Lecture 12
Amplitude Amplification; Grover vs. Symmetric Cryptography

Week 6 | the general quadratic speedup, why it is the best possible, and what it really costs an attacker; Lab 3 launches | reading: de Wolf Ch. 7; NIST PQC FAQ

Grover halves the bits of security of a symmetric key in principle; longer keys restore the margin

In this lecture

Amplitude amplification
When the number of solutions is unknown
Grover is optimal
Grover against block ciphers
Hash functions, and Shor vs. Grover
Try it in code
Lab 3 launch
Summary and exercises

Lecture 11 analysed Grover's algorithm for one marked item. This lecture widens the lens in two directions. Mathematically, the same two-reflection trick speeds up any algorithm that succeeds with small probability, it copes with an unknown number of solutions, and no quantum algorithm can do better. Cryptographically, the question is what all this means for AES and SHA-256. By the end you should be able to state amplitude amplification, explain the randomised iteration-count trick, state and sketch the optimality bound, and give an honest account of Grover's threat to symmetric cryptography, including the limits on parallelism and the cost of the oracle.

1 — Amplitude amplification

Grover's starting state $|s\rangle$ is the output of one particular algorithm, $H^{\otimes n}$, which "guesses" a uniformly random string and so succeeds with probability $1/N$. Nothing in the rotation argument used that specific algorithm.

definition 12.1 — the amplification setting

Let $\mathcal A$ be a quantum circuit (with no measurements) on $n$ qubits, and let the basis states be split into "good" and "bad" ones, with a phase oracle $S_\chi$ that multiplies good basis states by $-1$. Write

$$\mathcal A|0^n\rangle=\sin\theta\,|\mathrm{good}\rangle+\cos\theta\,|\mathrm{bad}\rangle ,$$

where $|\mathrm{good}\rangle$ and $|\mathrm{bad}\rangle$ are the normalised projections onto good and bad states and $p=\sin^2\theta$ is the success probability of $\mathcal A$. Let $S_0=I-2|0^n\rangle\langle0^n|$ and define the amplification operator

$$Q=-\,\mathcal A\,S_0\,\mathcal A^{-1}\,S_\chi .$$

Classically, boosting $\mathcal A$ means running it again and again and checking each output. To build $Q$, amplitude amplification instead needs .

Read off the factors of $Q=-\mathcal AS_0\mathcal A^{-1}S_\chi$. Also ask what a measurement would do to the state being rotated.

$Q$ contains $\mathcal A^{-1}$, and everything stays coherent until the final measurement. That is why $\mathcal A$ must be a unitary circuit with no measurements of its own.

theorem 12.1 — amplitude amplification (Brassard, Høyer, Mosca and Tapp)

For every $k\ge0$, measuring $Q^k\mathcal A|0^n\rangle$ gives a good outcome with probability $\sin^2\big((2k+1)\theta\big)$. With $k\approx\tfrac{\pi}{4\theta}\approx\tfrac{\pi}{4\sqrt p}$ the success probability is close to 1, using $O(1/\sqrt p)$ runs of $\mathcal A$ and $\mathcal A^{-1}$, compared with about $1/p$ independent repetitions of $\mathcal A$ classically.

It is Theorem 11.2 again. In the plane spanned by $|\mathrm{bad}\rangle$ and $|\mathrm{good}\rangle$, $S_\chi$ is the reflection in the $|\mathrm{bad}\rangle$ axis, and $-\mathcal AS_0\mathcal A^{-1}=2\mathcal A|0^n\rangle\langle0^n|\mathcal A^{-1}-I$ is the reflection in the line through $\mathcal A|0^n\rangle$, which sits at angle $\theta$. Two reflections in lines at angles $0$ and $\theta$ make a rotation by $2\theta$. Grover's algorithm is the case $\mathcal A=H^{\otimes n}$, where $-H^{\otimes n}S_0H^{\otimes n}$ is exactly the diffuser $D$.

HW6 asks you to specialise this to Grover search with $M$ marked items and find the best iteration count. The general lesson is the important one: any quantum procedure that succeeds with probability $p$ can be boosted to near certainty with about $1/\sqrt p$ repetitions instead of $1/p$. That is the "quadratic speedup" you will see quoted for quantum Monte Carlo estimation, optimisation heuristics and many other proposals.

