We introduce a cipher-structure-aware variational framework for key recovery from public data in reduced block ciphers. Public S-box differential constraints and candidate-key-dependent inverse-round residuals are converted into phase separators through reversible compute-phase-uncompute circuits. The principal separator is a hybrid DDT construction that combines pairwise and synchronized multi-pair differential constraints before residual refinement. The construction is specified by public functions and does not require a key-indexed phase table in the physical circuit. We formalize the public-instance model, prove one-sided completeness of the structural diagnostics, and derive a conditional lower-tail bound for false-key diagnostic gaps under an explicitly stated sub-Gaussian moment condition. This statistical statement concerns the diagnostic landscape, not convergence of a finite-depth QAOA optimizer. On ten independent random three-pair instances of 16-bit simplified AES, an 18-layer Hybrid-DDT schedule reaches a mean public-consistent-key probability of 0.529785, with values from 0.388892 to 0.770937, ranks the correct key first in every run, and has largest observed false-key probability 0.008723. The result is a reduced-cipher mechanism study, not an attack on full AES.
We introduce a cipher-structure-aware variational framework for key recovery from public data in reduced block ciphers. Public S-box differential constraints and candidate-key-dependent inverse-round residuals are converted into phase separators through reversible compute-phase-uncompute circuits. The principal separator is a hybrid DDT construction that combines pairwise and synchronized multi-pair differential constraints before residual refinement. The construction is specified by public functions and does not require a key-indexed phase table in the physical circuit. We formalize the public-instance model, prove one-sided completeness of the structural diagnostics, and derive a conditional lower-tail bound for false-key diagnostic gaps under an explicitly stated sub-Gaussian moment condition. This statistical statement concerns the diagnostic landscape, not convergence of a finite-depth QAOA optimizer. On ten independent random three-pair instances of 16-bit simplified AES, an 18-layer Hybrid-DDT schedule reaches a mean public-consistent-key probability of 0.529785, with values from 0.388892 to 0.770937, ranks the correct key first in every run, and has largest observed false-key probability 0.008723. The result is a reduced-cipher mechanism study, not an attack on full AES.
Grover search provides the generic quantum baseline for symmetric-key recovery by amplifying a reversible public-verification oracle. We investigate whether public round structure can instead shape a variational key register before exact verification. For simplified AES (S-AES), we construct phase separators from S-box differential-distribution constraints, candidate-key-dependent inverse diagnostics, and a global residual Hamming-shell term. Each component has a reversible compute-phase-uncompute realization. We prove a one-sided completeness statement for these diagnostics and derive a conditional lower-tail bound for false keys under a weakly correlated diagnostic model. On ten random three-pair 16-bit S-AES instances, an 18-layer schedule optimized with Adam achieves a mean public-consistent-key probability of 46.78 percent, ranks the correct key first in every run, and limits the largest observed false-key probability to 1.11 percent. The 16-bit study evaluates the induced key-register dynamics without shot sampling, while a separate gate-level S-DES experiment validates the reversible oracle pattern without a key-space phase table. The results establish a controlled reduced-cipher benchmark; they do not claim an attack on full AES or an asymptotic advantage over Grover. Within these limits, the construction provides a useful framework for analyzing how AES structure can be incorporated into quantum algorithms.
This paper focuses on quantum key-recovery attacks on block ciphers. Previous works on quantum differential and truncated differential attacks like [Kaplan et al., ToSC 2016] have shown that classical algorithms for key-recovery, typically based on generating differential pairs and sieving them, can be accelerated by up to a quadratic speedup using variants of quantum search, quantum amplitude amplification, and quantum collision-finding.>br/> In this paper, we introduce a new quantum truncated differential key-recovery attack, which leverages the quantum convolution algorithm introduced in [Schrottenloher, CRYPTO 2022] and previously used in linear cryptanalysis. We adapt this algorithm to the case of differential cryptanalysis, by rewriting the probability of a differential of an n-bit cipher as a convolution of functions with 2n-bit input. We then construct a quantum state whose amplitudes encode the probability of the differential for different key guesses, and use this as the starting point of a quantum search. In some cases (although not on practical ciphers so far), the speedup is better than quadratic compared to classical attacks. We also extend the framework to related-key differential attacks.We give applications to a 9-round attack on QARMAv2-64 adapted from [Ahmadian et al., DCC 2024] and a 12-round related-key attack on AES-256 from [Boura et al., CRYPTO 2023], which show improvement over classical attacks and over Kaplan et al.’s strategy when taking into account the amount of memory and the type of quantum memory used (as our attack requires only quantum-accessible classical memory).
