Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Lecture notes in computer science

Automatic Quantum Multi-collision Distinguishers and Rebound Attacks with Triangulation Algorithm

Zhenzhen Bao, Jian Guo, Shun Li, Phuong Pham

Published Jan 1, 2024• 3 citations
Publisher
DOI
10.1007/978-981-97-5028-3_2

Related papers

Quantum Multi-Collision Distinguishers.

Zhenzhen Bao, Jian Guo, Shun Li +1 more

•Jan 1, 2021•3 citations

Anonymous collision detection for practical quantum networks

Wangsheng Zheng, Beili Gong

Physics Letters A•Sep 6, 2024•2 citations

Quantum Free-Start Collision Attacks on Double Block Length Hashing with Round-Reduced AES-256

Amit Kumar Chauhan, Abhishek Kumar, Somitra Kumar Sanadhya

Recently, Hosoyamada and Sasaki (EUROCRYPT 2020), and Xiaoyang Dong et al. (ASIACRYPT 2020) proposed quantum collision attacks against AES-like hashing modes AES-MMO and AES-MP. Their collision attacks are based on the quantum version of the rebound attack technique exploiting the differential trails whose probabilities are too low to be useful in the classical setting but large enough in the quantum setting. In this work, we present dedicated quantum free-start collision attacks on Hirose’s double block length compression function instantiated with AES-256, namely HCF-AES-256. The best publicly known classical attack against HCF-AES-256 covers up to 9 out of 14 rounds. We present a new 10-round differential trail for HCF-AES-256 with probability 2−160, and use it to find collisions with a quantum version of the rebound attack. Our attack succeeds with a time complexity of 285.11 and requires 216 qRAM in the quantum-attack setting, where an attacker can make only classical queries to the oracle and perform offline computations. We also present a quantum free-start collision attack on HCF-AES-256 with a time complexity of 286.07 which outperforms Chailloux, Naya-Plasencia, and Schrottenloher’s generic quantum collision attack (ASIACRYPT 2017) in a model when large qRAM is not available.

IACR Transactions on Symmetric Cryptology•Mar 19, 2021•14 citations

Quantum algorithm to compute particle collisions

Physics Today•Jun 4, 2012•0 citations

Improved Quantum Rebound Attacks on Double Block Length Hashing with Round-Reduced AES-256 and ARIA-256

Dongjae Lee, Seokhie Hong

At EUROCRYPT 2020, Hosoyamada and Sasaki proposed the first dedicated quantum collision attacks on hash functions. Their proposal presented a quantum adaptation of the rebound attack and revealed that differential trails, which have too low probability for use in classical settings, might be exploitable in quantum settings. After their work, subsequent research has actively delved into analyzing the security of hash functions in the quantum setting.In this paper, we revisit the quantum rebound attacks on the double block hash function Hirose instantiated with 10-round AES-256 (HCF-AES-256) and 7-round ARIA-256 (HCF-ARIA-256) proposed by Chauhan et al. and Baek et al., respectively. Initially, we identify the flaws in their work and reevaluate the complexity of the attacks. We reveal that the flaws stem from not considering the issue that the S-box differential equation has one solution on average. Earlier research addressed this problem by adding auxiliary bits to the search space. If this method is used to correct the flaws, the resulting time complexities are 217.36 and 220.94 times higher than their proposals. Consequently, in some settings, their attacks become less efficient than generic attacks.Subsequently, we propose improved quantum rebound attacks using nested quantum amplitude amplification and quantum state preparation. Our improved attack efficiently pre-filters the search space, leading to a reduction in overall time complexity. We first classically reduce the search space and employ quantum state preparation to generate a superposition state over the pre-filtered search space. We then use nested quantum amplitude amplification to further reduce the search space quantumly. As a result, we achieve a reduction in the time complexity of the quantum rebound attacks on HCF-AES-256 and HCF-ARIA-256 by factors of 211.2 and 219.5, respectively, making the attacks more efficient than generic attacks again.

