Henri Ludovic

Henri Gilbert

Stacey Jeffery

Antoine Joux

Gregor Leander

Bart Preneel

Damien Vergnaud

Anaïs

Andrea André

Anne Anthony

Augustin, Christelle, Christina, Christophe Antonio Clara

Clémence, Daniel, Étienne, Ferdinand Florian

Ivan Gaëtan

Pierre, Rémi, Ritam, Rocco, Rodolfo, Sébastien, Shibam, Shizhu, Simon Pascale Paul

Simona Shouvik

Thomas

Vivien Valentin

Yann B Xavier

Ronald Cramer

Marc Stevens

Anne André

Akinori, Gaëtan Antonio

Jean-François Ferdinand

Léo

María Lorenzo

Nicolas

Patrick

Paul, Rémi, Ritam, Sam Paul

Sébastien, Thomas Virginie Xavier

Yannick

Yixin

Gaëtan, Léo, Lucca, Matthieu, Pierrick, Serge, Stéphanie, Steve Emmanuel Véronique

Keywords: Symmetric cryptography, cryptanalysis, post-quantum security, quantum algorithms, merging algorithms, lightweight cryptography. v

Comment décrire ces trois ans 1 de recherche au sein de l'équipe SECRET 2 ? N'ayons pas peur des mots, et puisque les concerné(e)s sauront m'excuser d'un tel lyrisme, je lance : ce fut un privilège. Aussi trois pages de remerciements ne donneront-elles qu'une approximation éhontée de ce que je dois à toutes celles et ceux qui m'ont aidé, soutenu, encouragé ou que j'ai tout simplement croisés sur ce parcours. Je vais en citer une partie ; il ne manquera pas seulement une personne, mais des dizaines, et je leur présente d'avance mes excuses : vous êtes aussi ici, entre les lignes.

En premier lieu, merci à María pour avoir dirigé cette thèse avec une implication, une disponibilité et un enthousiasme qui rendirent ma vie de thésard somme toute assez facile. Merci à André pour être parvenu à m'inculquer un peu de calcul et de preuves quantiques 3 . Merci à

Wir müssen unser Dasein so weit, als es irgend geht, annehmen; alles, auch das Unerhörte, muß darin möglich sein. Das ist im Grunde der einzige Mut, den man von uns verlangt: mutig zu sein zu dem Seltsamsten, Wunderlichsten und Unaufklärbarsten, das uns begegnen kann.

Nous devons accepter notre existence aussi largement qu'il se peut ; tout, même l'inoui, doit y être possible. C'est au fond le seul courage que l'on exige de nous : être courageux envers ce qui, venant à nous, est le plus bizarre, le plus étonnant, le moins éclaircissable.

Rainer Maria Rilke, Briefe an einen jungen Dichter [START_REF] Rilke | Lettres à un jeune poète. Trans[END_REF] Introduction xix

Introduction

Cryptography aims at protecting information, transmitted through insecure channels, against adversaries trying to access or to control it. This science has certainly accompanied all types of human communication, from written letters to radio messages, and its history features a gallery of prominent historical figures, from Julius Caesar to Alan Turing. But it did not settle down as a branch of mathematics until the course of the 20th century, and more precisely, as a branch of complexity theory, which studies the hardness of computational problems.

Computational security. In our era of digital communications, modern cryptographic tools are mathematical objects which provide some security guarantees up to computational assumptions. These assumptions say how hard it should be, for the adversary, to solve a well-defined mathematical problem. For example, the RSA public-key scheme [START_REF] Rivest | A Method for Obtaining Digital Signatures and Public-Key Cryptosystems[END_REF], arguably the most widely known cryptosystem of modern times, relies on the hardness of factoring natural integers. Factoring algorithms have been well-studied, and the best known algorithm to date is the General Number Field Sieve [START_REF] Arjen | The development of the number field sieve[END_REF]. Thus, when two users Alice and Bob set up their communication protocol, they parameterize it so that the eavesdropper Eve, using the GNFS, cannot recover the prime factorization within a reasonable time.

In a secure communication protocol, RSA will often be used only once per session, in order to set up a shared secret between the participants, denoted a symmetric key. Afterwards, Alice and Bob will rely on a secret-key cryptosytem, such as AES-GCM encryption. Again, the security of AES-GCM is a computational assumption: it is conjectured that, in order to decrypt the exchanged messages, Eve has no other choice but to try all possible keys, which is infeasible if the number of keys is sufficiently large.

Our confidence in these assumptions relies on a continuous, public and independent re-evaluation of them. New algorithms may be designed, and new attacks may be found, that may challenge our initial security assumptions. Since deprecating and updating cryptographic standards takes a long time, cryptography must always be (more than) one step ahead.

Making cryptography lightweight.

At the dawn of the digital era, Alice and Bob were two humans using personal computers. Today, the number of devices connected to the Internet exceeds by far the world population, and the Internet of Things (IoT) experiences a steady growth. Alice and Bob are now more likely to be two smart devices, xix sensors, vehicles, routers, communicating and reporting without any human interaction or supervision. The smaller and ubiquitous these devices become, the stronger the constraints in terms of computing power, bandwidth or latency. Early cryptographic algorithms were not designed with these constraints in mind, and can perform badly in these new environments. Therefore, the last decade has seen the rise of new algorithms, aiming at lower implementation costs, energy consumption, and a better balanced between security and efficiency: this is lightweight cryptography (a nice overview of these algorithms can be found in [START_REF] Biryukov | State of the Art in Lightweight Symmetric Cryptography[END_REF]). However, being lightweight should not come at the expense of new weaknesses, and these new designs must undergo the same public scrutiny.

In 2019, the American National Institute of Standards and Technology (NIST) launched a standardization process for new lightweight cryptographic primitives [START_REF]Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process[END_REF]. Out of 56 first-round candidates, 32 of them passed to the second round on August 30, 2019 [START_REF]Status Report on the First Round of the NIST Lightweight Cryptography Standardization Process[END_REF].

The quantum paradigm shift. The concept of a universal quantum simulator was proposed in the early 1980s by visionary physicists. Simulating the evolution of a complex quantum mechanical system is a hard problem for today's computers. But if the simulator was a controlled quantum system itself, it would be possible to reproduce any other system with fidelity. The first physicists working in this direction rapidly understood that this quantum simulator would be a quantum computer, running quantum algorithms, with a new notion of complexity [START_REF] Deutsch | Quantum theory, the Church-Turing principle and the universal quantum computer[END_REF]. Thus, quantum complexity theory was born. But the first major achievements of quantum computing appeared later in 1994, with Simon's [START_REF] Daniel | On the Power of Quantum Computation[END_REF] and Shor's [START_REF] Shor | Algorithms for Quantum Computation: Discrete Logarithms and Factoring[END_REF] algorithms. The former showed the first exponential speedup of a black-box problem. The latter posed a direct threat to some classical cryptosystems, which unluckily happened to be some of the most widely used, including RSA.

Guessing when a scalable quantum computing architecture will be available to Eve, if it happens to be technically (and economically) feasible, is a perilous exercise that we shall not attempt here. While technologies make constant progress, major engineering problems still need to be solved. In 2019, a team of researchers supported by Google announced having performed a quantum computation (sampling the distribution of random circuits) that outperformed the best classical simulator available [START_REF] Arute | Quantum supremacy using a programmable superconducting processor[END_REF], a milestone inconveniently named quantum supremacy. This means that today's quantum architectures are becoming faster than their classical elders at some very specific tasks, although they haven't seen practical applications yet.

Cryptography in the post-quantum future. Future quantum computers can have an impact on today's secrets. This fact was summarized by Mosca [START_REF] Mosca | Cybersecurity in a quantum world: will we be ready?[END_REF] in a statement known today as Mosca's theorem. Let 𝑋 be the amount of time for which Alice and Bob expect their communication to remain secure. Let 𝑌 be the time necessary to transition to quantum-secure cryptography. Let 𝑍 be the time to build a large-scale quantum computer with applications to cryptography. Then if 𝑋 `𝑌 ą 𝑍, the communications xx that were exchanged at time 𝑌 , before the transition, could be revealed to the malicious Eve earlier than their expiration date (Figure 1). This is why the mere possibility of a quantum Eve in an undefined future is a sufficient motivation to seek and explore post-quantum designs today. This view has been notably embraced by the NSA, which made in 2015 a public statement recommending a transition to post-quantum systems. In 2016, the NIST launched a standardization process for quantum-secure public-key cryptosystems [START_REF]Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process[END_REF], in replacement to those broken by Shor's algorithm. Out of 69 submissions, 26 second-round candidates were announced in 2019, including 17 public-key encryption and key-establishment systems, and 9 digital signatures. In July 2020, NIST announced the third-round "finalist" candidates (4 for public-key encryption and key-establishment and 3 for digital signatures) alongside 8 "alternate" algorithms advancing to the third round, but unlikely to be standardized at the end of the third round.

But these public-key systems represent only a subset of the cryptographic tools used in today's digital infrastructures.

Post-quantum symmetric cryptography. In today's protocols, public-key cryptosystems intervene usually in the architecture that enables Alice and Bob to agree on a secret (certificates, public-key infrastructures, key-exchange mechanisms). But in order to have confidence in the protocol, we ask for security guarantees of all its components; and most of the transiting data is encrypted under a secret key 𝑘, using a standard symmetric cipher such as [AES].

Symmetric ciphers are usually regarded as less structured, as they do not need to embed any trapdoor. Quantum algorithms with an exponential speedup, such as Shor's, seem inapplicable. Despite this fact, it was known very early on that Grover's generic search algorithm [START_REF] Lov | A Fast Quantum Mechanical Algorithm for Database Search[END_REF] would speed up the exhaustive search of the key by a quadratic factor. In order to bring this computational effort back to the same level as classical exhaustive search, a simple solution seems to double the length of the keys [START_REF]Quantum Computing: Progress and Prospects[END_REF]. Fortunately, a standard such as [AES] allows keys of 128 as well as 256 bits. xxi Gimli, in which the internal state is divided into medium-sized blocks that are processed in a similar way (bundles in Shadow and columns in Gimli). In Spook, we observe that some round constants used to break the symmetry between bundles in Shadow can cancel each other out, which negates their effect. This allows to propagate symmetric states inside the permutation. In combination with an efficient truncated differential pattern, we exhibit a practical limited-birthday distinguisher on the full Shadow. Next, we present a practical forgery attack on the candidate Spook using Shadow reduced to two thirds of its original rounds. These results won the "Mathematical cryptanalysis 1" challenge proposed by the designers 1 and motivated a tweak in their submission [START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF].

In Gimli, we also target first the permutation from [START_REF] Daniel | Gimli : A Cross-Platform Permutation[END_REF]. We remark that the simple linear layer used in Gimli does not diffuse enough between the columns, and that symmetric columns can be propagated backwards and forwards on many rounds. Using a guess-and-determine approach, we design an internal symmetry distinguisher on the full Gimli, with a practical variant on 23 of its 24 rounds. Next, we use the same design pattern in collision attacks on the hash function of the Gimli submission package, reaching 12 rounds (8 practical) and 18 rounds for semi-free-start collisions. Finally, we extend these collision attacks in the quantum setting.

Chapter 9 (Quantum Security Analysis of AES). This chapter is based on a joint work with Xavier Bonnetain and María Naya-Plasencia [BNS19b] which was published in the second issue of Transactions in Symmetric Cryptology (ToSC) 2019. This work also introduced the nested search framework presented in Chapter 2.

One of the most well-known block ciphers to date is the current standard [AES]. In this chapter, we perform the first quantum security analysis of AES, in the secretkey model. Indeed, despite a massive amount of classical cryptanalysis, only generic exhaustive search of the keys had been studied so far in the quantum setting. The new quantum key-recovery attacks presented here help us to draw a first estimation of the security margin of AES in the quantum setting. They rely on classical design patterns. However, quantizing classical attacks is a non-trivial task, since by definition, a quantum key-recovery must compete against quantum exhaustive search of the keys, that is, Grover's algorithm. After discussing the attack strategies that could be applied, we present in detail the two families that give new results. First, we quantize the square attacks on 6-round and 7-round AES variants, using Q1 queries only and quantum memory with quantum random access. Next, we present our best attack, which reaches 8 rounds out of 14 for AES-256, the variant which is usually recommended for postquantum security. This attack uses a Demirci-Selçuk Meet-in-the-Middle design pattern, but differs significantly from its classical counterparts. We show that it can use Q1 queries, classical memory and a small amount of qubits only (with no quantum random access). Surprisingly, our adaptation to the quantum setting gives also new ideas for classical attacks of this type. 1 The challenges are detailed on their webpage: www.spook.dev/challenges xxv Chapter 10 (Saturnin). This chapter is based on a joint work with Anne Canteaut, Sébastien Duval, Gaëtan Leurent, María Naya-Plasencia, Léo Perrin and Thomas Pornin, which was submitted to the NIST LWC process [START_REF] Canteaut | Saturnin. Submission to NIST-LWC (2nd Round)[END_REF] and published in a special issue of ToSC [Can+20].

We introduce the Saturnin suite, a candidate of the NIST lightweight standardization project, now in the second round. Saturnin is a block cipher with 256-bit keys and 256-bit blocks. Saturnin-CTR-Cascade is an authenticated cipher with associated data (AEAD), and Saturnin-Hash is a 256-bit hash function. The guiding principle of Saturnin is that post-quantum security should not be sacrificed for lightness, and it should be possible to obtain both with an appropriate design. The increased block size of Saturnin overcomes some limitations of AES. The cipher is designed as to have an efficient bitsliced implementation, while admitting an abstract representation that appears to be close to an AES with a bigger state, and a simpler key-schedule. Thus, it inherits most of our knowledge on the security of AES, including the analysis of Chapter 9 in the quantum setting. The AEAD and Hash constructions use quantum-secure block cipher modes of operation.

We detail below other results that will not be presented in this document.

Quantum slide attacks. Classical slide attacks are powerful key-recovery attacks that rely on self-similarities in iterated ciphers such as Substitution-Permutation Networks or Feistel schemes. These attacks have the unique property of performing independently from the number of iterates of the construction. Introduced in [START_REF] Kaplan | Breaking Symmetric Cryptosystems Using Quantum Period Finding[END_REF], quantum slide attacks translate the self-similarity into a promise problem. This problem is solved using a quantum shift-finding algorithm with an exponential acceleration, such as Simon's algorithm. With Xavier Bonnetain and María Naya-Plasencia, we performed a comprehensive study of slide attacks in the classical literature and of quantum variants. These results were published at SAC 2019 [BNS19a].

Generic algorithms for golden collision search. We studied algorithms for collision search when a single collision (the golden collision) has to be found. The best attack on the NIST post-quantum candidate SIKE [START_REF] Jao | Supersingular Isogeny Key Encapsulation[END_REF] is a generic golden collision search. With Samuel Jaques, we improved the known quantum algorithms without quantum random-access. These results did not threaten the parameter choices of [START_REF] Jao | Supersingular Isogeny Key Encapsulation[END_REF], but showed the potential of quantum walk algorithms even without qRAM, under the assumption that errors in the quantum architecture are self-corrected. These results were published at SAC 2020 [JS20].

Quantum algorithms for the subset-sum problem. The random subset-sum problem aims to find, given 𝑛 integers of Z 𝑀 (𝑀 » 2 𝑛 ), a subset of them that sums to a given target. Although no cryptosystem based on subset sums is considered for standardization by the NIST post-quantum project, this problem borders on generic decoding, and has cryptanalytic applications such as quantum key-recoveries of CSIDH [BS20]. The best classical algorithms to date are merging algorithms using the xxvi representation technique of Howgrave-Graham and Joux [START_REF] Howgrave | New Generic Algorithms for Hard Knapsacks[END_REF]. With Xavier Bonnetain, Rémi Bricout and Yixin Shen, we improved both the classical and quantum algorithms for subset-sums. In the classical setting, we used extended representations and loosened constraints to reach a better time complexity than previous work [START_REF] Becker | Improved Generic Algorithms for Hard Knapsacks[END_REF]. In the quantum setting, we designed the first quantum subset-sum algorithm using quantumaccessible classical memory, improved the time complexity in all models and worked around a heuristic on quantum walk algorithms that previous works were dependent on. These results were published at ASIACRYPT 2020 [Bon+20].

Security analysis of CSIDH. CSIDH [START_REF] Castryck | CSIDH: An Efficient Post-Quantum Commutative Group Action[END_REF] is a proposal for a non-interactive key-exchange based on an Abelian group law, using elliptic curves at its core. Although it is not a candidate of the NIST post-quantum project, as it was proposed slightly later at ASIACRYPT 2018, CSIDH triggered a massive amount of research. Contrarily to most proposals, the best quantum attack has more than a quadratic advantage with respect to the best classical attack, as it uses Kuperberg's Abelian hidden shift algorithm [START_REF] Kuperberg | A Subexponential-Time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF] or its variants. These algorithms have a subexponential complexity, whereas the best known classical algorithm is exponential. The security levels of the proposed parameters in [START_REF] Castryck | CSIDH: An Efficient Post-Quantum Commutative Group Action[END_REF] were only conjectured. Due to the gap between classical and quantum complexities, a precise analysis of the quantum attack is paramount, since this attack alone defines the security level. With Jean-François Biasse, Xavier Bonnetain, Benjamin Pring and William Youmans, we studied asymptotic trade-offs in a hybrid (mixed quantum and classical) attack against CSIDH based on a variant of Kuperberg's algorithm. This work was published in the Journal of Mathematical Cryptology [Bia+19]. With Xavier Bonnetain, we performed a non-asymptotic study, both of the hidden shift algorithms and the other factors in the attack. We showed that the initial parameters of [START_REF] Castryck | CSIDH: An Efficient Post-Quantum Commutative Group Action[END_REF] offered a lower security than conjectured, not comparable with the security levels of the NIST call that they intended to match. This work was published at EUROCRYPT 2020 [BS20].

xxvii

Notation and Acronyms

We recapitulate here the main notations and acronyms used throughout this thesis. Usually, 𝑛 will be an integer parameter and we will compare asymptotic complexities in 𝑛 using the Bachmann-Landau notations of complexity theory: big O, small o, big Omega, big Theta. We use polyp𝑛q to denote a polynomial of 𝑛.

𝑓 p𝑛q " 𝒪p𝑔p𝑛qq 𝑓 p𝑛q " 𝑜p𝑔p𝑛qq 𝑓 p𝑛q " Ωp𝑔p𝑛qq 𝑓 p𝑛q " Θp𝑔p𝑛qq

, / / . / / - ðñ $ ' ' & ' ' %
D𝐶 ą 0, D𝑛 0 , @𝑛 ą 𝑛 0 , |𝑓 p𝑛q| ď 𝐶 ¨𝑔p𝑛q @𝐶 ą 0, D𝑛 0 , @𝑛 ą 𝑛 0 , |𝑓 p𝑛q| ă 𝐶 ¨𝑔p𝑛q D𝐶 ą 0, D𝑛 0 , @𝑛 ą 𝑛 0 , |𝑓 p𝑛q| ě 𝐶 ¨𝑔p𝑛q 𝑓 p𝑛q " Ωp𝑔p𝑛qq and 𝑓 p𝑛q " 𝒪p𝑔p𝑛qq By convention, tuples of "small" size (typically polynomial in 𝑛) are numbered starting from 1 and lists of "big" size (typically exponential in 𝑛) are numbered starting from 0. Note that some of these notations overlap (for example, 𝑆 will denote the AES S-Box, the Shadow S-Box, a Gimli state) but should nevertheless remain clear from context.

Acronyms

xxxiv Chapter 1

Introduction to Quantum Computing

We open this chapter with an overview of the main principles of quantum computing, for the purpose of presenting the main quantum algorithms of Section 1.4 and Chapter 2. More details can be found in the celebrated book of Nielsen and Chuang [START_REF] Nielsen | Quantum information and quantum computation[END_REF], as well as in the lecture notes of de Wolf [dW19]. We then go into the details of quantum memory models and define quantum RAM. Among the algorithms that we will present later, some quantum speedups can only be obtained using powerful memory models, which represent optimistic assumptions on the capacities of future quantum hardware. Thus, giving such power to quantum adversaries is a conservative assumption. However, there exists connections between these models, that we will explicit, which will justify to take all of them in consideration in our security analyses. Finally, we present Simon's algorithm [START_REF] Daniel | On the Power of Quantum Computation[END_REF], arguably the simplest example of an exponential quantum speedup, and cover some of its technicalities in order to prepare Chapter 4. Note that the contents of this chapter may provide a more profound understanding for the curious reader, but most of them are not needed to understand the main results of this thesis. Although we require some technical results to ensure their correctness and success probability, all our quantum algorithms can be phrased as combinations of Simon's algorithm (in this chapter) and quantum search (in Chapter 2), that can be used as black boxes.