A procedure $\mathcal A$ succeeds with probability $p=0.01$, so classical repetition needs about 100 runs. About how many rounds of amplitude amplification does Theorem 12.1 suggest?

Use $k\approx\tfrac{\pi}{4\sqrt p}$, with $\sqrt p=0.1$.

$\tfrac{\pi}{4\theta}\approx7.84$ (with $\theta=\arcsin0.1$; $\tfrac{\pi}{4\cdot0.1}\approx7.85$), so 7 or 8 rounds: 7 gives success $\sin^2(15\theta)\approx0.995$, 8 gives $\approx0.983$. Each round uses $\mathcal A$ and $\mathcal A^{-1}$ once, against about 100 classical repetitions: the square-root saving.

example 12.1 — one round makes a 25% algorithm certain

Let $\mathcal A=R_y(\pi/3)$ on one qubit, with $|1\rangle$ good. Find $p$, $\theta$ and the success probability after $k=0,1,2,3$ rounds of amplification.

$R_y(\pi/3)|0\rangle=\cos\tfrac\pi6|0\rangle+\sin\tfrac\pi6|1\rangle$, so $\theta=\pi/6=30^\circ$ and $p=\tfrac14$. The success probability after $k$ rounds is $\sin^2((2k+1)30^\circ)$: $\tfrac14$, $1$, $\tfrac14$, $\tfrac14$ for $k=0,1,2,3$ (angles $30^\circ,90^\circ,150^\circ,210^\circ$). One round turns a one-in-four procedure into a certain one; a second round overshoots. This is the same geometry as Grover with $N=4$ (Lecture 11, Example 11.1). Section 6 runs it in Qiskit.

2 — When the number of solutions is unknown

The best iteration count depends on $\theta$, hence on the number of solutions $M$. If $M$ is unknown, a fixed count can be badly wrong. With $N=2^{20}$, the count of 804 designed for $M=1$ is right for one key, but if there happen to be four solutions it rotates the state about twice too far. The widget shows the effect.

The cure is to randomise. If $k$ is chosen uniformly from $\{0,1,\dots,m-1\}$, the average success probability is easy to compute and becomes reliably large once $m$ is big enough, whatever $\theta$ is.

proposition 12.2 — random iteration counts (Boyer, Brassard, Høyer and Tapp)

If $k$ is uniform on $\{0,\dots,m-1\}$, the success probability averaged over $k$ is

$$\frac1m\sum_{k=0}^{m-1}\sin^2\big((2k+1)\theta\big)=\frac12-\frac{\sin(4m\theta)}{4m\sin(2\theta)} ,$$

which is at least $\tfrac14$ whenever $m\ge1/\sin(2\theta)$.

Write $\sin^2u=\tfrac12(1-\cos2u)$, so the sum is $\tfrac m2-\tfrac12\sum_{k=0}^{m-1}\cos\big((2k+1)\alpha\big)$ with $\alpha=2\theta$. The cosine sum telescopes: since $2\sin\alpha\cos((2k+1)\alpha)=\sin((2k+2)\alpha)-\sin(2k\alpha)$, summing over $k$ gives $2\sin\alpha\sum_k\cos((2k+1)\alpha)=\sin(2m\alpha)$. Hence the sum of cosines is $\sin(4m\theta)/(2\sin2\theta)$, and dividing by $m$ gives the formula. If $m\sin2\theta\ge1$, the second term has absolute value at most $\tfrac{1}{4m\sin2\theta}\le\tfrac14$.

Take $N=2^{16}$ and $M=1$. About how large must $m$ be for Proposition 12.2 to guarantee an average success probability of at least $\tfrac14$?

Compute $1/\sin2\theta$ with $\sin\theta=1/\sqrt N=2^{-8}$. For small $\theta$, $\sin2\theta\approx2\sin\theta$.

$\sin2\theta\approx2\cdot2^{-8}=2^{-7}$, so $m\ge1/\sin2\theta\approx128=\tfrac12\sqrt N$. The threshold is of order $\sqrt N$, which is why BBHT's total cost stays $O(\sqrt{N/M})$.

