Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IACR Transactions on Symmetric Cryptology

On the Quantum Security of OCB

Varun Maram, Daniel Masny, Sikhar Patranabis, Srinivasan Raghuraman

Published Jun 10, 2022• 11 citations
Publisher

Abstract

The OCB mode of operation for block ciphers has three variants, OCB1, OCB2 and OCB3. OCB1 and OCB3 can be used as secure authenticated encryption schemes whereas OCB2 has been shown to be classically insecure (Inoue et al., Crypto 2019). Even further, in the presence of quantum queries to the encryption functionality, a series of works by Kaplan et al. (Crypto 2016), Bhaumik et al. (Asiacrypt 2021) and Bonnetain et al. (Asiacrypt 2021) have shown how to break the unforgeability of the OCB modes. However, these works did not consider the confidentiality of OCB in the presence of quantum queries.We fill this gap by presenting the first formal analysis of the IND-qCPA security of OCB. In particular, we show the first attacks breaking the IND-qCPA security of the OCB modes. Surprisingly, we are able to prove that OCB2 is IND-qCPA secure when used without associated data, while relying on the assumption that the underlying block cipher is a quantum-secure pseudorandom permutation. Additionally, we present new quantum attacks breaking the universal unforgeability of OCB. Our analysis of OCB has implications for the post-quantum security of XTS, a well-known disk encryption standard, that was considered but mostly left open by Anand et al. (PQCrypto 2016).

DOI
10.46586/tosc.v2022.i2.379-414

Related papers

Post-Quantum Security of Block Cipher Constructions

Gorjan Alagic, Chen Bai, Christian Majenz +1 more

Block ciphers are versatile cryptographic ingredients that are used in a wide range of applications ranging from secure Internet communications to disk encryption. While post-quantum security of public-key cryptography has received significant attention, the case of symmetric-key cryptography (and block ciphers in particular) remains a largely unexplored topic. In this work, we set the foundations for a theory of post-quantum security for block ciphers and associated constructions. Leveraging our new techniques, we provide the first post-quantum security proofs for the key-length extension scheme FX, the tweakable block ciphers LRW and XEX, and most block cipher encryption and authentication modes. Our techniques can be used for security proofs in both the plain model and the quantum ideal cipher model. Our work takes significant initial steps in establishing a rigorous understanding of the post-quantum security of practical symmetric-key cryptography.

arXiv:2510.08725•Oct 9, 2025•0 citations

A Review of Block Ciphers and Its Post-Quantum Considerations

R Chethana, Jayavrinda Vrindavanam V, Subarna Roy +1 more

Recent advances in cryptography aim to address threats posed by quantum computers. However, these advances have focused disproportionately on asymmetric schemes, while symmetric primitives like block ciphers have received less attention. The common assumption is that doubling block cipher key sizes provides adequate quantum resistance, but this oversimplifies the challenge. This paper provides a systematic examination of block cipher security in the quantum computing era. The paper first establishes a formal framework for understanding block cipher security, covering their mathematical foundations and essential security properties. Building on this foundation, we examine how quantum computing fundamentally challenges these security assumptions, going beyond the simple impact on key lengths. Our review of recent research reveals that quantum attacks can exploit structural vulnerabilities in block ciphers and their modes of operation, requiring more comprehensive defenses than key length adjustments alone. We analyze emerging approaches in quantum-resistant design and identify critical areas requiring further research to ensure block cipher security in a post-quantum world.

IEEE Access•Jan 1, 2025•7 citations

On post-quantum security properties of one block ciphers mode of operation for block-oriented storage devices protection

