Problem Definition
A function F is said to be r-to-one if every element in its image has exactly r distinct preimages.
Input: an r-to-one function F.
Output: x 1 and x 2 such that \( { F(x_1) = F(x_2) } \).
Key Results
The algorithm presented here finds collisions in arbitrary r-to-one functions F after only \( { O(\sqrt[3]{N/r}) } \) expected evaluations of F. The algorithm uses the function as a black box, that is, the only thing the algorithm requires is the capacity to evaluate the function. Again assuming the function is given by a black box, the algorithm is optimal [1] and it is more efficient than the best possible classical algorithm, which has query complexity \( { \Omega(\sqrt{N/r}) } \). The result is stated precisely in the following theorem and corollary.
Theorem 1
Given an r-to-one function \( { F \colon X \rightarrow Y } \) with \( { r \geq 2 } \) and an integer \( { 1 \leq k \leq N=|X| } \), algorithm \( \textnormal{\textbf{Col\-li\-sion}}(F,k) \)returns a collision...