Quantum Attacks Against Type-1 Generalized Feistel Ciphers and Applications to CAST-256

Boyu Ni,Gembu Ito,Xiaoyang Dong,Tetsu Iwata

DOI: https://doi.org/10.1007/978-3-030-35423-7_22

2020-01-01

Abstract:Generalized Feistel Schemes (GFSs) are important components of symmetric ciphers, which have been extensively studied in the classical setting. However, detailed security evaluations of GFS in the quantum setting still remain to be explored.

What problem does this paper attempt to address?

Quantum attacks on some feistel block ciphers

Xiaoyang Dong,Bingyou Dong,Xiaoyun Wang

DOI: https://doi.org/10.1007/s10623-020-00741-y

2020-03-09

Abstract:Post-quantum cryptography has attracted much attention from worldwide cryptologists. However, most research works are related to public-key cryptosystem due to Shor's attack on RSA and ECC ciphers. At CRYPTO 2016, Kaplan et al. showed that many secret-key (symmetric) systems could be broken using a quantum period finding algorithm, which encouraged researchers to evaluate symmetric systems against quantum attackers. In this paper, we continue to study symmetric ciphers against quantum attackers. First, we convert the classical advanced slide attacks (introduced by Biryukov and Wagner) to a quantum one, that gains an exponential speed-up in time complexity. Thus, we could break 2/4K-Feistel and 2/4K-DES in polynomial time. Second, we give a new quantum key-recovery attack on full-round GOST, which is a Russian standard, with <span class="mathjax-tex">$2^{114.8}$</span> quantum queries of the encryption process, faster than a quantum brute-force search attack by a factor of <span class="mathjax-tex">$2^{13.2}$</span>.
Quantum cryptanalysis on some generalized Feistel schemes

Xiaoyang Dong,Zheng Li,Xiaoyun Wang

DOI: https://doi.org/10.1007/s11432-017-9436-7

2019-01-02

Science China Information Sciences

Abstract:Post-quantum cryptography has attracted much attention from worldwide cryptologists. In ISIT 2010, Kuwakado and Morii gave a quantum distinguisher with polynomial time against 3-round Feistel networks. However, generalized Feistel schemes (GFS) have not been systematically investigated against quantum attacks. In this paper, we study the quantum distinguishers about some generalized Feistel schemes. For d-branch Type-1 GFS (CAST256-like Feistel structure), we introduce (2d - 1)-round quantum distinguishers with polynomial time. For 2d-branch Type-2 GFS (RC6/CLEFIA-like Feistel structure), we give (2d + 1)-round quantum distinguishers with polynomial time. Classically, Moriai and Vaudenay proved that a 7-round 4-branch Type-1 GFS and 5-round 4-branch Type-2 GFS are secure pseudo-random permutations. Obviously, they are no longer secure in quantum setting. Using the above quantum distinguishers, we introduce generic quantum key-recovery attacks by applying the combination of Simon’s and Grover’s algorithms recently proposed by Leander and May. We denote n as the bit length of a branch. For (d2-d+2)-round Type-1 GFS with d branches, the time complexity is 2(12d2−32d+2)⋅n2$${2^{\left( {\frac{1}{2}{d^2} - \frac{3}{2}d + 2} \right) \cdot \frac{n}{2}}}$$, which is better than the quantum brute force search (Grover search) by a factor 2(14d2+14d)n$${2^{\left( {\frac{1}{4}{d^2} + \frac{1}{4}d} \right)n}}$$. For 4d-round Type-2 GFS with 2d branches, the time complexity is 2d2n2$${2^{\frac{{{d^2}n}}{2}}}$$, which is better than the quantum brute force search by a factor 23d2n2$${2^{\frac{{3{d^2}n}}{2}}}$$.

computer science, information systems,engineering, electrical & electronic
Quantum key-recovery attack on Feistel structures

Xiaoyang Dong,Xiaoyun Wang

DOI: https://doi.org/10.1007/s11432-017-9468-y

2018-08-31

Science China Information Sciences

Abstract:Post-quantum cryptography has drawn considerable attention from cryptologists on a global scale. At Asiacrypt 2017, Leander and May combined Grover’s and Simon’s quantum algorithms to break the FX-based block ciphers, which were introduced by Kilian and Rogaway to strengthen DES. In this study, we investigate the Feistel constructions using Grover’s and Simon’s algorithms to generate new quantum key-recovery attacks on different rounds of Feistel constructions. Our attacks require 20.25nr−0.75n quantum queries to break an r-round Feistel construction. The time complexity of our attacks is less than that observed for quantum brute-force search by a factor of 20.75n. When compared with the best classical attacks, i.e., Dinur et al.’s attacks at CRYPTO 2015, the time complexity is reduced by a factor of 20.5n without incurring any memory cost.

