Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2012.08321 · Cybersecurity

Quantum key recovery attack on SIMON32/64

Hui Liu, Yang Li

Published Aug 1, 2021• 8 citations
arXivHTMLPDF

Abstract

Abstract The quantum security of lightweight block ciphers is receiving more and more attention. However, the existing quantum attacks on lightweight block ciphers only focused on the quantum exhaustive search, while the quantum attacks combined with classical cryptanalysis methods haven’t been well studied. In this paper, we study quantum key recovery attack on SIMON32/64 using Quantum Amplitude Amplification algorithm in Q1 model. At first, we reanalyze the quantum circuit complexity of quantum exhaustive search on SIMON32/64. We estimate the Clifford gates count more accurately and reduce the T gate count. Also, the T-depth and full depth is reduced due to our minor modifications. Then, using four differentials given by Biryukov in FSE 2014 as our distinguisher, we give our quantum key recovery attack on 19-round SIMON32/64. We treat the two phases of key recovery attack as two QAA instances separately, and the first QAA instance consists of four sub-QAA instances. Then, we design the quantum circuit of these two QAA instances and estimate their corresponding quantum circuit complexity. We conclude that the quantum circuit of our quantum key recovery attack is lower than quantum exhaustive search. Our work firstly studies the quantum dedicated attack on SIMON32/64. And this is the first work to study the complexity of quantum dedicated attacks from the perspective of quantum circuit complexity, which is a more fine-grained analysis of quantum dedicated attacks’ complexity.

DOI
10.1186/s42400-021-00089-3

Related papers

Quantum Differential‐Linear Key Recover Attack and its Application on Simon32/64 and Simeck32/64

C Z, Jie Guan, Tairong Shi +3 more

ABSTRACT Since the proposal of the Grover algorithm in 1996, which first combined quantum algorithms with symmetric cryptanalysis, significant progress has been made in the quantization of classical cryptanalysis methods. Differential‐linear cryptanalysis is a hybrid technique combining differential and linear cryptanalysis; however, there has been no prior work on its quantization. This paper presents a quantum differential‐linear key recovery attack framework. We apply this framework to Simon32/64 and Simeck32/64. Considering that the experimental correlation distribution of the differential‐linear distinguisher significantly affects the complexity of quantum attacks, we measure the experimental correlation distributions of Simon32/64 and Simeck32/64. We conduct a quantum differential‐linear key recovery attack on 19‐round Simon32/64. Under the Q1 model, the time complexity of the attack is , the data complexity is , the memory complexity is and the success rate is 60.96%, which achieves the lowest time, memory, and data complexities among all existing 19‐round quantum attacks. In the Q2 model, the time complexity reduces to , with negligible memory complexity. For Simeck32/64, we present a 20‐round quantum key recovery attack under the Q2 model, which is the first quantum key recovery attack on this block cipher.

Advanced Quantum Technologies•May 1, 2026•0 citations

Quantum Attack Implementation of TWINE Block Cipher

Zou Kun, Xinfeng Dong, Zhang Fuzhong +1 more

The result of resource consumption in quantum attack implementation of cryptographic algorithm is an important metric to evaluate the security strength of cryptographic algorithm against quantum attack. This paper studies complete implementation of quantum attack on cryptographic algorithm using Grover meets Simon method. We find 9-round quantum distinguisher whose round is the longest currently about TWINE, and utilize Grover meets Simon method to carry out 14/15-round quantum key recovery attack on TWINE-80/TWINE-128 with lower complexity than exhaust attack. Furthermore, we give complete implementation of quantum oracle and QAA algorithm in TWINE’s quantum key recovery attack for the first time. The circuit is suitable for all implementation of quantum key recovery attack on block cipher using Grover meets Simon method.

Asia Conference on Algorithms, Computing and Machine Learning (CACML)•Mar 28, 2025•0 citations

