Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International Symposium on Information Theory and its Applications

Security on the quantum-type Even-Mansour cipher

Hidenori Kuwakado, Masakatu Morii

Published Oct 1, 2012• 114 citations
OpenAlex

Abstract

Quantum cryptography such as BB84 is a quantum protocol for sharing classical information, but is not a scheme for encrypting quantum information itself. This paper considers that quantum information is encrypted with the quantum circuit of the Even-Mansour cipher. It has been proved that breaking the Even-Mansour cipher requires exponential time in the key length using any classical algorithm. This paper shows that the quantum version of the Even-Mansour cipher is insecure, that is, a key can be found in polynomial time in the key length. This is an example that the quantum version of a secure classical cipher is not always secure.

Related papers

On Quantum Related-Key Attacks on Iterated Even-Mansour Ciphers

Akinori Hosoyamada, Kazumaro Aoki

It has been said that security of symmetric key schemes is not so much affected by quantum computers, compared to public key schemes. However, recent works revealed that, in some specific situations, symmetric key schemes are also broken in polynomial time by adversaries with quantum computers. These works contain a quantum distinguishing attack on 3-round Feistel ciphers and a quantum key recovery attack on the Even-Mansour cipher by Kuwakado and Morii, in addition to the quantum forgery attack on CBC-MAC which is proposed independently by Kaplan et al., and by Santoli and Schaffner. Iterated Even-Mansour cipher is a simple but important block cipher, which can be regarded as an idealization of AES. Whether there exists an efficient quantum algorithm that can break iterated Even-Mansour cipher with independent subkeys is an important problem from the viewpoint of analyzing post-quantum security of block ciphers. Actually there is an efficient quantum attack on iterated Even-Mansour cipher by Kaplan et al., but their attack can only be applied in the case that all subkeys are the same. This paper shows that there is a polynomial time quantum algorithm that recovers partial keys of the iterated Even-Mansour cipher with independent subkeys, in a related-key setting. The related-key condition is somewhat strong, but our algorithm can recover subkeys with two related oracles. In addition, we also show that our algorithm can recover all keys of the i-round iterated Even-Mansour cipher, if we are allowed to access i related quantum oracles. To realize quantum related-key attacks, we extend Simon's quantum algorithm so that we can recover the hidden period of a function that is periodic only up to constant. Our technique is to take differential of the target function to make a double periodic function, and then apply Simon's algorithm.

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Dec 31, 2018•20 citations

ANALYSIS OF QUANTUM BB84 AND B92 ENCRYPTION ALGORITHMS

Долгочуб Евгений Александрович, Alexey N. Polikanin

A communication channel protected by quantum cryptography cannot be hacked under ideal conditions. But only because there are currently no suitable hacking methods available. All existing methods of breaking cryptographic networks are aimed at mathematical models of ciphers. However, if we follow the rule that the stability of a system is determined by the stability of its weakest link, we can see the opposite. Quantum cryptography is a promising young and developing field in the field of information security. Every specialist in the field of information security is interested in creating a perfect and secure communication network. Systems that currently use the BB84 and B92 protocols are vulnerable to attacks from hackers. These security protocols are already considered outdated, but scientists can not yet offer other options. The article discusses the advantages and disadvantages of the first quantum encryption algorithms BB84 and B92.

Interexpo GEO-Siberia•Jul 8, 2020•0 citations

On the security of the BB84 quantum key distribution protocol

Cannings, Richard

The BB84 quantum key distribution (QKD) protocol enables two authenticated parties to generate a secret key over an insecure quantum channel. Using a standardized security definition, we prove that BB84 is secure and include explicit bounds on its security. Furthermore, our use of quantum circuit diagrams simplify the Shor-Preskill proof. Namely, we can reduce the Modified Lo-Chau QKD to a practical version of BB84 using the observation from Shor and Preskill that one may ignore a correctable number of phase errors, and the fact that computational basis measurements commute with controls of CNOT operations. The first four chapters provide the required background material on quantum computing, information theory, cryptography, coding theory, and quantum error correcting codes. Chapter 5 presents protocols for entanglement purification. Chapter 6 reduces an entanglement purification protocol to the Modified Lo-Chau QKD, and proves that it is secure. Finally, a reduction from the Modified Lo-Chau QKD to BB84 establishes the security of the latter.

