find x i (for 2 ≤ i ≤ k) in the loop of step 2. The total quantum time complexity of this k-collision finding algorithm are O(k · 2 n/2 ), where k is a variable and cannot be removed. As a result, a k-collision quantum search algorithm is meaningful only if it can find a k-collision faster than O(k · 2 n/2 ).

B. THE HSX17 MULTI-COLLISION SEARCH ALGORITHM
In [17], Hosoyamada et al. proposed a k-collision search algorithm (HSX17) for F : X → Y (|X | = k|Y | = k · 2 n ) by constructing a recursive algorithm MColl(F, k), which could be explained as follows.
1) If k = 1, choose x ∈ X uniformly at random and output (x, F(x)). Otherwise, proceed to step 2. 2) Repeat MColl(F, k − 1) about l times and obtain Otherwise, proceed to step 4. 4) Define a new mapping F 1 as follows. If x ∈ X does not appear in L and F(x) collides with one image in L, then F 1 returns 1, otherwise F 1 returns 0. Apply Grover's algorithm on F 1 to find a preimage of 1, which produces a k-collision of F. 2 n /l) by adopting Grover's algorithm. When l = 2 n/3 k−1 , they could optimize the time complexity to O(2 (3 k−1 −1)n/(2·3 k−1 ) ), and the quantum memory complexity is O(2 n/3 ). Due to limited space, we just omit the detail of their k-collision algorithm. For interested readers, please refer to [17].

C. THE IMPROVED MULTI-COLLISION SEARCH ALGORITHM PROPOSED BY LIU AND ZHANDRY (LZ18)
Liu and Zhandry in [18] proposed an improved k-collision search algorithm. The attack process of their k-collision search algorithm can be explained in Algorithm 1 as follows.

Algorithm 1 Require:
Input, a random function F : X → Y ; Input, k empty lists L 1 , L 2 , . . ., L k in the classical memory; 1: while |L 1 | < 2 t do 2: Choose a random x ∈ X . Add (x, F(x)) to the list L 1 ; 3: end while 4: Define a new mapping F 1 as follows. If x ∈ X does not appear in L 1 and F(x) collides with one image in L 1 , then F 1 returns 1, otherwise F 1 returns 0. 5: for 1 ≤ i ≤ t 1 do 6: Apply Grover's algorithm on F 1 to find a preimage of 1 so as to find a collision of F; Add the collision to the list L 2 ; 7: end for 8: Define a function F i (x) as follows. If x ∈ X does not appear in L i−1 but F(x) collides with one images of (i − 1)-collisions in L i−1 then F i returns 1, otherwise F i returns 0. 10: for 1 ≤ j ≤ t i do 11: Apply Grover's algorithm on F i to find a preimage of 1, which produces a i-collision of F; Add the above i-collision to the list L i ; 12: end for 13: end for 14: Given t k−1 different (k − 1)-collisions of H k , apply Grover's algorithm on F (k−1)k (x) to find a preimage of 1, so as to find a k-collision of H k ; For any constant k, the time and query complexities of LZ18 can be computed as follows.
1) Collect t 1 elements (x 1 , y 1 ), (x 2 , y 2 ), . . . (x t 1 , y t 1 ) in a list L 1 , where x i is picked independently and randomly from X and y i = F(x i ) for 1 ≤ i ≤ t 1 . This step needs t 1 quantum time and queries. 2) Apply Grover's algorithm on F 1 about t 2 times so as to obtain t 2 different 2-collision of F. According to the birthday paradox, the probability of the case that all t 2 different 2-collisions do not collide is 1 − O(2 −n/2 k ), which is small. Therefore, it takes t 2 √ 2 n /t 1 quantum time and queries to find t 2 different 2-collision with Grover's algorithm. Store these t 2 different 2-collision in a list L 2 .
3) Apply Grover's algorithm on F i about t i times to produce t i different i-collision of F. Similar to step 2, the probability of the case that all t i different i-collisions do not collide is 1 − O(t 2 i /t i−1 ), which is small. Store these t i different i-collision of F in a list L i . The quantum time and query for collecting F, apply Grover's algorithm on X to find a x , which collides with one of the (k − 1)-collisions in L k−1 . It needs the quantum time and queries of t k √ 2 n /t k−1 to find a k-collision. To sum up, the time and query complexities of LZ18 is ). Obviously, the time and query complexity of LZ18 is always better than HSX17 for a given k.

