Hidden Shift Quantum Cryptanalysis and Implications

Abstract

At Eurocrypt 2017 a tweak to counter Simon's quantum attack was proposed: replace the common bitwise addition, with other operations, as a modular addition. The starting point of our paper is a follow up of these previous results: First, we have developed new algorithms that improve and generalize Kuperberg's algorithm for the hidden shift problem, which is the algorithm that applies instead of Simon when considering modular additions. Thanks to our improved algorithm, we have been able to build a quantum attack in the superposition model on Poly1305, proposed at FSE 2005, largely used and claimed to be quantumly secure. We also answer an open problem by analyzing the effect of the tweak to the FX construction. We have also generalized the algorithm. We propose for the first time a quantum algorithm for solving the problem with parallel modular additions, with a complexity that matches both Simon and Kuperberg in its extremes. We also propose a generic algorithm to solve the hidden shift problem in non-abelian groups. In order to verify the theoretical analysis we performed, and to get concrete estimates of the cost of the algorithms, we have simulated them, and were able to validate our estimated complexities. Finally, we analyze the security of some classical symmetric constructions with concrete parameters, to evaluate the impact and practicality of the proposed tweak, concluding that it does not seem to be efficient.

Quantum Security Analysis of CSIDH

“…Intuitively, the behavior of this algorithm will be close to the one of [ 10 ], as we only have a slightly higher amplitude in the values, and a few more elements to produce. The number of oracle queries Q is exactly the number of labeled qubits used during the combination step.…”

“…Cyclic Groups and Concrete Estimates. In [ 10 ], the authors showed that the polynomial factor in the , for a variant of Kuperberg’s original algorithm, is a constant around 1 if N is a power of 2. In the context of CSIDH, the cardinality of the class group is not a power of 2, but in most cases, its odd part is cyclic, as shown by the Cohen–Lenstra heuristics [ 17 ].…”

“…So we choose to approximate the class group as a cyclic group. This is why we propose in what follows a generalization of [ 10 , Algorithm 2] that works for any N , at essentially the same cost. We suppose that an arbitrary representation of the class group is available; one could be obtained with the quantum polynomial-time algorithm of [ 14 ], as done in [ 16 ].…”

“…If the group has a component which is a small power of two, the previous routine can be used with in order to force the odd cyclic component at zero. Then the algorithms of [ 10 ] can be used, with a negligible overhead.…”

Quantum Circuits for the CSIDH: Optimizing Quantum Evaluation of Isogenies

“…The first question is outside the scope of our paper. Some of the simpler algorithms were simulated for small sizes in [46], [10], and [11], but Kuperberg commented in [46, page 5] that his "experiments with this simulator led to a false conjecture for [the] algorithm's precise query complexity".…”