Grover search provides the generic quantum baseline for symmetric-key recovery by amplifying a reversible public-verification oracle. We investigate whether public round structure can instead shape a variational key register before exact verification. For simplified AES (S-AES), we construct phase separators from S-box differential-distribution constraints, candidate-key-dependent inverse diagnostics, and a global residual Hamming-shell term. Each component has a reversible compute-phase-uncompute realization. We prove a one-sided completeness statement for these diagnostics and derive a conditional lower-tail bound for false keys under a weakly correlated diagnostic model. On ten random three-pair 16-bit S-AES instances, an 18-layer schedule optimized with Adam achieves a mean public-consistent-key probability of 46.78 percent, ranks the correct key first in every run, and limits the largest observed false-key probability to 1.11 percent. The 16-bit study evaluates the induced key-register dynamics without shot sampling, while a separate gate-level S-DES experiment validates the reversible oracle pattern without a key-space phase table. The results establish a controlled reduced-cipher benchmark; they do not claim an attack on full AES or an asymptotic advantage over Grover. Within these limits, the construction provides a useful framework for analyzing how AES structure can be incorporated into quantum algorithms.
AI Summary
Can public cipher structure concentrate a variational key register before exact verification, rather than relying solely on Grover search? This paper studies that question for 16-bit simplified AES (S-AES), using QAOA-style compute–phase–uncompute layers built from S-box differential-distribution constraints, candidate-key-dependent inverse-round residuals, and a global residual Hamming-shell term. Success is the measured probability $p_{\mathrm{Good}}$ of keys satisfying all public plaintext–ciphertext pairs, not ciphertext-state overlap.
An 18-layer schedule trained with Adam is evaluated by exact, shot-free simulation of the induced key-register dynamics. Across ten random-key instances with three public pairs, mean $p_{\mathrm{Good}}$ is $46.78\%$, with a minimum of $27.53\%$. The correct key has the largest probability in every instance; the largest false-key probability observed is $1.11\%$. A matched two-pair experiment gives mean success $20.83\%$. Separate gate-level S-DES checks validate the reversible oracle pattern without a key-space phase table.
The analysis establishes one-sided diagnostic completeness and, under a weakly correlated false-key diagnostic model, bounds the expected false-key count below a threshold by $(2^n-|\mathrm{Good}|)e^{-LI(\tau)}$. These conditional landscape bounds do not establish finite-depth QAOA performance. The S-AES simulations store exact key-register phase arrays and do not simulate the full reversible workspace or measurement-based training. The stated scope is a reduced-cipher benchmark and resource model: no attack on full AES or asymptotic advantage over Grover is claimed, and larger gate-level, shot-based experiments remain future work.
Little sign of AI-generated textIncrementalSmall numerics onlyMissing comparisonStrong assumptions
Error found: The justification given for Eq. (hamming-tail) is insufficient: approximately unbiased residual-bit marginals alone do not yield its exponential bound without additional quantitative control of their joint distribution.
Written by gpt-6.1-sol from the paper's full text. Automated: it can be wrong.
Grover search provides the generic quantum baseline for symmetric-key recovery by amplifying a reversible public-verification oracle. We investigate whether public round structure can instead shape a variational key register before exact verification. For simplified AES (S-AES), we construct phase separators from S-box differential-distribution constraints, candidate-key-dependent inverse diagnostics, and a global residual Hamming-shell term. Each component has a reversible compute-phase-uncompute realization. We prove a one-sided completeness statement for these diagnostics and derive a conditional lower-tail bound for false keys under a weakly correlated diagnostic model. On ten random three-pair 16-bit S-AES instances, an 18-layer schedule optimized with Adam achieves a mean public-consistent-key probability of 46.78 percent, ranks the correct key first in every run, and limits the largest observed false-key probability to 1.11 percent. The 16-bit study evaluates the induced key-register dynamics without shot sampling, while a separate gate-level S-DES experiment validates the reversible oracle pattern without a key-space phase table. The results establish a controlled reduced-cipher benchmark; they do not claim an attack on full AES or an asymptotic advantage over Grover. Within these limits, the construction provides a useful framework for analyzing how AES structure can be incorporated into quantum algorithms.
Can public cipher structure concentrate a variational key register before exact verification, rather than relying solely on Grover search? This paper studies that question for 16-bit simplified AES (S-AES), using QAOA-style compute–phase–uncompute layers built from S-box differential-distribution constraints, candidate-key-dependent inverse-round residuals, and a global residual Hamming-shell term. Success is the measured probability pGood of keys satisfying all public plaintext–ciphertext pairs, not ciphertext-state overlap.
