An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography

Chailloux, André; Naya-Plasencia, Maŕıa; Schrottenloher, André

doi:10.1007/978-3-319-70697-9_8

Cited by 89 publications

(86 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…With Grover we could recover the keys with a complexity of 2 n/2 and 2 plaintextsciphertext pairs, (P 1 , C 1 ) and (P 2 , C 2 ), by performing an exhaustive search over the value of k 1 that would verify P (P 1 ⊕ k 1 ) ⊕ P (P 2 ⊕ k 1 ) = C 1 ⊕ C 2 . In [23], Hosoyamada and Sasaki also gave a tradeoff D · T 6 = 2 3n for D ≤ 2 3n/7 under the condition that only polynomially many qubits are available, by using the multi-target preimage search by Chailloux et al [12]. D and T are balanced at D = T = 2 3n/7 , which is smaller than the classical balanced point 2 n/2 .…”

Section: Tradeoffs For the Even-mansour Constructionmentioning

confidence: 99%

See 1 more Smart Citation

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

Bonnetain

Hosoyamada

Naya-Plasencia

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

In symmetric cryptanalysis, the model of superposition queries has led to surprising results, with many constructions being broken in polynomial time thanks to Simon's period-finding algorithm. But the practical implications of these attacks remain blurry. In contrast, the results obtained so far for a quantum adversary making classical queries only are less impressive. In this paper, we introduce a new quantum algorithm which uses Simon's subroutines in a novel way. We manage to leverage the algebraic structure of cryptosystems in the context of a quantum attacker limited to classical queries and offline quantum computations. We obtain improved quantum-time/classical-data tradeoffs with respect to the current literature, while using only as much hardware requirements (quantum and classical) as a standard exhaustive search with Grover's algorithm. In particular, we are able to break the Even-Mansour construction in quantum timeÕ(2 n/3 ), with O(2 n/3 ) classical queries and O(n 2 ) qubits only. In addition, we improve some previous superposition attacks by reducing the data complexity from exponential to polynomial, with the same time complexity. Our approach can be seen in two complementary ways: reusing superposition queries during the iteration of a search using Grover's algorithm, or alternatively, removing the memory requirement in some quantum attacks based on a collision search, thanks to their algebraic structure. We provide a list of cryptographic applications, including the Even-Mansour construction, the FX construction, some Sponge authenticated modes of encryption, and many more.

show abstract

Section: Tradeoffs For the Even-mansour Constructionmentioning

confidence: 99%

“…However, even in this direction, there are several debatable points; basic quantum algorithms for finding collisions have massive quantum hardware requirements [9]. There is a quantum-hardwarefriendly variant [12], but then the time complexity becomes suboptimal.…”

Section: Introductionmentioning

confidence: 99%

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

Bonnetain

Hosoyamada

Naya-Plasencia

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…The quantum algorithm on the hash function is mainly focused on collision problem, and little research on preimage attack. In article, 9 Chailloux and Naya‐Plasencia proposed a quantum algorithm for multitarget preimage search. Given a function H and a list

L = {y_{1}, y_{2}, \dots, y_{2^{t}}}

of elements of size 2 t .…”

Section: Quantum Algorithm For Hash Functionsmentioning

confidence: 99%

Quantum algorithms for hash preimage attacks

Wang

Tian

Sun

et al. 2020

Quantum Engineering

View full text Add to dashboard Cite

Summary Cryptographic hash functions are important building blocks of many security systems. A preimage attack on hash functions tries to find a message that has a specific hash value. A cryptographic hash function should resist attacks on its preimage. The current paper presents a new quantum algorithm for hash preimage attacks, which can break the preimage resistance with circuit complexity O(2n/3) using O(2n/3) running times, where n is the input bit length of the hash function. The quantum circuit complexity is apparently reduced from O(2n/2) to O(2n/3) at the cost of O(2n/3) running times requirements compared with the existing algorithms.

show abstract

“…After taking the asymptotical big O notation off, the relation between time and space in terms of Grover iterations and number of processors, called trade-offs curve, is obtained. Apart from resource estimates, investigating the trade-offs curve of state-of-the-art collision algorithm in [18] with optimized parameters is one of our major concerns.…”

Section: This Workmentioning

confidence: 99%

“…In Asiacrypt 2017, Chailloux, Naya-Plasencia and Schrottenloher suggested a new quantum collision finding algorithm, called CNS algorithm, of O(N 2/5 ) query complexity using O(N 1/5 ) classical memory [18].…”

Section: Generalizations and Variantsmentioning

confidence: 99%

Time–space complexity of quantum search algorithms in symmetric cryptanalysis: applying to AES and SHA-2

Kim¹,

Han²,

Jeong³

2018

Quantum Inf Process

View full text Add to dashboard Cite

Performance of cryptanalytic quantum search algorithms is mainly inferred from query complexity which hides overhead induced by an implementation. To shed light on quantitative complexity analysis removing hidden factors, we provide a framework for estimating timespace complexity, with carefully accounting for characteristics of target cryptographic functions. Processor and circuit parallelization methods are taken into account, resulting in the time-space trade-offs curves in terms of depth and qubit. The method guides how to rank different circuit designs in order of their efficiency. The framework is applied to representative cryptosystems NIST referred to as a guideline for security parameters, reassessing the security strengths of AES and SHA-2.

show abstract

An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography

Cited by 89 publications

References 43 publications

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

Quantum algorithms for hash preimage attacks

Time–space complexity of quantum search algorithms in symmetric cryptanalysis: applying to AES and SHA-2

Contact Info

Product

Resources

About