Grover's algorithm does not help much against collisions; Brassard-Hoyer-Tapp (which does use Grover internally) does (at ~2^85 time), but requires a large (als

Grover's algorithm does not help much against collisions; Brassard-Hoyer-Tapp (which does use Grover internally) does (at ~2^85 time), but requires a large (also ~2^85) amount of quantum storage. Basically: generate ~2^85 random strings and respective hashes, then use Grover to find one new preimage in ~2^85 (instead of classical ~2^170) time. In practice classical rho collision-finding is more resource-efficient: replace the crazy ~2^85 storage by ~2^85 small memoryless computing units, and find a collision in 2^128 / 2^85 ~ 2^43 time. Or match the quantum time with only ~2^43 computing units, and negligible storage.