The query complexity of order-finding

We consider the problem where /spl pi/ is an unknown permutation on (0, 1,..., 2/sup n/-1), /spl gamma//sub 0//spl isin/(0, 1,..., 2/sup n/-1), and the goal is to determine the minimum r>0 such that /spl pi//sup r/(y/sub 0/)=y/sub 0/. Information about /spl pi/ is available only via queries that yield /spl pi//sup x/(y) from any x/spl isin/(0, 1,..., 2/sup n/-1) and /spl gamma//sub /spl isin//(0, 1,..., 2/sup n/-1) (where m is polynomial in n). The resource under consideration is the number of these queries (hence our model of computation is the decision tree). We show that the number of queries necessary to solve the problem in the classical probabilistic bounded error model is exponential in n. This contrasts sharply with the quantum bounded-error model, where a constant number of queries suffices.