Proposition 12.2 for $N=4096$ and $M=1$. Once $m$ passes $1/\sin2\theta=32$ (amber), a random count from $\{0,\dots,m-1\}$ succeeds with probability above $\tfrac14$, and the average settles near $\tfrac12$.

The BBHT algorithm exploits this without knowing $\theta$: start with $m=1$; repeatedly choose $k$ at random below $m$, run $k$ Grover iterations, measure, and check the answer with one classical query; if it fails, multiply $m$ by a constant such as $\tfrac65$. Once $m$ passes $1/\sin2\theta\approx\tfrac12\sqrt{N/M}$, each round succeeds with probability at least $\tfrac14$, and a geometric-series argument shows the expected total number of iterations is $O(\sqrt{N/M})$, the same order as if $M$ were known (Boyer et al., 1998). The simulation in Section 6 gives about $1.2\sqrt{N/M}$. If there is no solution at all, the algorithm never succeeds, so in practice one stops after about $\sqrt N$ iterations in total and declares "no solution".

3 — Grover is optimal

Could a cleverer quantum algorithm search faster than $\sqrt N$? No.

theorem 12.3 — optimality of search (Bennett, Bernstein, Brassard and Vazirani, 1997)

Every quantum algorithm that finds the marked item of an unstructured search problem with probability at least $\tfrac12$, for every possible marked item, makes $\Omega(\sqrt N)$ queries. Zalka (1999) showed that Grover's $\tfrac\pi4\sqrt N$ is optimal even in the constant.

Run the algorithm with an oracle that marks nothing, and let $a_{x,t}$ be the amplitude with which query $t$ asks about input $x$. The total "query weight" $\sum_x\sum_{t=1}^T|a_{x,t}|^2$ equals $T$, so some input $w$ receives weight at most $T/N$. Now switch to the oracle that marks $w$. Each query $t$ changes the state by at most $2|a_{w,t}|$, and the changes add up, so the final states of the two runs differ by at most $2\sum_t|a_{w,t}|\le2\sqrt{T\cdot T/N}=2T/\sqrt N$ by Cauchy–Schwarz. To tell the two oracles apart with constant probability the final states must differ by a constant, so $T\ge c\sqrt N$. (This is the "hybrid argument" of BBBV; Nielsen–Chuang §6.6 gives the details, and de Wolf Ch. 11 proves the same bound by the polynomial and adversary methods.)

Which of these claims, if true, would contradict Theorem 12.3?

A quantum computer factors 2048-bit numbers in polynomial time.Factoring is not unstructured: Shor's algorithm exploits a hidden period, and Theorem 12.3 says nothing about structured problems.
A quantum algorithm finds the marked item among $2^{40}$ unstructured items, with probability 0.9, using $2^{10}$ oracle queries.
Grover's algorithm needs about $\tfrac\pi4\,2^{20}$ queries for $N=2^{40}$.That is exactly order $\sqrt N$: it matches the bound rather than beating it.
A classical algorithm needs about $2^{39}$ queries for $N=2^{40}$.The theorem is a lower bound on quantum algorithms; a slow classical algorithm is consistent with it.

The theorem forbids fewer than order $\sqrt N$ queries for unstructured search. Compare each claim with $\sqrt{2^{40}}=2^{20}$.

$2^{10}$ queries is far below $\sqrt{2^{40}}=2^{20}$, so that algorithm cannot exist. Structured problems such as factoring are outside the theorem's reach.

Theorem 12.3 is strong evidence, relative to an oracle, that quantum computers will not solve NP-complete problems efficiently (Lecture 10): a quantum algorithm that ignores the structure of a problem can do no better than Grover, which only halves the exponent.

4 — Grover against block ciphers

Key recovery for a $k$-bit block cipher, given a known plaintext–ciphertext pair (or a few), is a search over $N=2^k$ keys with the oracle "does this key encrypt $p$ to $c$?". Lecture 7 showed how to build such an oracle reversibly, and the figure shows its shape.

