Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2610.27506

Quantum Cryptanalysis on Two Feistel-Type Constructions

Yan-Ying Zhu, Bin-Bin Cai, Fei Gao, Song Lin

quant-phSubmitted Oct 20, 2026• Announced Oct 21, 2026• 0 citations
arXivHTMLPDF

Abstract

With the rapid advancement of quantum computing, the security of traditional cryptographic systems is facing significant challenges. As a fundamental component of symmetric cryptography, block ciphers have attracted increasing attention regarding their quantum security in recent years. In this paper, we propose new quantum attacks on two Feistel-type constructions, i.e., New Structure IV and the lightweight block cipher LBlock, under the quantum chosen-plaintext attack (qCPA) model. First, we construct an 8-round quantum distinguisher for New Structure IV and perform an $r(r>12)$-round quantum key-recovery attack. Compared with Li et al.'s qCPA-based result presented at INSCRYPT 2024, our attack reduces the time complexity by a factor of $2^{n/2}$, where $n$ denotes the subkey length. Second, we design a 9-round quantum distinguisher for LBlock and extend it to an $r(r>15)$-round quantum key-recovery attack. The proposed quantum distinguisher covers one more round than Liu et al.'s automated-search distinguisher at ASIACRYPT 2025, which results in a $2^{16}$ reduction in the time complexity of our $r$-round quantum key-recovery attack on LBlock. Furthermore, by analyzing the structure of the round function and the key scheduling of LBlock, we reduce the subkey guess space for the 15-round attack from 76 bits to 52 bits, lowering the time complexity from \(O(2^{38})\) to \(O(2^{26})\) by a factor of \(2^{12}\).

Related papers

Quantum Chosen-Cipher Attack on Camellia

Yanjun Li, Qi Wang, Dingyun Huang +2 more

The Feistel structure represents a fundamental architectural component within the domain of symmetric cryptographic algorithms, with a substantial body of research conducted within the context of classical computing environments. Nevertheless, research into specific symmetric cryptographic algorithms utilizing the Feistel structure is relatively scarce in quantum computing environments. This paper, for the first time, proposes a five-round distinguisher for Camellia under the quantum chosen-ciphertext attack (qCCA) setting, with its effectiveness empirically validated. Additionally, by combining Grover’s algorithm and Simon’s algorithm, we construct a nine-round key-recovery attack model against Camellia. Through an in-depth analysis of Camellia’s key expansion algorithm, we significantly reduce the complexity of the key-recovery attack. The proposed attack achieves a time complexity of 261.5 for recovering the correct key bits and requires 531 quantum bits.

Mathematics•Apr 24, 2025•0 citations

New results on the quantum security analysis of lightweight block cipher Simeck

Qihang Ding, Jiongjiong Ren, Shaozhen Chen

Abstract Simeck demonstrates reliable resistance against conventional cryptanalytic attacks and offers sound security properties, making it a noteworthy design in the field of lightweight cryptography. Nevertheless, ongoing progress in quantum computing poses a potential threat to the security of Simeck, underscoring the need for a rigorous analysis of its quantum resilience. In this paper, we analyze quantum distinguishers and key-recovery attacks on Simeck in the Q2 model. Leveraging the connection between truncated differentials and periodic functions, we revisit Simon-type qCPA distinguishers for Simeck-32/48/64 and further extend them to the qCCA setting. The qCPA distinguishers cover 8/9/11 rounds of Simeck-32/48/64, matching the round numbers reported by Lu et al. (2026), whereas our qCCA distinguishers cover 10/11/13 rounds. Based on these distinguishers, we investigate their application to Grover-meets-Simon key-recovery attacks on reduced-round Simeck. Furthermore, we mount qCPA key-recovery attacks on 11/12/14-round Simeck-32/48/64 and extend them to qCCA attacks on 13/14/16-round Simeck-32/48/64. Finally, we provide empirical estimates of the quantum resources required for the proposed key-recovery attacks. For Simeck-32/48/64, the empirical quantum query complexities are $$2^{28.09}/2^{40.32}/2^{52.59}$$ 2 28.09 / 2 40.32 / 2 52.59 in the qCPA setting and $$2^{26.81}/2^{39}/2^{51.17}$$ 2 26.81 / 2 39 / 2 51.17 in the qCCA setting, respectively, under the stated decision-test assumptions and empirical false-positive estimates.