New results on the quantum security analysis of lightweight block cipher Simeck

Qihang Ding, Jiongjiong Ren, Shaozhen Chen

Abstract Simeck demonstrates reliable resistance against conventional cryptanalytic attacks and offers sound security properties, making it a noteworthy design in the field of lightweight cryptography. Nevertheless, ongoing progress in quantum computing poses a potential threat to the security of Simeck, underscoring the need for a rigorous analysis of its quantum resilience. In this paper, we analyze quantum distinguishers and key-recovery attacks on Simeck in the Q2 model. Leveraging the connection between truncated differentials and periodic functions, we revisit Simon-type qCPA distinguishers for Simeck-32/48/64 and further extend them to the qCCA setting. The qCPA distinguishers cover 8/9/11 rounds of Simeck-32/48/64, matching the round numbers reported by Lu et al. (2026), whereas our qCCA distinguishers cover 10/11/13 rounds. Based on these distinguishers, we investigate their application to Grover-meets-Simon key-recovery attacks on reduced-round Simeck. Furthermore, we mount qCPA key-recovery attacks on 11/12/14-round Simeck-32/48/64 and extend them to qCCA attacks on 13/14/16-round Simeck-32/48/64. Finally, we provide empirical estimates of the quantum resources required for the proposed key-recovery attacks. For Simeck-32/48/64, the empirical quantum query complexities are $$2^{28.09}/2^{40.32}/2^{52.59}$$ 2 28.09 / 2 40.32 / 2 52.59 in the qCPA setting and $$2^{26.81}/2^{39}/2^{51.17}$$ 2 26.81 / 2 39 / 2 51.17 in the qCCA setting, respectively, under the stated decision-test assumptions and empirical false-positive estimates.

Cybersecurity•Oct 16, 2026•0 citations

Quantum Cryptanalysis on Two Feistel-Type Constructions

Yan-Ying Zhu, Bin-Bin Cai, Fei Gao +1 more

With the rapid advancement of quantum computing, the security of traditional cryptographic systems is facing significant challenges. As a fundamental component of symmetric cryptography, block ciphers have attracted increasing attention regarding their quantum security in recent years. In this paper, we propose new quantum attacks on two Feistel-type constructions, i.e., New Structure IV and the lightweight block cipher LBlock, under the quantum chosen-plaintext attack (qCPA) model. First, we construct an 8-round quantum distinguisher for New Structure IV and perform an $r(r>12)$-round quantum key-recovery attack. Compared with Li et al.'s qCPA-based result presented at INSCRYPT 2024, our attack reduces the time complexity by a factor of $2^{n/2}$, where $n$ denotes the subkey length. Second, we design a 9-round quantum distinguisher for LBlock and extend it to an $r(r>15)$-round quantum key-recovery attack. The proposed quantum distinguisher covers one more round than Liu et al.'s automated-search distinguisher at ASIACRYPT 2025, which results in a $2^{16}$ reduction in the time complexity of our $r$-round quantum key-recovery attack on LBlock. Furthermore, by analyzing the structure of the round function and the key scheduling of LBlock, we reduce the subkey guess space for the 15-round attack from 76 bits to 52 bits, lowering the time complexity from \(O(2^{38})\) to \(O(2^{26})\) by a factor of \(2^{12}\).

quant-pharXiv:2610.27506•Oct 21, 2026•0 citations

Compact Quantum Circuit Design of PUFFIN and PRINT Lightweight Ciphers for Quantum Key Recovery Attack

P. Saravanan, J. Jenitha, S. Sanjana +1 more

Quantum computing plays a vital role in the next generation computing platforms as researchers have achieved quantum supremacy by proving that quantum computers can outperform classical computers. These high performance computers will pose a serious threat to the security of the conventional cryptographic algorithms. The secret key of the conventional cryptographic algorithms when implemented by quantum circuits can easily be recovered with the help of Grover key search algorithm. The Grover’s algorithm requires low cost quantum implementation of cryptographic algorithms in order to mount the quantum key recovery attack successfully. Hence the low cost quantum implementation of conventional cryptographic algorithms to mount quantum key recovery attack using Grover search algorithm is an active area of research. This work proposes a novel quantum circuit implementation of two lightweight block ciphers namely PUFFIN and PRINT and for the first time in literature In-place method is used to optimize the quantum resources in these two ciphers which helps to build compact quantum circuits without extra ancilla inputs. The performance metrics considered in this work to quantify the quantum resources of the proposed circuits are number of quantum gates, quantum cost, latency and number of qubits. In addition, the quantum resources are also estimated to mount the quantum key recovery attacks on the proposed quantum circuit implementations of PUFFIN and PRINT using Grover-based key search algorithm.

IEEE Access•Jan 1, 2023•9 citations

Quantum grover attack on MIBS

Hasan Özgür Çıldıroğlu, Harun Basmaci, Oğuz Yayla

Abstract The advent of quantum computing necessitates a rigorous reassessment of classical cryptographic primitives, particularly lightweight block ciphers (LBCs) deployed in resource-constrained environments. This work presents a comprehensive quantum implementation and security analysis of the Feistel-based LBC MIBS against quantum cryptanalysis. Using the inherent reversibility of its structure, we develop a novel ancilla-free quantum circuit that optimizes qubit count and depth. For MIBS-64 and MIBS-80, our implementation achieves quantum costs of 23,371 and 24,363, requiring 128 and 144 qubits, respectively, with a depth of 4,768. We subsequently quantify the cipher’s vulnerability to Grover’s key-search algorithm under the NIST PQC security constraint M A X D E P T H $\mathtt{M}\mathtt{A}\mathtt{X}\mathtt{D}\mathtt{E}\mathtt{P}\mathtt{T}\mathtt{H}$ . By constructing Grover oracles using inner parallelization with multiple plaintext-ciphertext pairs to suppress false positives, we demonstrate total quantum attack costs of approximately 2 94 for MIBS-64 and 2 111 for MIBS-80. These values fall below NIST’s Level-1 security threshold (2 170 ), confirming the susceptibility of both MIBS variants to quantum key-recovery attacks despite their classical lightweight efficiency.