A key-search oracle: compute the cipher on the known plaintext for a superposition of keys, flip the phase where the result equals the known ciphertext, and uncompute. Every Grover iteration runs the cipher twice, reversibly. Lab 3 builds this for a toy 4-bit cipher.

Grover then needs about $\tfrac\pi4\,2^{k/2}$ iterations instead of the classical $2^{k-1}$ trial encryptions on average. In "bits of security", the base-2 logarithm of the work, an idealised quantum attacker halves the key length. As an example, take an 80-bit key (the size of some legacy lightweight ciphers): Grover needs $\tfrac\pi4\,2^{40}\approx8.6\times10^{11}$ iterations, against $2^{79}$ classical trials, which at a billion trials per second is about 19 million years.

Bits of security against classical attack and against an idealised Grover attack that pays one unit per oracle call. Real quantum attacks pay much more per call and parallelise poorly, so the red bars are a lower bound on the attacker's real cost, not an estimate of it.

Three facts make the real threat much smaller than the red bars suggest.

facts 12.4 — why Grover is a weak attack in practice

The iterations are sequential. $\tfrac\pi4\,2^{k/2}$ iterations must run one after another. Even for an 80-bit key, $8.6\times10^{11}$ iterations at an (optimistic) one millisecond of error-corrected time per iteration would take about 27 years.
Parallel machines help only a little. Splitting the search across $K$ quantum computers shortens the time by only a factor $\sqrt K$, not $K$, and Zalka proved that, asymptotically, no way of parallelising Grover does better. HW6 asks you to explain why. Classical key search, by contrast, parallelises perfectly.
Each iteration is expensive. The oracle runs the whole cipher reversibly, twice. For AES-128 the first detailed estimate (Grassl, Langenberg, Roetteler and Steinwandt, 2016) needed 2,953 logical qubits and a $T$-depth of about $1.06\cdot2^{80}$ for the whole attack, using three known plaintext–ciphertext pairs (Lecture 7).

Tick every reason, given in these notes, why Grover is a much weaker attack in practice than the idealised count of $\tfrac\pi4\,2^{k/2}$ oracle calls suggests.

The iterations must run one after another, so the count is also a sequential running time.
Each iteration ends with a measurement, which restarts the search.There is no measurement between iterations: the state is rotated coherently and measured once at the end.
Every iteration runs the whole cipher reversibly, twice, on error-corrected qubits.
Grover's algorithm only works on ciphers with some linear structure.Grover needs no structure at all, only an oracle that recognises the right key. That is why it applies to every cipher, and also why it gains only a square root.

Facts 12.4 lists the reasons. Check the other two options against how Grover's algorithm actually runs (Lecture 11).

Sequential iterations and an expensive reversible oracle are two of the three facts (the third is poor parallelism). Grover is measured only once, and it works on any cipher.

NIST's post-quantum standardisation process builds the first two facts into its definitions. Its weakest security category is "at least as hard as key search on AES-128", with quantum attacks limited to a maximum circuit depth, MAXDEPTH. NIST suggested three plausible values: $2^{40}$ (what presently envisioned quantum computers could do serially in a year), $2^{64}$ (what classical computers can do serially in a decade) and $2^{96}$ (atomic-scale qubits running for a millennium). Its call for proposals estimates key search on AES-128 at $2^{170}/\text{MAXDEPTH}$ quantum gates, against $2^{143}$ classical gates; with MAXDEPTH $=2^{40}$ that is $2^{130}$ quantum gates, only $2^{13}$ times fewer than the classical $2^{143}$, and each error-corrected quantum gate is vastly more expensive than a classical one. NIST's FAQ concludes that "it is quite likely that Grover's algorithm will provide little or no advantage in attacking AES, and AES 128 will remain secure for decades to come."

idea — the practical advice

Symmetric cryptography needs no new algorithms. The standard guidance is that AES-128 remains acceptable, and that new systems wanting a comfortable long-term margin, especially for data that must stay secret for decades, should use 256-bit keys (HW6 asks you to explain what margin they restore). Compare this with Section 5's table: public-key cryptography based on factoring or discrete logarithms must be replaced outright.

