Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Lecture notes in computer science

Quantum Key Search with Side Channel Advice

Daniel Patrick Martin, Ashley Montanaro, Elisabeth Oswald, Dan J. Shepherd

Published Dec 22, 2017• 19 citations
Publisher
DOI
10.1007/978-3-319-72565-9_21

Related papers

Quantum Search with Advice

Ashley Montanaro

Lecture notes in computer science•Jan 1, 2011•22 citations

Quantum-Aware Key Rank for Side-Channel Attacks evaluation

Yevgen Kotukh

Side-channel attacks on block ciphers rarely recover the key outright: they leave a residual key space ordered by subkey posteriors, and evaluation laboratories report the key rank of the true key against thresholds near 2^48 and 2^60. No evaluation framework models an adversary who collects traces classically and finishes the search on a quantum computer, although quantum search with advice provides exactly that. We give such an adversary a cost model and a metric. For a device whose key has rank r, any quantum algorithm with classical access to the posteriors needs Omega(sqrt(r)) cipher evaluations, and block search achieves O(sqrt(r)); the per-instance advantage is exactly quadratic, and the super-quadratic exponents reported for search with advice are averages over the prior that apply to no single device. Under the NIST MAXDEPTH budget D and a Grover iteration of g gates and depth d, the quadratic advantage holds only for ranks up to (4D/(pi d))^2 and collapses to a constant factor beyond; with the best published AES-128 oracle and D = 2^40 the window closes near rank 2^58.6. We define the quantum-aware key rank, the classical rank of equal cost, computable from the rank estimators laboratories already run, and derive the classical rank a device must retain to keep a given threshold against each depth budget. Block search and amplitude amplification from the product-form posterior state are within a factor of two to four of each other on Hamming-weight posteriors, so the cost of coherent indexing decides between them. Experiments on simulated leakage and a toy cipher confirm the predicted window: at SNR 0.125 a depth-limited quantum adversary is worth about 22 traces to a classical one, however large its gate budget.

quant-pharXiv:2610.20537•Oct 15, 2026•0 citations

Introducing Quantum Key Distribution

Federico Grasselli

Quantum science and technology•Jan 1, 2021•3 citations

Quantum key distribution

Roger Colbeck, Dejan Dukaric, Matthias Fitzi +1 more

Springer eBooks•Jan 1, 2007•1 citation

Pinpointing Super-Quadratic Quantum Enumeration Speedups

Carsten Schubert, Niklas Paskarbeit, Maximilian J. Kramer +2 more

In cryptanalysis and beyond, presumably the most basic problem is search within an unstructured space: Given a finite set of elements K, find a marked element using an efficiently evaluable predicate. Grover's algorithm [16] gives an optimal quadratic query advantage for black-box search. Cryptanalytic settings, however, often come with additional probabilistic advice over the candidate space. These distributions frequently have product form, e.g. when probabilities for independent key coordinates are derived from side-channel leakage. Classically, simply querying the predicate function in the given likelihood order is optimal to find the correct result as fast as possible in expectation. In the quantum setting, Montanaro [26] showed how to achieve an optimal expected query complexity, beating plain Grover on every non-uniform distribution of the advice (disregarding a constant overhead factor). What has been missing so far is a finite-size method for evaluating the quantum-classical guessing-moment separation induced by a given advice distribution. We provide such a method for product-distribution advice, thereby sharpening the previous entropy-based estimate of Bashiri et al. [6]. Our approach reduces the relevant classical and quantum guessing moments to functionals of the one-dimensional surprisal distribution. For product advice, this distribution is obtained by convolving the per-coordinate surprisal laws. When the surprisals lie on a common arithmetic grid—the commensurate case—the resulting logarithmic moments, and hence the speedup exponent, can be evaluated as finite sums without discretization error. Exponential tilting makes this computation numerically stable. For general non-commensurate product advice, we discretize the surprisals onto a common grid before running our algorithm and derive an a-posteriori bound on the resulting binning error. We apply the framework to cold-boot leakage on seeds and block-cipher keys, to template-attack posteriors, and to synthetic i.i.d. Bernoulli posteriors whose parameter is chosen to reproduce average residual ranks reported for Keccak side-channel attacks on ML-KEM and ML-DSA. The resulting guessing-moment exponents substantially exceed 2 in several skewed-advice settings, reaching 3.92 for cold-boot advice and 3.12 in the synthetic models, and include cases where the previous entropy-based bound did not establish an exponent above 2.

