Quantum Attacks: A View of Data Complexity on Offline Simon’s Algorithm

Abstract

Simon’s algorithm has shown a threat to block ciphers in the quantum setting, especially accelerating attacks with superposition queries. Sometimes it is difficult for attackers to make superposition queries, while an easier way is to use classical data then process them on quantum computers. At ASIACRYPT 2019, Bonnetain et al. proposed the offline Simon’s algorithm. But there is a gap between the classical queries and a quantum database in their work.

In this paper, we propose an algorithm involving polynomial qubits that can transform a classical database into a quantum superposition state without using QRAM. What’s more, we analyze the influence of two approaches called pre- and post-distinguisher methods for Simon’s algorithm attack. Then we run a quantum key recovery attack on Feistel structure in the Q1 model. For attacking r-round Feistel structure with n-bit block size and n/2-bit subkey, the time complexity of our attack is $O(l\cdot 2^{n/2+2}+2^{(r-3)n/4})$ (where l is a constant), and the classical data complexity is always $O(2^{n/2+1})$, which is much better than the classical attacks especially for $r>5$.