Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound

Abstract

In this paper we spot light on dedicated quantum collision attacks on concrete hash functions, which has not received much attention so far. In the classical setting, the generic complexity to find collisions of an n -bit hash function is , thus classical collision attacks based on differential cryptanalysis such as rebound attacks build differential trails with probability higher than . By the same analogy, generic quantum algorithms such as the BHT algorithm find collisions with complexity . With quantum algorithms, a pair of messages satisfying a differential trail with probability p can be generated with complexity . Hence, in the quantum setting, some differential trails with probability up to that cannot be exploited in the classical setting may be exploited to mount a collision attack in the quantum setting. In particular, the number of attacked rounds may increase. In this paper, we attack two international hash function standards: AES-MMO and Whirlpool. For AES-MMO, we present a 7-round differential trail with probability and use it to find collisions with a quantum version of the rebound attack, while only 6 rounds can be attacked in the classical setting. For Whirlpool, we mount a collision attack based on a 6-round differential trail from a classical rebound distinguisher with a complexity higher than the birthday bound. This improves the best classical attack on 5 rounds by 1. We also show that those trails are optimal in our approach. Our results have two important implications. First, there seems to exist a common belief that classically secure hash functions will remain secure against quantum adversaries. Indeed, several second-round candidates in the NIST post-quantum competition use existing hash functions, say SHA-3, as quantum secure ones. Our results disprove this common belief. Second, our observation suggests that differential trail search should not stop with probability but should consider up to . Hence it deserves to revisit the previous differential trail search activities.

New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions

“…This attack is more efficient than a generic one for 18 rounds classically, and up to 20 quantumly. As a side note, these results provide a new example where quantum attacks reach more rounds than classical ones, much like in [21].…”

“…We consider 8 rounds of Gimli, e.g. rounds 21 to 14 included, and name Gimli (21,14) this reduced-round permutation. We omit the last swap, because it has no incidence (it only swaps values).…”

“…Putting both Steps Together. With these solutions, we built two collisions on 8round Gimli (21,14). We start from 1 , 0, 0, 0, then after one round, we inject the values 21 , 21 , 21 , 21 and ′21 , 21 , 21 , 21 respectively in the rate; then we obtain two states that differ only on the -coordinate of the third column (not the first, due to a big swap), and we inject two different blocks to cancel out this difference, obtaining the same state.…”

“…Different choices are possible, which are detailed e.g. in [21]. In short, the overall cost of quantum collision search depends on the cost that is assigned to quantum hardware.…”

“…Quantum collision attacks reaching more rounds than classical ones. In [21], Hosoyamada and Sasaki initiated the study of dedicated quantum attacks on hash functions. They remarked that quantum collision search does not benefit from a square-root speedup (it goes from roughly 2 /2 to 2 /3 with the BHT algorithm, and the gain is even smaller in more constrained models of quantum hardware), while some collision-finding procedures may have a better speedup, say, quadratic.…”