2020
DOI: 10.1007/978-3-030-45724-2_10
|View full text |Cite
|
Sign up to set email alerts
|

Implementing Grover Oracles for Quantum Key Search on AES and LowMC

Abstract: Grover’s search algorithm gives a quantum attack against block ciphers by searching for a key that matches a small number of plaintext-ciphertext pairs. This attack uses calls to the cipher to search a key space of size N . Previous work in the specific case of AES derived the full gate cost by analyzing quantum circuits for the cipher, but focused on minimizing the number of qubits. In contrast, we study the cost of quantum key search attacks under a depth restric… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...
1
1
1
1

Citation Types

0
124
0
2

Year Published

2020
2020
2024
2024

Publication Types

Select...
4
3
2

Relationship

0
9

Authors

Journals

citations
Cited by 148 publications
(134 citation statements)
references
References 37 publications
0
124
0
2
Order By: Relevance
“…Thus, we can certainly obtain q PRP by instantiating LRWQ with AES. This means that our result enables us to directly benefit from recent efforts for quantum cryptanalysis on AES [GLRS16,BNS19b,JNRV20].…”
Section: Our Contributionsmentioning
confidence: 77%
“…Thus, we can certainly obtain q PRP by instantiating LRWQ with AES. This means that our result enables us to directly benefit from recent efforts for quantum cryptanalysis on AES [GLRS16,BNS19b,JNRV20].…”
Section: Our Contributionsmentioning
confidence: 77%
“…Besides quantum acceleration on exhaustive search, new lines of research emerged, focusing on dedicated cryptanalysis of block ciphers [13], hash functions [25], and on the several attacks relying on Simon's algorithm ( [9][10][11][12]32,35,37]). Nevertheless, work on quantum circuits focuses mainly on exhaustive key search and specifically on AES key search [18,29], [1,36], [22], and the few other examples mentioned above.…”
Section: Related Workmentioning
confidence: 99%
“…Let us simply notice that Gimli, compared to other primitives that have been studied in this setting, e.g. AES [22], seems fairly easy to implement using basic quantum computing operations. In the example of AES, the most costly component is the S-Box [22], and Gimli does not have such.…”
Section: Examplementioning
confidence: 99%