Georgii V. Firsov, Alisa Mikhailovna Koreneva

Journal of Computer Virology and Hacking Techniques•May 16, 2025•1 citation

Quantum Security of the Combined Feedback Mode

Mengyuan Zhang, Wenling Wu, Han Sui

Authenticated encryption with associated data (AEAD) play a critical role in secure communication protocols, by offering confidentiality, integrity, and authenticity. However, the advent of quantum computing poses a significant threat to the security of AEAD schemes, including ISO/IEC standards such as OCB (offset codebook) and GCM (Galois/counter mode), highlighting the need for a thorough evaluation of their quantum resistance. Combined feedback mode (COFB) is a lightweight AEAD mode proposed at CHES'17, gaining significant attention due to its excellent performance in both software and hardware implementations. In this paper, we study the post-quantum security of COFB. First, we show COFB is insecure under the security notion of quantum-secure pseudo-random funtion (qPRF) by presenting an attack with a single encryption query. Next, we investigate the IND-qCPA (indistinguishability under quantum chosen-plaintext attack) security of COFB. Specifically, we show that if instantiated with a qPRF-secure$n$-bit block cipher, the IND-qCPA security bound of COFB is roughly$(Q^{7/4}\cdot\ell^{11/4})/2^{n/2}+Q\ell/2^{n/4}$, where$Q$denotes the number of encryption queries and$\ell$represents the maximum length (in blocks) of messages in each query. Furthermore, we extend this result to GIFT-COFB, a finalist in the NIST Lightweight Cryptography competition, and establish its security bound as$(Q^{7/4}\cdot \ell^{11/4})/2^{n/2}$.

Chinese Journal of Electronics•Nov 1, 2025•0 citations

Post-Quantum Security of COPA

Ping Zhang, Yutao Wang

COPA is a notable authenticated online cipher and was one of the winning proposals for the CAESAR competition. Current works describe how to break the existentially unforgeable under quantum chosen message attack (EUF-qCMA) of COPA. However, these works do not demonstrate the confidentiality of COPA in the quantum setting. This paper fills this gap, considers the indistinguishable under quantum chosen-plaintext attack (IND-qCPA) security for privacy, and presents the first IND-qCPA security analysis of COPA. In addition, in order to effectively avoid the problems of quantum existential forgery attack and quantum distinguishing attack, we introduce an intermediate state doubling-point technology into COPA, restrict the associated data non-emptiness, and present an enhanced variant, called COPA-ISDP, to support the IND-qCPA and EUF-qCMA security. Our work is of great significance, as it provides a simple and effective post-quantum secure design idea to resist Simon's attack.

Entropy•Aug 23, 2025•0 citations

An Investigative Study on Variants of Post-Quantum RSA

Kondapalli V V Subbarao, Manas Kumar Yogi

As quantum computing advances, traditional cryptographic schemes such as RSA face increasing vulnerability to attacks. This investigative study delves into the realm of post-quantum cryptography, focusing specifically on variants of RSA designed to resist quantum attacks. Through a comprehensive review of existing literature and cryptographic protocols, we analyse the strengths and weaknesses of various post-quantum RSA variants, including lattice-based, code-based, and hash-based approaches. Additionally, we evaluate the computational efficiency and security guarantees of these variants, considering factors such as key size, encryption/decryption speed, and resistance to quantum algorithms. Our findings provide insights into the current state of post-quantum RSA, highlighting promising directions for further research and development in the quest for quantum-resistant cryptographic solutions. In the future robust variants of RSA, algorithms will help the stakeholders of the cryptosystems to instil faith in the security of the system in the face of challenges which is inadvertently posed by the attackers using advanced security attack vectors.

