Abstract:Should quantum computers become available, they will reduce the effective key length of basic secret-key primitives, such as blockciphers. To address this we will either need to use blockciphers which inherently have longer keys or use key-length extension techniques which employ a blockcipher to construct a more secure blockcipher that uses longer keys. We consider the latter approach and revisit the FX and double encryption constructions. Classically, FX is known to be secure, while double encryption is no more secure than single encryption due to a meet-in-the-middle attack. We provide positive results, with concrete and tight bounds, for both of these constructions against quantum attackers in ideal models. For FX, we consider a partially-quantum model, where the attacker has quantum access to the ideal primitive, but only classic access to FX. We provide two results for FX in this model. The first establishes the security of FX against non-adaptive attackers. The second establishes security against general adaptive attacks for a variant of FX using a random oracle in place of an ideal cipher. This result relies on the techniques of Zhandry (CRYPTO '19) for lazily sampling a quantum random oracle. An extension to perfectly lazily sampling a quantum random permutation, which would help resolve the adaptive security of standard FX, is an important but challenging open question. We introduce techniques for partially-quantum proofs without relying on analyzing the classical and quantum oracles separately, which is common in existing work. This may be of broader interest. For double encryption we apply a technique of Tessaro and Thiruvengadam (TCC '18) to establish that security reduces to the difficulty of solving the list disjointness problem, which we are able to reduce through a chain of results to the known quantum difficulty of the element distinctness problem.

Further improvements of the estimation of key enumeration with applications to solving LWE

Benchmarking Attacks on Learning with Errors

Minimizing CNOT-count in Quantum Circuit of the Extended Shor’s Algorithm for ECDLP

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

Improved Attacks on (EC)DSA with Nonce Leakage by Lattice Sieving with Predicate.

Learning with Errors and Extrapolated Dihedral Cosets

A Systematic Approach and Analysis of Key Mismatch Attacks on Lattice-Based NIST Candidate KEMs

The cool and the cruel: separating hard parts of LWE secrets

Cryptanalysis of a Public Key Cryptosystem Based on Diophantine Equations Via Weighted LLL Reduction.

Flexible and Compact MLWE-Based KEM

Improving Efficiency of Key Enumeration Based on Side-Channel Analysis

Magnifying Side-Channel Leakage of Lattice-Based Cryptosystems with Chosen Ciphertexts: The Case Study of Kyber

Memory-Efficient Attacks on Small LWE Keys

Several Improvements on BKZ Algorithm.

Quantum Differential and Linear Cryptanalysis

Carry Your Fault: A Fault Propagation Attack on Side-Channel Protected LWE-based KEM

A quantum-classical hybrid algorithm with Ising model for the learning with errors problem

Efficient Quantum Public-Key Encryption From Learning With Errors

Light the Signal: Optimization of Signal Leakage Attacks Against LWE-Based Key Exchange

Quantum Key-length Extension

Practical Randomized RLWE-Based Key Exchange Against Signal Leakage Attack.