Contents

History

The field of quantum computing originated in the 1980s as a subfield of quantum physics. Some physicists, including notably Richard Feynman [START_REF] Feynman | Simulating physics with computers[END_REF], had remarked that the task of simulating quantum mechanical systems (via their wave function, which describes completely their state) would pose a challenge to classical computers.

Being able to simulate efficiently the evolution of any wave function would enable us to study complex quantum systems such as molecules. This problem, known today as Hamiltonian simulation, is the earliest motivation of quantum information science. In order to solve it efficiently, the solution was to implement the simulator as a quantum system itself. Some proposals were given, but the quantum computing model was not completely fleshed out until the definition by Deutsch of the universal quantum Turing machine [START_REF] Deutsch | Quantum theory, the Church-Turing principle and the universal quantum computer[END_REF], a universal simulator for quantum physics. We shall not go into the details of this definition here; it is equivalent to the quantum circuits that we will define in Section 1.2.

From the point of view of computability, the universal quantum Turing machine is not more powerful than the universal Turing machine, defined by Turing in his seminal work [START_REF] Turing | On computable numbers, with an application to the Entscheidungsproblem[END_REF]. Thus, the quantum world does not challenge the Church-Turing thesis: 1 Every function which should naturally be regarded as computable can be computed by the universal Turing machine.

However, for the same reason that made quantum computers desirable in the first place, the quantum computing model challenges the strong Church-Turing thesis, which could be formulated as follows:

Any computable function can be computed by the universal Turing machine, with at most polynomial overhead.

It is not known today whether quantum computers bring a strict computational advantage over classical computers, in terms of complexity classes. 2 In other words, it is not known whether the inclusion: BPP Ď BQP is strict, where BPP is the class of problems solvable in probabilistic polynomial-time and BQP the class of problems solvable by quantum Turing machines in polynomial time.

After the definition of the quantum Turing machine, a few early algorithms were developed, such as Deutsch-Jozsa's [START_REF] Deutsch | Rapid solution of problems by quantum computation[END_REF], and the theory of quantum complexity appeared [START_REF] Bernstein | Quantum complexity theory[END_REF]. But the classical computer science community really became aware of the quantum paradigm shift with Shor's algorithm [START_REF] Shor | Algorithms for Quantum Computation: Discrete Logarithms and Factoring[END_REF], which solves in polynomial time the factoring and discrete logarithm problems, for which only classical exponential or subexponential algorithms are known. This breakthrough did not only challenge the strong Church-Turing thesis, but also the widely used cryptosystems based on these (classically) difficult problems.

Therefore, in a few years, quantum computers had turned from a physicist's dream into a theoretical framework in complexity theory; another few years later, and they had become the bogeyman of cryptographic schemes. However, despite their success at solving some computational problems, it was known very early on that quantum computers would not be all-powerful [START_REF] Bennett | Strengths and Weaknesses of Quantum Computing[END_REF]. Post-quantum cryptography was born with the prospect of finding the strengths and weaknesses of this new attackers, thereby finding new secure designs for an era of quantum computations. This is the main motivation of our work. We defer a brief history of cryptography and the post-quantum perspective to Chapter 3 and, for now, focus only on quantum computing.

Quantum Computations

In this section, we describe quantum systems and define the quantum circuit model, which is today the most standard way of describing quantum computations.

Quantum Systems

We name quantum system any physical object, e.g., one or more atoms, of which we can measure some physical property, e.g., the momentum. We assume that observing this property can yield 𝑁 possible values, which are classical states. These measurement outcomes are denoted |𝜓 0 y , . . . , |𝜓 𝑁 ´1y.

Definition 1.1 (Hilbert space). A Hilbert space ℋ is a vector space over C equipped with an inner product x¨|¨y, which is:

• Positive definite: for all 𝑥 P ℋ, x𝑥|𝑥y ě 0 and x𝑥|𝑥y " 0 ùñ 𝑥 " 0 ,

• Linear in its first argument,

• Conjugate symmetric: for all 𝑥, 𝑦 P ℋ, x𝑥|𝑦y " x𝑦|𝑥y .

The notation |¨y ("ket") is used for basis vectors; the notation x¨| ("bra") is used for linear forms (basis vectors of the dual space ℋ ˚). These notations are convenient to work with, as we have x𝜓| |𝑥y " x𝜓|𝑥y ("bracket"). Definition 1.2 (Quantum state). The state of the quantum system is an element of norm 1 of the 𝑁 -dimensional Hilbert space with orthonormal basis p|𝜓 𝑖 yq 0ď𝑖ď𝑁 ´1, isomorphic to C 𝑁 . It is sometimes referred to as as a pure state. Thus, we represent the state as a superposition of all these measurement outcomes:

|𝜓y " 𝛼 0 |𝜓 0 y `. . . `𝛼𝑁´1 |𝜓 𝑁 ´1y , where the 𝛼 𝑖 are complex numbers, coined the amplitudes, such that ř 𝑖 |𝛼 𝑖 | 2 " 1 (normalization condition). A mixed state is a probability distribution of pure states. The normalization condition allows to omit global amplitude factors for ease of notation. In the physical world, amplitudes give the probability distribution of measurement outcomes.

Proposition 1.1 (Measurement). Measuring the system yields the value 𝜓 𝑖 with probability |𝛼 𝑖 | 2 . This makes the state of the system collapse to |𝜓 𝑖 y.

Note that global phase factors can also be omitted, and that states |𝜓y and 𝑒 𝑖𝛼 |𝜓y are indistinguishable.

Between two measurements, the system can evolve through unitary operators of ℋ.

Definition 1.3 (Unitary operators). A matrix 𝑈 P ℳ 𝑁,𝑁 pCq describes a unitary operator of ℋ » C 𝑁 if 𝑈 : 𝑈 " 𝐼, where 𝑈 : is the conjugate transpose of 𝑈 . The amplitude vector p𝛼 0 𝛼 2 . . . 𝛼 𝑁 ´1q 𝑡 of the state is transformed into 𝑈 p𝛼 0 𝛼 2 . . . 𝛼 𝑁 ´1q 𝑡 .

The fact that 𝑈 must be unitary follows from the normalization condition. Since 𝑈 is unitary, it always admits 𝑈 : as an inverse. Thus, the unitary evolution of a quantum system is always reversible. This was soon remarked by physicists [START_REF] Feynman | Simulating physics with computers[END_REF][START_REF] Feynman | Quantum mechanical computers[END_REF]. The only non-reversible transformation of a quantum state is its measurement. It is also the only way of obtaining information about this state.

Quantum Circuits

The quantum circuit model can be seen as a universal, yet simple, way of describing quantum systems and their unitary evolution. We will now define its fundamental building blocks, qubits, named by analogy with classical bits, and quantum gates, analogous to classical logical gates. Definition 1.4 (Qubit). A qubit is a two-dimensional quantum system with two basis states |0y and |1y (referred to as the computational basis). Its state is an element of the two-dimensional Hilbert space ℋ » C 2 :

|𝜓y " 𝛼 |0y `𝛽 |1y where |𝛼| 2 `|𝛽| 2 " 1 .

A quantum circuit uses a prescribed number of qubits, say 𝑛, that are initialized to the default state |0y. Dimensionality. A system of 𝑛 qubits, although it contains only 𝑛 basic components, is described by a quantum state of dimension 2 𝑛 , in the space ℋ b𝑛 , where b is the tensor product. The canonical basis of ℋ b𝑛 is |𝑖y , 0 ď 𝑖 ď 2 𝑛 ´1. Indeed, each basis element 𝑖, written as an 𝑛-bit string, represents a possible measurement for the 𝑛-qubit system, and the quantum state of the system is a superposition over these 2 𝑛 strings:

|𝜓y " 𝛼 0 |0 ¨¨¨0y `𝛼1 |0 ¨¨¨01y `. . . `𝛼2 𝑛 ´1 |1 ¨¨¨1y .

From two states |𝜓 1 y and |𝜓 2 y, it is naturally possible to consider a joint state, which is generally written |𝜓 1 y b |𝜓 2 y or simply |𝜓 1 y |𝜓 2 y. Because the measurement outcomes of both individual systems are independent, they are said disentangled. But in general, the 𝑛 qubits in a circuit are entangled. Entanglement is one of the powerful features of quantum computation, as it allows to work in a space of dimension 2 𝑛 (ℋ b𝑛 ) instead of 2𝑛 (ℋ 𝑛 ).

Example 1.1 (Measuring a subsystem). Entanglement between two quantum subsystems is a correlation of their measurement outcomes. As an example, consider an entangled state of two qubits:

|𝜓y " |`y " 1 ? 2 |00y `1 ? 2 |11y .
Measuring only the first qubit projects the state |𝜓y on the compatible subspace. If we obtain 1, then |𝜓y is projected to |11y, which means that the state of the second qubit is modified as well.

On the contrary, if |𝜓y is of the form:

|𝜓y " 1 2 |00y `1 2 |01y `1 2 |10y `1 2 |11y ,
then measuring the first qubit projects the second to 1 ? 2 p|0y `|1yq in all cases. They are disentangled, and we can write:

|𝜓y " 1 ? 2 p|0y `|1yq b 1 ? 2 p|0y `|1yq .
Operations. We have now set up the system in its basis state |0 ¨¨¨0y. Notice that all qubits are disentangled at the beginning. A quantum circuit then applies a sequence of unitary operators known as quantum gates. These gates are drawn from some given universal gate set, which will contain simple operators acting on one or two qubits at once, with the power of implementing any unitary up to an arbitrary precision. In a quantum circuit, the prescribed quantum gates always form a series of sequential instructions, in contrast to classical circuits, where the gates can also be created in application-specific hardware.

Single-qubit Gates. Some well-known single-qubit gates are:

• the bitflip gate X, analogous to the classical NOT gate: it swaps the states |0y and |1y (we will often write it NOT).

• the phaseflip gate Z: it does nothing on |0y and changes the complex amplitude of |1y to its opposite.

• the Hadamard gate H: it maps |0y to 1 ? 2 p|0y `|1yq and |1y to 1 ? 2 p|0y ´|1yq. Notice that H is involutory (self-adjoint), that is, H : " H.

• the T-gate T: it rotates the phase of the state |1y by a fixed angle 𝜋{4; that is, it maps |0y to |0y and |1y to expp𝑖𝜋{4q |1y.

As unitary matrices:

X " ˆ0 1 1 0 ˙, Z " ˆ1 0 0 ´1˙, H " 1 ? 2 ˆ1 1 1 ´1˙, T " ˆ1 0 0 expp𝑖𝜋{4q ˙.
CNOT and Toffoli gates. The standard two-qubit gate is the CNOT (Controlled NOT ), which realizes the operation |𝑎y |𝑏y Þ Ñ |𝑎y |𝑏 ' 𝑎y. In other words, it negates the second qubit depending on the first one. Since it acts on two qubits, it is a unitary matrix of dimension 2 2 " 4:

CNOT " ¨1 0 0 0 0 1 0 0 0 0 0 1 0 0 1 0

‹ ‹ ' .
Next, the Toffoli gate Tof [START_REF] Toffoli | Reversible Computing[END_REF] acts on three qubits and maps |𝑎𝑏𝑐y to |𝑎𝑏𝑐 ' p𝑎 ^𝑏qy.

We will also use the identity operator I to denote that the state remains unchanged.

When two operators are applied on two different subsystems, we use a tensor product notation.

Definition 1.5 (Tensor product of operators). We define:

p𝑈 1 b 𝑈 2 qp|𝜓 1 y b |𝜓 2 yq " 𝑈 1 |𝜓 1 y b 𝑈 2 |𝜓 2 y ,
and extend this definition to entangled states by linearity.

When applying 𝑛 copies of an operator, we write 𝑈 b𝑛 . A simple example of 𝑛-qubit unitary operator built from simple gates is the Hadamard transform H b𝑛 . It consists in applying a Hadamard gate to each qubit in parallel:

H b𝑚 |𝑦y " ÿ 𝑧Pt0,1u 𝑚 p´1q 𝑦¨𝑧 |𝑧y .
The Hadamard transform is a simple example of the Quantum Fourier Transform. In the one-dimensional version, we replace Z 2 by any Z 𝑝 :

QFT 𝑝 |𝑥y " 1 ? 𝑝 ÿ 𝑦PZ𝑝 𝜔 𝑦𝑥 |𝑥y ,
where 𝜔 " 𝑒 2𝑖𝜋{𝑝 , and the 𝑛-dimensional version is simply a tensor product. One can easily remark that the reverse is another Quantum Fourier Transform replacing 𝜔 by 𝜔.

The Clifford+T gate set. The universal gate set that we will consider in the following chapters is the Clifford+T set, that is the most frequent in the post-quantum cryptographic literature nowadays.

Definition 1.6 (Clifford set [START_REF] Gottesman | Theory of fault-tolerant quantum computation[END_REF]). The Clifford set is generated by Z, H, CNOT.

The rationale for the Clifford+T set is that quantum circuits generated from Clifford gates can be simulated efficiently: this is the Gottesman-Knill theorem [START_REF] Gottesman | The Heisenberg Representation of Quantum Computers[END_REF]. Adding the T-gate to this set enables one to approximate efficiently any gate on one or two qubits, hence any unitary: this is the Solovay-Kitaev theorem [START_REF] Dawson | The Solovay-Kitaev algorithm[END_REF].

Theorem 1.1 (Solovay-Kitaev ([NC00], Appendix 3)). One can approximate any oneor two-qubit gate up to error 𝜖 using an amount at most polylog `1 𝜖 ˘of CNOT, H and T gates.

The Toffoli gate, which is convenient to work with in reversible computing, can be implemented using 7 T-gates and 8 Clifford gates.

Circuit drawings. In a quantum circuit, individual qubits are represented by wires. We often regroup them in qubit registers and use { to denote that there are 𝑛 qubits. Generic operators applied to subsystems are simply represented by boxes. Some elementary gates, such as CNOT and Tof, have a special representation (Circuit 1.1, Circuit 1.2). The symbol denotes measurement (the wire stops because the state is destroyed).

X Z H T

Quantum Circuit 1.1: Elementary gates X, Z, H, T.

Physical realizations of quantum circuits. The quantum circuit model represents the "logical layer" of quantum computations, which is supposed to work perfectly. Throughout this thesis, the words "qubits" and "gates" will refer exclusively to logical qubits and gates, not to the physical components that shall lie behind these concepts. As such, the circuit model can be seen as a programming interface, the implementation details being the experimentalists' work. At the physical level, quantum systems are susceptible to decoherence, the spontaneous destruction of their state due to unwanted interactions, and the gates induce considerable errors. In order to make a quantum computation fault-tolerant, one must work with bigger systems: any logical qubit would then be implemented with hundreds or thousands of physical qubits, using quantum errorcorrecting codes, so that the errors at the physical level do not disrupt the computation at the logical level. The quantum threshold theorem [START_REF] Gottesman | An introduction to quantum error correction and fault-tolerant quantum computation[END_REF] states that if the error rates of physical qubits are small enough, then the errors can be corrected faster than they are created, enabling to run indefinitely a fault-tolerant computation.

Current quantum computing devices belong to the category of noisy intermediate scale (NISQ) machines [START_REF] Preskill | Quantum Computing in the NISQ era and beyond[END_REF], and a fault-tolerant qubit has not yet been built. The recent results of [START_REF] Arute | Quantum supremacy using a programmable superconducting processor[END_REF], performing a quantum computation that cannot be simulated on today's classical computers, were obtained in this setting. Meanwhile, most envisioned cryptanalytic applications, including all algorithms presented in the next chapters, require fault-tolerance. But this does not rule out a use of NISQ computations in cryptography.

Quantum Algorithms

We will describe quantum algorithms using quantum circuits, in the same way as classical algorithms can be described with families of classical circuits.

Example: the 𝑛-bit Toffoli gate. As an example, consider the following operation: nTof : p𝑎 0 , . . . , 𝑎 𝑛´1 , 𝑏q Þ Ñ p𝑎 0 , . . . , 𝑎 𝑛´1 , 𝑏 ' p𝑎 0 ^. . . ^𝑎𝑛´1 q .

Lemma 1.1. There exists a quantum circuit for nTof using 2𝑛 ´3 Toffoli gates and 𝑛 ´2 ancilla qubits.

Here, an ancilla qubit is a work qubit that is initialized in the state |0y, used during the computation and returned to |0y afterwards; we will often omit them from more complicated quantum circuits. We give an example for 𝑛 " 5 which is adapted from [NC00, Figure 4.10]. Lemma 1.1 follows from a trivial induction. The doubling in cost follows from the necessity of returning the ancilla qubits to the state |0y. Other trade-offs are possible, using more Toffolis and less ancilla qubits, as shown in [ Oracles. Most of the algorithms described in the next chapters access an oracle 𝑂 𝑓 implementing a function 𝑓 . A quantum algorithm is then a family of circuits describing unitary operators interleaved with oracle calls. We will use two equivalent ways to realize a reversible oracle call to a possibly non-invertible function 𝑓 . Both are involutory operators.

Proposition 1.2 (Equivalence of oracles). The standard oracle and the phase oracle are equivalent under a Hadamard transform on the output register:

PO 𝑓 " pI b H b𝑚 qSO 𝑓 pI b H b𝑚 q and equivalently SO 𝑓 " pI b H b𝑚 qPO 𝑓 pI b H b𝑚 q .

Proof. We have: Þ ÝÝÝÝÝÑ p´1q 𝑦¨𝑓 p𝑥q |𝑥y |𝑦y .

|𝑥y |𝑦y pIbH b𝑚 q Þ ÝÝÝÝÝÑ
Once we have obtained the first equality, it suffices to compose by pI b H b𝑚 q on the left and right, since H is an involution.

Thanks to Proposition 1.2, we will refer to either oracle by the notation 𝑂 𝑓 , which shall be clear from context.

Computations and uncomputations.

Since a quantum circuit is no more than the specification of a unitary operator, and a unitary operator is invertible, a quantum circuit always admits an inverse. Furthermore, given the sequence of gates of the circuit, the inverse operator is simply the sequence of their inverses, written backwards. Oracle calls are involutory. Computing 𝒜 : is called uncomputing 𝒜. It is especially useful if 𝒜 produces a meaningful result, e.g., a single bit 𝑏 that we want to retrieve, but modifies the state in a way that we wish to forget.

Embedding classical computations.

If 𝑓 is specified as a classical deterministic algorithm, then the oracle 𝑂 𝑓 can be implemented with about the same number of operations as 𝑓 . However, since this computation must be reversible, the intermediate memory storage cannot be erased, which can lead to an explosion of memory. Fortunately, it is possible to uncompute the intermediate steps as done in Circuit 1.4. There is an optimal strategy to decide which steps to uncompute at which time, sometimes known as a "pebble game" [START_REF] Knill | An analysis of Bennett's pebble game[END_REF], and it leads to Bennett's time-space trade-off [START_REF] Bennett | Time/Space Trade-Offs for Reversible Computation[END_REF][START_REF] Levin | A Note on Bennett's Time-Space Tradeoff for Reversible Computation[END_REF].

Theorem 1.2 (Theorem 1 in [START_REF] Bennett | Time/Space Trade-Offs for Reversible Computation[END_REF]). For any 𝜀 ą 0, a classical algorithm running in time 𝑇 and using space 𝑆 can be simulated by a quantum circuit using 𝒪 `𝑇 1`𝜀 ˘quantum gates and 𝒪p𝑆 ¨ln 𝑇 q qubits (the constants depend on 𝜀).

