The function $f$ is simply an arbitrary boolean function of a bit string: $f\colon \{0,1\}^n \to \{0,1\}$. For applications to breaking cryptography, such as [1], [2], or [3], this is not actually a ‘database lookup’, which would necessitate storing the entire database as a quantum circuit somehow, but rather a function such as

\begin{equation*}
x \mapsto \begin{cases}
1, & \text{if $\operatorname{SHA-256}(x) = y$;} \\
0, & \text{otherwise,}
\end{cases}
\end{equation*}

for fixed $y$, which has no structure we can exploit for a classical search, unlike, say, the function

\begin{equation*}
x \mapsto \begin{cases}
1, & \text{if $2^x \equiv y \pmod{2^{2048} - 1942289}$}, \\
0, & \text{otherwise},
\end{cases}
\end{equation*}

which has structure that can be exploited to invert it faster even on a classical computer.

The question of the particular *cost* can't be answered in general because $f$ can be any circuit—it's just a matter of making a quantum circuit out of a classical circuit. But usually, as in the example above, the function $f$ is very cheap to evaluate on a classical computer, so it shouldn't pose a particularly onerous burden on a quantum computer for which everything else about Grover's algorithm is within your budget.

The only general cost on top of $f$ is an extra conditional NOT gate $$C\colon \left|a\right> \left|b\right> \to \left|a\right> \left|a \oplus b\right>$$ where $\oplus$ is xor, and an extra ancillary qubit for it. In particular, if we have a circuit $$F\colon \left|x\right> \left|a\right> \lvert\text{junk}\rangle \mapsto \left|x\right> \left|a \oplus f(x)\right> \lvert\text{junk}'\rangle$$ built out of $C$ and the circuit for $f$, then if we apply it to $\left|x\right>$ together with an ancillary qubit initially in the state $\left|-\right> = H\left|1\right> = (1/\sqrt{2})(\left|0\right> - \left|1\right>)$ where $H$ is a Hadamard gate, then we get

\begin{align*}
F\left|x\right> \left|-\right> \lvert\text{junk}\rangle
&= \frac{1}{\sqrt{2}}\bigl(
F\left|x\right> \left|0\right> \lvert\text{junk}\rangle
- F\left|x\right> \left|1\right> \lvert\text{junk}\rangle
\bigr) \\
&= \frac{1}{\sqrt{2}}\bigl(
\left|x\right> \left|f(x)\right> \lvert\text{junk}'\rangle
- \left|x\right> \left|1 \oplus f(x)\right> \lvert\text{junk}'\rangle
\bigr).
\end{align*}

If $f(x) = 0$ then $1 \oplus f(x) = 1$, so by simplifying we obtain $$F\left|x\right> \left|-\right> \lvert\text{junk}\rangle = \left|x\right> \left|-\right> \lvert\text{junk}'\rangle,$$ whereas if $f(x) = 1$ then $1 \oplus f(x) = 0$, so $$F\left|x\right> \left|-\right> \lvert\text{junk}\rangle = -\left|x\right> \left|-\right> \lvert\text{junk}'\rangle,$$ and thus in general $$F\left|x\right> \left|-\right> \lvert\text{junk}\rangle = (-1)^{f(x)} \left|x\right> \left|-\right> \lvert\text{junk}'\rangle.$$

Another great answer to this question is provided in this answer on CS Theory SE.

– glS – 2018-06-16T12:51:49.6175

That's something I wondered about, too. In this experiment for example they hard-wire the solution into the oracle, which tastes a bit like cheating to me...

– M. Stern – 2018-03-17T02:48:27.253