Abstract QSimon algorithm (a full quantum version of Simon's algorithm) is used to find periods in commitment functions and does not require classical calculations. However, QSimon algorithm circuit is incomplete, and the implementation of an essential component (solving boolean linear equations) has high resource consumption. This work further studies QSimon algorithm and applies QSimon algorithm to attack the offset two‐round (OTR) scheme. QSimon algorithm is established by quantum boolean linear equations solving algorithm and general quantum truncation technique, which can obtain the period of any truncated function with overwhelming probability. The confidentiality and integrity of the OTR scheme are compromised by employing QSimon algorithm. The attacks ensure a high success rate and realize exponential speedup compared with classical versions.
Abstract QSimon algorithm (a full quantum version of Simon's algorithm) is used to find periods in commitment functions and does not require classical calculations. However, QSimon algorithm circuit is incomplete, and the implementation of an essential component (solving boolean linear equations) has high resource consumption. This work further studies QSimon algorithm and applies QSimon algorithm to attack the offset two‐round (OTR) scheme. QSimon algorithm is established by quantum boolean linear equations solving algorithm and general quantum truncation technique, which can obtain the period of any truncated function with overwhelming probability. The confidentiality and integrity of the OTR scheme are compromised by employing QSimon algorithm. The attacks ensure a high success rate and realize exponential speedup compared with classical versions.
Classical forgery attacks against Offset Two-round (OTR) structures require some harsh conditions, such as some plaintext and ciphertext pairs need to be known, and the success probability is not too high. To solve these problems, a quantum forgery attack on OTR structure using Simon’s algorithm is proposed. The attacker intercepts the ciphertext-tag pair [Formula: see text] between the sender and receiver, while Simon’s algorithm is used to find the period of the tag generation function in OTR, then we can successfully forge new ciphertext [Formula: see text] ([Formula: see text]) for intercepted tag [Formula: see text]. For a variant of OTR structure (Prøst-OTR-Even-Mansour structure), a universal forgery attack, in which it is easy to generate the correct tag of any given message if the attacker is allowed to change a single block in it, is proposed. It first obtains the secret parameter [Formula: see text] using Simon’s algorithm, then the secret parameter [Formula: see text] is used to find the keys [Formula: see text] and [Formula: see text], so that an attacker can forge the changed messages. It only needs several plaintext blocks to help obtain the keys to forge any messages. Performance analysis shows that the query complexity of our attack is [Formula: see text], and its success probability is very close to 1.
Abstract Due to its innovative and performance advantages, Prøst‐COPA and Prøst‐OTR have attracted widespread attention. For the Prøst‐COPA without associated data and with associated data, the corresponding quantum key recovery attacks are proposed using Simon's algorithm, respectively. In the first scenario, the messages are used to calculate the Message Authentication Code (MAC) and construct a period function to recover the secret parameter . Then, utilizing ciphertext, a periodic function is constructed with a periodic value equal to the key value. MAC is calculated from messages and the associated data in the second scenario. Considering the impact of the associated data on the periodicity of the function, the messages are treated as a constant and further construct two periodic functions to recover the secret parameter and the key. For Prøst‐OTR, by constructing two periodic functions using two tags with different numbers of message blocks, the secret parameter can be recovered, and then the key can be recovered using Simon's algorithm. Compared to the classical attacks, the quantum‐based methods only require quantum queries (where is the message block size), resulting in an exponential speed acceleration and the success probability of the method is close to 1. These methods also show a lower query complexity than the state‐of‐the‐art quantum methods.
