Two-round Even-Mansour block cipher resists quantum attacks
On The Simplest Quantum-Secure Block Cipher
Cryptography and Security
Summary
Cryptographic algorithms called pseudorandom permutations are important for secure communication and data protection. The authors studied a method called the Even-Mansour cipher, which is simple but known to be breakable with quantum computing if only one round is used. They proved that using two rounds of this cipher can protect against powerful quantum attacks that adapt based on previous queries. This work shows the minimal setup needed for quantum-secure block ciphers within this framework.
What this means in practice
- •For cryptography engineers: Design quantum-resistant block ciphers using two-round Even-Mansour constructions to secure data against future quantum attacks.
- •For quantum computing platform developers: Use the two-round Even-Mansour cipher as a primitive to build pseudorandom unitaries or cryptographic protocols that separate classical and quantum complexity classes.
A theory result. No direct application yet.
Authors
Gorjan Alagic, Joseph Carolan, Christian Majenz, Saliha Tokat
Abstract
Pseudorandom permutations are ubiquitous in theoretical and applied cryptography. PRPs that offer security even against adversaries making quantum queries are of increasing interest, and used in applications ranging from constructing pseudorandom unitaries to separating SZK from BQP. A successful framework for constructing classically-secure PRPs is the key-alternating Even-Mansour approach, which interleaves applications of public permutations with additions of round keys. The single-round construction is already classically secure in the ideal permutation model (IPM), with added rounds offering improved concrete security. However, in the quantum-query setting, the status of this framework is presently unclear. A simple quantum-query attack based on Simon's algorithm breaks the one-round cipher. For two or more rounds, security is only known against non-adaptive adversaries who must prepare all queries in advance. In this work, we show that the two-round Even-Mansour cipher is information theoretically secure in the IPM against adversaries making polynomially-many adaptive forward and inverse quantum queries to all available oracles. Our proof uses compressed permutation oracles and a specially crafted isometry relating the ideal and real experiments. We also show that this construction is minimal, in the sense that essentially any cipher constructed via a single call to a public permutation is quantumly insecure.