An Efficient Quantum Collision Search Algorithm and Implications on - PowerPoint PPT Presentation

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography André Chailloux, María Naya-Plasencia, André Schrottenloher Inria Paris, France December 5, 2017 A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 1/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Outline Cryptographic context 1 Quantum collision search: a brief state of the art 2 Our collision algorithm 3 A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 2/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Cryptographic context A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 3/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Cryptographic context Symmetric cryptography: Ideal security defined by generic attacks Cryptanalysis searches for faults of the primitives Cryptanalysis increases confidence A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 4/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Post-quantum cryptography Suppose an adversary has access to a universal , scalable quantum computer: RSA ( factorization ) and ECC ( discrete logarithms ) could be broken in polynomial time (Shor). This is why the community is actively working on efficient post-quantum primitives (codes, lattices, isogenies. . . ) that will be standardized. In symmetric cryptography Grover’s generic attacks. . . . What about quantum cryptanalysis? What about other generic attacks? A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 5/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Quantum collision search: a brief state of the art A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 6/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Studied problem(s) If we consider generic attacks, keeping in mind a black-box random function H : { 0 , 1 } n → { 0 , 1 } n : Collision search: find x , y such that H ( x ) = H ( y ) , classical � 2 n / 2 � time O with poly ( n ) memory, using Pollard’s rho method. Muti-target preimage search: given { h 1 , . . . , h 2 t − 1 } (the targets), find m such that H ( m ) ∈ { h 1 , . . . , h 2 t − 1 } : classical time O ( 2 n − t ) using O ( 2 t ) memory, by exhaustive search. The precise complexity for solving these problems defines ideal security bounds, e.g for hash functions. A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 7/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Collisions: state of the art Time Queries Memory Processors Note 2 n / 2 2 n / 2 Pollard’s rho poly ( n ) 1 Opt. in time / queries Time Queries Qubits Processors Note 2 n / 2 2 n / 2 Grover a poly ( n ) 1 BHT b 2 n / 3 ? ? 1 Opt. in queries 2 n / 3 2 n / 3 2 n / 3 Ambainis c 1 Opt. in time / queries a Grover, 1996 b Brassard, Høyer, and Tapp, 1998 c Ambainis, 2007 A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 8/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm In short The quantum query lower bound for collisions has been reached. All the available quantum algorithms have a common point: if we want to outperform the classical 2 n / 2 , we need more than poly ( n ) qubits. Challenge (Grover and Rudolph, 2004) Find an algorithm for collision and/or element distinctness which gives a searching speedup greater than merely a square-root factor over the number of available processing qubits. A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 9/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Our model We restrict the qubits available to poly ( n ) : this is a "reasonable" computer. Quantum resources needed are those of Grover’s algorithm. We focus on the theoretical algorithm (in the circuit model) and not on implementation details. A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 10/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Result Time Queries Memory Processors 2 n / 2 2 n / 2 Pollard’s rho method poly ( n ) 1 Time Queries Qubits Classical memory 2 n / 2 2 n / 2 Grover poly ( n ) 0 2 2 n / 3 2 n / 3 2 n / 3 BHT poly ( n ) 2 n / 3 2 n / 3 2 n / 3 Ambainis 0 2 2 n / 5 2 2 n / 5 2 n / 5 Our result poly ( n ) A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 11/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Our collision algorithm A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 12/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Grover search Given oracle access to the (efficiently computable) function : { 0 , 1 } n → { 0 , 1 } , the oracle O f acts on superpositions of f quantum states: O f ( | x � | 0 � ) = | x � | f ( x ) � and �� � � O f α i | x i � | 0 � = α i | x i � | f ( x i ) � . i i We look for x such that f ( x ) = 1. One solution among 2 n : quantum time O ( 2 n / 2 ) ; With 2 t solutions among 2 n : quantum time O ( 2 ( n − t ) / 2 ) . A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 13/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm BHT algorithm (Brassard, Høyer, Tapp, 1998) Using Grover, we can find a collision of H in O ( 2 n / 3 ) quantum queries, in two steps: Perform ℓ = 2 n / 3 arbitrary classical queries to H : H ( x 1 ) , . . . , H ( x ℓ ) . Grover : search x ∈ { 0 , 1 } n such that f ( x ) = 1. The oracle f : f ( x ) = 1 ⇐ ⇒ x / ∈ { x 1 , . . . x ℓ } and H ( x ) ∈ { H ( x 1 ) , . . . , H ( x ℓ ) } . Queries: � 2 n n 2 + 3 ���� 2 n / 3 � �� � Initial list 2 n / 3 solutions among 2 n A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 14/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm The oracle f ( x ) = 1 ⇐ ⇒ x / ∈ { x 1 , . . . x ℓ } and H ( x ) ∈ { H ( x 1 ) , . . . , H ( x ℓ ) } . Needs a superposition query to H (which is implemented). Needs to answer a query of the form y ∈ { H ( x 1 ) , . . . , H ( x ℓ ) } , in superposition. This is easy if 2 n / 3 quantum memory is available. Without any quantum data structure, how do we do? A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 15/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm BHT cost Queries: � 2 n / 3 + 2 n / 2 n / 3 ( 1 + 0 ) Time: 2 n / 3 + 2 n / 3 ( 1 + (?)) Superposition membership query: Testing if H ( x ) ∈ { H ( x 1 ) , . . . , H ( x ℓ ) } is done sequentially in time O ( 2 n / 3 ) . A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 16/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Improving   The cost is unbalanced: n n n   2 2 1 2 + + 3 3 3 ���� ���� ���� ���� 2 n / 3 solutions among 2 n Initial list Querying H Membership Because we are computing: 2 n / 3 iterations; A query to O H with each iteration; 2 n / 3 operations with each iteration. Ideas Use distinguished points; Take a smaller list: membership testing will be faster (but there will be more iterations); Balance the cost. A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 17/27

Cryptographic context Quantum collision search: a brief state of the art Our collision algorithm Step 1: distinguished points Definition (Distinguished points) All the x whose image starts with u zeroes. We generate a list of distinguished points. We are now searching only among the distinguished points (2 n − u ) for the same number of solutions (2 n / 3 ). Total cost:     n u 3 − u n u n   × 2 2 2 2 2 + + 3 2 2 2 3 ���� ���� ���� ���� ����   List size Less iterations Grover search Building Membership of a DP all the DPs � �� � � �� � First step: constructing the list Second step: searching a collision A. Chailloux, M. Naya-Plasencia, A. Schrottenloher (Inria) Quantum Coll. Search and Implications 18/27