The classical (parallel) black pebbling game is a useful abstraction which allows us to analyze the resources (space, space-time, cumulative space) necessary to evaluate a function $f$ with a static data-dependency graph $G$. Of particular interest in the field of cryptography are data-independent memory-hard functions $f_{G,H}$ which are defined by a directed acyclic graph (DAG) $G$ and a cryptographic hash function $H$. The pebbling complexity of the graph $G$ characterizes the amortized cost of evaluating $f_{G,H}$ multiple times as well as the total cost to run a brute-force preimage attack over a fixed domain $\mathcal{X}$, i.e., given $y \in \{0,1\}^*$ find $x \in \mathcal{X}$ such that $f_{G,H}(x)=y$. While a classical attacker will need to evaluate the function $f_{G,H}$ at least $m=|\mathcal{X}|$ times a quantum attacker running Grover's algorithm only requires $\mathcal{O}(\sqrt{m})$ blackbox calls to a quantum circuit $C_{G,H}$ evaluating the function $f_{G,H}$. Thus, to analyze the cost of a quantum attack it is crucial to understand the space-time cost (equivalently width times depth) of the quantum circuit $C_{G,H}$. We first observe that a legal black pebbling strategy for the graph $G$ does not necessarily imply the existence of a quantum circuit with comparable complexity -- in contrast to the classical setting where any efficient pebbling strategy for $G$ corresponds to an algorithm with comparable complexity evaluating $f_{G,H}$. Motivated by this observation we introduce a new (parallel) quantum pebbling game which captures additional restrictions imposed by the No-Deletion Theorem in Quantum Computing. We apply our new quantum pebbling game to analyze the quantum space-time complexity of several important graphs: the line graph, Argon2i-A, Argon2i-B, and DRSample. (See the paper for the full abstract.)
翻译:古典( parallel) 黑色平流游戏是一种有用的抽象, 使我们能够分析资源( 空间、 空间时间、 累积空间), 以静态数据依赖度图形 $G$ 。 在加密领域特别感兴趣的是数据独立的内存- 硬函数 $f ⁇ G, H} 美元, 由定向自行车图( DAG) 确定 $G$ 和密码仪的硬拷贝函数 $H美元。 图形的复杂度 $G$ 代表了评估 $G, H} 多次调值 以及在一个固定域进行强力前攻击的总成本 $G mathal{ 美元, 也就是说, 美元 美元== 美元= 美元 美元=xx} 美元, 美元= 美元= 美元=美元, 美元= 任何 美元=美元。 古典攻击者需要先评估 美元 美元, H} 美元; 美元= 美元 美元=xxxx 亚数 战略, 要求 美元 美元 美元 美元 美元 美元 以新算算。