Quantum Chosen-Ciphertext Attacks Against Feistel Ciphers

Ito, Gembu; Hosoyamada, Akinori; Matsumoto, Ryutaroh; Sasaki, Yu; Iwata, Tetsu

doi:10.1007/978-3-030-12612-4_20

Cited by 44 publications

(14 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Following [40,33,17], we will adopt the Q1 / Q2 terminology to classify quantum attacks on symmetric schemes. Note that these models have alternative names, for example "quantum chosen-plaintext attack" (qCPA) is used for "Q2" in [34,22]. In the Q1 setting, the adversary is given only classical encryption or decryption query access to black-boxes.…”

Section: Attack Scenariosmentioning

confidence: 99%

Quantum Linearization Attacks

Bonnetain

Leurent

Naya-Plasencia

et al. 2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Recent works have shown that quantum period-finding can be used to break many popular constructions (some block ciphers such as Even-Mansour, multiple MACs and AEs. . . ) in the superposition query model. So far, all the constructions broken exhibited a strong algebraic structure, which enables to craft a periodic function of a single input block. Recovering the secret period allows to recover a key, distinguish, break the confidentiality or authenticity of these modes. In this paper, we introduce the quantum linearization attack, a new way of using Simon's algorithm to target MACs in the superposition query model. Specifically, we use inputs of multiple blocks as an interface to a function hiding a linear structure. Recovering this structure allows to perform forgeries. We also present some variants of this attack that use other quantum algorithms, which are much less common in quantum symmetric cryptanalysis: Deutsch's, Bernstein-Vazirani's, and Shor's. To the best of our knowledge, this is the first time these algorithms have been used in quantum forgery or key-recovery attacks. Our attack breaks many parallelizable MACs such as LightMac, PMAC, and numerous variants with (classical) beyond-birthday-bound security (LightMAC+, PMAC+) or using tweakable block ciphers (ZMAC). More generally, it shows that constructing parallelizable quantum-secure PRFs might be a challenging task.

show abstract

Section: Attack Scenariosmentioning

confidence: 99%

Quantum Linearization Attacks

Bonnetain

Leurent

Naya-Plasencia

et al. 2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…We will use, for its simplicity, the Q1 / Q2 terminology of [39,31,12], which is the most common in quantum cryptanalysis works. Alternative names exist, such as "quantum chosen-plaintext attack" (qCPA) instead of Q2, found in most provable security works (e.g., [6]) and [36,18].…”

Section: Contextmentioning

confidence: 99%

Beyond quadratic speedups in quantum attacks on symmetric schemes

Bonnetain¹,

Schrottenloher²,

Sibleyras³

2021

Preprint

View full text Add to dashboard Cite

In this paper, we report the first quantum key-recovery attack on a symmetric block cipher design, using classical queries only, with a more than quadratic time speedup compared to the best classical attack. We study the 2XOR-Cascade construction of Gaži and Tessaro (EURO-CRYPT 2012). It is a key length extension technique which provides an n-bit block cipher with 5n 2 bits of security out of an n-bit block cipher with 2n bits of key, with a security proof in the ideal model. We show that the offline-Simon algorithm of Bonnetain et al. (ASIACRYPT 2019) can be extended to, in particular, attack this construction in quantum time O(2 n ), providing a 2.5 quantum speedup over the best classical attack. Regarding post-quantum security of symmetric ciphers, it is commonly assumed that doubling the key sizes is a sufficient precaution. This is because Grover's quantum search algorithm, and its derivatives, can only reach a quadratic speedup at most. Our attack shows that the structure of some symmetric constructions can be exploited to overcome this limit. In particular, the 2XOR-Cascade cannot be used to generically strengthen block ciphers against quantum adversaries, as it would offer only the same security as the block cipher itself.

show abstract

“…Many common quantum attack methods( [24][25] [26] [27]) are also the application and extension of Simon's algorithm.…”

Section: Introductionmentioning

confidence: 99%

Feasibility Analysis of Grover-meets-Simon Algorithm

Zhu¹,

Xie²,

Xia³

et al. 2023

Preprint

View full text Add to dashboard Cite

Quantum algorithm is a key tool for cryptanalysis. At present, people are committed to building powerful quantum algorithms and tapping the potential of quantum algorithms, so as to further analyze the security of cryptographic algorithms under quantum computing. Recombining classical quantum algorithms is one of the current ideas to construct quantum algorithms. However, they can not be easily combined, the feasibility of quantum algorithms needs further analysis in quantum environment.This paper reanalyzes the existing combined algorithm--Grover-meets-Simon algorithm in terms of the principle of deferred measurement. First of all, due to the collapse problem caused by the measurement, we negate the measurement process of Simon's algorithm during the process of the Grover-meets-Simon algorithm. Second, since the output of the unmeasured Simon algorithm is quantum linear systems of equations, we discuss the solution of quantum linear systems of equations and find it feasible to consider the deferred measurement of the parallel Simon algorithm alone. Finally, since the Grover-meets-Simon algorithm involves an iterative problem, we reconsider the feasibility of the algorithm when placing multiple measurements at the end. According to the maximum probability of success and query times, we get that the Grover-meets-Simon algorithm is not an effective attack algorithm when putting the measurement process of the Simon algorithm in the iterative process at the end of Grover-meets-Simon algorithm.

show abstract

Quantum Chosen-Ciphertext Attacks Against Feistel Ciphers

Cited by 44 publications

References 17 publications

Quantum Linearization Attacks

Quantum Linearization Attacks

Beyond quadratic speedups in quantum attacks on symmetric schemes

Feasibility Analysis of Grover-meets-Simon Algorithm

Contact Info

Product

Resources

About