Quantum computing is generally considered non-threatening to symmetric ciphers. Quantum attacks on symmetric ciphers require a thorough analysis of their internal structures, posing considerable difficulties and challenges. As of 2023, Google's quantum supremacy chip, Sycamore, is still incapable of cryptanalysis. Leveraging D-Wave's quantum annealing exploits the unique quantum tunneling effect, providing an edge in solving combinatorial optimization problems. It can be regarded as a class of artificial intelligence algorithm that can achieve global optimization. We propose a quantum heuristic symmetric cipher attack algorithm for substitution-permutation network (SPN) symmetric ciphers, which transforms the plaintext-ciphertext propagation rules within SPN structure into the problem of solving a constrained quadratic model (CQM). A novel reduction algorithm is employed to eliminate redundant constraint conditions. The D-Wave Advantage quantum computer is used to recover the encryption sub-keys. Using the quantum approximate optimization algorithm, IBM Q Experience can only recover two rounds of the Heys Cipher sub-key, whereas D-Wave Advantage achieves complete key recovery, validating its potential in quantum symmetric cipher attacks.
Quantum computing is generally considered non-threatening to symmetric ciphers. Quantum attacks on symmetric ciphers require a thorough analysis of their internal structures, posing considerable difficulties and challenges. As of 2023, Google's quantum supremacy chip, Sycamore, is still incapable of cryptanalysis. Leveraging D-Wave's quantum annealing exploits the unique quantum tunneling effect, providing an edge in solving combinatorial optimization problems. It can be regarded as a class of artificial intelligence algorithm that can achieve global optimization. We propose a quantum heuristic symmetric cipher attack algorithm for substitution-permutation network (SPN) symmetric ciphers, which transforms the plaintext-ciphertext propagation rules within SPN structure into the problem of solving a constrained quadratic model (CQM). A novel reduction algorithm is employed to eliminate redundant constraint conditions. The D-Wave Advantage quantum computer is used to recover the encryption sub-keys. Using the quantum approximate optimization algorithm, IBM Q Experience can only recover two rounds of the Heys Cipher sub-key, whereas D-Wave Advantage achieves complete key recovery, validating its potential in quantum symmetric cipher attacks.
Abstract The quantum annealing algorithm leverages the global optimization capability of its unique quantum tunneling effect, making it well-suited for solving NP-hard combinatorial optimization problems. This research investigates its potential in symmetric cipher attacks, exemplified by the Mixed Integer Linear Programming (MILP) problems in symmetric ciphers. None of Google’s three generations of quantum chips can be used for cryptographic attacks. Due to the complexity of symmetric ciphers, attacks on real quantum computers have mostly focused on simplified versions, while key NP-hard problems in full-scale versions remain untouched. Amid slow progress in quantum computing for cryptographic attacks, this study proposes a novel Hybrid Quantum-Classical Attack (HyQCA) algorithm. In HyQCA, the propagation rules of integral properties in symmetric ciphers are encoded as MILP problems, leveraging the global optimization capability of quantum tunneling to escape local minima. Using the PUFFIN algorithm to validate HyQCA’s feasibility, we design the MILP model for PUFFIN and solve it on a real D-Wave quantum computer, successfully obtaining a 9-round integral distinguisher. It is surprising that, for the attack on the full-scale version of PUFFIN, the results achieved are comparable to traditional mathematical methods in terms of the same number rounds. This paper preliminarily validates the practical feasibility of quantum annealing in symmetric cipher attacks.
Integer factorization, the core of the Rivest-Shamir-Adleman (RSA) attack, is an exciting but formidable challenge. As of this year, a group of researchers' latest quantum supremacy chip remains unavailable for cryptanalysis. Quantum annealing (QA) has a unique quantum tunneling advantage, which can escape local extremum in the exponential solution space, finding the global optimal solution with a higher probability. Consequently, we consider it an effective method for attacking cryptography. According to Origin Quantum Computing, QA computers are able to factor numbers several orders of magnitude larger than universal quantum computers. We try to transform the integer factorization problem in RSA attacks into a combinatorial optimization problem by using the QA algorithm of D-Wave quantum computer, and attack RSA-2048 which is composed of a class of special integers. The experiment factored this class of integers of size 22048,N=p×qAs an example, the article gives the results of 10 RSA-2048 attacks in the appendix. This marks the first successful factorization of RSA-2048 by D-Wave quantum computer, regardless of employing mathematical or quantum techniques, despite dealing with special integers, exceeding 21061−1 of California State University. This experiment verifies that the QA algorithm based on D-Wave is an effective method to attack RSA.