In [19], Hosoyamada et al. proposed a new k-claw
In detail, their k-claw quantum search algorithm can be described as follows.
1) Collect t 1 elements x 1 , x 2 , . . . , x t 1 uniformly at random from X 1 . Compute and store these t 1 values f 1 (x i ) in a list L 1 . This step takes t 1 time. 2) For 2 ≤ j ≤ k − 1, do At step j, adopt Grover's algorithm to find and store t j different j-claws for f 1 , . . . , f j in a list L j . The j-th step needs t j · 2 n /t j−1 time and queries. 3) Run Grover's algorithm on the list L k−1 to find k-claw for f 1 , . . . , f k . Output the k-claw value. The time complexity of their k-claw algorithm is t 1 + t 2 · √ 2 n /t 1 + . . . + t k−1 · √ 2 n /t k−2 + √ 2 n /t k−1 . When t i = 2 (

IV. NEW LOW QUANTUM MEMORY ALGORITHM FOR FINDING MULTI-COLLISION
The previous k-collision search quantum algorithms only considered how to find a k-collision with exponential quantum memory. In this section, we show how to construct a k-collision finding algorithm in the low quantum memory environment. First, we show our efficient 3-collision search algorithm. Second, we propose our general k-collision search algorithm for k ≥ 3.

A. NEW LOW QUANTUM MEMORY ALGORITHM FOR FINDING A 3-COLLISION
In this section, we propose a new 3-collision search algorithm for a random function H : X → Y with low quantum memory, where |X | = 3·|Y | = 3·2 n . Our 3-collision search algorithm consists of the two phases. First, we shall collect enough collisions of H in list L. Second, we can adopt Grover's algorithm to find a new x so that there exists This (x i , x j , x, H (x)) is a 3-collision of H . In detail, we can construct 3-collision search algorithm in the following three ways.

1) FIRST IDEA
Our first idea is trying to convert the previous 3-collision search algorithm into a 3-collision algorithm with small quantum memory. We present the process of Algorithm 2 as follows.

Algorithm 2 Require:
Input, a random function H : X → Y ; Input, 2 empty lists L 1 , L 2 in the classical memory; 1: while |L 1 | < 2 t do 2: Pick a random x ∈ X , and compute H (x); 3: Add (x, H (x)) to the list L 1 ; 4: end while 5: Define a function F 1 (x) as follows. 6: for 1 ≤ i ≤ 2 l do 7: Apply Grover's algorithm on F 1 to find a preimage of 1, so as to obtain a collision of H ; 8: Add (x j , x i , H (x j )) to the list L 2 ; 9: end for 10: Define a function F 2 (x) as follows. 11: Apply Grover's algorithm on F 2 to find a preimage of 1, so as to find a 3-collision of H ; 12: Repeat the above operation, until the adversary finds a 3-collision of H (x).
The definition of functions F 1 and F 2 are given as follows.
The time complexity of Algorithm 2 can be calculated as follows. First, the list L 1 does not contain a collision with overwhelming probability (1 − 2 −n/2 k ). That is, it takes the time cost of O(2 t ) to collect 2 t elements (x i , H (x i )) in the list L 1 . After collecting 2 t elements in L 1 , the probability of an element in the Y = {0, 1} n producing a collision is 2 (t−n)/2 . Therefore, we need to iterate the Grover's iteration G about 2 n /2 t times so as to generate a collision of H . During each iteration, we shall check whether elements in the superposition are good or not, which can be done in time 2 t via sequential testing. To sum up, the time cost of generating a collision of H is 2 (n−t)/2 ·2 t ≥ 2 n/2 , which means that Algorithm 2 is less effective than Multi-Grover (see in Section 3.1). Therefore, this idea is invalid, which means we can not convert the previous 3-collision algorithm into a low quantum memory 3-collision search algorithm directly.

2) SECOND IDEA
As shown in our first idea, we can not construct an efficient low quantum memory 3-collision search algorithm by using the previous 3-collision search algorithm directly. In order to solve this problem, our second idea try to adopt LQMCA proposed by Chailloux et al. to find 2 l collisions of H (x) from S H r . Note that the first r bits of these 2 l collisions are zero. Then we can divide our algorithm for finding a 3-collision of H into several subproblems. We can improve the final time complexity by finding a balance between these subproblems. We present the process of Algorithm 3 as follows.

