Abstract We present a novel quantum implementation of SLIM, a lightweight 32/80-bit Feistel cipher. By inverting its Key addition-Substitution-Permutation (KSP) layers without ancillary qubits, we construct the full quantum circuit using 112 qubits with quantum cost 30,404 and depth 4,066. To assess quantum resilience, we implement Grover’s algorithm with three plaintext-ciphertext pairs (r = 3; 337 qubits), yielding an attack cost of 2 111 under NIST’s MAXDEPTH constraints—below the Level-1 threshold 2 170 . While SLIM falls short of NIST’s security threshold for near-term quantum attacks, among other lightweight BCs, its efficient architecture retains practical advantages for constrained applications.
The emergence of quantum computing demands rigorous reassessment of classical cryptographic primitives, particularly lightweight block ciphers (LBCs). This work addresses this critical need by presenting the first comprehensive quantum implementation and security analysis of the Feistel-based LBCs SLIM and MIBS against quantum cryptanalysis. Leveraging the inherent reversibility of the ciphers, we develop novel ancilla-free quantum circuits optimizing qubit utilization and depth. For SLIM-80, our design achieves 30,404 quantum cost with 112 qubits and depth of 4,066. For MIBS-64 and MIBS-80, we implement circuits with 23,371 and 24,363 quantum costs requiring 128 and 144 qubits, respectively, and a uniform depth of 4,768. We then quantify vulnerability to Grover’s key-search under the NIST PQC security constraint MAXDEPTH. By constructing Grover oracles under inner parallelization with multiple plaintext-ciphertext pairs to suppress false positives, we demonstrate total attack costs of 2^111 for SLIM-80 and MIBS-80, and 2^94 for MIBS-64. These costs fall below NIST’s Level-1 security threshold 2^170, confirming both ciphers’ susceptibility to quantum threats despite their lightweight efficiency. Our methodology establishes a quantum implementation framework for Feistel ciphers, revealing critical trade-offs among qubit efficiency, depth, and quantum resilience.
With the rapid advancement of quantum computing, the security of traditional cryptographic systems is facing significant challenges. As a fundamental component of symmetric cryptography, block ciphers have attracted increasing attention regarding their quantum security in recent years.
In this paper, we propose new quantum attacks on two Feistel-type constructions, i.e., New Structure IV and the lightweight block cipher LBlock, under the quantum chosen-plaintext attack (qCPA) model. First, we construct an 8-round quantum distinguisher for New Structure IV and perform an
r(r>12)-round quantum key-recovery attack. Compared with Li et al.'s qCPA-based result presented at INSCRYPT 2024, our attack reduces the time complexity by a factor of
2n/2, where
n denotes the subkey length. Second, we design a 9-round quantum distinguisher for LBlock and extend it to an
r(r>15)-round quantum key-recovery attack. The proposed quantum distinguisher covers one more round than Liu et al.'s automated-search distinguisher at ASIACRYPT 2025, which results in a
216 reduction in the time complexity of our
r-round quantum key-recovery attack on LBlock. Furthermore, by analyzing the structure of the round function and the key scheduling of LBlock, we reduce the subkey guess space for the 15-round attack from 76 bits to 52 bits, lowering the time complexity from
O(238) to
O(226) by a factor of
212.
Abstract The advent of quantum computing necessitates a rigorous reassessment of classical cryptographic primitives, particularly lightweight block ciphers (LBCs) deployed in resource-constrained environments. This work presents a comprehensive quantum implementation and security analysis of the Feistel-based LBC MIBS against quantum cryptanalysis. Using the inherent reversibility of its structure, we develop a novel ancilla-free quantum circuit that optimizes qubit count and depth. For MIBS-64 and MIBS-80, our implementation achieves quantum costs of 23,371 and 24,363, requiring 128 and 144 qubits, respectively, with a depth of 4,768. We subsequently quantify the cipher’s vulnerability to Grover’s key-search algorithm under the NIST PQC security constraint M A X D E P T H
MAXDEPTH . By constructing Grover oracles using inner parallelization with multiple plaintext-ciphertext pairs to suppress false positives, we demonstrate total quantum attack costs of approximately 2 94 for MIBS-64 and 2 111 for MIBS-80. These values fall below NIST’s Level-1 security threshold (2 170 ), confirming the susceptibility of both MIBS variants to quantum key-recovery attacks despite their classical lightweight efficiency.
The development of post-quantum cryptography requires cryptographic primitives that remain secure against quantum adversaries. Quantum key-recovery attacks constitute a fundamental class of quantum cryptanalytic techniques, and the resistance of a cryptosystem to such attacks serves as an important indicator of its overall security. Since the Feistel structure is a core component in the design of many block ciphers, efficient quantum key-recovery attacks on Feistel ciphers provide valuable insights into evaluating and strengthening their security. In this paper, we propose an efficient generic quantum key-recovery attack on Feistel ciphers. Our attack integrates universal hash families with Simon's and Grover's algorithms to perform key-recovery. We rigorously analyze the correctness of the proposed attack and derive its time and quantum resource complexities. A comprehensive comparison with existing keyrecovery attacks shows that the proposed approach improves both quantum resource usage and dominant query complexity, and therefore yields a more efficient quantum key-recovery attack. Our work enhances the understanding of Feistel ciphers under quantum threats and informs the design of robust cryptosystems for the post-quantum era.
As quantum computing emerges, the security domain is set to encounter unparalleled challenges, necessitating a pivotal shift to Post-Quantum Cryptography (PQC) for safeguarding against quantum adversities. Current cryptographic mechanisms, especially RSA and ECC, are susceptible to quantum breaches due to their reliance on factorization and discrete logarithm problems. The emergence of quantum computers endangers traditional cryptographic infrastructures, exposing them to swift decryption by algorithms like Shor’s,
N=p⋅q, and Grover’s,
r≡a2NmodN, where N is the product of two significant primes, p and q, and r denotes the remainder after applying Grover’s algorithm to a. Conventional cryptographic methods, which rest on problems solvable by quantum computers, emphasize the need to transition to PQC, substituting prevalent methods with quantum-resilient alternatives, represented by
E=memodn, where E is the encrypted message, m the plaintext, e the public key exponent, and n the product of two prime numbers. This research evaluates the efficacy of PQC approaches, encompassing lattice-based, code-based, and isogeny-based cryptography, with assessments based on metrics like encryption duration,
Te=fe1, and key length,
log2(N), where
Te represents encryption time and
fe the encryption speed. Employing standardized datasets, we examine encryption and decryption speeds, key sizes, and success metrics against NIST’s endorsed security standards. The findings underscore PQC’s potential in delivering robust security, albeit with variations in performance metrics, guiding secure communication choices. In summation, the study highlights the essential shift to PQC in addressing the vulnerabilities ushered in by quantum computing, presenting a spectrum of fortified strategies for the future of information security.