More generally, any classical randomized algorithm admits a quantum embedding, that is, a quantum algorithm that returns the same distribution of results upon measurement. Definition 1.8. Let 𝒜 be a randomized algorithm with no input. A quantum embedding for 𝒜 is a quantum algorithm 𝒜 1 that has no input, and the distribution over the possible outcomes of 𝒜 1 (after measurement) is the same as the distribution over possible outcomes of 𝒜. This quantum embedding admits similar time and space complexities, where classical elementary operations (logic gates) are replaced by quantum gates and classical bits by qubits. Any selection of random bits is replaced by Hadamard gates. Ratios between time complexities are approximately preserved when embedding classical algorithms into quantum algorithms.

In-place and out-of-place computations. Most of the classical computations that we will embed in quantum circuits will be out of place, meaning that they write their result on a separate register than the input. This is the case with the standard oracle SO 𝑓 . However, if 𝑓 is a permutation, then the transformation |𝑥y Þ Ñ |𝑓 p𝑥qy is unitary. In that case, we say that 𝑓 is computed in place. This is not harder to do if we have the ability to compute 𝑓 and 𝑓 ´1 out of place, since we can perform: But in general, when given oracle access to 𝑓 only, we do not consider the in-place variant of 𝑂 𝑓 .

The deferred measurement principle. Only a measurement can extract information from the system. However, during a quantum computation, intermediate measurements are not necessary. The circuit will return the same final result if they are not performed. Despite this fact, these partial measurements have some advantages. By turning pure states into mixed states, they can help to simplify the presentation of an algorithm. They can also help to reduce the amount of ancilla qubits, by measuring them and reusing them, as in the variant of Shor's algorithm by Mosca and Ekert [START_REF] Mosca | The Hidden Subgroup Problem and Eigenvalue Estimation on a Quantum Computer[END_REF].

Quantum Complexity Notions

In order to estimate their advantage over classical algorithms, we need asymptotic and non-asymptotic notions of complexities for quantum algorithms, described as quantum circuits.

Query complexity. Given access to the oracle 𝑂 𝑓 , we count the number of queries made to 𝑂 𝑓 . Time complexity. We count the number of quantum gates performed. When using 𝒪 notations, we do not need to specify a universal gate set, as all good universal sets are equivalent up to a constant factor. For performing detailed quantum gate counts, we use the Clifford+T gate set, as it has become the most widely used for benchmarking cryptanalytic algorithms [Amy+16; Gra+16; Hän+20; Jaq+20].

Comparing quantum and classical complexities.

There does not exist a clear common benchmark for comparing quantum and classical operations. Common sense dictates us that, in the foreseeable future, quantum gates are likely to remain orders of magnitude slower than classical gates, and qubits more costly than classical bits. This justifies to look for unbalanced trade-offs between quantum and classical resources. This is done for example in [Bia+19;BS20] in the study of some quantum algorithms with cryptanalytic applications. However, it is sometimes easier to think of this gap as a mere constant and equalize asymptotic classical and quantum times.

Notations. We will denote by T c p𝒜q the classical time complexity of a classical algorithm 𝒜, T q p𝒜q the quantum time complexity of a quantum algorithm 𝒜 and M p𝒜q the memory complexity of an algorithm, for a given model of memory.

Quantum Memory Models

Quantum computing machines from a near future will likely have only a few qubits available, which is why the topic of this section is mostly theoretical. But the study of quantum algorithms using massive amounts of qubits, or even more hypothetical hardware capabilities, can be a first step towards more constrained resources and quantum circuits of smaller area.

In particular, many classical algorithms relevant for cryptanalysis require read and write access to a random-access memory. In the analysis of these algorithms, we often suppose that these operations take a constant time, though this is an assumption that does not hold at large scales, as discussed in [START_REF] Michael | The Full Cost of Cryptanalytic Attacks[END_REF].

When trying to make quantum versions of these algorithms, we often fall upon the need for memory operations of the same efficiency, although they are now handling quantum data. This is where we need to define quantum Random-Access Memory (qRAM) and all its variants. qRAM is ubiquitous in the quantum computing literature, but often implicit. In this section, definitions are borrowed from [Amb07; Kup13] and technical results are from [START_REF] Jeffery | Frameworks for Quantum Algorithms[END_REF] or folklore.

Variants of qRAM

As its core, the quantum random-access model relies on a new quantum gate, the qRAM gate (see, for example, [Amb07, Section 6.1]), which is assumed to have unit cost regardless of the number of qubits it spans. Assume that we have 𝑁 data registers |𝑥 0 y , . . . , |𝑥 𝑁 ´1y and an index register |𝑖y. Then the gate performs the unitary of Circuit 1.5. In this thesis, we will use the terms "QRACM" and "QRAQM" in a technical context, and "qRAM" in a broader sense, for any of them.

Quantum Data Structures using qRAM

Using qRAM gates, it is possible to obtain quantum data structures with fast insertion and lookups. If we want only to implement dichotomy search in a sorted list, without inserting, this is doable without any errors using a logarithmic number of qRAM gates. If we want both insertion and search in a logarithmic number of gates, this is allowed by the radix tree data structure presented in [START_REF] Jeffery | Frameworks for Quantum Algorithms[END_REF]. Many algorithms that we will consider in this thesis, for example in Chapter 5 and Chapter 6, can make use of a simpler data structure for membership testing. We only need to assume that the list accessed contains random bit-strings with distinct prefixes.

We define a Unique prefix list as follows (we refer to Algorithm 2.10 for a use case). This is a list ℒ holding 𝑛-bit strings indexed by 𝑚-bit prefixes (𝑚 ď 𝑛), which are also their addresses. Memory cells are 𝑛 `1-bit or qubit registers initialized to a special state K. Thus, the list requires exactly p𝑛 `1q2 𝑚 bits (for QRACM) or qubits (QRAQM) of storage. It can only contain a single element of a given 𝑚-bit prefix, and is of maximal size 2 𝑚 (alternatively, we may authorize a constant number of elements of a given prefix, which we would put in a "bucket" of fixed size). It supports the following operations, which use 𝒪p1q qRAM gates and 𝒪p𝑛q basic gates each:

• Search(𝑠), where 𝑠 is a bit-string of size 𝑚: returns the element of prefix 𝑠 if there is one, and K otherwise. This requires simply to we fetch the value of the register at index 𝑠.

• Membership(𝑥), where 𝑥 is a bit-string of size 𝑛: returns 1 if 𝑥 P ℒ and 0 otherwise. This is done by calling Search(trunc 𝑚 p𝑥q) with the 𝑚-bit prefix of 𝑥 and checking whether the result is K.

• SearchMany(𝑠), where 𝑠 is a bit-string of size smaller than 𝑚: returns the uniform superposition of all 𝑥 P ℒ that have prefix 𝑠, or K if there is no such 𝑥.

If all memory cells with prefix 𝑠 are occupied, SearchMany can easily be implemented with a few Hadamard gates and a qRAM gate, and it is exact. If this is not the case, then among the cells that we query, there are unwanted K values. However, if we know the size of 𝑠 in advance, it is possible to make SearchMany exact using an exact Amplitude Amplification (Theorem 2.3).

Emulating qRAM Gates

It is well known, and will be of particular importance for us (in Section 5.1 for example), that QRACM can be emulated with purely classical storage.

Lemma 1.2 (QRACM emulation). A qRAM gate accessing 2 𝑛 classical memory cells of 𝑚 bits each can be replaced by a quantum circuit using p2𝑛 ´3q2 𝑛 Toffoli gates (none if 𝑛 ď 1), 𝑛2 𝑛 NOT gates, at most 𝑚2 𝑛 CNOT gates and 𝑛 ´1 ancillas qubits (none if 𝑛 ď 1).

Proof. Let 𝛿 𝑖𝑗 be the Kronecker symbol: 𝛿 𝑖𝑗 " 1 ðñ 𝑖 " 𝑗 and 𝛿 𝑖𝑗 " 0 otherwise. For a given 𝑗, it is easy to implement a circuit that computes 𝑖 Þ Ñ 𝛿 𝑖𝑗 . Let us take 5-bit integers as an example, and 𝑗 " 9 " 01001 2 . Then if we write 𝑖 " 𝑖 4 𝑖 3 𝑖 2 𝑖 1 𝑖 0 2 :

𝛿 𝑖𝑗 " 𝑖 4 ^𝑖3 ^ 𝑖 2 ^ 𝑖 1 ^𝑖0 ,
which leads to Circuit 1.6 using the 5-bit Toffoli gate of Circuit 1.3 and NOT gates X.

|𝑖 4 y X ' X |𝑖 4 y |𝑖 3 y ' |𝑖 3 y |𝑖 2 y X ' X |𝑖 2 y |𝑖 1 y X ' X |𝑖 1 y |𝑖 0 y ' |𝑖 0 y |𝑏y |𝑏 ' 𝛿 𝑖9 y Quantum Circuit 1.6: Quantum circuit for 𝛿 ˚9.
In general, we only need a single 𝑛-bit Toffoli gate and at most 2𝑛 NOT gates for indices of 𝑛 bits. Next, assume without loss of generality that we access the memory cell at index 0, containing a classical value 𝑥 " 𝑥 𝑚´1 . . . 𝑥 0 2 . We apply the unitary It is also easy to use such a circuit in the case where the data accessed is part of the quantum circuit. Instead of using a specific sequence of CNOT gates in Circuit 1.7, we replace them by Toffoli gates controlled by 𝛿 𝑖0 and by the qubits that we are accessing.

Corollary 1.1. A qRAM gate spanning 2 𝑛 data registers of size 𝑚 each can be emulated with 𝑛2 𝑛 NOT gates, pmaxp2𝑛 ´3, 0q `𝑚q2 𝑛 Toffoli gates and 𝑛 ´1 ancilla registers.

Thus, the separation between memory models becomes significant only when massive amounts of memory are used. If the memory size is small (say, polynomial in the dimension 𝑛 of the problem), then swapping memory models does not modify the gate complexity by more than a factor polyp𝑛q.

Membership Queries

Another version of Lemma 1.2 allows us to bypass completely a quantum data structure if we want simply to test membership to a list ℒ of 𝑁 elements. This will be used later in Chapter 5 (see Algorithm 5.1), but also in Chapter 9.

Lemma 1.3 (Membership query). Let ℒ " 𝑥 0 , . . . , 𝑥 𝑁 ´1 be a list of distinct 𝑚-bit strings of size 𝑁 , with 𝑚 " 2𝑚 1 and 𝑚 ´3 ě 1. There exists a quantum circuit Membership ℒ that performs:

|𝑦y |𝑏y Membership ℒ
Þ Ý ÝÝÝÝÝÝÝ Ñ |𝑦y |𝑏 ' p𝑦 P ℒqy , using less than 2𝑚 NOTs, 𝑚𝑁 CNOTs and exactly p𝑚 ´3q𝑁 `𝑚 Toffolis.

Proof. Notice that ℒ does not need to be sorted, but sorting it beforehand can help to ensure that all its elements are distinct. We can simply reuse the circuit for the Kronecker symbol (Circuit 1.6), which requires NOTs and a single 𝑚-bit Toffoli gate. For each (classical) value 𝑥 P ℒ, we apply the unitary:

|𝑦y |𝑏y Þ Ñ |𝑦y |𝑏 ' 𝛿 𝑦𝑥 y .
Applying all unitaries in sequence is enough, since ℒ contains distinct elements, as we can write:

p𝑦 P ℒq " 𝛿 𝑦𝑥 0 ' 𝛿 𝑦𝑥 1 ' . . . ' 𝛿 𝑦𝑥 𝑁 . |𝑦 1 y X ' ' X X ' ' X |𝑦 1 y |𝑦 2 y ' ' ' ' |𝑦 2 y |𝑦 3 y X ' ' X ' ' |𝑦 3 y |𝑦 4 y X ' ' X X ' ' X |𝑦 4 y |0y ' ' |0y |0y ' ' |0y |𝑏y |𝑏 ' 𝛿 𝑦𝑥 y |𝑏 ' 𝛿 𝑦𝑥 ' 𝛿 𝑦𝑥 1 y
Quantum Circuit 1.8: Cancellation of Toffoli gates in the membership circuit.

Next, we remark that half the gates in the circuit can be removed. Since we assumed for simplicity an even 𝑚, in the Kronecker symbol computations, we can replace the 𝑚-bit Toffoli gates by 𝑚 1 Toffolis, an 𝑚 1 -bit Toffoli, and 𝑚 1 Toffolis again. Then half of the work consists in computing a Toffoli gate, then applying zero, one or two NOTs on the control wires, then applying a Toffoli again. If there are no NOTs, the Toffoli cancel out. If there is only one, we are computing: Thus, we can replace them by CNOTs in all cases, removing these Toffolis.

The upper bound of Lemma 1.3 is valid for all lists. For a given one, it is likely that the circuit can be optimized further, for example by computing the Kronecker symbols in a sequence that maximizes the overlap between consecutive elements of ℒ. But a simple counting argument shows that we cannot do asymptotically much better.

ˆ𝑐 ˆ𝑞 𝑟 ˙˙𝑅 » 𝑐 𝑅 𝑞 𝑟𝑅 ě 2 𝑚𝑁 ùñ 𝑅plog 2 𝑐 `𝑟 log 2 𝑞q ě 𝑚𝑁 ùñ 𝑅 ě 𝑚𝑁 log 2 𝑐 `𝑟 log 2 𝑞 .
Thus, with 𝑟 and 𝑐 constants, and if the circuit uses 𝑞 " 𝒪p𝑚q qubits, we cannot hope to go below 𝒪p𝑚𝑁 { log 𝑚q.

Replacing QRACM with classical sequential-access memory. A direct consequence of Lemmas 1.2 and 1.3 is that QRACMs, even of exponential size, can be removed from quantum algorithms making only few membership queries (or performing few qRAM gates).

Corollary 1.2. Let 𝒜 be a quantum algorithm making 𝑄 membership queries to a classical list ℒ of size 𝐿, using 𝑚 qubits and 𝑇 other gates. Then there exists an equivalent algorithm 𝒜 1 using 𝑚 qubits, running in time r 𝒪p𝑄𝐿 `𝑇 q, that uses a classical memory with sequential access (CSAM) of size 𝐿.

Each time 𝒜 accesses ℒ, we use the circuit Membership ℒ . The gates that we apply depend on the elements of ℒ, which is why it must still be stored. But this storage is purely classical, and with sequential access. Indeed, while each call of Membership ℒ requires to go through the whole list ℒ, the elements form a sequence of instructions to the quantum processing unit, that only needs to be read in fixed order. Physically, we can imagine that ℒ is stored in a hard drive, with a single magnetic head. This type of memory is cheaper and does not suffer from scaling energy consumption.

Discussion and Comparisons

The qRAM gate is obviously powerful, as it allows to span 𝑀 components in a single time step. Physical realizations of qRAM would have many applications in different areas of quantum computing, not limited to quantum cryptanalysis. Circuits vs. QRACM. The specificity of quantum memory models is that the quantum circuit model and the QRACM model are competitors: we do not know, and we cannot predict whether a QRACM of size 𝑀 would cost more to maintain than a quantum circuit with 𝑀 qubits. In fact, some authors have argued that specific architectures for QRACM may turn out to be cheaper than plain qubits [START_REF] Kuperberg | Another Subexponential-time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF]; others have considered the opposite [START_REF] Lov | How significant are the known collision and element distinctness quantum algorithms?[END_REF].

From QRAQM to plain circuits. Even if we consider it as a blurry horizon in a distant future, the most powerful model of QRAQM remains a meaningful setting, not only because we may be interested in worst-case scenarios. Throughout the following chapters, we encounter some algorithms that seem to require QRAQM but admit QRACM-only variants, and some others that seem to require QRACM but admit CSAMonly variants. Hence, time-efficient quantum algorithms in the QRAQM model may be a "first step" towards versions with lower hardware requirements. This is why, in the following, we will encounter and consider all three settings: plain circuits (CSAM or RAM), QRACM, QRAQM.

An Example of qRAM architecture. In [GLM08], Giovannetti, Lloyd, and Maccone proposed the bucket-brigade architecture. They start with the standard arrangement of the 2 𝑛 memory cells in leaves of a tree of depth 𝑛, with 2 𝑛 ´1 switches that decide whether to go to left (0) or to right (1) depending on the requested address. In the bucket-brigade qRAM (Figure 1.1), each switch is a trit and can be either in the state left, right or wait. All switches start in the state wait. Address bits are read one by one. When a bit 𝑏 arrives at a switch, if the switch is in the state wait, then it is changed to the state left or right depending on 𝑏. If the switch is in the left or right state, then it routes 𝑏 accordingly to the next switch.

Translating a bucket-brigade call into a quantum circuit gives a complexity similar to Lemma 1.2, because all paths are explored in superposition, and all switches modified. However, this circuit will be massively parallel, with a depth 𝒪p𝑛q and a width of 𝒪p𝑛2 𝑛 q qubits. The other main feature of this architecture is its error-resilience, which stems from the fact that most of the switches remain in the state wait. In any basis vector of the superposition, only 𝒪p𝑛q switches are in the state left or right. Thus, a practical advantage of qRAM may come from a reduced cost of error-correction with respect to plain quantum circuits. However, in [START_REF] Arunachalam | On the Robustness of Bucket Brigade Quantum RAM[END_REF], the authors questioned the robustness of this model with respect to errors. In particular, the error per gate would need to be inversely proportional to the number of queries performed to the qRAM.

The current research seems to focus on qRAM as components of hybrid quantum architectures [START_REF] Blencowe | Quantum RAM[END_REF][START_REF] Hong | Robust quantum random access memory[END_REF].

Simon's Algorithm

Simon's algorithm [START_REF] Daniel | On the Power of Quantum Computation[END_REF] is the simplest member of the family of Hidden subgroup algorithms, and the precursor of Shor's algorithm [START_REF] Shor | Algorithms for Quantum Computation: Discrete Logarithms and Factoring[END_REF]. It has many use cases in quantum symmetric cryptanalysis and will be one of the most used tools in the following chapters. In this section, we introduce the problem and the algorithm.

Simon's Problem

The problem to solve is the following. Problem 1.1 (Boolean hidden period). Let 𝑋 be a set. Suppose given access to a function 𝑓 : t0, 1u 𝑛 Ñ 𝑋 such that there exists 𝑠 P t0, 1u 𝑛 with: @𝑥, 𝑓 p𝑥q " 𝑓 p𝑦q ðñ 𝑦 " 𝑥 or 𝑦 " 𝑥 ' 𝑠 , then find 𝑠.

In other words, we must determine if a given function is periodic (𝑠 ‰ 0) or injective (𝑠 " 0) given the promise that this is one of the cases, and we must find its period. From now on, we will assume that 𝑋 " t0, 1u 𝑛 for simplicity. Simon's problem can be seen as a hidden period problem, but also as a hidden subgroup problem for a subgroup of pZ 2 q 𝑛 , and last but not least, it is equivalent to the Boolean hidden shift problem. Problem 1.2 (Boolean hidden shift). Given access to two functions 𝑓, 𝑔 : t0, 1u 𝑛 Ñ 𝑋 that either have no image in common, or satisfy 𝑓 p¨q " 𝑔p¨' 𝑠q for some 𝑠, find 𝑠.

Proof of equivalence. An algorithm for the Boolean hidden shift problem solves the hidden period problem by setting 𝑓 " 𝑔. Next, given an instance 𝑓, 𝑔 for the hidden shift problem, we define:

𝐹 : t0, 1u ˆt0, 1u 𝑛 Ñ 𝑋 p𝑏, 𝑥q Þ Ñ " 𝑓 p𝑥q if 𝑏 " 0 𝑔p𝑥q if 𝑏 " 1 .
Then 𝐹 admits the period p1, 𝑠q.

Solving this problem with classical oracle access to 𝑓 requires Ω `2𝑛{2 ˘queries, as this is the expected number of queries before a collision pair 𝑥, 𝑦, 𝑓 p𝑥q " 𝑓 p𝑦q occurs in the periodic case. If we don't find such a pair, then we can conclude that the function is injective. Simon [START_REF] Daniel | On the Power of Quantum Computation[END_REF] gives a probabilistic quantum polynomial-time algorithm which only requires 𝒪p𝑛q queries to 𝑂 𝑓 . An exact version was later given by Brassard and Høyer [START_REF] Brassard | An Exact Quantum Polynomial-Time Algorithm for Simon's Problem[END_REF], who also extended the algorithm to the case where 𝑓 admits multiple periods and the whole subspace of periods must be retrieved.

