Grover Meets Simon – Quantumly Attacking the FX-construction

Leander, Gregor; May, Alexander

doi:10.1007/978-3-319-70697-9_6

Cited by 116 publications

(91 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…1). If we were in the Q2 model, we could recover k 1 by using the technique by Leander and May [31] in timeÕ(2 n/3 ). However, their technique is not applicable in the Q1 setting since quantum queries are required.…”

Section: Target Modelmentioning

confidence: 99%

“…Moreover, our attack idea in the Q1 model can also be used to reduce the number of quantum queries of attacks in the Q2 model. The Leander and May's attack on the FX construction in the Q2 model [31] guesses the m-bit key k of the FX construction FX k,kin,kout and checks whether the guess is correct by using Simon's algorithm, which requires O(2 m/2 ) online quantum queries and O(2 m/2 ) offline quantum computations. Roughly speaking, the guess k ′ for the key k is correct if and only if (f k ′ ⊕ g)(x) has the secret period k in , where f k ′ (x) = E k ′ (x) and g(x) = FX k,kin,kout (x).…”

Section: Target Modelmentioning

confidence: 99%

“…This is reasonable for cryptographic applications, as a block cipher is expected to behave like a random permutation, which makes the functions we construct in our applications behave like random functions. This assumption is made in [24,31], and such functions satisfy Condition (2) with an overwhelming probability. Moreover, as remarked in [24], a cryptographic construction that fails to satisfy Condition (2) would exhibit some poor differential properties which could be used for cryptanalysis.…”

Section: Simon's Algorithm With Asymmetric Queriesmentioning

confidence: 99%

See 2 more Smart Citations

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

Bonnetain

Hosoyamada

Naya-Plasencia

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In symmetric cryptanalysis, the model of superposition queries has led to surprising results, with many constructions being broken in polynomial time thanks to Simon's period-finding algorithm. But the practical implications of these attacks remain blurry. In contrast, the results obtained so far for a quantum adversary making classical queries only are less impressive. In this paper, we introduce a new quantum algorithm which uses Simon's subroutines in a novel way. We manage to leverage the algebraic structure of cryptosystems in the context of a quantum attacker limited to classical queries and offline quantum computations. We obtain improved quantum-time/classical-data tradeoffs with respect to the current literature, while using only as much hardware requirements (quantum and classical) as a standard exhaustive search with Grover's algorithm. In particular, we are able to break the Even-Mansour construction in quantum timeÕ(2 n/3 ), with O(2 n/3 ) classical queries and O(n 2 ) qubits only. In addition, we improve some previous superposition attacks by reducing the data complexity from exponential to polynomial, with the same time complexity. Our approach can be seen in two complementary ways: reusing superposition queries during the iteration of a search using Grover's algorithm, or alternatively, removing the memory requirement in some quantum attacks based on a collision search, thanks to their algebraic structure. We provide a list of cryptographic applications, including the Even-Mansour construction, the FX construction, some Sponge authenticated modes of encryption, and many more.

show abstract

Section: Target Modelmentioning

confidence: 99%

Section: Target Modelmentioning

confidence: 99%

Section: Simon's Algorithm With Asymmetric Queriesmentioning

confidence: 99%

See 1 more Smart Citation

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

Bonnetain

Hosoyamada

Naya-Plasencia

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Therefore, we have to construct a quantum algorithm that exhibits less time complexity than both 2 n and 2 1.25n . Inspired by Leander and May's study [16], we combine Grover's and Simon's algorithms to observe the round keys.…”

Section: Quantum Key-recovery Attacks On 5-round Feistel Structuresmentioning

confidence: 99%

“…At Asiacrypt 2017, Leander and May [16] presented a quantum key-recovery attack on FX-construction, which were introduced by Kilian and Rogaway [17] to strengthen DES, as shown in Figure 2:…”

Section: Introductionmentioning

confidence: 99%

Quantum key-recovery attack on Feistel structures

Dong

Wang

2018

Sci. China Inf. Sci.

View full text Add to dashboard Cite

Secure Key-Alternating Feistel Ciphers Without Key Schedule SCIENCE CHINA Information Sciences Quantum cryptanalysis on some generalized Feistel schemes SCIENCE CHINA Information Sciences 62, 022501 (2019); Real-time state recovery attack against MORUS in nonce-misuse setting SCIENCE CHINA Information Sciences 62, 039109 (2019); Partially known information attack on SM2 key exchange protocol SCIENCE CHINA Information Sciences 62, 032105 (2019); SCIENCE CHINA Information Sciences

show abstract

Post‐Quantum Symmetric Cryptography

NAYA‐PLASENCIA

2023

Symmetric Cryptography 2

View full text Add to dashboard Cite

Grover Meets Simon – Quantumly Attacking the FX-construction

Cited by 116 publications

References 18 publications

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

Quantum key-recovery attack on Feistel structures

Post‐Quantum Symmetric Cryptography

Contact Info

Product

Resources

About