An 18-layer schedule trained with Adam is evaluated by exact, shot-free simulation of the induced key-register dynamics. Across ten random-key instances with three public pairs, mean pGood is 46.78%, with a minimum of 27.53%. The correct key has the largest probability in every instance; the largest false-key probability observed is 1.11%. A matched two-pair experiment gives mean success 20.83%. Separate gate-level S-DES checks validate the reversible oracle pattern without a key-space phase table.
The analysis establishes one-sided diagnostic completeness and, under a weakly correlated false-key diagnostic model, bounds the expected false-key count below a threshold by (2n−∣Good∣)e−LI(τ). These conditional landscape bounds do not establish finite-depth QAOA performance. The S-AES simulations store exact key-register phase arrays and do not simulate the full reversible workspace or measurement-based training. The stated scope is a reduced-cipher benchmark and resource model: no attack on full AES or asymptotic advantage over Grover is claimed, and larger gate-level, shot-based experiments remain future work.
We introduce a cipher-structure-aware variational framework for key recovery from public data in reduced block ciphers. Public S-box differential constraints and candidate-key-dependent inverse-round residuals are converted into phase separators through reversible compute-phase-uncompute circuits. The principal separator is a hybrid DDT construction that combines pairwise and synchronized multi-pair differential constraints before residual refinement. The construction is specified by public functions and does not require a key-indexed phase table in the physical circuit. We formalize the public-instance model, prove one-sided completeness of the structural diagnostics, and derive a conditional lower-tail bound for false-key diagnostic gaps under an explicitly stated sub-Gaussian moment condition. This statistical statement concerns the diagnostic landscape, not convergence of a finite-depth QAOA optimizer. On ten independent random three-pair instances of 16-bit simplified AES, an 18-layer Hybrid-DDT schedule reaches a mean public-consistent-key probability of 0.529785, with values from 0.388892 to 0.770937, ranks the correct key first in every run, and has largest observed false-key probability 0.008723. The result is a reduced-cipher mechanism study, not an attack on full AES.
Key recovery attack on SPN ciphers such as AES is NP hard in complexity. Previous studies have estimated the quantum resources required for implementing Grover’s key search for AES, but these are largely theoretical in nature. The key challenges to implement Grover’s algorithm on current quantum hardware include the number of available qubits, noise, and decoherence. However, the rapid advancement of hardware has brought us closer to practical realization for the cryptanalysis of light-weight SPN ciphers. This study presents an efficient quantum circuit implementation of Mini-AES, a 16-bit variant of AES, employing standard CNOT and Toffoli gates. To the best of our knowledge, our work provides the first complete quantum implementations of all core Mini-AES components for the quantum oracle. The effects of noise are emulated for each module of the quantum oracle and quantified. Furthermore, Grover’s algorithm is applied to Mini-AES to perform successful key recovery through a known-plaintext attack, demonstrating significant amplitude amplification while using near-optimal Grover’s iterations, thereby reducing the total quantum volume. The optimal Grover’s iterations have been obtained empirically as well as validated with finite-shot analysis. Notably, the application of Grover’s algorithm reveals key clustering behavior in Mini-AES, which has been corroborated through classical simulation.
Advanced Encryption Standard is one of the most widely used and important symmetric ciphers for today. It well known, that it can be subjected to the quantum Grover's attack that twice reduces its key strength. But full AES attack requires hundreds of qubits and circuit depth of thousands, that makes impossible not only experimental research but also numerical simulations of this algorithm. Here we present an algorithm for optimized Grover's attack on downscaled Simplifed-AES cipher. Besides full attack we present several approaches that allows to reduce number of required qubits if some nibbles of the key are known as a result of side-channel attack. For 16-bit S-AES the proposed attack requires 23 qubits in general case and 19, 15 or 11 if 4, 8 or 12 bits were leaked in specifc confguration. Comparing to previously known 32-qubits algorithm this approach potentially allows to run the attack on today's NISQ-devices and perform numerical simulations with GPU, that may be useful for further research of problem-specifc error mitigation and error correction techniques.
