Keywords: cryptographie à clé symétrique, cryptanalyse quantique, preuve de sécurité, protocole d'echange de clé authentifié symmetric-key cryptography, quantum cryptanalysis, security proofs, authenticated key exchange

Pour la cryptographie moderne, la sécurité d'un système est défini comme la somme des ressources nécessaires pour le briser. Avec la venue d'ordinateurs quantiques efficaces et les nouvelles possibilités algorithmiques que cela ouvre, ce montant de ressources est voué à changer.

Dans cette thèse, nous effectuons un pas en direction d'une meilleure compréhension de cette menace quantique. Après une introduction au calcul quantique et à la cryptographie, nous montrons des attaques quantiques contre la fonction pseudo-aléatoire de Legendre dans le cadre avec le moins de suppositions. Par la suite, nous exposons une manière générale de transposer les attaques boomerang en algorithmique quantique ainsi que quelques applications. Nous continuons sur une méthode de doublement de taille de blocs pour les chiffrements à blocs inspirée sur le schéma Encrypt-Mix-Encrypt et nous en montrons la sécurité. Nous finissons par la contruction d'une version quantique du protocole d'authentification de la 3G/4G/5G UMTS-AKA avant d'en montrer la sécurité ainsi que celle des primitives sous-jacentes Milenage et TUAK.

Introduction

Cryptography is the science of transmitting information through an insecure channel. It accompanies communications from antiquity to our modern days. However it became a branch of mathematics only in the 20th century. It is a subset of complexity theory, the study of the hardness of computational problems.

Computational Security.

Modern cryptography contains a certain set of tools, mathematical objects which are expected to hold security up to a computational bound. Indeed, these tools are designed to make information unreadable to any unauthorized entity (or adversary) until it spends a certain (unreachable) amount of resources.

There are many ways to ensure this kind of security. The first one is relying of the difficulty of a general problem. As an example, RSA (one of the most widely used cryptosystems) relies on the difficulty of the factorization problem. This way of building is powerful as many instances can be built from one problem. Then the main focus of verification is the underlying problem. However, it does not mean that the instantiation is left unchecked (many early versions of RSA were vulnerable). The second one is designing building blocks called "primitives" that are the focus for the security evaluation. Then, these can be used with modes of operations which allows those primitives to encrypt practical messages. These modes of operations are also proven to be secure to ensure the security of the whole process.

Quantum Threat. The concept of quantum computers was proposed in the early 1980s by visionary physicists. Simulating the evolution of complex quantum systems, like long molecules, is a hard problem for our computers. The concept of quantum computers is to turn this problem around, making quantum systems a new way to make computations. Physicists that worked in this direction quickly understood that it would lead to a quantum computer executing quantum algorithm with its own notion of complexity.

However, the first demonstration of the possibilities of quantum computing was made in 1992 with the Deutsch-Jozsa algorithm, which states whether a function {0, 1} n to {0, 1} is constant or equilibrated (|f -1 (0)| = |f -1 (1)| = 2 n-1 ) in only one query, whereas a classical computer needs 2 n-1 + 1 queries to achieve certainty. It was closely followed by Simon's algorithm and Shor's algorithm, both in 1994. The first one recovers hidden periods and the second one factorizes large numbers.

The factorization of large numbers happens to be the problem on which RSA relies on for its security.

The realization of such quantum computers began in 1998 with a working 2-qubit computer implementing Deutsch-Jozsa algorithm. It was followed by the first factorization using Shor's algorithm in 2001 by IBM with a 7-qubit machine. Another important step has been the claim by Google to have achieved quantum supremacy (having a quantum computer solving a problem that would be "irrealizable" for any existing classical computer) in 2019 and IBM promising a 1121-qubit computer by 2023 and a million-qubit computer by 2030.

Quantum Cryptanalysis. We gain confidence in the security of the different cryptographic constructions by challenging their claimed security bounds. Cryptanalysis is the set of all techniques employed and developed in that manner.

The consideration of the quantum computer as a potential adversary led to many new attacks and techniques known as quantum cryptanalysis. While many systems and constructions were theoretically broken, the true potential of quantum computing is still unknown. Indeed, discovered quantum algorithm are few and even combining known quantum algorithms falls in a gray area.

Security Proofs. Provable security as a domain is making security proofs of a construction on the assumption of the security of the underlying blocks. While we are far from determining every construction this way, provable security has many tools at its disposal against classical adversaries.

However, against quantum adversaries many of those tools do not meet its quantum equivalent as many notions that appear trivial in the classical world are broken in the quantum world.

Quantum Protocols.

As cryptography is about transmitting information in a secure way through an insecure channel, it involves caring about the information left in said channel. Cryptographic protocols can be defined as procedures involving two or more legitimate entities in the goal to transmit some information and verifying some security properties.

Like quantum computers were conceptualized because of the complexity of quantum systems, most quantum protocols use the properties of quantum mechanics to build unforgeable materials.

Post-Quantum Future of Cryptography. As security is defined as the amount of resources needed to break it, our communication can only be secure for a certain duration determined by current (classical) analysis. However, as more than 90% of the worldwide communications use cryptosystems that are vulnerable to the quantum computers, the moment of their arrival is the end of the security of those communications. This does not concern only communications made past the arrival of quantum computers but also those who were guaranteed to remain safe at that time.

Then communications have to change to quantum-secure cryptosystems not only when quantum computers arrive but before their security duration are at threat to get brutally shortened.

Moreover, making a new standard is long, not including having it implemented by different companies (the NIST competition for post-quantum standards took five years to decide a first algorithm to be standardized and the competition is still on). Cryptography has to be one step ahead.

Organization

Chapter 1. We present the tools of quantum computing used in the following chapters. It starts with a quick history of the domain and continues with the elementary notions of quantum computing: qubits, superposition, entanglement, operators and quantum complexity.

Chapter 2. We expose the major algorithmic building blocks that pave our work: Grover's search and its generalization, the amplitude amplification algorithm, BHT collision search, Shor's algorithm, Simon's period finding algorithm and some of its intricacies and Kuperberg's algorithm.

Chapter 3. We present the notions of cryptography necessary to the next chapters. It starts with an overview of the domain including asymmetric cryptography, symmetric cryptography and its constructions. It continues with foundations of cryptanalysis and specific notions related to quantum cryptanalysis. It ends with an overview of communication protocols.

Chapter 4. We expose new quantum attacks against the Legendre PRF, from a joint work with André Schrottenloher, published at MathCrypt in 2021 [START_REF] Frixons | Quantum Boomerang Attacks and Some Applications[END_REF].

We present two quantum algorithms for solving the Legendre hidden shift problem (SLS) when classical queries are given, and without quantum RAM. The first one (distinguished table-based collisions) allows to reach an advantage against Grover's algorithm when more data is given. The second one is the offline Kuperberg's algorithm.

Chapter 5. It is based on a joint work with María Naya-Plasencia and André Schrottenloher published at Selected Areas in Cryptography in 2021 [START_REF] Frixons | Quantum security of the legendre prf[END_REF].

We propose an efficient quantum boomerang attack, as well as a variant for mixing boomerang attacks. We propose several improvements for different cases, as reducing the quantum RAM need or making Q2 attacks work in Q1 under certain circumstances. In some cases, our attacks reach a quadratic speedup with respect to classical attacks. This shows that boomerang attacks are also performant cryptanalysis tools for the postquantum world, that will be needed for correctly determining the best security margins.

Chapter 6. We present a joint work with María Naya-Plasencia, Ritam Bhaumik and André Chailloux that is currently under submission.

It focuses on the Encrypt-Mix-Encrypt construction. We provide the first proposal of a generic way for extending both the key and the state size, with quantum security arguments and significant classical proof.

In addition we propose some new kind of superposition attacks on the Encrypt-Mix-Encrypt construction, an original distinguisher matching the bound of our construction, and a method considering simulations for supporting conjectures from proofs.

Chapter 7. It is based on a joint work with Sébastien Canard and Loïc Ferreira that is currently in a review process. We first define a security model that does not rely on unconditional security and allows honest parties and attackers to use superposition messages. In particular, assuming that we are in a quantum world, we provide a discussion on what can be put into superposition by the client, the server and the operator during a honest execution of such quantum UMTS-AKA protocol.

More precisely, the quantum version of the UMTS-AKA that we describe assumes quantum computations as well as quantum communications (i.e., the messages that are exchanged between parties are in a superposition of quantum states).

We then formally prove that this quantum version of the UMTS-AKA is as secure in this quantum model as it is in the classical setting [4]. As a supplementary contribution, we also exhibit a new attack against the state confidentiality of a mobile user. This attack holds in the quantum but also in the classical setting.

We finally study the security of the underlying primitives that can instantiate the UMTS-AKA, Milenage and TUAK. We show an attack on Milenage as a qPRF, however the context of the UMTS-AKA makes this attack unrealistic and we further prove the security of Milenage based on the security of AES. We also show a reduction from the security of TUAK to the security of Keccak-f.

Contents

Notations

History

Quantum computing, as the name suggests, is based on quantum physics. The original notion is attributed to Paul Benioff and Richard Feynman, the former for showing in 1980 that a computer could operate with quantum mechanics and proposing a model for a quantum computer and the latter for arguing about the difficulty for a classical computer to simulate quantum mechanics in 1981.

During the following years, quantum mechanics have been studied considering different applications, like unforgeable materials and quantum key distribution, applying its unique properties, namely the "no-cloning" theorem, stipulating that one cannot clone a qubit.

Interest for quantum computer grew when it was shown to outperform its classical counterpart in certain cases. It started with the Deutsch-Jozsa algorithm, published in 1992, which states whether a function {0, 1} n to {0, 1} is constant or equilibrated (|f -1 (0)| = |f -1 (1)| = 2 n-1 ) in only one query, whereas a classical computer needs 2 n-1 + 1 to achieve certainty. However, a small number of queries are sufficient to be almost sure and thus the community was not completely convinced until Peter Shor developed in 1994 a quantum algorithm for factorizing large numbers exponentially faster than the best known classical algorithms. In 1996, Lov Grover developed an efficient quantum database search, providing quantum computers a general advantage over its classical counterpart and further emphasizing the interest for such a technology.

The realization of such quantum computers began in 1998 with a working 2-qubit computer implementing Deutsch-Jozsa algorithm. It was followed by the first factorization using Shor's algorithm in 2001 by IBM with a 7-qubit machine. Another important step has been the claim by Google to have achieved quantum supremacy (having a quantum computer solving a problem that would be "irrealizable" for any existing classical computer) in 2019 and IBM promising a 1121-qubit computer by 2023 and a million-qubit computer by 2030 [START_REF]IBM quantum roadmap[END_REF]69,[START_REF]Google wants to create a quantum computer with a million qubits[END_REF].

Fundamentals of Quantum Computing

In this section, we present the fundamentals of quantum computing following the lecture notes of de Wolf [START_REF] De | Quantum Computing: Lecture Notes[END_REF].

Qubits

In order to define the qubits and operations on them, we first remind the notion of Hilbert spaces.

Definition 1.1 (Hilbert Spaces).

A Hilbert space H is a vector space over C with an inner product ⟨•|•⟩ i.e., a function from H 2 to C that verifies the following properties:

• Conjugate Symmetric. For all x, y ∈ H, ⟨y|x⟩ = ⟨x|y⟩.

• Bilinearity. For all x, y, z ∈ H, µ, λ ∈ C, ⟨λx + µy|z⟩ = λ⟨x|z⟩ + µ⟨y|z⟩.

• Definite Positivity. For all x ∈ H, ⟨x|x⟩ ∈ R + and ⟨x|x⟩ = 0 ⇔ x = 0.

We also note ∥x∥ = ⟨x|x⟩ the norm induced by the inner product. Dirac Notation. For further use, the spaces we consider will be of the form C N . The elements are noted as N i=1 x i |i⟩ = (x 1 , x 2 , ..., x N ). We use the canonical inner product N i=1 x i |i⟩ N i=1 y i |i⟩ = N i=1 x i ȳi (the |i⟩ form a orthonormal basis). x i is called the amplitude associated to the state |i⟩.

We can define the qubit, quantum equivalent of the classical bit. Concatenation and Entanglement of Qubits. A qubit takes greater complexity when considered as an ensemble. A system of n qubits is a element of C 2 n with norm 1. A concatenation of systems makes every possible state of the two subsystems appear with its own amplitude: A system that cannot be seen as two subsystems concatenated is said to be entangled. An example of entanglement is Other Measurments There are more general notions of measurement we do not cover in this introduction, like positive operator-valued measures (POVMs). However they are equivalent up to the use of additional qubits.

  i∈{0,1} n a i |i⟩   ⊗   j∈{0,1} n b j |j⟩   = i,j∈{0,1} n a i |i⟩⊗b j |j⟩ = (i,j)∈{0,1}

Quantum Circuits

In this subsection, we expose the general operations on qubits and the most commonly used ones.

Definitions Definition 1.5 (Unitary Operator).

A unitary operator of a Hilbert space is a linear application that preserves the norm.

Definition 1.6 (Quantum Operator). A quantum operator on n qubits is a unitary operator on C 2 n .

Remark. When using quantum objects, the operators considered must be linear (maintain the amplitude) and unitary (the input and the outputs are qubits) Definition 1.7 (Inverse Operator). As any quantum operator O is unitary, it has an inverse noted O † , applying this operator is called "uncomputing".

Matrix Notation. Quantum operators on n qubits are unitary operators on C 2 n . They can be noted as matrices. With the Dirac notation, it corresponds to f = i,j∈{0,1} n a i,j |i⟩ ⟨j| with for all k in {0, 1} n , (|i⟩ ⟨j|) |k⟩ = |i⟩ if k = j and 0 otherwise. An "elementary" operator (often acts on a small number of qubits) is called a gate, in analogy to classical logic gates (NOT, AND, OR).

Common Gates

We describe the most common gates and some constructions. We start by the one-qubit operators. Definition 1.8 (One-qubit Gates).

• X (or N OT ) implements the classical "not", it maps |0⟩ to |1⟩ and conversely.

X = 0 1 1 0 |b⟩ X |b ⊕ 1⟩
• Z flips the amplitude of |1⟩ and leaves |0⟩ intact.

Z = 1 0 0 -1 |b⟩ Z ( -
H = 1 √ 2 1 1 1 -1 |b⟩ H 1 √ 2 (|0⟩ + (-1) b |1⟩)
• R θ leaves |0⟩ intact and rotates the amplitude of |1⟩. R π/4 is named T .

R θ = 1 0 0 e iθ |b⟩ R θ e ibθ |b⟩
We now describe some useful operators on more qubits.

Definition 1.9 (Composition of operators). Let U 1 and U 2 be two operators acting on n qubits, U 2 • U 1 acts on n qubits and

(U 2 • U 1 ) |x⟩ = U 2 (U 1 |x⟩). U 2 • U 1 as operators = U 2 × U 1 as matrices |x⟩ U 1 U 2 U 2 • U 1 |x⟩
We also define I the identity operator, i.e. the "do-nothing" operator.

I =    1 0 0 0 . . . 0 0 0 1    |x⟩ |x⟩
Definition 1.10 (Tensor product of operators). Let U 1 and U 2 be two operators acting on n and m qubits respectively, U 1 ⊗ U 2 acts on n + m qubits and

(U 1 ⊗ U 2 )(|x⟩ ⊗ |y⟩) = (U 1 |x⟩) ⊗ (U 2 |y⟩
). This definition can be extended to any state by linearity. We also define

U ⊗n = U ⊗ U ⊗ • • • ⊗ U n times
. Definition 1.11 (Controlled operator). Let U be an operator acting on n qubits, the controlled operator CU acts on n + 1 qubits and

CU (|b⟩ ⊗ |x⟩) = |0⟩ ⊗ |x⟩ if b=0 |1⟩ ⊗ (U |x⟩) if b=1 CU = Id 0 0 U |x⟩ U U b |x⟩ |b⟩ |b⟩
The most common ones are CN OT , implementing the xor, and CCN OT , also known as Toffoli gate. The implementation of such circuit can be done efficiently by using the following formulation :

CN OT =

QF T =

      1 1 • • • 1 1 ω • • • ω 2 n -1 . . . . . . . . . . . . 1 ω 2 n -1 • • • ω (2 n -1) 2       |x⟩ QF T 1 2 n/2
QF T |x⟩ = 1 2 n/2 2 n -1 y=0 χ 2 n (xy) |y⟩ = 1
2 n/2 y 1 ,...,yn∈{0,1} χ 2 n (x( n j=1 y j 2 n-j )) |y 1 , ..., y n ⟩ = 1 2 n/2 y 1 ,...,yn∈{0,1} n j=1 e 2πixy j /2 j |y 1 , ..., y n ⟩ = n j=1 1 √ 2 |0⟩ + e 2πix/2 j |1⟩ There also exists QF T for other integers than 2 n .

Notions for Quantum Algorithms

In this subsection we detail some generalities of quantum computing.

Ancilla Qubits

This is the equivalent of the classical memory: to compute a function, there is often a need for extra room for operations. For operators U 1 and U 2 acting on n and n + m qubits respectively, we say that U 1 and U 2 encode the same operator if and only if for all n-qubit state |x⟩, U 2 (|x⟩ ⊗ |0⟩) = (U 1 |x⟩) ⊗ |0⟩. The extra |0⟩ qubits are called ancilla qubits.

QRAM (Quantum Random Access Memory)

Speaking of quantum memory, there is also a need for a quantum equivalent of a table access. This QRAM gate allows to manage a quantum database by allowing to store elements on quantum memory and to quickly access them and even to make superposition of them (see [5]). Depending on the nature of the |x i ⟩ (classical or superposition), the estimated cost of the QRAM changes. Thus, there is a distinction (as shown in Figure 1.2) between QRACM (Quantum Random Access to Classical Memory) and QRAQM (Quantum Random Access to Quantum Memory).

However an efficient implementation of QRAM is still unknown, making it an assumption that can be discarded in regards to practicality.

Equivalence of Oracles

With classical computing, the output of a function is always in a set of bits, whether it is a new set of bits (out-of-place computation) or rewriting on the same set of bits (in-place computation). With quantum computing, there is also the possibility to write on the amplitudes of the system. For a function f : {0, 1} n → {0, 1} m , the standard oracle O f and the phase oracle P O f act on n + m qubits with O f |x, y⟩ → |x, y ⊕ f (x)⟩ and P O f |x, y⟩ → (-1) f (x)•y |x, y⟩ respectively.

For a permutation, f : {0, 1} n → {0, 1} n , the in-place oracle IO f acts on n qubits with IO f : |x⟩ → |f (x)⟩. (This formulation implies the access to IO f -1 = IO † f and is not common in the literature.) These function formulations are equivalent as

P O f = (I ⊗ H ⊗m ) • O f • (I ⊗ H ⊗m
). (This can be seen as a generalization of the identity H • X • H = Z.)

For permutations, we suppose a formulation for f and f -1 . Then O f -1 • SW AP •O f encodes the same operator as IO f and O f = (IO f -1 ⊗I)•CN OT • (IO f ⊗ I).

No Cloning Theorem

We now present some limitations to the power of quantum computing. Theorem 1.1 (No Cloning Theorem [START_REF] William | A single quantum cannot be cloned[END_REF]). There exist no operator U and state |γ⟩ such that for every one-qubit state |ϕ⟩, U (|ϕ⟩ |0⟩ |γ⟩) is of the form |ϕ⟩ |ϕ⟩ |γ ϕ ⟩.

Proof. Let U be a cloning operator and |ϕ⟩ = α |0⟩+β |1⟩ (with |α| 2 +|β| 2 = 1). Then by linearity,

U (|ϕ⟩ |0⟩ |γ⟩) = αU (|0⟩ |0⟩ |γ⟩) + βU (|1⟩ |0⟩ |γ⟩) |ϕ⟩ |ϕ⟩ |γ ϕ ⟩ = α |0⟩ |0⟩ |γ 0 ⟩ + β |1⟩ |1⟩ |γ 1 ⟩ α 2 |0⟩ |0⟩ |γ ϕ ⟩ + αβ |0⟩ |1⟩ |γ ϕ ⟩ +αβ |1⟩ |0⟩ |γ ϕ ⟩ + β 2 |1⟩ |1⟩ |γ ϕ ⟩ = α |0⟩ |0⟩ |γ 0 ⟩ + β |1⟩ |1⟩ |γ 1 ⟩
This implies that αβ = 0 as the right term contains no element starting with |0⟩ |1⟩ or |1⟩ |0⟩. It means that if U can clone the classical states |0⟩ and |1⟩, it can only clone the classical states.

Remark.

• While this statement only concerns one-qubit states, cloning states on any fixed size implies cloning one-qubit states.

• While a cloning operator does not exist, it mostly means that we cannot clone unknown qubits. Yet, we can use an operator on multiple sets of qubits to get many "clones" of the same state.

• There also exists approximate cloning methods that uses the unknown qubit and produces two qubits closer to the original one than random.

No Deleting Theorem

Theorem 1.2 (No Deleting Theorem [START_REF] Kumar | Impossibility of deleting an unknown quantum state[END_REF]). There exist no operator U and state |γ⟩ such that for every one-qubit state |ϕ⟩, U (|ϕ⟩ |ϕ⟩ |γ⟩) is of the form |ϕ⟩ |0⟩ |γ ϕ ⟩.

Proof. Let U be a deleting operator and |ϕ⟩ = α |0⟩+β |1⟩ (with |α| 2 +|β| 2 = 1).

Then by linearity,

U (|ϕ⟩ |ϕ⟩ |γ⟩) = α 2 U (|0⟩ |0⟩ |γ⟩) + αβU (|0⟩ |1⟩ |γ⟩) +αβU (|1⟩ |0⟩ |γ⟩) + β 2 U (|1⟩ |1⟩ |γ⟩) α |0⟩ |0⟩ |γ ϕ ⟩ + β |1⟩ |0⟩ |γ ϕ ⟩ = α 2 U (|0⟩ |0⟩ |γ⟩) + β 2 U (|1⟩ |1⟩ |γ⟩) + √ 2αβ 1 √ 2 U (|0⟩ |1⟩ |γ⟩) + 1 √ 2 U (|1⟩ |0⟩
|γ ϕ ⟩ = α |γ 0 ⟩ + β |γ 1 ⟩ + |ϵ⟩ |Φ⟩ = 1 √ 2 (|0⟩ |0⟩ |γ 1 ⟩ + |1⟩ |0⟩ |γ 0 ⟩ + α |0⟩ |0⟩ |ϵ⟩ + β |1⟩ |0⟩ |ϵ⟩)
Then by considering the norm on the second equation, we get that |ϵ⟩ = 0. Then the right term of the first equation has always norm 1, meaning that |γ 0 ⟩ and |γ 1 ⟩ constitute a base. This implies that the information of |ϕ⟩ is still in |γ ϕ ⟩.

Remark.

• Like the cloning theorem, deleting larger states means being able to do so on one-qubits states.

• In the same vein, it mostly means that we cannot delete unknown qubits. Yet, the inverse of operators can delete its corresponding state.

Quantum Complexity

Like in many domains, the conception of algorithms in cryptography has a heavy emphasis on efficiency. While the metrics of classical algorithms are well-known (time, data and memory complexity), there are many formulations for quantum circuits.

Here are the main ones:

Size. We count the number of elementary gates used (for presented circuits X, Z, H, R θ , CN OT , Toffoli). This is our main concern in the rest of this thesis as it is equivalent to classical time complexity.

Width. We count the number of qubits used (input, output and ancillas). This is the equivalent to memory complexity. It seconds the size measurement.

Depth. This is the highest number of gates involving a single fixed qubit. This is an important measure for implementations of quantum circuits, however we will not consider it in this thesis as implementation is not our primary goal.

Query complexity. When using an external function, we count the number of O f gates as query complexity.

With those notions in mind, we can expose the quantum algorithms that are fundamental to this thesis: Grover's search and its generalization, the amplitude amplification, BHT collision search, Shor's algorithm, Simon's period finding and Kuperberg's algorithm.

Chapter 2 Major Quantum Algorithms

We expose the major algorithmic building blocks that pave our work: Grover's search and its generalization, the amplitude amplification algorithm, BHT collision search, Shor's algorithm, Simon's period finding algorithm and some of its intricacies and Kuperberg's algorithm for which we provide some deepening in Chapter 4.

Contents

Deutsch-Jozsa Algorithm

We start the algorithm presentation by the oldest one, the Deutsch-Jozsa algorithm [START_REF] Deutsch | Rapid solution of problems by quantum computation[END_REF]. It was first described in 1992. While it did not change the view of the community on quantum computing, it is the first quantum algorithm that solves a problem faster than its classical counterpart.

Premise

We introduce the problem solved by the Deutsch-Jozsa algorithm.

Problem 2.1. Let f : {0, 1} n → {0, 1} be a function that is either constant (f = 0 or f = 1) or balanced (|f -1 (0)| = |f -1 (1)|)
. Distinguish between cases.

Description of Algorithm 2.1

Algorithm 2.1 Description of the Deutsch-Jozsa algorithm Input: superposition oracle access to f , either constant or balanced Output: "Constant" or "Balanced" 1: Start with the state |0 n ⟩ |1⟩ 2: Apply the Hadamard gate on all qubits, obtaining the state

1 2 (n+1)/2 x∈{0,1} n |x⟩ ⊗ (|0⟩ -|1⟩) 3: Apply the oracle |x⟩ |y⟩ → |x⟩ |y ⊕ f (x)⟩ to the state, obtaining x∈{0,1} n 1 2 (n+1)/2 |x⟩ ⊗ (|f (x)⟩ -|f (x) ⊕ 1⟩) 4: Rewrite it as 1 2 (n+1)/2 x∈{0,1} n (-1) f (x) |x⟩ ⊗ (|0⟩ -|1⟩) 5:
Apply the Hadamard gate on all qubits, obtaining the state

1 2 n x,y∈{0,1} n |y⟩ (-1) f (x)+x•y ⊗ |1⟩ if f is constant, then it simplifies to |0 n ⟩ ⊗ |1⟩. if f is balanced, then the amplitude of the state |0 n ⟩ ⊗ |1⟩ is 0. 6: Measure and check if the result is 0 n ∥1 7: if it is return "Constant" Else return "Balanced"
Remarks. The fact that the Deutsch-Jozsa algorithm needs only one query to the function f has two effects:

• as we will see with other quantum algorithms, a superposition query can do more than any classical query. A classical computer needs at least two queries to differentiate between a constant function and a non-constant one;

• needing only one query means that a property can be found even if the function is never used again. In cryptography, as presented in Chapter 3, many constructions use always-changing values to prevent an adversary to use a trivial property that would be exposed otherwise.

Grover's Search

We present the Grover's search [START_REF] Lov | A Fast Quantum Mechanical Algorithm for Database Search[END_REF], introduced in 1996 by Lov Grover, which is the quantum equivalent of the exhaustive search that exists in classical algorithms.

Premise

Problem 2.2. Let f : {0, 1} n → {0, 1} be a function. We call elements x such that f (x) = 1 "good" and others "bad". We note Y the set of "good" elements and X the search space, here {0, 1} n . Our goal is to find a "good" element.

Classical Search

With classical means, the best we can do (without further specification of the function f ) is to take an element x at random and check if x is "good" and retry with a different element if it is not. The probability of success is We want to get the closest vector to |"Good"⟩ as our goal is to measure an element in |"Good ′′ ⟩. This translates to 2αθ + 1 ≃ π 2 , where α is the number of rounds. This simplifies to t = π 4θ . We can write

Description of Grover's algorithm

|"Good ′′ ⟩ |"Bad ′′ ⟩ H ⊗n |0⟩ |ϕ k+1 ⟩ |ϕ k ⟩ O f (|ϕ k ⟩)
H ⊗n |0 n ⟩ as |X|-|Y | |X| |"Bad ′′ ⟩ + |Y | |X| |"Good ′′ ⟩.
We deduce that sin(θ) = |Y | |X| and then θ = arcsin( |Y | |X| ). We conclude that the number of rounds (and thus the complexity of the Optimization. This algorithm replaces the exhaustive search that is optimal for classical computation and has been proven to be also optimal for quantum computations [START_REF] Zalka | Grover's quantum searching algorithm is optimal[END_REF].

algorithm) is t =     π 4 arcsin( |Y | |X| )     ≃ π

Amplitude Amplification

Grover's algorithm requires that the search space is of the form {0, 1} n . While it is enough to get importance as it is a relatively common search space, it prevents some more advanced techniques from using it.

The amplitude amplification, introduced by Brassard, Hoyer, Mosca and Tapp [START_REF] Brassard | Quantum amplitude amplification and estimation[END_REF], extends Grover's algorithm to any search space by replacing H ⊗n by a (reversible) procedure C that generates a uniform superposition of the search space from |0 n ⟩.

Technically, the starting point becomes C |0 n ⟩ and the routine

C • O 0 • C † • O f .
Then the calculations made for Grover's search also hold for the amplitude amplification.

As mentioned earlier, this algorithm is a building block for the following chapters and it will appear as Amplify(C, f ).

BHT Algorithm

Many cryptographic constructions build their security upon the difficulty to get a collision. The main quantum algorithms to find collisions are Ambainis' algorithm [5] and BHT algorithm, which we detail below.

Premise

Problem 2.3. Let f : {0, 1} n → {0, 1} m be a function (m < 2n to have a good probability that a collision exists). Our goal is to search for x, y ∈ {0, 1} n such that x ̸ = y and f (x) = f (y).

Remark. There is also the problem to find a claw f (x) = g(y) for f and g two functions from {0, 1} n to {0, 1} m . However, it can be reduced (with good probability) to the above problem by the function h

: (b, x) → f (x) ⊕ b(f (x) ⊕ g(x)).
Classical algorithm. For classical computation, and an output set of size n, we need O ( √ n) queries (the birthday paradox bound) for a collision to appear. The known way to do so is the Pollard's rho algorithm [START_REF] John | Monte Carlo methods for index computation[END_REF].

Description

Brassard et al. proposed in 1998 [START_REF] Brassard | Quantum Cryptanalysis of Hash and Claw-Free Functions[END_REF] an approach to use Grover's search with the birthday paradox:

1. start by querying the function f 2 m/3 times and list the obtained values (and their inputs);

2. sort those values and build a quantum circuit that searches by dichotomy if a new element is already in this list;

3. use Grover's algorithm to search an element such that the output by f is in the list.

The searched elements have a probability 2 -2m/3 to pass the test and then the Grover's search takes roughly 2 m/3 computations to return a right element. The total complexity of the BHT algorithm is about O 2 m/3 computations and needs a QRAM of the same size.

Full quantum circuit.

It is possible to make BHT a fully quantum algorithm by using a quantum list of superposed elements instead of a classical one (sorting the list can be done with ancillary qubits remembering the permutations). This has the advantage to return the uniform superposition of the collisions instead of a simple collision pair.

|0 2l ⟩ |0 n ⟩ QF T O f QF T Figure 2
.2: Shor's period finding algorithm Chailloux, Naya-Plasencia and Schrottenloher [START_REF] Chailloux | An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography[END_REF] managed to build a version of this algorithm without the need for QRAM and negligible memory use with time complexity O 2 2m/5 .

Shor's Algorithm

We present the (in)famous Shor's algorithm [START_REF] Shor | Polynominal time algorithms for discrete logarithms and factoring on a quantum computer[END_REF] that efficiently computes factoring (breaking the RSA scheme) and discrete logarithm (breaking the DH, ECDH, ECDSA schemes). A realization of this algorithm for the concerned sizes (256-bit for elliptic curve variants and 4096-bit for finite field variants) would mean the end of the security properties for almost 90% of communications over the Internet [START_REF]RSA Is Dead -We Just Haven't Accepted It Yet[END_REF]114].

Reducing Factorization to Period Finding

First, we fix the number to factorize N and a "seed" x. Then, we consider the function n → x n mod N . This function has a smallest period r < N . Considering that N is odd and not a power of a prime (which cases are easy to reduce), then with probability greater than 1 2 , r is even and (x r/2 +1)(x r/2 -1) ≡ 0 mod N is not a trivial zero divisor. It follows that gcd(x r/2 + 1, N ) and gcd(x r/2 -1, N ) are two non-trivial factors of N .

Shor's Period Finding Algorithm

We detail the core of Shor's algorithm (Figure 2.2).

Premise for Shor's algorithm

Shor's algorithm solves the following problem. Problem 2.4. Let f : Z → {0, 1} n be a periodic function with a period r < 2 l . Our goal is to recover r.

Description of the Algorithm

We consider a quantum implementation of f , O f acting on 2l + n qubits with

O f (|x⟩ |y⟩) = |x⟩ |y ⊕ f (x)⟩.
The algorithm starts with the state

|0 2l ⟩ |0 n ⟩ .
We apply a QF T gate on the first register to get the state

1 2 l 2 2l -1 x=0 |x⟩ |0 n ⟩ .
Then we apply O f , leading to the state

1 2 l 2 2l -1 x=0 |x⟩ |f (x)⟩ .
We measure the second register and get a value b. (The distribution of this value is uniform on the image of f but it does not matter for our concern.) The state becomes

1 √ m m-1 j=0 |jr + x 0 ⟩ with x 0 the first value such that f (x 0 ) = b and m = min{j|jr + x 0 ≥ 2 2l }.
We apply another QFT and get the state

1 2 l √ m 2 2l -1 y=0 e 2iπ yx 0 2 2l 1 -e 2iπ ymr 2 2l
1 -e

2iπ yr 2 2l
|y⟩ .

Then, when we measure the state, with high probability (see [START_REF] Shor | Polynominal time algorithms for discrete logarithms and factoring on a quantum computer[END_REF]), we get a value y such that there exists an integer c such that yr 2 2l -c <

Reducing Discrete Logarithm to Period Finding

For discrete logarithm, given x and y in a group G, we search r such that y = x r (supposing it exists). We consider the function f : (a, b) → x a y b . This function admits a period (r, -1). While we use a function with two entries instead of one, we just use QF T on both entries and the calculations turn out to be similar.

Simon's Algorithm

We present Simon's hidden subgroup algorithm. While Shor's algorithm breaks current public key cryptosystem, Simon's algorithm [START_REF] Daniel | On the Power of Quantum Computation[END_REF] impacts secret key cryptography, as we will see along this thesis.

|0 n ⟩ |0 m ⟩ H ⊗n O f H ⊗n

Simon's Problem

We present the problem solved by Simon's algorithm.

Problem 2.5. Let s ∈ {0, 1} n and f : {0, 1} n → {0, 1} m a function such that for all x, y in {0, 1} n , f (x) = f (y) ⇔ x = y or x = y ⊕ s. Given f , our goal is to find s.
Usually we better take interest in the following variation of the problem.

Problem 2.6. Let s ∈ {0, 1} n and f, g : {0, 1} n → {0, 1} m two injective functions such that for all x in {0, 1} n , f (x) = g(x ⊕ s). Given f and g, our goal is to find s.

This problem is equivalent to the first one by taking

F : (b, x) → f (x) if b = 0 g(x) if b = 1 .

Description of the Algorithm

We first describe Simon's routine (Figure 2.3).

We start with the state

|0 n ⟩ |0 m ⟩ .
We apply the Hadamard gate on all qubits of the first register, leading to the state

1 2 n/2 x∈{0,1} n |x⟩ |0 m ⟩ .
We apply the oracle O f , thus the state becomes

|ϕ f ⟩ = 1 2 n/2 x∈{0,1} n |x⟩ |f (x)⟩ .
We measure the second register and get a value c = f (x 0 ) for a unknown x 0 . By the premise, we get the state

1 √ 2 (|x 0 ⟩ + |x 0 ⊕ s⟩) .
We apply the Hadamard gate on all qubits and we get the state

1 √ 2 n+1 y∈{0,1} n (-1) x 0 •y + (-1) (x 0 ⊕s)•y |y⟩ . This simplifies to 1 √ 2 n+1 y∈{0,1} n (-1) x 0 •y (1 + (-1) s•y ) 0 if y•s=1
|y⟩ .

Then when we measure the state, we get a uniformly random y such that y • s = 0.

Simon's algorithm consists in applying this routine n + l times, thus getting (y 1 , ..., y n+l ) and solving the linear system with unknown s

     y 1 • s = 0 . . . y n+l • s = 0
Because the y i are taken uniformly in the subspace {y, y • s = 0} (of dimension n-1), this system has rank n-1 with probability n-2 i=0 (1-2 n+l-i ) ≤ 1 -2 -l-1 (by equality of row and column rank, the first row only has to be non-zero and the next ones have to be outside the space generated by the previous ones).

Weakening Simon's Premise

Most of the time, the functions on which we will use Simon's algorithm will not fit the above premise exactly. This one only considers collisions of the form f (x) = f (x ⊕ s) but our functions will have other (random) collisions. While the outputs of Simon's routine still follows y • s = 0, it is no longer uniform in that subspace and may lead to a system with smaller rank. By taking more outputs of Simon's routine, we still get the desired result.

Theorem 2.1 ([76]

). After n + l uses of Simon's routine, Simon's algorithm returns s with probability greater than 1 -

2 n 1+ϵ(f,s) 2 n+l where ϵ(f, s) = max t∈{0,1} n \{0,s} (P(f (x) = f (x ⊕ t))).
Proof. While the outputs of Simon's routine still follows y • s = 0, the algorithm fails if the rank of the system is lower than expected. For each t ∈ {0, 1} n \{0, s}, we have P(

y i • t = 0) = 1+ϵ(f,s) 2
. Then the probability of t being solution of the system is 1+ϵ(f,s) 2

n+l

. By taking the union of all possible t, we get P(the algorithm fails) ≤ 2 n 1+ϵ(f,s) 2 n+l .

Remark.

A high ϵ value on a cryptographic function is considered a weakness and leads to a differential attack (see Subsection 3.3.2).

Simon's algorithm as a quantum circuit

As presented, Simon's algorithm is a quantum procedure implying a quantum machine running the routine and applying the measurement, and another computer (most likely classical) registering the outputs and solving the linear system. However, in many applications, it is useful to detect if there is a period as a subroutine of a bigger computation. We present some insight showing how it is possible to make a quantum circuit QSimon computing a variant of Simon's algorithm (Figure 2

.4).

A first remark is to see that measurements can be postponed: the value f (x 0 ) does not matter to the computation, it only serves to separate the states |x 0 ⟩ and |x 0 ⊕ s⟩ from the rest. To the same effect, the value y can be in superposition for the calculations as all remaining states |y⟩ share the same statement y • s = 0.

A second remark is that the routine needs only a superposition

|ϕ f ⟩ = O f • (H ⊗n ⊗ I) |0 n+m ⟩ = 1 2 n/2 x∈{0,1} n |x⟩ |f (x)⟩
(second step of the routine), the rest consists in applying H ⊗n ⊗ I on the state (we just observed that the measurement is not necessary), meaning that we can keep several copies of |ϕ f ⟩ as a database.

A third insight is making the treatment of the y i a quantum circuit. The computation of whether the rank is maximal or not can be done by a classical reversible circuit.

Kuperberg's Algorithm

We present Kuperbeg's hidden subgroup algorithm [START_REF] Kuperberg | A Subexponential-Time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF]. It is an equivalent of Simon's algorithm when the bit-wise xor is replaced by a modular addition.

Kuperberg's Premise

We present the problem solved by Kuperberg's algorithm. Problem 2.7. Let s ∈ Z/2 n Z and f, g : Z/2 n Z → {0, 1} m be two injective functions such that for all x in {0, 1} n , f (x) = g(x + s). Given f and g, our goal is to find s.

For clarification, we call

F : (a, x) → f (x) if a = 0 g(x) if a = 1 |ϕ f ⟩ |ϕ f ⟩ |ϕ f ⟩ |ϕ f ⟩ . . . . . . |ϕ f ⟩ |ϕ f ⟩ |y⟩ |y ⊕ Simon(f )⟩ RAN K Figure 2.4: QSimon gate |0⟩ H |ψ b ⟩ : b |0 n ⟩ |0 m ⟩ QF T O F QF T Figure 2.5: Kuperberg's routine

Description of the Algorithm

Kuperberg's routine

We start by describing Kuperberg's routine (Figure 2.5).

We start with the state

|0⟩ |0 n ⟩ |0 m ⟩ .
We apply the Hadamard gate on the first qubit and QF T on the second register, leading to the state

1 2 (n+1)/2 a ∈ {0, 1} x ∈ Z/2 n Z |a⟩ |x⟩ |0 m ⟩ .
We apply the oracle O F , thus the state becomes

|ϕ f,g ⟩ = 1 2 (n+1)/2 x∈Z/2 n Z |0⟩ |x⟩ |f (x)⟩ + |1⟩ |x⟩ |g(x)⟩ . |ψ b ′ ⟩ : c |ψ b ⟩ |ψ b+(-1) c b ′ ⟩ Figure 2.6: Combining outputs
We measure the second register and get a value c = f (x 0 ) for a unknown x 0 . By the premise, we get the state

1 √ 2 (|0⟩ |x 0 ⟩ + |1⟩ |x 0 -s⟩) .
We apply the QF T gate on the second register and we get the state

1 √ 2 n+1 b∈Z/2 n Z (χ 2 n (x 0 b) |0⟩ + χ 2 n ((x 0 -s)b) |1⟩) |b⟩ This simplifies to 1 √ 2 n+1 b∈Z/2 n Z χ 2 n (x 0 b) (|0⟩ + χ 2 n (-sb) |1⟩) |b⟩ .
Then we measure the state and we get a uniformly random b. The state becomes

|ψ b ⟩ = 1 √ 2 (|0⟩ + χ 2 n (-sb) |1⟩).
Exploiting the Result. At this point, exploiting |ψ b ⟩ directly seems too costly. We want values of b that makes the computation easier. The simplest is b = 2 n-1 , for which

|ψ 2 n-1 ⟩ = 1 √ 2 (|0⟩ + (-1) s |1⟩) = H |s mod 2⟩.

Combining Outputs

We expose a way to combine the different states |ψ b ⟩ to make more interesting ones (Figure 2.6).

We start with the state

|ψ b ⟩⊗|ψ b ′ ⟩ = 1 2 |0, 0⟩ + χ 2 n (-sb) |1, 0⟩ + χ 2 n (-sb ′ ) |0, 1⟩ + χ 2 n (-s(b + b ′ )) |1, 1⟩ .
We apply the CN OT gate and we get the state

1 2 |0, 0⟩ + χ 2 n (-s(b + b ′ )) |1, 0⟩ + χ 2 n (-sb ′ ) |0, 1⟩ + χ 2 n (-sb) |1, 1⟩ . which simplifies to 1 2 |0, 0⟩ + χ 2 n (-s(b + b ′ )) |1, 0⟩ + χ 2 n (-sb ′ ) |0, 1⟩ + χ 2 n (-s(b -b ′ )) |1, 1⟩ .
We measure the second qubit and get the value c. The remaining state becomes 1

√ 2 |0⟩ + χ 2 n (-s(b + (-1) c b ′ )) |1⟩ = |ψ b+(-1) c b ′ ⟩ .
L ← L ′ 14: k ← k + 2 log 2 (3)n -i log 2 (3) 15: if |ψ 2 n-1 ⟩ is found then 16:
return s mod 2 17: else 18: return "Failure"

Recovering |ψ 2 n-1 ⟩

We finally show how to use the different elements we have computed to recover s. Proposition 2.1. In algorithm 2.2, if, at the begining of the turn, we start with a2 k elements, we end the turn with at least (a -1)2 k /3 elements.

