Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Computer

An Overview and Concerns Related to Quantum Cryptanalysis: Past, Present, and Future

Subhamoy Maitra, Pantelimon Stănică

Published Sep 19, 2023• 1 citation
Publisher

Abstract

We outline the important quantum algorithms that are instrumental toward cryptanalysis of classical ciphers. Here we attempt to touch on the relevant security issues and explain certain (some low-level) technical points on the cryptographic primitives.
DOI
10.1109/mc.2023.3295611

Related papers

Recent developments and challenges of quantum cryptography

Jozef Gruska, Jan Bouda

Presentation of basic research directions and results of contemporary quantum cryptography.

•Jan 1, 2008•0 citations

Quantum Cryptanalysis: Evaluating the Impact of Shor’s and Grover’s Algorithms on Modern Encryption Standards

Mithal Hadi Jebur, Sumar Mohamed Khaleel

Motivated by Shor’s algorithm and its attractive features, the milestone results in quantum cryptanalysis were the discovery of quantum differential and linear cryptanalysis. In quantum cryptanalysis, quantum distinguishers imitate the classical setting. Details differ; however, as the distinguisher in the quantum setting can take maximum coset superposition of all possible subsets of plaintext pairs. Using quantum measurements, the winning gap of the game is exploited so that a distinguisher can still guess the secret key perfectly with a constant probability. Symmetric primitives also suffer reduced ideal security in the quantum world, but this security reduction is less drastic than for most asymmetric primitives. Stream ciphers, block ciphers, and cryptographic hash functions are primitives that are believed to resist quantum attacks. Analogs to Shor’s algorithm may say how hard it is to build a quantum computer, but devising quantum algorithms to outperform the best classical attacks for widely-used cryptographic primitives is probably outside the reach of current even if exponentially growing noisy intermediate-scale quantum (NISQ) computers.

CyberSystem journal.•Dec 31, 2025•3 citations

Analysing Existing Cryptographic Protocols, Quantum Key Distribution, and Post-quantum Cryptography to Enhance Security in the Quantum Computing World

Neha Junagade, Sheetal Umesh Bhandari, Rachana Y. Patil

Lecture notes in networks and systems•Oct 29, 2025•0 citations

Quantum impossible differential and truncated differential cryptanalysis

Huiqin Xie, Li Yang

Traditional cryptography is suffering a huge threat from the development of quantum computing. While many currently used public-key cryptosystems would be broken by Shor's algorithm, the effect of quantum computing on symmetric ones is still unclear. The security of symmetric ciphers relies heavily on the development of cryptanalytic tools. Thus, in order to accurately evaluate the security of symmetric primitives in the post-quantum world, it is significant to improve classical cryptanalytic methods using quantum algorithms. In this paper, we focus on two variants of differential cryptanalysis: truncated differential cryptanalysis and impossible differential cryptanalysis. Based on the fact that Bernstein-Vazirani algorithm can be used to find the linear structures of Boolean functions, we propose two quantum algorithms that can be used to find high-probability truncated differentials and impossible differentials of block ciphers, respectively. We rigorously prove the validity of the algorithms and analyze their complexity. Our algorithms treat all rounds of the reduced cipher as a whole and only concerns the input and output differences at its both ends, instead of specific differential characteristics. Therefore, to a certain extent, they alleviate the weakness of conventional differential cryptanalysis, namely the difficulties in finding differential characteristics as the number of rounds increases.

arXiv:1712.06997•Dec 18, 2017•4 citations

Security Against Attacks to Cryptographic Algorithms by Quantum Computer – And Why Multiple Different Solutions Are Needed

Stefan Röhrich

This work describes and compares different ways to protect your systems against attacks by quantum computers. The comparison is done from a security and an implementation point of view.