computer science, information systems,engineering, electrical & electronic
Quantum attacks on generalized Feistel networks based on the strong–weak separability

Ying Xu,Xiaoni Du,Meichun Jia,Xiangyu Wang,Jian Zou

DOI: https://doi.org/10.1007/s11128-023-04135-6

IF: 1.965

2023-10-16

Quantum Information Processing

Abstract:Generalized Feistel networks are important components of symmetric ciphers, and detailed security evaluations in the quantum setting remain to be explored. In this paper, based on the strong–weak separability of certain branch output function, we present polynomial-time quantum distinguishers for 4F-function and 2F-function structures in quantum chosen-plaintext attack setting for the first time, and then quantum key-recovery attacks are achieved through Grover-meet-Simon algorithm, respectively. Under the condition of the semi-strong separability, firstly, we give a quantum distinguisher on 8-round 4F-function structure, from which we carry out a 12-round quantum key-recovery attack to guess 10 n -bit subkey, whose time complexities gain a factor of . When attacking rounds, we can recover -bit subkey in time . Secondly, we show a quantum distinguisher on 5-round 2F-function structure, and a 7-round quantum key-recovery attack is performed on it, which can recover 3 n -bit subkey in time . When , -bit subkey can be recovered with time complexities by a factor of . Furthermore, based on the weak separability, a 6-round quantum distinguisher for 2F-function structure is constructed, and an 8-round quantum key-recovery attack is achieved, and the time complexity is when . The results show that the time complexity of each attack scheme we proposed is much better than that of Grover's brute force search.

physics, multidisciplinary,quantum science & technology, mathematical
Quantum Differential and Linear Cryptanalysis

Marc Kaplan,Gaëtan Leurent,Anthony Leverrier,María Naya-Plasencia

DOI: https://doi.org/10.13154/tosc.v2016.i1.71-94

2017-03-07

Abstract:Quantum computers, that may become available one day, would impact many scientific fields, most notably cryptography since many asymmetric primitives are insecure against an adversary with quantum capabilities. Cryptographers are already anticipating this threat by proposing and studying a number of potentially quantum-safe alternatives for those primitives. On the other hand, symmetric primitives seem less vulnerable against quantum computing: the main known applicable result is Grover's algorithm that gives a quadratic speed-up for exhaustive search. In this work, we examine more closely the security of symmetric ciphers against quantum attacks. Since our trust in symmetric ciphers relies mostly on their ability to resist cryptanalysis techniques, we investigate quantum cryptanalysis techniques. More specifically, we consider quantum versions of differential and linear cryptanalysis. We show that it is usually possible to use quantum computations to obtain a quadratic speed-up for these attack techniques, but the situation must be nuanced: we don't get a quadratic speed-up for all variants of the attacks. This allows us to demonstrate the following non-intuitive result: the best attack in the classical world does not necessarily lead to the best quantum one. We give some examples of application on ciphers LAC and KLEIN. We also discuss the important difference between an adversary that can only perform quantum computations, and an adversary that can also make quantum queries to a keyed primitive.

Quantum Physics,Cryptography and Security
Computational Security of Quantum Encryption

Gorjan Alagic,Anne Broadbent,Bill Fefferman,Tommaso Gagliardoni,Christian Schaffner,Michael St. Jules

DOI: https://doi.org/10.48550/arXiv.1602.01441

2016-02-03

Quantum Physics

Abstract:Quantum-mechanical devices have the potential to transform cryptography. Most research in this area has focused either on the information-theoretic advantages of quantum protocols or on the security of classical cryptographic schemes against quantum attacks. In this work, we initiate the study of another relevant topic: the encryption of quantum data in the computational setting. In this direction, we establish quantum versions of several fundamental classical results. First, we develop natural definitions for private-key and public-key encryption schemes for quantum data. We then define notions of semantic security and indistinguishability, and, in analogy with the classical work of Goldwasser and Micali, show that these notions are equivalent. Finally, we construct secure quantum encryption schemes from basic primitives. In particular, we show that quantum-secure one-way functions imply IND-CCA1-secure symmetric-key quantum encryption, and that quantum-secure trapdoor one-way permutations imply semantically-secure public-key quantum encryption.
Improved Security Bounds for Generalized Feistel Networks