Description of the Algorithm

Simon's algorithm relies on a subroutine FindVector, which is depicted in Circuit 1.9. In short, it first creates a superposition of the two preimages of a random element of the codomain of 𝑓 . By making these two elements interfere (constructively or destructively), it allows to sample a random vector orthogonal to the period. In Algorithm 1.1, we follow the evolution of the quantum state through the operations applied.

We choose a number 𝑚 constant or linear in 𝑛. Simon's algorithm (Algorithm 1.2) consists in running 𝑛 `𝑚 times the subroutine FindVector (Algorithm 1.1), creating an p𝑛 `𝑚q ˆ𝑛 matrix 𝑌 out of the 𝑦 obtained, and computing its rank 𝑟. If 𝑟 ă 𝑛 ´1, then the algorithm has failed. If 𝑟 " 𝑛, then we know for sure that the function is injective; if 𝑟 " 𝑛 ´1, then the linear system 𝑌 𝑆 " 0 has a single solution, which should be 𝑠.

The probability of failure is governed by the value of 𝑚, due to Proposition 1.4.

Proposition 1.4 (Failure probability in Simon's algorithm). Algorithm 1.2 returns an incorrect result with probability ď 2 ´𝑚.

Proof. The two cases can be brought down to the same computation: given 𝑟 `𝑚 vectors 𝑦 1 , . . . , 𝑦 𝑟`𝑚 drawn uniformly at random from an F 2 -vector space 𝑉 of dimension 𝑟, we lower bound the probability that these vectors contain a basis of 𝑉 . When 𝑠 " 0, 𝑉 " F 𝑛 2 and when 𝑠 ‰ 0, 𝑉 is the subspace orthogonal to 𝑠. We use a remark from [START_REF] Santoli | Using Simon's algorithm to attack symmetric-key cryptographic primitives[END_REF]. A family of 𝑟 binary vectors of length 𝑟 `𝑚, drawn uniformly at random, has full rank with probability:

𝑟´1 ź 𝑖"0 ˆ1 ´1 2 𝑟`𝑚´𝑖 ˙ě 1 ´2𝑚 ,
since the first vector is zero with probability 2 ´p𝑟`𝑚q , and then, each new column must be drawn outside the subspace of size 2 𝑖 generated by the previous 𝑖 vectors. Then, by equality of row and column rank, we obtain the result. • If 𝑠 ‰ 0 then 𝑓 is periodic. The value 𝑎 measured in Step 5 has exactly two preimages 𝑥 0 and 𝑥 0 ' 𝑠 for some 𝑥 0 . The amplitude of 𝑦 is:

ÿ 𝑥P𝑓 ´1p𝑎q p´1q 𝑥¨𝑦 " p´1q 𝑥 0 ¨𝑦 `p´1q p𝑥 0 '𝑠q¨𝑦 ,
which is zero if 𝑦 ¨𝑠 " 1 and non-zero otherwise.

In all cases, we obtain a uniformly random 𝑦 such that 𝑦 ¨𝑠 " 0. return Failure Thus, Simon's algorithm runs in time 𝒪 `𝑛3 ˘, using 𝒪p𝑛q queries, and achieves an exponential success probability.

Weakening the Promise

In a cryptographic context, the functions on which we apply Simon's algorithm are often not exactly injective, and random collisions may occur. Let t0, 1u 𝑛 {p𝑠q be the equivalence classes of t0, 1u 𝑛 under the relation: 𝑥 " 𝑦 ðñ 𝑥 " 𝑦 or 𝑥 " 𝑦 ' 𝑠. Definition 1.9 (Random periodic function ( [START_REF] Bonnetain | Hidden Structures and Quantum Cryptanalysis[END_REF], Definition 4.1)). A function 𝑓 : t0, 1u 𝑛 Ñ 𝑋 of period 𝑠 is random periodic if 𝑓 restricted to t0, 1u 𝑛 {p𝑠q is a random function.

Problem 1.3 (Simon's problem with random functions). Suppose given access to a function 𝑓 : t0, 1u 𝑛 Ñ t0, 1u 𝑛 which is either a random function, or a random periodic function of period 𝑠. Determine the case and find 𝑠.

The soundness of Algorithm 1.2 applied to random functions has already been investigated in the literature. In [START_REF] Kaplan | Breaking Symmetric Cryptosystems Using Quantum Period Finding[END_REF], the authors relate the probability of failure to the quantity: 𝜖p𝑓, 𝑠q " max 𝑡Pt0,1u 𝑛 zt0,𝑠u Pr 𝑥 p𝑓 p𝑥q " 𝑓 p𝑥 ' 𝑡qq .

(1.1)

This notation naturally extends to both the periodic case (𝑠 ‰ 0) and the aperiodic case (𝑠 " 0), and we write 𝜖p𝑓 q " 𝜖p𝑓, 𝑠q.

Theorem 1.3 ([Kap+16a], Theorem 1). If 𝜖 " 𝜖p𝑓 q ă 1, then after 𝑛 `𝑟 queries, Simon's algorithm returns 𝑠 with a probability greater than 1 ´2𝑛 `1`𝜖 2 ˘𝑛`𝑟 .

In short, 𝜖p𝑓 q controls the weight of unwanted periods of 𝑓 . If 𝜖p𝑓 q " 0, then we fall back in the perfect case. On the contrary, if 𝜖p𝑓 q " 1, then 𝑓 is constant and 𝑠 cannot be recovered at all.

Proof of Theorem 1.3. After having measured 𝑛 `𝑟 vectors 𝑦 1 , . . . , 𝑦 𝑛`𝑟 , the algorithm fails if all the vectors are orthogonal to a given 𝑡 ‰ 𝑠.

In the subroutine FindVector, if the 𝑥 0 in the last step is such that 𝑓 p𝑥 0 ' 𝑡q " 𝑓 p𝑥 0 q, then the vector 𝑦 𝑖 measured will be orthogonal to 𝑡 with probability 1. Otherwise, it will be orthogonal to 𝑡 with probability 1 2 . The first case occurs with probability 𝜖, the second with probability 1 ´𝜖. All in all, we have Prp𝑦 𝑖 K 𝑡q " 1`𝜖 2 . We do a union bound over all 𝑡 and obtain:

PrpdimpSpan p𝑦 1 , . . . , 𝑦 𝑛`𝑟 qq ď 𝑛 ´2q ď 2 𝑛 ˆ1 `𝜖 2 ˙𝑛`𝑟 .
The bound is the same in the case where there is no period.

Bound of 𝜖p𝑓 q for random functions. In quantum cryptanalysis, Simon's algorithm is often applied to functions of which it is safe to assume that they are drawn uniformly at random. Any other behavior may denote a weakness that should be cryptographically exploited. For a random function, 𝜖p𝑓 q is negligibly small [START_REF] Daemen | Probability distributions of correlation and differentials in block ciphers[END_REF]. We give below an upper bound taken from [START_REF] Bonnetain | Tight Bounds for Simon's Algorithm[END_REF].

Lemma 1.4. For a function 𝑓 drawn uniformly at random from pt0, 1u 𝑛 Ñ t0, 1u 𝑛 q, for any 𝑎 ą 0:

Pr 𝑓 ˆ𝜖p𝑓 q ě p𝑎 `1q𝑛 2 𝑛 ˙ď 2 ´𝑎𝑛 . (1.2)
Proof. Let 𝑚 be a bound to choose later. Consider a fixed value of 𝑡 P t0, 1u 𝑛 . We count the number of functions such that at least 𝑚 elements 𝑥 are sent to the same image as 𝑥 ' 𝑡. Since we just have to choose these 𝑥 elements, their images, and complete the function, there are

ˆ2𝑛 𝑚 ˙2𝑛𝑚 2 𝑛p2 𝑛 ´2𝑚q ď 2 𝑛𝑚 𝑚! 2 𝑛p2 𝑛 ´𝑚q
, hence a proportion 1 𝑚! of them at most. Hence, for a given 𝑡:

Pr 𝑓 ´Pr 𝑥 p𝑓 p𝑥q " 𝑓 p𝑥 ' 𝑡qq ě 𝑚 2 𝑛 ¯ď 1 𝑚! .
Next, we do a union bound on all values of 𝑡:

Pr 𝑓 ´D𝑡, Pr 𝑥 p𝑓 p𝑥q " 𝑓 p𝑥 ' 𝑡qq ě 𝑚 2 𝑛 ¯ď 2 𝑛 𝑚! ,
and replace by 𝜖:

Pr 𝑓 ´𝜖p𝑓 q ě 𝑚 2 𝑛 ¯ď 2 𝑛 𝑚! .
It remains to choose 𝑚 appropriately: 𝑚 " p𝑎 `1q𝑛 is enough for our result, and for 𝑚 ě 4, we have 𝑚! ě 2 𝑚 .

Thus, even if we consider families of random functions of exponential size, we can assume that 𝜖p𝑓 q is less than 𝑎𝑛 2 𝑛 for all functions simultaneously, for an accordingly chosen constant 𝑎, by Lemma 1.4 and a union bound. Next, we show that: Lemma 1.5. Assume that 𝜖p𝑓 q ď 𝑎𝑛 2 𝑛 for some constant 𝑎. Then for sufficiently big 𝑛, Simon's algorithm fails with probability lower than 2 ´𝑟𝑒 after 𝑛 `𝑟 queries.

Proof. By Theorem 1.3, the probability of error is lower than:

2 𝑛 ˆ1 `𝜖 2 ˙𝑛`𝑟 " p1 `𝜖q 𝑛`𝑟 2 ´𝑟 ď 𝑒 p𝑛`𝑟q𝜖 2 ´𝑟 ď 𝑒 𝑎p𝑛`𝑟q𝑛{2 𝑛 2 ´𝑟 ď 𝑒2 ´𝑟 ,
where the last inequality holds if 𝑛 is not too small (cryptographically relevant values of 𝑛 ě 80 are all but enough).

All in all, Simon's algorithm applies very well to cryptographic functions or permutations exhibiting a hidden shift, as soon as they do not contain another unwanted structure.

Simon's Algorithm as a Quantum Circuit

We have presented Simon's algorithm as a quantum procedure, which contains many measurements. For some applications, we will need a fully reversible implementation of this algorithm.

In total, Simon's algorithm makes 𝑛 `𝑟 queries to 𝑂 𝑓 where 𝑟 allows to control its probability of failure. The inputs of these queries are disentangled copies of ř 𝑥 |𝑥y |0y. Hence, we can consider instead that all the queries are done beforehand, and given to a quantum circuit QSimon. For our purposes, QSimon only needs to perform a phase shift of the state if the function is periodic, and nothing otherwise.

We will show that, while an exact QSimon seems hard to realize, it is as easy to bound the induced error as to bound the error in Simon's algorithm. In the following, let us denote |𝜓 𝑓 y " ř 𝑥Pt0,1u 𝑛 |𝑥y |𝑓 p𝑥qy a quantum state that contains one of the queries to 𝑂 𝑓 .

Theorem 1.4 (Quantum circuit for Simon's algorithm). Assuming that 𝜖p𝑓 q ď 𝑎𝑛 2 𝑛 for some 𝑎, where 𝜖 is defined as in Equation (1.1), and setting 𝑚 " 𝑛 `𝑟 " 𝒪p𝑛q, there exists a quantum circuit QSimon using 𝒪 `𝑛3 ˘elementary gates that realizes:

˜𝑚´1 â 𝑖"0 |𝜓 𝑓 y ¸QSimon Þ ÝÝÝÝÑ p´1q 𝑏 ˜𝑚´1 â 𝑖"0 |𝜓 𝑓 y ¸`|𝛿y ,
where 𝑏 " 1 if 𝑓 is periodic and 0 otherwise, and |𝛿y is an error vector of amplitude:

}|𝛿y} ď 𝑒2 ´𝑟{2`1 . H b𝑛 H b𝑛 . . . H b𝑛 H b𝑛 𝑦 1 Rank 𝑦 0 . . . . . . 𝑦 𝑚´1 𝑦 𝑚´1 ⎧ ⎨ ⎩ |𝜓 𝑓 y ⎧ ⎨ ⎩ |𝜓 𝑓 y
Quantum Circuit 1.10: Quantum circuit for Simon's algorithm.

Proof. Circuit 1.10 gives a representation of QSimon, where Rank is a unitary operator that given 𝑛-bit vectors 𝑦 1 , . . . , 𝑦 𝑛`𝑟 , flips the phase if the rank of the family is less than 𝑛 ´1 (periodic case). Rank will perform Gaussian elimination, and may require additional ancilla qubits that are not represented in Circuit 1.10.

• If 𝑓 is periodic, then the rank of 𝑦 1 , . . . , 𝑦 𝑛`𝑟 is always less than 𝑛 ´1, and we have } |𝛿y } " 0.

• If 𝑓 is simply random, then the families 𝑦 1 , . . . , 𝑦 𝑛`𝑟 of rank less than 𝑛 incur errors on the output bit 𝑏 and on the product of states |𝜓 𝑓 y that we wish to leave unchanged.

Before the final Hadamard transform, the error vector |𝛿 1 y contains twice the bad families (with amplitude ´1 on the right |𝑏y, and `1 on the wrong |𝑏y). Thus its squared norm is equal to 4 times the probability of measuring such a family, and the analysis of Theorem 1.3 and Lemma 1.5 applies. After the Hadamard transform, the norm of |𝛿y satisfies: }|𝛿y} ď }|𝛿 1 y} ď 𝑒2 ´𝑟{2`1 .

Chapter 2 Classical and Quantum Search

In this chapter, we focus on classical and quantum algorithms for unstructured search problems, including Grover's algorithm, its generalization to Amplitude Amplification, and its exact variant. We give some well-known technical results covering our use of quantum search in the following chapters. We cover the sampling framework, a bridge that we will use to walk from classical to quantum search. Note that this framework is equivalent to the filter framework that we introduced in [BNS19b]. Finally, we describe the collision, multicollision and preimage search problems for random functions and their previous best classical and quantum algorithms.

Unordered Search

In this section, we will present Grover's algorithm [START_REF] Lov | A Fast Quantum Mechanical Algorithm for Database Search[END_REF] and its generalization to Amplitude Amplification [START_REF] Brassard | Quantum amplitude amplification and estimation[END_REF]. In the next chapters, we will refer to either of them by the term quantum search, but most often we will use the latter. These algorithms solve variants of the unordered search problem that we define as follows.

Problem 2.1 (Unordered search). Let 𝑋 be a set. Let 𝐺 Ď 𝑋 be a subset of 𝑋 ("good elements") and 𝑓 : 𝑋 Ñ t0, 1u a function ("test") such that 𝑓 p𝑥q " 1 ðñ 𝑥 P 𝐺. Find 𝑥 P 𝐺.

Classical Sampling

If no assumption is made on the function 𝑓 , then any classical randomized algorithm solving Problem 2.1 requires Ω p|𝑋|{|𝐺|q queries to 𝑓 , which is the average number of queries with random inputs 𝑥 before one of them is "good".

In order to emphasize the similarities between classical and quantum unordered search procedures, we will think of classical search as a sampling procedure that returns a random 𝑥 P 𝐺. In [BNS19b], the term filter is used, where a filter is thought of as a lazy sampling procedure. The presentation here will be equivalent.

Definition 2.1 (Classical sampling). Let 𝑋 be a set. A classical sampling procedure for 𝑋 is a randomized algorithm that requires no input and returns a random 𝑥 P 𝑋 that is uniformly distributed.

Classical unordered search can be seen as a function that turns a sampling Sample 𝑋 for 𝑋 into a sampling Sample 𝐺 for 𝐺 Ď 𝑋, using the information given by the test 𝑓 . 𝑥 Ð Sample 𝑋 pq 3: until 𝑓 p𝑥q " 1 return 𝑥

In the following, we let T c p𝒜q denote the classical average time complexity of a randomized algorithm 𝒜, and by abuse of notation, we use also 𝑓 to denote an algorithm that computes 𝑓 . We have: Lemma 2.1.

T c pSample 𝐺 q " |𝑋| |𝐺| pT c pSample 𝑋 q `Tc p𝑓 qq . (2.1)
Proof. A proof can be done by a direct computation. Each step of Sample 𝐺 invokes Sample 𝑋 and 𝑓 once. Let 𝑡 be the number of steps before we find 𝑥 P 𝐺:

Ep𝑡q " `8 ÿ 𝑡"1 𝑡 ˆ1 ´|𝐺| |𝑋| ˙𝑡´1 |𝐺| |𝑋| .
If we let 𝑓 p𝑥q " ř `8 𝑡"0 p1 ´𝑥q 𝑡 " 1 𝑥 , then Ep𝑡q " ´|𝐺| |𝑋| 𝑓 1 ´|𝐺| |𝑋| ¯. We conclude:

Ep𝑡q " ˆ|𝑋| |𝐺| ˙2 |𝐺| |𝑋| " |𝑋| |𝐺| .

Grover's Algorithm

In the quantum setting, Grover's algorithm [START_REF] Lov | A Fast Quantum Mechanical Algorithm for Database Search[END_REF] provides an elegant, efficient and optimal solution to Problem 2.1. In the following, we identify 𝑋 with a set of bit-strings t0, 1u

H b𝑛 𝑂 0 H b𝑛 ˜ÿ 𝑥 𝛼 𝑥 |𝑥y ¸" ÿ 𝑥 p2𝐴 ´𝛼𝑥 q |𝑥y .
Hence, it realizes a reflection around |𝑋y:

H b𝑛 𝑂 0 H b𝑛 " H b𝑛 p2 |0 𝑛 y x0 𝑛 | ´Iq H b𝑛 " 2 |𝑋y x𝑋| ´I .
The composition of these two reflections is a rotation of angle 2𝜃, as drawn in Figure 2.1. Optimality. A first optimality result was given in [START_REF] Bennett | Strengths and Weaknesses of Quantum Computing[END_REF], before Grover's algorithm was discovered. They show that when |𝐺| " 1, a quantum algorithm for Problem 2.1 requires Ωp a |𝑋|q queries to the oracle 𝑂 𝑓 . This bound was improved in [START_REF] Boyer | Tight bounds on quantum searching[END_REF]; later on, Zalka showed that Grover's algorithm was optimal [START_REF] Zalka | Grover's quantum searching algorithm is optimal[END_REF].

Number of iterates

Discussion on the Algorithm

Before we give the technical extensions of the algorithm that appeared later in the literature, let us discuss briefly its applicability.

Search space. In our presentation, we have assumed that the search space 𝑋 could be identified with bit-strings t0, 1u 𝑛 . That is, there exists an injective function, computable in polynomial time that maps an index 𝑖 P t0, 1u 𝑛 to 𝑥 𝑖 P 𝑋. This will always be the case in the following chapters, and it has multiple practical consequences: we can consider 𝑋 as an ordered set (as the indices have a canonical ordering) and we can perform a search in subsets of 𝑋 (by giving arbitrary values to some of the index bits).

Grover's algorithm as a database search. The original paper by Grover was entitled A fast quantum mechanical algorithm for database search. However, if 𝑋 represents a classical database, mapping indices 𝑖 to 𝑥 𝑖 is a memory access. Without QRACM, performing this operation in superposition over 𝑖 cannot be done in polyp𝑛q.

However, it applies without difficulty to many problems with a trivial search space, e.g., SAT solving or exhaustive key search in symmetric ciphers, making it one of the most well-known applications of quantum computers in symmetric cryptography.

Parallelization. The classical exhaustive search procedure (Algorithm 2.1) that solves Problem 2.1 can be perfectly distributed. If we run 𝑆 instances of the algorithm in parallel, then 𝐺 can be sampled in expected wall-clock time |𝑋| |𝐺|𝑆 and after a total number of |𝑋| |𝐺| iterations. In comparison, Grover's algorithm parallelizes badly. By running 𝑆 independent instances and stopping after 𝒪 ´b |𝑋| |𝐺|𝑆 ¯iterates, the measurement results will contain expectedly an element in 𝐺. The wall-clock time is reduced only by a factor ? 𝑆 and the total number of iterates increases by the same factor. This is proven optimal in [START_REF] Zalka | Grover's quantum searching algorithm is optimal[END_REF].