5 — Hash functions, and Shor vs. Grover

An $n$-bit hash function $H$ must resist two attacks. Preimage search (given $y$, find $x$ with $H(x)=y$) is unstructured search, so Grover reduces it from $2^n$ to about $2^{n/2}$ evaluations, with the same caveats as key search. Collision search (find $x\neq x'$ with $H(x)=H(x')$) already costs only $2^{n/2}$ classically, by the birthday bound of Lecture 10. The Brassard–Høyer–Tapp algorithm finds collisions with about $2^{n/3}$ queries, but it needs about $2^{n/3}$ qubits of quantum random-access memory; once the hardware is counted, Bernstein (2009) found no advantage over classical parallel collision search. So SHA-256 keeps roughly 128-bit collision resistance and, idealised, 128-bit quantum preimage resistance.

SHA-384 has 384-bit outputs. In bits of security, what is its idealised quantum preimage resistance, and its (classical) collision resistance?

Preimage: Grover turns $2^n$ into $2^{n/2}$. Collision: the classical birthday bound is already $2^{n/2}$, and quantum collision search gives no practical gain.

Both are $384/2=192$ bits. For preimages, Grover halves the exponent; for collisions, the birthday bound halved it long before any quantum computer.

primitive	best quantum attack	effect	response
RSA, Diffie–Hellman, elliptic curves	Shor (Lectures 15–16)	broken in polynomial time	replace with post-quantum schemes (Lecture 17)
block ciphers (AES)	Grover	at most halves the bits of security	prefer 256-bit keys for long-term margin
hash functions (SHA-2, SHA-3)	Grover (preimage); BHT (collision)	preimage bits at most halved; collisions barely affected	256-bit outputs remain adequate

crypto connection — the asymmetry in one sentence

Shor exploits hidden structure (a period) and gains exponentially; Grover exploits nothing and gains only a square root, and Theorem 12.3 says that is all an unstructured attack can ever gain. That single contrast explains why the post-quantum migration replaces public-key algorithms wholesale while leaving symmetric algorithms in place.

Shor's algorithm runs in time polynomial in the key length $n$, roughly $n^3$. Doubling an RSA modulus from 2048 to 4096 bits multiplies the cost of Shor's attack by about .

If the cost is $c\,n^3$, compare $c\,(2n)^3$ with $c\,n^3$.

$(2n)^3=8n^3$: a factor of 8, which no defender can rely on. Against a polynomial-time attack, bigger keys do not help; the algorithm itself has to be replaced.

6 — Try it in code

tool — Example 12.1: amplifying a 25% algorithm (tested with qiskit 2.5)

import numpy as np
from qiskit import QuantumCircuit
from qiskit.quantum_info import Statevector

t = np.pi / 3                                  # A = R_y(pi/3): A|0> = cos(pi/6)|0> + sin(pi/6)|1>, p = 1/4

def A(qc):     qc.ry(t, 0)
def A_inv(qc): qc.ry(-t, 0)
def flip_good(qc): qc.z(0)                     # S_good = I - 2|1><1|
def flip_zero(qc): qc.x(0); qc.z(0); qc.x(0)   # S_0    = I - 2|0><0|

for rounds in range(4):
    qc = QuantumCircuit(1)
    A(qc)
    for _ in range(rounds):                    # Q = -A S_0 A^dagger S_good (the sign is a global phase)
        flip_good(qc); A_inv(qc); flip_zero(qc); A(qc)
    p = Statevector.from_instruction(qc).probabilities()[1]
    print(f"{rounds} rounds: P(good) = {p:.4f}")

0 rounds: P(good) = 0.2500
1 rounds: P(good) = 1.0000
2 rounds: P(good) = 0.2500
3 rounds: P(good) = 0.2500

tool — searching without knowing M

import numpy as np

rng = np.random.default_rng(1)
N, M = 2 ** 16, 37                            # M is unknown to the algorithm
theta = np.arcsin(np.sqrt(M / N))

