In this paper, we analyse the extended generalized Feistel-like scheme and construct new quantum distinguishing attacks as well as multiple new quantum round key recovery attacks on this scheme with polynomial complexity. The obtained result implies that the investigated scheme is not resistant to the quantum computing model, at least to the distinguishing attacks.
In this paper, we analyse the extended generalized Feistel-like scheme and construct new quantum distinguishing attacks as well as multiple new quantum round key recovery attacks on this scheme with polynomial complexity. The obtained result implies that the investigated scheme is not resistant to the quantum computing model, at least to the distinguishing attacks.
Abstract Generalized Feistel schemes (GFSs) are extremely important and extensively researched cryptographic schemes. In this paper, the security of Type‐1 GFS in quantum circumstances is investigated. On the one hand, in the qCCA setting, a new quantum polynomial‐time distinguisher on ‐round Type‐1 GFS with branches is given, which extends the previous results by rounds. This leads to a more efficient analysis of type‐1 GFS, that is, the complexity of some previous key‐recovery attacks is reduced by a factor of , where k is the key length of the internal round function. On the other hand, for CAST‐256, which is a certain block cipher based on Type‐1 GFS, a 17‐round quantum distinguisher in the qCPA setting is given. Based on this, an ‐round quantum key‐recovery attack with complexity is constructed.
With the rapid advancement of quantum computing, the security of traditional cryptographic systems is facing significant challenges. As a fundamental component of symmetric cryptography, block ciphers have attracted increasing attention regarding their quantum security in recent years.
In this paper, we propose new quantum attacks on two Feistel-type constructions, i.e., New Structure IV and the lightweight block cipher LBlock, under the quantum chosen-plaintext attack (qCPA) model. First, we construct an 8-round quantum distinguisher for New Structure IV and perform an r(r>12)-round quantum key-recovery attack. Compared with Li et al.'s qCPA-based result presented at INSCRYPT 2024, our attack reduces the time complexity by a factor of 2n/2, where n denotes the subkey length. Second, we design a 9-round quantum distinguisher for LBlock and extend it to an r(r>15)-round quantum key-recovery attack. The proposed quantum distinguisher covers one more round than Liu et al.'s automated-search distinguisher at ASIACRYPT 2025, which results in a 216 reduction in the time complexity of our r-round quantum key-recovery attack on LBlock. Furthermore, by analyzing the structure of the round function and the key scheduling of LBlock, we reduce the subkey guess space for the 15-round attack from 76 bits to 52 bits, lowering the time complexity from O(238) to O(226) by a factor of 212.
This paper investigates generalizations of the Lai-Massey scheme, including unified constructionscombining it with the Feistel scheme (MD GLM, UFLM, L-Feistel, and quasi-Feistel). New reductionsto the quasi-Feistel scheme are provided. Known efficient quantum attacks are analyzed, includingchosen-plaintext attacks on 3 rounds and chosen-ciphertext attacks on 4 rounds for a special case of thequasi-Feistel cipher using Simon’s algorithm. It is demonstrated that restrictions in that work led to thedegeneration of the quasi-Feistel scheme into the standard Feistel scheme, replicating known quantumattacks on the Feistel scheme. New two-round distinguishing attacks are presented for the L-Feistel andMD-1 GLM schemes, enabling round key recovery.
By studying the attack technology based on Simon, Grover and other quantum algorithms for the security of block cipher structure, this paper proposes new quantum attack on 6 generalized unbalanced Feistel structures. We improve the attack results of n-cell structure, New Structure I/III/IV structure and FBC-like structure, and give a quantum attack on Skipjack structure for the first time. Based on Simon algorithm, this paper constructs a n2-round, a 12/12/6-round and a 4-round quantum distinguisher about n-cell structure, New structure I/III/IV and FBC-like structure, improving n2-n-1 rounds, 6 rounds/3 rounds/1 round and 1 round separately, comparing to the previous results. In addition, this paper also constructs a 9-round quantum distinguisher about Skipjack structure. Moreover, this paper proposes a quantum key recovery attack on the above six structures in combination with Grover algorithm, and the time complexities of attacks are analyzed.
The Feistel structure represents a fundamental architectural component within the domain of symmetric cryptographic algorithms, with a substantial body of research conducted within the context of classical computing environments. Nevertheless, research into specific symmetric cryptographic algorithms utilizing the Feistel structure is relatively scarce in quantum computing environments. This paper, for the first time, proposes a five-round distinguisher for Camellia under the quantum chosen-ciphertext attack (qCCA) setting, with its effectiveness empirically validated. Additionally, by combining Grover’s algorithm and Simon’s algorithm, we construct a nine-round key-recovery attack model against Camellia. Through an in-depth analysis of Camellia’s key expansion algorithm, we significantly reduce the complexity of the key-recovery attack. The proposed attack achieves a time complexity of 261.5 for recovering the correct key bits and requires 531 quantum bits.
Quantum algorithms are raising concerns in the field of cryptography all over the world. A growing number of symmetric cryptography algorithms have been attacked in the quantum setting. Type-3 generalized Feistel scheme (GFS) and unbalanced Feistel scheme with expanding functions (UFS-E) are common symmetric cryptography schemes, which are often used in cryptographic analysis and design. We propose quantum distinguishing attacks on Type-3 GFS and UFS-E in the quantum chosen plaintext attack setting. The results of key recovery are better than those based on exhaustive search in the quantum setting.