Open Physics•Jan 1, 2026•0 citations
Abstract The quantum security of lightweight block ciphers is receiving more and more attention. However, the existing quantum attacks on lightweight block ciphers only focused on the quantum exhaustive search, while the quantum attacks combined with classical cryptanalysis methods haven’t been well studied. In this paper, we study quantum key recovery attack on SIMON32/64 using Quantum Amplitude Amplification algorithm in Q1 model. At first, we reanalyze the quantum circuit complexity of quantum exhaustive search on SIMON32/64. We estimate the Clifford gates count more accurately and reduce the T gate count. Also, the T-depth and full depth is reduced due to our minor modifications. Then, using four differentials given by Biryukov in FSE 2014 as our distinguisher, we give our quantum key recovery attack on 19-round SIMON32/64. We treat the two phases of key recovery attack as two QAA instances separately, and the first QAA instance consists of four sub-QAA instances. Then, we design the quantum circuit of these two QAA instances and estimate their corresponding quantum circuit complexity. We conclude that the quantum circuit of our quantum key recovery attack is lower than quantum exhaustive search. Our work firstly studies the quantum dedicated attack on SIMON32/64. And this is the first work to study the complexity of quantum dedicated attacks from the perspective of quantum circuit complexity, which is a more fine-grained analysis of quantum dedicated attacks’ complexity.
ABSTRACT Since the proposal of the Grover algorithm in 1996, which first combined quantum algorithms with symmetric cryptanalysis, significant progress has been made in the quantization of classical cryptanalysis methods. Differential‐linear cryptanalysis is a hybrid technique combining differential and linear cryptanalysis; however, there has been no prior work on its quantization. This paper presents a quantum differential‐linear key recovery attack framework. We apply this framework to Simon32/64 and Simeck32/64. Considering that the experimental correlation distribution of the differential‐linear distinguisher significantly affects the complexity of quantum attacks, we measure the experimental correlation distributions of Simon32/64 and Simeck32/64. We conduct a quantum differential‐linear key recovery attack on 19‐round Simon32/64. Under the Q1 model, the time complexity of the attack is , the data complexity is , the memory complexity is and the success rate is 60.96%, which achieves the lowest time, memory, and data complexities among all existing 19‐round quantum attacks. In the Q2 model, the time complexity reduces to , with negligible memory complexity. For Simeck32/64, we present a 20‐round quantum key recovery attack under the Q2 model, which is the first quantum key recovery attack on this block cipher.
The result of resource consumption in quantum attack implementation of cryptographic algorithm is an important metric to evaluate the security strength of cryptographic algorithm against quantum attack. This paper studies complete implementation of quantum attack on cryptographic algorithm using Grover meets Simon method. We find 9-round quantum distinguisher whose round is the longest currently about TWINE, and utilize Grover meets Simon method to carry out 14/15-round quantum key recovery attack on TWINE-80/TWINE-128 with lower complexity than exhaust attack. Furthermore, we give complete implementation of quantum oracle and QAA algorithm in TWINE’s quantum key recovery attack for the first time. The circuit is suitable for all implementation of quantum key recovery attack on block cipher using Grover meets Simon method.
Abstract Simeck demonstrates reliable resistance against conventional cryptanalytic attacks and offers sound security properties, making it a noteworthy design in the field of lightweight cryptography. Nevertheless, ongoing progress in quantum computing poses a potential threat to the security of Simeck, underscoring the need for a rigorous analysis of its quantum resilience. In this paper, we analyze quantum distinguishers and key-recovery attacks on Simeck in the Q2 model. Leveraging the connection between truncated differentials and periodic functions, we revisit Simon-type qCPA distinguishers for Simeck-32/48/64 and further extend them to the qCCA setting. The qCPA distinguishers cover 8/9/11 rounds of Simeck-32/48/64, matching the round numbers reported by Lu et al. (2026), whereas our qCCA distinguishers cover 10/11/13 rounds. Based on these distinguishers, we investigate their application to Grover-meets-Simon key-recovery attacks on reduced-round Simeck. Furthermore, we mount qCPA key-recovery attacks on 11/12/14-round Simeck-32/48/64 and extend them to qCCA attacks on 13/14/16-round Simeck-32/48/64. Finally, we provide empirical estimates of the quantum resources required for the proposed key-recovery attacks. For Simeck-32/48/64, the empirical quantum query complexities are 228.09/240.32/252.592^{28.09}/2^{40.32}/2^{52.59}228.09/240.32/252.59 2 28.09 / 2 40.32 / 2 52.59 in the qCPA setting and 226.81/239/251.172^{26.81}/2^{39}/2^{51.17}226.81/239/251.17 2 26.81 / 2 39 / 2 51.17 in the qCCA setting, respectively, under the stated decision-test assumptions and empirical false-positive estimates.