def search_with_unknown_M():
    """Boyer-Brassard-Hoyer-Tapp: random iteration counts from a growing range"""
    m, iterations = 1.0, 0
    while True:
        k = rng.integers(0, int(np.ceil(m)))   # k uniform in {0, ..., ceil(m) - 1}
        iterations += k
        if rng.random() < np.sin((2 * k + 1) * theta) ** 2:   # measure and check the answer
            return iterations
        m = min(1.2 * m, np.sqrt(N))           # grow the range by 6/5

runs = [search_with_unknown_M() for _ in range(5000)]
print("average Grover iterations:", round(np.mean(runs), 1), "   sqrt(N/M) =", round(np.sqrt(N / M), 1))

average Grover iterations: 51.0    sqrt(N/M) = 42.1

This simulates the algorithm's statistics rather than running circuits: each round's success is drawn with the probability $\sin^2((2k+1)\theta)$ of Theorem 11.2. The average cost is about $1.2\sqrt{N/M}$ iterations, the same order as an algorithm that knew $M$ in advance (HW6).

7 — Lab 3 launch: Grover key search on a toy cipher

lab 3 — build the oracle, run the attack (due in 10 days)

Goal. Build a Grover oracle from a classical function, and connect Grover to cryptanalysis.

The cipher. Use the 4-bit cipher $E_k(p)=S(p\oplus k)\oplus k$, where $S$ is the PRESENT S-box $(\mathtt{C},\mathtt5,\mathtt6,\mathtt B,\mathtt9,\mathtt0,\mathtt A,\mathtt D,\mathtt3,\mathtt E,\mathtt F,\mathtt8,\mathtt4,\mathtt7,\mathtt1,\mathtt2)$ in hexadecimal. Build a reversible circuit for $S$ (Qiskit's synthesis tools may help), and from it the oracle that marks the keys $k$ with $E_k(p)=c$: compute, phase-flip, uncompute.
Check and run. Verify the oracle on all 16 basis states, then run Grover with 0 to 4 iterations and plot the success probability against Theorem 11.2.
Two keys. For this cipher, a known pair is consistent with either one or two keys. The pair $p=0$, $c=4$ has two ($k=1$ and $k=2$). Adapt your iteration count, and compare with what you get if you assume one key.
Cost. Transpile one Grover iteration for an IBM backend and report its depth and two-qubit gate count. Would it run usefully on today's hardware? (Discussion only; no hardware run.)
Analysis. Extrapolate the oracle cost to AES-128 using Lecture 7's estimates. Why does this suggest Grover is a far smaller threat than Shor?

8 — Summary and exercises

summary

Amplitude amplification: if $\mathcal A$ succeeds with probability $p=\sin^2\theta$, then $Q=-\mathcal AS_0\mathcal A^{-1}S_\chi$ rotates by $2\theta$, and about $\tfrac{\pi}{4\sqrt p}$ rounds make success likely. Grover is the case $\mathcal A=H^{\otimes n}$.
With an unknown number of solutions, random iteration counts from a growing range still cost $O(\sqrt{N/M})$ on average.
No quantum algorithm searches an unstructured space with fewer than order $\sqrt N$ queries (BBBV; Zalka: $\tfrac\pi4\sqrt N$ is exact).
Against a $k$-bit key, an idealised Grover attack costs about $2^{k/2}$ iterations. In practice the iterations are sequential, parallelism gains only $\sqrt K$, and each iteration runs the cipher reversibly twice. AES-128 remains acceptable; 256-bit keys give a long-term margin.
Hash preimages: about $2^{n/2}$ idealised; collisions: no practical quantum gain over the classical $2^{n/2}$.

Next time: the quantum Fourier transform, the engine of phase estimation and Shor's algorithm. HW6 is due at the start of Week 7; Lab 3 in ten days.

exercises 12

Let $\mathcal A$ succeed with probability exactly $p=\tfrac12$. What does one round of amplitude amplification give? Show how adding one extra qubit, prepared by $R_y(\pi/2)$ and required to be 1 for success, makes a single round succeed with certainty.
Check Proposition 12.2 for $m=1$ and $m=2$ by computing the average directly.
About how many Grover iterations does an idealised attack need for a 112-bit key?
Using NIST's estimate of $2^{170}/\text{MAXDEPTH}$ quantum gates for AES-128 key search, compute the quantum gate count for each of the three suggested MAXDEPTH values, and compare each with the classical $2^{143}$.
SHA-1 has 160-bit outputs. What are its classical and idealised quantum preimage costs, in bits? (Its classical collision resistance is in fact broken by cryptanalysis, which no quantum argument is needed for.)
For the Lab 3 cipher with $p=0$, check by hand that $k=1$ and $k=2$ both give $c=4$, and find every key consistent with $p=0$, $c=\mathtt C$.