Key recovery attack on SPN ciphers such as AES is NP hard in complexity. Previous studies have estimated the quantum resources required for implementing Grover’s key search for AES, but these are largely theoretical in nature. The key challenges to implement Grover’s algorithm on current quantum hardware include the number of available qubits, noise, and decoherence. However, the rapid advancement of hardware has brought us closer to practical realization for the cryptanalysis of light-weight SPN ciphers. This study presents an efficient quantum circuit implementation of Mini-AES, a 16-bit variant of AES, employing standard CNOT and Toffoli gates. To the best of our knowledge, our work provides the first complete quantum implementations of all core Mini-AES components for the quantum oracle. The effects of noise are emulated for each module of the quantum oracle and quantified. Furthermore, Grover’s algorithm is applied to Mini-AES to perform successful key recovery through a known-plaintext attack, demonstrating significant amplitude amplification while using near-optimal Grover’s iterations, thereby reducing the total quantum volume. The optimal Grover’s iterations have been obtained empirically as well as validated with finite-shot analysis. Notably, the application of Grover’s algorithm reveals key clustering behavior in Mini-AES, which has been corroborated through classical simulation.
Abstract Cryptanalysis is crucial for securing cryptographic systems, particularly with the advent of quantum computing, which threatens traditional encryption methods. Advanced cryptanalytic techniques are essential for developing robust systems that can withstand quantum attacks, ensuring encrypted data remains secure and accessible only to authorized parties. This paper introduces the Quantum Hopfield Neural Network (QHopNN) as a novel approach to enhance key recovery in symmetric ciphers. This research provides valuable insights into integrating quantum principles with neural network architectures, paving the way for more secure and efficient cryptographic systems. By leveraging quantum principles like superposition and entanglement, along with Hopfield networks’ pattern recognition and optimization capabilities, QHopNN achieves superior accuracy and efficiency in deciphering encrypted data. Additionally, integrating unitary quantum evolution with dissipative dynamics further enhances the cryptographic robustness and efficiency of QHopNN. The proposed framework is rigorously evaluated using prominent symmetric ciphers, including S-AES and S-DES, and benchmarked against existing state-of-the-art techniques. Experimental results compellingly demonstrate the superiority of QHopNN in key recovery, with a mean Bit Accuracy Probability (BAP) of 0.9706 for S-AES and 0.9815 for S-DES, significantly outperforming current methods. This breakthrough opens new avenues for advancing cryptanalysis and sets the stage for pioneering future research in quantum-inspired cryptographic techniques.
It has been established that quantum algorithms can solve several key cryptographic problems more efficiently than classical computers. As progress continues in the field of quantum computing it is important to understand the risks they pose to deployed cryptographic systems. Here we focus on one of these risks - quantum key-recovery attacks against ideal ciphers. Specifically, we seek to model the risk posed by an economically motivated quantum attacker who will choose to run a quantum key-recovery attack against an ideal cipher if the cost to recover the secret key is less than the value of the information at the time when the key-recovery attack is complete. In our analysis we introduce the concept of a quantum cipher circuit year to measure the cost of a quantum attack. This concept can be used to model the inherent tradeoff between the total time to run a quantum key recovery attack and the total work required to run said attack. Our model incorporates the time value of the encrypted information to predict whether any time/work tradeoff results in a key-recovery attack with positive utility for the attacker. We make these predictions under various projections of advances in quantum computing. We use these predictions to make recommendations for the future use and deployment of symmetric key ciphers to secure information against these quantum key-recovery attacks. We argue that, even with optimistic predictions for advances in quantum computing, 128 bit keys (as used in common cipher implementations like AES-128) provide adequate security against quantum attacks in almost all use cases.
It has been said that security of symmetric key schemes is not so much affected by quantum computers, compared to public key schemes. However, recent works revealed that, in some specific situations, symmetric key schemes are also broken in polynomial time by adversaries with quantum computers. These works contain a quantum distinguishing attack on 3-round Feistel ciphers and a quantum key recovery attack on the Even-Mansour cipher by Kuwakado and Morii, in addition to the quantum forgery attack on CBC-MAC which is proposed independently by Kaplan et al., and by Santoli and Schaffner. Iterated Even-Mansour cipher is a simple but important block cipher, which can be regarded as an idealization of AES. Whether there exists an efficient quantum algorithm that can break iterated Even-Mansour cipher with independent subkeys is an important problem from the viewpoint of analyzing post-quantum security of block ciphers. Actually there is an efficient quantum attack on iterated Even-Mansour cipher by Kaplan et al., but their attack can only be applied in the case that all subkeys are the same. This paper shows that there is a polynomial time quantum algorithm that recovers partial keys of the iterated Even-Mansour cipher with independent subkeys, in a related-key setting. The related-key condition is somewhat strong, but our algorithm can recover subkeys with two related oracles. In addition, we also show that our algorithm can recover all keys of the i-round iterated Even-Mansour cipher, if we are allowed to access i related quantum oracles. To realize quantum related-key attacks, we extend Simon's quantum algorithm so that we can recover the hidden period of a function that is periodic only up to constant. Our technique is to take differential of the target function to make a double periodic function, and then apply Simon's algorithm.