arXiv:2609.28226•ACM Conference on Post-Quantum and Quantum-based Security•Oct 26, 2026•0 citations

Quantum Key Distribution

Springer eBooks•Jan 1, 2010•0 citations
Side-channel attacks on block ciphers rarely recover the key outright: they leave a residual key space ordered by subkey posteriors, and evaluation laboratories report the key rank of the true key against thresholds near 2^48 and 2^60. No evaluation framework models an adversary who collects traces classically and finishes the search on a quantum computer, although quantum search with advice provides exactly that. We give such an adversary a cost model and a metric. For a device whose key has rank r, any quantum algorithm with classical access to the posteriors needs Omega(sqrt(r)) cipher evaluations, and block search achieves O(sqrt(r)); the per-instance advantage is exactly quadratic, and the super-quadratic exponents reported for search with advice are averages over the prior that apply to no single device. Under the NIST MAXDEPTH budget D and a Grover iteration of g gates and depth d, the quadratic advantage holds only for ranks up to (4D/(pi d))^2 and collapses to a constant factor beyond; with the best published AES-128 oracle and D = 2^40 the window closes near rank 2^58.6. We define the quantum-aware key rank, the classical rank of equal cost, computable from the rank estimators laboratories already run, and derive the classical rank a device must retain to keep a given threshold against each depth budget. Block search and amplitude amplification from the product-form posterior state are within a factor of two to four of each other on Hamming-weight posteriors, so the cost of coherent indexing decides between them. Experiments on simulated leakage and a toy cipher confirm the predicted window: at SNR 0.125 a depth-limited quantum adversary is worth about 22 traces to a classical one, however large its gate budget.
In cryptanalysis and beyond, presumably the most basic problem is search within an unstructured space: Given a finite set of elements K, find a marked element using an efficiently evaluable predicate. Grover's algorithm [16] gives an optimal quadratic query advantage for black-box search. Cryptanalytic settings, however, often come with additional probabilistic advice over the candidate space. These distributions frequently have product form, e.g. when probabilities for independent key coordinates are derived from side-channel leakage. Classically, simply querying the predicate function in the given likelihood order is optimal to find the correct result as fast as possible in expectation. In the quantum setting, Montanaro [26] showed how to achieve an optimal expected query complexity, beating plain Grover on every non-uniform distribution of the advice (disregarding a constant overhead factor). What has been missing so far is a finite-size method for evaluating the quantum-classical guessing-moment separation induced by a given advice distribution. We provide such a method for product-distribution advice, thereby sharpening the previous entropy-based estimate of Bashiri et al. [6]. Our approach reduces the relevant classical and quantum guessing moments to functionals of the one-dimensional surprisal distribution. For product advice, this distribution is obtained by convolving the per-coordinate surprisal laws. When the surprisals lie on a common arithmetic grid—the commensurate case—the resulting logarithmic moments, and hence the speedup exponent, can be evaluated as finite sums without discretization error. Exponential tilting makes this computation numerically stable. For general non-commensurate product advice, we discretize the surprisals onto a common grid before running our algorithm and derive an a-posteriori bound on the resulting binning error. We apply the framework to cold-boot leakage on seeds and block-cipher keys, to template-attack posteriors, and to synthetic i.i.d. Bernoulli posteriors whose parameter is chosen to reproduce average residual ranks reported for Keccak side-channel attacks on ML-KEM and ML-DSA. The resulting guessing-moment exponents substantially exceed 2 in several skewed-advice settings, reaching 3.92 for cold-boot advice and 3.12 in the synthetic models, and include cases where the previous entropy-based bound did not establish an exponent above 2.