Quantum Difgerential and Linear Cryptanalysis Truncated difgerential - PowerPoint PPT Presentation

Introduction Brute-force FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia 1 / 25 Conclusion Quantum Difgerential and Linear Cryptanalysis Truncated difgerential Difgerential Marc Kaplan 1 , 2 Gaëtan Leurent 3 Anthony Leverrier 3 María NayaPlasencia 3 1 LTCI, Télécom ParisTech 2 School of Informatics, University of Edinburgh 3 Inria Paris FSE 2017

Introduction Brute-force Difgerential Truncated difgerential Conclusion Motivation What would be the impact of quantum computers on symmetric cryptography? Kaplan, Leurent, Leverrier & Naya-Plasencia Quantum Difgerential and Linear Cryptanalysis FSE 2017 2 / 25 ▶ Some physicists think they can build quantum computers ▶ NSA thinks we need quantumresistant crypto (or do they?)

Introduction Brute-force Difgerential Truncated difgerential Conclusion Motivation What would be the impact of quantum computers on symmetric cryptography? Kaplan, Leurent, Leverrier & Naya-Plasencia Quantum Difgerential and Linear Cryptanalysis FSE 2017 2 / 25 ▶ Some physicists think they can build quantum computers ▶ NSA thinks we need quantumresistant crypto (or do they?)

Introduction Impact on public-key cryptography FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia Impact on symmetric cryptography Brute-force 3 / 25 Expected impact of quantum computers Conclusion Truncated difgerential Difgerential ▶ Some problems can be solved much faster with quantum computers ▶ Up to exponential gains ▶ But we don’t expect to solve all NP problems ▶ RSA, DH, ECC broken by Shor’s algorithm ▶ Breaks factoring and discrete log in polynomial time ▶ Large effort to develop quantumresistant algorithms ( e.g. NIST) ▶ Exhaustive search of a k bit key in time 2 k / 2 with Grover’s algorithm ▶ Common recommendation: double the key length (AES256) ▶ Encryption modes are secure [Unruh  al, PQC’16] ▶ Authentication modes broken w/ superposition queries [Crypto ’16]

Introduction Impact on public-key cryptography FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia Impact on symmetric cryptography Brute-force 3 / 25 Expected impact of quantum computers Conclusion Truncated difgerential Difgerential ▶ Some problems can be solved much faster with quantum computers ▶ Up to exponential gains ▶ But we don’t expect to solve all NP problems ▶ RSA, DH, ECC broken by Shor’s algorithm ▶ Breaks factoring and discrete log in polynomial time ▶ Large effort to develop quantumresistant algorithms ( e.g. NIST) ▶ Exhaustive search of a k bit key in time 2 k / 2 with Grover’s algorithm ▶ Common recommendation: double the key length (AES256) ▶ Encryption modes are secure [Unruh  al, PQC’16] ▶ Authentication modes broken w/ superposition queries [Crypto ’16]

Introduction Impact on public-key cryptography FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia Impact on symmetric cryptography Brute-force 3 / 25 Expected impact of quantum computers Conclusion Truncated difgerential Difgerential ▶ Some problems can be solved much faster with quantum computers ▶ Up to exponential gains ▶ But we don’t expect to solve all NP problems ▶ RSA, DH, ECC broken by Shor’s algorithm ▶ Breaks factoring and discrete log in polynomial time ▶ Large effort to develop quantumresistant algorithms ( e.g. NIST) ▶ Exhaustive search of a k bit key in time 2 k / 2 with Grover’s algorithm ▶ Common recommendation: double the key length (AES256) ▶ Encryption modes are secure [Unruh  al, PQC’16] ▶ Authentication modes broken w/ superposition queries [Crypto ’16]

Introduction Impact on public-key cryptography FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia Impact on symmetric cryptography Brute-force 3 / 25 Expected impact of quantum computers Conclusion Truncated difgerential Difgerential ▶ Some problems can be solved much faster with quantum computers ▶ Up to exponential gains ▶ But we don’t expect to solve all NP problems ▶ RSA, DH, ECC broken by Shor’s algorithm ▶ Breaks factoring and discrete log in polynomial time ▶ Large effort to develop quantumresistant algorithms ( e.g. NIST) ▶ Exhaustive search of a k bit key in time 2 k / 2 with Grover’s algorithm ▶ Common recommendation: double the key length (AES256) ▶ Encryption modes are secure [Unruh  al, PQC’16] ▶ Authentication modes broken w/ superposition queries [Crypto ’16]