Proof. At first, we pair as many elements as possible and combine them. There are at least (a -1)2 k /2 pairs as at most 2 k elements cannot get paired. Then, we get (a -1)2 k /4 good combinations and (a -1)2 k /2 bad combinations. Then from those bad combinations and the unpaired elements we make new pairs and so on. At the end, at most 2 k elements could not be paired and we got (a -1)2 k /3 good combinations.

Recovering s. There are many ways to conclude here. The first one is to remark that f ′ : x → f (2x) and g : x → g(2x -(s mod 2)) follows Kuperberg's premise with s ′ = s-(s mod 2) Chapter 3

Introduction to Cryptography

This chapter presents the notions of cryptography necessary to the next chapters. It starts with an overview of the domain including asymmetric cryptography, symmetric cryptography and its constructions. It continues with foundations of cryptanalysis and specific notions related to quantum symmetric cryptanalysis. It ends with an overview of communication protocols.

Overview

Cryptography as a whole is the science of protecting information transmitted through an insecure channel. This protection is usually declined into three main properties.

Confidentiality.

A third party should not be able to recover any information from exchanged messages.

Integrity.

A third party should not be able to modify the exchanged information without making it invalid.

Authenticity. A third party should not be able to impersonate a rightful entity.

Kerckhoff's Principles

Auguste Kerckhoff stated in 1883 [START_REF] Kerckhoffs | La cryptographic militaire[END_REF][START_REF] Kerckhoffs | La cryptographie militaire (part ii)[END_REF] six rules that still apply nowadays to guide the design of cryptographic systems.

• The first Kerckhoffs's principle states that "the system should be computationally, if not mathematically, indecipherable". Each cipher or construction must be evaluated to verify its security. We will discuss how in the next sections.

• According to the second principle, "the system should not require secrecy, and it should not be a problem if it falls into enemy hands". It separates cryptography from steganography, which is the science of dissimulating a message: even if the adversary reads the exchange and knows the method of encryption, it can not recover the information without the secret key.

• The rest of the principles are concerns about practicability. While our means are not the same as the ones Auguste Kerckhoff knew, encryption is still conceived with constraints in mind: cryptographers compete to get the most secure system but also for the fastest encryption/decryption and the smallest size.

The world of cryptography is divided in two families: symmetric cryptography, which assumes sharing a prior secret and asymmetric cryptography that does not (and is mainly used to agree on the secret).

Asymmetric Cryptography

First introduced by Diffie and Hellman in 1976 [START_REF] Diffie | New directions in cryptography[END_REF], asymmetric (or public-key) cryptography allows two parties to exchange secure messages without prior agreement on a common secret by using a private-key public-key pair.

The security of such systems relies on hard problems. While many of them are not proved to be as hard as it could be (or more formally, NP-complete problems [START_REF] Randolph | A Guide to the Theory of NP-Completeness[END_REF]), like factorization and discrete logarithm (hard problems behind most currently used systems in public-key cryptography), the best algorithms solving them are carefully evaluated. Because Shor's algorithm (Section 2.5) solves factorization and discrete logarithm with unprecedented speed, we will need to adapt the public-key crypto-systems. That is the idea of the NIST Post-Quantum Cryptography Standardization process started in 2017 [102], which selected systems to be standardized in July 2022 with an additional round for supplementary systems.

Symmetric Cryptography

Symmetric cryptography dates back to antiquity with the well-known Caesar's cipher, where each letter of the alphabet is shifted by a fixed secret number of positions, or the scytal, which changes the positions of letters in a linear pattern (some date it back to around 1500 BC with the first encrypted document). While the standards of cryptography have been greatly improved, the intent remains the same: using a shared secret to transfer a message through an insecure channel, whether it is a Gallic horseman or the Internet. In symmetric cryptography, the key used for encryption and the one for decryption are the same.

Primitives and Constructions. The world of symmetric cryptography is built from the ground up. It begins with "elementary" functions, called "primitives" (block ciphers, permutations, . . . ) meant to achieve specific security properties, which we detail in the next section. Then, we combine them with operating modes, to build practical functions for different uses. For example, a block cipher takes only an input of predetermined length and we use a mode of operation for encrypting a message of any length in a safe way.

Security of Primitives.

The security of a primitive is defined by how difficult is it to attack it, i.e. to break one of its security property. For example, as we will see later, considering a keyed primitive, it must be difficult to recover the key. We will see later what difficult means. Generic Attacks. For each security property, there is a limit to what is achievable independently of the design of the primitive, called a generic bound. The attack matching the bound is called a generic attack. To complete our last example, one can always try every key and find the right one through the process, which is called exhaustive search. Dedicated Attacks. However, the security evaluation of a specific primitive implies dedicated attacks. If a dedicated attack performs better than the best generic attack, the primitive is usually considered to be broken. While some dedicated attacks can seem impractical, they reveal a weakness in the design that can only get worse, and it would be irresponsible to accept a broken primitive when unbroken ones exist without a proper justification. Security Margin. Usually, been broken, a primitive is depreciated. Most of primitives are designed as a composition of smaller functions called "rounds" and before a primitive is broken, many versions of the primitive involving less rounds, called "round reduced" versions, are broken. Looking at the evolution of the number of rounds broken, we can make effective previsions of security of the full primitive. For example, the best known attacks against AES cover 7 rounds out of 10 since 2008 [START_REF] Lu | New Impossible Differential Attacks on AES[END_REF] (Section 6.10.3).

Elements of Symmetric Cryptography

In this section, we present the main elements of symmetric cryptography, their security goals and the associated generic attacks.

Block Ciphers

A block cipher is a family of permutations on a message space, usually {0, 1} n indexed by a key K in a key space, usually {0, 1} k :

E : {0, 1} k × {0, 1} n → {0, 1} n D : {0, 1} k × {0, 1} n → {0, 1} n ∀k, x, D k (E k (x)) = x
Security Goal. A block cipher is meant to be used as a secret pseudorandom permutation and is evaluated as such. Without the key, the block cipher should be indistinguishable from a random permutation.

We can define this property in terms of experiments involving a challenger defining the frame and an attacker trying to win by getting some information (This idea of security game is further detailed in Section 3.5). Here is an indistinguishability (IND) game for the security of a block cipher E:

1. The challenger generates a random key K and a random permutation Π

The challenger gives the attacker either the random permutation Π or the keyed block cipher E K as a black box.

The block cipher E is (t, q, ϵ)-indistinguishable if any adversary A using at most t computations and q queries to the black box has an advantage Adv(A) = P(A wins) -1 2 ≤ ϵ. Depending on the context, we can distinguish Adv prp (when the attacker has access to E k as a back box, corresponding to the IND-CPA game, prp meaning pseudo-random permutation, compared to prf meaning pseudo-random function), Adv sprp (when the attacker has access to E k and E -1 K as back boxes, corresponding to the IND-CCA game, sprp meaning strong pseudo-random permutation) and Adv qprp (when the attacker has access to E k and E -1 K as quantum back boxes, qprp meaning quantum pseudo-random permutation).

There is a weaker version where the attacker only wins if it recovers the key.

Generic Attacks. The generic attack against a block cipher is an exhaustive search for the key, verifying which key is the right one. It can be done using few plaintext-ciphertext pairs by simply checking if the encryption of the plaintext with the tested key outputs the expected ciphertext. This means there is always a classical attack using O 2 k computations. The quantum equivalent is searching the right key with Grover's search (Section 2.2) instead of classic exhaustive search. It uses O 2 k/2 computations.

Another generic attack consists in querying all possible inputs and making a table of all possible plaintext-ciphertext pairs, also known as the "codebook". This means there is always an attack using O (2 n ) computations and memory (for classical and quantum computers alike). While this does not recover the key or explicitly distinguish the block cipher from a true random permutation, an attacker with the whole codebook can easily reverse any message (if the same key is still used after querying the whole codebook).

Stream Ciphers

A stream cipher encrypts messages of any size by generating a sequence called " keystream" and XORs it to the message to produce the ciphertext. It uses a key K in a key space, usually {0, 1} k , a nonce N in a nonce space, usually {0, 1} n . The nonce is a public value that should not be repeated to avoid re-encryption:

E : {0, 1} k × {0, 1} n × {0, 1} * → {0, 1} * D : {0, 1} k × {0, 1} n × {0, 1} * → {0, 1} * ∀k, x, N D k (E k (x, N ), N ) = x
A way of building a stream cipher is applying a certain mode of operation (like the counter mode) to a block cipher.

Hash Functions

A hash function is a (public) function that takes as input messages of any size and produces a tag of fixed size t:

h : {0, 1} * → {0, 1} t .
It is evaluated mainly along three security requirements:

MACs

A Message Authentication Code (or MAC) is a family of functions indexed by a key K, usually in {0, 1} k :

M AC : {0, 1} k × {0, 1} * → {0, 1} t .
A MAC is meant to protect the integrity of a message with the receiver checking if the tag is correct (if an attacker tries to change the message, it will not be able to compute a correct tag as it does not have the key). There are two security notions for MACs.

Unforgeability: An attacker is unable to make a forgery, i.e. a valid messagetag pair which has not been given to the attacker.

AEAD

An Authenticated Encryption with Associated Data (or AEAD) encrypts messages of any length and produce a tag T usually in {0, 1} t . The decryption decrypts the message if the tag is valid and returns an error ⊥ otherwise. It uses a key K in a key space, usually {0, 1} k , a nonce N in a nonce space, usually {0, 1} n and an associated data AD of any length. Like stream ciphers, the nonce is a public value that should not be repeated to avoid re-encryption:

E : {0, 1} k × {0, 1} n × {0, 1} * × {0, 1} * → {0, 1} * × {0, 1} t D : {0, 1} k × {0, 1} n × {0, 1} * × {0, 1} * × {0, 1} t → {0, 1} * ∪ {⊥} ∀k, x, N, AD D k (E k (x, N, AD), N, AD) = x

Permutation-Based Cryptography

Permutation-based cryptography is an approach to building primitives. It consists in using public strong permutation with modes of operations (like the sponge constructions) applied to it. It was popularized by Bertoni, Daemen, Peeters and Van Assche with the proposal of Keccak [START_REF] Bertoni | The Keccak reference[END_REF] in 2008, which became the SHA3 standard, and later Farfalle [START_REF] Bertoni | Farfalle: parallel permutation-based cryptography[END_REF]. This design became a popular trend as many finalists [START_REF] Ce Dobraunig | Isap v2. 0[END_REF][START_REF] Bao | PHOTON-beetle authenticated encryption and hash family[END_REF][START_REF] Iwata | Duel of the titans: the romulus and remus families of lightweight AEAD algorithms[END_REF][START_REF] Beierle | Schwaemm and Esch: lightweight authenticated encryption and hashing using the sparkle permutation family[END_REF][START_REF] Dobraunig | Ascon v1. 2: Lightweight authenticated encryption and hashing[END_REF][START_REF] Wu | TinyJAMBU: A family of lightweight authenticated encryption algorithms (version 2)[END_REF][START_REF] Daemen | Xoodyak, a lightweight cryptographic scheme[END_REF] of the NIST lightweight cryptography competition are designed this way.

Preliminaries of Cryptanalysis

In this section, we present some basis of cryptanalysis of symmetric constructions.

(Quantum) Security Models

We describe the different settings usually considered for cryptanalysis.

Q0. This is the classical setting: no quantum computing is involved. This is the usual classification (ordered by increasing security) for a function E.

• Known-ciphertext (KC): The attacker has only access to some ciphertexts E(m i ).

• Known-plaintext (KP): The attacker has access to some plaintextciphertexts pairs (m i , E(m i )).

• Chosen-plaintext (CP): The attacker gets to choose the m i and gets the pair (m i , E(m i )) back. If the attacker chooses the m i all at once, it is non-adaptative, it is adaptative (CPA) if the chosen messages depend on previous outcomes.

• Chosen-ciphertext (CC) (only for revertible primitives): The attacker get to choose the m i and a "mode" (either "encryption" or "decryption") for each query and gets the pair (m i , E ±1 (m i )) back.

If the attacker chooses the m i all at once, it is non-adaptative, it is adaptative (CCA) if the chosen messages depend on previous outcomes.

Q1. Also known as the post-quantum setting, legitimate parties still use classical computers but consider an adversary has access to a powerful quantum computer. More formally, the adversary can query primitives with classic values but can treat those offline with a quantum machine.

Q2. Also known as the full-quantum setting, this allows an adversary to use a quantum computer but also superposition queries, effectively using the oracles O E described in Section 1.2.3.3.

Discussion on the Q1 and Q2 Models [kaplan2015quantum, 29, 126, 71]. Q1 is the most immediate quantum setting as it becomes reality as soon as there exists a quantum computer efficient enough. This setting also englobes the most immediate threat of an adversary recording communications hoping to break it with a quantum computer when it will be powerful enough. This makes it the most meaningful setting for quantum attacks. Q2 is less immediate as it requires a machine running a quantum encryption circuit for legitimate parties and an attacker having access to a quantum encryption circuit without its key. While Q2 setting implies Q1, some scenarios make the Q2 model relevant nearly at the same time as the arrival of efficient quantum computers, especially white-box implementation. This setting has led to the most successful quantum attacks and inspired some of the Q1 attacks while leaving many primitives unaffected. This makes Q2 the most meaningful setting for security as it also include many intermediate scenarios.

Differential Cryptanalysis

Differential cryptanalysis is the most well-known family of attacks. It was first developed by Biham and Shamir [START_REF] Biham | Differential cryptanalysis of the data encryption standard[END_REF] against the DES [103].

The basic method consists in considering pairs of plaintexts with a fixed difference and study the outputs difference, hoping for a statistical property between them. For a function f and a pair of differences (α, β), we say that

the differential α f -→ β has probability p = Pr α f -→ β = P X (f (X ⊕ α) ⊕ f (X) = β) .
If p is higher than what would be expected from a random function, we have a distinghisher on the function. This distinghisher can be extended to a keyrecovery attack by adding some rounds and guessing the corresponding keys until we find the good one i.e., the one that reveals the distinguisher property.

Such basic method got many variations including:

• truncated differentials, where instead of a unique difference, a family of differences is considered;

• higher order differential, where instead of at a pair, a set of plaintexts with fixed differences is used;

• boomerang attacks which we will detail further in Chapter 5.

Linear Cryptanalysis

Linear cryptanalysis is a general cryptanalysis method developed by Matsui against the cipher FEAL [START_REF] Matsui | A New Method for Known Plaintext Attack of FEAL Cipher[END_REF] and later against DES [START_REF] Matsui | Linear Cryptanalysis Method for DES Cipher[END_REF]. The general method is to find a linear approximation of the form

m j=1 P i j ⊕ m ′ j=1 C i ′ j = m ′′ j=1 K i ′′ j that
holds with high probability where P is the plaintext, C is the ciphertext and K is the key.

With an ideal cipher, any equality of this kind happens with probability 2 . An attack consists in finding an equality that occurs with a probability far enough from 1 2 and to detect it with a reasonable amount of data, producing a distinguisher. A key-recovery attack can also be built by adding some rounds to the distinguisher.

Some Quantum Attacks

We now present some fundamental quantum attacks that motivated further research on the subject.

Distinguisher on One-Time Pad

A distinguisher against the One-Time Pad, while not explicitly useful, extends our comprehension of the possibilities offered by quantum computing. It essentially breaks the usual notions of security based on the attacker only accessing limited values of the function.

Description of the One-Time Pad

The One-Time Pad was first discovered by Miller in 1882 [START_REF] Miller | Telegraphic code to insure privacy and secrecy in the transmission of telegrams[END_REF] and patented by Vernam in 1919 [START_REF] Sandford | Secret signaling system[END_REF]. From a n-bit message and a n-bit key, the ciphertext is the bit-wise xor between the message and the key (E k (m) = m ⊕ k). Since the key is supposed to be used only once (hence the name), it was proved to achieve information-theoretically security by Shannon in 1949 [START_REF] Shannon | Communication theory of secrecy systems[END_REF].

The One-Time Pad is still a staple of cryptography, at the base of stream ciphers. Those ciphers essentially take a seed and generate a long pseudorandom sequence that will be used as keys for executions of One-Time Pad.

Quantum Attack (in Q2)

The attack consists in considering the function x → E k (x)⊕x, which is constant (equal to k), and applying a variant of Deutsch-Jozsa algorithm, as shown in Algorithm Algorithm 3.1.

Algorithm 3.1 Description of the distinguisher on One-Time Pad

Input: (single) oracle access to E, either a One-Time Pad or a random permutation Output: "One-Time Pad" or "Random"

7: If it is return "One-Time Pad" else return "Random" R L f 1 f 2 f 3 R ′ L ′

3-round Feistel Network

We then present a quantum attack that provided the first example of a Q2 attack using Simon's algorithm.

Description of Feistel Networks

Feistel networks are a way of designing block ciphers first used for the Lucifer cipher, direct precursor of the DES. This design uses pseudo-random functions to build a block cipher on a doubled state. It is an iterated cipher built from a round that separates the input into a "left" part and a "right" part, applies a function parameterized by a secret key to the "left" part, xor the result to the "right" part and swaps the "left" part and "right" part.

Luby and Rackoff [START_REF] Luby | How to construct pseudorandom permutations from pseudorandom functions[END_REF] proved in 1988 the security of 3-round Feistel (Figure 3.1) against chosen plaintext attacks and 4-round Feistel against chosen ciphertext attacks (up to O 2 n/4 classical queries where n is the size of the input).

Quantum Attack (in Q2)

We present the attack published by Kuwakado and Morii in 2010 [START_REF] Kuwakado | Quantum distinguisher between the 3-round Feistel cipher and the random permutation[END_REF].

It exploits the fact that

L ′ = R ⊕ f 2 (L ⊕ f 1 (R)).
Then by fixing two distinct elements α 0 and α 1 in {0, 1} n , we observe that

F : (b, x) → α b ⊕ L ′ (x∥α b ) admits the period (1, f 1 (α 0 ) ⊕ f 1 (α 1 )
). This property is exactly what Simon's algorithm is made for and we can recover f 1 (α 0 )⊕f 1 (α 1 ) in O (n) superposition queries and O n 3 computations.

The Even-Mansour Cipher

The Even-Mansour cipher is a classic construction that is a staple in provable security. The quantum attacks we detail below changed the perception of what the Q1 setting allows for.

Description of the Even-Mansour Cipher

The Even-Mansour construction [START_REF] Even | A construction of a cipher from a single pseudorandom permutation[END_REF] (Figure 3.2) is a simple method to build a block cipher from a permutation. It takes a public pseudo-random n-bit permutation Π and two n-bit keys k 1 and k 2 and applies it the following way:

for all x ∈ {0, 1} n , EM (x) = Π(x ⊕ k 1 ) ⊕ k 2 .
It is proven secure up to O 2 n/2 classical queries and computations.

Quantum Attack in Q2

We present the attack published by Kuwakado and Morii in 2012 [START_REF] Kuwakado | Security on the quantumtype Even-Mansour cipher[END_REF]. It recovers the key k 1 in O (n) superposition queries and O n 3 computations (then the key k 2 can be recovered by using k 2 = EM (x) ⊕ Π(x ⊕ k 1 )). We define the function F : x → EM (x) ⊕ Π(x) = k 2 ⊕ Π(x ⊕ k 1 ) ⊕ Π(x) and remark it admits k 1 as a period. Then because Π is a pseudo-random function, Simon's algorithm can recover k 1 using O (n) superposition queries and O n 3 computations.

FX Construction

Description of the FX Construction

The FX construction is a simple method to increase the key length of a block cipher. It takes a n-bit block cipher E K instantiated with a m-bit key K and two n-bit keys k 1 and k 2 and combine them as shown in Figure 3

.3: for all x ∈ {0, 1} n , F X(x) = E K (x ⊕ k 1 ) ⊕ k 2 .
It is proven secure up to O 2 n+m 2 classical queries and computations [START_REF] Kilian | How to protect DES against exhaustive key search[END_REF].

x E F X(x) k 1 k 2 K Figure 3.3: FX Construction

Grover-meets-Simon Attack

We present the attack published by Leander and May in 2017 [START_REF] Leander | Grover Meets Simon -Quantumly Attacking the FX-construction[END_REF]. It is the first attack combining different quantum algorithms.

The idea is to guess the key K, then the system comes down to an Even-Mansour cipher with Π = E K and the attack described above can be applied.

For all k ∈ {0, 1} m , we define the function

F k : x → F X(x) ⊕ E k (x)
. It admits k 1 as a period if k = K and does not admits a period otherwise. Then we can use the quantum circuit implementing Simon's algorithm we discussed in Section 2.6.4 to make a circuit that evaluates whether k = K or not. This circuit can be used as the evaluating function f of a Grover's search, thus making a complete circuit that recovers K in O (n) superposition queries and O n 3 2 m/2 computations.

Remark. The circuit implementing Simon's algorithm is approximate, i.e. has a probability of error. However we can reduce it as much as we want with little increase of time and query complexity (a constant as long as m = O (n)).

As shown in [START_REF] Bonnetain | Quantum Attacks Without Superposition Queries: The Offline Simon's Algorithm[END_REF], it is also possible to use only O (n) superposition queries by remembering that the quantum circuit only needs databases (notation defined in Section 2.6.4)

|ϕ F k ⟩ = 1 2 n/2 x∈{0,1} n |x⟩ |F X(x) ⊕ E k (x)⟩ .
Furthermore, the databases can be built on the fly as

|ϕ F k ⟩ = O E k
does not need a query |ϕ F X ⟩ queried once .

Q1 attack on Even-Mansour cipher

We finally present the different attacks on the Even-Mansour cipher in the Q1 setting.

Collision Attack

As the Q1 setting is classical queries with quantum algorithms, a first approach is the conversion of the best classical attack. This was studied by Kuwakado and Morii in [START_REF] Kuwakado | Security on the quantumtype Even-Mansour cipher[END_REF] It consists in finding a claw between x → Π(x) ⊕ Π(x ⊕ 1) and y → EM (y) ⊕ EM (y ⊕ 1). Then, with good probability (1/2 as Π is a pseudo-random permutation), x ⊕ y ∈ {k 1 , k 1 ⊕ 1}. The Q1 attack then consists in finding the claw using the BHT algorithm instead of classical collision search. The Q1 attack has time, query and QRAM complexity O 2 n/3 . An other version using the collision search without QRAM (Section 2.4.2) was proposed by Hosoyamada and Sasaki in [START_REF] Hosoyamada | Cryptanalysis against symmetrickey schemes with online classical queries and offline quantum computations[END_REF] with complexity O 2 3n/7 computations, classical queries, O 2 n/7 classical memory and negligible quantum memory.

Offline Simon

Another approach inspired by the attacks in the Q2 setting. Bonnetain, Hosoyamada, Naya-Plasencia, Sasaki and Schrottenloher proposed it in [START_REF] Bonnetain | Quantum Attacks Without Superposition Queries: The Offline Simon's Algorithm[END_REF]. As we cannot make the full superposition query anymore (unless we make all the classical queries and build the superposition, which defeats the purpose of this approach), we guess a part of k 1 and make the queries to apply the Q2 attack on the rest of the key.

More formally, we separate the key

k 1 = k L n-i bits ∥ k R i bits .
We query the whole function x → EM (0 n-i ∥x) (2 i queries).

We search k L (with Grover's algorithm, Figure 3.4) by checking if

F k : x → EM (0 n-i ∥x) ⊕ Π(k∥x) is periodic (if k = k L , k R is a period).
If we had to make |ϕ F k ⟩ at each iteration of the Grover's search, this procedure would lose its interest as we would need QRAM to make it effective. However, we can use the remark on the quantum attack against the F X construction to reuse the database.

|ϕ F k ⟩ = O Π(k∥•) does not need a query |ϕ EM (0 n-i ∥•) ⟩ computed once per database .
This attack uses 2 i queries and O 2 i + √ 2 n-i computations, which optimizes for i ≃ n/3 to O 2 n/3 queries and computations.

Other Simon-based Attacks

Kaplan, Leurent, Leverrier and Naya-Plasencia developed in [START_REF] Kaplan | Breaking Symmetric Cryptosystems Using Quantum Period Finding[END_REF] a series of attacks which consist in recovering unexpected periods using Simon's algorithm. Their technique breaks many schemes including the LRW construction for tweakable block ciphers, the CBC-MAC, PMAC, GMAC building scheme for MACs and the GCM and OCB constructions for authenticated encryption. Bonnetain, Leurent, Naya-Plasencia and Schrottenloher showed in [START_REF] Bonnetain | Quantum linearization attacks[END_REF] a new type of attacks called linearization attacks. It consists in using Deutsch-Jozsa algorithm (Section 2.1) to recover a linearity property even if the linear function changes for every query.

|k⟩ |k⟩ |ϕ EM (0 n-i ∥•) ⟩ |ϕ F k ⟩ |ϕ EM (0 n-i ∥•) ⟩ |ϕ EM (0 n-i ∥•) ⟩ |ϕ F k ⟩ |ϕ EM (0 n-i ∥•) ⟩ . . . . . . |ϕ EM (0 n-i ∥•) ⟩ |ϕ F k ⟩ |ϕ EM (0 n-i ∥•) ⟩ O Π(k∥•) O Π(k∥•) QSimon H |1⟩ (-1) k=k L H |1⟩

Protocols

Cryptographic protocols are procedures involving two or more legitimate entities in the goal to transmit some information and verifying some security properties.

While many other kinds of protocols exist, like multi-party computation, the focus in this thesis, speaking of protocols, is on Authenticated Key Exchange protocols. AKE Protocols. Authenticated Key Exchange (AKE) protocols are aimed to turn an insecure channel into a secure one by authenticating each party and producing a shared secret key, called "session key".

Bellare, Pointcheval and Rogaway [START_REF] Bellare | Authenticated Key Exchange Secure against Dictionary Attacks[END_REF][START_REF] Bellare | Entity Authentication and Key Distribution[END_REF] modeled AKE protocols and their security requirements (specific AKE protocols may involve more security properties like privacy or internal state protection). Some preliminary notions are defined beforehand.

Security is defined in terms of experiments, formally called "games" (which are defined below). A challenger simulates executions of the protocol between some simulated legitimate parties (usually servers and clients) and an adversary is given a goal to achieve with the different tools, called "oracles", it has access to.

For further definitions, an instance that accepts the authentication is said to be in "accepting" state (often explicit in the protocol description).

Partnering and Freshness.

As a proof-making method, partnering of instances is defined by the sharing of a sid value (defined for each protocol, but a correct execution of the protocol must lead to partnership).

Then an instance is said to be fresh if it is not partnered to a revealed instance or one whose parent party is corrupted. An attack will only be considered valid if the target instance is still fresh at the end. A variant of freshness (to prove forward secrecy, i.e. a session key is not vulnerable to future corruption) consists in considering an instance fresh even if its parent party or the parent of a partnered instance is corrupted after the T est query.

Oracles. General oracles are defined. They are the ways the challenger makes the frames for further security games and the attacker interacts with the simulation.

• Initialization : initiates entities;

• N ewInstance(P ) : creates a new instance for party P ;

• Execute(P 1 , P 2 ) : takes instances P 1 and P 2 and runs the protocol between them, returns the transcript (allows the attacker to make passive attacks);

• Send(P 1 , m) : sends the message m to the instance P 1 and returns the adequate message (allows the attacker to make active attacks);

• Corrupt(P ) : corrupts the entity P ;

• Reveal(P 1 ) : checks if P 1 is in accepting state and if it is, reveals the session key of P 1 and otherwise, fails;

• T est(P 1 ) : checks if P 1 is in accepting state and aborts if not. Otherwise, it initializes a secret bit b, if b = 1 it returns the session key of P 1 and a random value drawn from the same set otherwise.

Security.

The security of such an AKE protocol is then decomposed in two properties:

Authenticity. An adversary is unable to make an instance end in accepting state without another instance registering a matching conversation, i.e. the messages sent by one is received by the other and vice versa. More formally, all polynomial-time adversaries have a negligible advantage to win the following game:

1. The challenger initializes parties.

2. The attacker fixes a target instance.

3. The attacker has access to the different oracles.

4. The attacker wins if it makes the target accept, still fresh and the instance has not a unique intended partner.

Session Key

Protection. An adversary is unable to distinguish the session key of a fresh instance from random. More formally, all polynomial-time adversaries have a negligible advantage to win the following game:

1. The challenger initializes parties.

2. The attacker fixes a target instance.

3. The attacker has access to the different oracles.

4. The attacker makes a unique T est query on the target.

5. The attacker has access to the different oracles (second phase).

6. The attacker guesses the secret bit of the T est query. The attacker wins if the guess is right and the target instance is still fresh.

Chapter 4

Quantum Security of the Legendre PRF

In this chapter, we perform the first analysis of quantum algorithms for the Shifted Legendre Symbol problem (defined below) without QRAM. We give two techniques and we discuss their applicability:

1. a quantum table-based collision search that builds over the multi-target preimage search of [START_REF] Chailloux | An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography[END_REF];

2. an offline decisional abelian hidden shift algorithm, or offline-DAHS for short, which is an offline adaptation of Kuperberg's algorithm (Section 2.7), similar to the offline Simon's algorithm (Section 3.4.5.2).

These results are a joint work with André Schrottenloher, published at MathCrypt in 2021 [START_REF] Frixons | Quantum Boomerang Attacks and Some Applications[END_REF].

The Legendre PRF and Context

Let P be a prime number and a ∈ F P . The Legendre symbol of a modulo P is defined as a P = 1 if a is a square modulo P and -1 otherwise (by convention, 0 P = 1). Its use in cryptography was first proposed by Damgård in [START_REF] Damgård | On the Randomness of Legendre and Jacobi Sequences[END_REF], who conjectured the hardness of the following problem: Problem 4.1 (Legendre sequence randomness). Given a sequence of consecutive Legendre symbols starting at some given value a ∈ F P , of some length m ∈ poly (log 2 P ):

a P , a + 1 P , . . . , a + m -1 P , then find a + m P .
That is, consecutive Legendre symbols form a pseudo-random sequence of bits. A similar problem can be defined for the Jacobi symbol, which is a generalization of the Legendre symbol to a composite basis

N = P 1 × . . . × P r : a N := i a P i .
The Legendre PRF. The conjecture of Damgård naturally leads to the definition of a pseudo-random function based on the shifted Legendre symbol, as in [START_REF] Wim Van Dam | Quantum Algorithms for Some Hidden Shift Problems[END_REF]:

F Leg : F P × F P → {-1, 1} (s, x) → s+x P
or as in [START_REF] Grassi | MPC-Friendly Symmetric Key Primitives[END_REF], by remapping {-1, 1} on {0, 1}. For a given secret s, distinguishing F Leg (s, x) from random values is the decisional shifted Legendre symbol problem (DSLS), the decisional version of the shifted Legendre symbol problem (SLS), which asks for the recovery of s. At the moment, no separation between the SLS and the DSLS is known. In this chapter, as in previous works, we will focus on solving the SLS.

Problem 4.2 (Shifted Legendre Symbol). Let P be a prime number. Given query access to the function F Leg,s : x → x+s P for some secret s ∈ F P , find s.

The Legendre symbol PRF has recently regained significant interest with the proposal of Grassi, Rechberger, Rotaru and Scholl [START_REF] Grassi | MPC-Friendly Symmetric Key Primitives[END_REF] to use it in a multi-party computation scenario. They showed precisely that there existed a simple MPC protocol to compute the PRF on secret-shared data, using the malleability of the Legendre symbol.

Since then, the PRF has been considered for use in the Ethereum blockchain, and the Ethereum foundation has proposed several challenges to encourage cryptanalysis research [START_REF] Feist | Legendre pseudo-random function[END_REF]. While the Ethereum challenges are not explicitly concerned with quantum adversaries, this is the case of the LegRoast signature scheme proposed in [START_REF] Beullens | LegRoast: Efficient Post-quantum Signatures from the Legendre PRF[END_REF], which adapts the Picnic construction [START_REF] Chase | Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives[END_REF] with the Legendre PRF. Solving the SLS problem allows to break these different schemes. However, in both cases the adversary cannot make chosen-plaintext queries to the PRF. In the Ethereum challenges he only knows a (large) sequence of successive Legendre symbols, a condition that can be satisfied by all the algorithms studied in this chapter. In LegRoast, he only learns the evaluation of the PRF on a few random, uncontrolled inputs.

Here, we focus on the SLS problem, and so, the security of the Legendre PRF, against a quantum adversary. The algorithms considered derive their advantage from making a large number of queries, and so, they do not impact all applications of the PRF in the same way (e.g., LegRoast does not seem to be affected).

Previous Results.

The SLS problem is a particular case of the shifted character problem, where the Legendre symbol is replaced by any multiplicative character of a finite field. This problem was studied by van Dam et al. [START_REF] Wim Van Dam | Quantum Algorithms for Some Hidden Shift Problems[END_REF] in the quantum setting. When superposition query access to the shifted character is given, they showed that the problem could be solved in polynomial time, using a single query.

However, when only classical queries are available, the SLS problem is believed to remain intractable for a quantum attacker, and was conjectured so by van Dam et al. [START_REF] Wim Van Dam | Quantum Algorithms for Some Hidden Shift Problems[END_REF] and by Grassi et al. [START_REF] Grassi | MPC-Friendly Symmetric Key Primitives[END_REF].

In the classical setting, several authors have studied and improved the Legendre PRF key-recovery attacks [START_REF] Khovratovich | Key recovery attacks on the Legendre PRFs within the birthday bound[END_REF][START_REF] Kaluderovic | Improved key recovery on the Legendre PRF[END_REF][START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF]. We give the detailed complexities in Table 4.1. The most advanced results were obtained by Beullens, Beyne, Udovenko and Vitto et al. [START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF] and concurrently by Kaluderović, Kleinjung and Kostic et al. [START_REF] Kaluderovic | Improved key recovery on the Legendre PRF[END_REF][START_REF] Kaluđerović | Cryptanalysis of the generalised Legendre pseudorandom function[END_REF]. Given a sequence of M Legendre symbols, they recover the secret in about O P M 2 operations. Their technique is a table-based collision search, whose principle will be reviewed in Section 4.2.

Even more recently, Seres, Horváth and Burcsi [START_REF] István | The Legendre Pseudorandom Function as a Multivariate Quadratic Cryptosystem: Security and Applications[END_REF] showed that the problem of recovering the key of a Legendre PRF is equivalent to solving some multivariate quadratic system of equations. So far this approach did not yield better attacks than those of [START_REF] Kaluderovic | Improved key recovery on the Legendre PRF[END_REF][START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF], as dedicated algebraic attacks seem inefficient against this system.

On the Use of QRACM. In the quantum setting, it was proposed [START_REF] Kaluderovic | Improved key recovery on the Legendre PRF[END_REF] to use a quantum version of the table-based collision search (some remarks were also made in [START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF]). However, in the same way that the classical attack uses a large table, the quantum attack will use a table of similar size. This table requires the model of classical memory with quantum random-access (QRACM). Although this is a powerful memory model, it is required by many quantum algorithms, e.g., for BHT quantum collision search [START_REF] Brassard | Quantum Cryptanalysis of Hash and Claw-Free Functions[END_REF], which makes it theoretically worth studying.

No practical, scalable implementation of QRACM exists at the moment, and near-term quantum architectures are expected to consist only of error-corrected quantum circuits of small width. Several authors envision an advantage coming from parallel circuits rather than memory usage [START_REF] Beals | Efficient distributed quantum computing[END_REF][START_REF] Jaques | Quantum Cryptanalysis in the RAM Model: Claw-Finding Attacks on SIKE[END_REF]. In this context, QRACM can be seen as a conservative assumption, that cannot be always accurate. This is why, more recently, quantum cryptanalytic algorithms have been developed that aim for an advantage over classical algorithms, while using standard computing qubits only.

Table-based Attacks

In this section, we first recall the classical table-based collision search of [START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF][START_REF] Kaluderovic | Improved key recovery on the Legendre PRF[END_REF] (Section 4.2.1), and the idea of early abort in a Grover search (Section 4.2.2), which is a folklore technique that we will use to save logarithmic factors. Next, we introduce our new quantum table-based collision search. It combines the ideas of the classical attack and the quantum collision search algorithm of [START_REF] Chailloux | An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography[END_REF]. The notations follow those of Beullens et al. [START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF].

As all the attacks studied in this paper, the table-based collision attacks use chosen, but non-adaptive queries to the Legendre PRF. More precisely, we assume that we can query M < √ P consecutive values of the Legendre PRF, of the form x+s P where 0 ≤ x ≤ M -1 and s is the secret. This is actually the setting of the Ethereum challenges [START_REF] Feist | Legendre pseudo-random function[END_REF].

Classical Algorithm

We set m = 3 ⌈log 2 P ⌉ and L ≤ (log 2 (P )) 2 the time to compute a Legendre symbol. The attack parses the M sequential Legendre symbols to create L-sequences: words of m bits that allow to discriminate a guess of s. The definition of L-sequences is from [START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF] and we slightly simplify it. We define:

L a = a P , a + 1 P , . . . , a + m -1 P .
Assuming that the Legendre PRF is "sufficiently random", and that m is big enough, a collision of L-sequences implies the equality of their parameters:

L a = L b =⇒ a = b.
With our choice of m, we will assume that no random collisions occur at all. This is a stronger heuristic than the one commonly used in the classical cryptanalysis of the Legendre PRF (see [START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF], Assumption 1). It will simplify our analysis of quantum algorithms.

* P , L a = L b =⇒ a = b.
In order to recover the secret s, one then looks for a collision between an L-sequence of unknown parameter (depending on s) and an L-sequence of known parameter. A basic attack could use the M queries to obtain M -m L-sequences, and then, evaluate random L-sequences in search for a collision. This would give a complexity O M + P M (as two L-sequences can only collide with probability 1 P ). The attacks of [START_REF] Beullens | Cryptanalysis of the Legendre PRF and Generalizations[END_REF][START_REF] Kaluderovic | Improved key recovery on the Legendre PRF[END_REF][START_REF] Kaluđerović | Cryptanalysis of the generalised Legendre pseudorandom function[END_REF] improve the trade-off between M and the time complexity, by extracting more L-sequences from the available queries. This uses the multiplicativity of the Legendre symbol. The attacks run as follows:

1. From the M consecutive Legendre symbols, extract M 2 m L-sequences of the form:

a + s P , a + b + s P , . . . , a + b(m -1) + s P = b P a/b + s/b P , a/b + 1 + s/b P , . . . , a/b + (m -1) + s/b P = b P L (s/b+a/b) mod P .
Since we can use b ≤ M m and a < M -bm + 1, the number of sequences is increased quadratically with respect to the naive extraction. This classical attack requires M 2 storage for the table, and expectedly mP/M 2 samples must be tested in Step 3 before a collision occurs. Thus Step 3 requires O m 2 P/M 2 Legendre symbol computations. Further optimizations allow to reduce the memory to M 2 /m and to amortize the cost of computing Legendre symbols in an iteration of the loop.

Quantum Version with QRACM. This procedure yields a quantum attack as proposed in [START_REF] Kaluderovic | Improved key recovery on the Legendre PRF[END_REF]. The precomputation stage (Step 1) is unchanged, but now Step 3 is a quantum search. Instead of running O mP/M 2 classical iterations, we need only O( mP/M 2 ) iterations, each of which performs O (m) Legendre symbol computations and a memory access. This can only be efficient if we use classical memory with quantum random-access (QRACM).

Quantum Search with Early Abort

Using the same M classical sequential queries, but without QRACM, the first quantum attack available is a direct quantum search of the secret s. We query the L-sequence L s (thus using only m data) and search for x ∈ Z * p such that L x = L s . We simply apply amplitude amplification (Section 2. Early-aborting. In a classical search for a sequence matching L s , we can stop the computation of L x at the first bit that does not match. This reduces the average number of Legendre symbols computed from m to a constant. In the quantum setting, this folklore idea allows to amortize the factor m down to log 2 m. We select a constant i ≤ m and define a subset of Z * P :

X i = {x ∈ Z * P , L x and L s match on the first i bitss}.
We know that s belongs to X i , and by the pseudorandomness of the Legendre PRF, that X i is roughly of size P 2 i . Furthermore, testing if a given x is in X i requires to compute only i Legendre symbols, not m. This allows to filter out most of the incorrect values.

We first use amplitude amplification to create an "inner" search: an algorithm S X i that samples from X i . This algorithm runs a quantum search over x ∈ Z * P with O( √ 2 i ) iterations, computing i Legendre symbols each. Since we do not know exactly the size of X i , we must run the search with a fixed number of iterations, and the output state is not exactly the uniform superposition over X i . However, we only need to sample from X i with constant probability p. Afterwards, the output of S X i is "good" for us (equal to s) with probability p 2 i P , where p is a constant. We can thus use amplitude amplification again. We amplify S X i , using O P 2 i iterations in total. Each iteration contains a computation of S X i and m -i Legendre symbols. This gives a total complexity:

O P 2 i √ 2 i (iL) + (m -i)L .
Taking i = 2 log 2 m and simplifying gives: O log 2 m √ P L .

Distinguished Collisions

Since we do not assume QRACM, we have to modify the table-based collision strategy if we are to beat the square-root complexity given by Grover search. We will use the strategy of [START_REF] Chailloux | An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography[END_REF] for multi-target preimage search, and adapt the algorithm of Section 4.2.1 as follows:

1. From the M Legendre symbols, extract M 2 m L-sequences.

2. Store only the M 2 m2 t "distinguished" sequences that start with t zeroes (an arbitrary choice).

3. Sample x such that L x is distinguished, until it matches one of the stored sequences.

We use amplitude amplification again. First, we build a quantum algorithm S D that samples x such that L x is distinguished. We can do that in time O(log 2 t √ 2 t L) using an early-aborted quantum search. Again, S D is not exact, and if we measure its output, we get a distinguished L x with constant probability only. But this is enough.

We next estimate the probability that S D returns a "good" output i.e., an x such that L x collides with one of the stored sequences. There are on average P/2 t distinguished sequences, and the probability to collide on the table is roughly M 2 /(m2 t ) P/2 t . Depending on the exact number of distinguished sequences, this probability also deviates from the expectation, but not more than by a constant.

Next, to test if a distinguished L x matches one of the stored sequences, we use a sequential circuit containing quantum gates controlled by classical values. A single L a can be compared to the current L x with a comparator using O (m) gates; we repeat this for all distinguished sequences of our table.

Assuming that we use all the data, this yields an algorithm of complexity:

O M 2 + P 2 t × M 2 m2 t log 2 t √ 2 t L + mL + M 2 m2 t m .
Note that the outer number of iterations has been reduced, because two distinguished sequences have a higher probability to collide than two random sequences. By taking t = 4 3 log 2 (M/m) we get a complexity:

O   M 2 + P m M 2 M m 2/3 (log 2 log 2 M )m 2   = O M 2 + √ P M 1/3 m 11/6 log 2 log 2 M .
Note that a memory of size M is required during Step 1 (extraction), and M 2/3 m during Step 3 (search). Both are only classical. Also, the memory of Step 3 is accessed only once per iteration ( P m M 2 in total) and in a sequential way. The complexity of the classical table-based collision decreases with the available data M , from O (P ) down to O P 1/2 when M = P 1/4 . This quantum variant decreases from O P 1/2 to O P 3/7 , reaching this minimum when M = P 3/14 data is available.