Yaobin Shen,Chun Guo,Lei Wang

DOI: https://doi.org/10.13154/tosc.v2020.i1.425-457

2020-01-01

Abstract:We revisit the security of various generalized Feistel networks. Concretely, for unbalanced, alternating, type-1, type-2, and type-3 Feistel networks built from random functions, we substantially improve the coupling analyzes of Hoang and Rogaway (CRYPTO 2010). For a tweakable blockcipher-based generalized Feistelnetwork proposed by Coron et al. (TCC 2010), we present a coupling analysis and for the first time show that with enough rounds, it achieves 2n-bit security, and this provides highly secure, double-length tweakable blockciphers.
Quantum Key-length Extension

Joseph Jaeger,Fang Song,Stefano Tessaro

DOI: https://doi.org/10.48550/arXiv.2105.01242

2021-10-23

Abstract:Should quantum computers become available, they will reduce the effective key length of basic secret-key primitives, such as blockciphers. To address this we will either need to use blockciphers which inherently have longer keys or use key-length extension techniques which employ a blockcipher to construct a more secure blockcipher that uses longer keys. We consider the latter approach and revisit the FX and double encryption constructions. Classically, FX is known to be secure, while double encryption is no more secure than single encryption due to a meet-in-the-middle attack. We provide positive results, with concrete and tight bounds, for both of these constructions against quantum attackers in ideal models. For FX, we consider a partially-quantum model, where the attacker has quantum access to the ideal primitive, but only classic access to FX. We provide two results for FX in this model. The first establishes the security of FX against non-adaptive attackers. The second establishes security against general adaptive attacks for a variant of FX using a random oracle in place of an ideal cipher. This result relies on the techniques of Zhandry (CRYPTO '19) for lazily sampling a quantum random oracle. An extension to perfectly lazily sampling a quantum random permutation, which would help resolve the adaptive security of standard FX, is an important but challenging open question. We introduce techniques for partially-quantum proofs without relying on analyzing the classical and quantum oracles separately, which is common in existing work. This may be of broader interest. For double encryption we apply a technique of Tessaro and Thiruvengadam (TCC '18) to establish that security reduces to the difficulty of solving the list disjointness problem, which we are able to reduce through a chain of results to the known quantum difficulty of the element distinctness problem.

Quantum Physics,Cryptography and Security
Quantum All-Subkeys-Recovery Attacks on 6-round Feistel-2* Structure Based on Multi-Equations Quantum Claw Finding

Wenjie Liu,Mengting Wang,Zixian Li

DOI: https://doi.org/10.1007/s11128-023-03877-7

2023-09-24

Abstract:Exploiting quantum mechanisms, quantum attacks have the potential ability to break the cipher structure. Recently, Ito et al. proposed a quantum attack on Feistel-2* structure (Ito et al.'s attack) based onthe Q2 model. However, it is not realistic since the quantum oracle needs to be accessed by the adversary, and the data complexityis high. To solve this problem, a quantum all-subkeys-recovery (ASR) attack based on multi-equations quantum claw-finding is proposed, which takes a more realistic model, the Q1 model, as the scenario, and only requires 3 plain-ciphertext pairs to quickly crack the 6-round Feistel-2* structure. First, we proposed a multi-equations quantum claw-finding algorithm to solve the claw problem of finding multiple equations. In addition, Grover's algorithm is used to speedup the rest subkeys recovery. Compared with Ito et al.'s attack, the data complexity of our attack is reduced from O(2^n) to O(1), while the time complexity and memory complexity are also significantly reduced.

Quantum Physics,Cryptography and Security,Emerging Technologies
Dedicated Quantum Attacks on XOR-Type Function With Applications to Beyond-Birthday- Bound MACs