Seed-based key generation is widely used in post-quantum cryptography because it provides compact secret-key representations and deterministic regeneration of cryptographic material. The same design, however, concentrates security on a short secret state: partial or noisy leakage about the seed may sharply reduce the space of plausible secrets. Existing posterior-guided recovery methods exploit such leakage by ranking candidate seeds according to posterior scores and then validating them against the target public key. This work studies how posterior-guided seed recovery changes in the presence of a quantum adversary. Building on the recently introduced Bitwise Bayesian Leakage Model (BBLM) and Seed Recovery Framework (SRF), we keep the leakage-processing stages classical, including posterior inference, candidate generation, ranking, score-band construction, and success-probability estimation. The quantum component is introduced only at the validation stage, where sequential public-key checks over an SRF-selected candidate set are replaced by Grover-assisted search. Instead of applying Grover search to the full seed space {0,1}λ , we apply it to the index set of the candidate band selected by SRF. For each index $\iota $ , the oracle coherently reconstructs the associated seed candidate $\textsf {seed}_{\iota } $ from the SRF preprocessing structures and evaluates a reversible public-key validation predicate on $\textsf {seed}_{\iota } $ . This yields a band-index oracle whose cost accounts for reversible index-to-seed reconstruction, read-only coherent access to the SRF data structures, seed expansion, scheme-specific public-key validation, comparison with the target public key, conditional phase marking, and uncomputation of all auxiliary workspace. As a concrete case study, we instantiate the seed-level validation component for the RYDE post-quantum signature scheme and develop a logical-oracle-level cost model that separates generic band-index and Grover costs from RYDE-specific validation costs. The analysis includes an explicit access model for the SRF data structures, a full logical-oracle-level cost decomposition, and leakage-driven experiments reporting a representative selected score band, candidate-set size, empirical inclusion probability, oracle cost, Grover iterations, final-check cost, expected validation-stage cost, the corresponding full recovery-cost expression, and calibration trends across leakage parameters. We also compare classical SRF validation, restricted Grover-assisted SRF, and full-space Grover search. The results characterize how posterior-guided candidate restriction and Grover-assisted validation interact under probabilistic leakage at the logical-oracle level, rather than claiming a hardware-level attack estimate.
The Advanced Encryption Standard (AES) is one of the most widely used symmetric block cipher cryptography algorithms. Simplified-AES (S-AES) retains the structural framework of AES, making it an ideal model for elucidating the mechanism of symmetric cryptography. In this paper, we investigate potential quantum attacks on S-AES, utilizing both Grover-based algorithms and variational quantum algorithms (VQAs). For Grover-based attacks, we introduce an optimized oracle for implementing S-AES, reducing the complexity from 160 Toffoli gates to 120 by refining the SubNibble operation. Additionally, we propose a general Variational Quantum Attack Algorithm (VQAA) for any type of symmetric encryption that does not require the quantum implementation of the encryption procedure, which reduces the gate complexity substantially. These improvements enable the implementation of both Grover-based attacks and VQAA on superconducting quantum computers. The results demonstrate the feasibility of cryptographic analysis on currently available quantum hardware. Our findings also underscore the challenges of parameter optimization for S-AES, attributing the difficulty to the design of efficient parameterized quantum circuits, which constrain the effectiveness of variational algorithms. Despite these advancements, significant challenges remain in achieving quantum attacks on AES.
Side-channel attacks on block ciphers rarely recover the key outright: they leave a residual key space ordered by subkey posteriors, and evaluation laboratories report the key rank of the true key against thresholds near 2^48 and 2^60. No evaluation framework models an adversary who collects traces classically and finishes the search on a quantum computer, although quantum search with advice provides exactly that. We give such an adversary a cost model and a metric. For a device whose key has rank r, any quantum algorithm with classical access to the posteriors needs Omega(sqrt(r)) cipher evaluations, and block search achieves O(sqrt(r)); the per-instance advantage is exactly quadratic, and the super-quadratic exponents reported for search with advice are averages over the prior that apply to no single device. Under the NIST MAXDEPTH budget D and a Grover iteration of g gates and depth d, the quadratic advantage holds only for ranks up to (4D/(pi d))^2 and collapses to a constant factor beyond; with the best published AES-128 oracle and D = 2^40 the window closes near rank 2^58.6. We define the quantum-aware key rank, the classical rank of equal cost, computable from the rank estimators laboratories already run, and derive the classical rank a device must retain to keep a given threshold against each depth budget. Block search and amplitude amplification from the product-form posterior state are within a factor of two to four of each other on Hamming-weight posteriors, so the cost of coherent indexing decides between them. Experiments on simulated leakage and a toy cipher confirm the predicted window: at SNR 0.125 a depth-limited quantum adversary is worth about 22 traces to a classical one, however large its gate budget.