A Reversible Version of Kuperberg's Algorithm

In this section, our goal is to present a quantum circuit that applies Kuperberg's algorithm. Indeed, Section 2.7 shows a procedure implying many intermediate measurements and classical procedures.

The Decisional Hidden Shift Problem

Quantum algorithms for hidden period or hidden shift problems have seen numerous applications in quantum cryptanalysis (Section 3.4).

As it was already remarked in [START_REF] Wim Van Dam | Quantum Algorithms for Some Hidden Shift Problems[END_REF], the SLS problem is an instance of Problem 2.7, where: g(x) = L s+x , obtained by m queries to the PRF F Leg,s , and f (x) = L x , obtained by m computations of Legendre symbols modulo P . In this chapter, we will not use Kuperberg's algorithm to solve directly the SLS, but a decisional version of Problem 2.7.

Problem 4.3 (Decisional abelian hidden shift).

Let f, g : Z/2 n Z → X be two injective functions such that either: ∃s, ∀x, f (x+s) = g(x), or Im(f )∩Im(g) = ∅. Decide which is the case.

Kuperberg's Algorithm Made Reversible

As we focus on Problem 4.3, we will work with an abelian group of the form G = Z 2 n for some n. We note M = 2 n the cardinality of the group. Note that the generalization to an arbitrary abelian group would be technical, but without significant incidence on the time complexity [START_REF] Bonnetain | Quantum Security Analysis of CSIDH[END_REF]. The assumption that the functions are injective is also helpful for our study, but not strictly necessary.

Sample Database. We define a sample state as:

|ϕ f,g ⟩ = 0≤x≤M -1 |0⟩ |x⟩ |f (x)⟩ + |1⟩ |x⟩ |g(x)⟩ ,
omitting the common amplitude factor for ease of notation. One creates it with a single oracle query to O f and O g . Kuperberg's algorithm starts by producing t = O(2 √ αn ) such states, where α = 2 log 2 3 is obtained from the complexity analysis. We name |ϕ f,g ⟩ ⊗t the sample database of (f, g): it contains all the information on f and g that we need to solve Problem 4.3.

Our goal is to process this state to decide whether f and g are shifted, without destroying the database. Measurements can always be removed from a quantum computation. Thus, we know that we can follow the standard operations of Kuperberg's algorithm, but without performing any measurement, and obtain a quantum circuit DAHS that yields the same result.

However, the standard procedure handles a lot of classical data, and performs non-trivial memory operations. This may increase significantly the time complexity in a fully reversible variant, especially since we do not want to rely on quantum RAM. We will show that reversibility costs only at most a polynomial factor in time. Given the sample database |ϕ f,g ⟩ ⊗t , the circuit DAHS finds whether f and g are shifted with constant probability of success. This probability can then be boosted by taking a polynomial number of copies of the circuit. All in all, we prove the following theorem.

Theorem 4.1.

There exists a quantum circuit DAHS that maps:

|ϕ f,g ⟩ ⊗t |b⟩ → |ϕ f,g ⟩ ⊗t |b ⊕ DAHS(f, g)⟩ + |δ f,g ⟩ , where DAHS(f, g) = 1 if
∥ |δ f,g ⟩ ∥ to O 2 -r/2 .
We devote the rest of this section to the details of this procedure. For now, we will assume that f and g are shifted, and we will go back to the other case at the end of this section.

Label States and Label Qubits

The first step in Kuperberg's algorithm is to transform all the independent sample states into label states, by measuring a value a in the third register and applying an M -dimensional QFT on the second register. In the reversible variant, we do not measure this a. We do not write it either for simplicity (after the QFT, it does not intervene further in the algorithm).

Since the functions are injective, there exists a single x 0 that maps to a through f and, by assumption, x 0 -s maps to a through g. We obtain:

|ψ f,g ⟩ = QFT M (|0⟩ |x 0 ⟩ + |1⟩ |x 0 -s⟩) = 0≤y≤M -1 χ M (x 0 y) |0⟩ + χ M ((x 0 -s)y) |1⟩ |y⟩ = 0≤y≤M -1 χ M (x 0 y) |0⟩ + χ M (-sy) |1⟩ |y⟩ .
Next, we would have measured the register |y⟩ to obtain a random value y and a label qubit: |ψ y ⟩ = |0⟩ + χ M (-sy) |1⟩ (up to a global phase factor). Again, we do not measure y. So we simply write label states as |ψ y ⟩ |y⟩, keeping in mind that there is a superposition over y.

A label qubit contains some information about s, but it is not immediately exploitable, unless we can obtain specific values of y. For example, if y = 2 n-1 , then the qubit is either |0⟩ + |1⟩ or |0⟩ -|1⟩ depending on the least significant bit of s. Recall that we are interested in deciding whether there is a shift or not (Problem 4.3). We can do that from many independent copies of |ψ 2 n-1 ⟩.

Classical Combinations.

The key step in the algorithm is when we create these wanted labels from the random initial ones. In the standard procedure, the values of the labels are known. From two label qubits |ψ y 1 ⟩ and |ψ y 2 ⟩, we can obtain |ψ y 1 ±y 2 ⟩ with a CNOT and a measurement. This erases both qubits and returns either y 1 + y 2 , or y 1 -y 2 , with probability 1 2 . The procedure then consists in combining pairs of labels (y 1 , y 2 ) that maximize the expected valuation of y 1 ± y 2 modulo 2. We let val 2 (z) = max{i, 2 i |z} denote this valuation.

Complexity. The complexity analysis in [START_REF] Kuperberg | A Subexponential-Time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF] gives that O 2 √ αn initial label qubits are enough. Simulations in [START_REF] Bonnetain | Hidden Shift Quantum Cryptanalysis and Implications[END_REF] showed that 2 √ αn were essentially enough to solve Problem 2.7 with constant probability, for groups of the form Z 2 n . Interestingly, the algorithm is pseudoclassical: the combination step can be easily simulated by sampling labels at random. This allows to compute precisely how many labels will be needed for a given instance of the problem, and to obtain the corresponding success probability.

Combining Two Labels Reversibly

When combining two labels, we start from the joint state:

|ψ y 1 ⟩ |ψ y 2 ⟩ |y 1 ⟩ |y 2 ⟩ = |0⟩ + χ M (-y 1 s) |1⟩ |0⟩ + χ M (-y 2 s) |1⟩ |y 1 ⟩ |y 2 ⟩ = |00⟩ + χ M (-y 1 s) |10⟩ + χ M (-y 2 s) |01⟩ + χ M (-(y 1 + y 2 )s) |11⟩ |y 1 y 2 ⟩ ,
and we CNOT the first qubit into the second one, mapping |10⟩ to |11⟩ and |11⟩ to |10⟩. We obtain:

|0⟩ + χ M (-(y 1 + y 2 )s) |1⟩ |0⟩ |y 1 ⟩ |y 2 ⟩ + χ M (-y 2 s) |0⟩ + χ M (-(y 1 -y 2 )s) |1⟩ |1⟩ |y 1 ⟩ |y 2 ⟩ .
In order to mimic the classical recomputation of labels, we perform a controlled addition or subtraction of y 2 in place, on the register that contains y 1 . We obtain the state:

|ψ y 1 +y 2 ⟩ |0⟩ |y 1 + y 2 ⟩ + χ M (-(y 1 -y 2 )s) |ψ y 1 -y 2 ⟩ |1⟩ |y 1 -y 2 ⟩ |y 2 ⟩ .
Once this operation has been performed, we get a qubit |0⟩ or |1⟩ that is used to indicate whether we obtained the sum y 1 + y 2 or the difference y 1 -y 2 . Here, it is just kept along for reversibility. The register that contains y 2 has become entangled with the other and cannot be used for further combinations.

In our DAHS circuit, we will define a "combination circuit" Comb v (Figure 4.1). We flag all the label states with additional qubits that inform us whether the label can be used for further combination or not. The circuit Comb v then first tests that the two labels y 1 , y 2 have valuation v and that their flags b 1 , b 2 are equal to 1 (Flag). If this is true, then it performs an addition or subtraction in place (Sub, Add), then NOTs the flag qubit b 2 (X), since y 2 cannot be used for combination anymore. Choosing which Labels to Combine. Among the pairs of labels y 1 , y 2 having the same valuation modulo 2, we want to select those which maximize the expected valuation of y 1 ± y 2 . We check whether the second to last bit of y/2 val 2 (y) is 0 or 1. If it is 0, then our hope is to add y to another label that maximizes the overlap of least significant bits. If it is 1, then our hope is to subtract y to another label that overlaps with 2 n -y on as many least significant bits as possible. Thus we can define a function F on labels1 :

|ψ y 1 ⟩ • |ψ y 1 ±y 2 ⟩ |b 1 ⟩ • Flag |y 1 ⟩ Sub Add |y 1 ± y 2 ⟩ |ψ y 2 ⟩ • |b 2 ⟩ • Flag X |y 2 ⟩ Sub Add |y 2 ⟩ |0⟩ |Carry⟩ |0⟩ Flag • • • |Flag⟩
F (y) =        (1, 0) if y = 0 or y cannot be combined anymore (-val 2 (y), rev(2 n -y, n)) if the second to last bit of y/(2 val 2 (y) ) is 1 (-val 2 (y), rev(y, n)) otherwise
where rev(y, n) reverses the bits in y (for a total of n bits). By sorting the labels according to F , we ensure that the best pairs, such that y 1 ± y 2 has the best expected valuation, are put together.

Combining All Labels

We start from a list of t = 2 ℓ label states for some integer ℓ. For v = 0, . . . , n-2:

• we perform a reversible sorting network for F : we compute F in ancillas, perform a sorting network, and then uncompute F . We consider that the computation of F can be neglected. The sorting network is a series of comparators and swaps (controlled on the results of the comparators).

The labels are moved in place. For reversibility, the outcome of each comparator must be written in a new qubit;

• we apply the combination circuit Comb v on each pair of labels at positions (2i, 2i + 1) for i ≤ 2 ℓ-1 . It writes 2ℓ new qubits that contain carries and inform whether the combinations occurred.

In practice, the combination layer at step v consumes all labels of valuation v and creates labels of higher valuation. The main difference with the classical process is that, although the labels are sorted to ensure a maximal number of zeroes after combination, since we take them 2 by 2 on arbitrary positions, we might create a few suboptimal pairs. This does not change the asymptotic complexity of the procedure.

Note that all labels equal to 0 mod 2 n , and the labels that cannot be combined anymore, are moved to the bottom of the list by sorting. The labels equal to 2 n-1 will be moved to the top. Thus, we know where to look for them.

Sorting Network. We use the odd-even mergesort of Batcher [START_REF] Batcher | Sorting Networks and Their Applications[END_REF]. On input a list of 2 ℓ n-bit strings, it uses a total of S(2 ℓ ) = 2 ℓ-1 ℓ(ℓ-1) 2 + 2 ℓ -1 = O ℓ 2 2 ℓ comparators and controlled SWAPs. In order to be made reversible, it also needs to write O ℓ 2 2 ℓ new qubits.

The Full Circuit. The full combination circuit contains n -1 layers of sorting, followed by layers of combination circuits: at layer i (starting from 0), we combine only the labels having valuation i. The complexity mainly depends on the sorting steps: there are in total

O (n) × O (n) × S(2 ℓ ) = O n 2 ℓ 2 2 ℓ
quantum gates used, mainly for comparators and SWAPs. The circuit writes nS(2 ℓ ) + (n -1)2 ℓ ancillas. They are uncomputed afterwards.

After the combination, we look at the r first label registers, for some value r to choose later. We expect them to contain copies of 2 n-1 . As we have seen, in the shifted case, the corresponding qubits contain identical copies of |0⟩ + |1⟩, or |0⟩ -|1⟩ depending on the parity of s. Thus, we perform a Hadamard transform on them and test if the result is all-zero or all-one.

Note that if the first label registers do not contain the expected copies of 2 n-1 , then we know that the circuit has failed. The fact that failures are detectable allows to reduce easily the probability of failure with multiple copies of the circuit: we simply take the result that has not failed.

Behavior in the Non-shifted Case

In the non-shifted case, by our assumptions, there is no overlap between functions f and g. Thus, sample states are the sums of two independent parts:

|ϕ f,g ⟩ = x |0⟩ |x⟩ |f (x)⟩ |ϕ f ⟩ + x |1⟩ |x⟩ |g(x)⟩ |ϕg⟩ ,
and the whole sample database |ϕ f,g ⟩ ⊗t can be rewritten as a sum of the 2 t states of the form |ϕ h 1 ⟩ ⊗ • • • ⊗ |ϕ ht ⟩ where h t ∈ {f, g}. By linearity, we can focus on the output of DAHS on one of these states only.

The QFT applied to |ϕ h ⟩ yields a state |b⟩ y |y⟩ ( x χ M (xy) |h(x)⟩) where b depends only on h. Therefore, after performing the combination step, and after obtaining labels equal to 2 n-1 , the corresponding qubits are not |0⟩±|1⟩, but either |0⟩, or |1⟩, depending on the exact sequence of combinations performed.

Recall that in the shifted case, the r qubits on which we apply the final Hadamard transform contain copies of |0⟩ ± |1⟩. If the algorithm succeeds, these copies are obtained in all cases, so they are disentangled from the rest of the state. In contrast, in the non-shifted case, we obtain a single r-dimensional basis state depending on the sequence of combinations. Thus after applying the Hadamard transform, the total amplitude on |0 r ⟩ (resp. |1 r ⟩) is equal to 2 -r/2 .

Bounding the Errors

The circuit DAHS is not exact. In the positive (shifted) case, it maps:

|ϕ t f,g ⟩ |b⟩ DAHS ---→ |ϕ t f,g ⟩ |b ⊕ 1⟩ + |δ f,g FN ⟩ |b⟩
where ∥ |δ f,g FN ⟩ ∥ ≤ ϵ F N , and ϵ 2 F N is the (small) probability of false negative; and in the negative (non shifted) case, it maps:

|ϕ t f,g ⟩ |b⟩ DAHS ---→ |ϕ t f,g ⟩ |b⟩ + |δ f,g FP ⟩ |b ⊕ 1⟩
where ∥ |δ f,g FP ⟩ ∥ ≤ ϵ F P and ϵ 2 F P is the (small) probability of false positive. We now bound both ϵ F N and ϵ F P separately, and independently of f and g. False Negatives. False negatives come from all the sequences of labels Y = y 1 , . . . , y t on which the combination cannot produce enough labels 2 n-1 . As unitary operators preserve the euclidean norm, we can bound ∥ |δ FN ⟩ ∥ before the combination step. Let us consider the state:

|ψ f,g ⟩ ⊗t = X Y χ M (X • Y )   1≤i≤t (|0⟩ + χ M (-y i s) |1⟩) |y i ⟩   |f (X)⟩ , (4.1) where X = x 1 , . . . , x t , χ M (X • Y ) = χ M (x i y i ) and f (X) = f (x 1 ), . . . , f (x t ).
All the "bad" sequences Y contribute to the probability of false negatives, so we bound:

X Y bad χ M (X • Y ) i (|0⟩ + χ M (-y i s) |1⟩) |y i ⟩ |f (X)⟩ ≤ |bad Y s| |all Y s| .
Thus False Positives. We have seen above that when the functions are not shifted, we have still some probability to fall on |0 r ⟩ or |1 r ⟩ after the final Hadamard transform. This probability is also independent of f and g. The amplitude on the state

|0 r ⟩ or |1 r ⟩ is exactly 1 √ 2 r
, and for all f :

∥ |δ F P ⟩ ∥ 2 = 2 2 r =⇒ ϵ F P = 2 -(r-1)/2 .

Quantum Search with an Approximate Test

Next, we use another result on Grover search using an approximate test oracle. This is an important object in the context of offline search algorithms such as offline-Simon [START_REF] Bonnetain | Quantum Attacks Without Superposition Queries: The Offline Simon's Algorithm[END_REF] or offline-DAHS below using the DAHS circuit above.

We consider a boolean function f : {0, 1} n → {0, 1} and an oracle O f that uses an ancillary state |ψ⟩. This ancillary state is required by the oracle to perform its computations, and it must be preserved. So one would expect to map:

|x⟩ |ψ⟩ O f --→ (-1) f (x) |x⟩
∀x ∈ {0, 1} n , |x⟩ |ψ⟩ O ′ f --→ (-1) f (x) |x⟩ |ψ⟩ + |δ x ⟩
where |ψ⟩ is the predefined ancillary state which must be preserved by the oracle, and

max x ∥ |δ x ⟩ ∥ ≤ ϵ.
That is, on each input vector, the oracle incurs a uniformly bounded error of amplitude ϵ (the same for all basis states). If this error is small enough, an amplitude amplification using O ′ f instead of O f will not "see" the difference. In our case, contrary to [START_REF] Bonnetain | Quantum Attacks Without Superposition Queries: The Offline Simon's Algorithm[END_REF], we will also start from an approximate initial state. We summarize these needs with the following.

(I ⊗ A)(I ⊗ O 0 )(I ⊗ A † )O ′ f t |ψ ′ ⟩ , that is, t iterations of "approximate" quantum search using O ′
f , where I is the identity operator applied to the ancillary state |ψ⟩. Then measuring the output yields a good result with probability greater than

(1 -tϵ -ν) 2 max(1 - |Y |/|X|, |Y |/|X|).
Proof. The proof uses a "hybrid argument" as in [START_REF] Bennett | Strengths and Weaknesses of Quantum Computing[END_REF] or [5, Lemma 5]. We will consider the "perfect" run of the algorithm, that starts with the initial |ψ⟩ and applies the perfect test O f , and compare it with the "imperfect" one, that starts with |ψ ′ ⟩ and applies the imperfect test O ′ f . Let |ψ ′ k ⟩ be the state after k iterations of the imperfect search, and |ψ k ⟩ after the perfect search. Our goal is to bound

∥ |ψ ′ k ⟩ -|ψ k ⟩ ∥. Let U = (I ⊗ A)O 0 (I ⊗ A † ), then the quantum search iterates are respectively U O ′
f and U O f . Before the first iteration, we have:

∥ |ψ ′ 0 ⟩ -|ψ 0 ⟩ ∥ = ν,
by definition of |ψ ′ ⟩. Next, for each k ≥ 0:

|ψ ′ k+1 ⟩ -|ψ k+1 ⟩ = U O ′ f |ψ ′ k ⟩ -U O f |ψ k ⟩ = O ′ f |ψ ′ k ⟩ -O f |ψ k ⟩ = O ′ f (|ψ ′ k ⟩ -|ψ k ⟩) + O ′ f |ψ k ⟩ -O f |ψ k ⟩ ,
and using the triangle inequality:

|ψ ′ k+1 ⟩ -|ψ k+1 ⟩ ≤ O ′ f (|ψ ′ k ⟩ -|ψ k ⟩) + O ′ f |ψ k ⟩ -O f |ψ k ⟩ ≤ |ψ ′ k ⟩ -|ψ k ⟩ + O ′ f |ψ k ⟩ -O f |ψ k ⟩ .
In order to bound the second term, we use the fact that O ′ f induces a uniformly bounded error ϵ. More specifically, if

|ψ k ⟩ = x α x |x⟩, we have: O ′ f |ψ k ⟩ - O f |ψ k ⟩ = x α x |δ x ⟩ where |δ x ⟩ is the error induced by O ′ f on the input state x. Then we have O ′ f |ψ k ⟩ -O f |ψ k ⟩ 2 = x α 2 x ∥|δ x ⟩∥ 2 ≤ ϵ 2 =⇒ O ′ f |ψ k ⟩ -O f |ψ k ⟩ ≤ ϵ,
by definition of ϵ. Thus, each iteration adds an error ϵ.

After t iterations, we have |ψ ′ t ⟩ = |ψ t ⟩ + |ψ err ⟩ where ∥|ψ err ⟩∥ ≤ ν + tϵ. By the Cauchy-Schwarz inequality, we have:

| ⟨ψ t |ψ err ⟩ | ≤ ∥|ψ t ⟩∥ ∥|ψ err ⟩∥ ≤ ν + tϵ.

Measuring |ψ ′

t ⟩, we project on |ψ t ⟩ with a probability greater than:

(1 -| ⟨ψ t |ψ err ⟩ |) 2 ≥ (1 -ν -tϵ) 2
and then, by amplitude amplification, we have a probability greater than max(1 -|Y |/|X|, |Y |/|X|) to measure a "good" element.

It can seem surprising to require a uniformly bounded error ϵ. Indeed, in a classical exhaustive search with a single solution, we can afford a constant probability of false negative (not recognizing the solution), and still obtain a constant probability of success, as we expect to look at the solution only once.

Our classical intuition then dictates that the same should be true of a quantum search: we could afford a much higher probability of false negatives than of false positives. We found that this was not the case, due to the stateful nature of the search. Indeed, taking different ϵ F P and ϵ F N changes the error term ϵ added at iteration k to a term:

sin 2 ((2k + 1)θ)ϵ 2 F N + cos 2 ((2k + 1)θ)ϵ 2 F P .
In order to have a constant probability of success in the end, we must measure a state in which a constant proportion of the amplitude is on the solution. That is, (2k+1)θ must be sufficiently close to π 2 to have sin 2 ((2k+1)θ) constant. This means that in the last iterations, the error term is close to ϵ F N . (Although in the first iterations, it was close to ϵ F P .) Over all the iterations, the solution and the bad elements both capture roughly (up to a constant) the same amount of amplitude, and so both terms ϵ F N and ϵ F P will have roughly the same effect. Proof. We use simply that sin 2 ((2t + 1)θ)

≥ 1 2 and 1 -t max(ϵ F N , ϵ F P ) -ϵ ≥ 1 -1 4 -1 4 = 1 2 .
We stress that Theorem 4.2 and Corollary 4.1 contain two important features, that are both crucial for solving the SLS problem:

• the test oracle can be imperfect, as soon as the error is uniformly bounded and exponentially small (when t is exponential);

• the ancillary state used by the approximate test can also be approximated, and the corresponding error ν can be a constant.

The Offline-DAHS Algorithm

In this section, we describe an offline-DAHS algorithm that will help us solve the SLS with classical queries, based on the reversible circuit DAHS.

The algorithm looks for a pair of shifted functions g(•) = f (• + s) over an abelian group, when g is fixed and f goes through a family (f i ) i∈I . We will consider a simple version of this problem, in which the group is Z 2 n , all functions are injective and admit distinct image sets. Problem 4.4 (Finding a shifted pair, injective case). Let g : Z 2 n → X be a function, and f i : Z 2 n → X be a family of functions indexed by I, such that:

• g and all f i are injective;

• there exists a single i 0 ∈ I and a shift s such that ∀x ∈ Z 2 n , g(x) = f i 0 (x + s);

• i̸ =i 0 Im(f i ) and Im(g) are disjoint.
Then find i 0 .

High-level Description

First of all, we describe offline-DAHS in a generic way, following the layout of the offline-Simon algorithm by Bonnetain, Hosyamada, Naya-Plasencia, Sasaki and Schrottenloher [START_REF] Bonnetain | Quantum Attacks Without Superposition Queries: The Offline Simon's Algorithm[END_REF]. Note that [START_REF] Bonnetain | Quantum Attacks Without Superposition Queries: The Offline Simon's Algorithm[END_REF] already proposed to combine their algorithm with Kuperberg's, but did not analyze the resulting algorithm nor its time complexity. Originally, the offline-Simon algorithm, which itself follows Grover-meet-Simon [START_REF] Leander | Grover Meets Simon -Quantumly Attacking the FX-construction[END_REF], combines a quantum search and a quantum circuit for Simon's algorithm. Roughly speaking, offline-DAHS is obtained by replacing Simon's algorithm by Kuperberg's (which is why we needed to define a quantum circuit for it).

Description. We use a quantum search for the right index i 0 ∈ I. Testing a given i means finding whether f i is a shift of g. For this, we use the circuit DAHS. Recall that DAHS takes in input the sample database of (f i , g): |ψ f i ,g ⟩ ⊗t and writes a single output bit. Thus, the naive Grover search would reconstruct the database at each iteration, then compute DAHS and return the database to |0⟩. However, due to the asymmetric nature of the problem, the function g in the database remains the same from one iteration to the next. Let us introduce the sample database of (0, g):

|ψ 0,g ⟩ ⊗t = x |0⟩ |x⟩ |0⟩ + |1⟩ |x⟩ |g(x)⟩ ⊗t .
It contains all the data on g that we need for the successive iterations of quantum search. The algorithm has then two steps.

• Precomputation step: construct |ψ 0,g ⟩ ⊗t .

• Search step: run the quantum search for i 0 . At each search iterate, compute f i inside the database to obtain the state |ψ f i ,g ⟩ ⊗t , run the circuit DAHS, then compute f i again to return to the state |ψ 0,g ⟩ ⊗t . Due to the approximate nature of DAHS, this is a quantum search with an approximate test (Theorem 4.2).

We have bounded the error of DAHS and given its complexity in Theorem 4.1. As long as the initial state |ψ 0,g ⟩ ⊗t can be constructed exactly, this becomes an easy instance of Theorem 4.2, and we deduce the following result. The fact that the queries to O g are now performed only in the precomputation step is the reason for the offline denomination. Note that the polynomial factors in the O in Proposition 4.1 are not negligible, and depend on log 2 I and n together.

Approximate Promise

We now go into technical details specific to offline-DAHS and not discussed in the previous literature.

So far, our analysis has assumed that we could start from an exact sample database |ψ 0,g ⟩ ⊗t as defined above. But it is not the case in the SLS problem. Here, g will be the secretly shifted Legendre symbol s+• P . This function is defined on Z P , but it is queried on an interval of length M .

In particular, in order to run the algorithm as expected from Proposition 4.1, we would need sample states of the form:

|ψ exact 0,g ⟩ = 0≤x≤M -1 |0⟩ |x⟩ |0⟩ + -s≤x≤M -s-1 |1⟩ |x⟩ |g(x)⟩ ,
which would allow for a total interference between the matching values of f (x) and g(x), when querying the good f . However, since we do not know the value of s, such states cannot be created. Instead, we rely on approximate sample states:

|ψ approx 0,g ⟩ = 0≤x≤M -1 |0⟩ |x⟩ |0⟩ + 0≤x≤M -1 |1⟩ |x⟩ |g(x)⟩ .
There is an error vector |ψ err 0,g ⟩ such that |ψ approx 0,g ⟩ = |ψ exact 0,g ⟩ + |ψ err 0,g ⟩:

∥ |ψ err 0,g ⟩ ∥ = -s≤x≤-1 |1⟩ |x⟩ |g(x)⟩ - M -s≤x≤M -1 |1⟩ |x⟩ |g(x)⟩ ≤ 2s 4M ,
and we can bound the distance between the "exact" database of (0, g) and the "approximate" one:

|ψ approx 0,g ⟩ ⊗t -|ψ exact 0,g ⟩ ⊗t 2 ≤ t∥ |ψ err 0,g ⟩ ∥ 2 = ts 2M .
This gives a total "starting error" ν = ts 2M . As we have seen in Theorem 4.2, we need this error to be constant, thus s needs to be subexponentially smaller than M for the algorithm to work.

Application to the Legendre Symbol

Given a sequence of M = 2 n successive outputs s+x P of the Legendre PRF, we define a function g(x) = L s+x on Z M . Next, we choose an integer n ′ such that 2 n ′ < M and we write:

s = s 1 + 2 n ′ s 2 , where s 1 < 2 n ′ . For a given s 2 , we define f (x) = L x+2 n ′ s 2 .
Then there exists a single s 2 such that g(x) = f (x + s 1 ).

Note that we need a subexponential gap between 2 n ′ , where n ′ is the number of bits of the secret handled by the (offline) DAHS subroutine, and M = 2 n , the amount of data given. It is due to the approximation discussed in Section 4.5.2. The DAHS subroutine still runs with labels of n = log 2 M bits.

By taking L-sequences of length ≥ 3 log 2 P , our Heuristic 4.1 ensures that the functions are injective, and that they have distinct image sets: two Lsequences cannot collide randomly. Thus, we have an instance of Problem 4.4 with an approximate promise, and we can apply Theorem 4.2.

We use the M classical queries to build the approximate sample states |ψ approx 0,g ⟩, and then, we run a Grover search over the remaining secret s 2 . Building the sample database from the classical queries is costly (O (M m) quantum gates for each sample), but done only once in the precomputation step.

Let α = 2 log 2 3. In order to make the starting error ν smaller than 1 4 , we must take t labels where

t2 n ′ /(2M ) ≤ 1 4 =⇒ t ≤ M/2 n ′ +3 . But since t = O(2 √ αn ), this means the circuit DAHS can only recover n ′ bits of s, where n ′ + √ αn = log 2 M = n. Thus n ′ = n - √ αn.
The remaining (log 2 P -n ′ ) bits must be searched with Grover's algorithm.

O M 2 √ α log 2 M + O   2 3 2 √ α log 2 M P M   .
Proof. We use Corollary 4.1 and Theorem 4.1. We run a quantum search with an approximate test (the circuit DAHS) and an approximate starting state (the approximate sample states). The analysis of DAHS assumes an exact ancillary state |ψ 0,g ⟩ ⊗t . Thus, Theorem 4.2 is crucial here to ensure that the approximate starting state does not disrupt the algorithm.

The minimum occurs when the two terms are equal, which constrains:

α log 2 M + log 2 M = 3 2 α log 2 M + 1 2 log 2 P -1 2 log 2 M =⇒ log 2 M = 1 3 α log 2 M + 1 3 log 2 P , up to the polynomial factors. We get log 2 M = 1 3 log 2 P + α 36 + √ α 6 = 1 3 log 2 P + O (1) and log 2 M = 1 3 log 2 P + √ α 3 √ 3 log 2 P +O (1)
. This gives a time complexity of order:

P 1/3 2 4 3 √ α √ log 2 P 1/3 .

Detailed Complexities

We give in Table 4.1 a recap of the different algorithms.

+ √ P M 1/3 m 11 6 log 2 log 2 M M classical + m qubits 4.2.3 Offline-DAHS M O   M 2 √ α log 2 M + 2 3 2 √ α log 2 M P M   O(2 √ α log 2 M ) qubits 4.5.3

Conclusion

In this chapter, we presented two quantum algorithms for solving the Legendre hidden shift problem (SLS) when classical queries are given, and without quantum RAM. The first one (distinguished table-based collisions) allows to reach an advantage against Grover's algorithm when more data is given. The second one is the offline Kuperberg's algorithm. It is an interesting method, notably the only one reaching a time-memory product below O √ P . Although a very efficient algorithm exists when superposition queries are allowed [START_REF] Wim Van Dam | Quantum Algorithms for Some Hidden Shift Problems[END_REF], it does not seem amenable to an offline version, which requires to define reduced instances of the problem (e.g., guessing part of the secret and finding the remaining bits by searching for a shift). Nevertheless, the algebraic properties of the Legendre symbol might still find a use in this context, and we leave this as an open question.

Chapter 5

Quantum Boomerang Attacks and Some Applications

In this chapter, we consider boomerang attacks, which form a particular type of differential attacks introduced by Wagner in [START_REF] Wagner | The Boomerang Attack[END_REF]. We study how to build an efficient quantum version of boomerang attacks and of mixing boomerang attacks [START_REF] Orr Dunkelman | The Retracing Boomerang Attack[END_REF] recently introduced in the context of AES. We propose, for the first time, efficient quantum boomerang attacks, and we apply them to several reduced-round versions of well known ciphers.

The quantum attacks studied in this chapter are also based on quantum search. One should note that, since quantum search always provides a quadratic speedup, our procedures admit a quadratic speedup at best. By comparing with the quadratic speedup of exhaustive key search, it follows that we will not be able to attack more rounds than in the classical setting: any quantum attack in our framework can be converted back into a valid classical attack. Though this result can seem rather negative at first sight, our new attacks, like previous works with similar conclusions [START_REF] Bonnetain | Quantum Security Analysis of AES[END_REF][START_REF] Kaplan | Quantum Differential and Linear Cryptanalysis[END_REF], tend to show that block ciphers should be assumed to retain half of their bits of classical security against quantum adversaries, even when this security has been reduced with respect to the generic key search.

It is based on a joint work with María Naya-Plasencia and André Schrottenloher published at Selected Areas in Cryptography in 2021 [START_REF] Frixons | Quantum security of the legendre prf[END_REF].

Classical Boomerang Attacks

In this section, we introduce the classical Boomerang attack from [START_REF] Wagner | The Boomerang Attack[END_REF] and the Mixing Boomerang attack from [START_REF] Orr Dunkelman | The Retracing Boomerang Attack[END_REF]. We give generic formulas for their time complexity depending on the parameters of the cipher attacked.

Throughout this chapter, we consider an n-bit block cipher E, with unknown key k. Standard block ciphers are built by iterating a round function, and we will sometimes decompose E into subciphers, e.g., E = E 2 • E 1 where E 1 forms the r 1 first rounds and E 2 the r 2 last rounds.

As specified in Section 3.3.2, boomerang cryptanalysis is a subset of differential cryptanalysis, which studies the propagation of differences in a cipher. We recall that for a cipher (or subcipher) E, and a pair of differences (α, β), we say that α → β is a differential for E of probability:

Pr α E -→ β = P X (E(X ⊕ α) ⊕ E(X) = β) .
Since E is a keyed function, the probability of a differential depends on the choice of key. In the analysis, it is usually computed on average over the key. When running an attack, we consider a black box with a fixed given key. We then assume that the differential probability is equal to the analyzed average (even if there is a small variation in practice, we may run the attack again with another estimate -this is valid for classical as well as quantum attacks).

The Classical Boomerang Attack

We briefly describe the boomerang distinguisher introduced in [START_REF] Wagner | The Boomerang Attack[END_REF] and the last-round key-recovery attack that can be based on it. The notation that we introduce here (E, p, q, α, . . .) will be kept throughout the chapter.

Boomerang Distinguisher. As above, let E be a block cipher of block size n and key size k, that can be decomposed into: E = E 2 • E 1 . We assume that each part has a high-probability differential: α → β for E 1 and δ → γ for E -1 2 .

Pr α

E 1 -→ β = p ↓ , Pr β E -1 1 ---→ α = p ↑ , Pr δ E -1 2 ---→ γ = q .
The distinguisher is given in Algorithm 5.1. It uses 4 p ↓ p ↑ q 2 encryptions, decryptions, and negligible memory. We can check its correctness as follows (see also Figure 5.1 for the notations):

Step 3: using the differential on E 1 ; with probability p ↓ , E 1 (P

1 ) ⊕ E 1 (P 2 ) = β = E -1 2 (C 1 ) ⊕ E -1 2 (C 2 )
Step 4: using the differential on E -1 2 ; with probability q 2 , E -1

2 (C 3 ) ⊕ E -1 2 (C 1 ) = γ and E -1 2 (C 4 ) ⊕ E -1 2 (C 2 ) = γ.
Thus, by summing these equations:

E -1 2 (C 3 ) ⊕ E -1 2 (C 4 ) = E -1 2 (C 1 ) ⊕ E -1 2 (C 2 ) = β.
Step 5: since we have established

E -1 2 (C 1 ) ⊕ E -1 2 (C 2 ) = β with probability p ↓ q 2 ,
it remains to satisfy the differential on E -1 1 , and we obtain P 3 ⊕P 4 = α with probability p ↑ × p ↓ q 2 . Then, the full path is satisfied with probability (p ↓ p ↑ q) 2 instead of 2 -n for a random permutation, and making 1/(p ↓ p ↑ q) 2 trials is enough to determine the case. Usually, we also have p ↓ = p ↑ = p and this formula simplifies into (pq) 2 .

Algorithm 5.1 Boomerang Distinguisher

Input: oracle access to E = E 2 • E 1 , and its inverse (or a random permutation) Output: "E" or "Random" 1: Repeat (p ↑ p ↓ q) -2 times ▷ (probability of success of 1 2 )

2:

Select P 1 at random and set P 2 = P 1 ⊕ α 3:

Encrypt: C 1 = E(P 1 ) and C 2 = E(P 2 )

4:

Compute:

C 3 = C 1 ⊕ δ and C 4 = C 2 ⊕ δ 5:
Decrypt:

P 3 = E -1 (C 3 ) and P 4 = E -1 (C 4 )
6:

if P 4 = P 3 ⊕ α then return "E" 7: EndRepeat 8: return "Random" Key Recovery on the Last Round. We now explain how to build a key-recovery attack using this boomerang distinguisher. We append one (or more) additional rounds R to the cipher, which is now

E = R • E 2 • E 1 (if the
additional round is at the beginning, consider E -1 ). Let D fin denote the set of differences that can be obtained from δ after the additional rounds, p out the probability that we get δ back from an element in D fin by computing the last rounds backwards, and k out the number of key bits involved in these additional rounds. We need D fin to be a vector space. This is usually the case as most of the time, non-zero components of δ become unknown after a passage through an S-Box. This property is used to make data structures of the form {X ⊕ ∆/∆ ∈ D fin }, from which we can extract quadratically many pairs with differences in

D fin : ∀∆ 1 , ∆ 2 , (X ⊕ ∆ 1 ) ⊕ (X ⊕ ∆ 2 ) = ∆ 1 ⊕ ∆ 2 ∈ D fin .
To simplify for now, we assume that 1 √ poutpq < |D fin |, in which case a single structure is needed. Otherwise when 1 √ poutpq ≥ |D fin |, we will actually generate multiple structures with |D fin | ciphertexts each, so that they form a total of 1 pout(pq) 2 pairs. Algorithm 5.2 detects a good guess of the k out key bits using the boomerang distinguisher. We will now explain its correctness and compute its average time complexity (up to a constant factor).

We start by generating a structure S of 1 √ poutpq ciphertexts with differences in D fin . This first step costs a time and memory:

1 √ poutpq . Now we partially decrypt these ciphertexts and obtain pairs with difference δ. Among the

1 pout(pq) 2 pairs (C i , C j ) in S, we expect 1 (pq) 2 of them to be such that R -1 (C i ) ⊕ R -1 (C j ) = δ,
where R involves the actual partial key K out used in the last rounds. Then we define

C ′ i = E(E -1 (C i ) ⊕ α) and C ′ j = E(E -1 (C j ) ⊕ α)
. By the boomerang property, with probability (pq) 2 , we will have

R -1 (C ′ i ) ⊕ R -1 (C ′ j ) = δ.
This difference gets then mapped to D fin with probability 1. Obtaining the list L pairs costs 2 √ poutpq data and memory and 1 √ poutpq log 1 √ poutpq computations for sorting the C ′ i (since D fin is a vector space, we can sort according to its cosets). This sorting allows to extract efficiently the pairs

C ′ i , C ′ j such that C ′ i ⊕ C ′ j ∈ D
S ⊆ {X ⊕∆, ∆ ∈ D fin } 2: L pairs ← ∅ 3: Compute all the C ′ = E(E -1 (C) ⊕ α) for all C ∈ S, sort S by values of C ′ 4: ForEach pair C ′ i , C ′ j such that C ′ i ⊕ C ′ j ∈ D fin 5: L pairs ← L pairs ∪ {(C i , C j , C ′ i , C ′ j )} 6: EndFor ▷ Here |L pairs | = |D fin | 2 n 1 pout(pq) 2
▷ Note that S being sorted, these pairs are computed efficiently

7: L triplets ← ∅ 8: ForEach pair C i , C j , C ′ i , C ′ j ∈ L pairs 9:
ForEach possible value K out of the k out bits of key ▷ 2 kout trials, 2 kout p 2 out solutions 10:

If both (C i , C j ) and (C ′ i , C ′ j ) lead to a difference δ through R -1 under K out 11: L triplets ← L triplets ∪ {(C i , C j , K out )} 12: EndFor 13: EndFor ▷ Here |L triplets | = |D fin | 2 n
1 (pq) 2 2 kout p out 14: return all guesses of K out in the triplet list There are enough quartets (C i , C j , C ′ i , C ′ j ) in L pairs to ensure that, for the good key guess of K out , one of them is an actual boomerang quartet. Let C out be the time complexity to obtain all valid keys K out for a given pair (C i , C j ) (Step 9 in Algorithm 5.2 is the naive way to do so, but there is usually a better algorithm as we will see in the applications). Since we expect on average 2 kout p 2 out such keys, we have C out ≥ 2 kout p 2 out . After having obtained the list L pairs of size |D fin | 2 n 1 pout(pq) 2 , we find all possible key guesses for each of these pairs i.e., all possible K out such that (C i , C j ) and (C ′ i , C ′ j ) lead to a difference δ through R -1 (in which case they form a boomerang quartet). This costs a time

|D fin | 2 n 1 pout(pq) 2 C out . The list of triplets obtained is of size: |D fin | 2 n
2 k out pout (pq) 2 , and we know that the actual key K out occurs in one of these triplets, because one of the pairs went through the boomerang. Thus, if we have:

|D fin | 2 n 2 k out pout (pq) 2
≤ 2 kout , we have reduced the number of possibilities for K out . We perform an exhaustive search over the remaining k -k out bits of key. We obtain a key-recovery attack of total time complexity:

1 √ p out pq log 1 √ p out pq + |D fin | 2 n 1 p out (pq) 2 C out + p 2 out 2 k , ( 5.1)
in number of queries to E and E -1 or evaluations of the cipher. Note that C out is counted relatively to the cost of an evaluation of E. The procedure used max

2 √ poutpq , |D fin | 2 n 2 k out pout (pq) 2
memory and 2 √ poutpq data.

Remark. Another situation commonly encountered in boomerang attacks is when two (or more) boomerang pairs occur within the trials. In that case, it is possible to recognize immediately the good guess of K out , as the only one that appears in two (or more) triples in the list L triplets .

Mixing Boomerang Attacks

We now give some details on a variant of boomerang attacks [START_REF] Orr Dunkelman | The Retracing Boomerang Attack[END_REF], which is related to mixture distinguishers.

Distinguisher. As in Section 5.1.1, the cipher is decomposed as

E = E 2 • E 1
and we assume that a good (truncated) differential α → β exists on E 1 with probability p ↓ forwards and with probability p ↑ backwards. We further assume that E 2 can be divided into a "left" and a "right" part Indeed, in Step 1 we have

E 2 = (E 2,L , E 2,
E 1 (P 1 ) ⊕ E 1 (P 2 ) = β with probability p ↓ . By definition of E, E 1 (P i ) = E -1 2 (C i ), so in Step 2, we know that E -1 2 (C 1 ) ⊕ E -1 2 (C 2 ) = β. If we separate β = β L ||β R , this rewrites: E -1 2,L (C 1,L ) ⊕ E -1 2,L (C 2,L ) = β L E -1 2,R (C 1,R ) ⊕ E -1 2,R (C 2,R ) = β R . (5.2)
Thus, by definition of C 3 , C 4 , we also have

E -1 2 (C 3 ) ⊕ E -1 2 (C 4 ) = β.
Finally in Step 3, with probability p ↑ , β gets mapped to α. After (p ↓ p ↑ ) -1 iterations, we obtain a valid quartet with probability 1/2.