$\theta=45^\circ$, and one round gives $\sin^2135^\circ=\tfrac12$: no improvement, and every number of rounds gives $\tfrac12$ ($\sin^2$ of $45^\circ,135^\circ,225^\circ,\dots$). With the extra qubit the combined success probability is $\tfrac12\cdot\tfrac12=\tfrac14$, so $\theta=30^\circ$, and one round reaches $90^\circ$: certainty, as in Example 12.1. Lowering $p$ on purpose to land exactly on $90^\circ$ is a standard trick.
For $m=1$, only $k=0$: average $\sin^2\theta$; the formula gives $\tfrac12-\tfrac{\sin4\theta}{4\sin2\theta}=\tfrac12-\tfrac{\cos2\theta}{2}=\sin^2\theta$. For $m=2$: $\tfrac12(\sin^2\theta+\sin^23\theta)$, and the formula gives $\tfrac12-\tfrac{\sin8\theta}{8\sin2\theta}$; both equal $\tfrac12-\tfrac14(\cos2\theta+\cos6\theta)$, using $\sin8\theta=2\sin2\theta\,(\cos2\theta+\cos6\theta)$.
$\tfrac\pi4\cdot2^{56}\approx5.7\times10^{16}$ iterations.
$2^{130}$, $2^{106}$ and $2^{74}$ quantum gates for MAXDEPTH $2^{40}$, $2^{64}$ and $2^{96}$. Only for the most generous depths does the quantum attack beat $2^{143}$ classical gates by a large margin, and those depths assume quantum hardware running flawlessly for decades to a millennium.
Classical preimage: 160 bits. Idealised Grover: about 80 bits. SHA-1 collisions were found classically in 2017, so it should not be used at all.
$E_1(0)=S(1)\oplus1=\mathtt5\oplus\mathtt1=\mathtt4$ and $E_2(0)=S(2)\oplus2=\mathtt6\oplus\mathtt2=\mathtt4$. For $c=\mathtt C$: $k=0$ gives $S(0)\oplus0=\mathtt C$, and $k=6$ gives $S(6)\oplus6=\mathtt A\oplus\mathtt6=\mathtt C$, so this pair also fits two keys.

Reading and sources

R. de Wolf, Quantum Computing: Lecture Notes, Ch. 7 (Grover and amplitude amplification) and Ch. 11 (query lower bounds) (arXiv:1907.09415).
NIST, Post-Quantum Cryptography FAQs (on AES and Grover) and the 2016 Call for Proposals, §4.A.5 (security categories and MAXDEPTH).
IBM Quantum Learning, Practical introduction to quantum-safe cryptography, the lesson on symmetric-key cryptography.
G. Brassard, P. Høyer, M. Mosca and A. Tapp, "Quantum amplitude amplification and estimation" (2002); M. Boyer, G. Brassard, P. Høyer and A. Tapp, "Tight bounds on quantum searching", Fortschr. Phys. 46 (1998); C. H. Bennett, E. Bernstein, G. Brassard and U. Vazirani, SIAM J. Comput. 26 (1997); C. Zalka, "Grover's quantum searching algorithm is optimal", Phys. Rev. A 60 (1999); G. Brassard, P. Høyer and A. Tapp, "Quantum cryptanalysis of hash and claw-free functions", LATIN 1998; D. J. Bernstein, "Cost analysis of hash collisions: will quantum computers make SHARCS obsolete?", SHARCS 2009. M. Grassl, B. Langenberg, M. Roetteler and R. Steinwandt, "Applying Grover's algorithm to AES: quantum resource estimates", PQCrypto 2016 (arXiv:1512.04965).

all numbers and figures in these notes are computed in python (verify_L12.py) and follow the page theme