Grover's algorithm

Grover's algorithm is a quantum algorithm that finds with high probability the unique input to a black box function that produces a particular output value, using just O(N^1/2) evaluations of the function, where N is the size of the function's domain. It was originated by Lov Grover.

The analogous problem in classical computation cannot be solved in fewer than O(N) evaluations (because, in the worst case, the Nth member of the domain might be the correct member). At roughly the same time that Grover published his algorithm, Bennett, Bernstein, Brassard, and Vazirani published a proof that no quantum solution to the problem can evaluate the function fewer than O(N^1/2) times, so Grover's algorithm is asymptotically optimal.

Unlike other quantum algorithms, which may provide exponential speedup over their classical counterparts, Grover's algorithm provides only a quadratic speedup. However, even quadratic speedup is considerable when N is large. Grover's algorithm could brute force a 128-bit symmetric cryptographic key in roughly 2⁶⁴ iterations, or a 256-bit key in roughly 2¹²⁸ iterations. As a result, it is sometimes suggested that symmetric key lengths be doubled to protect against future quantum attacks.