Tairong Shi,Wenling Wu,Bin Hu,Jie Guan,Han Sui,Senpeng Wang,Mengyuan Zhang

DOI: https://doi.org/10.1109/tifs.2024.3402970

IF: 7.231

2024-06-07

IEEE Transactions on Information Forensics and Security

Abstract:A lot of work in the field of quantum cryptanalysis is currently devoted to finding applications of Grover-meets-Simon algorithm and its complexity is given in the form of , but research on how to implement the attack efficiently is still insufficient. After all, it is crucial to study quantum attacks in resource-limited situations, according to NIST's guidance on circuit depth. This work first evaluates the parallelization of Grover-meets-Simon by drawing on the Grover's parallel approach and shows that as the width increases by , the depth decreases by a factor of . Further, the first dedicated quantum attack on a class of functions that appear in cryptographic scheme applications (so-called XOR-type function) is proposed. The depth, width, and the number of gates required for the attack are greatly reduced compared to the general parallelization. Then we apply the attack to various Beyond-Birthday-Bound (BBB) MACs, where the XOR function can be constructed, including SUM-ECBC and its variants (2K-SUM-ECBC, 2K-ECBC_Plus), and GCM-SIV2. In the typical case where SUM-ECBC is based on AES-128, our attack saves at least 62.3% in depth, 19.5% in width and 22.2% in gate count simultaneously. The impact on some lightweight ciphers is further explored, and it is interesting to note that the lighter the quantum circuit implementation of the cipher is, the greater the possible impact of an attack will be. This observation may provide new insights into quantum cryptanalysis.

computer science, theory & methods,engineering, electrical & electronic
Quantum Attacks: A View of Data Complexity on Offline Simon's Algorithm.

Bo Yu,Tairong Shi,Xiaoyang Dong,Xuan Shen,Yiyuan Luo,Bing Sun

DOI: https://doi.org/10.1007/978-981-97-0945-8_19

2024-01-01

Abstract:Simon's algorithm has shown a threat to block ciphers in the quantum setting, especially accelerating attacks with superposition queries. Sometimes it is difficult for attackers to make superposition queries, while an easier way is to use classical data then process them on quantum computers. At ASIACRYPT 2019, Bonnetain et al. proposed the offline Simon's algorithm. But there is a gap between the classical queries and a quantum database in their work. In this paper, we propose an algorithm involving polynomial qubits that can transform a classical database into a quantum superposition state without using QRAM. What's more, we analyze the influence of two approaches called pre- and post-distinguisher methods for Simon's algorithm attack. Then we run a quantum key recovery attack on Feistel structure in the Q1 model. For attacking r-round Feistel structure with n-bit block size and n/2-bit subkey, the time complexity of our attack is O(l center dot 2(n/2+2) + 2((r-3)n/4)) (where l is a constant), and the classical data complexity is always O(2(n/2+1)), which is much better than the classical attacks especially for r > 5.
Lattice-Based Cryptography: A Survey

Xiaoyun Wang,Guangwu Xu,Yang Yu

DOI: https://doi.org/10.1007/s11401-023-0053-6

2023-12-01

Chinese Annals of Mathematics Series B

Abstract:Most of current public key cryptosystems would be vulnerable to the attacks of the future quantum computers. Post-quantum cryptography offers mathematical methods to secure information and communications against such attacks, and therefore has been receiving a significant amount of attention in recent years. Lattice-based cryptography, built on the mathematical hard problems in (high-dimensional) lattice theory, is a promising post-quantum cryptography family due to its excellent efficiency, moderate size and strong security. This survey aims to give a general overview on lattice-based cryptography. To this end, the authors begin with the introduction of the underlying mathematical lattice problems. Then they introduce the fundamental cryptanalytic algorithms and the design theory of lattice-based cryptography.

mathematics
Revisit and Cryptanalysis of a CAST Cipher

XIAO ZHOU,JINGWEI LI,XUEJIA LAI,HAILUN YAN

DOI: https://doi.org/10.12783/dtcse/iceiti2017/18884

2018-01-01

DEStech Transactions on Computer Science and Engineering

Abstract:CAST family of ciphers are the block ciphers created by Carlisle Adams et al. in 1996. One famous member of CAST family is CAST-128, which is a 12-round or 16-round Feistel network. In this paper, we apply the interpolation attack on both 5- round and 16-round CAST-128 Cipher to recover the last round key. We first mount the basic interpolation attack separately on it. After combining with the higher order differential cryptanalysis, our result reduces the time complexity in 231.4 bit operation for 5-round attack. We also apply the optimized interpolation attack on the 16-round CAST-128-like structure which requires 244.2 bit operations and 231 chosen plaintexts.
Hacking Cryptographic Protocols with Advanced Variational Quantum Attacks

Borja Aizpurua,Pablo Bermejo,Josu Etxezarreta Martinez,Roman Orus

2023-11-06

Abstract:Here we introduce an improved approach to Variational Quantum Attack Algorithms (VQAA) on crytographic protocols. Our methods provide robust quantum attacks to well-known cryptographic algorithms, more efficiently and with remarkably fewer qubits than previous approaches. We implement simulations of our attacks for symmetric-key protocols such as S-DES, S-AES and Blowfish. For instance, we show how our attack allows a classical simulation of a small 8-qubit quantum computer to find the secret key of one 32-bit Blowfish instance with 24 times fewer number of iterations than a brute-force attack. Our work also shows improvements in attack success rates for lightweight ciphers such as S-DES and S-AES. Further applications beyond symmetric-key cryptography are also discussed, including asymmetric-key protocols and hash functions. In addition, we also comment on potential future improvements of our methods. Our results bring one step closer assessing the vulnerability of large-size classical cryptographic protocols with Noisy Intermediate-Scale Quantum (NISQ) devices, and set the stage for future research in quantum cybersecurity.

