  Given a random function $f$ with domain $[2^n]$ and codomain $[2^m]$, with $m
\geq n$, a collision of $f$ is a pair of distinct inputs with the same image.
Collision finding is an ubiquitous problem in cryptanalysis, and it has been
well studied using both classical and quantum algorithms. Indeed, the quantum
query complexity of the problem is well known to be $\Theta(2^{m/3})$, and
matching algorithms are known for any value of $m$. The situation becomes
different when one is looking for multiple collision pairs. Here, for $2^k$
collisions, a query lower bound of $\Theta(2^{(2k+m)/3})$ was shown by Liu and
Zhandry (EUROCRYPT~2019). A matching algorithm is known, but only for
relatively small values of $m$, when many collisions exist. In this paper, we
improve the algorithms for this problem and, in particular, extend the range of
admissible parameters where the lower bound is met. Our new method relies on a
chained quantum walk algorithm, which might be of independent interest. It
allows to extract multiple solutions of an MNRS-style quantum walk, without
having to recompute it entirely: after finding and outputting a solution, the
current state is reused as the initial state of another walk. As an
application, we improve the quantum sieving algorithms for the shortest vector
problem (SVP), with a complexity of $2^{0.2563d + o(d)}$ instead of the
previous $2^{0.2570d + o(d)}$.
