Quantum attacks on two-round even-mansour

Abstract

Even-Mansour is one of the most important constructions in symmetric cryptography, both from a theoretical and practical perspective. With the rapid development of quantum computing, the security of Even-Mansour construction in quantum setting needs to be considered. For one round Even-Mansour construction, it is well settled by classical and quantum attacks. While for the iterated scheme, the situation is much more complex. In this paper, we study the next case in line in detail and depth: quantum attacks against two rounds case. We first make an asymptotic comparison with existing classical and quantum attacks. Then we give concrete resource estimation for the proposed quantum attacks on round reduced LED cipher and AES2. The resource estimation allows to deduce the most efficient attacks based on the trade-off of the number of qubits and Toffoli depth.

Quantum Attacks on Type‐1 Generalized Feistel Schemes

“…This started with the 3-round Feistel distinguisher proposed by Kuwakado and Morii. [16] After that, more generic constructions, such as Even-Mansour cipher, [17,18] FX construction, [19] message authentication codes (MACs), [20][21][22][23] etc, [24][25][26] were broken by different quantum algorithms, including Simon algorithm, [27] Grover algorithm, [28] Grover-meets-Simon algorithm, [19] Bernstein-Vazirani (BV) algorithm, [29] etc.…”