Quantum Differential and Linear Cryptanalysis

Abstract

Quantum computers, that may become available one day, would impact many scientific fields, most notably cryptography since many asymmetric primitives are insecure against an adversary with quantum capabilities. Cryptographers are already anticipating this threat by proposing and studying a number of potentially quantum-safe alternatives for those primitives. On the other hand, symmetric primitives seem less vulnerable against quantum computing: the main known applicable result is Grover’s algorithm that gives a quadratic speed-up for exhaustive search. In this work, we examine more closely the security of symmetric ciphers against quantum attacks. Since our trust in symmetric ciphers relies mostly on their ability to resist cryptanalysis techniques, we investigate quantum cryptanalysis techniques. More specifically, we consider quantum versions of differential and linear cryptanalysis. We show that it is usually possible to use quantum computations to obtain a quadratic speed-up for these attack techniques, but the situation must be nuanced: we don’t get a quadratic speed-up for all variants of the attacks. This allows us to demonstrate the following non-intuitive result: the best attack in the classical world does not necessarily lead to the best quantum one. We give some examples of application on ciphers LAC and KLEIN. We also discuss the important difference between an adversary that can only perform quantum computations, and an adversary that can also make quantum queries to a keyed primitive.

Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound

“…This is a strange tendency especially considering the fact that there are many attempts to speed up dedicated cryptanalysis against block ciphers e.g. differential and linear cryptanalysis [ 25 ], impossible differential cryptanalysis [ 44 ], meet-in-the-middle attacks [ 8 , 20 ], slide attacks [ 7 ], and so on. In this paper, we explore dedicated collision attacks against hash functions to find collisions faster than generic quantum attacks.…”

“…Thus, the trail cannot be used to find hash collisions if . On the other hand, in the quantum setting, Kaplan et al [ 25 ] showed that we can find a message pair that satisfies the differential in time around . Thus, if we have a differential trail with probability p , we can mount a collision attack in time around .…”

Quantum search for scaled hash function preimages

“…Generic quantum cryptanalysis has also been proposed in the last years focusing on different constructions [16,31,33]. Besides quantum acceleration on exhaustive search, new lines of research emerged, focusing on dedicated cryptanalysis of block ciphers [13], hash functions [25], and on the several attacks relying on Simon's algorithm ( [9][10][11][12]32,35,37]).…”

Provably Quantum-Secure Tweakable Block Ciphers

“…If the underlying BC is an n-bit BC with k-bit keys, then LRWQ becomes an n-bit TBC with 3k-bit keys and n-bit tweaks. We show that LRWQ is indistinguishable from tweakable random permutations up to O(2 n/6 ) quantum queries 5 in the setting that adversaries can query arbitrary superpositions of 1 The security model that adversaries with quantum computers have access to only classical keyed oracles is called Q1 model, and the model that they have access to quantum keyed oracles is called Q2 model [KLLN16b].…”

“…Post-quantum security attracts significant attention not only in the context of public key cryptography but also in the context of symmetric key cryptography, from the view point of both cryptanalysis [BN18, BNS19a, BNS19b, CNS17, GNS18, HSX17, KLLN16b,KLLN16a] and provable security for modes of operations [BZ13, CHS19, HI19, HY18, SY17, Zha19]. Recent results on symmetric key schemes show that some of the schemes that are proven to be secure in the classical setting are completely broken by adversaries with quantum computers in some specific situations [KM10, KM12,KLLN16a], which implies that simple remedies such as "doubling the length of secret keys" would not be sufficient to prepare for the threat of quantum computers, especially if it needs to be run on a quantum computer.…”