Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Mathematics

Quantum Chosen-Cipher Attack on Camellia

Yanjun Li, Qi Wang, Dingyun Huang, Jian Liu, Huiqin Xie

Published Apr 24, 2025• 0 citations
Publisher

Abstract

The Feistel structure represents a fundamental architectural component within the domain of symmetric cryptographic algorithms, with a substantial body of research conducted within the context of classical computing environments. Nevertheless, research into specific symmetric cryptographic algorithms utilizing the Feistel structure is relatively scarce in quantum computing environments. This paper, for the first time, proposes a five-round distinguisher for Camellia under the quantum chosen-ciphertext attack (qCCA) setting, with its effectiveness empirically validated. Additionally, by combining Grover’s algorithm and Simon’s algorithm, we construct a nine-round key-recovery attack model against Camellia. Through an in-depth analysis of Camellia’s key expansion algorithm, we significantly reduce the complexity of the key-recovery attack. The proposed attack achieves a time complexity of 261.5 for recovering the correct key bits and requires 531 quantum bits.

DOI
10.3390/math13091383

Related papers

A new quantum cryptanalysis method on block cipher Camellia

Yanjun Li, Hao Lin, Meng Liang +1 more

Abstract Symmetric cryptography is expected to be quantum safe when long‐term security is needed. Kuwakado and Morii gave a 3‐round quantum distinguisher of the Feistel cipher based on Simon's algorithm. However, the quantum distinguisher without considering the specific structure of the round function is not accurate enough. A new quantum cryptanalysis method for Feistel structure is studied here. It can make full use of the specific structure of the round function. The properties of Camellia round function and its linear transformation P are taken into account, and a 5‐round quantum distinguisher is proposed. Then, the authors follow a key‐recovery attack framework by Leander and May, that is, Grover‐meet‐Simon algorithm, and give a quantum key‐recovery attack on 7‐round Camellia in Q2 model with the time complexity of 2 24 . It is the very first time that the specific structure of the round function is used to improve quantum attack on Camellia.

IET Information Security•Jul 6, 2021•5 citations

Quantum Cryptanalysis on Two Feistel-Type Constructions

Yan-Ying Zhu, Bin-Bin Cai, Fei Gao +1 more

With the rapid advancement of quantum computing, the security of traditional cryptographic systems is facing significant challenges. As a fundamental component of symmetric cryptography, block ciphers have attracted increasing attention regarding their quantum security in recent years. In this paper, we propose new quantum attacks on two Feistel-type constructions, i.e., New Structure IV and the lightweight block cipher LBlock, under the quantum chosen-plaintext attack (qCPA) model. First, we construct an 8-round quantum distinguisher for New Structure IV and perform an $r(r>12)$-round quantum key-recovery attack. Compared with Li et al.'s qCPA-based result presented at INSCRYPT 2024, our attack reduces the time complexity by a factor of $2^{n/2}$, where $n$ denotes the subkey length. Second, we design a 9-round quantum distinguisher for LBlock and extend it to an $r(r>15)$-round quantum key-recovery attack. The proposed quantum distinguisher covers one more round than Liu et al.'s automated-search distinguisher at ASIACRYPT 2025, which results in a $2^{16}$ reduction in the time complexity of our $r$-round quantum key-recovery attack on LBlock. Furthermore, by analyzing the structure of the round function and the key scheduling of LBlock, we reduce the subkey guess space for the 15-round attack from 76 bits to 52 bits, lowering the time complexity from \(O(2^{38})\) to \(O(2^{26})\) by a factor of \(2^{12}\).

quant-pharXiv:2610.27506•Oct 21, 2026•0 citations

Quantum related-key attacks on Feistel-like ciphers

Hong-Wei Sun, Long Zhang, Dandan Li +3 more

Abstract Quantum attacks employing superposition queries (Q2 model) have been demonstrated to compromise numerous classically secure block-cipher constructions. These attacks embed the target encryption structure into a period-finding problem, which dedicated quantum algorithms, including the Simon and BV algorithms, can solve. After restoring the secret state, attackers can launch an attack by recovering the key (the secret state contains key information) or distinguishing it from random permutations. In this paper, we investigate the quantum security of Feistel-like ciphers in a related-key setting. For several constructions, we demonstrate how to define a periodic function that can be evaluated using the Simon algorithm with only $O(n)$ O ( n ) quantum queries to the encryption oracle, where n represents the block size. This enables secret-state recovery attacks on Type-1/2 generalized Feistel schemes, as well as key-recovery attacks on the Feistel-FK and Misty L-KF constructions. All these attacks achieve an exponential reduction in query complexity compared to the best known classical or quantum methods.