NATO science for peace and security series. D, Information and communication security•Feb 19, 2024•0 citations

Quantum Differential and Linear Cryptanalysis

Marc Kaplan, Gaëtan Leurent, Anthony Leverrier +1 more

Quantum computers, that may become available one day, would impact many scientific fields, most notably cryptography since many asymmetric primitives are insecure against an adversary with quantum capabilities. Cryptographers are already anticipating this threat by proposing and studying a number of potentially quantum-safe alternatives for those primitives. On the other hand, symmetric primitives seem less vulnerable against quantum computing: the main known applicable result is Grover’s algorithm that gives a quadratic speed-up for exhaustive search. In this work, we examine more closely the security of symmetric ciphers against quantum attacks. Since our trust in symmetric ciphers relies mostly on their ability to resist cryptanalysis techniques, we investigate quantum cryptanalysis techniques. More specifically, we consider quantum versions of differential and linear cryptanalysis. We show that it is usually possible to use quantum computations to obtain a quadratic speed-up for these attack techniques, but the situation must be nuanced: we don’t get a quadratic speed-up for all variants of the attacks. This allows us to demonstrate the following non-intuitive result: the best attack in the classical world does not necessarily lead to the best quantum one. We give some examples of application on ciphers LAC and KLEIN. We also discuss the important difference between an adversary that can only perform quantum computations, and an adversary that can also make quantum queries to a keyed primitive.

arXiv:1510.05836•IACR Transactions on Symmetric Cryptology•Dec 1, 2016•27 citations
Motivated by Shor’s algorithm and its attractive features, the milestone results in quantum cryptanalysis were the discovery of quantum differential and linear cryptanalysis. In quantum cryptanalysis, quantum distinguishers imitate the classical setting. Details differ; however, as the distinguisher in the quantum setting can take maximum coset superposition of all possible subsets of plaintext pairs. Using quantum measurements, the winning gap of the game is exploited so that a distinguisher can still guess the secret key perfectly with a constant probability. Symmetric primitives also suffer reduced ideal security in the quantum world, but this security reduction is less drastic than for most asymmetric primitives. Stream ciphers, block ciphers, and cryptographic hash functions are primitives that are believed to resist quantum attacks. Analogs to Shor’s algorithm may say how hard it is to build a quantum computer, but devising quantum algorithms to outperform the best classical attacks for widely-used cryptographic primitives is probably outside the reach of current even if exponentially growing noisy intermediate-scale quantum (NISQ) computers.
Traditional cryptography is suffering a huge threat from the development of quantum computing. While many currently used public-key cryptosystems would be broken by Shor's algorithm, the effect of quantum computing on symmetric ones is still unclear. The security of symmetric ciphers relies heavily on the development of cryptanalytic tools. Thus, in order to accurately evaluate the security of symmetric primitives in the post-quantum world, it is significant to improve classical cryptanalytic methods using quantum algorithms. In this paper, we focus on two variants of differential cryptanalysis: truncated differential cryptanalysis and impossible differential cryptanalysis. Based on the fact that Bernstein-Vazirani algorithm can be used to find the linear structures of Boolean functions, we propose two quantum algorithms that can be used to find high-probability truncated differentials and impossible differentials of block ciphers, respectively. We rigorously prove the validity of the algorithms and analyze their complexity. Our algorithms treat all rounds of the reduced cipher as a whole and only concerns the input and output differences at its both ends, instead of specific differential characteristics. Therefore, to a certain extent, they alleviate the weakness of conventional differential cryptanalysis, namely the difficulties in finding differential characteristics as the number of rounds increases.
Quantum computers, that may become available one day, would impact many scientific fields, most notably cryptography since many asymmetric primitives are insecure against an adversary with quantum capabilities. Cryptographers are already anticipating this threat by proposing and studying a number of potentially quantum-safe alternatives for those primitives. On the other hand, symmetric primitives seem less vulnerable against quantum computing: the main known applicable result is Grover’s algorithm that gives a quadratic speed-up for exhaustive search. In this work, we examine more closely the security of symmetric ciphers against quantum attacks. Since our trust in symmetric ciphers relies mostly on their ability to resist cryptanalysis techniques, we investigate quantum cryptanalysis techniques. More specifically, we consider quantum versions of differential and linear cryptanalysis. We show that it is usually possible to use quantum computations to obtain a quadratic speed-up for these attack techniques, but the situation must be nuanced: we don’t get a quadratic speed-up for all variants of the attacks. This allows us to demonstrate the following non-intuitive result: the best attack in the classical world does not necessarily lead to the best quantum one. We give some examples of application on ciphers LAC and KLEIN. We also discuss the important difference between an adversary that can only perform quantum computations, and an adversary that can also make quantum queries to a keyed primitive.