Implementing Grover Oracles for Quantum Key Search on AES and LowMC

Jaques, Samuel; Naehrig, Michael; Roetteler, Martin; Virdia, Fernando

doi:10.1007/978-3-030-45724-2_10

Cited by 139 publications

(134 citation statements)

References 37 publications

Supporting

Mentioning

124

Contrasting

Unclassified

Order By: Relevance

“…Thus, we can certainly obtain q PRP by instantiating LRWQ with AES. This means that our result enables us to directly benefit from recent efforts for quantum cryptanalysis on AES [GLRS16,BNS19b,JNRV20].…”

Section: Our Contributionsmentioning

confidence: 77%

Provably Quantum-Secure Tweakable Block Ciphers

Hosoyamada

Iwata

2021

ToSC

View full text Add to dashboard Cite

Recent results on quantum cryptanalysis show that some symmetric key schemes can be broken in polynomial time even if they are proven to be secure in the classical setting. Liskov, Rivest, and Wagner showed that secure tweakable block ciphers can be constructed from secure block ciphers in the classical setting. However, Kaplan et al. showed that their scheme can be broken by polynomial time quantum superposition attacks, even if underlying block ciphers are quantum-secure. Since then, it remains open if there exists a mode of block ciphers to build quantum-secure tweakable block ciphers. This paper settles the problem in the reduction-based provable security paradigm. We show the first design of quantum-secure tweakable block ciphers based on quantum-secure block ciphers, and present a provable security bound. Our construction is simple, and when instantiated with a quantum-secure n-bit block cipher, it is secure against attacks that query arbitrary quantum superpositions of plaintexts and tweaks up to O(2n/6) quantum queries. Our security proofs use the compressed oracle technique introduced by Zhandry. More precisely, we use an alternative formalization of the technique introduced by Hosoyamada and Iwata.

show abstract

Section: Our Contributionsmentioning

confidence: 77%

Provably Quantum-Secure Tweakable Block Ciphers

Hosoyamada

Iwata

2021

ToSC

View full text Add to dashboard Cite

show abstract

“…Besides quantum acceleration on exhaustive search, new lines of research emerged, focusing on dedicated cryptanalysis of block ciphers [13], hash functions [25], and on the several attacks relying on Simon's algorithm ( [9][10][11][12]32,35,37]). Nevertheless, work on quantum circuits focuses mainly on exhaustive key search and specifically on AES key search [18,29], [1,36], [22], and the few other examples mentioned above.…”

Section: Related Workmentioning

confidence: 99%

Quantum search for scaled hash function preimages

Ramos-Calderer

Bellini

Latorre

et al. 2021

Quantum Inf Process

View full text Add to dashboard Cite

We present the implementation of Grover’s algorithm in a quantum simulator to perform a quantum search for preimages of two scaled hash functions, whose design only uses modular addition, word rotation and bitwise exclusive or. Our implementation provides the means to assess with precision the scaling of the number of gates and depth of a full-fledged quantum circuit designed to find the preimages of a given hash digest. The detailed construction of the quantum oracle shows that the presence of AND gates, OR gates, shifts of bits and the reuse of the initial state along the computation require extra quantum resources as compared with other hash functions based on modular additions, XOR gates and rotations. We also track the entanglement entropy present in the quantum register at every step along the computation, showing that it becomes maximal at the inner core of the first action of the quantum oracle, which implies that no classical simulation based on tensor networks would be of relevance. Finally, we show that strategies that suggest a shortcut based on sampling the quantum register after a few steps of Grover’s algorithm can only provide some marginal practical advantage in terms of error mitigation.

show abstract

“…Let us simply notice that Gimli, compared to other primitives that have been studied in this setting, e.g. AES [22], seems fairly easy to implement using basic quantum computing operations. In the example of AES, the most costly component is the S-Box [22], and Gimli does not have such.…”

Section: Examplementioning

confidence: 99%

New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions

Gutierrez

Leurent

Naya-Plasencia

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Gimli is a family of cryptographic primitives (both a hash function and an AEAD scheme) that has been selected for the second round of the NIST competition for standardizing new lightweight designs. The candidate Gimli is based on the permutation Gimli, which was presented at CHES 2017. In this paper, we study the security of both the permutation and the constructions that are based on it. We exploit the slow diffusion in Gimli and its internal symmetries to build, for the first time, a distinguisher on the full permutation of complexity 2 64 . We also provide a practical distinguisher on 23 out of the full 24 rounds of Gimli that has been implemented. Next, we give (full state) collision and semi-free-start collision attacks on Gimli-Hash, reaching respectively up to 12 and 18 rounds. On the practical side, we compute a collision on 8-round Gimli-Hash. In the quantum setting, these attacks reach 2 more rounds. Finally, we perform the first study of linear trails in the permutation, and we propose differentiallinear cryptanalysis that reach up to 17 rounds of Gimli.

show abstract

Implementing Grover Oracles for Quantum Key Search on AES and LowMC

Cited by 139 publications

References 37 publications

Provably Quantum-Secure Tweakable Block Ciphers

Provably Quantum-Secure Tweakable Block Ciphers

Quantum search for scaled hash function preimages

New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions

Contact Info

Product

Resources

About