New Algorithms for Quantum (Symmetric) Cryptanalysis Mara - PowerPoint PPT Presentation

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms New Algorithms for Quantum (Symmetric) Cryptanalysis María Naya-Plasencia 2 , André Schrottenloher 2 Joint work with André Chailloux 2 and Lorenzo Grassi 1 1 IAIK, Graz University of Technology, Austria 2 Inria, France May 19, 2019 M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 1/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Outline Quantum-safe (Symmetric) Cryptography 1 Quantum Collision Search 2 Quantum k-xor Algorithms 3 M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 2/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Quantum-safe (Symmetric) Cryptography M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 3/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms (Pre-quantum) cryptography Enable secure communications even in the presence of malicious adversaries. Asymmetric (e.g. RSA) No shared secret / computationally costly Security based on well-known hard mathematical problems (e.g. factorization) Symmetric (e.g. AES) Shared secret / computationally efficient Ideal security defined by generic attacks (e.g. 2 | K | ) Need of continuous security evaluation (cryptanalysis) M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 4/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms A typical symmetric primitive Ideal block cipher E K is a family of permutations of { 0 , 1 } n parameterized by K . Real block cipher: Typically built by iterating a round function Select a key K Decompose the message into n -bit blocks and use E K with a mode of operation M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 5/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Generic attacks on ciphers The security provided by an ideal block cipher is defined by the best generic attack: exhaustive search for the key in 2 | K | Recovering the key from a secure cipher must be infeasible. Typical key sizes range from | K | = 128 to 256 bits. M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 6/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Symmetric cryptanalysis The ideal security is defined by generic attacks (2 | K | ) Does real security meet this ideal security? We won’t know . . . without a continuous security evaluation. Any attack better than the generic one is considered a “break”. Cryptanalysis is an empirical measure of security. M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 7/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms The security margin The security of a cipher is not a 1-bit information: e.g. round-reduced attacks. ⇒ determine and adapt the security margin. The best attacks find the highest number of rounds reached (regardless of the complexity) Allows to compare primitives M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 8/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Quantum-safe (Symmetric) Cryptography M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 9/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Post-quantum cryptography Asymmetric (e.g. RSA) Shor’s algorithm factorizes in polynomial time: this is not secure anymore. Actively looking for replacements (NIST call) Symmetric (e.g. AES) Exhaustive search in 2 | K | / 2 with Grover’s algorithm. Double the key length for equivalent ideal security. In both cases, lots of work regarding quantum attacks. M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 10/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Many new results Breaking some classically secure constructions in some quantum adversary models Extending cryptanalysis studies to quantum adversaries Solving recurrent generic problems M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 11/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Quantum search Find in S (of size 2 n ) an element x (2 t solutions) such that x satisfies some condition. � � 2 ( n − t ) / 2 Sampling + Checking � �� � � �� � � �� � 2 t solutions Produce the Test a among 2 n superposition of search space S in superposition x ∈ S M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 12/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Two settings “Low-qubits” Only O ( n ) qubits, no qRAM access. ⇒ A quantum adversary from tomorrow. Exponential qRAM Read and write access in quantum superposition: � � | i � | 0 � → | i � | a i � i i M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 13/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Quantum Collision Search with A. Chailloux, M. Naya-Plasencia M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 14/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms The birthday problem Collision search Let H : { 0 , 1 } n → { 0 , 1 } n be a random function, find a collision of H , i.e. a pair x 1 , x 2 ∈ { 0 , 1 } n such that H ( x 1 ) = H ( x 2 ) . Numerous applications, e.g. generic attacks on hash functions. Classical time and queries: Θ( 2 n / 2 ) With 2 n / 2 queries, we can form 2 n pairs, an n -bit collision occurs w.h.p. We can do this in O ( n ) memory (Pollard’s rho) M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 15/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Quantum algorithms for collisions Time Queries Qubits / Classical qRAM memory 2 n / 2 2 n / 2 Pollard 0 O ( n ) 2 n / 2 2 n / 2 Grover O ( n ) 0 2 n / 3 2 n / 3 2 n / 3 2 n / 3 Brassard, Høyer, Tapp 2 2 n / 3 2 n / 3 2 n / 3 BHT (*) O ( n ) M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 16/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Collision search in a low-qubits setting Single-processor Only O ( n ) qubits No qRAM lookups M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 17/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms A naive collision algorithm Perform ℓ arbitrary classical queries to H : H ( x 1 ) , . . . , H ( x ℓ ) . Search x ∈ { 0 , 1 } n such that: H ( x ) ∈ { H ( x 1 ) , . . . , H ( x ℓ ) } Optimal ℓ = 2 n / 2 : 2 n / 2 + 2 n 2 n / 2 M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 18/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms A quantum collision algorithm Naive classical: Quantum (BHT): Perform ℓ arbitrary Perform ℓ arbitrary classical classical queries to H : queries to H : H ( x 1 ) , . . . , H ( x ℓ ) . H ( x 1 ) , . . . , H ( x ℓ ) . With Grover , search Search x ∈ { 0 , 1 } n such x ∈ { 0 , 1 } n such that that: H ( x ) ∈ { H ( x 1 ) , . . . , H ( x ℓ ) } . Optimal ℓ = 2 n / 3 : H ( x ) ∈ { H ( x 1 ) , . . . , H ( x ℓ ) } � � � 2 n Optimal ℓ = 2 n / 2 : n 2 + 1 + 1 3 ���� ���� 2 n / 3 � �� � 2 n / 2 + 2 n List qRAM Iterations lookup 2 n / 2 M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 19/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms Removing qRAM We have a list L = { H ( x 1 ) , . . . , H ( x ℓ ) } , known classically, and want to compute: | y � | 0 � �→ | y � | y ∈ L � . With qRAM: build a data structure for L , compute membership in O ( log ℓ ) qRAM gates; Without qRAM: compare sequentially against elements of L . We compute: | y � | 0 � �→ | y � | ( y = H ( x 1 )) ∨ ( y = H ( x 2 )) . . . ∨ ( y = H ( x ℓ )) � in time � O ( ℓ ) . M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 20/59

Quantum-safe (Symmetric) Cryptography Quantum Collision Search Quantum k-xor Algorithms BHT without quantum memory Queries: � 2 n / 3 + 2 n / 2 n / 3 ( 1 + 0 ) Time: 2 n / 3 + 2 n / 3 � 1 + 2 n / 3 � M. Naya-Plasencia, A. Schrottenloher Quantum (Symmetric) Cryptanalysis 21/59