Attack on First Round. We append one or more additional rounds R before those covered by the distinguisher. We write E = E 2 • E 1 • R. We let D start denote the set of differentials that can lead to α for the additional rounds R, p in the probability to get α from an element of D start and k in the number of bits of the key involved in the additional rounds. Step 1: Generating Pairs. We generate a list of 1 p in p ↓ p ↑ pairs of plaintexts (P 1 , P 2 ) such that their difference is in D start . Again, there can be one or multiple structures, but as the term 1 p in p ↓ p ↑ (the number of pairs) will appear in the complexity, there is no difference between these two cases.

For each pair (P 1 , P 2 ) we compute:

(C 1 = E(P 1 ), C 2 = E(P 2 )), (C 3 = (C 1,L , C 2,R ), C 4 = (C 2,L , C 1,R )), (P 3 = E -1 (C 3 ), P 4 = E -1 (C 4 )). (5.3)
For each pair, we have R(P 1 ) ⊕ R(P 2 ) = α with probability p in . Then,

(E 2 • E 1 ) -1 (C 3 ) ⊕ (E 2 • E 1 ) -1 (C 4 ) = α
with probability p ↓ p ↑ . Thus, we expect that one pair satisfies the boomerang distinguisher. By decrypting through R we fall back on D start .

Thus, we keep only the pairs (P 1 , P 2 ) such that P 3 ⊕ P 4 ∈ D start , among which the pair that went through the boomerang must remain. We get a list of |Dstart| Step 2: Sieving Key Bits. For each kept pairs (P 1 , P 2 ), we determine the values of K in (the k in bits of key that intervene in R) such that (P 1 , P 2 ) and (P 3 , P 4 ) both lead to a difference α through R. The average expected number of possible values for K in for each pair is thus 2 k in (p in ) 2 . We let C in denote the cost of finding all these possible values.

At a cost of |Dstart|

2 n 1 p in p ↓ p ↑ C in computations, we get a list of |Dstart| 2 n 1 p ↓ p ↑ 2 k in p in elements (P 1 , P 2 , K in ) . If |D start | 2 n 1 p ↓ p ↑ 2 k in p in < 2 k in , ( 5.4)
then we have reduced the number of possible values for K in and we do an exhaustive search of the remaining k -k in bits of key. The attack has a total time complexity: Select P 1 at random 3:

1 p in p ↓ p ↑ + |D start | 2 n 1 p in p ↓ p ↑ C in + p 2 in 2 k , ( 5
If E -1 (E(P 1 ) ⊕ δ) = E -1 (E(P 1 ⊕ α) ⊕ δ) ⊕ α then 4:
the state (P 1 ) is "good" Else the state (P 1 ) is "bad" 5: EndRepeat 6: Measure and check if a solution was found 7: If it was found return "E" Else Return "Random" in number of queries to E and E -1 or evaluations of the cipher. Note that C in is counted relatively to the cost of an evaluation of E.

Quantum Boomerang Attacks

In this section, we adapt the attacks presented in Section 5.1 to the quantum setting. This form a framework for applications.

Quantum Boomerang Distinguisher

Similarly to the differential attacks from [START_REF] Kaplan | Quantum Differential and Linear Cryptanalysis[END_REF], the boomerang distinguisher of Algorithm 5.1 can be accelerated in the Q2 setting (Algorithm 5.3). The Repeat loop becomes a quantum search with π 4 (pq) -1 iterations looking for an element P 1 such that P 1 , P 1 ⊕ α forms a boomerang pair. If E satisfies the expected property, such a P 1 will be found, otherwise measuring the result will give us an invalid pair. We make in total π 4 (pq) -1 × 8 queries to E and E -1 (each query is made twice for reversibility), which are in superposition since the quantum search space is on the value P 1 .

Quantum Boomerang Last-rounds Attack

Recall that the last-rounds attack of Section 5.1.1 is in two phases: first, we use the boomerang property to sieve the k out bits that intervene in the last rounds R. Second, we perform an exhaustive search on the k -k out remaining key bits.

For now, let us put aside the small constant factors. We count all quantum times in evaluations of E or E -1 and consider a Q2 query to E or E -1 to cost the same. The generic key-recovery is Grover's exhaustive search, with a time 2 k/2 and a negligible number of Q1 queries. Our first idea is to go below that using the sieve on the k out bits of key that the boomerang property gives. If we can produce the superposition of valid K out with a time complexity below 2 (k-kout)/2 , and if there are strictly less than 2 kout elements in this superposition, then we can do better than Grover search: we use amplitude amplification on an algorithm that first samples a K out , then tries to complete the key in time 2 (k-kout)/2 .

In order to produce a possible value of K out , we look for a pair C 1 , C 2 such that:

• C 1 ⊕ C 2 ∈ D fin and C ′ 1 ⊕ C ′ 2 ∈ D fin , where C ′ i = E(E -1 (C i ) ⊕ α);
• there exists a subkey

K out such that (C 1 , C 2 ) and (C ′ 1 , C ′ 2 ) decrypt to the difference δ through R -1 under K out .
Finding such a valid pair C 1 , C 2 is a collision search problem, solved with BHT algorithm. Let us assume that D fin ≥ 2 n/3 , which corresponds to the case where a single structure is enough. A structure contains |D fin | 2 pairs, and the constraint

C ′ 1 ⊕ C ′ 2 ∈ D fin selects a proportion |D fin | 2 n of them.
Thus there is at least one solution.

Algorithm 5.4 Quantum Last-rounds Key-recovery

Input: superposition oracle access to E and E -1 Output: the full key

1: Amplify ( |D fin | 2 n 2 k out pout (pq) 2 ) times 2:
Sample a subkey guess K out using: Sample a guess of K out 7:

If R -1 (C 1 ) ⊕ R -1 (C 2 ) = δ = R -1 (C ′ 1 ) ⊕ R -1 (C ′ 2 ) then K out is "good" 8: EndAmplify 9: If we obtained a valid K out then (C 1 , C 2 , C ′ 1 , C ′ 2 ) is "good" 10:
EndAmplify 11:

Given this subkey guess K out :

12:

Amplify 2 (k-kout) times 13:

Sample a choice of the k -k out other key bits, check if the full K matches If we obtained a valid full key K then K out is "good" 16: EndAmplify 17: Measure K out , recompute K and return it We now check the number of iterations in the loops of Algorithm 5.4.

Step 1: the number of iterations to perform depends on the probability that a subkey guess K out , obtained with the procedure in the loop, is the good one. In the classical analysis of the procedure, we obtained a list of

|D fin | 2 n 2 k out pout (pq) 2 tuples (C 1 , C 2 , C ′ 1 , C ′ 2 , K out )
, and we took the key K out from one of these tuples. We know that the good one is in one of these tuples. The computation inside the Repeat loop is the same, so the probability of success (the full key is found) is

2 n |D fin | (pq) 2
2 k out pout and the number of iterations follows.

Step 3: here, we are iterating on tuples

(C 1 , C 2 , C ′ 1 , C ′ 2 )
until we find a key candidate. The probability that a tuple yields a key candidate is 2 kout p 2 out , thus there are max(1,

1 √ 2 k out p 2 out
) iterations. We will assume 2 kout p 2 out ≤ 1. Note that the key candidate (actually the superposition of all possible candidates for the given tuple) is obtained by exhaustive search, but a more involved procedure could likely be applied in order to reduce the time complexity.

Step 12: having obtained a candidate for K out , it remains to try it: for this, we perform a simple Grover search over the remaining k -k out bits.

By changing the loops into nested quantum searches, the quantum time complexity of Algorithm 5.4 is:

|D fin | 2 n 2 kout p out (pq) 2   1 2 kout p 2 out 2 n |D fin | 1/3 + 2 kout/2 + 2 (k-kout)/2   = |D fin | 2 n 2 kout p out (pq) 2 <2 k out /2 by the classical analysis   2 n/3 2 kout/2 p out |D fin | 1/3 + 1 p out + 2 (k-kout)/2
Exhaustive search   .

The algorithm requires Q2 queries to E and E -1 , and uses 2 n /|D fin | 1/3 qRAM due to the use of BHT (or Ambainis' algorithm) to find valid pairs. However, if we can replace the factor 2 n /|D fin | 1/3 by 2 n /|D fin | 1/2 , then we can use a Grover search instead of BHT, and the algorithm will now require a small number of qubits only.

Making the Attack Q1. Recall that the attack requires only a structure of 1 √ pout(pq) ciphertexts. For each of these, we will have to compute E(E -1 (C) ⊕ α) := f (C). Thus, all the queries made to E and E -1 asked during the attack fall actually in a set of size

1 √ pout(pq) . If we have 1 √ pout(pq) < 2 k/2
, then we can make all the queries classically beforehand and store the results in a quantum RAM of size 1 √ pout(pq) . Inside Algorithm 5.4, we replace the on-the-fly computation of f by a memory lookup.

Algorithm 5.5 Quantum First-rounds Key-recovery

Input: superposition oracle access to E and E -1 Output: the full key 1: Amplify |Dstart|

2 n 1 p ↑ p ↓ 2 k in p in times 2:
Sample a subkey guess K in using:

3: Amplify 1/(2 k in p 2 in ) times 4:
Sample a valid (P 1 , P 2 ) using:

If R(P 1 ) ⊕ R(P 2 ) = α = R(P 3 ) ⊕ R(P 4 ), then K in is "good" 12: EndAmplify 13:
If there is a valid K in , then (P 1 , P 2 , K in ) is "good" Given this subkey guess K in :

16:

Amplify 2 k-k in times 17:
Sample a choice of the k -k in other key bits, check if the full K matches If the valid full key K was obtained, K in is good 20: EndAmplify 21: Measure K in , recompute the full K and return it

Quantum Mixing Boomerang Distinguisher

We now study the mixing boomerang attacks presented in Section 5.1.2. Since the distinguisher is a single loop similar to Algorithm 5.1, it can be replaced by a quantum search of a valid pair (P 1 , P 1 ⊕ α) with about 1/ √ p ↓ p ↑ iterations, with Q2 queries and negligible memory.

Quantum First-round Mixing Attack. The attack will work similarly as the quantum last-round attack of Algorithm 5.4. The main difference is that we do not need a collision search algorithm to filter out the valid pairs (P 1 , P 2 ) such that

P 3 ⊕ P 4 ∈ D start .
We analyze the time complexity of Algorithm 5.5, when translated into nested amplitude amplifications.

Step 1: here, the number of iterations depends on the number of possible keys K in obtained in the sieving step. From the classical analysis, we know that there will be |Dstart|

2 n 1 p ↑ p ↓ 2 k in p in < 2 k in
tuples (P 1 , P 2 , P 3 , P 4 , K in ) obtained, among which the good subkey K in appears (at least once). Thus there are at most |Dstart|

2 n 1 p ↑ p ↓ 2 k in p in 1/2 iterations.
Step 3: from a valid quadruple (P 1 , P 2 , P 3 , P 4 ), i.e., one that satisfies P 1 ⊕P 2 ∈ D start and P 3 ⊕ P 4 ∈ D start , the probability that we obtain a subkey guess is 2 k in p 2 in . This gives the number of iterations.

Step 5: the probability for a given pair to be valid is simply |Dstart| 2 n .

Step 16: similarly to Algorithm 5.4, we complete the quantum search for the key.

The total quantum time complexity of Algorithm 5.5 is given by:

|D start | 2 n 2 k in p in p ↑ p ↓   1 2 k in p 2 in 2 n |D start | + 2 k in /2 + 2 (k-k in )/2   = |D start | 2 n 2 k in p in p ↑ p ↓ 2 n/2 2 k in /2 p in |D start | 1/2 + 1 p in + 2 (k-k in )/2 . (5.6)
The baseline algorithm does not use quantum RAM and requires only a small number of qubits, but it also relies on Q2 queries. Depending on the amount of data required, it may be possible to make it Q1: for this, we query all the 1 p in p ↑ p ↓ pairs required by the classical attack, and store the tuples (P 1 , P 2 , P 3 , P 4 ) in a quantum RAM. This can only work if

1 p in p ↑ p ↓ < 2 k/2 .

Application to SAFER

SAFER is a family of block ciphers (Substitution-Permutation Networks) that dates back to the SAFER K-64 proposal of [START_REF] James | SAFER K-64: A Byte-Oriented Block-Ciphering Algorithm[END_REF]. SAFER-K-64 was a block cipher of 64 bits. A new version SAFER+, with 128-bit blocks, was a candidate of the AES competition organized by the NIST [START_REF] Massey | Nomination of SAFER+ as Candidate Algorithm for the Advanced Encryption Standard[END_REF]. Finally, another variant, SAFER++, was submitted to the NESSIE project [START_REF] Massey | Nomination of SAFER++ as Candidate Algorithm for the New European Schemes for Signatures, Integrity, and Encryption[END_REF]. Here, we focus on SAFER++ and more precisely, on the boomerang attack presented in [START_REF] Biryukov | Cryptanalysis of SAFER++[END_REF]. It reaches 5.5 rounds out of 7 total rounds.

Description of the Cipher

We use ⊞ and ⊟ to denote addition and subtraction modulo 2 8 . We consider the version of SAFER++ with a 128-bit key (and 128-bit blocks), which has 7 rounds. The round function (Figure 1 in [START_REF] Biryukov | Cryptanalysis of SAFER++[END_REF]) consists of key additions, a nonlinear layer and a linear layer. The state and the round keys are represented as 16 bytes numbered from 0 to 15, partitioned into S 1 = {0, 3, 4, 7, 8, 11, 12, 15} and S 2 = {1, 2, 5, 6, 9, 10, 13, 14}. A single round performs the following steps: Boomerang Attack. The full differential path of the classical 5-round boomerang attack of [START_REF] Biryukov | Cryptanalysis of SAFER++[END_REF] is reproduced in Figure 5.3. We use S 0 A 0 S 1 A 1 -S 2 -A 2 S 3 A 3 S 4 A 4 to denote the whole construction. The total probability for the boomerang to occur is: (2 -7-30.4 ) 2 2 -40-8 = 2

Middle:

In the middle, the S-Box trick allows to traverse the layer S 2 with probability 1. When going backwards from this middle to the top, everything propagates with probability 1.

We recall the attack procedure from [START_REF] Biryukov | Cryptanalysis of SAFER++[END_REF] in Algorithm 5.6. It requires 2 78 encryptions.

Algorithm 5.6 Classical attack on 5-round SAFER++ (adapted from [START_REF] Biryukov | Cryptanalysis of SAFER++[END_REF], Section 6.3).

Input: access to E and E -1 1: Prepare 2 29 structures of 2 48 plaintexts P i that take all values in bytes 1, 4, 5, 11, 14 and 15 and are constant in the others 2: For each structure, obtain the ciphertexts C i = E(P i ) 3: For each structure, add the difference δ (one bit in bytes 2, 4, 5, 12) to the C i and decrypt: obtain

Q i = E -1 (C i ⊕ δ) 4:
For each structure, sort the Q i on the values of the bytes that are constant in the P i and keep the pairs Q i , Q j that have zero difference on these ten bytes (all bytes except 1, 4, 5, 11, 14 and 15) ▷ We search for a difference after the S-Box of the form (0, x, 0, 0, x, x, 0, 0, 0, 0, 0, -4x, 0, 0, x, -x) 5: For each possible quartet (P j , P k , Q j , Q k ), search for the upper key bytes K 4 0 , K 11 0 , K 14 0 , K 15 0 such that after the first S-Box layer, we have a difference (x, -4x, x, -x) (x odd) between P j and P k and between Q j and Q k . The quartets are kept with their partial key and the observed x. 6: For each quartet, search for the key bytes K 1 0 and K 2 0 ′ (upper and lower key addition in byte 0) such that the difference after the first S-Box is the right one. Repeat this for K 5 0 and K 6 0 ′ . 7: Find a suggestion of the 8 key bytes that appears twice, and run exhaustive search on the remaining bytes.

From a pool of 2 48 plaintexts, we get approximately 2 95 pairs, which have to satisfy an 80-bit condition, so we get 2 15 pairs in Step 4. The probability that the structure contains a boomerang is approximately 2 -27.8 , so by using 2 29 structures, we can expect two boomerang quartets to occur among the 2 44 filtered quartets.

Next, we guess 4 bytes of the first upper round key (K 4 0 , K 11 0 , K 14 0 , K 15 0 ) to remove wrong quartets. For each guess, we have a 25-bit condition on both pairs. Thus, 50 bits of restriction on the quartets. At this point, we obtain 2 44 × 2 32 × 2 -50 = 2 26 valid quartets and key guesses. Note that this already yields a valid key-recovery attack, as we have been able to reduce the number of possible K 4 0 , K 11 0 , K 14 0 , K 15 0 from 2 32 to 2 26 . For the next 4 key bytes guessed at Step 6, there is approximately one choice for each valid quartet currently kept. Thus, at this point, we have 2 26 guesses of 8 bytes of the key, among which we expect the good one to occur. If we ran immediately an exhaustive search for the remaining 8 bytes, we would obtain a complexity 2 26 × 2 8×8 = 2 90 .

However, there are two valid boomerang pairs: one of the key guesses occurs twice. As the key guesses are 8 bytes and there are 2 26 of them, we can expect that random collisions are not likely to occur, and the only key guess occurring twice is the good one. Thus exhaustive search is ran only once. The bottleneck of the complexity lies in encrypting and decrypting the 2 29 structures, for a total of 2 78 time and queries.

Extension. Another half round can be added at the end, by making 30 bits of additional key guess and running Algorithm 5.6 2 30 times.

Quantum Boomerang Attack

Our new quantum attack (Algorithm 5.7) on 5-round SAFER++ uses the quantum framework of Algorithm 5.4, adapted to the setting of the classical boomerang attack (Algorithm 5.6). We first explain its time complexity, and show how it goes below Grover's exhaustive search in time 2 64 . Recall that the time complexity is counted in number of evaluations of SAFER++.

Algorithm 5.7 Attack on 5-round SAFER++.

Input: superposition access to E and E -1 Output: the full key 1: Amplify 2 26 times 2:

Sample a guess for K 4 0 , K 11 0 , K 14 0 , K 15 0 , K 1 0 , K 2 0 ′ , K 5 0 , K 6 0 ′ using: If a solution was found, return it (and the quartet) Search exhaustively for K 1 0 , K 2 0 ′ and K 6 0 ′ (keep at most one value) ▷ there is on average one value; sometimes there can be more; but we only need this to work for the actual boomerang quartet Given the current guess of 8 bytes of key, complete the key by Grover search 13: EndAmplify 14: Measure and return the full key Assuming that we use Grover search at Step 4 (instead of collision search), the attack would run in approximately:

√ 2 26    √ 2 18    √ 2 80 Step 4 + √ 2 32 + 2 • 2 16
Step 11

   + √ 2 64 Step 12   
(5.9) calls to SAFER++ and its inverse. The dominating term comes from the search for quartets satisfying the partial collision condition on 10 bytes. Indeed, the classical attack can sample these quartets very easily using structures. If we use classical search in Algorithm 5.7, we can obtain an attack running with polynomial memory in little less time than 2 128 . However, in the quantum setting, additional factors from amplitude amplification will prevent that, so we must resort to quantum collision search in Step 4.

Since a structure is of size 2 48 and we need 80 bits of collision, we can use Ambainis' algorithm to produce a superposition of colliding pairs (thus valid quartets) in about (π/2) 2 2 80/3 ≃ 2 28.3 calls to E and E -1 in superposition.

Assuming that the numbers of iterations are exact, but putting the additional factors of quantum search, we obtain:

2 π 4 2 13 2 π 4 2 9 2 28.3 × 4
Step 4

+ 2 π 4 2 16
Step 11

+4 • 2 16 + π 4 2 32 × 4
Step 12 ≃ 2 13.65 2 9.65 (2 30.3 + 2 16.65 + 2 19 ) + 2 33.65 ≃ 2 53.6 < 2 64 (5.10)

where the time is counted in computations of SAFER++ and its inverse, and we assume that a black-box (quantum) query costs the same. In the last step (quantum exhaustive search over 8 key bytes), we match against two given plaintext-ciphertext pairs. In Step 12, we know that there is exactly one solution (or none) in a search space of size 2 64 . Thus, we can run exact amplitude amplification with π 4 2 32 iterations and succeed with probability 1 (either we find the solution, or prove that there is none). For the other loops, we can ensure a high probability of success by making a few assumptions on the classical attack: • the number of valid quartets for each structure is close to the average (this ensures that Ambainis' algorithm works as intended; if necessary we make multiple copies of it);

• the actual boomerang pair yields only a single value at Step 11, and our algorithm does not lose it;

• the probability, for a given guess of 8 key bytes sampled at Step 2, to be the good one, is close to 2 -26 .

The attack requires 2 27 registers of 256 qubits to store the values of P i and E -1 (E(P i ) ⊕ δ) for each P i , and 2 53.6 computations and superposition queries to E and E -1 (faster than Grover's search, which use 2 64 computations).

Application to KASUMI

KASUMI is a block cipher used in the confidentiality and the integrity algorithms of the 3GPP mobile communications [2]. In 2005, a related-key attack was found by Eli Biham, Orr Dunkelman and Nathan Keller [START_REF] Biham | A Related-Key Rectangle Attack on the Full KASUMI[END_REF] on KASUMI which made the security of the algorithms using KASUMI unprovable (no security proof but not necessarily an attack). This attack was further refined by Orr Dunkelman, Nathan Keller and Adi Shamir [START_REF] Orr Dunkelman | A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony[END_REF] and runs in practical time.

Description of the Cipher

KASUMI is a block cipher with a 128-bit key and a 64-bit block. It is an 8-round Feistel network using smaller functions F O and F L, F L then F O on even rounds and F O then F L on odd rounds. For now we note i the number of the round of the global Feistel network.

F L is a 2-round Feistel network with for the first round function a left rotation of one bit then a bit-wise AND with KL i,1 and for the second round function, a bit-wise OR with KLi, 2 then a left rotation of one bit.

F O is a 3-round Misty Feistel network with a bit-wise XOR with KO i,j then application of F I i,j as j-th round of F O.

F I is a 4-round Misty Feistel unbalanced network with 9 bits on one side and 7 on the other. On odd round it applies S9 on the 9-bit part and xor the 7 first bits with the 7bit part, on second round , apply S7 on the 7-bit branch and xor it with the first 7 bits of the 9-bit branch and xor the whole state with KI i,j , on last round apply S7 on the 7-bit branch and xor it with the first 7 bits of the 9-bit branch.

For the key scedule, we have

K = K 1 ||K 2 ||K 3 ||K 4 ||K 5 ||K 6 ||K 7 ||K 8 and: K ′ = K ⊕ 0x0123456789ABCDEF F EDCBA9876543210 KL i,1 = K i <<< 1 KL i,2 = K ′ i+2 KO i,1 = K i+1 <<< 5 KO i,2 = K i+5 <<< 8 KO i,3 = K i+6 <<< 13 KI i,1 = K ′ i+4 KI i,2 = K ′ i+3 KI i,3 = K ′ i+7
We refer to [START_REF] Orr Dunkelman | A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony[END_REF] for more details on the cipher.

Classical Attack

The attack of [START_REF] Orr Dunkelman | A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony[END_REF] relies on a boomerang distinguisher on 7 rounds of KASUMI with probability 2 -14 .

Top Boomerang: in F L, each bit of key has only one half probability to express itself which make the following related key differential happen with ∆K = (0, 0, 0x8000, 0, 0, 0, 0, 0) and probability 1 4 :

Bottom Boomerang: the same differential happens on rounds 5-7 with ∆K = (0, 0, 0, 0, 0, 0, 0x8000, 0) and probability 1 4 .

Middle: we want two top differentials and a bottom differential to produce another bottom differential. In this case, the right part of the quartet is of the form (X, X ⊕ 00100000, X ⊕ 00100000, X) and the goal is to transform it through F O 4 to a balanced quartet, knowing that F L 4 is linear.

The last round attack uses the Feistel structure to determine the elements that follow the path of the boomerang: once the structure of element is chosen, the difference of the left parts of

C L a ⊕ C L c = F L 8 (F O 8 (C R a )) ⊕ F L 8 (F O 8 (C R c
)) is the same among the elements that follow the path of the boomerang.

Once we have a correct quartet, we can recover KL 8,2 , KO 8,1 , KI 8,1 by considering the differences on the second round of F L 8 (we know the differences just after the round because it is the difference of the left part and the difference just before the round only depends on KO 8,1 , KI 8,1 ) and knowing the values that go into the bitwise OR, we can eliminate wrong guesses for KO 8,1 , KI 8,1 when we come to a contradiction.

Three quartets give four right pairs (C R a , C R c and C L a , C L c are the same for every quartets) on which the key guesses have to not get a contradiction.

Wrong keys have a probability to be kept less than 1+1 is the probability that all four pairs agree with the i-th bit of KL 8,2 being a 0 (same difference before the OR as after) and same probability for agreeing on a 1 (always no difference after the OR)). Remark that in the process, KL 8,2 is also found.

The same analysis holds when we recover KL 8,1 , KO 8,3 , KI 8,3 by considering the differences on the first round of F L 8 . This result in the following attack:

We start with 2 24 elements which make 2 48 pairs. With the first condition we only keep 2 16 quartets in which we expect to have 2 16 × 2 -14 = 4 right quartets. The probability of a 32-bit value C L 1 ⊕ C L 3 appearing more than three times from 2 16 random values is less than 2 16 3 2 3×(-32) 2 32 ≤ 2 -18 . Then we are almost sure that the corresponding quartets are right. The total attack needs 2 33.8 computations.

Quantum Attack

Our quantum attack on KASUMI uses the quantum framework of Algorithm 5.4, adapted to the setting of the classical attack (Algorithm 5.8).

Algorithm 5.8 Classical attack on KASUMI (adapted from [51], Sec. 5)

Input: access to E and E -1 1: Choose a value A prepare a structures of 2 24 plaintexts C a = (X a , A) 2: For each element, obtain the plaintexts P a = E -1 Ka (P a ) 3: For each element, compute P b = (0, 00100000) ⊕ P a and decrypt: obtain

C b = E -1 K b (P b ) 4:
Prepare a structure of 2 24 plaintexts C c = (X c , A ⊕ 00100000), encrypt and get P c = E -1 Kc compute P d = (0, 00100000) ⊕ P c and decrypt: obtain ▷ We expect to get a group of 3 or more quartets then we are almost sure that the remaining quartets are valid one 7: Recover the key parts KL 8,2 , KO 8,1 , KI 8,1 as described earlier 8: Recover the key parts KL 8,1 , KO 8,3 , KI 8,3 as described earlier 9: Recover the key parts KO 8,2 , KI 8,2 by brute force The full attack needs 2 22.7 computations using Ambainis algorithm or 2 24 computation without QRAM (then we use the classic part for quartet determination and Grover search for the key search). Both version are faster than Grover's search, which uses 2 32 computations.

C d = E -1 K d (P d

Application to Related-key AES

In this section, we present the boomerang related-key attack on AES-256 from [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF] and study a corresponding quantum attack. We will see that the classical attack path is actually not adapted to the quantum setting. The quantum attack represents a relatively minor improvement on the classical one, and it can only be considered valid under a restriction on the number of related keys.

Note that the attack uses a tuple of classically related keys (the same as in the classical attack). In this situation, there is no trivial quantum attack such as the one of [START_REF] Rötteler | A note on quantum related-key attacks[END_REF] (which needs a quantum superposition of related keys).

Description of AES

The AES [START_REF]Advanced Encryption Standard[END_REF], designed by Daemen and Rijmen [START_REF] Daemen | AES proposal: Rijndael[END_REF], was the winner of the AES competition organized by the NIST. It is arguably one of the most analyzed ciphers to date. Similarly to SAFER++, it has blocks of 128 bits, divided in Algorithm 5.9 Quantum attack on KASUMI Input: superposition access to E and E -1 Output: the full key 1: Find three correct quartets 2: Amplify 2 16 times ▷ ((2 32 ) 3/8 iterations using Ambainis)

3:

Find a superposition of quartets that satisfy the first criterion (Step 5 before)

▷ Either using Ambainis' algorithm, or quantum search Verify the full key on a simple encryption 21: EndAmplify 16 bytes numbered from 0 to 15. The state of AES is represented as a square and we will follow the byte numbering of [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF]. Thus, in a plaintext P or a subkey K, the byte P i,j or K i,j is located at row i and column j.

AES State.

The state of is composed of elements of F 256 organized in a 4 × 4 matrix :

     α 0 α 4 α 8 α 12 α 1 α 5 α 9 α 13 α 2 α 6 α 10 α 14 α 3 α 7 α 11 α 15     
Composition of a Round. AES-128 is composed of 10 rounds which are composed of :

• AddKey xors the state with the round key (see Key Schedule);

• SubBytes which applies the AES Sbox on all individual elements α i ;

• ShiftRows which shifts the i-th row by i position;

• MixColumns which multiplies each column by a fixed matrix.

The last round omits the Mixcolumns operation and applies one extra AddKey. Key Schedule. The round key expansion from the 128-bit master key K = k 0 ∥k 1 ∥k 2 ∥k 3 for the subkey of round i, K i for E is as follows: K 0 = k 0 ∥k 1 ∥k 2 ∥k 3 and K i+1 = (k 4i+4 ∥k 4i+5 ∥k 4i+6 ∥k 4i+7 ) for i from 0 to 9

k 4i+4 = SubWord (RotWord(k 4i+3 )) ⊕ k 4i ⊕ rc i k 4i+5 = k 4i+4 ⊕ k 4i+1 k 4i+6 = k 4i+5 ⊕ k 4i+2 k 4i+7 = k 4i+6 ⊕ k 4i+3 with rc i =      X i mod X 8 + X 4 + X 3 + X + 1 0 0 0     

Classical Attack

We consider here the related-key attack of [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF] on full-round AES-256 (14 rounds in total, numbered from 1 to 14). This key-recovery has a data and time complexity of 2 99.5 . There are 4 related keys K A , K B , K C , K D in the attack of [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF], where K B , K C , K D are computed from K A . These related keys are used in the four branches of the quartet. We refer to [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF] for the definition of their relations. The path of the boomerang is represented on Figure 5.4 and Figure 5.5. The key-schedule of AES-256 has an internal state of 256 bits in which the full key is first loaded, then updated every two rounds (the first half is used for even rounds, the second half for odd rounds). We let K 0 , K 1 , . . . denote these successive 256-bit round keys, where K 0 = K is the master key.

The main requirement for this attack are the differences 1f in the output of the active S-Boxes. With a difference 01 in the input, the output difference is 1f with probability 2 -6 . Thus, assuming that we can start from a pair that satisfies the path of Figure 5.4 at Round 1, it passes the top differential to the beginning of round 9 with probability 2 -6×5 = 2 -30 . Then we use the ladder switch technique, which means that we consider the S-Boxes on the bytes (0, 0), (0, 1), (0, 2), (0, 3) to belong to the top part of the boomerang and the other ones to belong to the bottom part of the boomerang, this way there is no differential to pay in either parts of the boomerang for this round. In the bottom part of the boomerang, there remains 3 S-Boxes to pass, with a probability 2 -18 . Thus the total probability is 2 -30×2-18×2 = 2 -96 .

We focus now on the key-recovery attack of [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF]. We start from 2 25.5 structures of plaintexts that take all possible values in the 9 bytes (0, 0), (1, 0), (2, 0), (3, 0), (1, 1), (1, 2), (1, 3), (2, 2), (3, 3) (that includes the first column, the second row and the first diagonal) and leave the other constant. For each structure:

1. the plaintexts are encrypted under K A and K B and the resulting ciphertexts stored in sets S A and S B ;

2. a (carefully chosen) difference ∆ C is XOR-ed to S A and the resulting ciphertexts are decrypted under K C , yielding a set S C of plaintexts;

3. the same ∆ C is XOR-ed to S B and the resulting ciphertexts are decrypted under K D , yielding a set S D of plaintexts;

4. S C and S D are then filtered for valid quartets: we find all the pairs P C ∈ S C , P D ∈ S D such that P C ⊕ P D is 0 in the 7 inactive bytes of the structure ((0, 1), (0, 2), (0, 3), (

5. two filtering steps for these quartets remain. We check whether P A,i,0 ⊕ P B,i,0 = P C,i,0 ⊕ P D,i,0 (= ∆K 0 i,0 ), i > 1 because ∆K 0 i,0 is equal for the key pairs (K A , K B ) and (K C , K D ); 6. another filtering allows to reduce the number of quartets by a factor 2 6 . There were 2 72 plaintexts in each structure, for a total of 2 97.5 plaintexts. There are 2 144 pairs per structure and a 9-byte condition is required to pass the first round. Thus, we can expect 2 144-8×9-96+25.5 ≃ 3 boomerang pairs among them. At the first filtering step, we filter on 7-byte conditions, in the second, there are 2-byte conditions, then a 6-bit condition. Thus there are 2 144-8×9-6+25.5 = 2 91.5 quartets at this point.

We can then begin to sieve some subkey bytes. It is shown in [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF] that by performing a few trials, one can reduce the number of quartets by a factor 2 19 and, for each of the remaining quartets, find 2 6 candidates for a total of 15 key bytes. Notably, 85 bits of K A are found. This makes a total of 2 78.5 choices for these key bytes. Since there are three boomerang quartets, one of these choices occurs three times (other collisions are unlikely).

Quantum Attack

The attack of [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF] runs in time 2 99.5 , makes the same number of queries to E and E -1 , and uses a memory of size 2 77.5 to recover the good guess for some

AK K 0 SB SR A 1 MC Round AK SB SR A 2 MC Round AK K 1 SB SR A 3 MC Round AK SB SR A 4 MC Round AK K 2 SB SR A 5 MC Round AK SB SR A 6 MC Round AK K 3 SB SR A 7 MC Round AK SB SR A 8 MC Round AK K 4 SB Figure 5
.4: Top part of the boomerang (see [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF], Fig. 7). We use purple for the difference 01, blue for the difference 1f , green for unknown differences and black for differences that collide by chance. The state after the SubBytes layer of round i is denoted A i . Figure 5.5: Bottom part of the boomerang (see [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF], Fig. 7). We use purple for the difference 01, blue for the difference 1f , green for unknown differences and black for differences that collide by chance.

AK

of the key bytes. It falls already below the complexity of Grover search for a single secret-key AES-256.

Generic Attack. In the related-key setting, and with an unbounded number of related keys, it is possible to reduce this to 2 256/3 = 2 85.3 queries and time using the same number of related keys (2 85.3 ). This is the quantum counterpart of the classical collision attack using 2 128 related keys, which would simply encrypt a small set of plaintexts P i under all the keys K, K ⊕ 1, . . . , K ⊕ 2 128 and find another key K ′ such that E K ′ (P i ) collides with one of the E K⊕j (P i ).

The quantum attack uses a smaller set of related keys and uses a Grover search in the second step; the complexities of both steps are balanced at roughly 2 85.3 . More precisely, the quantum search step needs two plaintexts (hence four encryptions per iteration). The first step performs 2 • 2 t queries and the second π 4 2 (256-t)/2 iterations, for a total of π 4 2 (256-t)/2+2 = 2 128-t/2+2.65 encryptions. This is minimized for t + 1 = 128 -t/2 + 2.65, i.e., t = 86.4 and the total is 2 87.4 encryptions.

Thus, we can choose to compare our attack complexity either with the generic bound of 2 87.4 , if we assume an unbounded number of classically related keys, or with a bound of 2 127 if we assume that only 4 related keys are available (in which case the best procedure is the same as above, but limited by the number of keys that we have). In the former case, the attack will not be valid. That is, the complexity will go above 2 87.4 . It will only be valid for the second definition.

Attack Procedure. We now detail the quantum version of the previous attack. We use the same differential path and the same key relations. Contrary to the attack against SAFER++, we will not combine the boomerang with a complete recovery of the key. Since only 85 bits of the master key are obtained, it may take actually too much time to continue a Grover search on the remaining key bits; we would then need a more involved procedure to get as many key bits as possible within the allowed time. Instead, we will define a function that produces deterministically a quartet and a 85-bit key guess. Roughly speaking, this function starts from a set of plaintext values (some substructure), performs a search of valid quartets on this space, sieves them to obtain a single (expected) quartet leading to 2 6 guesses of key bits, and chooses one of these guesses. It will output 2 78.5 key guesses of 85 bits. We expect one of these guesses to appear more often, due to the boomerang pairs. Thus we can use Ambainis' element distinctness algorithm [5]. However, we must recognize the only guess that appears three times, not two, so we must use the 3-distinctness algorithm which runs in generic complexity O N 3/4 for N elements (also optimal). The constant in the O is the same as in the 2-distinctness algorithm.

Algorithm 5.10 Related-key attack on AES-256 (as a classical combination of Repeat loops).

Input: access in superposition to encryptions and decryptions under

K A , K B , K C , K D 1: function F (i, b) ▷ i is a 72.5-bit value, b is a 6-bit value 2:
Depending on i, choose a set of 2 19 subsets of 2 Choose one of the 2 19 subsets for P A

5:

Create a superposition of quartets passing the filter of Step 4 (56 bits), as follows:

6:
Create the list of 2 At this point, we have a (single) quartet returning key guesses: choose one of them depending on b 19: Apply Ambainis' 3-distinctness algorithm to F 20: Measure and return the single 3-collision among the key outputs of F We compute the time complexity of Algorithm 5.10 as follows. It is dominated by the 2 3×78.5/4 ≃ 2 58.9 calls to the function F that we defined. Calling F requires two loops, one of which corresponds actually to a quantum collision search for quartets matching the 9-byte condition. Note that the computations required to find if there are key guesses, and to select one of them, are negligible with respect to the other factors. The complexity that we obtain is slightly below the classical attack complexity, but not significantly. It is also above the quantum bound of 2 87.4 encryptions. We also use the same number of superposition queries, and about 2 58.9 quantum random-access memory. Our main issue with this method is that the quantum time complexity of 3-distinctness is different than that of 2-distinctness, which is not the case classically. If the good key was the only one appearing twice, instead of three times, we could replace the term 2 58.9 by 2 52.3 and go more significantly below the classical complexity. Furthermore, this method (using an element distinctness routine on top of the search of quartets) seems intrinsically less adapted than the direct combination with exhaustive search that we used against SAFER++. Thus, it seems necessary to modify the path of the attack in order to find more key bytes with a valid quartet, and to finish faster the recovery of the key.

Application to 5-Round AES

In this section, we present the mixing boomerang distinguisher on 5-round AES of [START_REF] Orr Dunkelman | The Retracing Boomerang Attack[END_REF], which is the fastest distinguisher known to date on this cipher, and leads to the fastest key-recovery attack on 5-round AES. We show that this attack admits a quantum version. Although the classical attack is already practical, we believe that its quantum variant is still of interest, as it might occur as a building block of more involved quantum attacks on reduced-round variants of the AES.

The boomerang

We separate the cipher in tree parts: E 0 is the AK which constitute the round -1, the rounds 0,1 and the steps SB and SR of the round 2, E 1 is the MC of the round 2 and E 2 is the AK of round 2 and the rounds 3 et 4.

Top Boomerang: E 0 admits a classical truncated differential: if we have a difference only on the bytes (0, 0), (1, 1), (2, 2), (3,3) of the plaintext, then with probability 2 -8 we do not have a difference in the bytes (0, 3), (1, 2), (2, 1), (3, 0) at the end of E 0 . Back-wise, if we do not have a difference on the bytes (0, 3), (1, 2), (2, 1), (3, 0) at the end of E 0 , the state just after the MC of the round 0 does not have a difference on the byte (1, 0) which only depends on the bytes (0, 0), (1, 1), (2, 2), (3, 3) of the plaintext.

Middle: E 1 is linear, which implies that if a list of states is balanced after E 1 , the list of states before E 1 is balanced too.

Bottom Boomerang: M C -1 • E 2 is separable in four super S-box, which means that the bytes (0, 0), (1, 3), (2, 2), (3, 1) of the end state only depends of the bytes (0, 0), (1, 1), (2, 2), (3,3) of the entry state, and an analogue property holds for the other diagonals.

Friend Pairs

If (P 1 , P 2 ) is a pair of plaintexts we want to use in the boomerang, a "friend pair" (P ′ 1 , P ′ 2 ) is a pair that correctly follows the boomerang if and only if the pair (P 1 , P 2 ) does.

In our case, the byte (1, 0) after the M C of round 0 is determined by

X (1,0) = 01.S(P (0,0) ⊕ K (0,0) ) ⊕ 02.S(P (1,1) ⊕ K (1,1) ) ⊕ 03.S(P (2,2) ⊕ K (2,2) )
⊕ 01.S(P (3,3) ⊕ K (3,3) ) (5.12)

Then we can explicitly build friend pairs by keeping the same differential and the same values on bytes (0, 0), (1, 1), (2, 2), (3,3) than the original pair but changing the values on other bytes.

    
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 , 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1

     and      0 A A A A 0 A A A A 0 A A A A 0 , 1 A A A A 1 A A A A 1 A A A A 1     

Value-difference Correspondence on AES S-box

The AES S-box can be decomposed into two steps:

1. an inversion on GF (2 8 ) = GF (2)[x]/(x 8 + x 4 + x 3 + x + 1) and 0 is mapped to 0;

the affine operation f

(x) = x ⊕ (x ≪ 1) ⊕ (x ≪ 2) ⊕ (x ≪ 3) ⊕ (x ≪ 4) ⊕ 0x63.
Then with the identity for y ̸ = x ̸ = 0

y 1 x ⊕ 1 x⊕y = x y 2 ⊕
x y computing x with y and 1

x ⊕ 1 x⊕y is making a division, solving a linear system and multiplying by y which should be faster than an encryption. A quantum circuit for solving the AES S-Box differential equation was given in [START_REF] Bonnetain | Quantum Security Analysis of AES[END_REF], that we can reuse.

Classical Attack

The attack consists in using the sharing of byte X (1,0) (Equation 5.12) with term simplifications thanks to the use of friend pairs. The attack uses 2 16 computations and 2 15 encryptions.

Algorithm 5.11 Classical attack on 5-round AES (adapted from [START_REF] Orr Dunkelman | The Retracing Boomerang Attack[END_REF], Sec.