Cybersecurity•Oct 16, 2026•0 citations

Improved quantum attack on several generalized unbalanced Feistel structures

Kun Zou, Xinfeng Dong, Zhang Fuzhong

By studying the attack technology based on Simon, Grover and other quantum algorithms for the security of block cipher structure, this paper proposes new quantum attack on 6 generalized unbalanced Feistel structures. We improve the attack results of n-cell structure, New Structure I/III/IV structure and FBC-like structure, and give a quantum attack on Skipjack structure for the first time. Based on Simon algorithm, this paper constructs a n2-round, a 12/12/6-round and a 4-round quantum distinguisher about n-cell structure, New structure I/III/IV and FBC-like structure, improving n2-n-1 rounds, 6 rounds/3 rounds/1 round and 1 round separately, comparing to the previous results. In addition, this paper also constructs a 9-round quantum distinguisher about Skipjack structure. Moreover, this paper proposes a quantum key recovery attack on the above six structures in combination with Grover algorithm, and the time complexities of attacks are analyzed.

International Conference on Networks, Communications and Information Technology (CNCIT)•Jun 1, 2022•7 citations

Improved Quantum Linear Attacks and Application to CAST

Kaveh Bashiri, Xavier Bonnetain, Akinori Hosoyamada +2 more

This paper studies quantum linear key-recovery attacks on block ciphers. The first such attacks were last-rounds attacks proposed by Kaplan et al. (ToSC 2016), which combine a linear distinguisher with a guess of a partial key. However, the most efficient classical attacks use the framework proposed by Collard et al. (ICISC 2007), which computes experimental correlations using the Fast Walsh-Hadamard Transform. Recently, Schrottenloher (CRYPTO 2023) proposed a quantum version of this technique, in which one uses the available data to create a quantum correlation state, which is a superposition of subkey candidates where the amplitudes are the corresponding correlations. A limitation is that the good subkey is not marked in this state, and cannot be found easily.In this paper, we combine the correlation state with another distinguisher. From here, we can use Amplitude Amplification to recover the right key. We apply this idea to Feistel ciphers and exemplify different attack strategies on LOKI91 before applying our idea on the CAST-128 and CAST-256 ciphers. We demonstrate the approach with two kinds of distinguishers, quantum distinguishers based on Simon’s algorithm and linear distinguishers. The resulting attacks outperform the previous Grover-meet-Simon attacks.

IACR Transactions on Symmetric Cryptology•Jun 11, 2025•0 citations

Quantum Attacks on Type‐1 Generalized Feistel Schemes

Hongwei Sun, Bin‐Bin Cai, Su‐Juan Qin +2 more

Abstract Generalized Feistel schemes (GFSs) are extremely important and extensively researched cryptographic schemes. In this paper, the security of Type‐1 GFS in quantum circumstances is investigated. On the one hand, in the qCCA setting, a new quantum polynomial‐time distinguisher on ‐round Type‐1 GFS with branches is given, which extends the previous results by rounds. This leads to a more efficient analysis of type‐1 GFS, that is, the complexity of some previous key‐recovery attacks is reduced by a factor of , where k is the key length of the internal round function. On the other hand, for CAST‐256, which is a certain block cipher based on Type‐1 GFS, a 17‐round quantum distinguisher in the qCPA setting is given. Based on this, an ‐round quantum key‐recovery attack with complexity is constructed.

