Quantum Attacks on Hash Constructions with Low Quantum Random Access Memory

Abstract

At ASIACRYPT 2022, Benedikt, Fischlin, and Huppert proposed the quantum herding attacks on iterative hash functions for the first time. Their attack needs exponential quantum random access memory (qRAM), more precisely $2^{0.43n}$ quantum accessible classical memory (QRACM). As the existence of large qRAM is questionable, Benedikt et al. leave an open question on building low-qRAM quantum herding attacks.

In this paper, we answer this open question by building a quantum herding attack, where the time complexity is slightly increased from Benedikt et al.’s $2^{0.43n}$ to ours $2^{0.46n}$, but it does not need qRAM anymore (abbreviated as no-qRAM). Besides, we also introduce various low-qRAM or no-qRAM quantum attacks on hash concatenation combiner, hash XOR combiner, Hash-Twice, and Zipper hash functions.

Appendices

A On Bao et al.’s Diamond Structure Building Algorithm

In [7, Section 3.3], the authors proposed a quantum algorithm for building diamond structure with exponential large QRAQM in their Algorithm 2. After that, they try to study the no-qRAM version. However, they only give the following sentences for their no-qRAM algorithm [7, Page 12]:

“In Scenario R2, the time complexity to find a collision is of $(2^{(n-t)})^{2/5}$ computations. Therefore, building a $2^t$-diamond structure requires $\mathcal {O}(t^{(2/3)}\cdot 2^t \cdot 2^{(2(n-t)/5)}) = \mathcal {O}(t^{2/3} \cdot 2^{(2n+3t)/5})$ computations, with $\mathcal {O}(t^{2/3} \cdot 2^t \cdot 2^{(n-t)/5}) = \mathcal {O}(t^{2/3} \cdot 2^{(n+4t)/5})$ classical memory. (see [7, Page 12])”

The authors do not give concrete steps for this no-qRAM algorithm. After communicating with the authors, we know that they just estimated the time complexity by replacing the Grover’s algorithm with CNS algorithm [21] and use classical memory to store the data instead of qRAM. They do not give the concrete steps at all.

However, the conversion is not trivial as estimated by the authors of [7]. In fact, we use almost two pages in Sect. 3.2 to reveal the no-qRAM algorithm. When we try to rebuild the steps with CNS collision algorithm [21] for building diamond, we find the final time complexity is $2^{(2n+4t)/5}$, which is different from the time $2^{(2n+3t)/5}$ claimed in [7]. Then, we communicated with the authors of [7] again, and they admitted our steps and time evaluation are correct.

Since the authors of [7] do not publish or give us their concrete steps for their claimed no-qRAM algorithm, we can not check which step is possibly wrong or which step leads to the different complexities. Since the herding attack is based on diamond structure, Bao et al’s [7] herding attack in no-qRAM setting is also flawed.

B On Bao et al.’s Quantum Herding Attack

In the original estimation by Bao et al. [7, Section 4.3], the overall time complexity of the no-qRAM herding attack is about $2^{((2n+3k)/5)} + 2^{(n/2-k/6)}$, where $2^{((2n+3k)/5)}$ is the time to build a $2^k$-diamond, and the time $2^{(n/2-k/6)}$ is to find the linking message $M_{link}$ to the diamond based on Chailloux et al.’s multi-target preimage algorithm [21]. After tradeoff between the two, it achieves optimal when $k=3n/23$, which results in the overall time complexity $2^{(11n/23)} = 2^{(0.478n)}$, classical memory $2^{(7n/23)}=2^{(0.304n)}$. Even if we compare our no-qRAM herding attack in Sect. 4 (i.e., time $2^{0.46n}$, classical memory $2^{0.23n}$) with this original complexity estimation of [7], the improvement of our attack is obvious.

However, the algorithm of building diamond structure of [7] is flawed as shown in Appendix A. Their herding attack based on diamond is also wrong. In fact, the time $2^{((2n+3k)/5)}$ will be $2^{((2n+4k)/5})$ when using our correct diamond building algorithm given in Sect. 3.2. Therefore, the complexity of Bao et al.’s no-qRAM herding attack becomes $2^{((2n+4k)/5)} + 2^{(n/2-k/6)}$ time and $2^{(n+2k)/5}$ classical memory, which achieves optimal when $k=3n/29$, that results in time $2^{(14n/29)}=2^{(0.4827n)}$, classical memory $2^{(7n/29)}=2^{(0.24n)}$. When compared with this corrected Bao et al.’s attack, our attack in Sect. 4 (time=$2^{0.46n}$, classical memory=$2^{0.23n}$) is still better obviously.