4.4)

Input: access to E and E -1 1: Generate 2 8 plaintext pairs (P 1 , P 2 ) such that they have a difference only on bytes (0, 0) and (1, 1). 2: For each pair, compute (P 3 , P 4 ) for the pair and 2 7 friend pairs 3: For each pair, keep only the friend pair such that there is no difference in byte (2, 2) or (3, 3) in (P 3 , P 4 ) and two other for verification. 4: For each pair, for each possible key byte K (0,0) compute the possible key byte K (1,1) that allow the boomerang to execute (equality on X (1,0) on the descending differential)(by correspondence between differential and value in the S-box) ▷ The equation is (02

) -1 .(S(P 1,(0,0) ⊕ K (0,0) ) ⊕ S(P 2,(0,0) ⊕ K (0,0) )) = S(P 1,(1,1) ⊕ K (1,1) ) ⊕ S(P 2,(1,1) ⊕ K (1,1)
) and is solved by correspondence between differential and value in the S-box 5: For each pair and key byte K (0,0) , compute the possible key byte K (3,3) with the equality on byte X (1,0) (if we had no difference in the byte (2, 2) on the friend pair, byte (2, 2) otherwise) ▷ The equation is S(P 1,(0,0) ⊕ K (0,0) ) ⊕ S(P 2,(0,0) ⊕ K (0,0) ) ⊕ 02.(S(P 1,(1,1) ⊕ K (1,1) ) ⊕ S(P 2,(1,1) ⊕ K (1,1) )) = S(P 1,(3,3) ⊕ K (3,3) ) ⊕ S(P 2,(3,3) ⊕ K (3,3) ) and is solved by correspondence between differential and value in the S-box 6: For each pair and key byte K (0,0) , compute the possible key byte K (2,2) (if we had no difference in the byte (2, 2) on the friend pair, byte (3, 3) otherwise) with the equality on byte X (1,0) on the initial pair. ▷ The equation is (03) -1 .(S(P 1,(0,0) ⊕K (0,0) )⊕S(P 2,(0,0) ⊕K (0,0) )⊕02.(S(P 1,(1,1) ⊕ Sample a pair (P 1 , P 2 ) such that they have a difference only on bytes (0, 0) and (1, 1). Sample a "friend" pair 5:

K (1,1) ) ⊕ S(P 2,(1,1) ⊕ K (1,1) )) ⊕ S(P 1,(3,3) ⊕ K (3,3) ) ⊕ S(P 2,(3,3) ⊕ K (3,3) ) = S(P 1,(2,2) ⊕ K (2,2) ) ⊕ S(P 2,(2,2) ⊕ K (2,2)
Verify that there is no difference in byte (2, 2) or (3,3) Sample a guess for K (0,0)

10:

Compute the possible key bytes K (1,1) that allow the boomerang to execute (by correspondence between differential and value in the S-box)

11:

Compute the possible key bytes (3,3) with the equality on byte (1, 0) (if we had no difference in the byte (2, 2) on the friend pair, byte (2, 2) otherwise)

12:

Compute the possible key bytes (2, 2) (if we had no difference in the byte (2, 2) on the friend pair, byte (3, 3) otherwise) with the equality on byte (1, 0) on the initial pair. The attack uses 2 8/2 × (2 7/2 + 2 8/2 ) = 2 8 computations.

Conclusion

We proposed an efficient quantum boomerang attack, as well as a variant for mixing boomerang attacks. We proposed several improvements for different cases, as reducing the quantum RAM need or making Q2 attacks work in Q1 under certain circumstances. In some cases, our attacks reach a quadratic speedup with respect to classical attacks. This shows that boomerang attacks are also performant cryptanalysis tools for the post-quantum world, that will be needed for correctly determining the best security margins.

Chapter 6

Safely Doubling your Block Ciphers for a Post-Quantum World

Introduction

The aim of this chapter is to provide new useful information in order to advance towards building a generic and provable way of easily extending secure classical constructions into new ones with doubled key and doubled state-size, while their post-quantum security remains comparable to the original classical one.

For this, we consider a new approach, based on the Encrypt-Mix-Encrypt paradigm with five block-cipher calls, that would allow to extend the internal state as well as the key size of any classically secure block-cipher.

The ECB-Mix-ECB or EME construction [START_REF] Halevi | A Parallelizable Enciphering Mode[END_REF] was proposed as a highly parallelisable mode of operation to extend the domain of a block-cipher to arbitrary lengths. The ECB layers above and below make it a suitable candidate for resisting quantum attacks, since most Simon-like attacks rely on some part of the input passing through only one block-cipher call or being XOR-ed directly to the state, and the ECB layers ensure that every part of the input passes through at least two block-cipher calls during both the encryption and decryption routines.

Our Contributions. The main contributions of our work are:

1. An original quantum superposition attack on the EME construction. It introduces a new family of attacks that exhibits a periodic property found in collisions;

2. A new construction based on Encrypt-Mix-Encrypt that resists this attack, by replacing the XOR-then-Encrypt mixing layer with a tweakable permutation call, that we will call QuEME, and that is claimed to offer n bits of security in both the classical and the quantum setting;

3. Four classical proofs for this construction: an IND-CPA proof of security up to the width of the underlying block-cipher using mirror theory; an IND-CCA proof up to the same bound using a conjectured tighter version of mirror theory, for which we find numerical evidence through an original approach using some simulations; and direct proofs of IND-CPA and IND-CPA security up to 2/3-rd the width of the block-cipher;

4. An original distinguisher that applies in particular to our construction that runs in time O(2 n ), which matches our security bound;

5. The first quantum security arguments for Encrypt-Mix-Encrypt constructions, to show that QuEME has, at least, n/6 bits of quantum security, which is in par for instance with the quantum security of LR4 [START_REF] Hosoyamada | 4-Round Luby-Rackoff Construction is a qPRP[END_REF], and show in particular that there is no collapse in the quantum security as can happen in LR3 for instance [START_REF] Kuwakado | Quantum distinguisher between the 3-round Feistel cipher and the random permutation[END_REF];

6. A concrete instantiation of the QuEME scheme with AES-128 for building a block-cipher with 256-bit state and key, with concrete (quantum) security claims; and some variants with fewer rounds than 10 for the building block that we also believe should be resistant.

It is based on a joint work with Ritam Bhaumik, André Chailloux and María Naya-Plasencia that is currently in a review process.

Contents

General Related Concepts

In this section, we introduce the Mirror theory and the H-coefficient technique.

Mirror Theory

We'll use some results from a line of research that focuses on finding tight approximations on the number of solutions to systems of bi-variate equations, which goes by the name Mirror Theory [START_REF] Patarin | Luby-Rackoff: 7 Rounds Are Enough for 2 n(1-ϵ) ) Security[END_REF]. Some of these results have been proved [START_REF] Dutta | Proof of Mirror Theory for ξ max = 2[END_REF][START_REF] Benoit Cogliati | The Indistinguishability of the XOR of $$k$$Permutations[END_REF][START_REF] Patarin | A Proof of Security in O(2n) for the Xor of Two Random Permutations[END_REF], while others are still conjectural [START_REF] Patarin | Security of balanced and unbalanced Feistel Schemes with Linear Non Equalities[END_REF], but generally accepted in the community.

We'll use the Pochhammer falling factorial power notation (a) b := a(a -1) . . . (a -b + 1).

Let N denote 2 n . Consider two sequences of n-bit variables Y 1 , . . . , Y q 1 and Z 1 , . . . , Z q 2 , with q 1 < N, q 2 < N . For some q < q 1 + q 2 suppose there are q bi-variate equations of the form

Y i ⊕ Z j = δ ij .
Then the Mirror Theorem states the following. Theorem 6.1 (Mirror Theorem (conjectural)). The number of solutions to the system described above such that Y i 's are all distinct and Z i 's are all distinct is at least

(N ) q 1 (N ) q 2 N q • (1 -ϵ),
where ϵ = O(q/N ).

The intuition behind this is that the numerator in the above expression is the total number of solutions satisfying just the distinctness constraint, and any randomly chosen solution has a probability of about 1/N q of satisfying all q bi-variate equations. However, the exact calculations needed to bound ϵ can be very complicated, and so far has only been completed for the special case with q 1 = q 2 = q where each variable appears in exactly one equation. In spite of this, the result has been claimed earlier without complete proofs, first by Patarin and then by others citing him, and is generally accepted in the community. In this chapter, we'll use the mirror theorem as a black box. Tighter Version. When many of the variables appear multiple times, the above bound can be made tighter. Consider the graph where a bi-variate equation involving Y i and Z j is represented by an edge between Y i and Z j . We assume none of the equations is redundant and the system of equations is consistent, so there are no cycles in this graph. Let C (1) , . . . , C (t) be the connected components, where t = q 1 + q 2 -q. For each j ∈ [1..t] let q (j)

1 (resp. q (j)
2 ) be the number of Y i 's (resp. Z i 's) that appear in C (j) . Finally, define the cumulative sums

Q (j) b = j-1 i=1 q (i) b
for each b ∈ {1, 2} and each j ∈ [1..t]. Then the Tight Mirror Theorem states the following. Theorem 6.2 (Tight Mirror Theorem (conjectural)). The number of solutions to this system such that Y i 's are all distinct and Z i 's are all distinct is at least

1 N q • t j=1 N -Q (j) 1 q (j) 1 N -Q (j) 2 q (j) 2 • (1 -ϵ), where ϵ = O(q/N ).
The intuition behind this is an extension of the intuition behind the Mirror Theorem. As before we randomly choose a valid solution for the {Y i } and the {Z i }, and it satisfies the equations with (roughly) a probability 1/N q . However, in this case, the key additional observation is that when choosing the valid solution, instead of ensuring distinctness among all {Y i } and all {Z i }, we just need to ensure that there are no collisions between components; since our system of equations is consistent, for any solution that satisfies the equations, within-component distinctness is automatically ensured. Thus when choosing the q (j) 1 Y i 's from the j-th component, we just choose them randomly from all the N -Q (j) 1 unsampled values, and similarly for the Z i 's. When q (j) 1 = q (j) 2 = 1 for each j, this reduces to the Mirror Theorem bound, and is strictly tighter in other cases, the gap increasing as the component sizes increase. We'll use this result as a black box too, to deal with cases where the component sizes are difficult to bound. In Section 6.6, we discuss some simulations we ran that suggest that this conjecture is not unreasonable.

H-Coefficient Technique

Suppose an adversary A is playing a distinguishing game against two oracles, one representing an ideal cryptographic object f , and the other representing an actual cryptographic construction C. We'll use the standard terminology where the oracle representing f is called the ideal oracle, denoted O 0 , and the oracle representing C is called the real oracle, denoted O 1 . Formally, the challenger samples a secret bit b at the beginning, and gives A the oracle O b ; A makes q queries {u i | i ∈ [1..q]} and receives the corresponding responses v i = O b (u i ); at the end of the game, A outputs a response bit b ′ , and wins if b ′ = b. The scenario where A interacts with the ideal (resp. real) oracle will interchangeable be called the ideal (resp. real) world.

To bound the advantage of A we use the Coefficient H Technique. Let τ be the transcript of a q-query game played by

A, i.e., τ = {(u i , v i ) | i ∈ [1.
.q]}. In addition, when A interacts with C, let τ * denote the internal transcript, denoted τ * = {w i | i ∈ [1..q]}; these are the intermediate variables computed when computing the responses to A's queries. Note that here u i , v i , w i are of unspecified length-the first two will depend on the oracle interface and the last on the complexity of the internal computations.

Extended Transcripts. Let S be a sampler that takes τ as input and simulates an internal transcript τ * when A interacts with f . We consider a modified game where at the end of the game τ * is released to A, which can be used to compute the final response bit; as this is extra information A is free not to use, this can only increase the advantage of A, so any upper bound we derive here must hold for the original game as well. (τ, τ * ) together will be called the extended transcript. (We'll simply call it a transcript when the context is unambiguous.) Good Transcripts. We'll define one or several bad events in the ideal world, based on the internal random coins of f and S. (Note that for A we only consider deterministic adversaries.) In the first step of the proof, we'll need to show that for some suitably small ϵ 1 the probability that at least one bad event occurs is upper-bounded by ϵ 1 . We'll call a transcript (τ, τ * ) good if it can be obtained in the ideal world without encountering any of the bad events.

Interpolation Probabilities. Given a transcript (τ, τ * ) and an oracle O b , we'll examine the interpolation probability of (τ, τ * ) in O b , denoted Pr b [(τ, τ * )]. This is the probability that the internal random coins of O b are compatible with (τ, τ * ), i.e., (τ, τ * ) is obtained as the game transcript as long as A queries u 1 first and for each i ∈ [2..q], on observing v 1 , . . . , v i-1 , next queries u i . For an adversary who does not make these queries, the probability of obtaining (τ, τ * ) is trivially 0, and we ignore such adversaries when calculating the interpolation probability.

Ratio of Good Probabilities. For the second step of the proof, we'll need to find a suitably small ϵ 2 such that for any arbitrary good transcript (τ, τ * ), the ratio of Pr 1 [(τ, τ * )] and Pr 0 [(τ, τ * )] is lower-bounded by 1 -ϵ 2 . This ratio is often simply referred to as the ratio of good probabilities, whereas the probability of at least one bad event occurring (applicable only for the ideal world) is referred to as the bad probability.

Once we have the stated bounds on both the bad probability and the ratio of good probabilities, the main result of the H-Coefficient Technique [START_REF] Patarin | The "Coefficients H" Technique[END_REF] tells us that the distinguishing advantage of A between O 0 and O 1 cannot exceed ϵ 1 + ϵ 2 . Below we give the formal statement of the theorem we will use.

Theorem 6.3 (H-Coefficient Technique). Suppose for an adversary

A playing a q-query distinguishing game between an ideal object f and a real construction C, we can define bad events and find ϵ 1 and ϵ 2 such that the probability of a bad event in a game against f is at most ϵ 1 , and the ratio of good probabilities while interacting with C and f for any fixed good transcript τ is at least 1 -ϵ 2 . Then we have

Adv C f (A) ≤ ϵ 1 + ϵ 2 .

Applying Simon's Algorithm to Functions Restricted on a Subset

In this section, we explain how we proceed to use Simon's algorithm (Section 2.6.4) to functions defined on any set and extend the Offline-Simon algorithm (Section 3.4.5.2) in this context. An important remark to Simon's algorithm is that we do not need g if we have access to cn superposition states |ϕ g ⟩ = x∈{0,1} n 1 2 n/2 |x⟩ |g(x)⟩. Moreover, we do not need the superposition to include all x in {0, 1} n , it is possible to restrict g to a subset A as long as the subset admits s as a period i.e., x ∈ A iff. x ⊕ s ∈ A, and A does not make an artificial period appear (by restricting on elements such that g(x ⊕ t) = g(x) for a certain t). This can be taken to an extreme where g = 0 but A has the information of the period. Theorem 6.4. Suppose that g : A ⊆ {0, 1} n → X has a period s, i.e. x⊕s ∈ A g(x ⊕ s) = g(x) for all x ∈ A and satisfies max t / ∈{0,s}

P x∈A (g(x ⊕ t) = g(x)) ≤ 1 2 120 where g(x) = g(x) if x ∈ A ⊥ otherwise
When we apply Simon's algorithm to cn copies of

|ϕ g ⟩ = x∈A 1 √ |A| |x⟩ |g(x)⟩,
it returns s with a probability at least 1 -

2 n • (3/4) cn . It is running in time cn 2 .
Then, because the properties of Simon's algorithm did not change because of the input restriction on g, we can apply the offline Simon's algorithm (Section 3.4.5.2) ideas.

This technique relies on the equality |ϕ f i ⊕g ⟩ = O f i |ϕ g ⟩ for preparing and recovering the databases |ϕ g ⟩. In our case, instead of f i 0 ⊕ g being periodic, we look for f i 0 ⊕ (g • f ′ i 0 ) being periodic with f ′ i as public permutations. We build the operator IN f ′ i : |x⟩ → |f ′ i (x)⟩ using ancila qubits and the following circuit:

O f ′ i O f ′-1 i |x⟩ |f ′ i (x)⟩ |0⟩ |0⟩ We can compute |ϕ f i 0 ⊕g•f ′ i 0 ⟩ = O f i • (IN f ′-1 i ⊗ I) |ϕ g ⟩. Theorem 6.5. Suppose that m = O(n), {f i } i∈{0,1} m a family of public functions from {0, 1} n → {0, 1} l , {f ′ i } i∈{0,1}
m a family of public permutations from {0, 1} n → {0, 1} n and g : A ⊆ {0, 1} n → {0, 1} l on which we only get some databases |ϕ g ⟩ and there is a unique i 0 such that

f i 0 ⊕ (g • f ′ i 0 ) has a period s and max (i,t) / ∈{0,1} m ×{0}∪{(i 0 ,s)} P x∈f ′-1 i (A) ((f i ⊕ (g • f ′ i ))(x ⊕ t) = (f i ⊕ (g • f ′ i ))(x)) ≤ 1 2 With O(n) databases |ϕ g ⟩ = x∈A 1 √ |A| |x⟩ |g(x)⟩,
we can recover i 0 with a probability in Θ(1). The running time is O(n 3 2 m/2 ).

Constructions Based on Encrypt-Mix-Encrypt Paradigm: First Attempt and Attack

Our aim is to build a 2n-bit-to-2n-bit block cipher using an n-bit block cipher, ideally with five or fewer calls to the blockcipher. Specifically, we studied the encrypt-mix-encrypt paradigm, where the plaintext blocks first pass through a (weak) encryption layer, then an invertible mixing layer with possibly non-linear components, and then another encryption layer. For the encryption layers we can begin with something very simple, like an ECB layer (with different keys).

Then our generic encryption function becomes

(L, R) → (E 3 (M (E 1 (L), E 2 (R)) ℓ ), E 4 (M (E 1 (L), E 2 (R)) r )), E 1 E 2 L R M E 3 E 4 S T L R S T E 1 E 2 L R F E 3 E 4 S T L R S T X E 1 E 2 L R f E 3 E 4 S T L R S T X Figure 6
.1: Left: The generic construction, with an invertible mixing layer M : { 0, 1 } 2n -→ { 0, 1 } 2n . Centre: With a specific mixing layer, with a compressing function

F : { 0, 1 } 2n -→ { 0, 1 } n . Right: A more specific instantiation of F , with a prf f : { 0, 1 } n -→ { 0, 1 } n .
where E 1 , . . . , E 4 are block ciphers with independent keys, and M is a 2n-bitto-2n-bit mixing layer with M (•, •) ℓ and M (•, •) r indicating the left and right halves of its output respectively (Figure 6.1, left).

For a specific mixing function, we take a 2n-bit-to-n-bit compressing function F and use M (x, y) := (x ⊕ F (x, y), y ⊕ F (x, y)) as our mixing layer (Figure 6.1, center). Since M needs to be invertible, we have the condition on F that (x, y) should be recoverable from (x ⊕ F (x, y), y ⊕ F (x, y)). One easy way to achieve this is to take an n-bit-to-n-bit function f and define

F (x, y) := f (x ⊕ y).
This was the first specific construction we considered (Figure 6.1, right). We assumed f is a qprf, and E 1 , . . . , E 4 are qprp's.

New Superposition Attack on the EME Construction

While analyzing the quantum security of this construction with F (x, y) := f (x ⊕ y), we discovered a new kind of superposition attack. The original idea of the attack is to build in the beginning a superposition of states that partially collide in the left output, and next, performing an exhaustive search of the key we are able to build a function that will be periodic in the subset of colliding states. This procedure is presented in Algorithm 6.1, and takes Õ(2 k/2 + 2 n/3 ) computations for recovering the key of E 2 . The same can be applied for recovering the keys of E 1 , E 3 or E 4 (as the inverse has the same shape). This is a new kind of superposition attack, that combines for the first time BHT, Grover and Simon (introduced in Chapter 2), and where BHT is used to restraint the function to the interesting outputs that generate a partial collision, and that will next verify a certain property. We believe this attack might apply to more constructions, and it should be considered in further studies analyzing the security of symmetric primitives with respect to superposition attacks.

Algorithm 6.1 Attack on construction

Input: superposition oracle access to E Output: the key k 2 of E 2 1: Choose two values L 0 and L 1 2: Repeat O(n) times (for confirmation)

3:

Search with BHT algorithm for claws on F b : R → S(L b , R) (using 2 n/3 turns)

▷ We get a uniform superposition |R 0 , R 1 ⟩ of all elements of the set

{(R, R ′ )/f (E 1 (L 0 ) ⊕ E 2 (R 0 )) ⊕ f (E 1 (L 1 ) ⊕ E 2 (R 1 )) = E 1 (L 0 ) ⊕ E 1 (L 1 )}. 4: EndRepeat ▷ We get O(n)
superpositions that we use as a database for the following Grover search 5: Grover search on k 2 with 2 k/2 turns using the following oracle :

6: ForEach superposition |R 0 , R 1 ⟩ 7: Add an external qubit |b⟩ = 1 √ 2 |0⟩ + 1 √ 2 |1⟩ 8: Apply (b, R 0 , R 1 ) → (b, E 2,k 2 (R b ), E 2,k 2 (R 1-b ))
▷ If we guessed right, we get a uniform superposition of the set

{(b, R 0 , R 1 )/f (E 1 (L b ) ⊕ R 0 ) ⊕ f (E 1 (L 1-b ) ⊕ R 1 ) = E 1 (L 0 ) ⊕ E 1 (L 1 )}. This set admits the period (1, E 1 (L 0 ) ⊕ E 1 (L 1 ), E 1 (L 0 ) ⊕ E 1 (L 1 )).
b, R, R ′ ) → R ′ ⊕ R.
▷ If we guessed right, the function on this set admits the period (

1, E 1 (L 0 ) ⊕ E 1 (L 1 ), E 1 (L 0 ) ⊕ E 1 (L 1 )
). Detecting a period on a wrong guess would mean a weakness of f .

11:

Uncompute to get back the superpositions |R 0 , R 1 ⟩ 12: EndGrover 13: Return k 2 Description of the Attack. Let S(L, R) be the function corresponding to this construction for inputs L, R (see rightmost construction of Figure 6.1) so

S(L, R) = E 3 (E 1 (L) ⊕ f (E 1 (L) ⊕ E 2 (R))) .
We start by fixing two distinct values L 0 and L 1 for left entries. Then, we consider the uniform superposition of claws between F 0 : R → S(L 0 , R) and 123

F 1 : R → S(L 1 , R) : 1 |{(R 0 , R 1 ), S(L 0 , R 0 ) = S(L 1 , R 1 )}| S(L 0 ,R 0 )=S(L 1 ,R 1 ) |R 0 , R 1 ⟩ .
(We can obtain this with BHT algorithm with complexity 2 n/3 .) We observe that

S(L 0 , R 0 ) = S(L 1 , R 1 ) is equivalent to f (E 1 (L 0 ) ⊕ E 2 (R 0 )) ⊕ f (E 1 (L 1 ) ⊕ E 2 (R 1 )) = E 1 (L 0 ) ⊕ E 1 (L 1 ).
We add an external qubit |b⟩ = 1

√ 2 |0⟩ + 1 √ 2 |1⟩
to the state and apply the controlled exchange (b, R 0 , R 1 ) → (b, R b , R 1-b ). The state becomes the uniform superposition of elements from

{(b, R 0 , R 1 )/f (E 1 (L b ) ⊕ E 2 (R 0 ) ⊕ f (E 1 (L 1-b ) ⊕ E 2 (R 1 ) = E 1 (L 0 ) ⊕ E 1 (L 1 )}.
This state is called |Φ⟩ for the rest of the attack. Now, if we guess the key of E 2 right, we can apply O sup E 2 : |x⟩ → E 2 (|x⟩) on the 2 rightmost register of |Φ⟩ 1 and get the superposition

1 2|{(R 0 , R 1 ), S(L 0 , R 0 ) = S(L 1 , R 1 )}| (b,R 0 ,R 1 )∈A |b, R 0 , R 1 ⟩ where A = {(b, R 0 , R 1 )/f (E 1 (L b )⊕R 0 )⊕f (E 1 (L 1-b )⊕R 1 ) = E 1 (L 0 )⊕E 1 (L 1 )}.
This set admits the period (1,

E 1 (L 0 ) ⊕ E 1 (L 1 ), E 1 (L 0 ) ⊕ E 1 (L 1 )), i.e. if (b, R 0 , R 1 ) is in the set then (b⊕1, R 0 ⊕E 1 (L 0 )⊕E 1 (L 1 ), R 1 ⊕E 1 (L 0 )⊕E 1 (L 1 )) is also in the set.
Then, we apply Simon's algorithm on (b, R 0 , R 1 ) → R 0 ⊕ R 1 to recover the existence of this period and uncompute the last steps to recover the states |Φ⟩.

This part is the execution of Theorem 6.5 with g = 0,

A = {(b, R 0 , R 1 )|S(L 0 , R 0 ) = S(L 1 , R 1 )}, f ′ i : (b, R 0 , R 1 ) → (b, E 2,k 2 (R b ), E 2,k 2 (R 1-b )), f i : (b, R, R ′ ) → R ′ ⊕ R and s = (1, E 1 (L 0 ) ⊕ E 1 (L 1 ), E 1 (L 0 ) ⊕ E 1 (L 1 )).
The attack has complexity Õ(2 k/2 + 2 n/3 ).

Similar Mixing Layers.

While the previous description of our attack targets the specific mixing layer from figure 6.1-right, our attack can be adapted and impact also the other mixing layers M (x, y) the following way. We describe the mixing layer the following way:

M (x, y) = Π 2 (f (Π 1 (x, y)), x, y)
1 This is possible since from the key of E2, we can compute E2 and E -1 2 efficiently. We

then compute |x⟩ |0⟩ O E 2 ---→ |x⟩ |E2(x)⟩ Swap ---→ |E2(x)⟩ |x⟩ O E -1 2 ----→ |E2(x)⟩ |0⟩.
124

E 1 E 2 L R E E 3 E 4 S T L R S T X Figure 6.2:
The new construction QuEME; the E in the middle layer takes its key as an input from the right.

By linearity, we write Π

1 (x, y) = Π 1,L (x) ⊕ Π 1,R (y) and Π 2 (f, x, y) = f ⊕ Π 2,L (x) ⊕ Π 2,R (y) (even if it means rewriting the function f ). The collision equation S(L 0 , R 0 ) = S(L 1 , R 1 ) is then equivalent to f (Π 1,L • E 1 (L 0 ) ⊕ Π 1,R • E 2 (R 0 )) ⊕ f (Π 1,L • E 1 (L 1 ) ⊕ Π 1,R • E 2 (R 1 )) = Π 2,L • E 1 (L 0 ) ⊕ Π 2,L • E 1 (L 1 ) ⊕ Π 2,R • E 2 (R 0 ) ⊕ Π 2,R • E 2 (R 1 ).
With a good guess and the controlled exchange, the equation of collisions becomes

f (Π 1,L • E 1 (L b ) ⊕ Π 1,R (R 0 )) ⊕ f (Π 1,L • E 1 (L 1-b ) ⊕ Π 1,R (R 1 )) = Π 2,L • E 1 (L 0 ) ⊕ Π 2,L • E 1 (L 1 ) ⊕ Π 2,R (R 0 ) ⊕ Π 2,R (R 1 ).
Then, we discuss what happens whether Π 1,R is reversible or not.

First case: Π 1,R is not reversible. Then there exists t ̸ = 0 such that Π 1,R (t) = 0. and the set of collisions admits the period s = (0, t, t).

Second case: Π 1,R is reversible. Then we note t = Π -1 1,R • Π 1,L (E 1 (L 0 ) ⊕ E 1 (L 1 )
) and the set of collisions admits the period s = (1, t, t).

Overall, the attack works the same way but the recovered period will be different.

New Construction and Classical Security Proofs

In this chapter, we propose the new construction QuEME shown in shown in Fig. 6.2. We define

QuEME E : { 0, 1 } 2n -→ { 0, 1 } 2n as QuEME E (L, R) := (S, T ),
where

L = E(K 1 , L), R = E(K 2 , R), X = L ⊕ R, S = E(X, L), T = X ⊕ S, S = E(K 3 , S), T = E(K 4 , T ),
for a block-cipher E(• , •) and four keys K 1 , . . . , K 4 . For each i ∈ [1..4] we'll use the notation write E i := E(K i , •).

Proof of Classical Security

First we analyse the information-theoretic security of QuEME against a classical adversary. To move to the information-theoretic setting, we replace andE(•, •) with a tweakable random permutation π. We call this modified construction QuEME π .

E 1 , E 2 , E 3 , E 4 with independent random permutations π 1 , π 2 , π 3 , π 4 ,
Since the inner call to E uses a dynamic key derived from the internal state, we consider the possibility that A tries to guess the internal key with offline queries to E. However, we note that for a good block-cipher, the only way this can provide A additional information about the game is if they can guess a key-message pair or a key-ciphertext pair. Since there are O(q) internal input and output pairs for E, this gives a O(qq ′ /2 2n ) probability of guessing one such pair correctly with q ′ offline queries to E. In addition, let α E (q, q ′ ) be an upper-bound on the advantage of an adversary who has learnt q ′ key-plaintext-ciphertext triples for E and is trying to distinguish q other key-plaintext-ciphertext triples from random. In our security bounds, whenever we switch from QuEME π to QuEME E , we add the terms O(qq ′ /2 2n ) and α E (q, q ′ ) to A's advantage as the cost of replacing the inner call to E with π, which should be a O(qq ′ /2 2n ) for a good block cipher.

Settings of the Game. For convenience, we first make a few standard stipulations and modifications to the sprp game. We do not allow A to make any redundant queries, which can either be repetitions of earlier queries or the feeding back in the opposite direction of an earlier response. Since such queries can give A no extra information, this constraint cannot decrease the advantage of A.

As a final modification, we consider the extended transcript game defined in Section 6.2.2, with τ

= {(L i , R i , S i , T i ) | i ∈ [1..q]} and τ * = {( L i , R i , X i , S i , T i ) | i ∈ [1.
.q]}. Defining the sampler S will be a critical part of the proof.

Transcript Graphs. As preparation for sampling the internal transcript τ * , we first define two undirected bipartite graphs G and H on the external bad 2 : For a path P of even length ≥ 4 in H, i∈P X i = 0; bad 3 : There is a cycle in H.

In bad 1 , bad 2 and bad 3 we assume bad 0 has not happened.

Bad Probabilities.

We recall that the bad events (and hence bad probabilities) are only defined in the ideal world. bad 0 involves a random collision over 2n bits, with a choice of the two indices i and i ′ . Thus, Pr

0 [bad 0 ] ≤ q 2 N 2 ≤ q 2 N 2 . ( 6.1)
We now bound the probability of bad 1 . Let's fix a pair of indices i, i ′ ̸ = i. Because we are in the ideal case,

S i , S i ′ , T i , T i ′ , X i , X i ′ are uniformly random strings in [N ]. Therefore, Pr 0 [bad 1 ] ≤ q(q -1) • 2 N 2 ≤ 2q 2 N 2 . ( 6.2)
For a path P of even length 2m ≥ 4, we can argue similarly that the 2m values X i , i ∈ P are all mutually independent, and sum to 0 with a probability of 1/N . The event involves 2m -1 further collisions (for forming the path P ), choice of 2m indices, and a choice whether the path begins from an S-node or a T -node. Therefore,

Pr 0 [bad 2 ] ≤ m≥2 q(q -1) . . . (q -2m + 1) • 2 N 2m ≤ m≥2 2q 2m N 2m = 2q 2 N 2 m≥2 q 2 N 2 m-1 ≤ 2q 2 N 2 m≥2 1 2 m-1 ≤ 2q 2 N 2 . (6.3)
Finally, a cycle of length 2m (with m ≥ 2, since a cycle of length 2 would imply bad 0 ) will need 2m collisions for the cycle and give a choice of 2m indices and a choice of whether the first node is an S or a T ; since the choice of this 'first node' is arbitrary, we divide the total count by m. This gives Pr

0 [bad 3 ] ≤ m≥2 q(q -1) . . . (q -2m + 1) • 2 N 2m • m ≤ m≥2 2q 2m mN 2m = q 2 N 2 m≥2 q 2 N 2 m-1 ≤ q 2 N 2 m≥2 1 2 m-1 ≤ q 2 N 2 . ( 6.4)
From equations 6.1-6.4 it follows that the probability that at least one of the bad events occurs is upper-bounded by

ϵ 1 = 6q 2 N 2 .
(6.5)

Ratio of Good Probabilities.

Next we turn to the second step of using the Coefficient H Technique: lowerbounding the ratio of good probabilities. Suppose (τ, τ * ) is a good transcript. Recall that q 1 , q 2 , q 3 , q 4 are the number of distinct values respectively of L i , R i , S i , T i in τ . Further suppose that in τ * , there are r distinct values of X i , with the number of queries they appear in being t 1 , . . . , t r , where t 1 + . . . + t r = q.

Real World. In the real world, for each j ∈ [1..4], the probability that π j is compatible with (τ, τ * ) is 1/(N ) q j , and the probability that π is compatible with (τ,

τ * ) is 1/[(N ) t 1 . . . (N ) tr ]. Thus, Pr 1 [(τ, τ * )] = 1 (N ) q 1 . . . (N ) q 4 (N ) t 1 . . . (N ) tr . ( 6.6)
Ideal World. In the ideal world, the probability that f is compatible with τ is 1/(N 2 ) q . The probabilities that π * 1 and π * 2 are compatible with τ * are respectively 1/(N ) q 1 and 1/(N ) q 2 . For the second step, the probability that the ( S 1 , T 1 , . . . , S q , T q ) comes from Γ is 1/|Γ|. Thus,

Pr 0 [(τ, τ * )] = 1 (N 2 ) q (N ) q 1 (N ) q 2 |Γ| . ( 6.7)
equations 6.6 and 6.7 give the ratio

ρ := Pr 1 [(τ, τ * )] Pr 0 [(τ, τ * )] = (N 2 ) q |Γ| (N ) q 3 (N ) q 4 (N ) t 1 . . . (N ) tr . ( 6.8)
Since (N ) t j < N t j , and t 1 + . . . + t r = q, we have (N ) t 1 . . . (N ) tr < N q . Plugging this in equation. 6.8 gives

ρ ≥ N q |Γ| (N ) q 3 (N ) q 4 . ( 6.9)
Using Mirror Theory as a Black-box. We recall that in the ideal world, having chosen all L i and R i , we need to choose S i and T i such that, for each i, j ∈ [1..q]:

• S i = S j ⇐⇒ S i = S j ; • T i = T j ⇐⇒ T i = T j ;
and for each i ∈ [1..q], S i ⊕ T i = X i . Then we can formulate our problem as one of Mirror Theory as follows: we need to find S 1 , . . . , S q 3 , all distinct, and T 1 , . . . , T q 4 , all distinct, satisfying q bi-variate equations of the form

S i + T j = δ ij .
Since this is a good transcript, we know that none of the bad events happened, making this system of equations cycle-free and consistent. Then from the Mirror Theorem (Theorem 6.1) we see that

|Γ| ≥ (N ) q 3 (N ) q 4 N q • (1 -ϵ 2 ), (6.10)
where ϵ 2 = O(q/N ). Putting the bound of equation 6.10 in equation 6.9 gives the desired bound

ρ ≥ 1 -ϵ 2 , ( 6.11)
thus completing the proof.

IND-CCA Security Proof of n-bit Security using Mirror Theory

In this subsection we prove Theorem 6.6. For simplicity we assume there are no cycle queries (no cycle in G or H); the case when there are cycle queries can be similarly handled. Let L 1 , . . . , L q 1 , R 1 , . . . , R q 2 , S 1 , . . . , S q 3 and T 1 , . . . , T q 4 be the distinct values we need to choose for each permutation (

L i correspond to E 1 (L i ), R i to E 2 (R i ), S to E -1 3 (S i ) and T i to E -1 4 (T i ))
. Let H τ be the graph analogous to G τ , but for inputs, i.e., two vertices i and i ′ are adjacent in

H τ if L i = L i ′ or R i = R i ′ ; the edge (i, i ′ )
is blue for the first condition and red for the second. We change the sampling mechanism in the ideal world as follows:

1. S first samples a X 1 , . . . , X q such that on any (non-empty) path P of even length in G or H,

i∈P X i ̸ = 0.
Let Λ denote the set of all (X 1 , . . . , X q ) satisfying this condition.

2. Next, S samples L 1 , . . . , L q 1 , all distinct, R 1 , . . . , R q 2 , all distinct, subject to q bi-variate equations of the form

L i ⊕ R j = δ G ij .
Let Γ G denote the set of all solutions to this system.

3. Finally S samples S 1 , . . ., S q 3 , all distinct, and T 1 , . . . , T q 4 , all distinct, subject to q bi-variate equations of the form S i ⊕ T j = δ H ij . Let Γ H denote the set of all solutions to this system. Since we have assumed there are no cycles in G and H, we have q 1 + q 2 -α = q 3 + q 4 -β = q.

Then the Tight Mirror Theorem (Theorem 6.2) tells us that

|Γ G | ≥ α j=1 N -Q (j) 1 q (j) 1 N -Q (j) 2 q (j) 2 • 1 N q • (1 -ϵ 2 ), (6.12
)

|Γ H | ≥ β j=1 N -Q (j) 3 q (j) 3 N -Q (j) 4 q (j) 4 • 1 N q • (1 -ϵ 3 ), (6.13)
where ϵ 1 and ϵ 2 are both O(q/N ). Similarly, we can show that

|Λ| ≥ N q   α j=1 (N ) q (j) 1 (N ) q (j) 2 N q (j) 1 +q (j) 2     β j=1 (N ) q (j) 3 (N ) q (j) 4 N q (j) 3 +q (j) 4   (1 -ϵ 3 ). ( 6.14)
We observe that

N -Q (j) 1 q (j) 1 (N ) q (j) 1 = q (j) 1 -1 k=0 N -Q (j) 1 (N -k) ≥ q (j) 1 -1 k=0 N -Q (j) 1 -k N = N -Q (j) 1 q (j) 1 N q (j) 1 , (6.15)
so that

α j=1 N -Q (j) 1 q (j) 1 (N ) q (j) 1 ≥ (N ) q 1 N q 1 . ( 6.16)
We can show a similar inequality for q 2 , q 3 , and q 4 . Thus,

|Γ G ||Γ H ||Λ| (N ) q 1 (N ) q 2 (N ) q 3 (N ) q 4 ≥ 1 N q (1 -ϵ 2 -ϵ 3 -ϵ 4 ). (6.17) Since Pr 0 [(τ, τ * )] = 1 (N 2 ) q |Γ G ||Γ H ||Λ| , ( 6.18)
we have

ρ ≥ 1 -ϵ 2 -ϵ 3 -ϵ 4 , (6.19)
which completes the proof.

2. it samples S i j from {0, 1} n \ B j and extends it to all of C j . 3Once S has completed Step 3 for C ℓ , the sampling of τ * is complete. We also include the additional bad event defined as follows:

bad 4 : There are is a path of length ≥ 3 in G τ .

This happens with O(q 3 /N 2 ) probability. When bad 5 has not happened, G τ has no component of size ≥ 2. Thus, for each j ∈ [2..ℓ], |B j | ≤ 2(j -1).

Good probability in ideal world. For each j ∈ [1..ℓ], the probability that the random sampling in the modified second step of S correctly outputs the

S i j is 1/(N -|B j |).
(We take B 1 to be the empty set.) Thus, Pr

0 [(τ, τ * )] = 1 (N 2 ) q (N ) q 1 (N ) q 2 N (N -|B 2 |) . . . (N -|B ℓ |)
. (6.20) equations 6.6 and 6.20 give the ratio

ρ = (N 2 ) q N (N -|B 2 |) . . . (N -|B ℓ |) (N ) q 3 (N ) q 4 (N ) t 1 . . . (N ) tr . ( 6.21)
Like in the derivation of equation 6.9, we plug in (N ) t 1 . . . (N ) tr < N q in equation 6.21 to get

ρ ≥ N q N (N -|B 2 |) . . . (N -|B ℓ |) (N ) q 3 (N ) q 4 . ( 6.22)
Since q ≥ max(q 3 , q 4 ), we have ℓ ≤ min(q 3 , q 4 ). Thus, we can rewrite equation 6.22 as

ρ ≥ N q N (N -2) . . . (N -(2ℓ -2)) (N ) q 3 (N ) q 4 ≥ N q-ℓ (N -ℓ) q 3 -ℓ (N -ℓ) q 4 -ℓ • N ℓ N (N -2) . . . (N -(2ℓ -2)) (N ) ℓ (N ) ℓ ≥ ℓ j=1 N (N -2(j -1)) (N -(j -1)) 2 = ℓ j=1 N 2 -2(N )(j -1) N 2 -2(N )(j -1) + (j -1) 2 = ℓ j=1 1 - (j -1) 2 N 2 -2(N )(j -1) + (j -1) 2 ≥ ℓ j=1 1 - 2(j -1) 2 N 2 ≥ 1 - ℓ j=1 2(j -1) 2 N 2 ≥ 1 - ℓ 3 N 2 , ( 6.23)
which completes the proof with ϵ 2 = ℓ 3 /N 2 .

IND-CCA Security Proof of (2n/3)-bit Security

In this subsection we instead prove the following weaker result without relying on any conjectured bound. Theorem 6.9. For any classical adversary A playing a q-query IND-CCA game against QuEME π , we have

Adv QuEME π sprp (A) = O q 3 2 2n .
For any classical adversary A ′ playing a q-query IND-CCA game against QuEME E with q ′ offline queries to E, we have

Adv QuEME E sprp (A ′ ) ≤ O q 3 2 2n + O qq ′ 2 2n + α E (q, q ′ ).
When decryption queries are allowed, we partition the queries into two sets: let I * contain the queries where both output blocks are fresh, and I contain the queries where one of the output blocks collides with an earlier block at the same position.

Sampler of Internal Transcripts.

Here we'll define the sampler S which takes

τ = {(L i , R i ), (S i , T i ) | i ∈ [1.
.q]} with the direction of each query (encryption or decryption) as input and samples a τ

* = {( L i , R i , S i , T i ) | i ∈ [1.
.q]}. The sampling proceeds as follows:

1. S initialises four tables D L , D R , D S , and D T as empty.

2. For an encryption query i, S first checks the tables D L and D R to see if L i or R i has already been sampled; whichever is not found in the table is freshly sampled from the set of unsampled values. X i is set to be

L i ⊕ R i .
a) If i ∈ I, one of S i and T i is already sampled, so the other one is set as the sum of the sampled one and X i .

b) If i ∈ I * , both S i and T i are fresh, so S i is sampled from outside D S , such that

T i = S i ⊕ X i is also outside D T .
3. For a decryption query i, S first checks the tables D S and D T to see if S i or T i has already been sampled; whichever is not found in the table is freshly sampled from the set of unsampled values. X i is set to be S i ⊕ T i . a) If i ∈ I, one of L i and R i is already sampled, so the other one is set as the sum of the sampled one and X i .

b) If i ∈ I, both L i and R i are fresh, so L i is sampled from outside

D L , such that R i = L i ⊕ X i is also outside D R .
Bad Events. We define the following bad events on the random coins of f and S: bad 0 : For some i, i ′ , i ′′ ∈ [1..q] with i > i ′ and i > i ′′ , S i = S i ′ and T i = T i ′′ ; bad 1 : In an encryption query i ∈ I, a previously unsampled S i or T i is set to be equal to a previously sampled value at the same position; bad 2 : In a decryption query i ∈ I, a previously unsampled L i or R i is set to be equal to a previously sampled value at the same position.

In bad 1 and bad 2 we assume bad 0 has not happened.