•Jan 1, 2004•0 citations

Quantum cryptography

Jonathan A. Jones, Dieter Jaksch

Cryptographic protocols can be classified by the type of security against eavesdropping which they provide. There exist mathematically secure schemes whose security relies on mathematical proofs (like the Vernam cipher discussed below) or conjectures (like public key RSA encryption) about the complexity of deciphering the message without possessing the correct key. The majority of current secure public Internet connections rely on such schemes. Alternatively, a cryptographic setup may provide a physically secure method for communicating. In these setups the security is provided by the physical laws governing the communication protocol. Here we first discuss a provably secure classical communication protocol and then quantum methods for distributing the necessary keys. The BB84 protocol relies on the impossibility of perfectly distinguishing non-orthogonal quantum states from one copy of the quantum system. The scheme was invented in 1984 and is the first of its kind. In contrast, the Ekert91 protocol makes use of Bell correlations between entangled pairs of photons. These correlations are destroyed when Eve attempts to make a measurement on one of the particles but also when imperfections, such as decoherence processes, affect the scheme. As long as no such “elements of reality” are introduced, and Bell correlations violating local realism can be generated by Alice and Bob, no eavesdropper can be present. One-time pads and the Vernam cipher The Vernam cipher is a cryptographic protocol which allows the encryption and decryption protocol to be publicly known. The security of the protocol relies entirely on the key which is private and not publicly known. Alice and Bob share identical n -bit secret key strings (one-time pad).

Cambridge University Press eBooks•Jul 19, 2012•0 citations

Security of entanglement based version of BB84 protocol for Quantum Cryptography

Anand Sharma, Vibha Ojha, Saroj Kumar Lenka

As the quantum cryptography is the ultimate solution for information security. Quantum cryptography describes the ultimate way for key distribution. Unlike many of the classical cryptosystems in use today, whose security often draws on unproven assumptions about the computational complexity of mathematical problems, the security of quantum cryptography is based on the laws of physics. The Quantum Key Distribution follows some protocols for key distribution. In this paper we describe the BB84 protocol which is used in Quantum Cryptography and the security aspect of entanglement based version of BB84.

•Jul 1, 2010•14 citations

Providing variable levels of security in quantum cryptography

Abhishek Parakh

Quantum cryptography provides perfect secrecy if the key exchanged is used for one-time-pad encryption. However, this requires very long keys which are not practical in most scenarios. Further, the key exchange bit-rate for quantum key distribution is very low. Consequently, often quantum key distribution algorithms only exchange (128, 192 or 256 bit) AES keys and then AES is used for data encryption. While Grover's algorithm will force us to only use AES- 256 and does not pose a catastrophic failure to AES, AES does not provide provable security. In this paper, we discuss methods that provide provable security but at the same time the key lengths may be controlled to practical levels. Difficulty of breaking the cipher is directly proportional to the key length and depends on the specific algorithm employed. The key idea is that key lengths can be tweaked such that an acceptable and provable level of security is achieved and therefore the cipher is not reliant on any assumptions for security. The paper will discuss different ways of achieving the above goal.