In recent years, some general cryptographic technologies have been widely used in network platforms related to the national economy and people’s livelihood, effectively curbing network security risks and maintaining the orderly operation and normal order of society. However, due to the fast development and considerable benefits of quantum computing, the classical cryptosystem faces serious security threats, so it is crucial to analyze and assess the anti-quantum computing ability of cryptographic algorithms under the quantum security model, to enhance or perfect the design defects of related algorithms. However, the current design and research of anti-quantum cryptography primarily focus on the cryptographic structure or working mode under the quantum security model, and there is a lack of quantum security analysis on instantiated cryptographic algorithms. This paper investigates the security of AES-OTR, one of the third-round algorithms in the CAESAR competition, under the Q2 model. The periodic functions of the associated data were constructed by forging the associated data according to the parallel and serial structure characteristics of the AES-OTR algorithm in processing the associated data, and the periodic functions of the associated data were constructed multiple times based on the Simon quantum algorithm. By using the collision pair, two collision forgery attacks on the AES-OTR algorithm can be successfully implemented, and the period s is obtained by solving with a probability close to 1. The attacks in this paper caused a significant threat to the security of the AES-OTR algorithm.
Simon's algorithm is one of the most widely used quantum algorithms in cryptanalysis of symmetric ciphers, which has a significant advantage over its classical counterparts. However, if the number of unwanted collisions of the target function is large or if the number of adversary's quantum superposition queries is limited, the Simon's algorithm is not able to unambiguously compute the actual period. This problem can lead to the failure of period-finding-based quantum attacks. In this paper we first show that using Simon's algorithm, one can find proper partial periods of Boolean vector functions, such that the corresponding probabilities, independent of the target function, are directly related to the number of quantum queries. Next, we examine how to use the partial period instead of actual one in quantum period-finding-based attacks. As a result, the advantage of our proposed relaxing method is twofold: It improves success probabilities of quantum period-finding-based distinguishers, provided that the adversary is limited to a specified small number of queries, in contrast to the previous ones. On the other hand, our proposed method generalizes the previous forgery attacks on modes of operation for message authentication codes.
Abstract Many quantum algorithms for attacking symmetric cryptography involve the rank problem of quantum linear equations. In this paper, two quantum algorithms are proposed to solve quantum linear systems of equations with coherent superposition, and their specific quantum circuits are constructed. In contrast to previous related studies, our quantum algorithms are universal, computing both the rank and general solution by one measurement. The difference between them is whether the data register containing the quantum coefficient matrix can be disentangled from the other registers while keeping the data qubits unchanged. On this basis, the two quantum algorithms are applied as subroutines to parallel Simon’s algorithm (with multiple periods), Grover Meets Simon algorithm, and Alg-PolyQ2 algorithm. Subsequently, a quantum classifier within Grover Meets Simon algorithm and a detailed test oracle within Alg-PolyQ2 algorithms are constructed, including their respective quantum circuits. To the best of our knowledge, no such specific analysis has been previously performed. The success probability of these algorithms is rigorously analyzed to ensure that the probability of success on the proposed quantum algorithms will not be lower than that of the original algorithms. Finally, we discuss the lower bound of the number of controlled-NOT gates for solving quantum linear systems of equations with coherent superposition. Our analysis indicates that the proposed algorithms are suitable for conducting attacks against lightweight symmetric ciphers within the effective working time of an ion-trap quantum computer.
Simon's algorithm is a polynomial period-finding algorithm that has been used to exploit the algebraic structure of specific symmetric ciphers, showing that exponential speedups in their cryptanalysis are theoretically possible. While the theoretical framework for an attack using Simon's algorithm on the Even-Mansour cipher is well-established, practical implementations on noisy intermediate-scale quantum (NISQ) hardware remain limited. This paper presents a proof of concept quantum cryptanalysis of the Even-Mansour cipher using Simon's period-finding algorithm on NISQ hardware. For N = 3 and N = 4, we successfully demonstrate secret key recovery for N-bit constructions on the ibm_miami processor. Our experiments also identify a scaling limitation in the classical pre-processing stage: The DORCIS circuit optimization tool encountered a memory bottleneck at N = 5, preventing the generation of optimized circuits for larger key lengths. Our results suggest firstly that Simon's algorithm is effective for the Even-Mansour cipher for short bit lengths on current quantum hardware. Secondly, while DORCIS is effective for the small-scale S-boxes for which it was designed, there remains a need for the investigation of more scalable and efficient synthesis tools capable of handling larger and more general permutations in the context of Even-Mansour ciphers.