Bad Probabilities. For bad 0 the two collisions have a joint probability of 1/N 2 , with choice of the three indices i, i ′ , i ′′ . Thus,

Pr[bad 0 ] ≤ q 3 N 2 . ( 6.24)
For bad 1 we need one collision with a previous i ′ for i ∈ I, and one collision with a previously sampled value at some i ′′ . Again they have a joint probability of 1/N 2 , with choice of the three indices i, i ′ , i ′′ . Thus,

Pr[bad 1 ] ≤ q 3 N 2 . ( 6.25)
Similarly we can show that

Pr[bad 2 ] ≤ q 3 N 2 . (6.26)
Ratio of Good Probabilities. As before, in the real world, we have Pr

1 [(τ, τ * )] = 1 (N ) q 1 . . . (N ) q 4 (N ) t 1 . . . (N ) tr . ( 6.27)
In the ideal world, we have a term 1/N 2q that comes from the sampling of the outputs in the online phase. As before, we use one N q to cancel out (N ) t 1 . . . (N ) tr . If the j-th unique L or R first appears in an encryption query, it will contribute a term 1/(N -j -1) to the probability, and the resulting (N -j -1) in the numerator will cancel out the same term in (N ) q 1 or (N ) q 2 . Similarly, if the j-th unique S or T first appears in an encryption query, it will contribute a term 1/(N -j + 1) to the probability, and the resulting (N -j + 1) in the numerator will cancel out the same term in (N ) q 3 or (N ) q 4 . For each encryption query in I, no sampling is done for S or T , and for each decryption query in I, no sampling is done for L or R, so these do not contribute anything to the probability.

Finally, consider an encryption query in I * that contains the j-th unique S and j ′ -th unique T . Thus, when sampling S we need to avoid j + j ′ -2 values, so this contributes a term 1/(N -j -j ′ + 2) to the probability. We combine this (N -j -j ′ + 2) in the numerator with one N -term in the numerator and the terms (N -j + 1) and (N -j ′ + 1) in the denominator (from (N ) q 3 or (N ) q 4 respectively), to get

N (N -j -j ′ + 2) (N -j + 1)(N -j ′ + 1) = 1 - (j -1)(j ′ -1) (N -j + 1)(N -j ′ + 1) ≥ 1 - 2jj ′ N 2 , (6.28)
where we use the inequalities j, j ′ ≤ N (1 -1/ √ 2). This uses up N |I * | , and the remaining N |I| is used to cancel out the remaining terms in the denominator.

Thus we have

ρ ≥ j,j ′ 1 - 2jj ′ N 2 ≥ j∈[1..q] 1 - 2j 2 N 2 ≥ 1 - q 3 N 2 , ( 6.29)
since we can replace the smaller of j and j ′ with the bigger one without breaking the inequality. This completes the proof with ϵ 2 = q 3 /N 2 .

Simulation of the Mirror Theory

In the proof of Theorem 6.6 we use a conjectured result from a line of research that focuses on finding tight approximations on the number of solutions to systems of bi-variate equations, which goes by the name Mirror Theory [START_REF] Patarin | Luby-Rackoff: 7 Rounds Are Enough for 2 n(1-ϵ) ) Security[END_REF] (see Section 6.2.1). The particular conjecture we use can be summarised as follows: Consider two sequences of n-bit variables Y 1 , . . . , Y q 1 and Z 1 , . . . , Z q 2 , with q 1 < N, q 2 < N , where N denote 2 n . For some q < q 1 + q 2 suppose there are q bi-variate equations of the form

Y i ⊕ Z j = δ ij .
Consider the graph where this equation is represented by an edge between Y i and Z j . We assume none of the equations is redundant and the system of equations is consistent, so there are no cycles in this graph. Let C (1) , . . . , C (t) be the connected components, where t = q 1 + q 2 -q. For each j ∈ [1..t] let q (j) 1 (resp. q (j)

2 ) be the number of Y i 's (resp. Z i 's) that appear in C (j) . Finally, define the cumulative sums

Q (j) b = j-1 i=1 q (i) b
for each b ∈ {1, 2} and each j ∈ [1..t]. Then the conjectured Tight Mirror Theorem (Theorem 6.2) claims that the number of solutions to this system such that Y i 's are all distinct and Z i 's are all distinct is at least

1 N q • t j=1 N -Q (j) 1 q (j) 1 N -Q (j) 2 q (j) 2 • (1 -ϵ),
where ϵ = O(q/N ).

In order to verify this conjecture, we have implemented a simulation that allow us to predict the number of possible internal transcripts. In this section, we describe these simulations that are, to the best of our knowledge, an innovative approach that hasn't been used before in this context.

First

Step: Getting the Sets of Connected Components. The first step for comparing experiments to the conjecture is computing the set of the connected components of two or more variables. We recall that there is an edge between the variables X i and Y j if and only if there is the equation X i ⊕ Y j = δ i,j . First we make a list of equations sorted by index i and one sorted by index j for retrieving the edges quickly, then we apply a classic Breadth-First Traversal of the graph. The procedure to get it is described in Algorithm 6.2 below: Algorithm 6.2 Retrieving the sets on connected components Input: List of equations of the form X i ⊕ Y j = δ i,j Output: The list of connected components 1: Sort the equations X i ⊕ Y j = δ i,j by i the result is named L X ▷ There needs to have a place to mark the different i. 2: Sort the equations X i ⊕ Y j = δ i,j by j the result is named L Y ▷ There needs to have a place to mark the different j. Start a pile with the element (X, i, 0)

5:

Start a list for recording the elements of the current connected component with the root element (X, i, 0)

6:
while the pile is not empty do 7:

Pop the first element (Z, l, ∆)

8: if l is not marked in the list L Z then 9:
for all X i ⊕ Y j = δ i,j in L Z with i = l if X = Z and j = l otherwise do 10:

Add (Y, j, ∆⊕δ i,j ) to the pile and to the component if X = Z and (X, i, ∆ ⊕ δ i,j ) otherwise Register the list if it contains more than one element ▷ This connected component has either no elements or is a isolated point.

13: Return the lists of connected components Naive Approach. The most natural way of doing once obtained the connected components is to generate the solutions. This can be done by initializing two sets of remaining places to {0, 1} n (S X for the variables X and S Y for the variables Y ). We take the largest component, find a place α for its root and for every points (Z, l, ∆) of this component ruling out α ⊕ ∆ from the the corresponding variable (S X if Z = X and S Y otherwise). We take the second largest, find a place for the second root β such that for every point (Z, l, ∆) of this second component β ⊕ ∆ is in the set of remaining places of corresponding variable and once a β is found we rule them out. We continue for the remaining components until there is either no more component (making a solution) or there is no viable place for a root (the earlier choices did not lead to a solution). While this method is not practical as it generates every solution which is double exponential on the size of the input, it is the only one (to our knowledge) to give the exact number of solutions.

Approximation. In this paragraph, we describe a method that allows to propose an approximation of the number of solutions of the system given by the equations X i ⊕ Y j = δ i,j . For a given set of equations we want to obtain the connected components (C i ) as described before and m their number and their size. We note ∆ i,j the set of places of the roots of the connected components such that the values taken by C i and C j collide. Then by the formula of the cardinal of a union, we get

2 nm -|solutions| = m k=1 (-1) k-1 {i 1 ,j 1 }>...>{i k ,j k } |∆ i 1 ,j 1 ∩ ... ∩ ∆ i k ,j k |
where > is an order.

A first observation is that for all {i 1 , j

1 } ̸ = {i 2 , j 2 }, |∆ i 1 ,j 1 ∩ ∆ i 2 ,j 2 | × 2 nm = |∆ i 1 ,j 1 | × |∆ i 2 ,j 2 |
as the difference between the value of the roots of C i 1 and C j 1 and between C i 2 and C j 2 are independent even for cases {i 1 , j 1 } ∩ {i 2 , j 2 } ̸ = ∅. For further use, for a set {i 1 , j 1 } > ... > {i k , j k }, we define the graph G {i 1 ,j 1 }>...>{i k ,j k } with vertices 1, ..., m and there is an edge between vertices a and b if and only if there exist l such that {i l , j l } = {a, b}. For a graph G on vertices 1, ..., m, we define

S G = 1 2 nm G ′∼ =G i,j∈G ′ ∆ i,j ,
where ∼ = denotes graph isomorphism. We let C G be the number of connected components of G and P G the number of non-isolated points.

This first observation extents to the computation of any S G where G has no cycle and to unions of not connected sub-graphs. S G can be bounded by ( i |C i | 2 ) P G /2 n(m-C G ) . This means that this method of approximation is suited for cases where the value i |C i | 2 is controlled. For random systems,

i |C i | 2 = O (q)
. Then a first approximation can be made by taking |solutions|

2 nm = i,j 1 - |∆ i,j | 2 n + O q 3 2 2n .
More advanced approximations can be made by considering cycles of successively bigger sizes. (For example, by considering the cycles of size 3, we get a better approximation with an error in O(q 4 /2 3n ).) The figure 6.3 shows the different simulations of the different approximations. It took 10 hours on an Intel i5-6500U CPU to compute. The approximations tend to get more solutions than the conjecture, but remaining in the expected error.

Conclusion.

Overall our simulations confirm that the tighter version of the mirror theory holds for small bit sizes (n ≤ 5 for the exact approach Figure 6.3a, n ≤ 8 for the better approximation Figure 6.3b, and n ≤ 11 for the first approximation Figure 6.3c). While it becomes infeasible to run the simulations for usable values of n, since we did not use any special properties of small n-values, our results seem to suggest that it should also hold for larger values of n, making our conjecture a reasonable one.

An O(2 n )-Distinguisher on our Scheme

We have black box access to a function f st. f $ ← -P 2n or f ← QuEME π , and we want to distinguish in which case we are. We present an distinguisher that performs only forward queries to f . Assume on query (x 1 ||x 2 ) we get output (y 1 ||y 2 ). In the first case, (y 1 ||y 2 ) is a uniformly random string that has not been outputted before for any (x 1 ||x 2 ) that has not been queried before. In the second case, there exists permutations π 1 , π 2 , π 3 , π 4 such

π 1 (x 1 ) ⊕ π 2 (x 2 ) = π -1
3 (y 1 ) ⊕ π -1 4 (y 2 ). (6.30)

Our proof will use linear algebra techniques. Let N = 4•2 n . Let x 1 , x 2 , y 1 , y 2 ∈ {0, 1} n that we interpret as integers in [0, 2 n -1], and let ⃗ e x 1 x 2 y 1 y 2 ∈ F N 2 be the binary column vector where the i th coordinate of ⃗ e x 1 x 2 y 1 y 2 is equal to 1 iff.

i = x 1 , i = x 2 + 2 n , i = y 1 + 2•2 n or t = y 2 + 3•2 n
and is equal to 0 otherwise. This means each ⃗ e x 1 x 2 y 1 y 2 ∈ F N 2 has weight 4, meaning four non-zero coordinates.

The idea of the distinguisher is that if the following: perform M queries

{x i 1 x i 2 ||y i 1 y i 2 } i∈[M ] , let H = span{⃗ e x i 1 x i 2 y i 1 y i 2 } i∈[M ]
. For M large enough (but linear in N ), we will show that if we queried our QuEME π construction, we have dim(H) ≤ N -2 with overwhelming probability, which we prove using equation 6.30. On the other hand, if we start from a random permutation, then we can show that dim(H) ≥ N -1 since the ⃗ e x i 1 x i 2 y i 1 y i 2 will essentially be random vectors of F N 2 of weight 4.

We consider the following adversary

Hardness of Distinguishing a Random Permutation from a Random Function with Small Range

Our proof will use a quantum lower bound on distinguishing a random permutation from a random function with small range proven in [START_REF] Zhandry | A Note on the Quantum Collision and Set Equality Problems[END_REF]. We first define a distribution S n (r) of small range functions: Definition 6.1. S n (r) is a distribution on functions from {0, 1} n to {0, 1} n sampled as follows:

• Draw a random function g from {0, 1} n → [r].

• Draw a random injective function h from [r] → {0, 1} n .

• Output the composition h • g.

Notice that any function f drawn from S n (r) satisfies |Im(f )| ≤ r. Let also P n be the uniform distribution on permutations on {0, 1} n . Zhandry's lower bound can be stated as follows: Proposition 6.3 ([127]). For any r, for any quantum adversary A f performing q queries to f , we have Adv Sn(r) qprp (A) = O q 3 r .

Quantum Security Statement

As in the classical setting, we consider the prp advantage against quantum adversaries that can query the whole function QuEME E but also the inner function E. In the quantum setting, both these queries can be quantum queries.

Theorem 6.10. For any quantum adversary A playing a q-query IND-CPA game against QuEME E with q ′ offline (quantum) queries to E, we have

Adv QuEME E prp (A) ≤ O (q + q ′ ) 2 2 n/3 + O   (q + q ′ ) 2 2 n/3 2   + α E (r 2 , r 2 ).
with r = O((q + q ′ )2 n/3 ), where recall that α E (x, x ′ ) be an upper-bound on the advantage of an adversary who has learned x ′ key-plaintext-ciphertext triples for E and is trying to distinguish x other key-plaintext-ciphertext triples from random. This implies in particular that the advantage is small essentially up to (q + q ′ ) = 2 n/6 .

Proof. We consider a quantum adversary A that performs q quantum queries to QuEME E and q ′ quantum queries to E. We perform a game based proof to prove our statement. We start from Game 1 which corresponds to the prp-advantage.

Game1 → Game2. We transform Game1 into Game2 by adding two random permutations j 1 , j 2 in the key and in the input of E.

Game1: prp-game(A) b $ ← -{0, 1} E $ ← -T BC n f ← QuEME E if b = 0 P 2n if b = 1 b ′ ← A f,E (•) Win if b = b ′ Game2: adding permutations to E b $ ← -{0, 1} E $ ← -T BC n j 1 , j 2 $ ← -P n Let E ′ st. E ′ k (x) = E j 1 (k) (j 2 (x)). f ← QuEME E ′ if b = 0 P 2n if b = 1 b ′ ← A f,E ′ (•) Win if b = b ′
Transforming E into E ′ does not change its distribution. It is still a random tweakable permutation (T BC n ). Therefore, this does not change the value of the game.

$ ← -{0, 1} E $ ← -T BC n j 1 , j 2 $ ← -P n Let E ′ st. E ′ k (x) = E j 1 (k) (j 2 (x)). f ← QuEME E ′ if b = 0 P 2n if b = 1 b ′ ← A f,E ′ (•) Win if b = b ′ Game3: adding permutations to QuEME E ′ b $ ← -{0, 1} E $ ← -T BC n j 1 , j 2 $ ← -P n Let E ′ st. E ′ k (x) = E j 1 (k) (j 2 (x)). f ← QuEME E ′ if b = 0 P 2n if b = 1 h L , h R $ ← -P n f ′ := f • (h L ||h R ). b ′ ← A f ′ ,E ′ (•) Win if b = b ′
In our encrypt then mix construction, we start already by 2 random permutations so adding an extra layer of permutations will not change the distribution QuEME E ′ . This of course does not change the distribution of random permutation as well hence Pr[A wins Game2] = Pr[A wins Game3].

Game3 → Game4. We now replace all the permutations with random small-range functions.

Game3: adding permutations to

QuEME E ′ b $ ← -{0, 1} E $ ← -T BC n j 1 , j 2 $ ← -P n Let E ′ st. E ′ k (x) = E j 1 (k) (j 2 (x)). f ← QuEME E ′ if b = 0 P 2n if b = 1 h L , h R $ ← -P n f ′ := f • (h L ||h R ). b ′ ← A f ′ ,E ′ (•) Win if b = b ′ Game4: adding permutations to QuEME E ′ b $ ← -{0, 1} E $ ← -T BC n j 1 , j 2 $ ← -S n (r) Let E ′ st. E ′ k (x) = E j 1 (k) (j 2 (x)). f ← QuEME E ′ if b = 0 P 2n if b = 1 h L , h R $ ← -S n (r) f ′ := f • (h L ||h R ). b ′ ← A f ′ ,E ′ (•) Win if b = b ′
From Zhandry's bound on small range functions, we have

Pr[A wins Game3] ≤ Pr[A wins Game4] + O q 3 r + O q ′3 r ≤ Pr[A wins Game4] + O (q + q ′ ) 3 r .
Game4: Classical Emulation. We consider the following classical adversary.

Classical adversary

B f,E 1. Pick j 1 , j 2 , h L , h R $ ← -S n (r).
Let Y 1 , Y 2 be the ranges of j 1 , j 2 respectively, and Z L , Z R be the ranges of h L , h R respectively, so they are each subsets of {0, 1} n of size r.

Define

E ′ st. E ′ k (x) = E j 1 (k) (j 2 (x)) and f ′ := f • (h L ||h R ). 3. Query f (x, y) for each (x, y) ∈ Z L × Z R and query E k (x) for each (k, x) ∈ Y 1 × Y 2 ,
for a total of 2r 2 queries. From these queries, recover the truth table of f ′ and E ′ . and moreover, B is a classical algorithm that performs 2r 2 queries to f . We still add a few remarks on the adversary B. Notice that we limit the number of queries of B but not its running time so we do not need to perform the different steps of the algorithm efficiently. From this, it makes it much easier to see how B performs the different steps of the algorithm. In particular, he chooses h L , h R , j 1 , j 2 at random and knows the full description of these functions, so he knows Y 1 , Y 2 , Z L , Z R . Also, after his 2r 2 queries, he can know the full truth table of f ′ and E ′ , so he knows the full description of A f ′ ,E ′ . A quantum algorithm on n qubits with m gates, can be emulated by a classical algorithm running in time exponential in n, m. However, he does not need any extra queries to f ′ , E ′ since he already knows the full description of f ′ and E ′ . What is important here is that even though the running time is large, the amount of queries done to f and E is limited to r 2 .

Emulate the quantum circuit

A f ′ ,E ′ (•) and output b ′ ← A f ′ ,E ′ (•).
We can now conclude

Adv QuEME E qprp (A) = Pr[A wins Game1] ≤ Pr[A wins Game4] + O (q + q ′ ) 3 r = Pr[B wins Game1] + O (q + q ′ ) 3 r = Adv QuEME E prp (B) + O (q + q ′ ) 3 r .
In order to conclude, take r = O (q + q ′ )2 n/3 . From Theorem 6.7, we have

Adv QuEME E prp (B) ≤ O r 2 2 n + O r 4 2 2n + α E (r 2 , r 2 ) = O (q + q ′ ) 2 2 n/3 + O   (q + q ′ ) 2 2 n/3 2   + α E (r 2 , r 2 ).
and from the choice of r, we have O (q + q ′ ) 3 /r = O (q + q ′ ) 2 /2 n/3 . From there, we conclude

Adv QuEME E qprp (A) ≤ Adv QuEME E prp (B) + O (q + q ′ ) 3 r ≤ O (q + q ′ ) 2 2 n/3 + O   (q + q ′ ) 2 2 n/3 2   + α E (r 2 , r 2 ).

Discussion

Our proof is very generic and we can relate the quantum security to the classical security for any construction that start by encrypting the left and right halves of the input. The drawback of this strategy is that it seems to be far from tight. Indeed, when looking at our construction and the attack running with O(2 n ) queries it's not clear how to use quantum queries to improve this attack. We expect our construction to have much more than n/6 bits of quantum security, maybe its quantum security is actually n bits.

In order to improve these bounds, one natural path would be to look at Zhandry's quantum query recording technique. However, in our case, we need to consider random permutation and not random functions and this is notoriously hard, as some of the proposals for this turned out to be incorrect (see for instance [START_REF] Unruh | Compressed Permutation Oracles (And the Collision-Resistance of Sponge/SHA3)[END_REF]). As this topic becomes more mature, we hope that this tool will be available for proving tight quantum security bounds for our construction.

Proposing a Concrete Instance: Double-AES

The aim of this section is to propose a concrete instance that would motivate cryptanalysis on these constructions. For this, we propose some variants that claim the same quantum security as the Saturnin block cipher [START_REF] Canteaut | Saturnin: a suite of lightweight symmetric algorithms for post-quantum security[END_REF], that was conceived with the objective of proposing resistance against quantum-attackers. In particular, we also claim that:

There exists no quantum attack in the single-key setting with T 2 /p < 2 224 , where T is the time complexity and p the success probability. We do not provide security against related-key superposition attacks (as is the case of all known block ciphers).

Therefore, in this section we propose a concrete construction based on AES-128 [START_REF] Daemen | Rijndael for AES[END_REF], showing how to use 256-bit keys and domain extensions in the different blocks, and proposing several possible variants depending on how many AES rounds are considered in each block, and we announce their corresponding (quantum) security claims. We have chosen the AES-128 block cipher to profit from its large amount of cryptanalysis on reduced round versions, that will simplify analyzing the instantiation of the new construction. We also briefly describe the best attacks we have found so far in these family of constructions. As we will see, these attacks motivated us to include the last MC transformation on each block cipher call, but on the two ones from the final layer. A brief description of AES-128 and of the best known attacks on it can be found in Section 5.5.1.

The main aim of these instantiations is to motivate cryptanalysis and comparison with other constructions as well as further research.

How to Extend the Keys?

Independently of the blocks ciphers used, we can decide how to choose the keys used in each block. As we expect that a 2n key can have the same security as a 4n one, we will choose the keys for E 3 and E 4 to be dependent on the ones from E 1 and E 2 for the sake of simplicity. For this, we propose to have a 2n key formed by (k 1 ||k 2 ). These keys will be used as the key of the two blocks applied in the input of the construction: k 1 for E 1 and k 2 for E 2 . We have to define now the keys k 3 and k 4 for the two output blocks E 3 and E 4 . The idea is that, from the knowledge from one input key we should not be able to retrieve any information from any other key. For this, we propose to define:

k 3 = k 1 ⊕ k 2 and k 4 = k 1 ⊕ (k 2 ≪ 1).
Though more robust and complicated key-extensions could be proposed, like for instance

K 1 , K 2 , E K 2 5 (K 1 ), E K 1 6 (K 2 )
, we believe ours has the advantage of being simpler and very efficient, and should have an equivalent security as long as the used block cipher is secure.

Property : guessing one full key (k 1 for instance) and x bits of any other key (i.e. k 2 ), allows to compute x and x -1 bits of the other two keys (k 3 and k 4 in the example). We could have choosen other simple configurations where the bits determined in the two last subkeys wouldn't belong mainly to the same bytes, but we believe this configuration is interesting, for the sake of simplicty of implementation and analysis.

Introducing a Domain in AES for Defining E j

We present in Section 5.5.1 the specifications of AES-128. For defining 4 additional different instances E 1 to E 4 , we propose to use a different constant for each block. All the remaining parts stay the same and we only change the constant, as: with

rc i,j =      X i mod X 8 + X 4 + X 3 + X + 1 j 0 0     
.

For the middle call to the block cipher we consider the original AES definition, where the input arriving as a parameter will have the role of the secret key.

Double-AES Concrete Proposals

Double-AES-10.

A very conservative approach would be to consider a full AES encription inside each block.

Conjecture: the 7-round attacks cannot be exploited when using AES in our construction.

We have tried to build attacks in our construction exploiting the best known attacks on 7-rounds when we consider the blocks used in the instantiation reduced to 7 rounds and we have not been able to do so. We conjecture that these attacks cannot apply when using our construction, and we propose therefore Double-AES-7, that instead of 10 rounds in each block only used 7. We also believe that it is a quite conservative approach, given the bext found attacks in the next section.

Variants Including Last MC: Double-AES-6-MC.

We propose a variant where the last MC operation is considered in the block call that do not belong to the last layer (E 3 and E 4 ). We encourage the cryptanalysis of Double-AES-5-MC, for which we think an attack might exist, and we conjecture that Double-AES-6-MC should provide a similar security than Double-AES-10.

Best Attacks.

In Section 6.10, we present the best attacks we have found. In order to reflect that different number of rounds can be considered per block, we call an attack on r 1 -r 2 -r 3 when it covers r 1 rounds for E 1 and E 2 , r 2 rounds for E and r 3 rounds for E 3 and E 4 . Our best attacks cover X-3-3 and X-2-X, without the last M C in E 1 , E 2 and E.

Security Claims

The final construction has a 256-bit state and key. We provide an unique security claim, not distinguishing between classical and quantum attacks: we claim that our extended block cipher Double-AES, with versions Double-AES-10, Double-AES-7 and Double-AES-5-MC provide around 128 bits of security against any type of attacker. 4In addition, we claim that when plugged in secure modes, any attack that requires a collision on the state would require at least the generic complexity for generating a collision, that is, no attack significantly better than T 5 ×M q = 2 512 exists, where T represents the time complexity, and M q the quantum memory (that includes the classical memory).

Discussion

As already said, we considered Saturnin [START_REF] Canteaut | Saturnin: a suite of lightweight symmetric algorithms for post-quantum security[END_REF], the first conceived block cipher aiming at security against all quantum attackers, as a model for our quantum security claims. Given that that construction also inherits a lot from the AES one, we consider the comparison interesting. The same goes for the cipher AES-256 [START_REF] Daemen | The Design of Rijndael: AES -The Advanced Encryption Standard[END_REF]. In particular, if we consider the Double-AES-7, as the two upper and the two lowers can be done in parallel, the time of one encryption should take an equivalent of 3 × 7 = 21 AES rounds, while AES-256 takes 14 rounds for encrypting half of the state. Rijndael-256 [START_REF] Daemen | Rijndael for AES[END_REF] is a similar case than the AES-256, but with a state of 256 bits this time, as Double-AES. Nevertheless, this constructions, that was not standardized, has been much less studied by the community and benifits less from the cryptanalysis knowledge of the community.

In all the three cases, our construction has the advantage of being a generic way for doubling block ciphers, and therefore, we believe further study would be useful for understanding the properties of the underlying block cipher that can generate an attack or that can not.

We expect further cryptanalysis to show if we can reduce the number of rounds in Double-AES-7 or in Double-AES-5-MC further in order to gain in interest with respect to these previous constructions while staying secure.

Best Attacks Found of Double-AES

The two best attacks we have found work on 3 rounds in E, E 3 and E 4 blocks and any number of rounds in the two first ones (X-3-3); and on 2 rounds in E while having any number of rounds in the upper and lower blocks (X-2-X) and are, logically, quantum attacks. They both use a step consisting on guessing at least a whole 128-bit key.

They also exploit the following property:

First Middle Round Canceled.

Given the key-addition operation of the AES, the input of the middle block after the first key addition will be equal to the output of E 2 . This property is very interesting. As an example, if we consider differences and if the input of the right part of the state is fixed, the first SB transfer of the middle round will have no active sboxes,

Attack on X-3-3 Without Last

M C in Blocks E 1 , E 2 and E.
This attack is based on the square attack [START_REF] Ferguson | Improved Cryptanalysis of Rijndael[END_REF]. From it we know that, if the input is an active diagonal only in the left part of the plaintext, we will recover 2 24 sets that verify that the state 4 rounds later is an state where all of its bytes take all the possible values independently. The aim is to generate a square state thanks to the left input at the beginning of the middle E, but we have to be careful, as this input state will also influence its subkeys. In order to make it work, we will consider a byte (in the before last column, not to affect too much further subkeys due to key-schedule), that takes all the 2 8 possible values in the input instead of structures of 2 32 , and we will then cover with the distinguisher one less round than the original square attack.

We guess k 1 of E 1 , in order to generate an input to E with two fully active bytes, as shown in Figure 6.4. Therefore, any number of rounds in E 1 would allow the attack to work. In addition, we guess the subkeys from k 3 associated to: 32 bits of antidiagonal for the last subkey, and 8 bits of subkey

AK k 2,1 SB SR MC Round 1 AK k 2,2 SB SR MC Round 2 AK k 2,3 SB SR Round 3 AK k 2,4 Figure 6
.4: Square-like property on the middle part. We use green for bytes that take every values, purple for balanced bytes and black for ignored bytes.

AK k 3,1 SB SR MC Round 1 AK k 3,2 SB • SR • MC • Round 2 MC ■ AK k 3,3 SB • • • • SR • • • • • • • • Round 3 AK k 3,4 ■ ■ ■ ■ • • • • • • • • • • • • • • • • Figure 6
.5: Recovery on the bottom part. We use green for bytes that take every value, purple for balanced bytes, black for ignored bytes, ■ for guessed bytes and • for deduced and known bytes.

for the before-last equivalent subkey, as shown in Figure 6.5. This allows us to compute, for a given left output, a byte after the first MC transformation in E 3 and check whether the sum of the resulting bytes is 0 or not. This filters one guess out of 256.

In order to increase this sieving, we choose, instead of one fixed state for the right input, 21, which would provide a sieving of 2 -8×21 to have balanced bytes each time, leaving approximately 2 128+5×8 × 2 -8×21 = 1 key guess.

Complexity will be 21 × 2 8 × 2 (128+32+8)/2 = 2 96.5 data and time. We expect that these attacks might be extended to 4-4-4, or to 4-3-4 with MC by having a closer look at the properties generated by the key-schedule of the middle block.

Attack on X-2-X Without Last

M C in Blocks E 1 , E 2 and E. Guessing k 3 .
We start with a fixed pair (P 1 , P 2 ) of left blocks of plaintexts and perform the encryption through Double-AES-X-2-X of (P 1 , R), (P 2 , R), for a fixed value R. We consider exclusively the left part of the output, we obtain C 1 and C 2 . For each guess of key k 3 from E 3 , we will try a decryption through E 3 of C 1 and C 2 and note the difference δ.

Guessing k 1 and Some Middle Subkeys.

For each guess of key k 1 from E 1 , we will try a encryption through E 1 of P 1 and P 2 . This will produce values x 1 and x 2 that correspond to the values that should enter the middle part E.

Then, we will experience the cancellation of the first round as described earlier. The second round starts by a key addition, and we can get to know the differences on the bytes 0,4,8 and 12 (the first line) before the second SB for one additional guess of the byte 13 of E 2 (R). Each one of this differences can be associated to 2 32-4 = 2 28 output differences through the DDT of these four sboxes. The output differences of these second SB will be determined by δ xored to the last subkey of the middle round. In order to compute the difference of this subkey for the first line, and therefore the posible values for finding a match of this first line with the δs, we can perform an additional guess guess of the byte 14 of E 2 (R) and the xor of the bytes 1,5,9 and 13 of E 2 (R). We therefore get to compute the possible output differences of E and compare them to the differences δ we described earlier.

As we just said, the probability of this sieving is of 2 -4 because of the DDT.

More Pairs.

In order to sieve more guesses, we use 70 pairs instead of one, which leaves approximately 2 128+128+3×8 × 2 -4×70 = 1 combination.

Complexity.

We can then use an element distinctiveness algorithm to find the correct combination of (k 1 , k 3 ). Thanks to Ambainis algorithm [5], the cost of this attack will be about 70 × (2 128 + 2 128+24 ) 2/3 = 2 107.5 time and memory.

Best known attacks on AES

Conclusion

In this chapter, we provide the first proposal of a generic way for extending both the key and the state size, with quantum security arguments and significant classical proofs. In addition we have proposed a new type of superposition attacks on the EME construction, an original distinguisher matching the bound of our construction, and a method considering simulations for supporting conjectures from proofs.

On concrete instances and cryptanalysis. Concrete instances of our construction combined with AES-128 have been proposed, with the aim of Chapter 7

Quantum Security of UMTS-AKA

In this chapter, we first define a security model that does not rely on unconditional security and allows honest parties and attackers to use superposition messages. In particular, assuming that we are in a quantum world, we provide a discussion on what can be put into superposition by the client, the server and the operator during a honest execution of such quantum UMTS-AKA protocol. More precisely, the quantum version of the UMTS-AKA that we describe assumes quantum computations as well as quantum communications (i.e., the messages that are exchanged between parties are in a superposition of quantum states).

We then formally prove that this quantum version of the UMTS-AKA is as secure in this quantum model as it is in the classical setting [4]. As the quantum version we built is an extension of the classical one, the attack by Zhang is still valid [START_REF] Zhang | Provably-Secure Enhancement on 3GPP Authentication and Key Agreement Protocol[END_REF]. It consists in using the extra authentication vectors of a corrupted server by the attacker elsewhere to make an unauthorized authentication. As a supplementary contribution, we also exhibit a new attack against the state confidentiality of a mobile user. This attack holds in the quantum but also in the classical setting.

We finally study the security of the underlying primitives that can instantiate the UMTS-AKA, Milenage and TUAK. We show an attack on Milenage as a qPRF, however the context of the UMTS-AKA makes this attack unrealistic and we further prove the security of Milenage based on the security of AES. We also show a reduction from the security of TUAK to the security of Keccak-f.

It is based on a joint work with Sébastien Canard and Loïc Ferreira that is currently in a review process.

The AKA Protocol

In this section, we present the standard protocol AKA used in the 3G and 4G infrastructure, and which is also the basis of the 5G AKA. The we describe a quantum variant supposed to be run between quantum computers and through superposition-allowing channels.

The Classic Version of AKA

The AKA procedure consists of an exchange of Message Authentication Codes (MAC) and key derivations from a fresh random value, and static secret keys shared by the client (Mobile Equipment/User Subscriber Identity Module, ME/ USIM) and the operator (Home Location Register, HLR). It is executed as a challenge response through a server (Visited Location Register, VLR).

Elements of the Protocol.

The main elements are the following.

Pseudo-random Functions. The protocol defines seven functions

f 1 , f 2 , f 3 , f 4 , f 5 , f * 1 , f * 5
which take as input the secret keys and the random value R. f 1 and f * 1 take as additional inputs the sequence number (Sqn C or Sqn Op,C ), and an Authentication Management Field (AM F ). f 1 outputs the MAC tag M ac S sent to the client. f 2 outputs the MAC tag M ac C sent to the server. f 3 and f 4 output respectively the session keys CK (Confidentiality Key) and IK (Integrity Key). f 5 outputs an Anonymity Key (AK) used to mask Sqn. f * 1 and f * 5 intervene in place of f 1 and f 5 during the the re-synchronization procedure. In practice, these functions are instantiated by either Milenage [1] or TUAK [START_REF]Specification of the TUAK algorithm set: A second example algorithm set for the 3GPP authentication and key[END_REF]. We consider that the values Sqn C do not repeat (otherwise the client would accept values from a previous execution of the protocol). To be sure the operators do not allow for a repetition of Sqn C , we restrict the number of authentication vector all operators can produce with the same sk C to be at most 2 |Sqn C | ∆ (since a client uses the same Sqn C for every operator), where ∆, chosen by the operator, defines an acceptance interval.

Static Secret

Description of an Execution.

The main steps are the following (see Figure 7.1).

Generation of the Challenge. First the server requests from the client an U ID, which is an IMSI (International Mobile Subscriber Identify) or a TMSI (Temporary Mobile Subscriber Identity), a value agreed in a previous session. The server forwards it to the operator. The operator produces n Authentication Vectors (AV ), sends them to the server, and updates Sqn Op,C to Sqn Op,C + n. Each vector AV i , 1 ≤ i ≤ n, is computed from a fresh random

Identity request ← ------------ Client identity -----------→ U ID Authentication -----------→ vector request For each i = 1, ..., n Generate R i Compute 1 Sqn Op,C ← Sqn n Authentication ← ----------- vectors (AV 1 , .., AV n ) Choose a value i Challenge ← ------- Compute (R i , Auth i ) 2 If M ac i S ̸ = M ac ′i S , Abort If Sqn i -Sqn C ∈ [1, ∆], Sqn C ← Sqn i Answer -----→ M ac ′i C Else, Re-synchronize If M ac i C = M ac ′i C , See Figure below Accept Else, Abort Authentication -----------→ failure report (U ID, R i , failure code) Sqn Op,C ← Sqn i 2 AK i = f 5 (sks, R i ) Sqn i = AK i ⊕ Auth i 1 M ac ′i S = f 1 (sks, R i , Sqn i , AM F ) M ac ′i C = f 2 (sks, R i ) CK i = f 3 (sks, R i ) IK i = f 4 (sks, R i ) 1 Sqn i = Sqn Op,C + i M ac i S = f 1 (sks, R i , Sqn i , AM F ) M ac i C = f 2 (sks, R i ) CK i = f 3 (sks, R i ) IK i = f 4 (sks, R i ) AK i = f 5 (sks, R i ) Auth i = Sqn i ⊕ AK i ∥AM F ∥M ac i S AV i = (R i , CK i , IK i , Auth i , M ac i C ) Re-Synchronization Client Server Operator (sks, Sqn C ) (sks, Sqn Op,C ) Compute M ac * S = f * 1 (sks, R i , Sqn C , 0) AK * = f * 5 (sks, R i ) Auts = Sqn C ⊕ AK * ∥M ac i S Synchronization ------------→ failure (Auts) Adds the value R i Re-synchronization --------------→ request (R i , Auts) Compute AK * = f * 5 (sks, R i ) Sqn C = AK * ⊕ Auts 1 M ac ′ * S = f * 1 (sks, R i , Sqn C , 0) If M ac i S ̸ = M ac ′i S , Abort Else, Sqn Op,C ← Sqn C
Sqn i = Sqn Op,C + i M ac i S = f 1 (sks, R i , Sqn i , AM F ) M ac i C = f 2 (sks, R i ) CK i = f 3 (sks, R i ) IK i = f 4 (sks, R i ) AK i = f 5 (sks, R i ) Auth i = Sqn i ⊕ AK i ∥AM F ∥M ac i S AV i = (R i , CK i , IK i , Auth i , M ac i C )
Challenge-Response. The server picks a vector AV i and sends the corresponding R i to the client. In turn, the latter computes

AK i = f 5 (sks, R i ) Sqn i = AK i ⊕ Auth i 1 M ac ′i S = f 1 (sks, R i , Sqn i , AM F ) M ac ′i C = f 2 (sks, R i ) CK i = f 3 (sks, R i ) IK i = f 4 (sks, R i )
The client verifies that M ac ′i S = M ac i S , sends an abort message if not, and checks if the challenge is fresh, i.e., Sqn i ∈ [Sqn C + 1, Sqn C + ∆]. Next it sets Sqn C to Sqn i , and replies to the server with M ac ′i C . If this answer is incorrect, the server sends to the operator a report containing the R i of the used AV i , the client's U ID, and a failure code. In such a case the operator updates Sqn Op,C to Sqn i .

Re-synchronization. If Sqn

i / ∈ [Sqn C + 1, Sqn C + ∆]
the client triggers a re-synchronization procedure (see Figure 7.1). First it computes

AK * = f * 5 (sks, R i ) M ac * S = f * 1 (sks, R i , Sqn C , 0) Auts = (Sqn C ⊕ AK * )∥M ac * S
where R i corresponds to the current challenge. The client sends Auts to the server which forwards it along with R i to the operator. Then the operator computes

AK * = f * 5 (sks, R i ) Sqn C = AK * ⊕ Auts 1 M ac ′ * S = f * 1 (sks, R i , Sqn C , 0)
and verifies if M ac ′ * S = M ac * S . If so, it updates Sqn Op,C to Sqn C , otherwise it aborts the procedure.

Quantum AKA Protocol

In this subsection we describe a quantum variant of the AKA protocol. More precisely, we consider a version within a full quantum world, where both honest and dishonest parties are given quantum capabilities. Hence, each party is able to perform quantum computations, and communication allows transferring qubits in superposition. Since the values can still be computed classically (measurements are still possible), this quantum variant is obviously an extension of the classical AKA.

Modelization of Quantum Communications.

We base our modelization of quantum communications on the work of Yao [START_REF] Andrew | Quantum Circuit Complexity[END_REF]. For a communication between Alice and Bob, the total state |a⟩ |c⟩ |b⟩ is composed of three parts:

• |a⟩ is Alice's secret part and modifiable only by her;

• |b⟩ is Bob's secret part and only modifiable by him;

• |c⟩ is the state of the channel, it is modifiable by everyone, or only Alice and Bob if the channel is secure (like the ones between operators and servers).

Other modelizations. Other modelizations of quantum communications exists, like [START_REF] Cleve | Substituting quantum entanglement for communication[END_REF], where communications are made using EPR-pairs, pairs of entangled qubits shared by Alice and Bob. While this englobes our modelization, it implies making and storing those pairs. The latter seems highly unpractical.

Superposition or Not

We detail below whether the parameters of the protocol may be used as values in superposition in the quantum variant.

Static Secret Keys. These keys are long-term values whose lifespan depends only on the time needed by an attacker to find them. Having long-term keys maintained in superposition seems obviously unpractical. From now on, we consider client and operator keys (sk C , sk Op ) to be in a classical state. Consequently sk Op,C is also in classical state.

Sequence Number. We consider sequence numbers to be in classical state.

Description of a Quantum Execution

The main steps of the quantum version of the protocol are the following (see Figure 7.2).

Generation of the Challenge. For 1 ≤ i ≤ n, the operator generates each superposition R i a R i | R i ⟩ , increments Sqn i = Sqn Op,C + i, and computes the parameters entangled with R i . The operator gets the superposition:

R i a R i |R i , M ac i S , M ac i C , CK i , IK i , AK i ⟩ M ac i S = f 1 (sks, R i , Sqn i , AM F ) M ac i C = f 2 (sks, R i ) CK i = f 3 (sks, R i ) IK i = f 4 (sks, R i ) AK i = f 5 (sks, R i ) The operator computes Auth i = |Sqn i ⊕ AK i ∥AM F ∥M ac i S ⟩ and AV i = |R i , CK i , IK i , Auth i , M ac i
C ⟩, and sends the authentication vectors AV i to the server.

Challenge-Response. The server picks a vector i and sends the corresponding challenge to the client. The client computes

AK i = f 5 (sks, R i ) Sqn i = AK i ⊕ Auth i 1 M ac ′i S = f 1 (sks, R i , Sqn i , AM F ) M ac ′i C = f 2 (sks, R i ) CK i = f 3 (sks, R i ) IK i = f 4 (sks, R i )
At this point, several qubits are shared between the operator, the server and the client. They are entangled, and every state value depends only on the value R i it was computed from. The quantum state of the system can be represented as

R i a R i | R i M ac i S M ac ′i S M ac ′i C CK i IK i AK i Sqn Op,C , R i M ac i S M ac i C CK i IK i AK i ⊕ Sqn Op,C , R i M ac i S M ac i C CK i IK i AK i ⟩
The first, second and third columns correspond respectively to the client's, server's, and operator's view.

R i a R i |R i , M ac *
S , AK * ⟩ where R i comes from the current challenge and

AK * = f * 5 (sks, R i ) M ac * S = f * 1 (sks, R i , Sqn C , AM F )
The client generates Auts = |(Sqn C ⊕ AK * )∥M ac * S ⟩ and sends it to the server which forwards it as R i a R i |R i , Auts⟩ to the operator. Then the operator computes

AK * = f * 5 (sks, R i ) Sqn C = AK * ⊕ Auts 1 M ac ′ * S = f * 1 (sks, R i , Sqn C , AM F
) and verifies if the measure of M ac ′ * S ⊕ M ac * S equals 0. If so, it updates Sqn Op,C to Sqn C , otherwise it aborts the procedure.

Notes on the Measurements.

During the protocol, we measure Sqn C as a value in classical state. We also need to measure M ac S ⊕ M ac ′ S and M ac C ⊕ M ac ′ C as it decides if the protocol continues or is interrupted.

Compared to the classical protocol, allowing for answers in superposition may mislead us into think that an adversary can have a higher probability to get an accepting state by entering random values. As seen in the description of the protocol, every value is determined by R i . For each R i , the probability of acceptance being identical, the same holds regarding the superposition of R i . Another way to see this phenomenon is to pass the deciding measurements, the answer needs to be measured as the expected superposition which is entangled with R.

Adversarial Model and Building Blocks

In this section, we define the quantum adversarial model for a quantum variant of the UMTS-AKA protocol, and some building blocks we need. We here adapt the work of Alt, Fouque, Macario-Rat, Onete and Richard [4] (done in a classical context) to our quantum setting.