Introduction Brute-force FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia 4 / 25 Main question Conclusion Overview of the talk Difgerential Truncated difgerential Is AES secure in a quantum setting? ▶ Symmetric design are evaluated with cryptanalysis: ▶ Differential (truncated, impossible, ...) ▶ Linear ▶ Integral ▶ Algebraic ▶ ... ▶ We should study quantum cryptanalysis! ▶ Start with classical techniques ▶ Do we get a quadratic speedup? ▶ Do we need a quantum encryption oracle? ▶ How are different cryptanalysis techniques affected?

Introduction Brute-force FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia 5 / 25 Security notions: Classical Conclusion Truncated difgerential Difgerential ▶ PRF security: given access to P / P − 1 , distinguishing E from random ▶ Classical setting: classical computations ▶ Classical security: classical queries ▶ Cipher broken by adversary with ▶ data ≪ 2 n ▶ time ≪ 2 k P , P − 1 ▶ success > 3 / 4 y x cipher / random

Introduction Brute-force FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia 6 / 25 Conclusion Security notions: Quantum Q1 Truncated difgerential Difgerential ▶ PRF security: given access to P / P − 1 , distinguishing E from random ▶ Quantum setting: quantum computations ▶ Classical security: classical queries ▶ Cipher broken by adversary with ▶ data ≪ 2 n ▶ time ≪ 2 k / 2 P , P − 1 ▶ success > 3 / 4 y x Q cipher / random

Introduction Brute-force FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia 7 / 25 Conclusion Security notions: Quantum Q2 Truncated difgerential Difgerential ▶ PRF security: given access to P / P − 1 , distinguishing E from random ▶ Quantum setting: quantum computations ▶ Quantum security: quantum (superposition) queries ▶ Cipher broken by adversary with ▶ data ≪ 2 n ▶ time ≪ 2 k / 2 P , P − 1 ▶ success > 3 / 4 ∑ x 𝜔 x | x ⟩| 0 ⟩ ∑ x 𝜔 x | x ⟩| P ( x )⟩ Q cipher / random

Introduction Q2 model: superposition queries FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia Brute-force 8 / 25 Q1 model: classical queries About the models Conclusion Truncated difgerential Difgerential ▶ Build a quantum circuit from classical values ▶ Example: breaking RSA with Shor’s algorithm ▶ Access quantum circuit implementing the primitive with a secret key ▶ Example: breaking CBCMAC with Simon’s algorithm ▶ The Q2 model is very strong for the adversary ▶ Simple and clean generalisation of classical oracle ▶ Aim for security in the strongest (nontrivial) model ▶ A Q2secure block cipher is useful for security proofs of modes

Introduction Brute-force FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia Conclusion Truncated difgerential Difgerential Brute-force Introduction Outline Conclusion Truncated difgerential Difgerential 8 / 25 Quantum Computing Grover’s algorithm Distinguisher Lastround attack Distinguisher Lastround attack

Introduction Classical algorithm FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia Brute-force 9 / 25 Difgerential Grover’s algorithm Truncated difgerential Conclusion ▶ Search for a marked element in a set X ▶ Set of marked elements M , with | M | ≥ 𝜁 ⋅ | X | 1: loop x ← Setup () ▷ Pick a random element in X , cost S 2: if Check( x ) then ▷ Check if it is marked, cost C 3: return x 4: ▶ 1 /𝜁 repetitions expected ▶ Complexity ( S + C )/𝜁

Introduction Grover Algorithm (as a quantum walk) FSE 2017 Quantum Difgerential and Linear Cryptanalysis Kaplan, Leurent, Leverrier & Naya-Plasencia Brute-force 9 / 25 Conclusion Grover’s algorithm Truncated difgerential Difgerential ▶ Search for a marked element in a set X ▶ Set of marked elements M , with | M | ≥ 𝜁 ⋅ | X | Quantum algorithm to find a marked element using: ▶ Setup: builds a uniform superposition of inputs in X ▶ Check: applies a controlphase gate to the marked elements ▶ Only 1 /√𝜁 repetitions needed ▶ Complexity ( S + C )/√𝜁 ▶ Can produce a uniform superposition of M ▶ Can provide an oracle without measuring (nesting) ▶ Variant to measure 𝜁 (quantum counting)