Quantum Security Analysis of AES

Bonnetain, Xavier; Naya-Plasencia, Maŕıa; Schrottenloher, André

doi:10.46586/tosc.v2019.i2.55-93

Cited by 101 publications

(61 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This is a strange tendency especially considering the fact that there are many attempts to speed up dedicated cryptanalysis against block ciphers e.g. differential and linear cryptanalysis [ 25 ], impossible differential cryptanalysis [ 44 ], meet-in-the-middle attacks [ 8 , 20 ], slide attacks [ 7 ], and so on. In this paper, we explore dedicated collision attacks against hash functions to find collisions faster than generic quantum attacks.…”

Section: Introductionmentioning

confidence: 99%

Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound

Hosoyamada

Sasaki

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper we spot light on dedicated quantum collision attacks on concrete hash functions, which has not received much attention so far. In the classical setting, the generic complexity to find collisions of an n -bit hash function is , thus classical collision attacks based on differential cryptanalysis such as rebound attacks build differential trails with probability higher than . By the same analogy, generic quantum algorithms such as the BHT algorithm find collisions with complexity . With quantum algorithms, a pair of messages satisfying a differential trail with probability p can be generated with complexity . Hence, in the quantum setting, some differential trails with probability up to that cannot be exploited in the classical setting may be exploited to mount a collision attack in the quantum setting. In particular, the number of attacked rounds may increase. In this paper, we attack two international hash function standards: AES-MMO and Whirlpool. For AES-MMO, we present a 7-round differential trail with probability and use it to find collisions with a quantum version of the rebound attack, while only 6 rounds can be attacked in the classical setting. For Whirlpool, we mount a collision attack based on a 6-round differential trail from a classical rebound distinguisher with a complexity higher than the birthday bound. This improves the best classical attack on 5 rounds by 1. We also show that those trails are optimal in our approach. Our results have two important implications. First, there seems to exist a common belief that classically secure hash functions will remain secure against quantum adversaries. Indeed, several second-round candidates in the NIST post-quantum competition use existing hash functions, say SHA-3, as quantum secure ones. Our results disprove this common belief. Second, our observation suggests that differential trail search should not stop with probability but should consider up to . Hence it deserves to revisit the previous differential trail search activities.

show abstract

Section: Introductionmentioning

confidence: 99%

Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound

Hosoyamada

Sasaki

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Thus, we can certainly obtain q PRP by instantiating LRWQ with AES. This means that our result enables us to directly benefit from recent efforts for quantum cryptanalysis on AES [GLRS16,BNS19b,JNRV20].…”

Section: Our Contributionsmentioning

confidence: 77%

Provably Quantum-Secure Tweakable Block Ciphers

Hosoyamada

Iwata

2021

ToSC

View full text Add to dashboard Cite

Recent results on quantum cryptanalysis show that some symmetric key schemes can be broken in polynomial time even if they are proven to be secure in the classical setting. Liskov, Rivest, and Wagner showed that secure tweakable block ciphers can be constructed from secure block ciphers in the classical setting. However, Kaplan et al. showed that their scheme can be broken by polynomial time quantum superposition attacks, even if underlying block ciphers are quantum-secure. Since then, it remains open if there exists a mode of block ciphers to build quantum-secure tweakable block ciphers. This paper settles the problem in the reduction-based provable security paradigm. We show the first design of quantum-secure tweakable block ciphers based on quantum-secure block ciphers, and present a provable security bound. Our construction is simple, and when instantiated with a quantum-secure n-bit block cipher, it is secure against attacks that query arbitrary quantum superpositions of plaintexts and tweaks up to O(2n/6) quantum queries. Our security proofs use the compressed oracle technique introduced by Zhandry. More precisely, we use an alternative formalization of the technique introduced by Hosoyamada and Iwata.

show abstract

“…At FSE 2020, Bonnetain et al [BNS19b] proposed a quantum circuit that fulfils the functionality of DDT. The cost is equivalent to 2 S-box computations and 22 ancilla qubits.…”

Section: Methods 2: Using a Dedicated Quantum Circuit For S-boxmentioning

confidence: 99%

“…In symmetric-key setting, it was generally believed that Grover's algorithm [Gro96] would provide the quadratic speedup in exhaustive search attack against the symmetric-key schemes such as block ciphers and hash functions, and thus doubling the key length addresses the concern. Interestingly, this belief has now been challenged due to several dedicated quantum attacks, such as on block ciphers [BNS19b], hash functions [HS20, DSS + 20], message authentication codes, authenticated encryption schemes [KM10, KLLN16, Bon17, LM17, HS18, BNS19a, IHM + 19, DDW20] etc. These attacks primarily rely on Simon's algorithm [Sim97] requiring online quantum superposition queries, except in [BHN + 19] where offline queries are performed.…”

Section: Introductionmentioning

confidence: 99%

Quantum Free-Start Collision Attacks on Double Block Length Hashing with Round-Reduced AES-256

Chauhan

Kumar

Sanadhya

2021

ToSC

View full text Add to dashboard Cite

Recently, Hosoyamada and Sasaki (EUROCRYPT 2020), and Xiaoyang Dong et al. (ASIACRYPT 2020) proposed quantum collision attacks against AES-like hashing modes AES-MMO and AES-MP. Their collision attacks are based on the quantum version of the rebound attack technique exploiting the differential trails whose probabilities are too low to be useful in the classical setting but large enough in the quantum setting. In this work, we present dedicated quantum free-start collision attacks on Hirose’s double block length compression function instantiated with AES-256, namely HCF-AES-256. The best publicly known classical attack against HCF-AES-256 covers up to 9 out of 14 rounds. We present a new 10-round differential trail for HCF-AES-256 with probability 2−160, and use it to find collisions with a quantum version of the rebound attack. Our attack succeeds with a time complexity of 285.11 and requires 216 qRAM in the quantum-attack setting, where an attacker can make only classical queries to the oracle and perform offline computations. We also present a quantum free-start collision attack on HCF-AES-256 with a time complexity of 286.07 which outperforms Chailloux, Naya-Plasencia, and Schrottenloher’s generic quantum collision attack (ASIACRYPT 2017) in a model when large qRAM is not available.

show abstract

Quantum Security Analysis of AES

Cited by 101 publications

References 27 publications

Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound

Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound

Provably Quantum-Secure Tweakable Block Ciphers

Quantum Free-Start Collision Attacks on Double Block Length Hashing with Round-Reduced AES-256

Contact Info

Product

Resources

About