5

In the literature before me, the quantum oracle of the Grover algorithm is shown as a function, in which a sign change is made possible $|x\rangle\rightarrow(-1)^{f(x)}|x\rangle$. I have read that it is possible to transform any efficient classical circuit into a quantum circuit.

My question, if I want to crack the DES encryption, is it possible to implement the DES algorithm as a circuit that acts as an oracle then? That's just a consideration. Is that conceivable? Could I find the key you are looking for? Is there perhaps some paper about it?

I would be very interested in what you think about it!

This is great. Are there also storage requirements for applying Grover's algorithm directly to DES or AES? – vy32 – 2021-01-30T22:37:21.183

Thank you for your answer. Perhaps you can help me with this: "Each call to $U_g$ involves two calls to a reversible implementation of $f$ and one call to a circuit that checks whether $f(x) = y$". The last part is obvious, but why does $f$ have to be called twice? – None – 2019-04-17T10:19:59.307

2@QuantaMag The reason for the two calls is that first one has to evaluate $f$ (coherently, i.e., by way of a reversible circuit), then one evaluates the equality function, but then one has to uncompute the call to $f$. In other words: $$ \sum_x |x\rangle |0\rangle |0\rangle \mapsto \sum_x |x\rangle |f(x)\rangle |0\rangle \mapsto \sum_x |x\rangle |f(x)\rangle |f(x)\stackrel{?}{=}y \rangle \mapsto \sum_x |x\rangle |0\rangle |f(x)\stackrel{?}{=} y\rangle $$ If you don't uncompute the call to $f(x)$, then there will be no interference possible. – MartinQuantum – 2019-04-20T07:28:27.397

1

@QuantaMag See also the answer https://quantumcomputing.stackexchange.com/a/5232/1828 to a related question about why we have to uncompute garbage.

– MartinQuantum – 2019-04-20T07:32:26.750