EPJ Quantum Technology•Feb 17, 2026•1 citation

Improved quantum attack on several generalized unbalanced Feistel structures

Kun Zou, Xinfeng Dong, Zhang Fuzhong

By studying the attack technology based on Simon, Grover and other quantum algorithms for the security of block cipher structure, this paper proposes new quantum attack on 6 generalized unbalanced Feistel structures. We improve the attack results of n-cell structure, New Structure I/III/IV structure and FBC-like structure, and give a quantum attack on Skipjack structure for the first time. Based on Simon algorithm, this paper constructs a n2-round, a 12/12/6-round and a 4-round quantum distinguisher about n-cell structure, New structure I/III/IV and FBC-like structure, improving n2-n-1 rounds, 6 rounds/3 rounds/1 round and 1 round separately, comparing to the previous results. In addition, this paper also constructs a 9-round quantum distinguisher about Skipjack structure. Moreover, this paper proposes a quantum key recovery attack on the above six structures in combination with Grover algorithm, and the time complexities of attacks are analyzed.

International Conference on Networks, Communications and Information Technology (CNCIT)•Jun 1, 2022•7 citations

The construction of quantum distinguishers for GFS based on Simon’s algorithm

Chengdong Ma, Jie Guan, Tairong Shi +1 more

With the application of quantum algorithms in cryptanalysis keeping increasing. Currently, there are many works based on Simon’s algorithm for generalized Feistel scheme (GFS), mostly using manual derivation to construct periodic functions. We present the functional form of the output component’s algebraic expression. Then we propose the transformation rules of functional form of algebraic expression through round function. Afterwards, we present an algorithm to find GFS’s longest round distinguishers based on Simon’s algorithm. Based on this, we get quantum distinguishers of Type-1 GFS, Type-2 GFS and Type-3 GFS under quantum chosen plaintext attack (qCPA) setting and quantum chosen ciphertext attack (qCCA) setting. For Type-1 GFS, the longest round quantum distinguisher based on Simon’s algorithm is unique under qCPA/qCCA setting, which is [Formula: see text]-round/[Formula: see text]-round. For [Formula: see text]-branch Type-2 GFS, [Formula: see text] kinds of [Formula: see text]-round distinguishers have been found under qCPA/qCCA setting. For Type-3 GFS, the longest round distinguisher based on Simon’s algorithm is unique under qCPA/qCCA setting, which is [Formula: see text]-round/3-round.

International Journal of Quantum Information•Sep 12, 2025•0 citations

Efficient Quantum Generic Key-Recovery Attack on Feistel Ciphers

Kun Zhang, Tao Shang, Yuanjing Zhang

The development of post-quantum cryptography requires cryptographic primitives that remain secure against quantum adversaries. Quantum key-recovery attacks constitute a fundamental class of quantum cryptanalytic techniques, and the resistance of a cryptosystem to such attacks serves as an important indicator of its overall security. Since the Feistel structure is a core component in the design of many block ciphers, efficient quantum key-recovery attacks on Feistel ciphers provide valuable insights into evaluating and strengthening their security. In this paper, we propose an efficient generic quantum key-recovery attack on Feistel ciphers. Our attack integrates universal hash families with Simon's and Grover's algorithms to perform key-recovery. We rigorously analyze the correctness of the proposed attack and derive its time and quantum resource complexities. A comprehensive comparison with existing keyrecovery attacks shows that the proposed approach improves both quantum resource usage and dominant query complexity, and therefore yields a more efficient quantum key-recovery attack. Our work enhances the understanding of Feistel ciphers under quantum threats and informs the design of robust cryptosystems for the post-quantum era.