Limiting the number of queries. Grover's algorithm performs badly if we enforce a limit on the number of queries to 𝑂 𝑓 , or equivalently, on the time. While stopping a classical exhaustive search in 𝑋 after 𝑡 iterations yields a solution with success probability 𝒪 ´𝑡|𝐺| |𝑋| ¯, stopping Grover's algorithm after 𝑡 iterations yields a state that, if measured, gives a solution with probability 𝒪 ´𝑡2 |𝐺| |𝑋| ¯(this follows from an estimation of sin 2 pp2𝑡 `1q𝜃q). This is actually optimal (the proof follows from [START_REF] Zalka | Grover's quantum searching algorithm is optimal[END_REF]).

Amplitude Amplification

Amplitude Amplification, proposed by Brassard, Hoyer, Mosca, and Tapp, is a powerful generalization of Grover's algorithm. It allows to speed up the search for a "good" output of any probabilistic algorithm, including all kinds of exhaustive search problems.

]

. Then by measuring 𝒬 𝑡 𝒜 |0y, we obtain a good result with success probability greater than maxp1 ´𝑎, 𝑎q.

In Grover's algorithm, the Hadamard transform H b𝑛 plays the role of 𝒜. Indeed, immediately measuring H b𝑛 |0 𝑛 y produces a good result with probability 𝑎 " |𝐺| |𝑋| . The idea behind Amplitude Amplification is that we can now run a quantum search on the outputs of another quantum algorithm. But it goes even further. If the exact probability of success is known, then the search can be made exact: it will have a pre-determined number of iterations and a success probability 1.

Theorem 2.3 ([Bra+02]

, Theorem 4). Let 𝑎 be the success probability of 𝒜. Then there is a quantum algorithm QExactp𝒜, 𝑓, 𝑎q that finds a correct solution with probability 1 using Θ ´1 ? 𝑎 ¯evaluations of 𝒜.

If we note T q p𝒜q the quantum time complexity of 𝒜, then we have more precisely (for small 𝑎):

T q pQExactp𝒜, 𝑓, 𝑎qq " Initial state hkkikkj T q p𝒜q Z 𝜋 4𝜃 𝑎

^`1 looooooomooooooon

Includes the last modified iteration ˆ2T q p𝒜q looomooon Run 𝒜 and 𝒜 :

`Tq p𝑂 𝑓 q `Tq p𝑂 0 q ˙, where this complexity corresponds to the algorithm of Theorem 2.2 with a small modification. The idea is to go back to the iterates in Grover's algorithm. The probability of error comes from the fact that the iterates move the current state by a fixed angle 2𝜃 in the plane Span p|𝐵y , |𝐺yq, thus reaching only a vector that forms an angle less than 𝜃 with |𝐺y. However, it is possible to modify the angle in the last rotation in order to meet perfectly the target |𝐺y. This requires to implement rotation gates of arbitrary precision which is, in turn, doable with a limited universal gate set thanks to the Solovay-Kitaev theorem (Theorem 1.1).

With unknown success probability. If the success probability is unknown, we can rely on the following theorem.

Theorem 2.4 ([Bra+02], Theorem 3). Let 𝒜 be a quantum algorithm without measurements of unknown success probability 𝑎 ą 0, 𝑓 a function that tests the outputs of 𝒜. Then there is an algorithm QSearchp𝒜, 𝑓 q that finds a correct solution using an expected Θ ´1 ? 𝑎 ¯evaluations of 𝒜 and 𝑓 .

The idea of Algorithm 2.2 is to run the Amplitude Amplification procedure with an exponentially increasing number of iterations, until the solution is found. At the beginning, the end state is only negligibly rotated in Span p|𝐵y , |𝐺yq and it is close to the uniform state |𝑋y (which is close to |𝐵y if there are only few solutions). However, once the number of iterations reaches and exceeds the optimal value

Y 𝜋 4 arcsinp ? 𝑎q ]
, the end state roughly becomes a random unit vector in Span p|𝐵y , |𝐺yq, hence sin 𝜑 |𝐺y `cos 𝜑 |𝐵y for a random angle 𝜑. Hence, measuring projects in 𝐺 with probability 1 2 . If 𝑎 " 0, the algorithm runs indefinitely. Usually we know that either 𝑎 " 0, either is it lower bounded by 𝑏. In that case, we use QSearchp𝒜, 𝑓 q and stop it when 𝑀 ? 𝑏 exceeds some fixed constant value. The algorithm has one-sided errors: it can return K even with a solution exists, in the case where all Steps 6 with 𝑀 ą Y 𝜋

arcsinp

? 𝑎q ] fail. Since each of them has a constant probability of failure, the constant in the 𝒪 will be proportional to 𝜖 in order to have a failure probability less than With a good interval. We can wish for more efficiency if an interval r𝑎p1´𝜖q, 𝑎p1`𝜖qs on the success probability of 𝒜 is given. In that case, we do not need to use the full power of Theorem 2.4. A single run of quantum search by assuming a success probability 𝑎 ensures a high success probability, as long as the relative error 𝜖 is small enough.

Theorem 2.5 (Lemma 5 in [BNS19b]). Assume that 𝒜 has a success probability 𝑎 1 P r𝑎p1 ´𝜖q, 𝑎p1 `𝜖qs for 𝜖 ď 1 2 . Then after running an Exact Amplitude Amplification QExactp𝒜, 𝑎q that assumes a success probability exactly equal to 𝑎, we measure a good state with probability greater than 1 ´𝜖2 .

Proof. An exact amplitude amplification with parameter 𝑎 results in a rotation of angle 𝜃 " 𝜋 2 ?

1 ˘𝜖 instead of 𝜋 2 in the plane spanned by good and bad results for 𝒜. If we measure immediately, the probability of failure is given by cos 2 𝜃. We bound | cos 𝜃| by:

| cos 𝜃| " ˇˇsin ´𝜃 ´𝜋 2 ¯ˇˇď ˇˇ𝜃 ´𝜋 2 ˇˇď 𝜋 2 p ? 1 `𝜖 ´1q .
Then, we use that ? 1 `𝜖 ď 1 `𝜖 2 for 𝜖 ď 1 2 , and 𝜋 4 ď 1. The result follows.

Finding Many Solutions

Classically, since Algorithm 2.1 samples elements at random from 𝐺, finding 𝑀 ! a |𝐺| solutions costs time 𝑀 ¨|𝑋| |𝐺| , as all outputs are distinct with high probability. However, learning all of 𝐺 may be slightly more difficult, as this is an instance of the coupon collector problem.

Problem 2.2 (Coupon collector). Given uniformly random samples from a set 𝐺, learn 𝐺.

It is well-known that Θp|𝐺| log |𝐺|q queries are necessary and sufficient to solve this problem with overwhelming probability ([MR10, Theorem 3.8]). In our case, we assumed that the elements of 𝑋 are uniquely indexed by bit-strings, which means that 𝑋 is ordered. Thus, we can adapt the "sampling" framework from Section 2.1.1 to iterate on the elements of 𝑋 without duplicates. That is, Algorithm 2.1 will maintain an internal iterator, ensuring that it never looks twice at the same 𝑥 P 𝑋. As a consequence, the same property follows for the elements sampled from 𝐺, which have no duplicates.

Thus, if we wish to obtain a particular number of solutions, we should just set up the size of the search space 𝑋 so that 𝐺 is of sufficient cardinality.

With quantum search. Quantumly, it is known that Θp a |𝑋||𝐺|q queries are necessary (as shown in [START_REF] Klauck | Quantum and Classical Strong Direct Product Theorems and Optimal Time-Space Tradeoffs[END_REF]). If we consider that exact copies of the state |𝐺y are given, and that we have to learn 𝐺 from it, the problem is similar [START_REF] Arunachalam | Quantum Coupon Collector[END_REF].

Lemma 2.4. Given |𝐺|, there is a quantum algorithm QFindAllp𝑋, 𝐺q that finds all elements of 𝐺 Ď 𝑋, using 𝒪 ´a|𝑋||𝐺| ¯queries to 𝑂 𝑓 and 𝒪 ´a|𝑋||𝐺| ¯time in the QRACM model.

Proof. The correctness of Algorithm 2.3 is trivial. We simply prove its time complexity: 𝑅 Ð 𝑅 Y t𝑧u return 𝑅 Lemma 2.4 allows us to remove the logarithmic factor of the coupon collector, but it relies heavily on the knowledge of |𝐺| and on the QRACM. Without QRACM, we will instead re-run 𝒪p|𝐺| log |𝐺|q independent searches and dismiss duplicate results.

|𝐺|´1 ÿ 𝑖"0 𝒪 ˜d |𝑋| |𝐺| ´𝑖 ¸" 𝒪 ´a|𝑋| ¯|𝐺| ÿ

Approximate Test Functions

In the following chapters, we will encounter some cases where the test 𝑓 is not exact, encompassed by the following definition.

Definition 2.2 (Approximate test

). An approximate test oracle 𝑂 𝑓 with error at most 𝜖 is a unitary operator that maps:

|𝑥y |𝑏y 𝑂 𝑓 Þ Ý Ý Ñ |𝑥y |𝑏 ' 𝑓 p𝑥qy `|𝑥y |𝛿 𝑥 y ,
where } |𝛿 𝑥 y } ď 𝜖 for all 𝑥, and some 𝜖 ą 0.

Note that this definition can be used as well with a phase oracle. We can also say that upon measurement, the probability of error is less than 𝜖. The definition for a phase oracle is similar. In the following, we also consider that the approximate test uses an ancillary state |𝜓y. ] iterations of:

𝒬 1 " pI b 𝒜qpI b 𝑂 0 qpI b 𝒜 : q𝑂 1 𝑓 ,
where I is the identity operator applied to the ancillary state |𝜓y. Then measuring the output yields a good result with probability greater than p1 ´𝑎q p1 ´𝑡𝜖q 2 .

Proof. The proof uses a "hybrid argument" as in [START_REF] Bennett | Strengths and Weaknesses of Quantum Computing[END_REF] or [Amb07, Lemma 5]. The idea is that if the error vector is sufficiently small, errors will go unnoticed during the search. Let |𝜓 1 𝑘 y be the state after 𝑘 iterations of 𝒬 1 , and let |𝜓 𝑘 y be the state after 𝑘 iterations of the "ideal" operator 𝒬 where the test 𝑂 𝑓 is exact.

Let 𝑈 " pI b 𝒜q𝑂 0 pI b 𝒜 : q. We deduce from the triangle inequality:

› › |𝜓 1 𝑘`1 y ´|𝜓 𝑘`1 y › › " › › 𝑈 𝑂 1 𝑓 |𝜓 1 𝑘 y ´𝑈 𝑂 𝑓 |𝜓 𝑘 y › › " › › 𝑈 𝑂 𝑓 |𝜓 1 𝑘 y `𝑈 𝛿 ´𝑈 𝑂 𝑓 |𝜓 𝑘 y › › ď › › 𝑈 𝑂 𝑓 p|𝜓 1 𝑘 y ´|𝜓 𝑘 yq › › `}𝑈 𝛿} ď › › |𝜓 1 𝑘 y ´|𝜓 𝑘 y › › `𝜖 .
Hence we have |𝜓 1 𝑡 y " |𝜓 𝑡 y`|𝜓 err y where }|𝜓 err y} ď 𝑡𝜖. By the Cauchy-Schwarz inequality, we have:

|x𝜓 𝑡 |𝜓 err y| ď }|𝜓 𝑡 y} }|𝜓 err y} ď 𝑡𝜖 .

Measuring |𝜓 1

𝑡 y, we project on |𝜓 𝑡 y with a probability greater than:

p1 ´|x𝜓 𝑡 |𝜓 err y| 2 q ě p1 ´𝑡𝜖q 2 , which we combine with Theorem 2.2 to obtain the result.

Nested Search

Many problems admit a significant quantum speedup when using a single Grover search instead of a classical exhaustive search, e.g., in the search for a good permutation in Information Set Decoding [START_REF] Daniel | Grover vs. McEliece[END_REF]. However, the variety of search problems that can be solved efficiently with a combination of searches is even greater. In this section, we define a class of sampling algorithms which both admit a classical and a quantum variant, with a square-root speedup between them. They are especially useful to analyze complex procedures based on exhaustive search, by using classical procedures as prototypes, as we will do in Chapter 9.

Quantum Search as a Sampling Procedure

Recall that we let T q p𝒜q denote the quantum time complexity of a quantum algorithm 𝒜.

In Section 2.1.1, we defined a classical sampling Sample 𝑋 as a function producing a uniformly random 𝑥 P 𝑋. We showed that classical unordered search turned a sampling Sample 𝑋 into a sampling Sample 𝐺 for the good subspace. We can now proceed by analogy in the quantum setting. Definition 2.3 (Quantum sampling). Let 𝑋 be a set. A quantum sampling procedure for 𝑋 is a quantum algorithm that requires no specific input (e.g., |0y) and returns the uniform superposition ř 𝑥P𝑋 |𝑥y.

In Grover's algorithm, as 𝑋 " t0, 1u 𝑛 , this procedure is simply the Hadamard transform H b𝑛 .

Then, quantum search can be seen as a mapping that turns a quantum sampling QSample 𝑋 for 𝑋 into a sampling QSample 𝐺 for 𝐺 " 𝑋| 𝑓 " t𝑥 P 𝑋, 𝑓 p𝑥q " 1u, using evaluations of the quantum oracle 𝑂 𝑓 . We use exact Amplitude Amplification (Theorem 2.3).

T q pQSample 𝐺 q " ´Y 𝜋 4𝜃 ] `1¯p T q pQSample 𝑋 q `Tq p𝑂 𝑓 qq . (2.2)
If |𝐺| and |𝑋| are big and if we are interested only in asymptotic complexities, the formulas:

T c pSample 𝐺 q "
|𝑋| |𝐺| pT c pSample 𝑋 q `Tc p𝑓 qq and T q pQSample 𝐺 q " d |𝑋| |𝐺| pT q pQSample 𝑋 q `Tq p𝑂 𝑓 qq are similar up to the square-root factor in the number of iterations.

Nesting

In the following, if 𝑋 if the search space and 𝐺 the "good" subspace, we let qiter p𝑋, 𝐺q denote the number of iterations of quantum search, iter p𝑋, 𝐺q for classical search, and also 𝐺 " 𝑋| 𝑓 the subset of elements that satisfy the condition 𝑓 .

When the test is a product. Suppose that 𝑓 " 𝑓 1 ^𝑓2 . For example

T c ´Sample 𝑋| 𝑓 1 ^𝑓2
¯" iter p𝑋, 𝑋| 𝑓 1 ^𝑓2 q pSample 𝑋 `Tc p𝑓 1 q `Tc p𝑓 2 qq and Algorithm 2.5 gives:

T c ´Sample 𝑋| 𝑓 1 ^𝑓2 ¯" iter p𝑋| 𝑓 1 , 𝑋| 𝑓 1 ^𝑓2 q ´Sample 𝑋| 𝑓 1 `Tc p𝑓 2 q "
iter p𝑋| 𝑓 1 , 𝑋| 𝑓 1 ^𝑓2 q piter p𝑋, 𝑋| 𝑓 1 q pT c pSample 𝑋 q `Tc p𝑓 1 qq `Tc p𝑓 2 qq where we can remark that iter p𝑋| 𝑓 1 , 𝑋| 𝑓 1 ^𝑓2 q iter p𝑋, 𝑋| 𝑓 1 q " iter p𝑋, 𝑋| 𝑓 1 ^𝑓2 q. In other words, the total number of iterations remains the same, but we only test for 𝑓 2 if 𝑓 1 is already satisfied (or the converse).

When the search space is a product. Suppose that 𝑋 " 𝑋 1 ˆ𝑋2 , with a test 𝑓 : 𝑋 1 ˆ𝑋2 Ñ t0, 1u. Again, there are different ways of implementing this search. We see that Algorithm 2.6 repeats samples of 𝑋 1 that could be simply reused. For example, if there is only a single solution in 𝑋 1 ˆ𝑋2 , then Algorithm 2.7 corresponds to searching in 𝑋 1 for 𝑥 1 such that there exists 𝑥 2 P 𝑋 2 with 𝑓 p𝑥 1 , 𝑥 2 q. Thus, while before the sampling contained another search, now it is the test, and we go from:

T c ´Sample 𝑋 1 ˆ𝑋2 | 𝑓 ¯" |𝑋 1 ˆ𝑋2 | `Tc `Sample 𝑋 1 ˘`T c `Sample 𝑋 2 ˘`T c p𝑓 q ˘ to: T c ´Sample 𝑋 1 ˆ𝑋2 | 𝑓 ¯" |𝑋 1 | ˆTc `Sample 𝑋 1 ˘`|𝑋 2 | `Tc `Sample 𝑋 2 ˘`T c p𝑓 q ˘˙. Algorithm 2.6 Direct implementation of Sample 𝑋 1 ˆ𝑋2 | 𝑓 1: repeat 2: 𝑥 1 Ð Sample 𝑋 1 3: 𝑥 2 Ð Sample 𝑋 2 4: until 𝑓 p𝑥 1 , 𝑥 2 q return 𝑥 1 , 𝑥 2 Algorithm 2.7 Nested implementation of Sample 𝑋 1 ˆ𝑋2 | 𝑓 1: repeat 2: 𝑥 1 Ð Sample 𝑋 1 3: repeat 4: 𝑥 2 Ð Sample 𝑋 2 5:
until 𝑓 p𝑥 1 , 𝑥 2 q or 𝑋 2 is exhausted 6: until 𝑓 p𝑥 1 , 𝑥 2 q return p𝑥 1 , 𝑥 2 q

Quantum-Classical Correspondence

The above discussion justifies to define Sample programs as follows, encompassing early-abort strategies and nested searches.

Definition 2.4 (Sample programs). A Sample program samples an element of some space 𝑋. It is defined recursively by: ' a randomized algorithm Sample 𝑋 that simply samples uniformly at random from 𝑋, ' another sample (or a sequence of a fixed number of samples), and a test, both of which can be Sample programs.

If we write down a classical Sample program, we can use Lemma 2.5 recursively and replace all of its subprocedures by quantum samples, obtaining the following (informal) result.

Theorem 2.7. Let 𝒜 be a classical algorithm written as a combination of Samples, with a constant amount of nesting. Let us write down the classical complexity of 𝒜 as a function of the number of iterations of each Sample:

T c p𝒜q " 𝑇 p𝐼 1 , . . . , 𝐼 𝑡 q ,
and assume that all non-sample operations of 𝒜 are written in a reversible way (in order to avoid trade-offs for reversible computing). Then there exists a quantum algorithm 𝒜 1 , that admits the same distribution of outputs as 𝒜, and has a time complexity:

T q `𝒜1 ˘" 𝒪 ´𝑇 ´a𝐼 1 , . . . , a 𝐼 𝑡 ¯¯.
Proof. The proof is a simple induction using Lemma 2.5 and the definition of a Sample.

Example 2.1 (Product test). The classical Sample of Algorithm 2.5 translates into a combination of two quantum searches: QSearchpQSearchpSample 𝑋 , 𝑓 1 q, 𝑓 2 q. It has the following complexity, up to a constant:

T q ´QSample 𝑋| 𝑓 1 ^𝑓2
¯" b iter p𝑋| 𝑓 1 , 𝑋| 𝑓 1 ^𝑓2 q ´biter p𝑋, 𝑋| 𝑓 1 q pT q pSample 𝑋 q `Tq p𝑓 1 qq `Tq p𝑓 2 q ¯.

Note that we cannot actually use Algorithm 2.2 here, and we must resort to an estimate of the success probability with Theorem 2.5.

