The subset cover problem for $k \geq 1$ hash functions, which can be seen as an extension of the collision problem, was introduced in 2002 by Reyzin and Reyzin to analyse the security of their hash-function based signature scheme HORS. The security of many hash-based signature schemes relies on this problem or a variant of this problem (e.g. HORS, SPHINCS, SPHINCS+, \dots). Recently, Yuan, Tibouchi and Abe (2022) introduced a variant to the subset cover problem, called restricted subset cover, and proposed a quantum algorithm for this problem. In this work, we prove that any quantum algorithm needs to make $\Omega\left(k^{-\frac{2^{k-1}}{2^k-1}}\cdot N^{\frac{2^{k-1}-1}{2^k-1}}\right)$ queries to the underlying hash functions to solve the restricted subset cover problem, which essentially matches the query complexity of the algorithm proposed by Yuan, Tibouchi and Abe. We also analyze the security of the general $(r,k)$-subset cover problem, which is the underlying problem that implies the unforgeability of HORS under a $r$-chosen message attack (for $r \geq 1$). We prove that a generic quantum algorithm needs to make $\Omega\left(N^{k/5}\right)$ queries to the underlying hash functions to find a $(1,k)$-subset cover. We also propose a quantum algorithm that finds a $(r,k)$-subset cover making $O\left(N^{k/(2+2r)}\right)$ queries to the $k$ hash functions.

翻译：Reyzin 和 Reyzin 于2002年引入了用于 $k\ geq 1美元散列函数的子集覆盖问题,这可以被视为碰撞问题的延伸。 许多基于 hash 的签名方案 HOR 。 许多基于 hash 的签名方案的安全取决于这个问题或这个问题的变式( 例如 HORS, SPHINCS, SPHINCS+,\ dots) 。 最近, 元, Tibouchi 和 Abe (2022) 引入了一个子集覆盖问题的变体, 被称为限制子集封面, 并提出了这一问题的量算法。 在这项工作中, 我们证明任何量算法都需要 $\\\\\\ frac\ k\ k\ k\ k\\ k\\\\ xdddown N\ kn@ ormax ormaxy or- orge- rational- rqual ral_ ral_ rick ral_ ral_ ral_ ral_ ral_ rick rick ral_ ral_ ral_ ral_ ral_ ral_ ral_ ral_ ral_ ral_ i) ma) ma) max_ we i i i ma ma ma ma ma ma ma i i max___ i i i i i i subilt_ i i i i i sublex_ i i i i i i i i i i sub_ i suble i i i i i i i i i i i i su i sub i suble sub sub i i i su su i sub i i i i su su su i i i i su i i i i su i i i su su su su su su su