Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2510.14475 · Science China Information Sciences

Offline dedicated quantum attacks on block cipher constructions based on two parallel permutation-based pseudorandom functions

Xiao-Fan Zhen, Zhenqiang Li, Jia-Cheng Fan, Su-Juan Qin, Fei Gao

Published Jul 16, 2026• 0 citations
arXivHTMLPDF
DOI
10.1007/s11432-026-5030-8

Related papers

The Offline Quantum Attack Against Modular Addition Variant of Even-Mansour Cipher

Fangzhou Liu, Xueqi Zhu, Ruozhou Xu +2 more

Lecture notes in computer science•Jan 1, 2024•0 citations

Resource-efficient Grover-meets-BV Q1 attacks on permutation-based pseudorandom functions

Jia-Wen Zhou, Bao-Min Zhou, Long Zhang +1 more

Quantum Information Processing•Jul 2, 2026•0 citations

Breaking permutation-based pseudorandom cryptographic schemes using distributed exact quantum algorithms

Ping Zhang, Yiyuan Luo

Quantum Information Processing•Jun 14, 2024•2 citations

On The Simplest Quantum-Secure Block Cipher

Gorjan Alagic, Joseph Carolan, Christian Majenz +1 more

Pseudorandom permutations are ubiquitous in theoretical and applied cryptography. PRPs that offer security even against adversaries making quantum queries are of increasing interest, and used in applications ranging from constructing pseudorandom unitaries to separating SZK from BQP. A successful framework for constructing classically-secure PRPs is the key-alternating Even-Mansour approach, which interleaves applications of public permutations with additions of round keys. The single-round construction is already classically secure in the ideal permutation model (IPM), with added rounds offering improved concrete security. However, in the quantum-query setting, the status of this framework is presently unclear. A simple quantum-query attack based on Simon's algorithm breaks the one-round cipher. For two or more rounds, security is only known against non-adaptive adversaries who must prepare all queries in advance. In this work, we show that the two-round Even-Mansour cipher is information theoretically secure in the IPM against adversaries making polynomially-many adaptive forward and inverse quantum queries to all available oracles. Our proof uses compressed permutation oracles and a specially crafted isometry relating the ideal and real experiments. We also show that this construction is minimal, in the sense that essentially any cipher constructed via a single call to a public permutation is quantumly insecure.

quant-pharXiv:2609.40350•Oct 1, 2026•0 citations

Superposition Attacks on Pseudorandom Schemes Based on Two or Less Permutations

Shaoxuan Zhang, Chun Fen Guo, Qingju Wang

We study quantum superposition attacks against permutation‐based pseudorandom cryptographic schemes. We first extend Kuwakado and Morii’s attack against the Even–Mansour cipher and exhibit key recovery attacks against a large class of pseudorandom schemes based on a single call to an n ‐bit permutation, with polynomial O ( n ) (or O ( n 2 ), if the concrete cost of Hadamard transform is also taken in) quantum steps. We then consider schemes, namely, two permutation‐based pseudorandom cryptographic schemes. Using the improved Grover‐meet‐Simon method, we show that the keys of a wide class of schemes can be recovered with O ( n ) superposition queries (the complexity of the original is O ( n 2 n /2 )) and O ( n 2 n /2 ) quantum steps. We also exhibit subclasses of “degenerated” schemes that lack certain internal operations and exhibit more efficient key recovery attacks using either the Simon’s algorithm or collision searching algorithm. Further, using the all‐subkeys‐recovery idea of Isobe and Shibutani, our results give rise to key recovery attacks against several recently proposed permutation‐based PRFs, as well as the two‐round Even–Mansour ciphers with generic key schedule functions and their tweakable variants. From a constructive perspective, our results establish new quantum Q2 security upper bounds for two permutation‐based pseudorandom schemes as well as sound design choices.

IET Information Security•Jan 1, 2024•3 citations

Poster: An Improved Quantum Attack on the Two-round Even-Mansour Cipher with Independent Permutations and Keys

Rentaro Shiba, Tetsu Iwata

In this study, we propose a quantum attack on the two-round iterated Even-Mansour cipher, which consists of two independent permutations and three independent subkeys. Our attack is in the Q1 model, where an adversary makes classical online queries and quantum offline queries. The complexity of our attack is O(2n/2), where n is the block size, while the best known attack for this variant is O(23n/5). Thus, our method significantly improves the computational complexity compared to existing quantum attacks.

ACM SIGSAC Conference on Computer and Communications Security (CCS)•Nov 19, 2025•0 citations
Pseudorandom permutations are ubiquitous in theoretical and applied cryptography. PRPs that offer security even against adversaries making quantum queries are of increasing interest, and used in applications ranging from constructing pseudorandom unitaries to separating SZK from BQP. A successful framework for constructing classically-secure PRPs is the key-alternating Even-Mansour approach, which interleaves applications of public permutations with additions of round keys. The single-round construction is already classically secure in the ideal permutation model (IPM), with added rounds offering improved concrete security. However, in the quantum-query setting, the status of this framework is presently unclear. A simple quantum-query attack based on Simon's algorithm breaks the one-round cipher. For two or more rounds, security is only known against non-adaptive adversaries who must prepare all queries in advance. In this work, we show that the two-round Even-Mansour cipher is information theoretically secure in the IPM against adversaries making polynomially-many adaptive forward and inverse quantum queries to all available oracles. Our proof uses compressed permutation oracles and a specially crafted isometry relating the ideal and real experiments. We also show that this construction is minimal, in the sense that essentially any cipher constructed via a single call to a public permutation is quantumly insecure.
We study quantum superposition attacks against permutation‐based pseudorandom cryptographic schemes. We first extend Kuwakado and Morii’s attack against the Even–Mansour cipher and exhibit key recovery attacks against a large class of pseudorandom schemes based on a single call to an n ‐bit permutation, with polynomial O ( n ) (or O ( n 2 ), if the concrete cost of Hadamard transform is also taken in) quantum steps. We then consider schemes, namely, two permutation‐based pseudorandom cryptographic schemes. Using the improved Grover‐meet‐Simon method, we show that the keys of a wide class of schemes can be recovered with O ( n ) superposition queries (the complexity of the original is O ( n 2 n /2 )) and O ( n 2 n /2 ) quantum steps. We also exhibit subclasses of “degenerated” schemes that lack certain internal operations and exhibit more efficient key recovery attacks using either the Simon’s algorithm or collision searching algorithm. Further, using the all‐subkeys‐recovery idea of Isobe and Shibutani, our results give rise to key recovery attacks against several recently proposed permutation‐based PRFs, as well as the two‐round Even–Mansour ciphers with generic key schedule functions and their tweakable variants. From a constructive perspective, our results establish new quantum Q2 security upper bounds for two permutation‐based pseudorandom schemes as well as sound design choices.
In this study, we propose a quantum attack on the two-round iterated Even-Mansour cipher, which consists of two independent permutations and three independent subkeys. Our attack is in the Q1 model, where an adversary makes classical online queries and quantum offline queries. The complexity of our attack is O(2n/2), where n is the block size, while the best known attack for this variant is O(23n/5). Thus, our method significantly improves the computational complexity compared to existing quantum attacks.