Example 2.2 (Product search space). With a single solution, the classical Sample or Algorithm 2.7 has a quantum equivalent with the following complexity, up to a constant:

T q ´QSample 𝑋 1 ˆ𝑋2 | 𝑓 ¯" a |𝑋 1 | ˆTc `Sample 𝑋 1 ˘`a |𝑋 2 | `Tc `Sample 𝑋 2 ˘`T c p𝑓 q ˘˙.
Theorem 2.7 allows us to design quantum sampling procedures in two stages: 1. we specify a classical Sample program, determine its complexity and use the theorem to estimate the complexity of a corresponding quantum sampling. 2. we use more precise results on quantum search to determine the success probability of the quantum sampling and its complexity. This separates the classical and quantum technicalities, and allows to delay the latter as much as possible. We will use this design principle in Chapter 9.

Notations

In the following chapters, we will write many algorithms as Sample programs, in order to use the classical-quantum correspondence of Theorem 2.7. As we saw above, these programs are easily translated as combinations of classical repeat-until loops, or quantum searches, with a quadratic correspondence in the number of search iterates. Inside a Sample block, we define a variable 𝑥 sampled from some search space 𝑋, and we evaluate some intricate Boolean condition on 𝑋. This requires further computations, and possibly invoking other Samples. By abuse of notation, we will add keywords such as if and abort to emphasize where this Boolean condition is evaluated lazily. After the Sample block, 𝑥 contains either a value that satisfies the condition, or K, if there is no such value. An example is given in Algorithm 2.8.

Collisions

We now review generic algorithms for finding collisions, which give upper bounds in the study of hash functions and modes of operation, but also building blocks for cryptanalytic algorithms. Throughout this section, ℎ : t0, 1u 𝑛 Ñ t0, 1u 𝑛 is a random function to which we have quantum oracle access. If the function ℎ picked at random does not have collisions, then all algorithms for Problem 2.3 will fail. More generally, the problems that we define here may not have any solutions, but the probability of such an event goes into the probability of failure of the corresponding algorithms.

A problem similar to collision search is claw-finding, where we want a collision between the outputs of two independent random functions 𝑓, 𝑔.

Problem 2.4 (Claw-finding). Given access to 𝑓, 𝑔 : t0, 1u 𝑛 Ñ t0, 1u 𝑛 , find a claw between 𝑓 and 𝑔: a pair 𝑥, 𝑦 such that 𝑓 p𝑥q " 𝑔p𝑦q.

These problems are equivalent. On the one hand, we can define the function ℎ : t0, 1u ˆt0, 1u 𝑛 Ñ t0, 1u 𝑛 by ℎp0, 𝑥q " 𝑓 p𝑥q and ℎp1, 𝑥q " 𝑔p𝑥q, then a collision pair of ℎ yields a claw of 𝑓, 𝑔 with probability 1 2 . Multicollisions extend this to an 𝑟-tuple of colliding elements.

Problem 2.5 (Multicollision search).

Let 𝑟 ě 2 be an integer. Find an 𝑟-collision: a tuple 𝑥 1 , . . . , 𝑥 𝑟 of distinct inputs such that ℎp𝑥 1 q " . . . " ℎp𝑥 𝑟 q.

Finally, we also consider preimage search problems.

Problem 2.6 (Preimage Search). Given access to ℎ, and a target 𝑦, find 𝑥 P t0, 1u 𝑛 such that ℎp𝑥q " 𝑦 (if it exists). Problem 2.7 (Multi-target Preimage Search). Given access to ℎ, and a list of targets ℒ " t𝑦 0 , . . . , 𝑦 𝐿´1 u, find 𝑥 P t0, 1u 𝑛 such that D𝑖 P r0; 𝐿 ´1s, ℎp𝑥q " 𝑦 𝑖 .

Note that the case where ℎ admits a single collision, or where such a function has to be distinguished from injective, is the well-studied element distinctness problem, which will appear in Chapter 6. It admits classical and quantum algorithms whose time complexities are the square of those of this chapter. Ambainis gave an optimal algorithm in the QRAQM model [START_REF] Ambainis | Quantum Walk Algorithm for Element Distinctness[END_REF] and we gave the best algorithms to date in the plain circuit model (without qRAM gates) in [JS20].

Classical Algorithms

For a random function, collision search requires provably Ωp2 𝑛{2 q queries. By the birthday paradox, among 2 𝑛{2 queries to ℎ, a collision will occur with constant probability (since 2 𝑛 pairs are formed). Pollard's rho method, introduced in [Pol] with the purpose of factoring integers, gives an elegant solution meeting this bound with polyp𝑛q memory. It relies on iterating the function ℎ, starting with a random 𝑥 0 P t0, 1u 𝑛 and defining the sequence 𝑥 𝑖`1 " ℎp𝑥 𝑖 q. After an expected number of 𝒪 `2𝑛{2 ˘iterations, a collision between the current 𝑥 𝑖 and one of the previous 𝑥 𝑗 will eventually occur, and the sequence will start to loop, as shown in Figure 2.2. Thus, the shape of the graph is reminiscent of the Greek letter 𝜌. The collision is found with a cycle-finding algorithm, for example Algorithm 2.9 (which is credited to Floyd by Knuth [Knu14]).

𝑥 0 𝑥 1 𝑥 2 𝑥 3 𝑥 4 𝑥 5 𝑥 6 𝑥 7 𝑥 8 𝑥 9 𝑥 10 𝑥 11
At

Step 4, we have 𝑥 " 𝑦 " ℎ 𝑖 p𝑥 0 q " ℎ 2𝑖 p𝑥 0 q for some 𝑖 and the value lies somewhere along the circle of the 𝜌. Let 𝑖 0 be the first index such that ℎ 𝑖 0 `ℓp𝑥 0 q " ℎ 𝑖 0 p𝑥 0 q, where ℓ is the length of the cycle. We know that 𝑖 is a multiple of ℓ. At Step 9 we have 𝑥 " ℎ 𝑗 p𝑥 0 q " ℎ 2𝑖`𝑗 p𝑥 0 q for some 𝑗, which implies that 𝑗 " 𝑖 0 is the top of the 𝜌. Thus, 𝑥 1 " ℎ 𝑖 0 ´1p𝑥 0 q and 𝑦 1 " ℎ 2𝑖`𝑖 0 p𝑥 0 q are indeed distinct values. The algorithm will perform another loop if we want to retrieve the cycle length.

There is no quantum Pollard's rho. The idea of iterating the function has found many other applications in related problems, e.g., in van Oorschot-Wiener distributed collision search [START_REF] Paul | Parallel Collision Search with Cryptanalytic Applications[END_REF] or Nikolic and Sasaki's time-memory trade-offs for the Generalized Birthday Problem [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF]. However, this technique has found almost no use in quantum algorithms.

Algorithm 2.9 Floyd's cycle-finding algorithm

Input: starting point 𝑥 0 Output: a collision of ℎ 1: Initialize: 𝑥 Ð 𝑥 0 , 𝑦 Ð 𝑥 0 2: repeat 3: 𝑥 Ð ℎp𝑥q, 𝑦 Ð ℎ 2 p𝑦q 4: until 𝑥 " 𝑦 5: Restart: 𝑥 Ð 𝑥 0 6: repeat 7:

𝑥 1 Ð 𝑥, 𝑦 1 Ð 𝑦 1 8: 𝑥 Ð ℎp𝑥q, 𝑦 Ð ℎp𝑦q 9: until 𝑥 " 𝑦 10: return 𝑥 1 , 𝑦 1
Iterating a function is done in [START_REF] Banegas | Low-Communication Parallel Quantum Multi-Target Preimage Search[END_REF] in a distributed multi-target preimage search algorithm. It is also done in [JS20], but without any advantage over other methods.

Intuitively, the probability of finding a collision of ℎ 𝑖 increases quadratically with 𝑖. This does not impact the time complexity, as ℎ must be evaluated the same number of times, but the memory can be reduced by storing chain-ends ℎ 𝑖 p𝑥q of exponentially long chains instead of the whole chain. In the quantum setting, iterations must be performed in sequence, and iterating ℎ costs the same as classically. Meanwhile, quantum search achieves a quadratic advantage over exhaustive search. A direct Grover search for collision pairs 𝑥, 𝑦 among pt0, 1u 𝑛 q 2 gives a time 𝒪 `2𝑛{2 ˘, which competes with Pollard's rho. Hence, the potential of iterating is weakened by the relative efficiency of quantum search. This is why none of the quantum algorithms presented in this thesis use iterations of ℎ.

Multi-target preimage search. For a random function, the best and optimal classical method for preimage search with 𝐿 targets is exhaustive search in time 𝒪 `2𝑛 𝐿 ˘[And+08], using a random-access memory of size 𝐿. No classical single-processor algorithm with time-memory product smaller than 2 𝑛 is known. Even though, it is possible to divide efficiently the work among many processors, and / or to batch many attacks, by computing chain-ends as in Hellman's time-memory trade-off [Hel80; Oec03].

Quantum Collision Search

The first quantum collision search algorithm (Algorithm 2.10) with a query speedup was proposed by Brassard, Høyer and Tapp [START_REF] Brassard | Quantum Cryptanalysis of Hash and Claw-Free Functions[END_REF]. Although they considered two-to-one functions, the algorithm works similarly with random functions, and we analyze it in this setting.

Using an appropriate data structure, the complexity of the algorithm is tight. Using a unique prefix list instead of a full-fledged set data structure is not a strong restriction if the function is random, and this enables us to perform membership queries using 𝒪p1q qRAM gates only.

Hence, Step 1 gives us p1 ´𝑒´1 q𝐿 distinct images. Since the function is random, the average probability, for an element among the 2 𝑛 ´𝐿 remaining inputs, to collide on this list, is p1´𝑒 ´1q𝐿 2 𝑛 . The exact probability for a given instance is unknown, but we can use Amplitude Amplification. Thus, the number of iterates in Step 2 is on average 𝒪 ´b 2 𝑛 𝐿 ¯. Each iterate contains only 𝒪p1q qRAM gates and 𝒪p𝑛q other gates. The time complexities between Step 1 and Step 2 are balanced when 𝐿 " 𝒪 `2𝑛{3 ˘, with 𝒪 `2𝑛{3 ˘time and queries. Algorithm 2.10 can be seen as a quantum version of the "naïve" classical collision search, which would build a table of size 2 𝑛{2 . It can also be seen as a quantum algorithm for multi-target preimage search (Problem 2.7) specialized at finding collisions. As of today, no quantum collision search algorithm goes below the time-memory trade-off curve 𝑇 2 ¨𝑀 " 2 𝑛 .

Remark 2.1. The unique prefix list of Section 1.3.2, where the memory addresses of the stored elements are given by their prefixes, is the most appropriate data structure for this kind of problem. Reading and writing require only 𝒪p1q qRAM gates and the list is populated with random bit-strings. This remains true for the merging algorithms that we will study in Chapter 5.

Remark 2.2. Grover and Rudolph [START_REF] Lov | How significant are the known collision and element distinctness quantum algorithms?[END_REF] argued that the QRACM requirement of Algorithm 2.10 could make it more expensive than classical collision search, unless the QRACM can be realized as a physical component without any active error correction. Indeed, if maintaining 𝐿 memory cells costs 𝒪p𝐿q error correction operations per time step, then the trade-off curve of the BHT algorithm is above the classical one. Later, Bernstein [START_REF] Daniel | Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete?[END_REF] drew similar arguments. In fact, without QRACM, no quantum speedup was known previous to the algorithm that will be presented at the beginning of Chapter 5.

Lower bound. After this result, the query lower bound for the collision problem was improved in successive works [Aar02; AS04; Amb05; Kut05] until reaching the bound Ωp2 𝑛{3 q for 2-to-1 functions, which was shown to hold as well for random functions [START_REF] Zhandry | A note on the quantum collision and set equality problems[END_REF].

Limiting the number of queries. In Chapter 2, we have seen how the success probability of quantum exhaustive search scales with the number of queries allowed: if we search for a single solution in a space of size 2 𝐿 ¯iterations of Grover search, each of which queries a QRACM of size 𝐿 that holds the targets. Banegas and Bernstein [START_REF] Banegas | Low-Communication Parallel Quantum Multi-Target Preimage Search[END_REF] gave a distributed quantum algorithm for this problem, but it does not perform better for a single processor. The best time-memory trade-off for classical algorithms remains 𝑇 ¨𝑀 " 2 𝑛 , and the quantum trade-off is 𝑇 2 ¨𝑀 " 2 𝑛 , with 𝑀 ď 𝐿 deciding how many targets we consider for the search.

Quantum Multicollision Search

In [START_REF] Hosoyamada | Quantum Multicollision Finding Algorithm[END_REF], Hosoyamada, Sasaki, and Xagawa presented a quantum algorithm for multicollision search, which was later improved in [START_REF] Hosoyamada | Improved Quantum Multicollision-Finding Algorithm[END_REF]. For a constant 𝑟, it runs

in time r 𝒪 `2 𝑛 2 ´1´1
2 𝑟´1 ´1 ¯˘, using the same amount of queries and QRACM. This query complexity was proven optimal for 𝑟 ą 2 by Liu and Zhandry [START_REF] Liu | On Finding Quantum Multi-collisions[END_REF].

Optimizing Algorithm 2.11 with a classical exhaustive search at line 12 gives the classical complexity, up to a constant factor in 𝑟. Optimizing with quantum search instead gives: , and all terms should be of the same order. The result follows.

@1 ď 𝑖 ď 𝑟, ℓ 𝑖 " ˆ1 ´1 2 𝑟´1 ˙ˆ1 ´1 2 𝑖 ˙´ˆ1 ´1 2 𝑖´1
Hidden constants. The classical "hidden constant" of 𝑟-collision search is of the order p𝑟!q 1{𝑟 : we are ensured that, given a t0, 1u 𝑛 Ñ t0, 1u 𝑛 random function, the probability to find an 𝑟-collision after p𝑟!q 1{𝑟 2 𝑛p𝑟´1q{𝑟 queries is higher than 1 ´1{𝑒. The situation is different in Algorithm 2.11. From [FO89, 3.3, Theorem 4], the average probability that a given 𝑖-collision can be extended to an 𝑖 `1-collision is 1 𝑖 . Thus, there is a constraint on the sizes of the intermediate lists ℒ 𝑖 : 2 𝑛ℓ 𝑖 ě p𝑟´1q! p𝑖´1q! . This suggests that the multiplicative factor may contain a factorial in 𝑟 (contrary to the classical setting).

Chapter 3 Introduction to Cryptography

In this chapter, we set up some standard notions and definitions in cryptography. After a brief historical detour, we recall in Section 3.1 notions of security, of security margin, the role of cryptanalysis, and how quantum computers may put today's computational security guarantees in peril. We separate generic and dedicated attacks, both being studied in the following chapters. In Section 3.4, we define attack settings, notably "Q1" and "Q2", and common symmetric primitives such as ciphers, hash functions, MACs. We give a list of previous known generic attacks on ideal primitives, classical and quantum. Then with great rewards he induces a certain man of the Gallic horse to convey a letter to Cicero. This he sends written in Greek characters, lest the letter being intercepted, our measures should be discovered by the enemy. He directs him, if he should be unable to enter, to throw his spear with the letter fastened to the thong, inside the fortifications of the camp.

Contents

As can be inferred from this excerpt, early cryptographers used a variety of ad hoc linguistic tricks. The paradigm shift that put cryptography in the hands of mathematicians seems to have occurred in modern times, notably with the foundational work of Auguste Kerckhoffs [Ker83a; Ker83b], who edicted six rules known today as Kerckhoffs' principles. These rules were intended to guide the design of ciphers for military use. Nowadays, computers have replaced electromechanical ciphering machines and cryptosystems, which were a tool for diplomatic and military personnel, have become essential building blocks of the Information Era. Yet, Kerckhoffs' principles have remained valid.

Computational secrecy. Kerckhoff's first principle dictates: The cryptosystem should be materially or mathematically impossible to decrypt. Modern cryptography focuses on computational security, introduced by Shannon in [START_REF] Shannon | Communication theory of secrecy systems[END_REF], where the problem of recovering the secret information ought to be computationally intractable.

Remark 3.1. This situation was translated in terms of complexity classes by Diffie and Hellman [START_REF] Diffie | New directions in cryptography[END_REF]: if encryption and decryption under a given secret are polynomial-time operations, then the problem of finding the secret belongs to the complexity class NP, but it should be sufficiently hard in this class.

Public algorithms. Kerckhoff's second principle reads: The system should not require secrecy. It should not be a problem if it falls into enemy hands. Nowadays, common sense dictates that the specification of a cryptographic algorithm (or function, or primitive) should be public.

Portability and lightness.

Kerckhoff's four other principles focus on the usability of the cryptosystem. He required it to be compatible with telegraph transmissions and to require only few human resources to handle and operate. Today, cryptographic algorithms are not computed by hand, but equivalent necessities still prevail. As more and more devices are being connected to the Internet, cryptographic algorithms are challenged by very constrained environments, with limits either in latency, number of operations, or circuit size. Thus, a need for secure lightweight primitives has arisen, embodied today by the ongoing standardization process launched by the NIST (see Section 3.3).

Cryptanalysis. While cryptography is the science of protecting information, cryptanalysis is the science of overcoming the defenses that cryptographers tried to set up. The oldest known written work about cryptanalysis is by Al-Kindi, an Arab scientist and philosopher born around 801 A.D. In his book A Manuscrit on Deciphering Cryptographic Messages, he introduced notably the statistical cryptanalysis of mono-alphabetic ciphers such as Caesar's, and the use of probable words [Sin99; . Nowadays, cryptography and cryptanalysis are deeply intertwined. In order to have good working cryptography, both lines of work are necessary, and they must communicate deeply with each other: a public effort of cryptanalysis incurs confidence in the designs that have remained unbroken. Meanwhile, our knowledge of cryptanalysis techniques, which is constantly renewed, helps in creating designs that reach a better balance between cost and security.

Branches. Cryptography is nowadays divided into two main subfields: symmetric (Section 3.1.1) and asymmetric (Section 3.1.2).

Symmetric Cryptography and its Security

The elderly branch of cryptology, that dates back to Caesar and Al-Kindi, is symmetric or secret-key cryptography. In this setting, the two users, conveniently named Alice and Bob, are assumed to possess a shared secret key 𝐾 that enables them to communicate securely on an insecure channel (e.g., a Gallic horseman, or the Internet).

Generic bounds. Symmetric designs start from primitives, small algorithms (for example, block ciphers or permutations) that handle a fixed amount of data, e.g., 128 bits, and offer only little functionality.

In full generality, a primitive is considered secure if it behaves like an ideal primitive, where the definition of ideal depends on the context. Writing a cryptanalytic attack is, in a sense, writing a proof that the primitive is not ideal.

There are generic bounds that apply to all primitives of a certain type, e.g., for a cipher, exhaustive search of the secret key 𝑘. Hence, an ideal cipher only needs to dimension the parameter 𝑘 according to the security level wanted. For example, while keys of 56 bits seemed fine at the time it was designed, the former cryptographic standard [DES] is today an easy target for this attack.

Dedicated attacks.

The goal of cryptanalysis is to ensure that a given primitive does not admit better dedicated attacks than the generic ones. If an attack exists, regardless of its practicality, the primitive can be declared broken. An attack reveals a weakness that cannot be fixed without changing the algorithm, and that can only get worse. Thus, a continued study of both generic and dedicated attacks is necessary to set the generic bound, check that it remains impractical and verify that it is met.

Notion of security margin. The security of a primitive is not a one-bit information. It is commonly inferred by the success of attacks on weakened versions. As an example, the best key-recoveries against the standard AES-256 [AES] manage to break a version reduced to 9 rounds out of 14. Thus, AES-256 still benefits of a 5{14 " 36% margin.

Constructions and generic attacks. Primitives are used as building blocks in constructions such as modes of encryption, MACs, AEAD schemes, etc. If the primitive behaves as ideal, then only some generic attacks can be applied to the construction. But these attacks also need a careful study. Figure 3 A public-key cryptosystem is said broken if the underlying hard problem turns out not to be hard, that is, solvable in polynomial time in the system's parameters. While the symmetric cryptanalysis effort focuses in breaking specific primitives or constructions, public-key cryptography requires in addition to improve the algorithms available for these problems. Then, the parameter sizes (e.g., the bit-size of 𝑝 in Algorithm 3.1) are dimensioned as to meet some given security levels. Public-key schemes are much heavier than secret-key schemes, whether in time, memory or bandwidth, and determining their security level with precision is necessary, if only to compare them fairly.

