Skip to Main content Skip to Navigation
Conference papers

An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography

Abstract : The cryptographic community has widely acknowledged that the emergence of large quantum computers will pose a threat to most current public-key cryptography. Primitives that rely on order-finding problems, such as factoring and computing Discrete Logarithms, can be broken by Shor’s algorithm ([49]). Symmetric primitives, at first sight, seem less impacted by the arrival of quantum computers: Grover’s algorithm [31] for searching in an unstructured database finds a marked element among 2n in time O˜(2n/2) , providing a quadratic speedup compared to the classical exhaustive search, essentially optimal. Cryptographers then commonly consider that doubling the length of the keys used will be enough to maintain the same level of security. From similar techniques, quantum collision search is known to attain O˜(2n/3) query complexity [20], compared to the classical O(2n/2) . However this quantum speedup is illusory: the actual quantum computation performed is actually more expensive than in the classical algorithm. In this paper, we investigate quantum collision and multi-target preimage search and present a new algorithm, that uses the amplitude amplification technique. As such, it relies on the same principle as Grover’s search. Our algorithm is the first to propose a time complexity that improves upon O(2n/2) , in a simple setting with a single processor. This time complexity is O˜(22n/5) (equal to its query complexity), with a polynomial quantum memory needed (O(n)), and a small classical memory complexity of O˜(2n/5). For multi-target preimage attacks, these complexities become O˜(23n/7), O(n) and O˜(2n/7) respectively. To the best of our knowledge, this is the first proof of an actual quantum time speedup for collision search. We also propose a parallelization of these algorithms. This result has an impact on several symmetric cryptography scenarios: we detail how to improve upon previous attacks for hash function collisions and multi-target preimages, how to perform an improved key recovery in the multi-user setting, how to improve the collision attacks on operation modes, and point out that these improved algorithms can serve as basic tools for some families of cryptanalytic techniques. In the end, we discuss the implications of these new attacks on post-quantum security.
Complete list of metadata
Contributor : André Chailloux Connect in order to contact the contributor
Submitted on : Tuesday, November 28, 2017 - 3:40:04 PM
Last modification on : Monday, February 22, 2021 - 12:38:50 PM




André Chailloux, María Naya-Plasencia, André Schrottenloher. An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography. Asiacrypt 2017 - Advances in Cryptology, Dec 2017, Hong Kong, China. pp.211--240, ⟨10.1007/978-3-319-70697-9_8⟩. ⟨hal-01651007⟩



Record views