Mandal Surajit, Anand Ravi, Rahman Mostafizar, Sarkar Santanu, Isobe Takanori
Indian Institute of Technology Madras, Chennai, India.
Indraprastha Institute of Technology Delhi, New Delhi, India.
Sci Rep. 2024 Sep 10;14(1):21105. doi: 10.1038/s41598-024-69188-8.
Extensive research is currently underway to determine the security of existing ciphers in light of the advancements in quantum computing. Against symmetric key cryptography, Grover's search algorithm is a prominent attack, capable of reducing search costs to the square root. For using Grover's algorithm, it is imperative to embed the target cipher into a quantum circuit. Even so, this area of research is relatively new; it has garnered significant attention from the research community. In this study, we provide the first estimation of the cost of Grover's key search attack against the AES-based AEAD schemes Rocca-S, AEGIS-128, and Tiaoxin-346. Our analysis considers circuit depth restrictions specified in NIST's PQC standardization process. Considering NIST's maximum depth constraints, We present the overall cost of these attacks using gate count and depth-times-width metrics. We observed that for , Rocca-S, AEGIS-128, and Tiaoxin-346 can be retrieved using Grover's search algorithm with gate count of 1.09 × 2, 1.14 × 2, and 1.22 × 2 respectively. Concerning the current updated values by NIST, these ciphers are secure in terms of the cost of implementing Grover's attack for key recovery. The quantum circuits of these ciphers are implemented using QISKIT, an open-source software development kit (SDK) designed for working with quantum computers running on the IBM Quantum Experience platform.
鉴于量子计算的进展，目前正在进行广泛的研究以确定现有密码的安全性。针对对称密钥密码学，格罗弗搜索算法是一种突出的攻击方式，能够将搜索成本降低到平方根。为了使用格罗弗算法，必须将目标密码嵌入到量子电路中。即便如此，这一研究领域相对较新；它已引起了研究界的广泛关注。在本研究中，我们首次估计了针对基于AES的AEAD方案Rocca-S、AEGIS-128和天琴-346的格罗弗密钥搜索攻击的成本。我们的分析考虑了美国国家标准与技术研究院（NIST）的后量子密码（PQC）标准化过程中规定的电路深度限制。考虑到NIST的最大深度约束，我们使用门数和深度-时间-宽度指标给出了这些攻击的总成本。我们观察到，对于 ，使用格罗弗搜索算法分别以1.09×2、1.14×2和1.22×2的门数可以检索出Rocca-S、AEGIS-128和天琴-346。关于NIST当前的更新值，就实施格罗弗攻击进行密钥恢复的成本而言，这些密码是安全的。这些密码的量子电路是使用QISKIT实现的，QISKIT是一个开源软件开发工具包（SDK），专为在IBM量子体验平台上运行的量子计算机而设计。