Post-Quantum Cryptography

In 1994, Shor [START_REF] Shor | Algorithms for Quantum Computation: Discrete Logarithms and Factoring[END_REF] discovered a quantum algorithm that solves the Abelian hidden period problem in polynomial time.

Problem 3.2 (Abelian hidden period, generalized). Let p𝐺, `q be an Abelian group, 𝑋 a set. Let 𝑓 : 𝐺 𝑘 Ñ 𝑋 be a function such that there exists 𝑠 1 , . . . , 𝑠 𝑘 with: @𝑥 1 , . . . , 𝑥 𝑘 , 𝑓 p𝑠 1 `𝑥1 , . . . , 𝑠 𝑘 `𝑥𝑘 q " 𝑓 p𝑥 1 , . . . , 𝑥 𝑘 q , then find p𝑠 1 , . . . , 𝑠 𝑘 q.

In particular, it can solve the Discrete Logarithm Problem in Abelian groups and factor large integers in polynomial time, problems on which most public-key cryptography in use until today was based on, notably RSA and ECC (using the group law on elliptic curves). In light of this breakthrough, the NIST launched in 2016 a standardization process [START_REF]Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process[END_REF] for post-quantum primitives, which reached its third round in July 2020.

As they should resist an attacker equipped with a quantum computer, the security of these primitives is based on problems which should be quantumly intractable, such as decoding linear codes, finding paths in supersingular isogeny graphs, finding short vectors in integer lattices. Many works have studied and improved the generic quantum algorithms for these problems, a full list of which would be outside the scope of this chapter. We can cite [Ber10; KT17] for generic decoding, [START_REF] Laarhoven | Solving the Shortest Vector Problem in Lattices Faster Using Quantum Search[END_REF] for lattice sieving, [START_REF] Aono | Quantum Lattice Enumeration and Tweaking Discrete Pruning[END_REF] for lattice enumeration.

However, to date, all the schemes broken during the process were broken using classical attacks, which suggests that more dedicated quantum cryptanalysis is yet necessary.

Post-quantum symmetric cryptography. Symmetric constructions seem easy to protect at first sight. Most problems that they are based on are naturally unstructured, and do not seem to benefit from any exponential speedup. Although Grover's algorithm can be used to accelerate exhaustive key search, it suffices to double the size of the parameters, in particular the key size, in order to provide an equivalent ideal security. Furthermore, Grover's algorithm does not benefit from a good parallelization, and quantum operations will likely remain orders of magnitude more costly than classical ones.

However, the generic attacks given by Grover's algorithm only reveal an upper bound on the security, not a lower bound. In 2010, Kuwakado and Morii [START_REF] Kuwakado | Quantum distinguisher between the 3-round Feistel cipher and the random permutation[END_REF] introduced the first attack in symmetric cryptography in the superposition query model, that we will define in Section 3.4.2. This started a series of quantum polynomial-time attacks on classically secure symmetric cryptosystems [START_REF] Kuwakado | Security on the quantum-type Even-Mansour cipher[END_REF][START_REF] Kaplan | Breaking Symmetric Cryptosystems Using Quantum Period Finding[END_REF]. Their common point is that they exploit an algebraic structure as a promise problem, and use Simon's algorithm to recover the secret.

The practical implications of these powerful attacks are yet unclear, but security in this stronger model has appeared more and more desirable over the time, if only to ensure compatibility between the different definitions of quantum security and proof frameworks that have flourished [GHS16; Unr17; SY17; BZ13a; Zha12; BZ13b; Zha19].

Besides, doubling the key size is a non trivial requirement. If the primitive does not allow it, we must change the primitive, use a new design and restart cryptanalysis. Furthermore, it leaves behind many other attack vectors, for example, generically exploiting a small block size. To date, most ciphers that allow 256-bit keys have a block size limited to 128 bits, for example the standard AES. Finally, quantum cryptanalysis is our only way to gain an understanding of the potential dedicated quantum attacks.

On the "quantum world". The quantum world is not very different from the classical world: we try to make primitives secure against adversaries with bounded resources, either computational or in queries. In asymmetric cryptanalysis, we try to find better algorithms for solving the underlying hard problems, but we must as well look into concrete constructions. In symmetric cryptanalysis, we find the best dedicated attacks performing better than the generic one, for example Grover's algorithm. The security margin is determined with respect to this attack. Although our perspective now includes quantum computations and queries, the life cycle of cryptographic primitives has remained the same.

In a post-quantum future, we can imagine that the quantum surname (quantum world, quantum cryptanalysis, quantum security margin, quantum generic attack. . . ) will disappear. We will just care about the "best attack", reaching the highest number of rounds, whether classical or quantum. Thus, we won't stop to study classical attacks: a primitive can only be secure if it is classically secure. This is why, despite the emphasis on the quantum setting that is put in the title of this thesis, most of the dedicated cryptanalysis performed in Chapter 8 will be classical only. The analysis of Gimli will provide examples of attacks that we study first in the classical setting, then modify and extend when switching to the quantum setting.

Lighweight Cryptography

With the unstoppable growth of the Internet of Things (IoT), cryptographic algorithms are now ubiquitous and required to run not only on personal computers or servers, but also low-power micro-controllers, low-area circuits, RFID chips, and so on. These new constraints motivated a wave of new lightweight designs.

As there are different constraints involved, this term actually regroups algorithms with very different design goals: some of them target the energy consumption, the code size, circuit area, latency, throughput, RAM consumption, etc. Some algorithms can also be optimized for side-channel resistance or masking.

In their survey [START_REF] Biryukov | State of the Art in Lightweight Symmetric Cryptography[END_REF], Biryukov and Perrin argued that the field could actually be split into two subfields, ultra-lightweight cryptography and ubiquitous cryptography. A cipher with a low area implementation, aiming at Application Specific Integrated Circuits (ASICs) but with worse software performances, would be included in the former category, whereas the latter would designate versatile algorithms with fairly efficient implementations on micro-controllers, ASICs and even software at the same time.

Standardizing lightweight cryptography.

In 2019, the American National Institute of Standards and Technology (NIST) launched a standardization process for new lightweight cryptographic primitives [NIS17; NIS18]. Submission packages were required to define at least an authenticated encryption algorithm and, optionally, a hash function. The NIST plans to wait until the final rounds to determine whether they will select a single algorithm (which would likely be an ubiquitous one in the definition of Biryukov and Perrin) or a portfolio (which would likely contain specialized ultra-lightweight ciphers).

57 candidate algorithms were submitted in February 2019. 56 of them were announced as first-round candidates in April 2019. On August 30, 2019, 32 or them passed to the second round [START_REF]Status Report on the First Round of the NIST Lightweight Cryptography Standardization Process[END_REF], among which Spook [START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF], Gimli [START_REF] Daniel | Gimli. Submission to NIST-LWC[END_REF] and Saturnin [Can+20], which will appear in Chapters 8 and 10 respectively. We shall consider only the attack settings of Section 3.4.2, and in particular, no leakage scenarios.

Symmetric Primitives

In this section, we recall some standard attack scenarios in symmetric cryptanalysis, we define some ideal primitives and give classical and quantum generic bounds.

Primitives

We recall the main families of primitives in symmetric cryptography. They are functions acting on bit-strings of fixed or variable length. Each definition gives an interface offering some functionality, and expected security guarantees such as: ' confidentiality: the secret message should not be recoverable by the attacker; ' integrity: the attacker should not be able to tamper with the message; ' authenticity: the attacker should not be able to impersonate the sender.

We give only a few examples of specific constructions, deferring most of them to the chapters in which they will be needed.

Block Ciphers

A block cipher is a family of permutations 𝐸 𝑘 of a message space t0, 1u 𝑛 , indexed by a key space t0, 1u 𝑚 , where 𝑛 is the block size and 𝑚 " 𝒪p𝑛q is the key size:

$ ' & ' % 𝐸 :
t0, 1u 𝑚 ˆt0, 1u 𝑛 Ñ t0, 1u 𝑛 𝐷 : t0, 1u 𝑚 ˆt0, 1u 𝑛 Ñ t0, 1u 𝑛 @𝑘 P t0, 1u 𝑚 , 𝑥 P t0, 1u 𝑛 , 𝐷 𝑘 p𝐸 𝑘 p𝑥qq " 𝐸 𝑘 p𝐷 𝑘 p𝑥qq " 𝑥 .

The strongest ideal model of a block cipher is the ideal cipher model introduced by Shannon [Sha49], in which a block cipher is selected uniformly at random from all families of permutations Π 𝑘 indexed by 𝑘. However, it is possible to construct primitives secure with an ideal cipher and insecure with any practical instantiation [START_REF] Black | The Ideal-Cipher Model, Revisited: An Uninstantiable Blockcipher-Based Hash Function[END_REF]. Many proofs require instead the cipher to be a pseudorandom permutation PRP: when 𝑘 is selected uniformly at random from t0, 1u 𝑚 , the permutation 𝐸 𝑘 should be indistinguishable from a randomly chosen permutation Π.

Generic key-recovery. We will consider chosen-plaintext or -ciphertext key-recovery attacks. The classical generic bound, in evaluations of 𝐸 ¨, is 𝒪 `P 𝑚 𝑛 T 2 𝑚 ˘using P 𝑚 𝑛 T chosen-plaintext queries. The adversary tries all possible keys and, for each key, reencrypts the given plaintexts, trying to match the given corresponding ciphertexts. The quantum generic bound is 𝒪 `P 𝑚 𝑛 T 2 𝑚{2 ˘using the same classical data.

Remark 3.2. Determining precise bounds for Grover search requires to dive into the details of a quantum circuit evaluating 𝐸 𝑘 p𝑥q for a given 𝑘, 𝑥. The case of [AES] will be studied in Chapter 9.

There are two main families of block ciphers: Feistel networks and Substitution-Permutation Networks (SPNs). The former includes notably the former standard [DES], and the latter the current standard [AES]. In this thesis, we mainly study SPNs.

SPNs.

They consist in iterating a round function which applies a key addition, followed by a substitution layer and a permutation layer. The substitution layer applies small nonlinear functions, or S-Boxes to the state. The permutation layer mixes the whole state using an efficient linear function. The key of each round is derived from the master key 𝑘 through a key-derivation algorithm, which may be as simple as the addition of a round-dependent constant.

Feistel networks. The Feistel network is a generic construction for turning functions into permutations. The state of the cipher, of 𝑛 bits, is divided into two branches 𝐿 0 , 𝑅 0 of 𝑛{2 bits each. Then, 𝑟 rounds are applied, using round functions 𝑓 0 , . . . , 𝑓 𝑟´1 :

𝐿 𝑖`1 , 𝑅 𝑖`1 " 𝑅 𝑖 , 𝐿 𝑖 ' 𝑓 𝑖 p𝑅 𝑖 q .
This operation is invertible. The full Feistelp𝑓 0 , . . . , 𝑓 𝑟´1 q is thus invertible for any choice of functions.

As a block cipher proposes a very limited functionality (it only encrypts a single block and does not ensure authenticity), it is necessary to use it inside a mode of operation.

Stream Ciphers

A stream cipher encrypts messages of variable length (up to some limit). The key space remains t0, 1u 𝑚 and we introduce a nonce space t0, 1u 𝜈 . The nonce (contraction of number used once), sometimes initial value or IV, is a public value used to avoid re-encryption.

$ ' & ' % 𝐸 : t0, 1u 𝑚 ˆt0, 1u 𝜈 ˆt0, 1u ˚Ñ t0, 1u D : t0, 1u 𝑚 ˆt0, 1u 𝜈 ˆt0, 1u ˚Ñ t0, 1u @𝑘,
𝑥, 𝑁 P t0, 1u 𝜈 , 𝐷 𝑘 p𝐸 𝑘 p𝑥; 𝑁 q; 𝑁 q " 𝐸 𝑘 p𝐷 𝑘 p𝑥; 𝑁 q; 𝑁 q " 𝑥 .

In a stream cipher such as Grain-128a (the basis of the LWC candidate [HJM] Grain-128AEAD), each combination of key and nonce generates a different sequence called the keystream, which is typically XORed to the message to generate the ciphertext.

A stream cipher can be built from a block cipher using an encryption mode, for example the counter mode (CTR) [START_REF]SP 800-38A: Recommendation for Block Cipher Modes of Operation: Methods and Techniques[END_REF] which is used in Saturnin [START_REF] Canteaut | Saturnin. Submission to NIST-LWC (2nd Round)[END_REF] (see Figure 10.10 in Section 10.2.3). Note that the use of any block cipher mode of operation requires first a padding scheme, to cut the message 𝑚 into a sequence of blocks 𝑚 0 , . . . , 𝑚 1 , 𝑚 ℓ , 𝑚 ˚where 𝑚 ˚is the last (padded) block.

Hash Functions

A hash function is a function that is hard to invert, and produces an output of fixed length 𝑛 (the hash) from an input message of any length:

! ℎ : t0, 1u ˚Ñ t0, 1u 𝑛 .
It is mainly used to provide integrity (and helps with authentication, e.g., when storing passwords). An ideal hash function cannot be distinguished from a random function.

Attacks. The main attacks on hash functions, that lead to exploitable weaknesses, consist in finding collisions (see Section 2.3), preimages, and second preimages: given 𝑥, find another input 𝑦 ‰ 𝑥 such that ℎp𝑦q " ℎp𝑥q.

There are also different ways to build hash functions from smaller components. The Merkle-Damgårg construction [START_REF] Ralph | A Certified Digital Signature[END_REF][START_REF] Damgård | A Design Principle for Hash Functions[END_REF], that is used in Saturnin-Hash in Chapter 10, uses a compression function of fixed length. Another example is the Sponge construction [Ber+07; Ber+11b], which is used in several algorithms considered throughout this thesis. It is based on a public permutation.

The basic layout is displayed in Figure 3.2. The state of the permutation Π is divided into two parts, the rate 𝑟 and the capacity 𝑐. The rate determines in part how fast the sponge will be computed, whereas the capacity mainly determines its security level. The function is computed in two phases. In the absorbing phase, the padded message blocks 𝑚 1 , . . . , 𝑚 𝑡 are XORed in the rate part, before a call to the permutation Π. After all message blocks have been processed, we enter the squeezing phase, in which the rate part of the sponge is extracted. These concatenated blocks form the output of the function. The current hash function standard [START_REF]SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions[END_REF] Sponge functions benefit from strong security guarantees. If Π is a random permutation, then a Sponge built with Π is indistinguishable from a random function up to 2 𝑐{2 queries. This corresponds to finding a collision on the capacity part, which yields a collision when inserting the right messages. In the quantum setting, sponges were proven collision-resistant up to 2 𝑐{3 queries [START_REF] Czajkowski | Post-quantum Security of the Sponge Construction[END_REF], which is the quantum collision lower bound on 𝑐 bits, and thus, is also essentially optimal. Indistinguishability was shown in [START_REF] Czajkowski | Quantum Indistinguishability of Random Sponges[END_REF].

MACs

A message authentication code is a function MAC of a key space t0, 1u 𝑚 and message space t0, 1u ˚, producing a tag of length 𝑡:

! MAC : t0, 1u 𝑚 ˆt0, 1u ˚Ñ t0, 1u 𝑡 .
It is intended to provide integrity, similarly to a hash function, but also authenticity, since the knowledge of the secret key 𝑘 is required to compute the tag.

Attacks. Standard attacks on a MAC either try to recover the key, or to build forgeries: creating a valid (message, tag) pair for a message that has not been previously queried. Thus, we can either search exhaustively for 𝑘 or try to guess the value of the tag, in time 𝒪 `2𝑡 ˘. In the quantum setting, we will accelerate this forgery if we have Q2 access to a verification oracle, using Grover search.

The definition that we just gave is that of a deterministic MAC. For iterated deterministic MACs, there exists a generic forgery attack [START_REF] Preneel | MDx-MAC and Building Fast MACs from Hash Functions[END_REF] of complexity 2 𝑛{2 if 𝑛 is the internal state size. Thus, there are three alternatives to obtain better security: either use a nonce or a randomly chosen salt, that is transmitted alongside the message, or design a MAC with a bigger internal state. There have been many proposals for the latter, studied from a cryptanalytic standpoint in [START_REF] Leurent | Generic Attacks Against Beyond-Birthday-Bound MACs[END_REF].

Authenticated Encryption

An authenticated encryption scheme (AE) offers both the functionalities of a stream cipher and a MAC. With associated data (AEAD), it accepts an additional input which is not encrypted, but contributes to the tag. As before, it is possible to define a standalone AEAD (such as Grain-128AEAD [HJM]), or to build it from smaller components.

Example: Encrypt-then-MAC. In the Encrypt-then-MAC paradigm, Alice will first compute the ciphertext 𝑐 using a mode of encryption, then MAC 𝑘 p𝑐q. Upon reception, Bob will recompute the MAC and check that the tags match. This is used in Saturnin (Chapter 10).

Example: Duplex Mode. The Duplex Mode [START_REF] Bertoni | Duplexing the Sponge: Single-Pass Authenticated Encryption and Other Applications[END_REF] allows to build an authenticated cipher with a Sponge. Its main idea is that, after XORing each message block 𝑚 𝑖 , the current value of the rate is outputted as a ciphertext block 𝑐 𝑖 . Then after absorbing the whole message, the squeezing phase returns an authentication tag. This provides an AE functionality with a single pass. This design pattern has been used by many candidates in the LWC process, including the second-round candidates [START_REF] Daniel | Gimli. Submission to NIST-LWC[END_REF][START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF] studied in Chapter 8.

Attack Settings

We consider classical and quantum adversaries (or attackers), which are algorithms (respectively classical and quantum) that can have black-box query access to a primitive holding a secret 𝑘 (this is the secret-key setting), e.g., a cipher 𝐸 𝑘 . In general we consider that there is a single secret, although the multi-user setting, where many secrets 𝑘 𝑖 are used on the same communication channel, has also practical meaning. Classical attack scenarios include: Known-ciphertext: the attacker can only obtain encrypted ciphertexts 𝐸 𝑘 p𝑚 𝑖 q Known-plaintext: the attacker obtains plaintext-ciphertext pairs p𝑚 𝑖 , 𝐸 𝑘 p𝑚 𝑖 qq with random or arbitrary 𝑚 𝑖 Chosen-plaintext: the attacker can obtain plaintext-ciphertext pairs p𝑥 𝑖 , 𝐸 𝑘 p𝑥 𝑖 qq with chosen 𝑥 𝑖 Chosen-ciphertext: the attacker can obtain pairs p𝑥 𝑖 , 𝐸 𝑘 p𝑥 𝑖 qq with chosen 𝑥 𝑖 or chosen 𝐸 𝑘 p𝑥 𝑖 q (encrypting and decrypting at will)

In the quantum setting, the adversary can perform quantum computations, but the way she1 accesses the data plays an important role. We adopt the Q1/Q2 terminology used in [Kap+16a; Kap+16b; HS18a; HS18b].

Q1.

The Q1 setting is called QS1 in [START_REF] Gagliardoni | Quantum Security of Cryptographic Primitives[END_REF] and is sometimes called the standard query model in the literature on quantum provable security (standard IND-CPA in [START_REF] Vivekanand Anand | Post-Quantum Security of the CBC, CFB, OFB, CTR, and XTS Modes of Operation[END_REF]). Although the adversary can perform offline quantum computations, she can only access the primitive through classical queries, whether it be known, chosen-plaintext or ciphertext. This attack setting is certainly the most meaningful. It will be applicable to all communications once a scalable quantum architecture is built, but it also concerns today's encrypted traffic, if an attacker can record it and wait patiently for a quantum computer to appear.

To date, the best Q1 quantum attacks known reach a quadratic speedup, based on quantum search, and most of them also imply classical attacks. The only known example of quantum Q1 attacks with no classical equivalent comes from the relative inefficiency of quantum collision search against quantum search [START_REF] Hosoyamada | Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound[END_REF] (see Section 4.2.2).

Q2.

Here, the adversary performs quantum computations and has quantum oracle access. Different types of oracles can be considered, but we will focus on the standard oracle 𝑂 𝐸 𝑘 :

|𝑥y |0y 𝑂 𝐸 𝑘 Þ Ý ÝÝ Ñ |𝑥y |𝐸 𝑘 p𝑥qy .
Remark 3.3. The word "standard" in "standard oracle" is not to be confused with "standard" in "standard query model". We will prevent this by using the Q1 / Q2 terminology.

