论文标题
Simon Block Cipher上的量子密钥恢复攻击
Quantum Key Recovery Attack on SIMON Block Cipher
论文作者
论文摘要
轻量级密码的量子安全性引起了越来越多的关注。但是，对轻质块密码的现有量子攻击主要集中在量子详尽的搜索上，而量子专用攻击与经典的密码分析方法相结合并未得到很好的研究。在本文中，我们使用Q1模型中使用量子振幅扩增算法研究了对Simon块密码的量子键恢复攻击。首先，我们重新分析了Simon Block Cipher上量子主钥匙详细搜索的量子电路复杂性。 Clifford Gates计数的估计更准确，t栅极计数降低。由于电路对电路进行了一些较小的修改，我们还减少了T深度和全深度。然后，基于Biryukov等人提供的Simon32，Simon48和Simon64的差分密码分析。在FSE 2014中，我们对这些Simon变体进行了量子圆形钥匙恢复攻击，并分别分析量子电路复杂性。我们对19轮SIMON32/64进行量子攻击，并设计关键恢复过程的量子电路。这次攻击的两个阶段可以分别视为两个QAA实例，第一个QAA实例由四个子QAA实例组成。我们得出的结论是，对19轮SIMON32/64、19轮Simon 48和26轮SIMON64/128对量子专用攻击的加密复杂性和电路复杂性都低于分别对这些变体的量子详尽搜索。我们的工作首先从量子电路复杂性的角度研究了对Simon块密码的量子专用攻击，这是对量子专用攻击的复杂性的更细粒度的分析。
The quantum security of lightweight block ciphers is receiving more and more attention. However, the existing quantum attacks on lightweight block ciphers mainly focused on the quantum exhaustive search, while the quantum dedicated attacks combined with classical cryptanalysis methods haven't been well studied. In this paper, we study quantum key recovery attack on SIMON block cipher using Quantum Amplitude Amplification algorithm in Q1 model. At first, we reanalyze the quantum circuit complexity of quantum master key exhaustive search on SIMON block cipher. The Clifford gates count is estimated more accurately and the T gate count is reduced. We also reduce the T-depth and Full-depth due to some minor modifications to the circuit. Then, based on the differential cryptanalysis on SIMON32, SIMON48 and SIMON64 given by Biryukov et al. in FSE 2014, we give quantum round key recovery attacks on these SIMON variants and analyze quantum circuit complexity separately. We take the quantum attack on 19-round SIMON32/64 for an example and design the quantum circuit of the key recovery process. The two phases of this attack could be regarded as two QAA instances separately, and the first QAA instance consists of four sub-QAA instances. We conclude that the encryption complexity and circuit complexity of quantum dedicated attacks on 19-round SIMON32/64, 19-round SIMON 48 and 26-round SIMON64/128 are both lower than those of the quantum exhaustive search on these variants separately. Our work firstly studies the quantum dedicated attack on SIMON block cipher from the perspective of quantum circuit complexity, which is a more fine-grained analysis of quantum dedicated attacks' complexity.
