2017.10.05 13:52:54 (915907648721178624) from Daniel J. Bernstein, replying to "JP Aumasson (@veorq)" (905682451565031425):
Even in the paper's bad model, the 12/25 claim is wrong. It's actually time N^0.28, hardware N^0.24; slower+bigger than rho (N^0.27,N^0.23).
2017.10.05 13:58:44 (915909116970897408) from Daniel J. Bernstein:
The authors say they're counting all space, and count the N^0.20 quantum hardware, but they forget to count the N^0.24 non-quantum hardware.
2017.09.07 08:20:25 (905677114384424960) from Daniel J. Bernstein:
Collisions: https://eprint.iacr.org/2017/847 says time N^0.4 using hardware N^0.2. But parallel rho is better: time N^0.35 using hardware N^0.15.
2017.09.07 08:41:37 (905682451565031425) from "JP Aumasson (@veorq)":
time-space product of 12/25 is interesting, but yeah ignores the cost of QC hardware vs classical, the latency of Q circuits etc.