Algorithm 3 Require:
input, a random function H : X → Y ; input, 2 empty lists L 1 , L 2 in the classical memory; 1: for 1 ≤ i ≤ 2 l do 2: Apply LQMCA to find a collision of H (x) from S H r ; 3: Add the above collision (x j , x i , H (x j )) to the list L 1 ; 4: end for 5: Define a function F 2 (x) as follows. 6: Apply Grover's algorithm on F 2 to find a preimage of 1, so as to find a 3-collision of H ; 7: Repeat the above operation, until the adversary finds a 3-collision of H (x).
The definition of functions F 2 is given as follows.

3) THIRD IDEA
By utilizing the LQMCA, our second idea can find a 3-collision faster than the Multi-Grover algorithm. However, the parameters r used in LQMCA are only optimized for the case of a single collision. Since we shall adopt LQMCA to find 2 l collisions of H (x) from S H r , we shall obtain some balanced between LQMCA and the cost of finding

Algorithm 4
Require: input, a random function H : X → Y ; input, 2 empty lists L 1 , L 2 in the classical memory; 1: while |L 1 | < 2 t do 2: Apply Grover's algorithm on H to find a (x, H (x)) from S H r ; 3: Add (x, H (x)) to the list L 1 ; 4: end while 5: Define a function F 1 (x) as follows. 6: for 1 ≤ i ≤ 2 l do 7: Apply Grover's algorithm on F 1 to find a preimage of 1, so as to find a collision of H from S H r ; 8: Add (x j , x i , H (x j )) to the list L 2 ; 9: end for 10: H (x j2 ) and x j1 = x j2 ) 11: Output the 3-collision (x j1 , x j2 , H (x j1 )); 12: Else Define a function F 2 (x) as follows. Apply Grover's algorithm on F 2 to find a preimage of 1, so as to find a 3-collision of H ; 13: Repeat the above operation, until the adversary finds a 3-collision of H (x).
We present the process of Algorithm 4 as follows. Note that our third idea need to find the new optimized parameters r so as to optimize the time complexity,. The definition of functions F 1 and F 2 are given as follows.
We can compute the time and memory complexity of Algorithm 4 as follows.
1) The time of collecting 2 t element from S H r in L 1 can be computed as follows. First, it takes 2 r 2 time to collect one element of H from S H r . Second, L 1 does not contain a collision with overwhelming probability (1 − 2 −n 2 k ). As a result, it needs the time cost of 2 t+ r 2 to collect 2 t element of H from S H r , while the classical memory is O(2 t ) and the quantum memory is O(n).
2) The time cost of collecting 2 l collisions from S H r in L 2 can be computed as follows. First, it takes 2 r 2 time to build the initial state |s , which is an uniform superposition over S H r . Since we have collected 2 t elements from S H r in L 1 , the probability of an element from S H r producing a collision is 181624 VOLUME 8, 2020 During each iteration, we shall not only recompute the initial state |s with 2 r 2 time, but also need to spend O(2 t ) time in checking whether elements in the superposition are good or not via sequential testing. To sum up, the time complexity of finding 2 l collisions of H (x) from S H r is 2 l · 2 n−r −t 2 (2 r 2 + 2 t ), while the classical memory is O(2 l ) and the quantum memory is O(n).
3) After filling L 2 with 2 l collisions from S H r , we shall adopt Grover's algorithm to find the preimage of 1 on F 2 . Similar to the above step, we can compute the time complexity of this operation as follows. First, it takes 2  13 , it means Algorithm 4 is better than Algorithm 3. As a result, we will adopt a similar idea as Algorithm 4 to construct our quantum k-collision algorithm.

B. NEW LOW QUANTUM MEMORY ALGORITHM FOR FINDING A k-COLLISION
In this section, we will propose an efficient k-collision searching algorithm for a random function H k : X → Y with O(n) qubits, where |X | = k|Y | = k · 2 n . Similar to Algorithm 4, our quantum k-collision search algorithm not only need to divide the entire attack process into several subproblems, but also shall find some balance between each parts. Let S H k r k = {(x, H k (x)) : ∃z ∈ {0, 1} n−r k , H k (x) = 0 . . . 0 r k times ||z}, the details of Algorithm 5 can be explained as follows. We would like to describe Algorithm 5 in Fig. 1 so as to help readers understand the idea of our algorithms for k-collision.
The definition of functions F 1k are given as follows.