Quantum Physics,Cryptography and Security,Machine Learning
Quantum Attacks on 1K-AES and PRINCE

Bin-Bin Cai,Yusen Wu,Jing Dong,Su-Juan Qin,Fei Gao,Qiao-Yan Wen

DOI: https://doi.org/10.1093/comjnl/bxab216

2022-02-01

The Computer Journal

Abstract:Abstract By introducing the BHT algorithm into the slide attack on 1K-AES and the related-key attack on PRINCE, we present the corresponding quantum attacks in this paper. In the proposed quantum attacks, we generalize the BHT algorithm to the situation where the number of marked items is unknown ahead of time. Moreover, we give an implementation scheme of classifier oracle based on Quantum Phase Estimation algorithm in presented quantum attacks. The complexity analysis shows that the query complexity, time complexity and memory complexity of the presented quantum attacks are all $\mathcal{O}(2^{n/3})$ when the success probability is about $63\%$, where $n$ is the block size. Compared with the corresponding classical attacks, the proposed quantum attacks can achieve subquadratic speed-up under the same success probability no matter on query complexity, time complexity or memory complexity. Furthermore, the query complexity of the proposed quantum slide attack on 1K-AES is less than Grover search on 1K-AES by a factor of $2^{n/6}.$ When compared with the Grover search on PRINCE, the query complexity of the presented quantum attack on PRINCE is reduced from $\mathcal{O}(2^{n})$ to $\mathcal{O}(2^{n/2}).$ When compared with the combination of Grover and Simon’s algorithms on PRINCE, the query complexity of our quantum attack on PRINCE is reduced from $\mathcal{O}(n\cdot 2^{n/2})$ to $\mathcal{O}(2^{n/2}).$ Besides, the proposed quantum slide attack on 1K-AES indicates that the quantum slide attack could also be applied on Substitution-Permutation Network construction, apart from the iterated Even-Mansour cipher and Feistel constructions.

computer science, information systems, theory & methods, software engineering, hardware & architecture
New Differential Cryptanalytic Results for Reduced-Round CAST-128.

Meiqin Wang,Xiaoyun Wang,Kam Pui Chow,Lucas Chi Kwong Hui

DOI: https://doi.org/10.1587/transfun.e93.a.2744

2010-01-01

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences

Abstract:CAST-128 is a block cipher used in a number of products, notably as the default cipher in some versions of GPG and PGP. It has been approved for Canadian government use by the Communications Security Establishment. Haruki Seki et al. found 2-round differential characteristics and they can attack 5-round CAST-128. In this paper, we studied the properties of round functions F1 and F3 in CAST-128, and identified differential characteristics for F1 round function and F3 round function. So we identified a 6-round differential characteristic with probability 2-53 under 2-23.8 of the total key space. Then based on 6-round differential characteristic, we can attack 8-round CAST-128 with key sizes greater than or equal to 72bits and 9-round CAST-128 with key sizes greater than or equal to 104bits. We give the summary of attacks on reduced-round CAST-128 in Table 10.
Quantum cryptography beyond key distribution: theory and experiment

Mathieu Bozzio,Claude Crépeau,Petros Wallden,Philip Walther

2024-11-14

Abstract:Due to its fundamental principles, quantum theory holds the promise to enhance the security of modern cryptography, from message encryption to anonymous communication, digital signatures, online banking, leader election, one-time passwords and delegated computation. While quantum key distribution (QKD) has already enabled secure key exchange over hundreds of kilometers, a myriad of other quantum-cryptographic primitives are being developed to secure future applications against quantum adversaries. This article surveys the theoretical and experimental developments in quantum cryptography beyond QKD over the past decades, along with advances in secure quantum computation. It provides an intuitive classification of the main quantum primitives and their security levels, summarizes their possibilities and limits, and discusses their implementation with current photonic technology.