Side-channel attacks on block ciphers rarely recover the key outright: they leave a residual key space ordered by subkey posteriors, and evaluation laboratories report the key rank of the true key against thresholds near 2^48 and 2^60. No evaluation framework models an adversary who collects traces classically and finishes the search on a quantum computer, although quantum search with advice provides exactly that. We give such an adversary a cost model and a metric. For a device whose key has rank r, any quantum algorithm with classical access to the posteriors needs Omega(sqrt(r)) cipher evaluations, and block search achieves O(sqrt(r)); the per-instance advantage is exactly quadratic, and the super-quadratic exponents reported for search with advice are averages over the prior that apply to no single device. Under the NIST MAXDEPTH budget D and a Grover iteration of g gates and depth d, the quadratic advantage holds only for ranks up to (4D/(pi d))^2 and collapses to a constant factor beyond; with the best published AES-128 oracle and D = 2^40 the window closes near rank 2^58.6. We define the quantum-aware key rank, the classical rank of equal cost, computable from the rank estimators laboratories already run, and derive the classical rank a device must retain to keep a given threshold against each depth budget. Block search and amplitude amplification from the product-form posterior state are within a factor of two to four of each other on Hamming-weight posteriors, so the cost of coherent indexing decides between them. Experiments on simulated leakage and a toy cipher confirm the predicted window: at SNR 0.125 a depth-limited quantum adversary is worth about 22 traces to a classical one, however large its gate budget.
In this paper we analyze for the first time the post-quantum security of AES. AES is the most popular and widely used block cipher, established as the encryption standard by the NIST in 2001. We consider the secret key setting and, in particular, AES-256, the recommended primitive and one of the few existing ones that aims at providing a post-quantum security of 128 bits. In order to determine the new security margin, i.e., the lowest number of non-attacked rounds in time less than 2128 encryptions, we first provide generalized and quantized versions of the best known cryptanalysis on reduced-round AES, as well as a discussion on attacks that don’t seem to benefit from a significant quantum speed-up. We propose a new framework for structured search that encompasses both the classical and quantum attacks we present, and allows to efficiently compute their complexity. We believe this framework will be useful for future analysis.Our best attack is a quantum Demirci-Selçuk meet-in-the-middle attack. Unexpectedly, using the ideas underlying its design principle also enables us to obtain new, counter-intuitive classical TMD trade-offs. In particular, we can reduce the memory in some attacks against AES-256 and AES-128.One of the building blocks of our attacks is solving efficiently the AES S-Box differential equation, with respect to the quantum cost of a reversible S-Box. We believe that this generic quantum tool will be useful for future quantum differential attacks. Judging by the results obtained so far, AES seems a resistant primitive in the post-quantum world as well as in the classical one, with a bigger security margin with respect to quantum generic attacks.
Quantum Cryptanalysis on IBM Quantum Hardware: Extending Even--Mansour Period Recovery from N=4 to N=10
We report genuine-un-compiled, textbook-faithful-quantum cryptanalysis of symmetric-cipher structures executed on real IBM quantum hardware (ibm\_kingston, Heron generation). Using Simon's algorithm we recover the hidden period of the Even-Mansour cipher up to security parameter N = 10 on real hardware, beyond the largest previously reported real-hardware key recovery of N = 4, and we cleanly recover the periods of a 3-round Feistel (DES-family) construction at block sizes 6 and 8; a 21-qubit block-10 instance is verified in simulation and submitted to hardware. We further provide a breadth-first benchmark of five genuine quantum attacks spanning four symmetric-cipher design paradigms -- Bernstein-Vazirani (linear structure, single query), Grover (SPN key search, quadratic), and Simon (Even-Mansour, CBC-MAC forgery, and Feistel; exponential-to-polynomial in query complexity) -- validated to the classical-simulation ceiling of 25 qubits. We are deliberately explicit about scope: these attacks target reduced or structured constructions in the Q2 (quantum-query) model, asymptotically follow the birthday bound and therefore do not constitute quantum advantage over classical collision-finding, do not break full AES/RSA or 16-round DES, and rely on error mitigation rather than fault-tolerant error correction. Our contribution is the real-hardware demonstration at record structure sizes, the breadth of genuine algorithmic coverage across four paradigms, and an honest, reproducible benchmark with public artifacts.
Abstract Differential attack is a basic cryptanalysis method for block ciphers that exploits the high probability relations between the input and output differences. The existing work in quantum differential cryptanalysis of block ciphers is focused on resource estimation to recover the last round subkeys on the basis of relations constructed using classical methods. To find such relations using quantum computing, we propose a method to search the high probability differential and impossible differential characteristics. The method explores all possible input and output difference pairs using superposition of qubits. The proposed method is used to design the quantum circuit to search the differential characteristics for a toy cipher smallGIFT. We execute the quantum circuit on a quantum simulator to get differential and impossible characteristics. These characteristics are validated with the characteristics obtained using branch-and-bound based method. The differential characteristic is used to mount quantum key recovery attack using Grover's search. We provide the estimation of quantum resources to search the differential characteristics of lightweight block cipher GIFT-64 on a quantum computer.