Estimating the Cost of Generic Quantum Pre-image Attacks on SHA-2 and SHA-3

Abstract

Abstract. We investigate the cost of Grover's quantum search algorithm when used in the context of pre-image attacks on the SHA-2 and SHA-3 families of hash functions. Our cost model assumes that the attack is run on a surface code based fault-tolerant quantum computer. Our estimates rely on a time-area metric that costs the number of logical qubits times the depth of the circuit in units of surface code cycles. As a surface code cycle involves a significant classical processing stage, our cost estimates allow for crude, but direct, comparisons of classical and quantum algorithms. We exhibit a circuit for a pre-image attack on SHA-256 that is approximately 2 153.8 surface code cycles deep and requires approximately 2 12.6 logical qubits. This yields an overall cost of 2 166.4 logical-qubit-cycles. Likewise we exhibit a SHA3-256 circuit that is approximately 2 146.5 surface code cycles deep and requires approximately 2 20 logical qubits for a total cost of, again, 2 166.5 logical-qubit-cycles. Both attacks require on the order of 2 128 queries in a quantum black-box model, hence our results suggest that executing these attacks may be as much as 275 billion times more expensive than one would expect from the simple query analysis.

Applying quantum algorithms to constraint satisfaction problems

“…Here we outline our resource methdology, which follows a model developed by several previous works in this area [3,8,10,53,78]. The model assumes that the quantum computation is encoded using the surface code [53], a quantum error-correcting code with properties that make it an excellent candidate for implementation on near-term hardware platforms (e.g.…”

“…The second variant can be obtained from the first by rejecting any colouring which uses more than k colours. In order to determine a challenging value of k for a given graph G, we first run the first variant of DSATUR to calculate the 8 Where "easier" should be interpreted from a practical point of view; from the perspective of computational complexity theory, the two problems are polynomial-time equivalent. chromatic number χ(G), then the second variant with k = χ(G).…”

“…It is unclear how much further this process can be continued. Given that the depth overhead of the quantum circuit is within an order of magnitude of the quantum circuit for SHA-256 [8], it seems plausible that one or two further orders of magnitude improvement are the most that will be possible. However, it may be possible to reduce the Toffoli-count of the algorithm, which is extremely high at present.…”

Time–space complexity of quantum search algorithms in symmetric cryptanalysis: applying to AES and SHA-2

“…SHA-2 and SHA-3 Pre-Image Search. Amy et al reported the quantum costs of SHA-2 and SHA-3 pre-image search in the units of logical and physical qubit and gate [4]. The method considers an error-correction scheme called surface code.…”

Compact and provably secure lattice-based signatures in hardware

“…The SHA3 hash function, Keccak, is chosen as the random oracle in the proposed Ring-TESLA designs, due to its speed in hardware as well as its post-quantum security [18]. A LHW polynomial multiplication module is also designed to compute on the LHW output of the hash function.…”