With the rapid advancement of quantum computing, the security of traditional cryptographic systems is facing significant challenges. As a fundamental component of symmetric cryptography, block ciphers have attracted increasing attention regarding their quantum security in recent years. In this paper, we propose new quantum attacks on two Feistel-type constructions, i.e., New Structure IV and the lightweight block cipher LBlock, under the quantum chosen-plaintext attack (qCPA) model. First, we construct an 8-round quantum distinguisher for New Structure IV and perform an r(r>12)r(r>12)r(r>12)-round quantum key-recovery attack. Compared with Li et al.'s qCPA-based result presented at INSCRYPT 2024, our attack reduces the time complexity by a factor of 2n/22^{n/2}2n/2, where nnn denotes the subkey length. Second, we design a 9-round quantum distinguisher for LBlock and extend it to an r(r>15)r(r>15)r(r>15)-round quantum key-recovery attack. The proposed quantum distinguisher covers one more round than Liu et al.'s automated-search distinguisher at ASIACRYPT 2025, which results in a 2162^{16}216 reduction in the time complexity of our rrr-round quantum key-recovery attack on LBlock. Furthermore, by analyzing the structure of the round function and the key scheduling of LBlock, we reduce the subkey guess space for the 15-round attack from 76 bits to 52 bits, lowering the time complexity from O(238)O(2^{38})O(238) to O(226)O(2^{26})O(226) by a factor of 2122^{12}212.
Quantum computing plays a vital role in the next generation computing platforms as researchers have achieved quantum supremacy by proving that quantum computers can outperform classical computers. These high performance computers will pose a serious threat to the security of the conventional cryptographic algorithms. The secret key of the conventional cryptographic algorithms when implemented by quantum circuits can easily be recovered with the help of Grover key search algorithm. The Grover’s algorithm requires low cost quantum implementation of cryptographic algorithms in order to mount the quantum key recovery attack successfully. Hence the low cost quantum implementation of conventional cryptographic algorithms to mount quantum key recovery attack using Grover search algorithm is an active area of research. This work proposes a novel quantum circuit implementation of two lightweight block ciphers namely PUFFIN and PRINT and for the first time in literature In-place method is used to optimize the quantum resources in these two ciphers which helps to build compact quantum circuits without extra ancilla inputs. The performance metrics considered in this work to quantify the quantum resources of the proposed circuits are number of quantum gates, quantum cost, latency and number of qubits. In addition, the quantum resources are also estimated to mount the quantum key recovery attacks on the proposed quantum circuit implementations of PUFFIN and PRINT using Grover-based key search algorithm.
Abstract The advent of quantum computing necessitates a rigorous reassessment of classical cryptographic primitives, particularly lightweight block ciphers (LBCs) deployed in resource-constrained environments. This work presents a comprehensive quantum implementation and security analysis of the Feistel-based LBC MIBS against quantum cryptanalysis. Using the inherent reversibility of its structure, we develop a novel ancilla-free quantum circuit that optimizes qubit count and depth. For MIBS-64 and MIBS-80, our implementation achieves quantum costs of 23,371 and 24,363, requiring 128 and 144 qubits, respectively, with a depth of 4,768. We subsequently quantify the cipher’s vulnerability to Grover’s key-search algorithm under the NIST PQC security constraint M A X D E P T H MAXDEPTH\mathtt{M}\mathtt{A}\mathtt{X}\mathtt{D}\mathtt{E}\mathtt{P}\mathtt{T}\mathtt{H}MAXDEPTH . By constructing Grover oracles using inner parallelization with multiple plaintext-ciphertext pairs to suppress false positives, we demonstrate total quantum attack costs of approximately 2 94 for MIBS-64 and 2 111 for MIBS-80. These values fall below NIST’s Level-1 security threshold (2 170 ), confirming the susceptibility of both MIBS variants to quantum key-recovery attacks despite their classical lightweight efficiency.