International Conference on Quantum Communications, Networking, and Computing (QCNC)•Apr 6, 2026•0 citations
The Feistel structure represents a fundamental architectural component within the domain of symmetric cryptographic algorithms, with a substantial body of research conducted within the context of classical computing environments. Nevertheless, research into specific symmetric cryptographic algorithms utilizing the Feistel structure is relatively scarce in quantum computing environments. This paper, for the first time, proposes a five-round distinguisher for Camellia under the quantum chosen-ciphertext attack (qCCA) setting, with its effectiveness empirically validated. Additionally, by combining Grover’s algorithm and Simon’s algorithm, we construct a nine-round key-recovery attack model against Camellia. Through an in-depth analysis of Camellia’s key expansion algorithm, we significantly reduce the complexity of the key-recovery attack. The proposed attack achieves a time complexity of 261.5 for recovering the correct key bits and requires 531 quantum bits.
Abstract Symmetric cryptography is expected to be quantum safe when long‐term security is needed. Kuwakado and Morii gave a 3‐round quantum distinguisher of the Feistel cipher based on Simon's algorithm. However, the quantum distinguisher without considering the specific structure of the round function is not accurate enough. A new quantum cryptanalysis method for Feistel structure is studied here. It can make full use of the specific structure of the round function. The properties of Camellia round function and its linear transformation P are taken into account, and a 5‐round quantum distinguisher is proposed. Then, the authors follow a key‐recovery attack framework by Leander and May, that is, Grover‐meet‐Simon algorithm, and give a quantum key‐recovery attack on 7‐round Camellia in Q2 model with the time complexity of 2 24 . It is the very first time that the specific structure of the round function is used to improve quantum attack on Camellia.
With the rapid advancement of quantum computing, the security of traditional cryptographic systems is facing significant challenges. As a fundamental component of symmetric cryptography, block ciphers have attracted increasing attention regarding their quantum security in recent years. In this paper, we propose new quantum attacks on two Feistel-type constructions, i.e., New Structure IV and the lightweight block cipher LBlock, under the quantum chosen-plaintext attack (qCPA) model. First, we construct an 8-round quantum distinguisher for New Structure IV and perform an r(r>12)r(r>12)r(r>12)-round quantum key-recovery attack. Compared with Li et al.'s qCPA-based result presented at INSCRYPT 2024, our attack reduces the time complexity by a factor of 2n/22^{n/2}2n/2, where nnn denotes the subkey length. Second, we design a 9-round quantum distinguisher for LBlock and extend it to an r(r>15)r(r>15)r(r>15)-round quantum key-recovery attack. The proposed quantum distinguisher covers one more round than Liu et al.'s automated-search distinguisher at ASIACRYPT 2025, which results in a 2162^{16}216 reduction in the time complexity of our rrr-round quantum key-recovery attack on LBlock. Furthermore, by analyzing the structure of the round function and the key scheduling of LBlock, we reduce the subkey guess space for the 15-round attack from 76 bits to 52 bits, lowering the time complexity from O(238)O(2^{38})O(238) to O(226)O(2^{26})O(226) by a factor of 2122^{12}212.
Abstract Quantum attacks employing superposition queries (Q2 model) have been demonstrated to compromise numerous classically secure block-cipher constructions. These attacks embed the target encryption structure into a period-finding problem, which dedicated quantum algorithms, including the Simon and BV algorithms, can solve. After restoring the secret state, attackers can launch an attack by recovering the key (the secret state contains key information) or distinguishing it from random permutations. In this paper, we investigate the quantum security of Feistel-like ciphers in a related-key setting. For several constructions, we demonstrate how to define a periodic function that can be evaluated using the Simon algorithm with only O(n)O(n)O(n) O ( n ) quantum queries to the encryption oracle, where n represents the block size. This enables secret-state recovery attacks on Type-1/2 generalized Feistel schemes, as well as key-recovery attacks on the Feistel-FK and Misty L-KF constructions. All these attacks achieve an exponential reduction in query complexity compared to the best known classical or quantum methods.
By studying the attack technology based on Simon, Grover and other quantum algorithms for the security of block cipher structure, this paper proposes new quantum attack on 6 generalized unbalanced Feistel structures. We improve the attack results of n-cell structure, New Structure I/III/IV structure and FBC-like structure, and give a quantum attack on Skipjack structure for the first time. Based on Simon algorithm, this paper constructs a n2-round, a 12/12/6-round and a 4-round quantum distinguisher about n-cell structure, New structure I/III/IV and FBC-like structure, improving n2-n-1 rounds, 6 rounds/3 rounds/1 round and 1 round separately, comparing to the previous results. In addition, this paper also constructs a 9-round quantum distinguisher about Skipjack structure. Moreover, this paper proposes a quantum key recovery attack on the above six structures in combination with Grover algorithm, and the time complexities of attacks are analyzed.
With the application of quantum algorithms in cryptanalysis keeping increasing. Currently, there are many works based on Simon’s algorithm for generalized Feistel scheme (GFS), mostly using manual derivation to construct periodic functions. We present the functional form of the output component’s algebraic expression. Then we propose the transformation rules of functional form of algebraic expression through round function. Afterwards, we present an algorithm to find GFS’s longest round distinguishers based on Simon’s algorithm. Based on this, we get quantum distinguishers of Type-1 GFS, Type-2 GFS and Type-3 GFS under quantum chosen plaintext attack (qCPA) setting and quantum chosen ciphertext attack (qCCA) setting. For Type-1 GFS, the longest round quantum distinguisher based on Simon’s algorithm is unique under qCPA/qCCA setting, which is [Formula: see text]-round/[Formula: see text]-round. For [Formula: see text]-branch Type-2 GFS, [Formula: see text] kinds of [Formula: see text]-round distinguishers have been found under qCPA/qCCA setting. For Type-3 GFS, the longest round distinguisher based on Simon’s algorithm is unique under qCPA/qCCA setting, which is [Formula: see text]-round/3-round.
The development of post-quantum cryptography requires cryptographic primitives that remain secure against quantum adversaries. Quantum key-recovery attacks constitute a fundamental class of quantum cryptanalytic techniques, and the resistance of a cryptosystem to such attacks serves as an important indicator of its overall security. Since the Feistel structure is a core component in the design of many block ciphers, efficient quantum key-recovery attacks on Feistel ciphers provide valuable insights into evaluating and strengthening their security. In this paper, we propose an efficient generic quantum key-recovery attack on Feistel ciphers. Our attack integrates universal hash families with Simon's and Grover's algorithms to perform key-recovery. We rigorously analyze the correctness of the proposed attack and derive its time and quantum resource complexities. A comprehensive comparison with existing keyrecovery attacks shows that the proposed approach improves both quantum resource usage and dominant query complexity, and therefore yields a more efficient quantum key-recovery attack. Our work enhances the understanding of Feistel ciphers under quantum threats and informs the design of robust cryptosystems for the post-quantum era.