Building Quantum-One-Way Functions from Block Ciphers: Davies-Meyer and Merkle-Damgård Constructions

Hosoyamada, Akinori; Yasuda, Kan

doi:10.1007/978-3-030-03326-2_10

Cited by 29 publications

(8 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is easy to see that, if Saturnin is a quantum ideal cipher, then it is indifferentiable, as required by [Zha18]. There is also another work on the quantum security of Merkle-Damgård, instantiated with Davies-Meyer in [HY18]. We reckon that a proof such as [HY18] could be done also with the MMO mode, in the quantum ideal cipher model.…”

Section: Saturnin-hashmentioning

confidence: 97%

“…Similarly to a qPRF, a cipher is a qPRP if no polynomial-time adversary can distinguish it, with a randomly chosen key, from a random permutation (this adversary can make encryption and decryption queries in superposition). We will also use the stronger definition of a quantum ideal cipher given in [HY18]: it is indistinguishable from a cipher chosen at random among all ciphers, under encryption and decryption queries, in superposition over the message and the key. Both definitions are extensions from the classical ideal cipher and PRP notions.…”

Section: Quantum Security Definitionsmentioning

confidence: 99%

“…There is also another work on the quantum security of Merkle-Damgård, instantiated with Davies-Meyer in [HY18]. We reckon that a proof such as [HY18] could be done also with the MMO mode, in the quantum ideal cipher model.…”

Section: Saturnin-hashmentioning

confidence: 99%

See 2 more Smart Citations

Saturnin: a suite of lightweight symmetric algorithms for post-quantum security

Canteaut

Duval

Leurent

et al. 2020

ToSC

View full text Add to dashboard Cite

The cryptographic algorithms needed to ensure the security of our communications have a cost. For devices with little computing power, whose number is expected to grow significantly with the spread of the Internet of Things (IoT), this cost can be a problem. A simple answer to this problem is a compromise on the security level: through a weaker round function or a smaller number of rounds, the security level can be decreased in order to cheapen the implementation of the cipher. At the same time, quantum computers are expected to disrupt the state of the art in cryptography in the near future. For public-key cryptography, the NIST has organized a dedicated process to standardize new algorithms. The impact of quantum computing is harder to assess in the symmetric case but its study is an active research area.In this paper, we specify a new block cipher, Saturnin, and its usage in different modes to provide hashing and authenticated encryption in such a way that we can rigorously argue its security in the post-quantum setting. Its security analysis follows naturally from that of the AES, while our use of components that are easily implemented in a bitsliced fashion ensures a low cost for our primitives. Our aim is to provide a new lightweight suite of algorithms that performs well on small devices, in particular micro-controllers, while providing a high security level even in the presence of quantum computers. Saturnin is a 256-bit block cipher with a 256-bit key and an additional 9-bit parameter for domain separation. Using it, we built two authenticated ciphers and a hash function.• Saturnin-CTR-Cascade is an authenticated cipher using the counter mode and a separate MAC. It requires two passes over the data but its implementation does not require the inverse block cipher.• Saturnin-Short is an authenticated cipher intended for messages with a length strictly smaller than 128 bits which uses only one call to Saturnin to providenconfidentiality and integrity.• Saturnin-Hash is a 256-bit hash function. In this paper, we specify this suite of algorithms and argue about their security in both the classical and the post-quantum setting. https://project.inria.fr/saturnin/

show abstract

Section: Saturnin-hashmentioning

confidence: 97%

Section: Quantum Security Definitionsmentioning

confidence: 99%

See 1 more Smart Citation

Saturnin: a suite of lightweight symmetric algorithms for post-quantum security

Canteaut

Duval

Leurent

et al. 2020

ToSC

View full text Add to dashboard Cite

show abstract

“…According to its input and output form, the quantum one‐way functions can be classified into the following categories. The first kind of quantum one‐way functions is the “classical‐classical” one‐way function . These functions are based on the hypothesis secure against quantum algorithms, thus are hard to invert in the quantum environment.…”

Section: Introductionmentioning

confidence: 99%

“…The first kind of quantum one-way functions is the "classical-classical" one-way function. 1,2 These functions are based on the hypothesis secure against quantum algorithms, thus are hard to invert in the quantum environment. The second kind of quantum one-way functions is the "classical-quantum" one-way function with classical bits as input and quantum states as output.…”

Section: Introductionmentioning

confidence: 99%

Full quantum one‐way function for quantum cryptography

Shang

Tang

Chen

et al. 2020

Quantum Engineering

View full text Add to dashboard Cite

Summary One‐way functions are fundamental tools for cryptography. Until now, quantum one‐way functions have several input‐output categories such as “classical‐to‐classical,” “classical‐to‐quantum,” and “quantum‐to‐classical,” which are used for postquantum cryptography or quantum cryptography. However, there are still no intrinsic “quantum‐to‐quantum” quantum one‐way functions. In this article, we propose the full quantum one‐way function to design full quantum cryptographic schemes. By concatenating the “quantum‐classical” one‐way function and the rotation operation of single qubit, the full quantum one‐way function has the input and output of quantum states. We prove its one‐way property from “easy computation” and “computationally difficult to invert.” Then we apply the full quantum one‐way function to quantum identity authentication. Security analysis shows that the proposed quantum identity authentication scheme based on the full quantum one‐way function is secure even under active attacks.

show abstract