IACR Transactions on Symmetric Cryptology•Sep 6, 2024•1 citation

Quantum Differential Collision Distinguishing Attacks on Feistel Schemes

ZHANG Zhongya, Wenling Wu, WANG Bolin

Feistel schemes are important components of symmetric ciphers, which have been extensively studied in the classical setting. We examine the extension methods of differential distinguishers of Feistel key-function and Feistel function-key schemes. The schemes are subjected to quantum differential collision distinguishing attacks based on the methods. The results show that the complexity is lower than that of differential attacks using only Grover algorithm, and the complexity of differential collision attack based on the Brassard-Høyer-Tapp and Grover algorithms is lower than that of quantization when using only the Grover algorithm. The results also show that different algorithms and methods can be combined to produce a more effective cryptanalysis approach. This provides a research direction for post-quantum cryptographic analysis and design.

Chinese Journal of Electronics•Nov 1, 2021•3 citations
Recently, Hosoyamada and Sasaki (EUROCRYPT 2020), and Xiaoyang Dong et al. (ASIACRYPT 2020) proposed quantum collision attacks against AES-like hashing modes AES-MMO and AES-MP. Their collision attacks are based on the quantum version of the rebound attack technique exploiting the differential trails whose probabilities are too low to be useful in the classical setting but large enough in the quantum setting. In this work, we present dedicated quantum free-start collision attacks on Hirose’s double block length compression function instantiated with AES-256, namely HCF-AES-256. The best publicly known classical attack against HCF-AES-256 covers up to 9 out of 14 rounds. We present a new 10-round differential trail for HCF-AES-256 with probability 2−160, and use it to find collisions with a quantum version of the rebound attack. Our attack succeeds with a time complexity of 285.11 and requires 216 qRAM in the quantum-attack setting, where an attacker can make only classical queries to the oracle and perform offline computations. We also present a quantum free-start collision attack on HCF-AES-256 with a time complexity of 286.07 which outperforms Chailloux, Naya-Plasencia, and Schrottenloher’s generic quantum collision attack (ASIACRYPT 2017) in a model when large qRAM is not available.
At EUROCRYPT 2020, Hosoyamada and Sasaki proposed the first dedicated quantum collision attacks on hash functions. Their proposal presented a quantum adaptation of the rebound attack and revealed that differential trails, which have too low probability for use in classical settings, might be exploitable in quantum settings. After their work, subsequent research has actively delved into analyzing the security of hash functions in the quantum setting.In this paper, we revisit the quantum rebound attacks on the double block hash function Hirose instantiated with 10-round AES-256 (HCF-AES-256) and 7-round ARIA-256 (HCF-ARIA-256) proposed by Chauhan et al. and Baek et al., respectively. Initially, we identify the flaws in their work and reevaluate the complexity of the attacks. We reveal that the flaws stem from not considering the issue that the S-box differential equation has one solution on average. Earlier research addressed this problem by adding auxiliary bits to the search space. If this method is used to correct the flaws, the resulting time complexities are 217.36 and 220.94 times higher than their proposals. Consequently, in some settings, their attacks become less efficient than generic attacks.Subsequently, we propose improved quantum rebound attacks using nested quantum amplitude amplification and quantum state preparation. Our improved attack efficiently pre-filters the search space, leading to a reduction in overall time complexity. We first classically reduce the search space and employ quantum state preparation to generate a superposition state over the pre-filtered search space. We then use nested quantum amplitude amplification to further reduce the search space quantumly. As a result, we achieve a reduction in the time complexity of the quantum rebound attacks on HCF-AES-256 and HCF-ARIA-256 by factors of 211.2 and 219.5, respectively, making the attacks more efficient than generic attacks again.
Feistel schemes are important components of symmetric ciphers, which have been extensively studied in the classical setting. We examine the extension methods of differential distinguishers of Feistel key-function and Feistel function-key schemes. The schemes are subjected to quantum differential collision distinguishing attacks based on the methods. The results show that the complexity is lower than that of differential attacks using only Grover algorithm, and the complexity of differential collision attack based on the Brassard-Høyer-Tapp and Grover algorithms is lower than that of quantization when using only the Grover algorithm. The results also show that different algorithms and methods can be combined to produce a more effective cryptanalysis approach. This provides a research direction for post-quantum cryptographic analysis and design.