Editing Grover's algorithm (section)

=== Cryptography ===
Grover's algorithm essentially solves the task of ''function inversion''. Roughly speaking, if we have a function <math>y = f(x)</math> that can be evaluated on a quantum computer, Grover's algorithm allows us to calculate <math>x</math> when given <math>y</math>. Consequently, Grover's algorithm gives broad asymptotic speed-ups to many kinds of [[brute-force attack]]s on [[symmetric-key algorithm|symmetric-key cryptography]], including [[collision attack]]s and [[pre-image attack]]s.<ref>{{Cite book|url=https://www.worldcat.org/oclc/318545517|title=Post-quantum cryptography|date=2009|publisher=Springer|others=Daniel J. Bernstein, Johannes Buchmann, Erik, Dipl.-Math Dahmén|isbn=978-3-540-88702-7|location=Berlin|oclc=318545517}}</ref> However, this may not necessarily be the most efficient algorithm since, for example, the [[Pollard's rho algorithm]] is able to find a collision in [[SHA-2]] more efficiently than Grover's algorithm.<ref>{{Cite journal|last=Bernstein|first=Daniel J.|date=2021-04-21|title=Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete?|url=https://www.hyperelliptic.org/tanja/SHARCS/record2.pdf#page=113|journal=Conference Proceedings for Special-purpose Hardware for Attacking Cryptographic Systems (SHARCS '09)|volume=09|pages=105–117}}</ref>