Abstract A significant amount of study is being done to review the security promises made for the various ciphers now in use as a result of the development of quantum computing technology. A general attack against symmetric key cryptography primitives that can reduce search costs to the square root is Grover's search algorithm. To implement Grover's algorithm, it is necessary that the target cipher be implemented as a quantum circuit. Despite being relatively new, this area of study has received significant attention from the research community. The authors have estimated the cost of Grover's key search attack against the stream cipher Atom, for the first time, under circuit depth restrictions defined in National Institute of Standards and Technology (NIST) PQC standardisation process. The authors implement the quantum circuit of Atom in QISKIT, (open‐source software development kit for working with quantum computers running on IBM Quantum Experience). The results are also compared with other existing literature on LFSR‐based stream ciphers, such as Grain‐v1, Grain‐128‐AEAD, and Lizard. The authors also find that, to the best of their knowledge, in the existing literature on estimating the cost of Grover's attack on symmetric ciphers, Atom is the only 128‐bit key cipher that meets the threshold of ≈2 170 set by NIST for quantum security of 128‐bit key ciphers. The authors also analyse the security of Atom against quantum TMDTO attacks.
Abstract A significant amount of study is being done to review the security promises made for the various ciphers now in use as a result of the development of quantum computing technology. A general attack against symmetric key cryptography primitives that can reduce search costs to the square root is Grover's search algorithm. To implement Grover's algorithm, it is necessary that the target cipher be implemented as a quantum circuit. Despite being relatively new, this area of study has received significant attention from the research community. The authors have estimated the cost of Grover's key search attack against the stream cipher Atom, for the first time, under circuit depth restrictions defined in National Institute of Standards and Technology (NIST) PQC standardisation process. The authors implement the quantum circuit of Atom in QISKIT, (open‐source software development kit for working with quantum computers running on IBM Quantum Experience). The results are also compared with other existing literature on LFSR‐based stream ciphers, such as Grain‐v1, Grain‐128‐AEAD, and Lizard. The authors also find that, to the best of their knowledge, in the existing literature on estimating the cost of Grover's attack on symmetric ciphers, Atom is the only 128‐bit key cipher that meets the threshold of ≈2 170 set by NIST for quantum security of 128‐bit key ciphers. The authors also analyse the security of Atom against quantum TMDTO attacks.
Extensive research is currently underway to determine the security of existing ciphers in light of the advancements in quantum computing. Against symmetric key cryptography, Grover’s search algorithm is a prominent attack, capable of reducing search costs to the square root. For using Grover’s algorithm, it is imperative to embed the target cipher into a quantum circuit. Even so, this area of research is relatively new; it has garnered significant attention from the research community. In this study, we provide the first estimation of the cost of Grover’s key search attack against the AES-based AEAD schemes Rocca-S, AEGIS-128, and Tiaoxin-346. Our analysis considers circuit depth restrictions specified in NIST’s PQC standardization process. Considering NIST’s maximum depth constraints, We present the overall cost of these attacks using gate count and depth-times-width metrics. We observed that for MAXDEPTH=240 , Rocca-S, AEGIS-128, and Tiaoxin-346 can be retrieved using Grover’s search algorithm with gate count of 1.09 × 2253, 1.14 × 2124, and 1.22 × 2124 respectively. Concerning the current updated values by NIST, these ciphers are secure in terms of the cost of implementing Grover’s attack for key recovery. The quantum circuits of these ciphers are implemented using QISKIT, an open-source software development kit (SDK) designed for working with quantum computers running on the IBM Quantum Experience platform.
NIST(National Institute of Standards and Technology) estimates the Grover key search cost required for symmetric key cryptography as the postquantum security strength. The Grover search algorithm is applicable to key recovery in symmetric key cryptography, and for this, the target encryption process must be implemented as a quantum circuit. In this paper, we present an optimized implementation of Simplified AES as a quantum circuit. Substitution, Mix Columns, and Key Expansion are implemented efficiently, and as a result of resource analysis, qubits, quantum gates, and circuit depth are significantly reduced compared to the previous result.
