Breaking Symmetric Cryptosystems Using Quantum Period Finding

Abstract

Due to Shor's algorithm, quantum computers are a severe threat for public key cryptography. This motivated the cryptographic community to search for quantum-safe solutions. On the other hand, the impact of quantum computing on secret key cryptography is much less understood. In this paper, we consider attacks where an adversary can query an oracle implementing a cryptographic primitive in a quantum superposition of different states. This model gives a lot of power to the adversary, but recent results show that it is nonetheless possible to build secure cryptosystems in it. We study applications of a quantum procedure called Simon's algorithm (the simplest quantum period finding algorithm) in order to attack symmetric cryptosystems in this model. Following previous works in this direction, we show that several classical attacks based on finding collisions can be dramatically sped up using Simon's algorithm: finding a collision requires Ω(2 n/2 ) queries in the classical setting, but when collisions happen with some hidden periodicity, they can be found with only O(n) queries in the quantum model. We obtain attacks with very strong implications. First, we show that the most widely used modes of operation for authentication and authenticated encryption (e.g. CBC-MAC, PMAC, GMAC, GCM, and OCB) are completely broken in this security model. Our attacks are also applicable to many CAESAR candidates: CLOC, AEZ, COPA, OTR, POET, OMD, and Minalpher. This is quite surprising compared to the situation with encryption modes: Anand et al. show that standard modes are secure with a quantum-secure PRF. Second, we show that Simon's algorithm can also be applied to slide attacks, leading to an exponential speed-up of a classical symmetric cryptanalysis technique in the quantum model.

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

“…holds, where Ψ (i) = u,x (−1) u·x |u |(f i ⊕ g)(x) . Now we use the following claim as a fact, which is shown as a subordinate result in the proof of Theorem 1 in [24].…”

“…Quantum slide attacks are a very efficient quantum counterpart of the classical slide attacks [3]. They have been introduced in [24], with a polynomial-time attack on 1-round self-similar ciphers. In many cases, our algorithm does not improve these attacks, because they are already too efficient and do not rely on a partial exhaustive search.…”

Report on Post-Quantum Cryptography

“…But this recommendation may be overly conservative, as quantum computing hardware will likely be more expensive to build than classical hardware. At the same time, this recommendation does not take into account the possibility of more sophisticated quantum attacks [16,17,18]. Our understanding of quantum cryptanalysis remains rather limited, and more research in this area is urgently needed.…”

Best of both worlds

“…This line of research has put forward a new tradeoff between the desired level of security and the required efficiency for practical purposes currently explored by Google's New Hope scheme in Chrome. But while cryptographers search for new computational assumptions that provide resistance to quantum attacks, crypto-analysts are busy finding new quantum trickery to break them down 3 . This in turn leads to the need for more complex protocols and hence to even more challenges for practical solutions.…”