Entropy

Quantum Security of Nonce-Based Encryption

Shuping Mao, Peng Wang, Yan Jia, Gang Liu, Bing Liu

Published Nov 24, 2025• 1 citation

Abstract

We investigate the quantum security of nonce-based encryption under the indistinguishability against quantum chosen-plaintext attacks (IND-qCPA). While classical results establish that IV-based modes such as CBC, CFB, OFB, and CTR achieve IND-qCPA security, we demonstrate that simply replacing the random IV with a nonce undermines both classical and quantum security. To address this, we propose a general transformation from R-IND-qCPA security to N-IND-qCPA security and introduce enhanced variants, namely, CBC2, CFB2, OFB2, and CTR2, that are provably secure in the nonce-based quantum setting. We further show that nonce-based stream cipher encryption inherently satisfies N-IND-qCPA security. These results provide a systematic framework for upgrading IV-based constructions to secure nonce-based counterparts, thereby strengthening practical symmetric encryption against quantum adversaries.

DOI: 10.3390/e27121194

Related papers

On the Quantum Security of OCB

Varun Maram, Daniel Masny, Sikhar Patranabis +1 more

The OCB mode of operation for block ciphers has three variants, OCB1, OCB2 and OCB3. OCB1 and OCB3 can be used as secure authenticated encryption schemes whereas OCB2 has been shown to be classically insecure (Inoue et al., Crypto 2019). Even further, in the presence of quantum queries to the encryption functionality, a series of works by Kaplan et al. (Crypto 2016), Bhaumik et al. (Asiacrypt 2021) and Bonnetain et al. (Asiacrypt 2021) have shown how to break the unforgeability of the OCB modes. However, these works did not consider the confidentiality of OCB in the presence of quantum queries.We fill this gap by presenting the first formal analysis of the IND-qCPA security of OCB. In particular, we show the first attacks breaking the IND-qCPA security of the OCB modes. Surprisingly, we are able to prove that OCB2 is IND-qCPA secure when used without associated data, while relying on the assumption that the underlying block cipher is a quantum-secure pseudorandom permutation. Additionally, we present new quantum attacks breaking the universal unforgeability of OCB. Our analysis of OCB has implications for the post-quantum security of XTS, a well-known disk encryption standard, that was considered but mostly left open by Anand et al. (PQCrypto 2016).

IACR Transactions on Symmetric CryptologyJun 10, 202211 citations

Concrete Security Against Adversaries with Quantum Superposition Access to Encryption and Decryption Oracles

Shahram Mossayebi, Rüdiger Schack

In 2013, Boneh and Zhandry introduced the notion of indistinguishability (IND) in chosen plaintext (CPA) and chosen ciphertext (CCA) attacks by a quantum adversary which is given superposition access to an oracle for encryption and decryption queries but is restricted to classical queries in the challenge phase. In this paper we define IND-CPA and IND-CCA notions for symmetric encryption schemes where the adversary has full quantum superposition access to the oracle, and give constructions that achieve these security notions. Our results are formulated in the concrete security framework.

arXiv:1609.03780Sep 13, 20167 citations

Quantum-Resistant Authenticated Encryption Variants of GCM

Marc Fischlin, Tobias Schmalz

Common authenticated encryption schemes are generally believed to remain secure in the post-quantum setting where adversaries with local quantum power interact classically with the users. This is apart from a square root loss in the security bound due to Grover's algorithm. This changes dramatically when one switches to a fully quantum setting where the adversary is allowed to interact with the users in superposition, called IND-qCCA security. Here, many well-known schemes become completely insecure, including the widely deplyoed Galois/Counter mode (GCM). Here we propose a modification to GCM and to its counterpart GCM-SIV that resurrects IND-qCCA security in the quantum setting for nonce-respecting adversaries. The key observation is to replace the universal hash functions GHASH and PolyVal in GCM and GCM-SIV by pairwise-independent versions.

IACR Transactions on Symmetric CryptologyJun 11, 20260 citations

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

Gorjan Alagic, Stacey Jeffery, Māris Ozols +1 more

Quantum computing is a significant threat to classical public-key cryptography. In strong "quantum access" security models, numerous symmetric-key cryptosystems are also vulnerable. We consider classical encryption in a model which grants the adversary quantum oracle access to encryption and decryption, but where the latter is restricted to non-adaptive (i.e., pre-challenge) queries only. We define this model formally using appropriate notions of ciphertext indistinguishability and semantic security (which are equivalent by standard arguments) and call it QCCA1 in analogy to the classical CCA1 security model. Using a bound on quantum random-access codes, we show that the standard PRF-based encryption schemes are QCCA1-secure when instantiated with quantum-secure primitives. We then revisit standard IND-CPA-secure Learning with Errors (LWE) encryption and show that leaking just one quantum decryption query (and no other queries or leakage of any kind) allows the adversary to recover the full secret key with constant success probability. In the classical setting, by contrast, recovering the key requires a linear number of decryption queries. The algorithm at the core of our attack is a (large-modulus version of) the well-known Bernstein-Vazirani algorithm. We emphasize that our results should not be interpreted as a weakness of these cryptosystems in their stated security setting (i.e., post-quantum chosen-plaintext secrecy). Rather, our results mean that, if these cryptosystems are exposed to chosen-ciphertext attacks (e.g., as a result of deployment in an inappropriate real-world setting) then quantum attacks are even more devastating than classical ones.

Leibniz international proceedings in informaticsJan 1, 20190 citations

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

Gorjan Alagic, Stacey Jeffery, Māris Ozols +1 more

Large-scale quantum computing poses a major threat to classical public-key cryptography. Recently, strong “quantum access” security models have shown that numerous symmetric-key cryptosystems are also vulnerable. In this paper, we consider classical encryption in a model that grants the adversary quantum oracle access to encryption and decryption, but where we restrict the latter to non-adaptive (i.e., pre-challenge) queries only. We formalize this model using appropriate notions of ciphertext indistinguishability and semantic security (which are equivalent by standard arguments) and call it QCCA 1 in analogy to the classical CCA 1 security model. We show that the standard pseudorandom function ( PRF )-based encryption schemes are QCCA 1 -secure when instantiated with quantum-secure primitives. Our security proofs use a strong bound on quantum random-access codes with shared randomness. Revisiting plain IND − CPA -secure Learning with Errors ( LWE ) encryption, we show that leaking only a single quantum decryption query (and no other leakage or queries of any kind) allows the adversary to recover the full secret key with constant success probability. Information-theoretically, full recovery of the key in the classical setting requires at least a linear number of decryption queries. Our results thus challenge the notion that LWE is unconditionally “just as secure” quantumly as it is classically. The algorithm at the core of our attack is a new variant of the well-known Bernstein–Vazirani algorithm. Finally, we emphasize that our results should not be interpreted as a weakness of these cryptosystems in their stated security setting (i.e., post-quantum chosen-plaintext secrecy). Rather, our results mean that, if these cryptosystems are exposed to chosen-ciphertext attacks (e.g., as a result of deployment in an inappropriate real-world setting) then quantum attacks are even more devastating than classical ones.

arXiv:1808.09655CryptographyMar 21, 20209 citations

Secure Signatures and Chosen Ciphertext Security in a Post-Quantum World.

Dan Boneh, Mark Zhandry

We initiate the study of quantum-secure digital signatures and quantum chosen ciphertext security. In the case of signatures, we enhance the standard chosen message query model by allowing the adversary to issue quantum chosen message queries: given a superposition of messages, the adversary receives a superposition of signatures on those messages. Similarly, for encryption, we allow the adversary to issue quantum chosen ciphertext queries: given a superposition of ciphertexts, the adversary receives a superposition of their decryptions. These adversaries model a natural post-quantum environment where end-users sign messages and decrypt ciphertexts on a personal quantum computer. We construct classical systems that remain secure when exposed to such quantum queries. For signatures we construct two compilers that convert classically secure signatures into signatures secure in the quantum setting and apply these compilers to existing post-quantum signatures. We also show that standard constructions such as Lamport one-time signatures and Merkle signatures remain secure under quantum chosen message attacks, thus giving signatures whose quantum security is based on generic assumptions. For encryption, we define security under quantum chosen ciphertext attacks and present both public-key and symmetric-key constructions.

Jan 1, 20133 citations