Algorithm 5
Require: input, a random function H k : X → Y and |X | = k|Y | = k · 2 n ; input, k empty lists L 1 , L 2 , . . ., L k in the classical memory; 1: while |L 1 | < 2 t 1 do 2: Apply Grover's algorithm on H k to find a (x, H k (x)) from S H k r k ; 3: Add (x, H k (x)) to the list L 1 ; 4: end while 5: Define a function F 1k (x) as follows. 6: for 1 ≤ i ≤ 2 t 2 do 7: Apply Grover's algorithm on F 1k to find a preimage of 1, so as to find a collision in S H k r k ; 8: Add (x j , x i , H k (x j )) to the list L 2 , where H k (x i ) ∈ S H k r k ; 9: end for 10: for 2 ≤ j ≤ k − 1 do 11: Define a function F jk (x) as follows. 12: for 1 ≤ i ≤ 2 t j do 13: Apply Grover's algorithm on F jk to find a preimage of 1, which produces an j-collision of H k ; 14: Add the above j-collision to the list L j ; 15: end for 16: end for 17: Grover's algorithm on F (k−1)k (x) to find a preimage of 1, so as to find a k-collision of H k ; For 2 ≤ j ≤ k − 1, F jk are defined as follows. 1) It takes 2 t 1 + r k 2 time to collect 2 t 1 elements of H k (x) from S H k r k , while the classical memory is O(2 t 1 ) and the quantum memory is O(n). 2) For 2 ≤ i ≤ k − 1, we can compute the quantum time complexity of step i as follows. Since list L i−1 has collected 2 t i−1 different (i − 1)-collision of H k from S H k r k , the probability of an element from S H r k producing a collision is 1 √ 2 n−r k /2 t i−1 . Therefore, the number of iterations is 2 n−r k /2 t i−1 = 2 n−r k −t i− 1 2 . During each iteration, we shall not only recompute the initial state |s with 2 r k 2 time, but also need to spend O(2 t i−1 ) time in checking whether elements in the superposition are good or not via sequential testing. Since we shall find VOLUME 8, 2020  (2 r k 2 +2 t k−1 ) time and queries to find a k-collision of H k (x) from S H k r k . To sum up, when the quantum memory is limited to O(n), we can express the overall time complexity as follows: We can adopt the following strategy to optimize the overall time complexity T k . First, we divide the overall time complexity T k into five parts: 2 t 1 + r k 2 , 2 . Second, we try to find a balance between the five parts. As pointed in Section 3.1, our k-collision algorithm is meaningful only when T k < 2 n/2 . In other words, we shall make sure all the time complexities of the five parts are smaller than 2 n/2 . Since we require 2

V. QUANTUM ALGORITHM FOR k-CLAW SEARCH PROBLEM
In this section, we propose an efficient low quantum memory k-claw search algorithm. The k-claw problem can be explained as follows. Define f i : X i → Y be a random function for 1 ≤ i ≤ k, where |X 1 | = . . . = |X k | = |Y | = 2 n . The goal of the k-claw problem is to find a k-claw x 1 × x 2 × . . . × x k × y ∈ X 1 × X 2 × . . . × X k × Y for f 1 , . . . , f k such that f 1 (x 1 ) = f 2 (x 2 ) = .
. . = f k (x k ) = y. Similar to our low quantum memory k-collision search algorithm, we can not construct an efficient low quantum memory k-claw search algorithm by using the previous k-claw search algorithm. In addition, our k-collision search algorithm can not be converted into a k-claw search algorithm directly. We can describe the attack process of our k-claw algorithm as follows.
The definition of functions F i (for 2 ≤ i ≤ k − 1) are given as follows.  ) and O(n), respectively. Since our quantum k-claw algorithm is similar to our quantum k-collision, we can construct our quantum k-Collision parallel algorithm with the same complexity in a similar way. Due to the limited space, we omit the detail.

VII. CONCLUSION
In this article, we propose some new quantum algorithms with low quantum memory for k-collision and k-claw problem. Due to the high time complexity requirement, we observe the previous quantum k-collision HSX17 or LZ18 can not be converted into a quantum k-collision with low quantum memory directly. In order to solve this problem, we construct our k-collision algorithm with low quantum memory by combining the previous quantum k-collision with LQMCA. Based on our low quantum memory k-collision algorithm, we construct our k-claw search algorithm with low quantum memory. At last, we show how to construct our quantum k-collision and k-claw parallel algorithm using 2 s quantum processors.
In the future, there are still several research directions. For example, we can develop some new quantum timememory-data tradeoffs for the cases when some functions f i are unbalanced, or the case when some function f i not public.