Abstract Due to its innovative and performance advantages, Prøst‐COPA and Prøst‐OTR have attracted widespread attention. For the Prøst‐COPA without associated data and with associated data, the corresponding quantum key recovery attacks are proposed using Simon's algorithm, respectively. In the first scenario, the messages are used to calculate the Message Authentication Code (MAC) and construct a period function to recover the secret parameter . Then, utilizing ciphertext, a periodic function is constructed with a periodic value equal to the key value. MAC is calculated from messages and the associated data in the second scenario. Considering the impact of the associated data on the periodicity of the function, the messages are treated as a constant and further construct two periodic functions to recover the secret parameter and the key. For Prøst‐OTR, by constructing two periodic functions using two tags with different numbers of message blocks, the secret parameter can be recovered, and then the key can be recovered using Simon's algorithm. Compared to the classical attacks, the quantum‐based methods only require quantum queries (where is the message block size), resulting in an exponential speed acceleration and the success probability of the method is close to 1. These methods also show a lower query complexity than the state‐of‐the‐art quantum methods.
Abstract Due to its innovative and performance advantages, Prøst‐COPA and Prøst‐OTR have attracted widespread attention. For the Prøst‐COPA without associated data and with associated data, the corresponding quantum key recovery attacks are proposed using Simon's algorithm, respectively. In the first scenario, the messages are used to calculate the Message Authentication Code (MAC) and construct a period function to recover the secret parameter . Then, utilizing ciphertext, a periodic function is constructed with a periodic value equal to the key value. MAC is calculated from messages and the associated data in the second scenario. Considering the impact of the associated data on the periodicity of the function, the messages are treated as a constant and further construct two periodic functions to recover the secret parameter and the key. For Prøst‐OTR, by constructing two periodic functions using two tags with different numbers of message blocks, the secret parameter can be recovered, and then the key can be recovered using Simon's algorithm. Compared to the classical attacks, the quantum‐based methods only require quantum queries (where is the message block size), resulting in an exponential speed acceleration and the success probability of the method is close to 1. These methods also show a lower query complexity than the state‐of‐the‐art quantum methods.
Classical forgery attacks against Offset Two-round (OTR) structures require some harsh conditions, such as some plaintext and ciphertext pairs need to be known, and the success probability is not too high. To solve these problems, a quantum forgery attack on OTR structure using Simon’s algorithm is proposed. The attacker intercepts the ciphertext-tag pair [Formula: see text] between the sender and receiver, while Simon’s algorithm is used to find the period of the tag generation function in OTR, then we can successfully forge new ciphertext [Formula: see text] ([Formula: see text]) for intercepted tag [Formula: see text]. For a variant of OTR structure (Prøst-OTR-Even-Mansour structure), a universal forgery attack, in which it is easy to generate the correct tag of any given message if the attacker is allowed to change a single block in it, is proposed. It first obtains the secret parameter [Formula: see text] using Simon’s algorithm, then the secret parameter [Formula: see text] is used to find the keys [Formula: see text] and [Formula: see text], so that an attacker can forge the changed messages. It only needs several plaintext blocks to help obtain the keys to forge any messages. Performance analysis shows that the query complexity of our attack is [Formula: see text], and its success probability is very close to 1.
Abstract Quantum attacks employing superposition queries (Q2 model) have been demonstrated to compromise numerous classically secure block-cipher constructions. These attacks embed the target encryption structure into a period-finding problem, which dedicated quantum algorithms, including the Simon and BV algorithms, can solve. After restoring the secret state, attackers can launch an attack by recovering the key (the secret state contains key information) or distinguishing it from random permutations. In this paper, we investigate the quantum security of Feistel-like ciphers in a related-key setting. For several constructions, we demonstrate how to define a periodic function that can be evaluated using the Simon algorithm with only O(n) O ( n ) quantum queries to the encryption oracle, where n represents the block size. This enables secret-state recovery attacks on Type-1/2 generalized Feistel schemes, as well as key-recovery attacks on the Feistel-FK and Misty L-KF constructions. All these attacks achieve an exponential reduction in query complexity compared to the best known classical or quantum methods.
Simon's algorithm is one of the most widely used quantum algorithms in cryptanalysis of symmetric ciphers, which has a significant advantage over its classical counterparts. However, if the number of unwanted collisions of the target function is large or if the number of adversary's quantum superposition queries is limited, the Simon's algorithm is not able to unambiguously compute the actual period. This problem can lead to the failure of period-finding-based quantum attacks. In this paper we first show that using Simon's algorithm, one can find proper partial periods of Boolean vector functions, such that the corresponding probabilities, independent of the target function, are directly related to the number of quantum queries. Next, we examine how to use the partial period instead of actual one in quantum period-finding-based attacks. As a result, the advantage of our proposed relaxing method is twofold: It improves success probabilities of quantum period-finding-based distinguishers, provided that the adversary is limited to a specified small number of queries, in contrast to the previous ones. On the other hand, our proposed method generalizes the previous forgery attacks on modes of operation for message authentication codes.
Block cryptanalysis has a major breakthrough in the model of superposition queries. For instance, Simon’s algorithm can efficiently break various constructions. In practice, Bernstein-Vaziran’s algorithm can also realize the periodic search of the vector function. Moreover, in some cases, it can have more advantages than the Simon’s algorithm.In the context of this study, we present an algorithm that combines Grover’s and Bernstein-Vazirani’s quantum algorithms. This algorithm empowers us to carry out key recovery attacks on Feistel structures. on Feistel structures, FX construction and Even Mansour construction. We exploit cryptosystems’ algebraic structure to launch successful key recovery attacks, considering that quantum attackers can only make classical queries. Through comparison, it can be concluded that this algorithm has stronger practicability in attacking block ciphers.
With the development of quantum technology, quantum computing has an increasingly significant impact on cryptanalysis. Several quantum algorithms, such as Simon’s algorithm, Grover’s algorithm, the Bernstein–Vazirani algorithm, Shor’s algorithm, and the Grover-meets-Simon algorithm, have been proposed successively. However, almost all cryptanalysis is based on the quantum chosen-plaintext attack (qCPA) model. This paper focuses on a powerful cryptanalytic model, quantum related-key attack (qRKA), and proposes a strategy of qRKAs against symmetric ciphers using Simon’s algorithm. We construct a periodic function to efficiently recover the secret key of symmetric ciphers if the attacked symmetric ciphers satisfy Simon’s promise, and present the complexity analysis on specific symmetric ciphers. Then, we apply qRKA to the Even–Mansour cipher and SoEM construction, recover their secret keys, and show their complexity comparison in the distinct attack models. This work is of great significance for the qRKA cryptanalysis of existing provably secure cryptographic schemes and the design of future quantum secure cryptographic schemes.
At present, quantum algorithm is a development direction of the early quantum algorithm in thinking. They are generally considered to be largely theoretical because the problems they solve are almost useless. In this paper, the applications of quantum algorithms in quantum key distribution, error correction, authentication and other fields are analyzed. Simon quantum algorithm benefits from the parallelism of quantum algorithms, and its fast finding function period property is used to construct a variety of attack forms, such as discrimination attack, key recovery attack, sliding attack, quantum forgery attack and so on. Simon algorithm uses register conversion to calculate the period in the process of key authentication, and applies this periodic feature to the interrogator in the process of key authentication, so as to achieve accurate key authentication.