Provably Quantum-Secure Tweakable Block Ciphers

Abstract

Recent results on quantum cryptanalysis show that some symmetric key schemes can be broken in polynomial time even if they are proven to be secure in the classical setting. Liskov, Rivest, and Wagner showed that secure tweakable block ciphers can be constructed from secure block ciphers in the classical setting. However, Kaplan et al. showed that their scheme can be broken by polynomial time quantum superposition attacks, even if underlying block ciphers are quantum-secure. Since then, it remains open if there exists a mode of block ciphers to build quantum-secure tweakable block ciphers. This paper settles the problem in the reduction-based provable security paradigm. We show the first design of quantum-secure tweakable block ciphers based on quantum-secure block ciphers, and present a provable security bound. Our construction is simple, and when instantiated with a quantum-secure n-bit block cipher, it is secure against attacks that query arbitrary quantum superpositions of plaintexts and tweaks up to O(2n/6) quantum queries. Our security proofs use the compressed oracle technique introduced by Zhandry. More precisely, we use an alternative formalization of the technique introduced by Hosoyamada and Iwata.

QCB: Efficient Quantum-Secure Authenticated Encryption

“…Quantum-secure TBCs have been independently considered by Hosoyamada and Iwata in [19]. They used a stronger notion of security where tweaks can be queried in superposition, and showed how to construct such a TBC from a block cipher.…”

Quantum Attacks on Sum of Even–Mansour Construction with Linear Key Schedules

“…Grover-meet-Simon algorithm [ 13 ] was first introduced by Leander and May, and combined Simon’s algorithm and Grover’s algorithm to achieve the key recovery attack against FX-construction. Currently, Simon’s algorithm, Grover’s algorithm, and Grover-meet-Simon algorithm have been extended to the Sum of Even–Mansour construction [ 14 ], encryption schemes [ 15 , 16 , 17 , 18 , 19 , 20 ], hash schemes [ 21 , 22 , 23 ], message authentication codes (MACs) [ 18 , 24 ], and authenticated encryption schemes [ 18 , 25 , 26 ]. There exist other quantum algorithms (such as HHL algorithm and BTH algorithm) and relevant quantum cryptanalysis.…”