Journal of Cryptography and Network Security Design and Codes•Apr 9, 2024•0 citations
The OCB mode of operation for block ciphers has three variants, OCB1, OCB2 and OCB3. OCB1 and OCB3 can be used as secure authenticated encryption schemes whereas OCB2 has been shown to be classically insecure (Inoue et al., Crypto 2019). Even further, in the presence of quantum queries to the encryption functionality, a series of works by Kaplan et al. (Crypto 2016), Bhaumik et al. (Asiacrypt 2021) and Bonnetain et al. (Asiacrypt 2021) have shown how to break the unforgeability of the OCB modes. However, these works did not consider the confidentiality of OCB in the presence of quantum queries.We fill this gap by presenting the first formal analysis of the IND-qCPA security of OCB. In particular, we show the first attacks breaking the IND-qCPA security of the OCB modes. Surprisingly, we are able to prove that OCB2 is IND-qCPA secure when used without associated data, while relying on the assumption that the underlying block cipher is a quantum-secure pseudorandom permutation. Additionally, we present new quantum attacks breaking the universal unforgeability of OCB. Our analysis of OCB has implications for the post-quantum security of XTS, a well-known disk encryption standard, that was considered but mostly left open by Anand et al. (PQCrypto 2016).
Block ciphers are versatile cryptographic ingredients that are used in a wide range of applications ranging from secure Internet communications to disk encryption. While post-quantum security of public-key cryptography has received significant attention, the case of symmetric-key cryptography (and block ciphers in particular) remains a largely unexplored topic. In this work, we set the foundations for a theory of post-quantum security for block ciphers and associated constructions. Leveraging our new techniques, we provide the first post-quantum security proofs for the key-length extension scheme FX, the tweakable block ciphers LRW and XEX, and most block cipher encryption and authentication modes. Our techniques can be used for security proofs in both the plain model and the quantum ideal cipher model. Our work takes significant initial steps in establishing a rigorous understanding of the post-quantum security of practical symmetric-key cryptography.
Recent advances in cryptography aim to address threats posed by quantum computers. However, these advances have focused disproportionately on asymmetric schemes, while symmetric primitives like block ciphers have received less attention. The common assumption is that doubling block cipher key sizes provides adequate quantum resistance, but this oversimplifies the challenge. This paper provides a systematic examination of block cipher security in the quantum computing era. The paper first establishes a formal framework for understanding block cipher security, covering their mathematical foundations and essential security properties. Building on this foundation, we examine how quantum computing fundamentally challenges these security assumptions, going beyond the simple impact on key lengths. Our review of recent research reveals that quantum attacks can exploit structural vulnerabilities in block ciphers and their modes of operation, requiring more comprehensive defenses than key length adjustments alone. We analyze emerging approaches in quantum-resistant design and identify critical areas requiring further research to ensure block cipher security in a post-quantum world.
Authenticated encryption with associated data (AEAD) play a critical role in secure communication protocols, by offering confidentiality, integrity, and authenticity. However, the advent of quantum computing poses a significant threat to the security of AEAD schemes, including ISO/IEC standards such as OCB (offset codebook) and GCM (Galois/counter mode), highlighting the need for a thorough evaluation of their quantum resistance. Combined feedback mode (COFB) is a lightweight AEAD mode proposed at CHES'17, gaining significant attention due to its excellent performance in both software and hardware implementations. In this paper, we study the post-quantum security of COFB. First, we show COFB is insecure under the security notion of quantum-secure pseudo-random funtion (qPRF) by presenting an attack with a single encryption query. Next, we investigate the IND-qCPA (indistinguishability under quantum chosen-plaintext attack) security of COFB. Specifically, we show that if instantiated with a qPRF-securennn-bit block cipher, the IND-qCPA security bound of COFB is roughly(Q7/4⋅ℓ11/4)/2n/2+Qℓ/2n/4(Q^{7/4}\cdot\ell^{11/4})/2^{n/2}+Q\ell/2^{n/4}(Q7/4⋅ℓ11/4)/2n/2+Qℓ/2n/4, whereQQQdenotes the number of encryption queries andℓ\ellℓrepresents the maximum length (in blocks) of messages in each query. Furthermore, we extend this result to GIFT-COFB, a finalist in the NIST Lightweight Cryptography competition, and establish its security bound as(Q7/4⋅ℓ11/4)/2n/2(Q^{7/4}\cdot \ell^{11/4})/2^{n/2}(Q7/4⋅ℓ11/4)/2n/2.
COPA is a notable authenticated online cipher and was one of the winning proposals for the CAESAR competition. Current works describe how to break the existentially unforgeable under quantum chosen message attack (EUF-qCMA) of COPA. However, these works do not demonstrate the confidentiality of COPA in the quantum setting. This paper fills this gap, considers the indistinguishable under quantum chosen-plaintext attack (IND-qCPA) security for privacy, and presents the first IND-qCPA security analysis of COPA. In addition, in order to effectively avoid the problems of quantum existential forgery attack and quantum distinguishing attack, we introduce an intermediate state doubling-point technology into COPA, restrict the associated data non-emptiness, and present an enhanced variant, called COPA-ISDP, to support the IND-qCPA and EUF-qCMA security. Our work is of great significance, as it provides a simple and effective post-quantum secure design idea to resist Simon's attack.
As quantum computing advances, traditional cryptographic schemes such as RSA face increasing vulnerability to attacks. This investigative study delves into the realm of post-quantum cryptography, focusing specifically on variants of RSA designed to resist quantum attacks. Through a comprehensive review of existing literature and cryptographic protocols, we analyse the strengths and weaknesses of various post-quantum RSA variants, including lattice-based, code-based, and hash-based approaches. Additionally, we evaluate the computational efficiency and security guarantees of these variants, considering factors such as key size, encryption/decryption speed, and resistance to quantum algorithms. Our findings provide insights into the current state of post-quantum RSA, highlighting promising directions for further research and development in the quest for quantum-resistant cryptographic solutions. In the future robust variants of RSA, algorithms will help the stakeholders of the cryptosystems to instil faith in the security of the system in the face of challenges which is inadvertently posed by the attackers using advanced security attack vectors.