Advanced Quantum Technologies•Jul 24, 2023•18 citations

Quantum cryptanalysis of ciphers based on generalized Feistel and Lai-Massey schemes

Andrii Fesenko

This paper investigates generalizations of the Lai-Massey scheme, including unified constructionscombining it with the Feistel scheme (MD GLM, UFLM, L-Feistel, and quasi-Feistel). New reductionsto the quasi-Feistel scheme are provided. Known efficient quantum attacks are analyzed, includingchosen-plaintext attacks on 3 rounds and chosen-ciphertext attacks on 4 rounds for a special case of thequasi-Feistel cipher using Simon’s algorithm. It is demonstrated that restrictions in that work led to thedegeneration of the quasi-Feistel scheme into the standard Feistel scheme, replicating known quantumattacks on the Feistel scheme. New two-round distinguishing attacks are presented for the L-Feistel andMD-1 GLM schemes, enabling round key recovery.

Theoretical and Applied Cybersecurity•Dec 28, 2025•0 citations
With the rapid advancement of quantum computing, the security of traditional cryptographic systems is facing significant challenges. As a fundamental component of symmetric cryptography, block ciphers have attracted increasing attention regarding their quantum security in recent years.
In this paper, we propose new quantum attacks on two Feistel-type constructions, i.e., New Structure IV and the lightweight block cipher LBlock, under the quantum chosen-plaintext attack (qCPA) model. First, we construct an 8-round quantum distinguisher for New Structure IV and perform an r(r>12)r(r>12)r(r>12)-round quantum key-recovery attack. Compared with Li et al.'s qCPA-based result presented at INSCRYPT 2024, our attack reduces the time complexity by a factor of 2n/22^{n/2}2n/2, where nnn denotes the subkey length. Second, we design a 9-round quantum distinguisher for LBlock and extend it to an r(r>15)r(r>15)r(r>15)-round quantum key-recovery attack. The proposed quantum distinguisher covers one more round than Liu et al.'s automated-search distinguisher at ASIACRYPT 2025, which results in a 2162^{16}216 reduction in the time complexity of our rrr-round quantum key-recovery attack on LBlock. Furthermore, by analyzing the structure of the round function and the key scheduling of LBlock, we reduce the subkey guess space for the 15-round attack from 76 bits to 52 bits, lowering the time complexity from (O(2^{38})) to (O(2^{26})) by a factor of (2^{12}).
The Feistel structure represents a fundamental architectural component within the domain of symmetric cryptographic algorithms, with a substantial body of research conducted within the context of classical computing environments. Nevertheless, research into specific symmetric cryptographic algorithms utilizing the Feistel structure is relatively scarce in quantum computing environments. This paper, for the first time, proposes a five-round distinguisher for Camellia under the quantum chosen-ciphertext attack (qCCA) setting, with its effectiveness empirically validated. Additionally, by combining Grover’s algorithm and Simon’s algorithm, we construct a nine-round key-recovery attack model against Camellia. Through an in-depth analysis of Camellia’s key expansion algorithm, we significantly reduce the complexity of the key-recovery attack. The proposed attack achieves a time complexity of 261.5 for recovering the correct key bits and requires 531 quantum bits.
Abstract Simeck demonstrates reliable resistance against conventional cryptanalytic attacks and offers sound security properties, making it a noteworthy design in the field of lightweight cryptography. Nevertheless, ongoing progress in quantum computing poses a potential threat to the security of Simeck, underscoring the need for a rigorous analysis of its quantum resilience. In this paper, we analyze quantum distinguishers and key-recovery attacks on Simeck in the Q2 model. Leveraging the connection between truncated differentials and periodic functions, we revisit Simon-type qCPA distinguishers for Simeck-32/48/64 and further extend them to the qCCA setting. The qCPA distinguishers cover 8/9/11 rounds of Simeck-32/48/64, matching the round numbers reported by Lu et al. (2026), whereas our qCCA distinguishers cover 10/11/13 rounds. Based on these distinguishers, we investigate their application to Grover-meets-Simon key-recovery attacks on reduced-round Simeck. Furthermore, we mount qCPA key-recovery attacks on 11/12/14-round Simeck-32/48/64 and extend them to qCCA attacks on 13/14/16-round Simeck-32/48/64. Finally, we provide empirical estimates of the quantum resources required for the proposed key-recovery attacks. For Simeck-32/48/64, the empirical quantum query complexities are 228.09/240.32/252.592^{28.09}/2^{40.32}/2^{52.59}228.09/240.32/252.59 2 28.09 / 2 40.32 / 2 52.59 in the qCPA setting and 226.81/239/251.172^{26.81}/2^{39}/2^{51.17}226.81/239/251.17 2 26.81 / 2 39 / 2 51.17 in the qCCA setting, respectively, under the stated decision-test assumptions and empirical false-positive estimates.