Oracles

The adversary interacts with the system by means of the following oracles, in addition to the functions f 1 , ..., f 5 , f * 1 , f N ewInstance(P ) → (P j , m): this oracle instantiates the new instance P j , of party P , which is either a client or a server. Furthermore, the oracle also outputs a message m, which is either the first message in an honest protocol session (if P is a server) or ⊥ (if P is a client).

Execute(C, i, S, j) → τ : selects the client C and the server S, creates (fresh) instances C i , S j , allocates the necessary quantum memory for these instances, then runs the protocol between them using the allocated quantum memory. The adversary has access to the transcript of the protocol instance τ via the channel state.

As for the immediate description of the protocol, there is no use of the results CK, IK, the adversary gets maximum control of the transcript by making the client uncompute its quantum values of the protocol (except R as it comes from the challenge sent by the server) and the challenger uncompute the quantum values of the protocol in the sever and in the operator (except R, as it links the quantum state of the protocol, and the ones concerned by a RevealSession or T est query, see below) in the clients, servers and operators. Then the only remaining value in superposition are the R in the client and in the operator which are sent to the attacker (it already has access to it). 2(One could consider the whole system to be a simulation and then executing the protocol on superpositions of clients, servers and operators but this is not our interest here. As such, this oracle takes classical values but returns a script written on qubits and most often in superposition, as specified in Section 7.1.2).

Send(P, i, m) → m ′ : simulates sending the message m to the instance P i of P . The output is a response message m ′ (which is set to ⊥ in case of an error or an abort). As our protocol is meant to run on superposition allowing channels, the messages m and m ′ use qubits and can be in superposition. T est(P, i) → K: this oracle can be used just after an execution of the protocol.

It is initialized with a secret random bit b and secret random functions f ′ 3 and f ′ 4 whose outputs are in the same space as CK and IK respectively. It returns ⊥ if the instance P i is not fresh or if it has not terminated in an accepting state (with a session key CK, IK). If b = 0, then the oracle returns CK = f 3 (R), IK = f 4 (R), else it returns CK ′ = f ′ 3 (R), IK ′ = f ′ 4 (R). We assume that the adversary makes a single T est query.

Partners. Two instances P i and P ′ j are partners if: • one is from a server and one is from a client;

• both instances are in accepting state;

• they share the same entangled superposition sid = (R, AK ⊕ Sqn C = AK ⊕ Sqn Op,C ).

Note that sid is a superposition included in the challenge transmitted by the server to the client. sid still contains information corresponding to the operator and the intended client as it is computed using their keys.

The sid are entangled values not only in themselves but also between the partnered instances as seen in the description of the quantum protocol. Then, deciding whether two instances are partnered can be done by xoring their sid. The result is 0 if they are effectively partnered and not 0 with overwhelming probability otherwise.

Targeted Notions

We here only give a short description of each security properties. Detailed definitions (together with proofs) are given in Section 7.3.

Indistinguishability of the output of the protocol: a man-in-the-middle (MitM) attacker should not be able to distinguish (with significative probability) the output of an execution of the protocol from random values, even with corruptions of other clients and servers (strong indistinguishability).

Resistance to client impersonation: a MitM attacker should not be able to make an uncorrupted server accept an execution (with significative probability) without relaying expected messages, even with corruptions of other clients and servers (strong resistance).

Resistance to server impersonation: a MitM attacker should not be able to make an uncorrupted client accept an execution (with significative probability) without relaying expected messages.

Soundness: a malicious server should not be able to make more authentication (with significative probability) with uncorrupted clients than what operators have allowed.

State-confidentiality: a malicious server should not be able to recover the values sk Op , sk Op,C , sk C or Sqn C significantly faster than guessing them.

Communications between Operators and Servers. Many elements that could easily break the security of the authentication are communicated between the operators and the servers. As such we consider the channels of communications between the operators and the servers to be secure.

A KD will take the given values as keys sk C and sk Op,C to generate the clients and operators. Then it will run the adversary A 0 with the generated clients and operators then if A 0 is right, A KD will answer "the keys are generated" and if A 0 is wrong, A KD will answer "the keys are random".

In the case the tuple of keys is the generated one, A 0 works normally. If it is the random one A 0 will work as an adversary for the game G 1 . The probability of the described events is reported as follows: keys Game G 2 : we define the game G 2 as the same as G 1 but we replace G with a perfect pseudo-random function G ′ on which there is no advantage.

A
Transition G 1 → G 2 : an attacker for G 1 either attacks G 2 or uses a property of G. To put it in another way, one can use an attack against G 1 but fails against G 2 to distinguish between G and G ′ . More formally, using the best adversary A 1 for G 1 , we can build a quantum adversary A G for the game against G with a total of q req = 10q exec + 5q Op + 4q res requests 4 for keyed G as a black box.

A G will take the black boxes to generate the clients and operators. Then it will run the adversaries A 1 with the generated clients and operators then if A 1 is right, A G will answer "the functions are generated" and if A 1 is wrong, A G will answer "the functions are random".

In the case the functions are the generated one, A 1 works normally. If they are the random one A 1 will work as an adversary for the game G 2 . The probability of the described events is reported as follows: Adv(G) qreq,t n Op ,n C ≥ P(A wins G qexec,qres,q Op ,t 1

) -P(A wins G qexec,qres,q Op ,t 2

)
4 This is the number of queries needed to simulate the games. During an execution, the operator and the client each compute f1,f2,f3,f4 and f5. For a re-synchronization, the client and the operator each compute f * 1 and f * 5 . For a corrupted request, the operator computes f1,f2,f3,f4 and f5. P(A wins G qexec,qres,q Op ,t 1

) ≤ P(A wins G qexec,qres,q Op ,t 2

) + Adv(G) qreq,t n Op ,n C Our next step is to reduce the configuration to one client, one server and one operator.

Game G 3 : we define the game G 3 as the same as G 2 but there is only one client and one operator.

Transition G 2 → G 3 : as G ′ and KD ′ are perfect, the keyed G ′ are uncorrelated. Thus the attacker does not have benefits from having other clients or operators. An attacker for G 3 could simply simulate other uncorrupted clients by reusing the target client and corrupted clients by generating random keys for an attacker in G 2 . As in G 0 → G 1 or G 1 → G 2 , a difference would mean an advantage over KD ′ or G ′ . P(A wins G qexec,qres,q Op ,t 2 ) = P(A wins G qexec,qres,q Op ,t 3 ) Game G 4 : we define the game G 4 as the same as G 3 but there is only one server now.

Transition G 3 → G 4 : as servers are interchangeable in the sense that the values exchanged do not depend on the server, we essentially make the attacker unable to corrupt servers. Since corruption of servers only gives access to authentication vectors which would be given during an execution and reveal, the queries from a corrupt server are now counted as additional executions of the protocol: q ′ exec = q exec + q Op . P(A wins G qexec,qres,q Op ,t 3

) = P(A wins G q ′ exec ,qres,t 4

)

Game G 5 : we define the game G 5 as the same as G 4 but the challenger now generates the R i before the game and measures the property of R i being all different.

Transition G 4 → G 5 : with our specifications on the generation of R i , the probability of not measuring this property is about q ′2 exec 2 |R| . P(A wins G q ′ exec ,qres,t 4

) = P(A wins G q ′ exec ,qres,t 4

and some R i are equal) +P(A wins G q ′ exec ,qres,t 4

and the R i are all differents) P(A wins G q ′ exec ,qres,t 4

) ≤ (q ′ exec ) 2 2 |R| + P(A wins G q ′ exec ,qres,t 5

)

Ending: the attacker has access to a superposition of authentication vectors such that none of the states contained in the superposition holds any significant information. It has to distinguish between values generated by a perfect pseudo-random function from different R i and true random values. To attack a client, the attacker can also try to send a different challenge which means guessing the output M ac S of a perfect pseudo-random function with a value Sqn C never seen before.

P(A wins G q ′

exec ,qres,t 5

) ≤ 1 2 + 1 2 M ac S
The protocol is (q exec , q res , q Op , t, ϵ)-strongly client-impersonation resistant if no attacker A running in time t with q exec executions of the protocol, q res re-synchronizations and q Op authentication vectors asked by a corrupted server has an advantage Adv(A) = P(A wins) more than ϵ. Theorem 7.2 (Client-impersonation resistance). The advantage on the clientimpersonation resistance game for the UMTS-AKA protocol is bounded as follows: where q req = 10q exec + 5q Op + 4q res .

Adv(A) ≤ (q exec + q Op ) 2 2 |R| + Adv(G)

Proof.

Game G 0 : this is the game defined just above.

P(A wins G

qexec,qres,q Op ,t 0

) = Adv(A)
Our first step is to replace structural elements with perfect ones.

Game G 1 : we define the game G 1 as the same as G 0 but we replace KD with a perfect key derivation KD ′ and G with a perfect pseudo-function G ′ on which there is no advantage.

Transition G 0 → G 1 : an attacker for G 0 either attacks G 1 or uses a property of KD or G. To put it in another way, one can use an attack against G 0 but fails against G 1 to distinguish between KD and KD ′ or between G and G ′ . One can easily use the same argument used in Section 7.3.1 with q req = 10q exec + 5q Op + 4q res requests 5 .

P(A wins G

qexec,qres,q Op ,t 0 ) ≤ P(A wins G qexec,qres,q Op ,t 1) +Adv(KD) t n Op ,n C +Adv(G) qreq,t n Op ,n C Our next step is to reduce the configuration to one client, one server and one operator.

Game G 2 : we define the game G 2 as the same as G 1 but there is only one client and one operator.

Transition G 1 → G 2 : as G ′ and KD ′ are perfect, the keyed G ′ are uncorrelated. Therefore the attacker does not have benefits from having other clients or operators. An attacker for G 2 could simply simulate other uncorrupted clients by reusing the target client and corrupted clients by generating random keys for an attacker in G 2 . As in G 0 → G 1 , a difference would mean an advantage over KD ′ or G ′ . P(A wins G qexec,qres,q Op ,t 1 ) = P(A wins G qexec,qres,q Op ,t 2 Relay: server-impersonation. The attacker is considered to be a simple relay during an execution of the protocol between a server instance S j and a client instance C i if the following events happened in the following order: We define the weak server-impersonation resistance game as follows.

1. The challenger generates n Op operators, n S servers and n C clients and their respective keys.

2. The attacker fixes a target (a client) and an operator.

3. The attacker is allowed to corrupt any number of clients except the target.

4. The attacker is an active MitM for executions of the protocol whose participants are decided by the attacker.

5. The attacker wins if he successfully breaks the server-impersonation resistance for the target client, i.e.s makes the target client instance accept, is still fresh and either the client instance is not partnered with the intended server, or is partnered with an other server, or the attacker has not been a simple relay.

The protocol is (q exec , q res , t, ϵ)-weakly server-impersonation resistant if no attacker A running in time t with q exec executions of the protocol and q res re-synchronizations has an advantage Adv(A) = P(A wins) more than ϵ. where q req = 10q exec + 4q res .

Theorem 7.3 (Weak server-impersonation resistance). The advantage on the server-impersonation resistance game for the UMTS-AKA protocol is bounded as follows:

Adv(A) ≤ q exec 2 |M ac S | + q 2 exec 2 |R| + Adv(G)
Game G 4 : we define the game G 4 as the same as G 3 but there is only one server.

Transition G 3 → G 4 : as servers are incorruptible, they can only partner with a client that shares the same R they got from an operator. Then, as the R are all differents, an unintended server will not partner. P(A wins G qexec,qres,t 3 ) = P(A wins G qexec,qres,t 4 ) Ending: the attacker has access to a superposition of authentication vectors such that none of the states contained in the superposition holds any significant information. Since the uncorrupted client needs the second message to accept, the attacker cannot ask the answer to the server or it will be a simple relay and then has to guess values M ac S generated by a perfect pseudo-random function with a Sqn C different from what he has seen. P(A wins G qexec,qres,q G 4 ) = q exec 2 |M ac S | Then by recalling the previous transitions, we get:

Adv(A) ≤ q exec 2 |M ac S | + q 2 exec 2 |R| + Adv(G)

Soundness Game

We define the soundness game as follows.

1. The challenger generates n C clients and n Op operators and their respective keys. Then the challenger generates q Op authentication vectors and reveal them to the attacker.

2. The attacker is the server for executions of the protocol with the clients decided by the attacker.

3. The attacker wins if he makes q Op + 1 executions of the protocol accept.

The protocol is (q exec , q res , q Op , t, ϵ)-server-sound if no attacker A running in time t with q exec executions of the protocol and q res re-synchronizations has an advantage Adv(A) = P(A wins) more than ϵ.

Theorem 7.4 (Soundness). The advantage on the soundness game for the UMTS-AKA protocol is bounded as follows:

Adv(A) ≤ q exec + q Op 2 |M ac S | + Adv(G) where q req = 10q exec + 5q Op + 4q res .

State Confidentiality Game

We define the state confidentiality game as follows.

1. The challenger generates n Op operators, n S servers and n C clients and their respective keys.

2. The attacker fixes a target (a client) and an operator.

3. The attacker corrupts any number of clients except the target.

4. The attacker is the server for executions of the protocol with the clients decided by the attacker. The protocol is (q exec , q res , q Op , t, ϵ)-state-confidential if no attacker A running in time t with q exec executions of the protocol, q res re-synchronizations and q Op authentication vectors asked by a corrupted server has an advantage Adv(A) = P(A wins) more than ϵ. where q req = 10q exec + 5q Op + 4q res .

Proof.

Game G 0 : this is the game defined just above.

P(A wins G

qexec,qres,q Op ,t 0

) = Adv(A)
Our first step is to replace structural elements with perfect ones.

Game G 1 : we define the game G 1 as the same as G 0 but we replace KD with a perfect key derivation KD ′ and G with a perfect pseudo-function G ′ on which there is no advantage.

Transition G 0 → G 1 : an attacker for G 0 either attacks G 1 or uses a property of KD or G. To put it in another way, one can use an attack against G 0 but fails against G 1 to distinguish between KD and KD ′ or between G and G ′ . One can easily use the same argument used in Section 7.3.1 with q req = 10q exec + 5q Op + 4q res requests 9 . P(A wins G qexec,qres,q Op ,t 0 ) ≤ P(A wins G qexec,qres,q Op ,t 1) +Adv(KD)

Idea of the Attack

The attack relies on the following property of Milenage.

For any value R 0 and R 1 for R, let us consider E(R 0 ⊕ sk Op,C ) = A∥B, E(R 1 ⊕ sk Op,C ) = C∥D, if A ⊕ B = C ⊕ D (probability 2 -64 to happen), then for x = SQN ∥AM F and b ∈ {0, 1}, F : b∥x → f 1 (R b , Sqn, AM F ) has a period 1∥(A ⊕ C). (This should not happen for a random function.)

We will fix R 0 and search for a R 1 such that F has a period. (Then querying F on 0∥x will give the value of F on 1∥(x ⊕ A ⊕ C), which also breaks the security of f 1 as a MAC function.)

Algorithm of the Attack

We present a quantum attack on Milenage that uses 2 57 computations (while searching the keys uses 2 128 computations as there are two 128-bit keys to recover).

Algorithm 7.1 Quantum attack on Milenage

Input: superposition oracle access to G, or a random function Output: "Milenage" or "Random" 1: Fix a value R 0 2: Grover search on R 1 with π 4 2 64/2 turns using the following oracle : If F is found to be periodic then 5:

the state (R 1 ) is "good" Else the state (R 1 ) is "bad" 6: EndGrover 7: Measure and check if a solution was found 8: If it was found return "Milenage" Else return "Random"

Security Proof of Milenage in AKA

The attack we showed has some extensive use of adaptive superposition queries on Milenage. However, the AKA protocol severely limits the possibilities for such queries. Thus, the above attack can be seen as only theoretical since hard to be put in practice in UMTS-AKA. Considering that, we below define a new game for the security of the primitive that reflects those constraints. We then prove that Milenage is quantum-secure using that "practical in-AKA" game.

In-AKA-distinguishing Game

We define the G-in-AKA-distinguishing game:

1. The challenger generates random independent keys in pure states sk C,1 ,..., sk C,n C and sk Op,C,1,1 , ..., sk Op,C,n C ,n Op for the studied pseudo-random With this mindset, we can obviously reduce the security of TUAK to the one of P with at most 4q queries.

Note on Keccak-f. We now have to give some evidence that the underlying permutation, namely Keccak-f, can be considered as quantum-secure. As Keccak-f[1600] is a permutation on 1600 bits, it means that the best general attack as a qPRF is to try and fail at finding a collision which takes at least 2 533 computations to do [START_REF] Zhandry | A Note on the Quantum Collision and Set Equality Problems[END_REF] compared to the 2 256 computations to brute-force the keys. Keccak-f has been studied in the classical case since the NIST SHA-3 competition in 2008. While the same cannot be said for the quantum case, the fact that no practical classical attack breaks more than 9 rounds out of 24 [START_REF] Suryawanshi | New Results on the SymSum Distinguisher on Round-Reduced SHA3[END_REF] (the best classical attack on the full permutation to our knowledge uses 2 1573 computations [START_REF] Yan | New zero-sum distinguishers on full 24-round Keccak-f using the division property[END_REF]) seems convincing that Keccak-f[1600] can be considered quantum-safe for now.

Conclusion

The UMTS-AKA protocol was designed in 1999 and intended to a classical world. With the advent of quantum computers, that multiple experts consider as imminent, it is necessary to take a new look at such protocols deployed in real life, which are used to protect the communication of billions of users. Assessing their security anew is therefore implied by the coming quantum era.

In this paper we have focused our attention on the UMTS authenticated key agreement, designed for the 3G telecommunication technology, and still at the basis of both 4G and 5G standards. This protocol is used every day by numerous users to protect their voice and data mobile communications.

We have defined a quantum version of the genuine AKA protocol. Starting from the work of Alt et al. we have derived a stronger quantum model which grants the adversary quantum computations as well as superposition queries. Then we have provided detailed security proofs of the quantum UMTS-AKA, showing that the quantum security of the protocol relies upon that of the underlying pseudo-random functions (f 1 , . . . , f * 5 ). Therefore, under the assumption that they are quantum-secure, the UMTA-AKA remains a secure scheme to protect users' communications. To the best of our knowledge this paper provides the first rigorous proof of the UMTS-AKA in a strong quantum setting.

As supplementary contributions, we also exhibit a new attack against the state confidentiality of a mobile user. This attack holds in the quantum as well as in the classical setting. We also describe a quantum existential forgery attack against the standalone f 1 function when instantiated with Milenage. We analyzed the quantum security of the underlying primitives of UMTS-AKA, Milenage and TUAK, and conclude that, if keyed with a 256-bit key, they are quantum secure as core functions of the UMTS-AKA protocol.

As a next work we aim at studying in a quantum setting the new properties of user's privacy and network's "awareness" that are provided in the 5G technology. With in mind the threat posed by quantum computing, the goal of the NIST's post-quantum competition is to motivate the design of quantumsecure asymmetric schemes. Likewise we hope that our work will contribute to the systematic analysis of the currently deployed protocols with regard to the quantum threat they will soon face, and help design secure quantum networks. For each i = 1, ..., n Generate (Quantum) Security Proofs. Our contribution in this domain is threefold.

| R i M ac i S M ac i C CK i , IK i AK i ⟩ Authentication ← ---------- vectors | R i M ac i S M ac i C CK i , IK i AK i ⊕ Sqn i ⟩ | R i M ac i S M ac i C CK i , IK i AK i ⊕ Sqn i ⟩ Challenge ← ------- | R i M ac i S AK i ⊕ Sqn i ⟩ | R i M ac i S AK i ⊕ Sqn i ⟩ Compute | R i M ac i S ⊕
• We obtained a IND-CCA security proof for our new construction that allows an (classical) attacker to use enough queries to hold a significant part of the sub-permutation codebook, a bound not common to achieve.

• We managed to make the first security proof against a quantum attacker which has access to encryptions and decryptions, making QuEME the first quantum-proof construction for block ciphers.

• We proved the security of Milenage and TUAK as primitives of a quantum UMTS-AKA.

Security Proofs for Quantum Protocols. We proposed a quantum version of the UMTS-AKA protocol and prove its security. To the best of our knowledge, this is the first rigorous proof of security of this kind of protocols in a full-quantum setting.

Open Problems

We end by proposing some open problems.

New Quantum Algorithms. Let us address the elephant in the room. While this thesis does not show any new quantum algorithmic brick, it certainly does not rule out the possibility of a new one changing the landscape of quantum cryptanalysis in a few years.

Even without inventing a such devastating algorithm, progress in known quantum algorithms is not out of the mind. An example may be Kuperberg's algorithm, which has seen many iterations of improvement since its discovery.

Quantum Cryptanalysis. Speaking of quantum cryptanalysis, there is still a lot to discover on hidden shift algorithm and their applications. For example, we exposed in this thesis a new way to use Simon's algorithm with substructures and broadening the type of properties that can be exploited. This technique was developed for the case of the Encrypt-Mix-Encrypt construction with the collision set. It could be useful to look for other structures (leading to more properties to be exploited) and other constructions (making it a more general approach).

Definition 1 . 2 (

 12 Qubit). A qubit is an element of C 2 with norm 1 i.e., an element of the form a |0⟩ + b |1⟩ with |a| 2 + |b| 2 = 1.

  2n

a

  i b j |i⟩⊗|j⟩ There are many possible notations for a concatenation of classical states: |i⟩ ⊗ |j⟩ = |i⟩ |j⟩ = |i, j⟩.

1 ) b |b⟩ • H maps |0⟩ to 1 √ 2 ( 1 √ 2 (

 11212 |0⟩ + |1⟩) and |1⟩ to |0⟩ -|1⟩). It is called the Hadamard gate.

Definition 1 . 12 (Definition 1 . 13 ( 1 2 n/ 2 2 n - 1 y=0 χ 2 n

 1121131212 Exchange gate). A last common gate (which can be built from CNOT) is SWAP, exchanging two qubits. Quantum Fourrier Transform). The Quantum Fourrier Transform (QFT) acts on n qubits and maps |x⟩ to (xy) |y⟩ where χ 2 n (x) = e 2ixπ 2 n .

Figure 1 . 2 :

 12 Figure 1.2: Quantum memory types

  |γ⟩) |Φ⟩ Then by projecting on |0⟩ |0⟩ |γ 0 ⟩ and |1⟩ |0⟩ |γ 1 ⟩, there is |ϵ⟩ orthogonal to |γ 0 ⟩ and |γ 1 ⟩ such that:

Figure 2 . 1 : 1 |X|

 211 Figure 2.1: Representation of a round of Grover's search routine.

4 |X|

 4 |Y | . We add, for further considerations, that the probability of success, i.e. the probability of measuring an element of Y at the end of Grover's algorithm is at least max(1 -|Y |/|X|, |Y |/|X|).

Figure 2 . 3 :

 23 Figure 2.3: Simon's routine

Algorithm 2 . 2 s mod 2 1: Compute O 2 √ 2 log 2 5 :L ′ ← ∅ 6 : 7 : 8 :else 12 :

 222222567812 Description of the Kuperberg's algorithm Input: superposition oracle access to F Output: (3)n elements |ψ b ⟩ and store them in a list L 2: k ← 2 log 2 (3)n 3: e ← 2n log 2 (3) 4: for i = 0 to ⌈e⌉ do while L contains two elements |ψ b ⟩ and |ψ b ′ ⟩ such that 2 ⌈k⌉ |(b -b ′ ) do Pop |ψ b ⟩ and |ψ b ′ ⟩ out of L Combine |ψ b ⟩ and |ψ b ′ ⟩ into |ψ B ⟩ 9: if B = b -b ′ then 10: Put |ψ B ⟩ into L ′ 11: Put |ψ B ⟩ back into L 13:

1

 1

Figure 3 .

 3 Figure 3.1: 3-round Feistel network

2 Figure 3 . 2 :

 232 Figure 3.2: Even-Mansour Cipher

Figure 3 . 4 :

 34 Figure 3.4: Evaluation function of the Grover's search

Contents 4 . 1

 41 The Legendre PRF and Context . . . . . . . . . . . . . . 60 4.2

Heuristic 4 . 1 .

 41 For all a, b ∈ Z

2 .

 2 Store all the extracted sequences (L (s/b+a/b) mod P , a, b) in a table.

3 .

 3 Sample c at random until (L c , a, b) appears in the table for some a, b. Such a collision yields a candidate key s such that: s/b + a/b = c =⇒ s = cb -a mod P . We can then test if this candidate is the good one with a few more computations. With Heuristic 4.1, there are no false positives, and s is the right key.

  3), where the amplified algorithm S Z * P consists in sampling an element x ∈ Z * P at random: S Z * P |0⟩ = x∈Z * P |x⟩ , and the test f consists in checking if L x = L s . By Heuristic 4.1, there is only one such solution. Thus the algorithm requires O(m √ P ) (quantum) Legendre symbol computations, in total O(m 3 √ P ) quantum gates.

Figure 4 . 1 :

 41 Figure 4.1: Combination circuit Combine v . Note the "control on 0" which applies the addition only if the qubit |ψ y 2 ⟩ is 0.

Theorem

Corollary 4 . 1 .

 41 If ν ≤ 1 4 and ϵ ≤ 1 4t , then the procedure of Theorem 4.2 succeeds with probability ≥ 1 8 .

Proposition 4 . 1 . 2 √

 412 Let α = 2 log 2 3. Problem 4.4 can be solved within a time O(2 √ αn √ I) using O(2 √ αn ) qubits, with constant probability. There are O(αn ) queries to g and O(2 √ αn √ I) queries to f (in superposition for both).

Theorem 4 . 3 .

 43 Given a sequence of M outputs of the Legendre PRF, we can solve the SLS problem using O 2√α log 2 M qubits, in quantum time:

Figure 5 . 1 :

 51 Figure 5.1: Last-round key recovery

4 p

 4 R ) (see the notations on Figure5.2).The distinguisher relies on the independence of E 2,L and E 2,R . It requires ↓ p ↑ encryptions-decryptions, operations and negligible memory. We repeat:1. select P 1 at random, set P 2 = P 1 ⊕ α and encrypt C 1 = E(P 1 ) andC 2 = E(P 2 ); 2. compute C 3 = (C 1,L , C 2,R ) and C 4 = (C 2,L , C 1,R );3. decrypt: P 3 = E -1 (C 3 ) and P 4 = E -1 (C 4 ).

Figure 5 . 2 :

 52 Figure 5.2: First-round mixing boomerang attack.

2 n 1 p 4 p

 214 in p ↓ p ↑ pairs at a cost of in p ↓ p ↑ computations and data.

4 : 5 :

 45 Use BHT algorithm to find a valid tuple (C1 , C 2 , C ′ 1 , C ′ 2 )Amplify 2 kout times 6:

Figure 5 . 3 :

 53 Figure 5.3: Classical boomerang attack on SAFER++ (reproduction of Fig. 4 in [21])

) 5 :

 5 Sort the C b and the C d by their right parts and keep the quartets (C a , C b , C c , C d ) such that C R b = C R d ⊕ 00100000. 6: Sort the quartets by their C L a ⊕ C L c and keep the pairs C a , C c that correspond to the most common value (we expect to get a group of 3 or more quartets).

Figure 5 . 6 :Figure 5 . 8 :Figure 5 . 9 :

 565859 Figure 5.6: Decomposition of 5-round AES

Figure 5 . 10 :

 510 Figure 5.10: Example of friend pairs

  ) and is solved by correspondence between differential and value in the S-box 7: Restart with other diagonals to get the full key 5.6.5 Quantum Attack Algorithm 5.12 Quantum attack on 5-round AES Input: access to E and E -1

15 :

 15 Restart with other diagonals to get the full key

10 :

 10 Apply Simon's algorithm on the resulting superposition with the function (

11 :

 11 Mark l in the list L Z 12:

Figure 6 . 3 :

 63 Figure 6.3: Results of simulations: logarithmic difference between simulation and conjectural prediction by number of equations (line is mean over 100 tries, area is variability)

  Pr[A wins Game1] = Pr[A wins Game2]. Game2 → Game3. We transform Game2 into Game3 by adding two random permutations on the top of QuEME E ′ . Game2: adding permutations to E b

  B f,E outputs exactly the same output as A f ′ ,E ′ so by definition, we have Pr[B wins Game1] = Pr[A wins Game4].

Contents 7 . 1

 71 The AKA Protocol . . . . . . . . . . . . . . . . . . . . . 158 7.1.1 The Classic Version of AKA . . . . . . . . . . . . 158 7.1.2 Quantum AKA Protocol . . . . . . . . . . . . . . 162 7.2 Adversarial Model and Building Blocks . . . . . . . . . . 165 7.2.1 Oracles . . . . . . . . . . . . . . . . . . . . . . . 166 7.2.2 Targeted Notions . . . . . . . . . . . . . . . . . . 168

  Keys. The client key (sk C ) is known by the client and the operator. From the latter and the operator key (sk Op ) an intermediate value (sk Op,C ) is derived as sk Op,C = KD(sk C , sk Op ). 1 The client stores sk Op,C while sk Op is known only to the operator. We note sks = sk C ||sk Op,C . Random Value. A fresh random value R is generated during each session, and used as challenge for the client. It aims at protecting the client and the operator from replay attacks. Sequence Number. The client and the operator keep respectively the secret values Sqn C and Sqn Op,C , which number the executions of the protocol, and prevent replay attacks against the client. A re-synchronization procedure may be executed in case of discrepancy.

Figure 7 . 1 :

 71 Figure 7.1: AKA protocol and re-synchronization procedure 160

  CorruptServer(S):This oracle corrupts the server S and gives the adversary access to a special oracle OpAccess.OpAccess(S, C) → m: for a corrupted server S, this oracle gives the adversary access to the server's local copy of all the operators, in particular returning the message that the operator Op would output to this server for initializing an execution of the protocol with the client C. (We do not consider superpositions of parties, and the output message can be a superposition.)RevealState(C, i, b) → Sqn C : for a client C, if b = 0, then this oracle reveals the current state of C i , else, if b = 1, then the oracle returns the state the operator stores for C (Sqn C is not a superposition).

) 5

 5 See footnote 4.

1 . 6 7. 3 . 3 . 1

 16331 use of the oracle Send(S, j, m) where m is the U ID of the client C, initializing the execution of the protocol; 2. use of the oracle Send(C, i, m ′ ) where m ′ is a projection of the output of Send(S, j, m). Weak Server-impersonation Resistance Game.

Theorem 7 . 5 (

 75 State confidentiality). The advantage on the state confidentiality game for the UMTS-AKA protocol is bounded as follows:Adv(A) ≤ Adv(G) qreq,t n Op ,n C +Adv(KD) t n Op ,n C + 8∆q exec 2 |Sqn C | + 1 2 |sk C | + 1 2 |sk Op,C | + 1 2 |sk Op |

3 :

 3 Apply Simon's algorithm on the functionF : b∥x → f 1 (R b , Sqn, AM F ) ▷ costs (5 × 64) 3 = 225 computations per use 4:

Figure 7 . 2 :

 72 Figure 7.2: Quantum version of the AKA protocol

  This chapter presents the tools of quantum computing used in the following chapters. It starts with a quick history of the domain and continues with the elementary notions of quantum computing: qubits, superposition, entanglement, operators and quantum complexity.

	Symbol Z R R + C z ⊕ +	Description set of integers set of real numbers set of non-negative real numbers set of complex numbers complex conjugate of z bit-wise xor integer addition Chapter 1
	•	inner product of vectors
	|A|	cardinal of the set A
	[b]	the boolean value of b (1 if b is true, 0 otherwise)
	≪	left shift
	val 2	2-adic valuation
	∥	concatenation
	rev	reversion

Contents 1.1 History . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.2 Fundamentals of Quantum Computing . . . . . . . . . . 18 1.2.1 Qubits . . . . . . . . . . . . . . . . . . . . . . . . 18 1.2.2 Quantum Circuits . . . . . . . . . . . . . . . . . 19 1.2.3 Notions for Quantum Algorithms . . . . . . . . . 22 1.2.4 Quantum Complexity . . . . . . . . . . . . . . . 25

  (Measuring a System of Qubits). When measured, a superposition i∈{0,1} n a i |i⟩ has a probability of |a i | 2 of collapsing to |i⟩. Contrary to a superposition, the result of a measurement can be read.

		1 √ 2 (|00⟩ + |11⟩).
	Definition 1.3 In circuits, it will be symbolized by	.

Definition 1.4 (Partial Measurement

). A superposition i,j∈{0,1} n a i,j |i, j⟩, when measured only on the first group of qubits, has a probability of j∈{0,1} n |a i,j | 2 of collapsing to |i⟩. The rest of the superposition becomes j∈{0,1} n a i,j j∈{0,1} n |a i,j | 2 |j⟩.

  Simon's Algorithm . . . . . . . . . . . . . . . . . . . . . . 33 2.6.1 Simon's Problem . . . . . . . . . . . . . . . . . .

		32
	2.5.1 Reducing Factorization to Period Finding . . . .	32
	2.5.2 Shor's Period Finding Algorithm . . . . . . . . .	32
	2.5.3 Reducing Discrete Logarithm to Period Finding .	33
	2.6 34
	2.6.2 Description of the Algorithm . . . . . . . . . . .	34
	2.6.3 Weakening Simon's Premise . . . . . . . . . . . .	35
	2.6.4 Simon's algorithm as a quantum circuit . . . . .	36
	2.7 Kuperberg's Algorithm . . . . . . . . . . . . . . . . . . .	36
	2.7.1 Kuperberg's Premise . . . . . . . . . . . . . . . .	36
	2.7.2 Description of the Algorithm . . . . . . . . . . .	37

2.1 Deutsch-Jozsa Algorithm . . . . . . . . . . . . . . . . . . 28 2.1.1 Premise . . . . . . . . . . . . . . . . . . . . . . . 28 2.1.2 Description of Algorithm 2.1 . . . . . . . . . . . . 28 2.2 Grover's Search . . . . . . . . . . . . . . . . . . . . . . . 29 2.2.1 Premise . . . . . . . . . . . . . . . . . . . . . . . 29 2.2.2 Classical Search . . . . . . . . . . . . . . . . . . . 29 2.2.3 Description of Grover's algorithm . . . . . . . . . 29 2.3 Amplitude Amplification . . . . . . . . . . . . . . . . . . 30 2.4 BHT Algorithm . . . . . . . . . . . . . . . . . . . . . . . 31 2.4.1 Premise . . . . . . . . . . . . . . . . . . . . . . . 31 2.4.2 Description . . . . . . . . . . . . . . . . . . . . . 31 2.5 Shor's Algorithm . . . . . . . . . . . . . . . . . . . . . . .

Contents 3

 3

.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 3.1.1 Kerckhoff's Principles . . . . . . . . . . . . . . . 42 3.1.2 Asymmetric Cryptography . . . . . . . . . . . . . 42 3.1.3 Symmetric Cryptography . . . . . . . . . . . . . 43 3.2 Elements of Symmetric Cryptography . . . . . . . . . . . 44 3.2.1 Block Ciphers . . . . . . . . . . . . . . . . . . . . 44 3.2.2 Stream Ciphers . . . . . . . . . . . . . . . . . . . 45 3.2.3 Hash Functions . . . . . . . . . . . . . . . . . . . 46 3.2.4 MACs . . . . . . . . . . . . . . . . . . . . . . . .

1: Start with the state |0 n ⟩ |0 n ⟩ 2: Apply the Hadamard gate on all qubits of the first register

	, obtaining the
	state x∈{0,1} n 1 2 n/2 |x⟩ ⊗ |0 n ⟩ 3: Apply the oracle |x⟩ |y⟩ → |x⟩ |y ⊕ E(x)⟩ to the state, obtaining
	1 2 n/2 4: Apply the CNOTs from the first register to the second one |x⟩ |y⟩ → x∈{0,1} n |x⟩ ⊗ |E(x)⟩
	|x⟩ |y ⊕ x⟩, obtaining 1 2 n/2 5: Apply the Hadamard gate on first register, obtaining the state x∈{0,1} n |x⟩ ⊗ |E(x) ⊕ x⟩
	1 2 n If E is a One-Time Pad, then it simplifies to |0 n ⟩ ⊗ |k⟩ x,y∈{0,1} n (-1) x•y |y, E(x) ⊕ x⟩
	If E is a random permutation, then the probability of measuring the state
	|0 n ⟩ in the first register is less than n 2 n . 6: Measure the first register and check if the result is 0 n

  Table-based Attacks . . . . . . . . . . . . . . . . . . . . . 62 4.2.1 Classical Algorithm . . . . . . . . . . . . . . . . . 62 4.2.2 Quantum Search with Early Abort . . . . . . . . 63 4.2.3 Distinguished Collisions . . . . . . . . . . . . . . 64 4.3 A Reversible Version of Kuperberg's Algorithm . . . . . . 66 4.3.1 The Decisional Hidden Shift Problem . . . . . . . 66 4.3.2 Kuperberg's Algorithm Made Reversible . . . . . 66 4.3.3 Label States and Label Qubits . . . . . . . . . . 67 4.3.4 Combining Two Labels Reversibly . . . . . . . . 68 4.3.5 Combining All Labels . . . . . . . . . . . . . . . 69 4.3.6 Behavior in the Non-shifted Case . . . . . . . . . 71 4.3.7 Bounding the Errors . . . . . . . . . . . . . . . . 71 4.4 Quantum Search with an Approximate Test . . . . . . . 72 4.5 The Offline-DAHS Algorithm . . . . . . . . . . . . . . . . 75 4.5.1 High-level Description . . . . . . . . . . . . . . . 75 4.5.2 Approximate Promise . . . . . . . . . . . . . . . 76 4.5.3 Application to the Legendre Symbol . . . . . . . 77 59 4.6 Detailed Complexities . . . . . . . . . . . . . . . . . . . . 78 4.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 78

  and only if f and g are a shifted pair, and ∥ |δ f,g ⟩ ∥ is bounded by a constant for all f, g satisfying the conditions of Problem 4.3. With t = O 2

√ αn , it contains O 2 √ αn quantum gates and ancilla qubits. With a factor r in time and memory complexity, we can reduce the bound on

  , if both f and g are injective, we have ϵ F N = |bad Y s| |all Y s| (and this does not depend from f and g). The classical analysis of Kuperberg's algorithm gives a constant probability of finding a good label if we start from O 2

√ αn of them. Thus, if we take copies of the combination circuit, we can obtain r good labels with probability 1 -ϵ if we start from O (-log 2 ϵ)r2 √ αn labels.

  |ψ⟩. However, the exact O f cannot be implemented, only an approximation O ′

f . Definition 4.1. An approximate test oracle for f , denoted O ′ f , is a unitary operator that maps:

  4.2 (Quantum search with approximate test). Let A, X, Y, θ = arcsin( |Y | |X| ), t = π 4θ be defined as in Section 2.2. Let f be a boolean function that tests if an output of A is "good", and let O ′ f be an approximate oracle for f with error ϵ, using an ancillary state |ψ⟩, as per Definition 4.1. Let |ψ ′ ⟩ be a quantum state such that ∥ |ψ⟩ -|ψ ′ ⟩ ∥ ≤ ν. We run the following algorithm:

Table 4 .

 4

	Method	Queries	Time	Memory	Source
				Classical algorithms
	Pollard's rho	√	P m	L	√	P m	m	[80]
	Table	M	M 2 + P m 2 /M 2	M 2 /m	[17]
	Table	M	M 2 + P m log 2 m/M 2	M 2	[74]
				Quantum algorithms
	Sup. queries		2	poly(m)	poly(m)	[42]
	Table (QRACM) Grover search	M m	M 2 + m 2 P/M 2 L log 2 m √ P L	M 2 QRACM [74] m qubits 4.2.2
	Distinguished points M	M 2

1: Comparison of classical and quantum algorithms to solve the SLS problem, including previous works and our new results. We note m = 3 ⌈log 2 P ⌉, α = 2 log 2 3, L ≤ (log 2 P ) 2 the time to compute a Legendre symbol, and we omit constant factors.

  Boomerang last-round attack Input: oracle access to E = R • E 2 • E 1 Output: guess of partial key K out involved in the round(s) R 1: Generate a structure S of 1 √ poutpq ciphertexts of the form:

fin at Step 4 of Algorithm 5.2. Algorithm 5.2

  .5)

	Algorithm 5.3 Quantum Boomerang Distinguisher
	Input:	superposition oracle access to E = E 2 • E 1 , or a random
	permutation
	Output: "E" or "Random"
	1: Repeat π 4 (pq) -1 times
	2:

  Sample a pair P 1 , P 2 = P 1 ⊕ α, compute P 3 , P 4 as in the distinguisher If P 3 ⊕ P 4 = α, then (P 1 , P 2 ) is "good"

	5:	Amplify	2 n |Dstart| times
	6:
	7:
	8:	EndAmplify
	9:	Amplify 2 k in times
	10:	Sample a guess of K in
	11:

  -122.8 .

	Top Boomerang: At the top, the difference is active in 6 bytes in positions
	1, 4, 5, 11, 14, 15. This difference propagates to a single active
	byte after one round (A Bottom Boomerang: In the lower part of the boomerang, we start with
	a difference 128 (changing one bit) in the 4 bytes at positions 2, 4, 5,
	12. By decrypting through S 4 A 4 , this yields a difference x, -x in bytes
	5 and 6 with probability 1. By decrypting through S 3 A 3 , this yields
	a difference active in bytes 3, 9, 11, 14 with probability 2 -7 . Then, by
	decrypting through A 2 , we can obtain a difference 128 in all bytes except
	2, 4, 9, 12 with probability 2 -30.4 .

0 • S 0 ) with probability 2 -40 , as there are 5byte conditions to meet. This difference is then mapped to a single active byte of difference 128 after the next nonlinear layer S 1 , with probability 2 -8 , and with probability 1, we obtain a difference 128 in bytes 0, 1, 2, 3, 8, 9, 11, 13, 14, 15 after A 1 . All other bytes are inactive.