In this paper, we propose a quantum circuit for the SPEEDY block cipher for the first time and estimate its security strength based on the post-quantum security strength presented by NIST. The strength of post-quantum security for symmetric key cryptography is estimated at the cost of the Grover key retrieval algorithm. Grover’s algorithm in quantum computers reduces the n-bit security of block ciphers to n2 bits. The implementation of a quantum circuit is required to estimate the Grover’s algorithm cost for the target cipher. We estimate the quantum resource required for Grover’s algorithm by implementing a quantum circuit for SPEEDY in an optimized way and show that SPEEDY provides either 128-bit security (i.e., NIST security level 1) or 192-bit security (i.e., NIST security level 3) depending on the number of rounds. Based on our estimated cost, increasing the number of rounds is insufficient to satisfy the security against quantum attacks on quantum computers.
Grover search algorithm is the most representative quantum attack method that threatens the security of symmetric key cryptography. If the Grover search algorithm is applied to symmetric key cryptography, the security level of target symmetric key cryptography can be lowered from n-bit to n2-bit. When applying Grover’s search algorithm to the block cipher that is the target of potential quantum attacks, the target block cipher must be implemented as quantum circuits. Starting with the AES block cipher, a number of works have been conducted to optimize and implement target block ciphers into quantum circuits. Recently, many studies have been published to implement lightweight block ciphers as quantum circuits. In this paper, we present optimal quantum circuit designs of symmetric key cryptography, including PRESENT and GIFT block ciphers. The proposed method optimized PRESENT and GIFT block ciphers by minimizing qubits, quantum gates, and circuit depth. We compare proposed PRESENT and GIFT quantum circuits with other results of lightweight block cipher implementations in quantum circuits. Finally, quantum resources of PRESENT and GIFT block ciphers required for the oracle of the Grover search algorithm were estimated.
“Grover's Algorithm: Quantum Search” explores Grover's Algorithm in the context of quantum search, beginning with an overview of its mechanics. The section includes a literature survey that covers Grover's algorithm, stream ciphers, and the Grover attack, as well as quantum resource estimation. The section then introduces a simplified 4-bit Grain cipher (with a 4-bit key and 4-bit IV), detailing its design, initialization, and key stream generation. Following this, the chapter discusses about key recovery using Grover's algorithm, with an emphasis on quantum circuit development for the simplified Grain 4-bit cipher. It outlines key steps in the circuit, such as executing the Boolean function and XORing the NFSR's fourth bit. Further, the section details the development of a Grover attack quantum circuit, describing both single and double pair methods. Experimental results are provided across multiple cases, with a summary of test cases and classical computation times. Quantum resource estimation, including the costs associated with the simplified Grain 4-bit cipher and the Grover oracle, is analyzed. The section concludes with a discussion on the results, classical and quantum resource estimations, and the potential for future enhancements to the approach.
The progression of quantum computing is considered a potential threat to traditional cryptography system, highlighting the significance of post-quantum security in cryptographic systems. Regarding symmetric key encryption, the Grover algorithm can approximately halve the search complexity. Despite the absence of fully operational quantum computers at present, the necessity of assessing the security of symmetric key encryption against quantum computing continues to grow.In this paper, we implement the ARIA block cipher in a quantum circuit and compare it with previous research. Our implementation of the ARIA quantum circuit achieves over 92.5% improvement in full depth and over 98.7% improvement in Toffoli depth compared to the implementation proposed in Chauhan et al. Compared to Yang et al.’s implementation, our implementation is improved the full depth by 36.7% and the number of qubits by 8%. Additionally, we analyze the complexity of Grover’s search attack and compare it with NIST criteria. We confirm that ARIA achieves quantum security level 1, 3, and 5 (ARIA-128, 192, and 256, respectively).