Quantum Communications and Quantum Imaging•Sep 18, 2018•6 citations
Quantum cryptography such as BB84 is a quantum protocol for sharing classical information, but is not a scheme for encrypting quantum information itself. This paper considers that quantum information is encrypted with the quantum circuit of the Even-Mansour cipher. It has been proved that breaking the Even-Mansour cipher requires exponential time in the key length using any classical algorithm. This paper shows that the quantum version of the Even-Mansour cipher is insecure, that is, a key can be found in polynomial time in the key length. This is an example that the quantum version of a secure classical cipher is not always secure.
It has been said that security of symmetric key schemes is not so much affected by quantum computers, compared to public key schemes. However, recent works revealed that, in some specific situations, symmetric key schemes are also broken in polynomial time by adversaries with quantum computers. These works contain a quantum distinguishing attack on 3-round Feistel ciphers and a quantum key recovery attack on the Even-Mansour cipher by Kuwakado and Morii, in addition to the quantum forgery attack on CBC-MAC which is proposed independently by Kaplan et al., and by Santoli and Schaffner. Iterated Even-Mansour cipher is a simple but important block cipher, which can be regarded as an idealization of AES. Whether there exists an efficient quantum algorithm that can break iterated Even-Mansour cipher with independent subkeys is an important problem from the viewpoint of analyzing post-quantum security of block ciphers. Actually there is an efficient quantum attack on iterated Even-Mansour cipher by Kaplan et al., but their attack can only be applied in the case that all subkeys are the same. This paper shows that there is a polynomial time quantum algorithm that recovers partial keys of the iterated Even-Mansour cipher with independent subkeys, in a related-key setting. The related-key condition is somewhat strong, but our algorithm can recover subkeys with two related oracles. In addition, we also show that our algorithm can recover all keys of the i-round iterated Even-Mansour cipher, if we are allowed to access i related quantum oracles. To realize quantum related-key attacks, we extend Simon's quantum algorithm so that we can recover the hidden period of a function that is periodic only up to constant. Our technique is to take differential of the target function to make a double periodic function, and then apply Simon's algorithm.
A communication channel protected by quantum cryptography cannot be hacked under ideal conditions. But only because there are currently no suitable hacking methods available. All existing methods of breaking cryptographic networks are aimed at mathematical models of ciphers. However, if we follow the rule that the stability of a system is determined by the stability of its weakest link, we can see the opposite. Quantum cryptography is a promising young and developing field in the field of information security. Every specialist in the field of information security is interested in creating a perfect and secure communication network. Systems that currently use the BB84 and B92 protocols are vulnerable to attacks from hackers. These security protocols are already considered outdated, but scientists can not yet offer other options. The article discusses the advantages and disadvantages of the first quantum encryption algorithms BB84 and B92.
The BB84 quantum key distribution (QKD) protocol enables two authenticated parties to generate a secret key over an insecure quantum channel. Using a standardized security definition, we prove that BB84 is secure and include explicit bounds on its security. Furthermore, our use of quantum circuit diagrams simplify the Shor-Preskill proof. Namely, we can reduce the Modified Lo-Chau QKD to a practical version of BB84 using the observation from Shor and Preskill that one may ignore a correctable number of phase errors, and the fact that computational basis measurements commute with controls of CNOT operations. The first four chapters provide the required background material on quantum computing, information theory, cryptography, coding theory, and quantum error correcting codes. Chapter 5 presents protocols for entanglement purification. Chapter 6 reduces an entanglement purification protocol to the Modified Lo-Chau QKD, and proves that it is secure. Finally, a reduction from the Modified Lo-Chau QKD to BB84 establishes the security of the latter.
Cryptographic protocols can be classified by the type of security against eavesdropping which they provide. There exist mathematically secure schemes whose security relies on mathematical proofs (like the Vernam cipher discussed below) or conjectures (like public key RSA encryption) about the complexity of deciphering the message without possessing the correct key. The majority of current secure public Internet connections rely on such schemes. Alternatively, a cryptographic setup may provide a physically secure method for communicating. In these setups the security is provided by the physical laws governing the communication protocol. Here we first discuss a provably secure classical communication protocol and then quantum methods for distributing the necessary keys. The BB84 protocol relies on the impossibility of perfectly distinguishing non-orthogonal quantum states from one copy of the quantum system. The scheme was invented in 1984 and is the first of its kind. In contrast, the Ekert91 protocol makes use of Bell correlations between entangled pairs of photons. These correlations are destroyed when Eve attempts to make a measurement on one of the particles but also when imperfections, such as decoherence processes, affect the scheme. As long as no such “elements of reality” are introduced, and Bell correlations violating local realism can be generated by Alice and Bob, no eavesdropper can be present. One-time pads and the Vernam cipher The Vernam cipher is a cryptographic protocol which allows the encryption and decryption protocol to be publicly known. The security of the protocol relies entirely on the key which is private and not publicly known. Alice and Bob share identical n -bit secret key strings (one-time pad).
As the quantum cryptography is the ultimate solution for information security. Quantum cryptography describes the ultimate way for key distribution. Unlike many of the classical cryptosystems in use today, whose security often draws on unproven assumptions about the computational complexity of mathematical problems, the security of quantum cryptography is based on the laws of physics. The Quantum Key Distribution follows some protocols for key distribution. In this paper we describe the BB84 protocol which is used in Quantum Cryptography and the security aspect of entanglement based version of BB84.
Quantum cryptography provides perfect secrecy if the key exchanged is used for one-time-pad encryption. However, this requires very long keys which are not practical in most scenarios. Further, the key exchange bit-rate for quantum key distribution is very low. Consequently, often quantum key distribution algorithms only exchange (128, 192 or 256 bit) AES keys and then AES is used for data encryption. While Grover's algorithm will force us to only use AES- 256 and does not pose a catastrophic failure to AES, AES does not provide provable security. In this paper, we discuss methods that provide provable security but at the same time the key lengths may be controlled to practical levels. Difficulty of breaking the cipher is directly proportional to the key length and depends on the specific algorithm employed. The key idea is that key lengths can be tweaked such that an acceptable and provable level of security is achieved and therefore the cipher is not reliant on any assumptions for security. The paper will discuss different ways of achieving the above goal.