  Search for KO 8,1 and KI 8,1 : EndAmplify 14: Search for KO 8,3 and KI 8,3 :

	4:	Amplify	√	2 32 times
					▷ ((2 32 ) 1/3 iterations using Ambainis)
	7:	EndAmplify
	8:	Check that the three quartets share the same value for C L a ⊕ C L c
	9: EndAmplify
					▷ The obtained quartets are correct
	10: 11: Amplify	√	2 32 times
	15: Amplify	√	2 32 times
	16:	KO 8,3 and KI 8,3 have to let a possibility for KL 8,1
	17: EndAmplify
	18: Search for KO 8,2 and KI 8,2 : 19: Amplify √ 2 32 times
	20:

5:

Pick a C a , C c , compute C b , C d 6: Check if C d = C b ⊕ 00100000 12:

KO 8,1 and KI 8,1 have to let a possibility for KL 8,2 13:

  72/3 plaintexts P A

	3:	Amplify 2 19 times
	4:

  72/3 plaintexts P A By encrypting under K A and decrypting under K C , create the set S C Create a single plaintext P B ▷ P B belongs to a space of size 2 7×9 = 2 72 , by the choice of P A Encrypt under K B , decrypt under K D , obtain P D Check if there is P C ∈ S C such that: P C ⊕ P D is 0 in the 7 inactive bytes wanted, and the condition at Step 5 is also satisfied (2 bytes)

	7:
	8:	Amplify 2 2×72/3 times
	9:
	10:
	11:
	12:	If there is, return P D
	13:	EndAmplify
	14:	Find P D
	15:	Check if the quartet P A , P B , P C , P D yields key guesses	▷
		probability 2 -19
	16:	If it does, return it
	17:	EndAmplify
	18:

  ≃ 2 59.9 2 10.15 (2 25 + 225.65 ) ≃ 296.4 .(5.11)

	2 • 2 58.9 2	π 4	√	2 19 2 • 2 72/3 + 4	π 4	2 72/3 + negl. + negl.

  in (P 3 , P 4 )

	6:	EndAmplify
	7: 8:	Sample two other friend pairs for verification Amplify √ 2 8 times

9:

  6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 115 6.2 General Related Concepts . . . . . . . . . . . . . . . . . 117 6.2.1 Mirror Theory . . . . . . . . . . . . . . . . . . . 117 6.2.2 H-Coefficient Technique . . . . . . . . . . . . . . 119 6.3 Applying Simon's Algorithm to Functions Restricted on a Subset . Quantum Security Statement . . . . . . . . . . . 144 6.8.3 Discussion . . . . . . . . . . . . . . . . . . . . . . 147 6.9 Proposing a Concrete Instance: Double-AES . . . . . . . 148 6.9.1 How to Extend the Keys? . . . . . . . . . . . . . 148 6.9.2 Introducing a Domain in AES for Defining E j . . 149 6.9.3 Double-AES Concrete Proposals . . . . . . . . . 149 6.9.4 Security Claims . . . . . . . . . . . . . . . . . . . 150 6.9.5 Discussion . . . . . . . . . . . . . . . . . . . . . . 150 6.10 Best Attacks Found of Double-AES . . . . . . . . . . . . 151 6.10.1 Attack on X-3-3 Without Last M C in Blocks E 1 , E 2 and E. . . . . . . . . . . . . . . . . . . . . . 151 6.10.2 Attack on X-2-X Without Last M C in Blocks E 1 , E 2 and E. . . . . . . . . . . . . . . . . . . . . . 153 6.10.3 Best known attacks on AES . . . . . . . . . . . . 154 6.11 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 154

	. 131
	6.5.4 IND-CPA Security Proof of (2n/3)-bit Security . 133
	6.5.5 IND-CCA Security Proof of (2n/3)-bit Security . 135
	6.6 Simulation of the Mirror Theory . . . . . . . . . . . . . . 138
	6.7 An O(2 n )-Distinguisher on our Scheme . . . . . . . . . . 141
	6.8 Quantum Security . . . . . . . . . . . . . . . . . . . . . . 143
	6.8.1 Hardness of Distinguishing a Random Permutation
	from a Random Function with Small Range . . . 144
	6.8.2

. . . . . . . . . . . . . . . . . . . . . . . . . . . 120 6.4 Constructions Based on Encrypt-Mix-Encrypt Paradigm: First Attempt and Attack . . . . . . . . . . . . . . . . . . 121 6.4.1 New Superposition Attack on the EME Construction 122 6.5 New Construction and Classical Security Proofs . . . . . 125 6.5.1 Proof of Classical Security . . . . . . . . . . . . . 126 6.5.2 IND-CPA Security Proof of n-bit Security using Mirror Theory . . . . . . . . . . . . . . . . . . . 128 6.5.3 IND-CCA Security Proof of n-bit Security using Mirror Theory . . . . . . . . . . . . . . . . . .

List of Round-reduced Attacks We

  expose a quick list of the best known attack against round-reduced AES-128 in the different settings.

	Attack	Rounds Time Data Reference
	Mixture Differential	5	2 21.5 2 21.5	[8]
	Yoyo	5	2 33	2 13.3	[105]
	Partial Sum	5	2 40	2 8	[115]
	Rectangle	5	2 23	2 9	[49]
	Rectangle	5	2 16.5	2 15	[49]
	Improved Square	5	2 35	2 33	[55]
	Boomeyong	5	2 49	2 49	[104]
	Rectangle	6	2 80	2 26	[49]
	Partial Sum	6	2 44	2 34.5	[55]
	Truncated Differential	6	2 78.7 2 71.3	[7]
	Boomeyong	6	2 79.72 2 79.72	[104]
	Impossible Differential	7	2 117.2 2 112.2	[88]
	Meet-in-the-Middle	7	2 116	2 116	[50]
	Impossible Differential	7	2 113 2 105.1	[30]
	Impossible Differential	7	2 110.9 2 104.9	[87]
	Meet-in-the-Middle	7	2 99	2 97	[44]

Table 6 .

 6

1: Current cryptanalysis for round-reduced AES-128 in the secret-key model.

  The end of the protocol goes as follows. The client measures M ac i S ⊕ M ac ′i S to verify that it equals 0, and sends an abort message if not. Then it measures Sqn i and checks if the challenge is fresh, i.e., Sqn i ∈ [Sqn C + 1, Sqn C + ∆]. Finally the client answers the challenge, and sets Sqn C to Sqn i . The server checks the answer by measuring M ac i C ⊕M ac ′i C , and proceeds as in the classical protocol. If Sqn i / ∈ [Sqn C + 1, Sqn C + ∆], the client triggers a re-synchronization procedure. First it computes the superposition

	Re-synchronization.

  CreateClient(Op) → (sk C , ID C , Sqn C ): this oracle (used by the challenger) creates a client C with unique identifier ID C , the client's secret keys sk C and sk Op,C = KD(sk C , sk Op ) and the sequence number Sqn C . The tuples (ID C , sk C , sk Op,C , Sqn C ) are associated with the client ID C and with the corresponding operator Op (i.e., each "copy" of Op in each server does this). The operator sets Sqn Op,C := Sqn C and then keeps track of Sqn Op,C . The adversary is given ID C . CreateOperator() → (sk Op , ID Op ): this oracle (used by the challenger) creates an operator Op with unique identifier ID Op , the operator's secret keys sk Op . The adversary is given ID Op .

* 5

and KD through their specifications.

CreateServer(Op) → (ID S ): this oracle (used by the challenger) creates a server S with unique identifier ID S . The challenger makes a secure channel between the new server and the operator Op. The adversary is given ID S .

  RevealSession(P, i) → {K, ⊥}: this oracle can be used just after an execution of the protocol. If the party has not terminated in an accepting state, this oracle outputs ⊥, else it outputs the session keys K = (CK, IK) computed by P i on the last execution involving P i (as explained in Section 7.1.2 the session keys are expected to be a superposition of values).

CorruptClient(C) → (sk C , {sk Op,C }): this oracle corrupts C and returns the long-term client key sk C and sk Op,C (not in superposition), but not sk Op as the client is not given the operator keys.

  qreq,t n Op ,n C + Adv(KD) t n Op ,n C + q exec 2 |M ac C |

  5. The attacker sends a tuple (sk C , sk Op,C , sk Op , n, Sqn C,n ), wins if he guesses right any of the values sk C , sk Op,C , sk Op or Sqn C,t which is the value Sqn C at the end of the execution n of the target client, and the client is still fresh.

|X|-|Y | |x⟩.This corresponds to the red symmetry in Figure

2.1.

The attacker uses the given black box.

The attacker guesses if the given black box is an implementation of the block cipher or permutation, and wins if it is right.

Although we did not find its explicit definition in previous works, it appears in the simulation code of[START_REF] Bonnetain | Hidden Shift Quantum Cryptanalysis and Implications[END_REF].

It is easy to see that D S ⊆ Bj.

As all known block ciphers, we cannot provide security against superposition related-key attacks.

skOp is denoted as OPC in Milenage and T OPC in TUAK.

This process separates the used memory of previous executions entangled with the attacker and the memory in new executions of the protocol.

This is the amount of generated functions since for each couple (C, Op) there is a generation of G.

We do not consider the last message of the protocol in the client-impersonation game as it does not interfere with the client acceptance.

This is the number of generated functions since for each couple (C, Op) there is a generation of G.

There is two values for R ′ as only Out1 is computed

Upper Key Addition: bytes in S 1 of the 16-byte round key are XOR-ed to the corresponding bytes of the block and the others are added modulo 2 8 .

Nonlinear Layer: it uses two functions X and L: X(a) = (45 a mod 257) mod 256, L(a) = log 45 (a) mod 257 and L(0) = 128, (5.7) where L is the inverse of X. Bytes in S 1 go through X and bytes in S 2 go through L.

Lower Key Addition: another 16-byte round key is added to the state, using modular addition in S 1 and XOR in S 2 .

Linear Layer: it repeats twice the following: a permutation of the bytes, followed by a Pseudo Hadamard Transform to groups of 4 bytes. This linear layer contains a total of 48 modular additions of individual bytes and can be described by the matrix given in [START_REF] Biryukov | Cryptanalysis of SAFER++[END_REF].

5-Round Classical Boomerang Attack

We present the attack from [START_REF] Biryukov | Cryptanalysis of SAFER++[END_REF]. It relies on a boomerang distinguisher on 4.5 rounds of SAFER++. If A denotes the linear layer and S the nonlinear layer (X and L), the distinguisher works against a sequence A 0 S 1 A 1 -S 2 -A 2 S 3 A 3 S 4 A 4 .

It would work against 4 rounds if any S-Boxes were used, but it reaches an additional 0.5 round thanks to the following property of the inverse-based S-Boxes in SAFER++:

∀a, X(a) ⊞ X(a ⊞ 128) = 1 mod 256 .

(5.8)

The top part of the boomerang starts with pairs of plaintexts having difference α = (0, x, 0, 0, x, x, 0, 0, 0, 0, 0, -4x, 0, 0, x, -x). This difference is such that it maps to a single active byte after A 0 , and up to 16 active bytes after A 1 • S 1 .

The difference added to ciphertexts is: δ = (0, 0, 128, 0, 128, 128, 0, 0, 0, 0, 0, 0, 128, 0, 0, 0) .

After S -1 4 •A -1 4 , it maps to a difference (0, 0, 0, 0, 0, x, -x, 0, . . .) with probability 2 -7 (not 2 -8 because the difference 128 maps to odd differences through X).

Then after A -1 3 , bytes 3, 9, 11 and 14 are active. In order to traverse the middle S-Box, the authors observe that if the bytedifferences coming both from the top and the bottom part of the boomerang are 128, then the boomerang traverses this S-Box layer for free. Indeed, if we encrypt P 1 , P 2 = P ⊞ 128 through X, we obtain X(P ), 1 ⊟ X(P ), i.e., two values that sum to 1. If the difference coming from the bottom part is 128, transcript τ . The vertices of G are the q 1 distinct values L 1 , . . . , L q 1 in the set {L i | i ∈ [1..q]} and the q 2 distinct values R 1 , . . . , R q 2 in the set {R i | i ∈ [1..q]} (we'll soon specify how we pick these labels); we put an edge between L j and R k if they appear together in some query, i.e., there is a query i ∈ [1..q] with (L i , R i ) = (L j , R k ). H is defined identically except with the ciphertexts {(S i , T i ) | i ∈ [1..q]} replacing the plaintexts in the above definition of G.

Let α (resp. β) be the number of components in G (resp. H). We label these components G (1) , . . . , G (α) and H (1) , . . . , H (β) . For t ∈ [1..α] let q (t) 1 (resp. q (t)

2 ) be the number of L-nodes (resp. R-nodes) in G (t) . Similarly, for t ∈ [1..β] let q (t) 3 (resp. q (t) 4 ) be the number of S-nodes (resp. T -nodes) in H (t) . Define the cumulative sums

for each j ∈ [1..α] when b ∈ {1, 2} and each j ∈ [1..β] when b ∈ {3, 4}. We assume the labelling of the L-nodes in G is such that the nodes

} are in G (j) , and likewise for the R-nodes, S-nodes, and T -nodes.

Classical Security Claim.

We claim the following security bound for QuEME π . Theorem 6.6. For any classical adversary A playing a q-query IND-CCA game against QuEME π , we have

For any classical adversary A ′ playing a q-query IND-CCA game against QuEME E with q ′ offline queries to E, we have

The proof of this relies on the conjectured Tight Mirror Theorem (Theorem 6.2). A simulation supporting the conjecture following an innovative approach can be found in Section 6.6.

Four Proofs. In this section, we present four classical security proofs for QuEME π . Section 6.5.2 describes a proof of IND-CPA security up to n bits using the Mirror Theorem; Section 6.5.3 gives a proof of IND-CCA security up to n bits using the Tight Mirror Theorem; Section 6.5.4 shows a proof of IND-CPA security up to 2n/3 bits without any mirror theoretic assumptions; and finally, Section 6.5.5 shows a proof of IND-CCA security up to 2n/3 bits without any mirror theoretic assumptions. In each of the proofs we first describe the sampler for the internal transcripts and its bad events, then provide a bound for the bad events, and finally bound the ratio of good probabilities to apply the Coefficient-H Technique and derive the desired security bound.

IND-CPA Security Proof of n-bit Security using Mirror Theory

In this subsection we prove the following result.

Theorem 6.7. For any classical adversary A playing a q-query IND-CPA game against QuEME π , under the assumption that the Mirror Theorem (Section 6.2.1) holds, we have

For any classical adversary A ′ playing a q-query IND-CPA game against QuEME E with q ′ offline queries to E, we have

Sampler of Internal Transcripts.

Here we'll define the sampler S which takes

.q]} as input and samples a

.q]}. The sampling proceeds as follows:

1. S first samples two independent n-bit random permutations π * 1 and π * 2 . Then it sets

2. Let Γ be the set of all 2q-sequences ( S 1 , T 1 , . . . , S q , T q ) satisfying the following conditions:

Then S samples ( S 1 , T 1 , . . . , S q , T q ) uniformly at random from the set Γ.

Bad Events. We define the following bad events on the random coins of f and S:

IND-CPA Security Proof of (2n/3)-bit Security

In this subsection we prove the following result.

Theorem 6.8. For any classical adversary A playing a q-query IND-CPA game against QuEME π , we have

For any classical adversary A ′ playing a q-query IND-CPA game against QuEME E with q ′ offline queries to E, we have

For this proof we change the second step of the sampling procedure of Section 6.5.2. We observe that for each j ∈ [1..ℓ], once a value is assigned to S i j , it induces a value on S i , T i for each i ∈ C j , according to the following rules:

Since C j is connected, all nodes in C j are guaranteed to be covered in this manner. We refer to this as extending S i j to all of C j .

S uses two (initialised as empty) sets D S and D T , to tabulate the sampled values of S i and T i respectively; every time a value is assigned to some S i or T i , it is added to the corresponding table. For a subgraph C of G τ (which can be seen as a subset of the queries), D S|C and D T |C will respectively denote D S and D T restricted to C. The connected components will be considered listed by decreasing size.

Step 1 is the same as in Section 6.5.2. In Step 2 S samples S 1 uniformly at random from {0, 1} n and extends S 1 to all of C 1 , and for each j ∈ [2..ℓ] S samples over C j as follows:

1. it computes the banned set B j defined with the following condition: if and only if S i j is assigned a value in B j and extended to all of C j , at least one of the sets D S|C j ∩ D S and D T |C j ∩ D T will be non-empty; Adversary å for distinguishing the QuEME π construction from a random permutation

and get respective outputs (y i 1 ||y i 2 ).

• Let H = span{⃗ e x i

Then, the next 2 n columns are the same but we replace π 1 with π 2 , and similarly with the third and last where we have π -1 3 and π -1 4 respectively instead of π 1 . So we can write

Because π 1 , π 2 , π 3 , π 4 are permutations, the matrix M contains at least 2 different non-zero lines, therefore dim(M ) ≥ 2. Also notice that

when the above holds, this immediately implies that dim(H j+1 ) = dim(H j ) + 1. Since M = 4N , this then implies that with overwhelming probability dim(H M ) ≥ N -1.

Quantising the distinguisher. So far we have not found any quantum versions improving the complexity, and we do not believe that this distinguisher can benefit of any speed-up in the quantum setting.

Quantum Security

In this section, we study the quantum security of our constructions. We will show that the QuEME π has n/6 bits of quantum security. While this is not an as strong statement as in the classical setting, it implies at least that the security does not totally collapse when we consider quantum adversaries as is the case for the 3-round Luby-Rackoff construction [START_REF] Kuwakado | Quantum distinguisher between the 3-round Feistel cipher and the random permutation[END_REF].

To prove this statement, we will actually reduce the quantum security to classical security (in a non-tight way) using Zhandry's lower bound on small range functions. We then show how to prove our quantum security statement in this framework. Finally, we discuss our results and ways of improving these quantum security claims. motivating its study, with a unified security claim regarding classical and quantum attackers. We believe the number of rounds of AES-128 considered in the building blocks can be reduced. We propose 7 rounds and 5 rounds if the final M C is not omitted in E 1 , E 2 and E, where we claim equal security than with 10 rounds, but we believe an interesting question would be whether we manage to attack a variant with less rounds, as our best attack reaches X-3-3 rounds (so any number of rounds in the first layer, and three in the middle and final layers), or 2 rounds in the middle one, for any number of rounds in the upper and lower instances. Related-key attacks on AES might also have an interesting application in this case because of the middle block.

We leave this as an interesting open question to break a variant with 5-5-5 rounds, or 6-6-6, that should be harder, as the structural distinguishers could be exploited. Another option would be to consider variants with less rounds in the middle block than in the four external ones. How low could we go?

We know attacks exists with only 2 rounds in the middle, for any number of rounds in the external applications.

Random Value. The random R does not need to be stored from one session to another. Therefore it is a matter of choice to keep it in classical state or superposition state. As the latter is a generalization of the former, we allow for the random values to be used in superposition. The operator can generate authentication vectors in superposition, and the attacker is allowed to send superposition queries to client and server parties.

Confidentiality and Integrity Keys.

As R is allowed to be in superposition, we expect the session keys CK and IK to be in superposition too.

Challenge Generator.

In the classical case [4], R is expected to be an unpredictable value from {0, 1} |R| . In a quantum setting, R are elements of C 2 |R| . Therefore our expectations of its randomness are meant to change. While the pseudo-random functions f 1 , ..., f 5 , f * 1 , f * 5 now have to resist quantum attacks, one could think the generation of R would face a similar challenge. Yet our security proofs only involve few properties of such a generator.

Expectations. We expect the function that generates R = 2 |R| -1 i=0 a i |i⟩ to have the following properties:

• a newly generated R is not entangled to any other R;

We want the random generator to produce independent uncorrelated values as we want to take care of minimal long-term values (we have the keys for black-boxing f 1 , ..., f 5 , f * 1 , f * 5 and Sqn for resistance toward replay attack). We want also the random generator to have a good distribution to make use of the full space of possible challenges.

Useful Property for Security Proofs in Later Sections. Then we have the following property: with

|i⟩ is a possible option of generation that respects our expectations. While this challenge generation does not contain any randomness, it still has the properties we need. Indeed, as the further computations of f 1 , ..., f 5 , f * 1 , f * 5 entangle R with other elements of the protocol that are uncomputable by the adversary, the underlying measurement results in the variability of the protocol.

Pseudo-random Function

As seen in Section 7.1, the protocol's security depends on the functions

implemented with either Milenage or TUAK. We need to assess how they impact the protocol security. For convenience, we denote

Following Alagic, Broadbent, Fefferman, Gagliardoni, Schaffner, Jules [3] and Zhandry [START_REF] Zhandry | How to Construct Quantum Random Functions[END_REF], we estimate the protocol's security based on the security of G. As such, the latter is defined by the ability to distinguish a group of implementations of G from random functions with the property that only the outputs of f 1 and f

and 7n

Op n C random functions. 3 The challenger gives the attacker either the random functions or the pseudo-random ones as a quantum black box O f i,sk C,j ,sk Op,C,j,j ′ such that

2. The attacker can use the given function in quantum circuits.

3. The attacker guesses if the given black box is an implementation of the pseudo-random functions or random ones, and wins if is is right.

The pseudo-random function is (q, t, n Op , n C , ϵ)-indistinguishable if no attacker A running in time t with q uses of any black box O f i,sk C,j ,sk Op,C,j,j ′ has an advantage Adv(A) = 2(P(A wins) - 1 2 ) more than ϵ. We also define Adv(G) q,t n Op ,n C = sup A {Adv(A)}. Note that our definition is similar to what is usually depicted as advantage on a secret-key quantum pseudo-function. The main difference is the reuse of sk C with different sk Op,C . This notion makes related-key attacks happen faster than the standard case having the full keys being random when the key difference is on sk Op,C .

Pseudo-random Key-derivation

Through corruption, one can reasonably expect some keys sk C and sk Op,C to get leaked. Such an event can occur but should not reveal anything about any sk Op or unleaked sk C and sk Op,C . As said in Section 7.1, the sk Op,C are obtained through a key derivation function KD. We define the advantage on KD against both of these issues.

Advantage on a Pseudo-random Key-derivation Function. We define the game about the pseudo-randomness of KD as a key-derivation function as follows. 2 ) more than ϵ. We also define Adv(KD) t n Op ,n C = sup A {Adv(A)}. Note that guessing a value sk Op is an attack. For one operator, this game can be seen as a known-plaintext game for the pseudo-random function sk C → KD(sk C , sk Op ).

Quantum Security of the UMTS-AKA Protocol

In this section, we present detailed definitions of the security properties by means of games executed between a challenger and an attacker. Then, we prove the attacker's advantages on those games to be negligible with the use of secure primitives. In this section, we consider a generic secure pseudo random function G. As said above, it can be instantiated using either Milenage or TUAK. The exact quantum security of those two instances are studied in Sections 7.4 and 7.5 respectively.

Session Keys Indistinguishability

Freshness: session keys indistinguishability. An instance P i is fresh if the adversary has not used the oracles CorruptClient, CorruptServer or RevealSession on P i or on any of its partners.

Session Keys Indistinguishability Game.

We define the session keys indistinguishability game as follows.

1. The challenger generates n Op operators, n S servers and n C clients and their respective keys.

2. The attacker fixes a target (a server or a client) and an operator.

3. The attacker is an active MitM for executions of the protocol whose participants are decided by the attacker.

4. The attacker uses the T est query on a fresh instance of the target.

5. The attacker is an active MitM for executions of the protocol whose participants are decided by the attacker (second phase).

6. The attacker guesses the secret bit b of the T est query. The attacker wins if the guess is right and the target instance is still fresh.

The protocol is (q exec , q res , q Op , t, ϵ)-strongly key-indistinguishable if no attacker A running in time t with q exec executions of the protocol, q res resynchronizations and q Op authentication vectors asked by a corrupted server (outside an execution of the protocol) has an advantage Adv(A) = P(A wins)-1 2 more than ϵ.

Theorem 7.1 (Session Keys Indistinguishability). The advantage on the session keys indistinguishability game for the UMTS-AKA protocol is bounded as follows:

where q req = 10q exec + 5q Op + 4q res .

Proof. Game G 0 : this is the game of the definition.

Our first step is to replace structural elements with perfect ones.

Game G 1 : we define the game G 1 as the same as G 0 but we replace KD with a perfect key derivation KD ′ on which there is no advantage.

Transition G 0 → G 1 : an attacker for G 0 either attacks G 1 or uses a property of KD. To put it in another way, one can use an attack that is successful against G 0 but fails against G 1 to distinguish between KD and KD ′ . More formally, using the best adversary A 0 for G 0 , we can build an adversary A KD for the game against KD.

Then by recalling the previous transitions, we get:

Client-impersonation Resistance

Freshness: client-impersonation resistance. An instance P i is considered fresh if the adversary has not used the oracles CorruptClient or CorruptServer on P i or on any of its partners.

Relay: client-impersonation. The attacker is considered to be a simple relay during an execution of the protocol between a server instance S j and a client instance C i if the following events happened in the following order:

1. use of the oracle Send(S, j, m) where m is the U ID of the client C, initializing the execution of the protocol;

2. use of the oracle Send(C, i, m ′ ) where m ′ is a projection of the output of Send(S, j, m);

3. use of the oracle Send(S, j, m ′′ ) where m ′′ is a projection of the output of Send(C, i, m ′ ).

Client-impersonation Resistance Game.

We define the client-impersonation resistance game as follows.

1. The challenger generates n Op operators, n S servers and n C clients and their respective keys.

2. The attacker fixes a target (a server) and an operator.

3. The attacker is allowed to corrupt any number of clients and servers except the target.

4. The attacker is an active MitM for executions of the protocol whose participants are decided by the attacker.

5. The attacker wins if he successfully breaks the client-impersonation resistance for the target server, i.e., makes the target server instance accept, is still fresh and either the server instance is not partnered with the intended client, the server instance is partnered with a non intended client or the attacker has not been a simple relay.

Game G 3 : we define the game G 3 as the same as G 2 but there is only one server now.

Transition G 2 → G 3 : as servers are interchangeable in the sense that the values exchanged do not depend on the server, we essentially make the attacker unable to corrupt servers. Since corruption of servers only gives access to authentication vectors which would be given during an execution and reveal, the queries from a corrupt server are now counted as additional executions of the protocol: q ′ exec = q exec + q Op . For the next games, those additional executions will be marked as not valid for wining the game, q valid = q exec is the number of valid executions for wining. The first executions are the marked ones and the valid ones are last, doing so does not remove generality.

exec ,qres,q valid ,t 3

)

Game G 4 : we define the game G 4 as the same as G 3 but the challenger now generates the R i before the game and measures the property of R i being all different.

Transition G 3 → G 4 : with our specifications on the generation of R i , the probability of not measuring this property is about q ′2 exec 2 |R| .

P(A wins G q ′

exec ,qres,q valid ,t 3

and some R i are equal) +P(A wins G q ′ exec ,qres,q valid ,t 3

and the R i are all differents) P(A wins G q ′ exec ,qres,q valid ,t 3

) ≤ (q ′ exec ) 2 2 |R| + P(A wins G q ′ exec ,qres,q valid ,t 4

)

Ending: The attacker has access to a superposition of authentication vectors such that none of the states contained in the superposition holds any significant information. Since the uncorrupted server needs the first and the last message in that order to be able to accept the execution, the attacker cannot ask the answer to the client or it will be a simple relay and then has to guess values M ac C generated by a perfect pseudo-random function with a R i different from what he has seen.

P(A wins G q ′

exec ,qres,q valid ,t 4

) = q valid 2 |M ac C | Then by recalling the previous transitions, we get:

Weak Server-impersonation Resistance

Freshness: server-impersonation resistance. An instance P i is considered fresh if the adversary has not used the oracles CorruptClient or CorruptServer on P i or on any of its partners.

Proof.

Game G 0 : this is the game defined just above.

Our first step is to replace structural elements with perfect ones.

Game G 1 : we define the game G 1 as the same as G 0 but we replace KD with a perfect key derivation KD ′ and G with a perfect pseudo-function G ′ on which there is no advantage.

Transition G 0 → G 1 : an attacker for G 0 either attacks G 1 or uses a property of KD or G. To put it in another way, one can use an attack against G 0 but fails against G 1 to distinguish between KD and KD ′ or between G and G ′ . One can easily use the same argument used in Section 7.3.1 with q req = 10q exec + 4q res requests 7 .

P(A wins G

qexec,qres,q Op ,t 0

Our next step is to reduce the configuration to one client, one server and one operator.

Game G 2 : we define the game G 2 as the same as G 1 but there is only one client and one operator.

Transition G 1 → G 2 : as G ′ and KD ′ are perfect, the keyed G ′ are uncorrelated. Therefore the attacker does not have benefits from having other clients or operators. An attacker for G 2 could simply simulate other uncorrupted clients by reusing the target client and corrupted clients by generating random keys for an attacker in G 2 . As in G 0 → G 1 , a difference would mean an advantage over KD ′ or G ′ . P(A wins G qexec,qres,q Op ,t 1 ) = P(A wins G qexec,qres,q Op ,t 2 ) Game G 3 : we define the game G 3 as the same as G 2 but the challenger now generates the R i before the game and measures the property of R i being all different.

Transition G 2 → G 3 : with our specifications on the generation of R i , the probability of not measuring this property is about q 2 exec 2 |R| . P(A wins G qexec,qres,t 3 ) = P(A wins G qexec,qres,t 3 and some R i are equal) +P(A wins G qexec,qres,t 3 and the R i are all differents) P(A wins G qexec,qres,t 3 ) ≤ (q exec ) 2 2 |R| + P(A wins G qexec,qres,t 4 )

7 See footnote 4. There is no server corruption (i.e., qOp = 0).

Proof.

Game G 0 : this is the game defined just above.

P(A wins G

qexec,qres,q Op ,t 0

Our first step is to replace structural elements with perfect ones.

Game G 1 : we define the game G 1 as the same as G 0 but we replace KD with a perfect key derivation KD ′ and G with a perfect pseudo-function G ′ on which there is no advantage.

Transition G 0 → G 1 : an attacker for G 0 either attacks G 1 or uses a property of KD or G. To put it in another way, one can use an attack against G 0 but fails against G 1 to distinguish between KD and KD ′ or between G and G ′ . One can easily use the same argument used in Section 7.3.1 with q req = 10q exec + 5q Op + 4q res requests 8 .

P(A wins G

qexec,qres,q Op ,t 0

Our next step is to reduce the configuration to one client and one operator.

Game G 2 : we define the game G 2 as the same as G 1 but there is only one client and one operator.

Transition G 1 → G 2 : as G ′ and KD ′ are perfect, the keyed G ′ are uncorrelated. Therefore the attacker does not have benefits from having other clients or operators. An attacker for G 2 could simply simulate other uncorrupted clients by reusing the target client and corrupted clients by generating random keys for an attacker in G 2 . As in G 0 → G 1 , a difference would mean an advantage over KD ′ or G ′ . P(A wins G qexec,qres,q Op ,t 1 ) = P(A wins G qexec,qres,q Op ,t 2 ) Ending: then the attacker has to guess values M ac S generated by a perfect pseudo-random function with a Sqn C different from what he has seen.

Then by recalling the previous transitions, we get:

State Confidentiality

Distinguishing Attack against State Confidentiality

During the process of establishing a proof of security for the state confidentiality, we discovered an attack which is able to distinguish the real value of Sqn C from a random one by recovering at least the last bit of Sqn C . The process is the following.

1. The operator and client are synchronized.

2. The (malicious) server queries two following authentication vectors AV 1 and AV 2 (Sqn 2 = Sqn 1 + 1).

3. The client initiates an authentication request.

4. The server authenticates the client using AV 1 (as normal).

5. The server ends the conversation causing the client to request an authentication.

6. The server authenticates the client using AV 1 causing a re-synchronization procedure.

7. The server registers the value AK * (R 1 ) ⊕ Sqn 1 .

8.

A new authentication procedure is immediately started.

9. The server authenticates the client using AV 2 (as normal).

10. The server ends the conversation causing the client to request an authentication.

11. The server authenticates the client using AV 1 causing a re-synchronization procedure.

12. The server registers the value AK * (R 1 ) ⊕ Sqn 2 .

13. From those two values, the server gets Sqn 2 ⊕ (Sqn

This new value is of the form 0 . . . 01 . . . 1 where the number of 1 is one more than the 2-adic valuation of Sqn 2 . Then, if there is exactly one "1", the last bit of Sqn 2 is a "1", otherwise it is a "0".

Freshness: state confidentiality. An entity P is fresh if the adversary has not used the oracles CorruptClient or RevealState on any instance of P . Our next step is to reduce the configuration to one client and one operator.

Game G 2 : we define the game G 2 as the same as G 1 but there is only one client and one operator.

Transition G 1 → G 2 : as G ′ and KD ′ are perfect, the keyed G ′ are uncorrelated. Therefore the attacker does not have benefits from having other clients or operators. An attacker for G 2 could simply simulate other uncorrupted clients by reusing the target client and corrupted clients by generating random keys for an attacker in G 2 . As in G 0 → G 1 , a difference would mean an advantage over KD ′ or G ′ . P(A wins G qexec,qres,q Op ,t 1 ) = P(A wins G qexec,qres,q Op ,t 2) Ending: the attacker can only win by sending the correct value for sk C , sk Op,C or sk Op or getting a right couple (n, Sqn C,n ).

For obtaining the secret keys, since G ′ and KD ′ are perfect, the attacker can only guess them.

Since the attacker is the server, it controls and knows the differences Sqn C,n+1 -Sqn C,n of the value Sqn C at times n and n ′ (which by design is between 1 and ∆).

From executions and synchronizations, the attacker only gets Sqn Op,C,n ⊕ AK n and Sqn C,n ⊕ AK * n . Since G ′ and KD ′ are perfect, the attacker can only learn Sqn C,n ⊕ Sqn C,n ′ when R n is the same as R n ′ (which can happen since the attacker can use an old authentication vector and get the result from the synchronization procedure).

The attacker then can learn the value of all the bits of Sqn C,n that changes throughout the game. For example, Sqn C ⊕(Sqn C +1) is of the form 0 . . . 01 . . . 1 where the number of 1 is one more than the 2-adic valuation of Sqn C + 1 (the details of this property change with the value of the difference between the successive values but the principle remains the same). As we expect around log(∆q exec ) + 3 bits to be affected, the probability for the attacker of guessing a good couple (n,

Then by recalling the previous transitions, we get:

In the above security analysis, we have idealized the core pseudo-random function and our purpose in the sequel is to study the quantum security of the two standardized implementations: Milenage and TUAK.

Quantum Security of Milenage

In the last section, we proved security properties of the UMTS-AKA protocol assuming the security of the primitives underneath. We resolve this point in this section, discussing the quantum security of Milenage, and the next one, TUAK.

Description of Milenage

Milenage is a construction based on a block cipher noted E that acts on 128-bit messages (AES).

Key Derivation. The keys sk

From the input R (128 bits), Sqn (48 bits), AM F (16 bits), intermediate values T and I are computed as

Then five values are computed as follows:

•

• f 1 outputs the first 64 bits of out 1 .

• f * 1 outputs the last 64 bits of out 1 .

• f 2 outputs the last 64 bits of out 2 .

• f 3 outputs out 3 .

• f 4 outputs out 4 .

• f 5 outputs the first 48 bits of out 2 .

• f * 5 outputs the first 48 bits of out 5 .

Attack on Milenage as a Pseudo-Random Function

We show an attack against Milenage as a pseudo-random function using the Grover-meets-Simon framework (Section 3.4.4.2).

functions

7n

Op n C random functions 10 . The challenger will use either the random functions or the pseudorandom ones as a quantum black box O f i,sk C,j ,sk Op,C,j,j ′ such that

2. The challenger now simulates the AKA protocol with the chosen oracles.

The attacker can ask for executions of the protocol where he is a Man-

In-the-Middle and has access to corrupted servers.

4. The attacker guesses whether the protocol is using G or random functions and wins if the guess is right.

A pseudo-random function is (q exec , q res , q Op , t, ϵ)-strongly in AKA-indistinguishable if no attacker A running in time t with q exec instances of the protocol, q res re-synchronizations and q Op authentication vectors asked by a corrupted server (outside an execution of the protocol) has an advantage Adv(A) = P(A wins) -1 2 more than ϵ. From the structure of UMTS-AKA, an execution of the protocol uses only G twice: once for generating the authentication vectors and once to verify them. Note that in order to get an interesting answer from the client, the attacker needs to pass through the client verification with a different element. The verification of the server is not an oracle since it exclusively uses the authentication vector it is given, which the attacker has also access to). For simplicity, we give the attacker the values out 1 ,out 2 ,out 3 ,out 4 ,out 5 instead of

with no loss of generality (we actually give more to the attacker this way). We recall that Sqn and AM F are classical values. Then we can replace the previous game with the following (named G 0 ) which is obviously exactly equivalent to the one above. There is no difference in winning one or the other game. and access to black-box verification functions F 1 and F * 1 that take quantum superpositions of states |x, y⟩ and measures whether y = f 1 (x, Sqn, AM F ) and y = f * 1 (x, Sqn, AM F ) respectively and give the result on a classic bit.

3. The attacker is free to interact with those elements.

4. The attacker guesses whether the challenger is using G or random functions and wins if the guess is right.

The number of given authentication vectors is bounded by q vect = q exec + q Op , the number of calls to F 1 is bounded by q F 1 = q exec and, the number of calls to F * 1 is bounded by q F * 1 = q res . We now show that Milenage is G-in-AKA indistinguishable by proving the following theorem.

Theorem 7.6 (G-in-AKA indistinguishability). The advantage on the G-in-AKA indistinguishability game for Milenage is bounded as follows:

where q req = 6q vect + 2q F 1 + 2q F * 1 . The rest of the subsection is dedicated to proving this theorem.

Use of E. We define the game G 1 as the same as G 0 except in Milenage we use a perfect quantum pseudo-random permutation E ′ instead of E and a perfect key derivation KD ′ instead of KD. Lemma 7.6.1.

The attacker either uses a property of E with at most q req = 6q vect + 2q

Use of Multiple Clients. As we now deal with a perfect block cipher, the different elements obtained through the different clients are unrelated. The total advantage is the sum of the advantages against each client. We show that for one client, the advantage is less than

|M ac S | . The resources of the attacker (access to authentication vectors, calls to F 1 and F * 1 ) are spread between the clients (q vect = clients q vect,client , q F 1 = clients q F 1 ,client and, q F * 1 = clients q F * 1 ,client ).

187

Then the total advantage is less than clients

, which is still less than

|M ac S | . We only consider the case of one client for the rest of the proof.

Use of Verification Functions. We define an intermediate game G ⟩) and measures whether any R i equal R ′ and abort in this case 3. The challenger gives the attacker the authentication vectors and access to black-box verification functions F 1 and F * 1 that take quantum superpositions of states |x, y⟩ and measures whether y = f 1 (x, Sqn, AM F ) and y = f * 1 (x, Sqn, AM F ) respectively and gives the result on a classical bit. 4. The challenger gives the attacker a value R ′ ,h a R ′ ,h |R ′ , h⟩ such that R ′ is measured to never be equal to a previous R i .

5. The attacker is free to interact with those elements.

6. The attacker guesses the value of any part of G(R ′ , Sqn, AM F ) (f 1 , f * 1 , out 2 , out 3 , out 4 , out 5 ) and wins if the guess is right.

Lemma 7.6.2. For every R ′ ,

Proof. As we want to consider all possible R ′ , the attacker uses F 1 or F * 1 either on an R ′ or on a previous R i . However, the attacker gains nothing by querying F 1 or F * 1 on a previous R i (the result is already known). Then we consider the attacker to only query F 1 or F * 1 on a R ′ . Then on a R ′ , either the result is "true" and we can declare the attacker to win, or the result is false and it continues. Either way, the measurement can be done at the end of the game with the final guess. Then having q F 1 access to F 1 and q F * 1 access to F * 1 only multiplies the probability of success.

There are two cases, either one of the internal value of the computation matches one that appeared for one of the previous R i , which happens with probability less than 12qvect 2 |R| , 11 or there is no collision and the attacker has to guess a random value such that there is no internal collision between R ′ and any R i .

Note that there is no gain to take more R ′ or a smaller part. In the first case, the attacker would have to spread the calls to F 1 or F * 1 between the different values R ′ to attack. In the second case, F 1 and F * 1 would only give a partial answer and the advantage of the attacker compared to a perfect G would not grow.

Randomness of the Initial Vectors. We showed that vectors outside the initial ones cannot be used efficiently. We now focus on the initial vectors. The verification function are trivial on those ones, and we can then dispose of them. We define the game G 3 as distinguishing the authentication vectors given to the attacker from vectors generated by a perfect pseudo-random function.

Lemma 7.6.3.

There are two cases, either one of the internal value of the computation matches one that appeared for one of the previous R i or there is no collision. The first one happens with probability less than 25q 2 vect 2 |R| . The second one means the attacker has only the fact that there is no internal collision between the computations of out 1 , out 2 , out 3 , out 4 , out 5 (which gives the same advantage).

Note on AES. AES has been studied in the classical case for over 20 years. While the same cannot be said for the quantum case, the work of Bonnetain, Naya-Plasencia and Schrottenloher [START_REF] Bonnetain | Quantum Security Analysis of AES[END_REF] seems convincing that AES can be considered quantum-safe for now.

Security of the Key Derivation.

As stated in 7.2.4, the model for evaluating the key derivation is a known-plaintext model on AES. It can be considered safe.

Note on the Advantage on E. The use of fixed superposition may mislead us to think only the classical security of E is needed. However, an example for a quantum attack happening is the one-time pad distinguisher (Section 3.4.1). This distinguisher happens with only one query on H |0⟩ against a one-time pad (where a classical distinguisher would need at least two queries) as G is a kind of one-time pad when E is a one-time pad. In this section we discuss the security of TUAK, which is based on a permutation noted P (in practice, it is Keccak-f[1600] [START_REF]Specification of the TUAK algorithm set: A second example algorithm set for the 3GPP authentication and key[END_REF]). The following description concerns the highest size of elements (keys and MACs are 256-bit long). The lower sizes only have some tweaks on the IN ST AN CE value and only output a subset of their higher size counterparts. We note rev(M ) the reversion of M , a * M to be the message M repeated a times and ALGON AM E to be the 56-bit value of the ASCII representation of "TUAK1.0".

Key

Security Arguments of TUAK.

From a security perspective, we look at P as a pseudo-random function taking on input the key sk Op,C on positions 0 to 255 and the key sk C on positions 512 to 767. Any attack on P would be considered as an attack against the permutation.

Chapter 8 Conclusion

In this conclusion, we recap the work done in those three years of thesis and give perspectives and open problems.

Summary of Results

The contributions made in this thesis are quite diverse.

Quantum Algorithm. We developed the first instance of an offline Kuperberg algorithm i.e., a quantum algorithm that from classical queries, recovers a hidden shift using Kuperberg algorithm. We applied it to the Shifted Legendre Symbol problem successfully. This method is interesting as it rivals asymptotically the table-based collision search, which needs to use QRAM, a supplementary assumption. It is also the only known algorithm of this kind besides is the Offline-Simon algorithm.

Quantum Cryptanalysis. Our contribution in this domain is twofold.

Quantization of Classical Attacks. We proposed an efficient quantum boomerang attack, as well as a variant for mixing boomerang attacks. We proposed several improvements for different cases, as reducing the quantum RAM needed or making Q2 attacks work in Q1 under certain circumstances. In some cases, our attacks reach a quadratic speedup with respect to classical attacks. This shows that boomerang attacks are also performant cryptanalysis tools for the post-quantum world, that will be needed for correctly determining the best security margins.

New Quantum Attack. We presented a new kind of Simon-based attack on the EME construction. While a period does not appear in "Offline" Quantum Algorithms. While the current "offline" quantum attacks require the knowledge of the intricacies of the original attack to realize, these original attacks are a direct application of Simon's or Kuperberg's algorithm. It would be interesting to look at other quantum attacks relying on those algorithms. Another approach is to look for other quantum algorithms to make offline algorithms. A possibility could be lying with the linearization attacks.

Quantum Tools for Security Proofs. While the field of security proofs against quantum adversaries has evolved to adapt many tools from the security proofs against classical adversaries, many are still missing. The most immediate step is to make a "recording" oracle for random permutations on the base of what exists for random functions.

Quantum Protocols. Our work on the UMTS-AKA protocol is a beginning for quantum protocols relying on the security of smaller primitives. A possibility of continuation is to look for other properties, like privacy claimed for the 5G version of the UMTS-AKA protocol. Another possibility is looking for other protocols.