Note that Q2 corresponds to the quantum query model in the literature on provable quantum security, for instance in [Dam+13; BZ13b; Zha12; GHS16; Bon+11].

The impact of the attacks using the Q2 model is unclear, but it has led to powerful breaks of classically secure constructions, some of which will be discussed in Section 4.1. There is though no question about the desirability of Q2 security. ' The model is simple and inclusive of any theoretical intermediates, for example, a quantum sidechannel attack in which the adversary could trick a device into performing quantum computations. ' The model is non-trivial: although there have been breaks, the Q2 attacks generally target constructions with a strong algebraic structure, and many designs retain their security. ' The model seems easier to work with in quantum provable security. ' The model includes the scenarios of white-box encryption or obfuscation, in which the adversary has access to a full description of the oracle with a secret key and can implement a quantum embedding of it. [START_REF] Rötteler | A note on quantum related-key attacks[END_REF] showed that a very strong model of superposition related-key attacks allowed to break all block ciphers. In this model, a secret 𝑘 is fixed and we are given oracle access to:

Stronger models. Rötteler and Steinwandt

|𝑥y |ℓy |0y 𝑂 𝐸 𝑘'Þ Ý ÝÝÝ Ñ |𝑥y |ℓy |𝐸 𝑘'ℓ p𝑥qy .
But then, since the specification of 𝐸 ¨is known, the adversary can implement a quantum oracle for the function 𝑓 pℓq " 𝐸 𝑘'ℓ p0q ' 𝐸 ℓ p0q, which is a random periodic function of period 𝑘, and use Simon's algorithm (Algorithm 1.1) to recover 𝑘. This shows that the model is intrinsically too strong, and it is not considered meaningful today.

Q2 setting in public-key cryptography. As we have seen, the assertion of security in public-key cryptography comes from designing algorithms for generic problems, such as factorization or discrete logarithms. The input will always be classical. Grilo, Kerenidis, and Zijlstra [START_REF] Grilo | Learning-with-errors problem is easy with quantum samples[END_REF] showed that the learning-with-errors (LWE) problem, which underlies multiple candidates of the NIST call [START_REF]Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process[END_REF], could be broken in polynomial time with superposition access, using the Bernstein-Vazirani algorithm [START_REF] Bernstein | Quantum complexity theory[END_REF]. Their attack was also improved by Alagic, Jeffery, Ozols, and Poremba [START_REF] Alagic | On Quantum Chosen-Ciphertext Attacks and Learning with Errors[END_REF].

Summary of Main Generic Attacks

We give in Table 3.1 a non-exhaustive list of generic attacks considered in this thesis, for each type of primitive, and bounds to compare our cryptanalysis to. Time complexities are given up to some constant, for a constant probability of success, in number of evaluations of the primitive. We omit 𝒪 notations for simplicity. Query complexities are given in number of black-box queries to the primitive. Memory is given in blocks of queried data.

Note that for block cipher modes of operation, we consider the number of blocks queried. Thus, a quantum chosen-plaintext query with 𝑟 blocks corresponds to 𝑟 data.

A hash function computation with 𝑟 blocks will cost a time 𝑟. Generic attacks usually use inputs of a single block.

Preliminaries of Cryptanalysis

In this section, we briefly introduce some cryptanalysis notions used in the next chapters.

Differential Cryptanalysis

Differential cryptanalysis is one of the most fruitful families of cryptanalytic algorithms. It was introduced by Biham and Shamir [START_REF] Biham | Differential Cryptanalysis of DES-like Cryptosystems[END_REF] in order to attack the [DES]. It studies the propagation of differences through multiple rounds of a cipher. A pair of differences Δ 𝑖𝑛 , Δ 𝑜𝑢𝑡 such that, with relatively high probability 𝑝 over 𝑚, 𝑚 1 :

𝑚 ' 𝑚 1 " Δ 𝑖𝑛 ùñ Πp𝑚q ' Πp𝑚 1 q " Δ 𝑜𝑢𝑡 ,
is denoted a differential. In differential cryptanalysis, one typically finds a differential pattern covering a certain number of rounds of the cipher, and appends one or more rounds before and after this pattern, performing an exhaustive search of some key bits. Truncated differential cryptanalysis is an extension by Knudsen [START_REF] Knudsen | Truncated and Higher Order Differentials[END_REF] in which the condition 𝑚 ' 𝑚 1 " Δ becomes 𝑚 ' 𝑚 1 P 𝐸, where 𝐸 is a vector space of higher dimension. It is common to encounter such a situation, in which the difference between 𝑚 and 𝑚 1 (and their images) is only partially determined. Instead of defining 𝐸 formally, we note for example: 𝑚 " 0 ˚˚˚01 ˚˚, where ˚denotes a part of the state where the difference is not fixed.

The extension of differential and truncated differential cryptanalysis to the quantum setting, using Grover's algorithm to speedup such key-recovery attacks, was studied in [START_REF] Kaplan | Quantum Differential and Linear Cryptanalysis[END_REF].

Distinguishers on Permutations

Cryptographic algorithms based on public permutations have been widely adopted, and they actually represent the majority of second-round candidates in the NIST LWC process. But the security of many of these algorithms relies on the absence of a distinguisher for the permutation used.

In the case of the Sponge construction, this is the hermetic sponge strategy: a strong permutation Π is used, that is, it should not have any "exploitable properties" [START_REF] Bertoni | Cryptographic sponge functions[END_REF], or exhibit any property that distinguishes is from a random permutation, outside the existence of a compact implementation. Such a property of Π implies the security of the Sponge. Of course, the converse is not necessarily true, and if Π admits a distinguisher, this does not necessarily yield an attack on any construction using it. But depending on the type of distinguisher used, it may raise some concerns.

Limited-birthday Distinguishers

The limited-birthday problem was introduced by Gilbert and Peyrin [START_REF] Gilbert | Super-Sbox Cryptanalysis: Improved Attacks for AES-Like Permutations[END_REF] in the known-key cryptanalysis of the [AES]. It requires to find a pair of inputs satisfying a truncated differential. Definition 3.1 (Limited-birthday problem). Given access to a permutation Π : F 𝑛 2 Ñ F 𝑛 2 , given two vector spaces 𝐸, 𝐹 of F 𝑛 2 of respective dimensions 𝑑 𝑖𝑛 and 𝑑 𝑜𝑢𝑡 , find a pair of inputs p𝑥, 𝑥 1 q P pF 𝑛 2 q 2 such that 𝑥 ' 𝑥 1 P 𝐸 and Πp𝑥q ' Πp𝑥 1 q P 𝐹 .

Since access to both Π and Π ´1 is allowed, the generic algorithm chooses depending on the values of 𝑑 𝑖𝑛 and 𝑑 𝑜𝑢𝑡 .

Theorem 3.1 ([GP10]

). There exists an algorithm that generates a limited-birthday pair in time:

max ˆmin 𝑑Pt𝑑 𝑖𝑛 ,𝑑𝑜𝑢𝑡u ? 2 𝑛`1´𝑑 , 2 𝑛`1´p𝑑 𝑖𝑛 `𝑑𝑜𝑢𝑡q ˙,
counted in number of queries to Π and Π ´1, and using min ´2𝑑 𝑖𝑛 , 2 𝑑𝑜𝑢𝑡 classical memory with random access.

The optimality of this method is proven in [START_REF] Iwamoto | Limited-Birthday Distinguishers for Hash Functions -Collisions beyond the Birthday Bound Can Be Meaningful[END_REF] for a black-box function, and in [START_REF] Hosoyamada | Improved Attacks on sLiSCP Permutation and Tight Bound of Limited Birthday Distinguishers[END_REF] for a black-box permutation. Definition 3.2 (Limited-birthday distinguisher). Let Π : F 𝑛 2 Ñ F 𝑛 2 be a permutation, e.g., Shadow-512. A limited-birthday distinguisher against Π is given by a pair of vector spaces 𝐸, 𝐹 of F 𝑛 2 of respective dimensions 𝑑 𝑖𝑛 and 𝑑 𝑜𝑢𝑡 , and an algorithm that solves the limited birthday problem in less time than the formula of Theorem 3.1.

Many of these distinguishers borrow the techniques of block cipher cryptanalysis.

The existence of fast algorithms to find such constrained pairs of inputs is an example of a "non-random" property of the permutation.

Chapter 4 Quantum Symmetric Cryptanalysis

In Chapters 1 and 3, we have introduced quantum computing and symmetric cryptography. We now bring these two worlds together and review previous works in quantum symmetric cryptanalysis. We separate these quantum attacks into the Q2 setting and the Q1 setting.

Q2 Attacks on Symmetric Constructions

We will now review Q2 attacks from the literature, applying to popular generic constructions in symmetric cryptography. Most of these attacks rely on quantum hidden shift algorithms, except the last one that we will present, which differs significantly.

Distinguishers on the Luby-Rackoff Constructions

Luby and Rackoff [LR88] studied a three-round Feistel network as shown in Figure 4.1. They showed that if the functions 𝑓 0 , 𝑓 1 , 𝑓 2 are pseudorandom functions, then 𝒪 `2𝑛{4 queries to Feistelp𝑓 0 , 𝑓 1 , 𝑓 2 q are necessary to distinguish it from a random permutation. Adding another round, they found that the same holds for Feistelp𝑓 0 , 𝑓 1 , 𝑓 2 , 𝑓 3 q even with 63

𝐿 0 𝑅 0 𝑓 0 𝑓 1 𝑓 2 𝐿 3 𝑅 3 Figure 4.1: Three-round Feistel network.
inverse queries, which makes it a strong pseudorandom permutation. Matching attacks were found by Patarin [START_REF] Patarin | New Results on Pseudorandom Permutation Generators Based on the DES Scheme[END_REF].

The quantum 3-round distinguisher. In [KM10], Kuwakado and Morii showed that in the Q2 setting, the three-round Feistel could be distinguished from a random permutation in polynomial time. This was the first exponential quantum speedup of a cryptanalytic algorithm in symmetric cryptography. Most polynomial-time quantum attacks on symmetric cryptographic algorithms to date follow the same design pattern as Kuwakado and Morii's distinguisher. The problem is reframed as a hidden Boolean shift problem, then solved using Simon's algorithm.

In this case, let 𝐸 be the primitive, which is either 𝐸 " Feistelp𝑓 0 , 𝑓 1 , 𝑓 2 q or 𝐸 " Π a random permutation. Kuwakado and Morii considered the case of permutations for 𝑓 0 , 𝑓 1 , 𝑓 2 in order to have precisely Simon's promise, but we have seen how to extend it to an approximate promise (Section 1.4.3). Let LFeistelp𝑓 0 , 𝑓 1 , 𝑓 2 q be the truncation to the left branch of the three-round Feistel. They remark that:

LFeistelp𝑓 0 , 𝑓 1 , 𝑓 2 qp𝐿 0 , 𝑅 0 q " 𝑅 0 ' 𝑓 1 p𝐿 0 ' 𝑓 0 p𝑅 0 qq ùñ LFeistelp𝑓 0 , 𝑓 1 , 𝑓 2 qp𝐿 0 , 𝑅 0 q ' 𝑅 0 " 𝑓 1 p𝐿 0 ' 𝑓 0 p𝑅 0 qq ,
so they take two random 𝛼 0 , 𝛼 1 P t0, 1u 𝑛 and define the function:

𝑓 p𝑏, 𝑥q " 𝛼 𝑏 ' 𝐸 Trunc 𝐿 p𝑥, 𝛼 𝑏 q ,
which, when 𝐸 is the Feistel scheme, satisfies the hidden period equation: 𝑓 p𝑏, 𝑥q " 𝑓 p𝑏 ' 1, 𝑥 ' 𝑓 0 p𝛼 0 q ' 𝑓 0 p𝛼 1 qq , and is random otherwise. Further works. Recently, Hosoyamada and Iwata showed that the 4-round construction remained secure up to 𝒪 `2𝑛{12 ˘Q2 forward queries, with a distinguishing attack using 𝒪 `2𝑛{6 ˘queries [START_REF] Hosoyamada | 4-Round Luby-Rackoff Construction is a qPRP[END_REF]. The proof was subsequently improved to 𝒪 `2𝑛{6 ȋn [START_REF] Hosoyamada | Tight Quantum Security Bound of the 4-Round Luby-Rackoff Construction[END_REF], making it tight. However, if inverse queries are authorized, the distinguisher based on Simon's algorithm was extended to 4 rounds by Ito et al. [START_REF] Ito | Quantum Chosen-Ciphertext Attacks Against Feistel Ciphers[END_REF].

The Even-Mansour Cipher

The Even-Mansour construction [START_REF] Even | A Construction of a Cipher from a Single Pseudorandom Permutation[END_REF] is a simple way to build a block cipher from a public 𝑛-bit permutation Π, and two 𝑛-bit keys, as shown in Figure 4.2:

𝐸 𝑘 1 ,𝑘 2 " Πp𝑥 ' 𝑘 1 q ' 𝑘 2 .
Even and Mansour show that if Π is a random permutation, the construction is classically secure up to 2 𝑛{2 queries and 2 𝑛{2 offline computations. More precisely, there exists a time-data trade-off 𝑇 ¨𝐷 " 2 𝑛 . Daemen [START_REF] Daemen | Limitations of the Even-Mansour Construction[END_REF] showed a matching chosen-plaintext attack. Next, Dunkelman, Keller, and Shamir [START_REF] Orr Dunkelman | Minimalism in Cryptography: The Even-Mansour Scheme Revisited[END_REF] changed the attack setting to known-plaintext only and also obtained an attack in time 2 𝑛{2 using polyp𝑛q memory. Quantum attack. In another seminal work, Kuwakado and Morii [START_REF] Kuwakado | Security on the quantum-type Even-Mansour cipher[END_REF] showed how to break the Even-Mansour cipher in quantum time 𝒪 `𝑛3 ˘, using 𝒪p𝑛q superposition queries to EM, thanks to Simon's algorithm. The attack targets 𝑘 1 . Once it has been obtained, the cipher becomes trivially broken. Let us define:

𝑥 Π 𝑘 1 𝑘 2 EMp𝑥q " 𝑘 2 ' Πp𝑘 1 ' 𝑥q
𝑓 p𝑥q " EMp𝑥q ' Πp𝑥q " 𝑘 2 ' Πp𝑘 1 ' 𝑥q ' Πp𝑥q
and observe that @𝑥, 𝑓 p𝑥 ' 𝑘 1 q " 𝑓 p𝑥q. Thus, assuming that 𝑓 behaves like a random periodic function, Simon's algorithm can be applied to recover 𝑘 1 .

Attacks on MACs

Subsequent works presented a variety of attacks with exponential speedups on MAC constructions, either by doing forgeries or recovering completely the key. In [START_REF] Kaplan | Breaking Symmetric Cryptosystems Using Quantum Period Finding[END_REF], attacks are given on CBC-MAC [START_REF] Black | CBC MACs for Arbitrary-Length Messages: The Three-Key Constructions[END_REF], PMAC [START_REF] Black | A Block-Cipher Mode of Operation for Parallelizable Message Authentication[END_REF], CMAC [START_REF] Dworkin | Recommendation for block cipher modes of operation: The CMAC mode for authentication[END_REF], GCM [START_REF] Mcgrew | The Security and Performance of the Galois/Counter Mode (GCM) of Operation[END_REF], OMAC [START_REF] Iwata | OMAC: One-Key CBC MAC[END_REF], OCB [START_REF] Krovetz | The Software Performance of Authenticated Encryption Modes[END_REF]. A generalization on the CBC-MAC attack is given in [START_REF] Santoli | Using Simon's algorithm to attack symmetric-key cryptographic primitives[END_REF].

Other works targeted the AEZ lightweight authenticated cipher [START_REF] Bonnetain | Quantum Key-Recovery on Full AEZ[END_REF], the classically secure MAC Poly1305 [START_REF] Bonnetain | Hidden Shift Quantum Cryptanalysis and Implications[END_REF].

We present the attack of [Kap+16a, Section 5] on the CBC-MAC variant of [BR00b] (Figure 4.3). This is a deterministic MAC based on a block cipher 𝐸 that uses two keys 𝑘, 𝑘 1 . 0 The attack of [Kap+16a, Section 5] queries the MAC with two blocks, but it can accommodate any number of blocks if we simply replace the 0 in Figure 4.3 by the previous chain of inputs (this is done in [START_REF] Santoli | Using Simon's algorithm to attack symmetric-key cryptographic primitives[END_REF]). Let 𝛼 0 , 𝛼 1 be fixed values for the first message block, then:

𝛼 𝑏 𝐸 𝑥 𝐸 𝐸 𝜏 𝑘 𝑘 𝑘 1
CBC´MACp𝛼 𝑏 ‖ 𝑥q " 𝐸 𝑘 1 p𝐸 𝑘 p𝑥 ' 𝐸 𝑘 p𝛼 𝑏 qqq .
Hence, there is a hidden Boolean shift between the functions CBC ´MACp𝛼 0 ‖ ¨q and CBC ´MACp𝛼 1 ‖ ¨q, which is 𝐸 𝑘 p𝛼 0 q ' 𝐸 𝑘 p𝛼 1 q. We obtain this value using Simon's algorithm.

Next, we remark that for any message block 𝑚, the tags of 𝛼 0 ‖ 𝑚 and of 𝛼 1 ‖ 𝑚 ' 𝐸 𝑘 p𝛼 0 q ' 𝐸 𝑘 p𝛼 1 q have the same values. Thus, we can build a forgery.

Quantum Slide Attacks

Classical slide attacks [START_REF] Biryukov | Slide Attacks[END_REF] draw their power from structural self-similarities in ciphers. Let us take the simple example of a one-round self-similar cipher 𝐸 𝑘 : t0, 1u 𝑛 Ñ t0, 1u 𝑛 , built by iterating a round function 𝐹 p𝑥, 𝑘q : t0, 1u 𝑛 ˆt0, 1u 𝑚 Ñ t0, 1u 𝑛 for a total of 𝑟 rounds, using the same round key 𝑘. This structure entails a very simple equality, the slide property:

𝐸 𝑘 p𝐹 p𝑥, 𝑘qq " 𝐹 p𝐸 𝑘 p𝑥q, 𝑘q . 𝑃, 𝐶, there exists a slide pair: 𝑃 0 , 𝐶 0 and 𝑃 1 , 𝐶 1 such that 𝐹 p𝑃 0 , 𝑘q " 𝑃 1 . In that case, we also have: 𝐹 p𝐶 0 , 𝑘q " 𝐶 1 . If 𝐹 is sufficiently weak, then 𝑘 can be retrieved from these two equations. Hence, the simplest attack setting consists in performing 𝒪 `2𝑛{2 queries, then checking for each pair 𝑃 0 , 𝐶 0 and 𝑃 1 , 𝐶 1 if it is a slide pair; and in that case returning the key 𝑘.

Quantum version.

In [START_REF] Kaplan | Breaking Symmetric Cryptosystems Using Quantum Period Finding[END_REF], Kaplan, Leurent, Leverrier, and Naya-Plasencia showed that, in some cases, the slide property can be turned into a promise problem, and this problem can be solved with Simon's algorithm. We will just present the attack of [START_REF] Kaplan | Breaking Symmetric Cryptosystems Using Quantum Period Finding[END_REF] on the key-alternating cipher of Figure 4.5, which is an iterated Even-Mansour construction using a permutation Π and a single key 𝑘.

In this example, slide pairs have the property: 𝑃 1 " Πp𝑘 ' 𝑃 0 q, or equivalently, 𝐶 1 " 𝑘 ' Πp𝐶 0 q. Thus, 𝐶 1 ' Π ´1p𝑃 1 q " 𝑃 0 ' Πp𝐶 0 q allows to detect a slide pair, and 𝑘 can be recovered in time 𝒪 `2𝑛{2 ˘and polyp𝑛q memory, using Pollard's rho method and Algorithm 2.9.

Kaplan, Leurent, Leverrier, and Naya-Plasencia observe that the self-similarity can be rewritten as: @𝑥, