Authenticated encryption with associated data (AEAD) play a critical role in secure communication protocols, by offering confidentiality, integrity, and authenticity. However, the advent of quantum computing poses a significant threat to the security of AEAD schemes, including ISO/IEC standards such as OCB (offset codebook) and GCM (Galois/counter mode), highlighting the need for a thorough evaluation of their quantum resistance. Combined feedback mode (COFB) is a lightweight AEAD mode proposed at CHES'17, gaining significant attention due to its excellent performance in both software and hardware implementations. In this paper, we study the post-quantum security of COFB. First, we show COFB is insecure under the security notion of quantum-secure pseudo-random funtion (qPRF) by presenting an attack with a single encryption query. Next, we investigate the IND-qCPA (indistinguishability under quantum chosen-plaintext attack) security of COFB. Specifically, we show that if instantiated with a qPRF-secure$n$-bit block cipher, the IND-qCPA security bound of COFB is roughly$(Q^{7/4}\cdot\ell^{11/4})/2^{n/2}+Q\ell/2^{n/4}$, where$Q$denotes the number of encryption queries and$\ell$represents the maximum length (in blocks) of messages in each query. Furthermore, we extend this result to GIFT-COFB, a finalist in the NIST Lightweight Cryptography competition, and establish its security bound as$(Q^{7/4}\cdot \ell^{11/4})/2^{n/2}$.
Authenticated encryption with associated data (AEAD) play a critical role in secure communication protocols, by offering confidentiality, integrity, and authenticity. However, the advent of quantum computing poses a significant threat to the security of AEAD schemes, including ISO/IEC standards such as OCB (offset codebook) and GCM (Galois/counter mode), highlighting the need for a thorough evaluation of their quantum resistance. Combined feedback mode (COFB) is a lightweight AEAD mode proposed at CHES'17, gaining significant attention due to its excellent performance in both software and hardware implementations. In this paper, we study the post-quantum security of COFB. First, we show COFB is insecure under the security notion of quantum-secure pseudo-random funtion (qPRF) by presenting an attack with a single encryption query. Next, we investigate the IND-qCPA (indistinguishability under quantum chosen-plaintext attack) security of COFB. Specifically, we show that if instantiated with a qPRF-securen-bit block cipher, the IND-qCPA security bound of COFB is roughly(Q7/4⋅ℓ11/4)/2n/2+Qℓ/2n/4, whereQdenotes the number of encryption queries andℓrepresents the maximum length (in blocks) of messages in each query. Furthermore, we extend this result to GIFT-COFB, a finalist in the NIST Lightweight Cryptography competition, and establish its security bound as(Q7/4⋅ℓ11/4)/2n/2.
The OCB mode of operation for block ciphers has three variants, OCB1, OCB2 and OCB3. OCB1 and OCB3 can be used as secure authenticated encryption schemes whereas OCB2 has been shown to be classically insecure (Inoue et al., Crypto 2019). Even further, in the presence of quantum queries to the encryption functionality, a series of works by Kaplan et al. (Crypto 2016), Bhaumik et al. (Asiacrypt 2021) and Bonnetain et al. (Asiacrypt 2021) have shown how to break the unforgeability of the OCB modes. However, these works did not consider the confidentiality of OCB in the presence of quantum queries.We fill this gap by presenting the first formal analysis of the IND-qCPA security of OCB. In particular, we show the first attacks breaking the IND-qCPA security of the OCB modes. Surprisingly, we are able to prove that OCB2 is IND-qCPA secure when used without associated data, while relying on the assumption that the underlying block cipher is a quantum-secure pseudorandom permutation. Additionally, we present new quantum attacks breaking the universal unforgeability of OCB. Our analysis of OCB has implications for the post-quantum security of XTS, a well-known disk encryption standard, that was considered but mostly left open by Anand et al. (PQCrypto 2016).
We investigate the quantum security of nonce-based encryption under the indistinguishability against quantum chosen-plaintext attacks (IND-qCPA). While classical results establish that IV-based modes such as CBC, CFB, OFB, and CTR achieve IND-qCPA security, we demonstrate that simply replacing the random IV with a nonce undermines both classical and quantum security. To address this, we propose a general transformation from R-IND-qCPA security to N-IND-qCPA security and introduce enhanced variants, namely, CBC2, CFB2, OFB2, and CTR2, that are provably secure in the nonce-based quantum setting. We further show that nonce-based stream cipher encryption inherently satisfies N-IND-qCPA security. These results provide a systematic framework for upgrading IV-based constructions to secure nonce-based counterparts, thereby strengthening practical symmetric encryption against quantum adversaries.
Common authenticated encryption schemes are generally believed to remain secure in the post-quantum setting where adversaries with local quantum power interact classically with the users. This is apart from a square root loss in the security bound due to Grover's algorithm. This changes dramatically when one switches to a fully quantum setting where the adversary is allowed to interact with the users in superposition, called IND-qCCA security. Here, many well-known schemes become completely insecure, including the widely deplyoed Galois/Counter mode (GCM). Here we propose a modification to GCM and to its counterpart GCM-SIV that resurrects IND-qCCA security in the quantum setting for nonce-respecting adversaries. The key observation is to replace the universal hash functions GHASH and PolyVal in GCM and GCM-SIV by pairwise-independent versions.
Quantum computing is a significant threat to classical public-key cryptography. In strong "quantum access" security models, numerous symmetric-key cryptosystems are also vulnerable. We consider classical encryption in a model which grants the adversary quantum oracle access to encryption and decryption, but where the latter is restricted to non-adaptive (i.e., pre-challenge) queries only. We define this model formally using appropriate notions of ciphertext indistinguishability and semantic security (which are equivalent by standard arguments) and call it QCCA1 in analogy to the classical CCA1 security model. Using a bound on quantum random-access codes, we show that the standard PRF-based encryption schemes are QCCA1-secure when instantiated with quantum-secure primitives. We then revisit standard IND-CPA-secure Learning with Errors (LWE) encryption and show that leaking just one quantum decryption query (and no other queries or leakage of any kind) allows the adversary to recover the full secret key with constant success probability. In the classical setting, by contrast, recovering the key requires a linear number of decryption queries. The algorithm at the core of our attack is a (large-modulus version of) the well-known Bernstein-Vazirani algorithm. We emphasize that our results should not be interpreted as a weakness of these cryptosystems in their stated security setting (i.e., post-quantum chosen-plaintext secrecy). Rather, our results mean that, if these cryptosystems are exposed to chosen-ciphertext attacks (e.g., as a result of deployment in an inappropriate real-world setting) then quantum attacks are even more devastating than classical ones.
The fast development of cyber communications, multimedia distribution, remote working have promoted the demand to transmit sensitive information through secure means in both the public and the private networks. The advent of massive quantum computers is rendering traditional cryptographic algorithms like RSA and Elliptic Curve Cryptography (ECC) insecure because they can crack the classical public-key algorithms like the Shor and Grover algorithms. This brings an immediate need of hybrid cryptographic systems, which integrate classical, quantum, and post-quantum algorithms to provide confidentiality, integrity, authentication, and future security beyond the quantum threat horizon.The paper is a proposal of a Hybrid Quantum-Post-Quantum Cryptographic Framework of transmitting files safely. It starts by aggregating files, which is a process to compress several files, images, videos, and multimedia files that users have chosen into one file to minimize redundancy and ease encryption. The AES-256 encrypted file is in GCM mode and provides confidentiality and integrity of the compressed file.The dual-layer mechanism ensures key establishment security. To begin with, Quantum Key Distribution (QKD) based on the protocols of BB84/E91 allows the Sender and the Receiver to generate a Quantum Secret Key (QSK) by exchanging quantum bits in quantum channel. Constant monitoring of the error rate facilitates automatic eavesdropping detection, and guarantees the keys generation is made when the conditions are secure, as well as the safeguarding of interception and man-in-the-middle attacks.A post-quantum layer is provided to ensure long-term security against quantum cryptanalysis, which uses Kyber, a NIST-approved lattice-based Key Encapsulation Mechanism (KEM). The Receiver creates a key pair of Kyber and disseminates the public key to the Sender. By using encapsulation, the Sender gets a PQC ciphertext and a Shared Secret (SS), with decapsulation on the Receiver side giving ensure that only participants of good faith get the same secret value.The hybridization phase consists of combining the QSK of QKD and SS of Kyber with the help of HKDF-SHA256 to obtain a Final Wrap Key (FWK). AES-GCM encrypts the key of file encryption by wrapping it with FWK which allows a secure and authenticated transfer of the key. The Sender sends four messages: encrypted file, Kyber ciphertext, wrapped AES key and the initialisation vector. At Receiver end, FWK is calculated once again with the help of QSK and SS so that the original data can be decrypted with the help of AES key.The suggested framework provides a defense-in-depth solution based on the combination of quantum security, post-quantum resilience and authenticated symmetric encryption. It can be analyzed that there is a strong resistance to classical and quantum adversaries, scalability, and compatibility with the existing communication networks. This renders the model to be appropriate to secure government communication, military systems, data exchange in healthcare environments, cloud storage and financial infrastructures. Keywords— Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), Kyber,Key Encapsulation Mechanism (KEM), HKDF-SHA256, Quantum Secret Key (QSK), GCM Mode.
Large-scale quantum computing poses a major threat to classical public-key cryptography. Recently, strong “quantum access” security models have shown that numerous symmetric-key cryptosystems are also vulnerable. In this paper, we consider classical encryption in a model that grants the adversary quantum oracle access to encryption and decryption, but where we restrict the latter to non-adaptive (i.e., pre-challenge) queries only. We formalize this model using appropriate notions of ciphertext indistinguishability and semantic security (which are equivalent by standard arguments) and call it QCCA 1 in analogy to the classical CCA 1 security model. We show that the standard pseudorandom function ( PRF )-based encryption schemes are QCCA 1 -secure when instantiated with quantum-secure primitives. Our security proofs use a strong bound on quantum random-access codes with shared randomness. Revisiting plain IND − CPA -secure Learning with Errors ( LWE ) encryption, we show that leaking only a single quantum decryption query (and no other leakage or queries of any kind) allows the adversary to recover the full secret key with constant success probability. Information-theoretically, full recovery of the key in the classical setting requires at least a linear number of decryption queries. Our results thus challenge the notion that LWE is unconditionally “just as secure” quantumly as it is classically. The algorithm at the core of our attack is a new variant of the well-known Bernstein–Vazirani algorithm. Finally, we emphasize that our results should not be interpreted as a weakness of these cryptosystems in their stated security setting (i.e., post-quantum chosen-plaintext secrecy). Rather, our results mean that, if these cryptosystems are exposed to chosen-ciphertext attacks (e.g., as a result of deployment in an inappropriate real-world setting) then quantum attacks are even more devastating than classical ones.