In this paper, we propose an estimation of quantum resources necessary for recovering a key using Known Plain Text Attack (KPA) model for SPARKLE family of LWC authenticated block ciphers - SCHWAEMM. The procedure is based on a general attack using Grover's search algorithm with encryption oracle over key space in superposition. The paper explains step by step how to evaluate the cost of each operation type in encryption oracle in terms of various quantum and reversible gates. The result of this paper is an implementation of the simplified version of this cipher using quantum computer and summary table which shows the depth of quantum circuit, the size of quantum register and how many gates of NCT family are required for implementing the ciphers and attacks on them.
In this paper, we propose an estimation of quantum resources necessary for recovering a key using Known Plain Text Attack (KPA) model for SPARKLE family of LWC authenticated block ciphers - SCHWAEMM. The procedure is based on a general attack using Grover's search algorithm with encryption oracle over key space in superposition. The paper explains step by step how to evaluate the cost of each operation type in encryption oracle in terms of various quantum and reversible gates. The result of this paper is an implementation of the simplified version of this cipher using quantum computer and summary table which shows the depth of quantum circuit, the size of quantum register and how many gates of NCT family are required for implementing the ciphers and attacks on them.
In this paper, we propose an estimation of quantum resources necessary for recovering a key using Known Plain Text Attack (KPA) model for SPARKLE family of LWC authenticated block ciphers - SCHWAEMM. The procedure is based on a general attack using Grover's search algorithm with encryption oracle over key space in superposition. The paper explains step by step how to evaluate the cost of each operation type in encryption oracle in terms of various quantum and reversible gates. The result of this paper is an implementation of the simplified version of this cipher using quantum computer and summary table which shows the depth of quantum circuit, the size of quantum register and how many gates of NCT family are required for implementing the ciphers and attacks on them.
This article presents the cost analysis of mounting Grover’s key search attack on the family of KATAN block cipher. Several designs of the reversible quantum circuit of KATAN are proposed. Owing to the National Insitute of Standards and Technology’s (NIST) proposal for postquantum cryptography standardization, the circuits are designed focusing on minimizing the overall depth. We observe that the reversible quantum circuits designed usingandgates andT-depth one Toffoli gate give more shallow circuits. Grover oracle for KATAN is designed based on the reversible circuits, which are used further to mount Grover’s key search attack on KATAN. The designs are implemented using the software framework ProjectQ, which provides a resource estimation tool to perform an appropriate cost analysis in an automated way. While estimating the resources, NIST’s depth restrictions are also respected.
“Grover's Algorithm: Quantum Search” explores Grover's Algorithm in the context of quantum search, beginning with an overview of its mechanics. The section includes a literature survey that covers Grover's algorithm, stream ciphers, and the Grover attack, as well as quantum resource estimation. The section then introduces a simplified 4-bit Grain cipher (with a 4-bit key and 4-bit IV), detailing its design, initialization, and key stream generation. Following this, the chapter discusses about key recovery using Grover's algorithm, with an emphasis on quantum circuit development for the simplified Grain 4-bit cipher. It outlines key steps in the circuit, such as executing the Boolean function and XORing the NFSR's fourth bit. Further, the section details the development of a Grover attack quantum circuit, describing both single and double pair methods. Experimental results are provided across multiple cases, with a summary of test cases and classical computation times. Quantum resource estimation, including the costs associated with the simplified Grain 4-bit cipher and the Grover oracle, is analyzed. The section concludes with a discussion on the results, classical and quantum resource estimations, and the potential for future enhancements to the approach.
Extensive research is currently underway to determine the security of existing ciphers in light of the advancements in quantum computing. Against symmetric key cryptography, Grover’s search algorithm is a prominent attack, capable of reducing search costs to the square root. For using Grover’s algorithm, it is imperative to embed the target cipher into a quantum circuit. Even so, this area of research is relatively new; it has garnered significant attention from the research community. In this study, we provide the first estimation of the cost of Grover’s key search attack against the AES-based AEAD schemes Rocca-S, AEGIS-128, and Tiaoxin-346. Our analysis considers circuit depth restrictions specified in NIST’s PQC standardization process. Considering NIST’s maximum depth constraints, We present the overall cost of these attacks using gate count and depth-times-width metrics. We observed that for MAXDEPTH=240 , Rocca-S, AEGIS-128, and Tiaoxin-346 can be retrieved using Grover’s search algorithm with gate count of 1.09 × 2253, 1.14 × 2124, and 1.22 × 2124 respectively. Concerning the current updated values by NIST, these ciphers are secure in terms of the cost of implementing Grover’s attack for key recovery. The quantum circuits of these ciphers are implemented using QISKIT, an open-source software development kit (SDK) designed for working with quantum computers running on the IBM Quantum Experience platform.
With the advancement of quantum computing, quantum circuit implementations of symmetric cryptographic algorithms are essential for evaluating their resistance to quantum attacks. As an ISO-standardized cipher, the efficient quantum circuit construction of Camellia is of great significance. Focusing on minimizing the DW-cost (qubits × Toffoli-depth) while balancing ancilla qubits and Toffoli-depth, this paper proposes an optimized quantum circuit design for Camellia. Specifically: (1) using a serial-multiplication and out-of-place inversion architecture under composite-field decomposition, combined with hierarchical screening for parallelizing bilinear multiplications, a compact in-place S-box quantum circuit is constructed with a DW-cost of 276, 28% lower than the state of the art; (2) a low-gate-count linear-layer circuit is obtained via heuristic search, and gate-sequence reordering then reduces the full depth from 9 to 7 without increasing the gate count; (3) Camellia-128/192/256 quantum circuits are constructed with DW-costs of 119,168, 257,664, and 257,664, achieving reductions of 48%, 52%, and 52% respectively over prior work. A pipelined Grover oracle is further designed and the total resources required for a full Grover search attacking Camellia are evaluated. For Camellia-128, the complete Grover search requires a T-depth of 2.10 × 2⁷⁶ and a total TDW-cost (qubits × T-depth) of 1.00 × 2⁸⁶, reducing T-depth by 75% and TDW-cost by 84% over prior work. The first full Grover search resource estimates for Camellia-192/256 are also presented, with T-depths of 7.20 × 2¹⁰⁸ and 8.11 × 2¹⁴⁰ and TDW-costs of 2.03 × 2¹²³ and 2.79 × 2¹⁵³, respectively. These results show that Grover's attack on Camellia requires fewer quantum resources than on AES at the 128-bit level, implying comparatively weaker post-quantum security at that key size, while the picture reverses at larger key sizes (Section 4).
Grover search algorithm is the most representative quantum attack method that threatens the security of symmetric key cryptography. If the Grover search algorithm is applied to symmetric key cryptography, the security level of target symmetric key cryptography can be lowered from n-bit to n2-bit. When applying Grover’s search algorithm to the block cipher that is the target of potential quantum attacks, the target block cipher must be implemented as quantum circuits. Starting with the AES block cipher, a number of works have been conducted to optimize and implement target block ciphers into quantum circuits. Recently, many studies have been published to implement lightweight block ciphers as quantum circuits. In this paper, we present optimal quantum circuit designs of symmetric key cryptography, including PRESENT and GIFT block ciphers. The proposed method optimized PRESENT and GIFT block ciphers by minimizing qubits, quantum gates, and circuit depth. We compare proposed PRESENT and GIFT quantum circuits with other results of lightweight block cipher implementations in quantum circuits. Finally, quantum resources of PRESENT and GIFT block ciphers required for the oracle of the Grover search algorithm were estimated.