Quantum Physics
General Linear Group Action on Tensors: A Candidate for Post-quantum Cryptography

Zhengfeng Ji,Youming Qiao,Fang Song,Aaram Yun

DOI: https://doi.org/10.1007/978-3-030-36030-6_11

2019-01-01

Abstract:Starting from the one-way group action framework of Brassard and Yung (Crypto’90), we revisit building cryptography based on group actions. Several previous candidates for one-way group actions no longer stand, due to progress both on classical algorithms (e.g., graph isomorphism) and quantum algorithms (e.g., discrete logarithm).
Superposition Attacks on Pseudorandom Schemes Based on Two or Less Permutations

Shaoxuan Zhang,Chun Guo,Qingju Wang

DOI: https://doi.org/10.1049/2024/9991841

2024-09-15

IET Information Security

Abstract:We study quantum superposition attacks against permutation‐based pseudorandom cryptographic schemes. We first extend Kuwakado and Morii's attack against the Even–Mansour cipher and exhibit key recovery attacks against a large class of pseudorandom schemes based on a single call to an n‐bit permutation, with polynomial O(n) (or O(n2), if the concrete cost of Hadamard transform is also taken in) quantum steps. We then consider TPPR schemes, namely, two permutation‐based pseudorandom cryptographic schemes. Using the improved Grover‐meet‐Simon method, we show that the keys of a wide class of TPPR schemes can be recovered with O(n) superposition queries (the complexity of the original is O(n2n/2)) and O(n2n/2) quantum steps. We also exhibit subclasses of "degenerated" TPPR schemes that lack certain internal operations and exhibit more efficient key recovery attacks using either the Simon's algorithm or collision searching algorithm. Further, using the all‐subkeys‐recovery idea of Isobe and Shibutani, our results give rise to key recovery attacks against several recently proposed permutation‐based PRFs, as well as the two‐round Even–Mansour ciphers with generic key schedule functions and their tweakable variants. From a constructive perspective, our results establish new quantum Q2 security upper bounds for two permutation‐based pseudorandom schemes as well as sound design choices.

computer science, information systems, theory & methods
Digest of Quantum Stream Cipher based on Holevo-Yuen Theory

Masaki Sohma,Osamu Hirota

DOI: https://doi.org/10.48550/arXiv.2206.01937

2022-06-04

Quantum Physics

Abstract:So far, quantum key distribution (QKD) has been the main subject in the field of quantum cryptography, but that is not quantum cryptographic communication, it is only the ability to send keys for cryptographic purposes. To complete cryptographic communication, a technique for encrypting data is necessary, and the conventional cryptographic technique of mathematical symmetric key cipher or One Time Pad (OTP) is adopted in the discussion so far. However, OTP is not the ultimate cipher for data encryption, because it does not satisfy security conditions in the modern cryptology. Around 2000, a new quantum stream cipher was proposed as a technique to challenge the possibility of overcoming drawbacks of OTP in practical use. Recently, we have published some review papers on it in Entropy (Open access journal), and others. This paper introduces an overview and a back ground of our paper that is entitled Quantum stream cipher based on Holevo-Yuen theory.

Quantum Attacks Against Type-1 Generalized Feistel Ciphers and Applications to CAST-256

Quantum attacks on some feistel block ciphers

Quantum cryptanalysis on some generalized Feistel schemes

Quantum key-recovery attack on Feistel structures

Quantum attacks on generalized Feistel networks based on the strong–weak separability

Quantum Differential and Linear Cryptanalysis

Computational Security of Quantum Encryption

Improved Security Bounds for Generalized Feistel Networks

Quantum Key-length Extension

Quantum All-Subkeys-Recovery Attacks on 6-round Feistel-2* Structure Based on Multi-Equations Quantum Claw Finding

Dedicated Quantum Attacks on XOR-Type Function With Applications to Beyond-Birthday- Bound MACs

Quantum Attacks: A View of Data Complexity on Offline Simon's Algorithm.

Lattice-Based Cryptography: A Survey

Revisit and Cryptanalysis of a CAST Cipher

Hacking Cryptographic Protocols with Advanced Variational Quantum Attacks

Quantum Attacks on 1K-AES and PRINCE

New Differential Cryptanalytic Results for Reduced-Round CAST-128.

Quantum cryptography beyond key distribution: theory and experiment

General Linear Group Action on Tensors: A Candidate for Post-quantum Cryptography

Superposition Attacks on Pseudorandom Schemes Based on Two or Less Permutations

Digest of Quantum Stream Cipher based on Holevo-Yuen Theory