By studying the attack technology based on Simon, Grover and other quantum algorithms for the security of block cipher structure, this paper proposes new quantum attack on 6 generalized unbalanced Feistel structures. We improve the attack results of n-cell structure, New Structure I/III/IV structure and FBC-like structure, and give a quantum attack on Skipjack structure for the first time. Based on Simon algorithm, this paper constructs a n2-round, a 12/12/6-round and a 4-round quantum distinguisher about n-cell structure, New structure I/III/IV and FBC-like structure, improving n2-n-1 rounds, 6 rounds/3 rounds/1 round and 1 round separately, comparing to the previous results. In addition, this paper also constructs a 9-round quantum distinguisher about Skipjack structure. Moreover, this paper proposes a quantum key recovery attack on the above six structures in combination with Grover algorithm, and the time complexities of attacks are analyzed.
This paper studies quantum linear key-recovery attacks on block ciphers. The first such attacks were last-rounds attacks proposed by Kaplan et al. (ToSC 2016), which combine a linear distinguisher with a guess of a partial key. However, the most efficient classical attacks use the framework proposed by Collard et al. (ICISC 2007), which computes experimental correlations using the Fast Walsh-Hadamard Transform. Recently, Schrottenloher (CRYPTO 2023) proposed a quantum version of this technique, in which one uses the available data to create a quantum correlation state, which is a superposition of subkey candidates where the amplitudes are the corresponding correlations. A limitation is that the good subkey is not marked in this state, and cannot be found easily.In this paper, we combine the correlation state with another distinguisher. From here, we can use Amplitude Amplification to recover the right key. We apply this idea to Feistel ciphers and exemplify different attack strategies on LOKI91 before applying our idea on the CAST-128 and CAST-256 ciphers. We demonstrate the approach with two kinds of distinguishers, quantum distinguishers based on Simon’s algorithm and linear distinguishers. The resulting attacks outperform the previous Grover-meet-Simon attacks.
Abstract Generalized Feistel schemes (GFSs) are extremely important and extensively researched cryptographic schemes. In this paper, the security of Type‐1 GFS in quantum circumstances is investigated. On the one hand, in the qCCA setting, a new quantum polynomial‐time distinguisher on ‐round Type‐1 GFS with branches is given, which extends the previous results by rounds. This leads to a more efficient analysis of type‐1 GFS, that is, the complexity of some previous key‐recovery attacks is reduced by a factor of , where k is the key length of the internal round function. On the other hand, for CAST‐256, which is a certain block cipher based on Type‐1 GFS, a 17‐round quantum distinguisher in the qCPA setting is given. Based on this, an ‐round quantum key‐recovery attack with complexity is constructed.
This paper investigates generalizations of the Lai-Massey scheme, including unified constructionscombining it with the Feistel scheme (MD GLM, UFLM, L-Feistel, and quasi-Feistel). New reductionsto the quasi-Feistel scheme are provided. Known efficient quantum attacks are analyzed, includingchosen-plaintext attacks on 3 rounds and chosen-ciphertext attacks on 4 rounds for a special case of thequasi-Feistel cipher using Simon’s algorithm. It is demonstrated that restrictions in that work led to thedegeneration of the quasi-Feistel scheme into the standard Feistel scheme, replicating known quantumattacks on the Feistel scheme. New two-round distinguishing attacks are presented for the L-Feistel andMD-1 GLM schemes, enabling round key recovery.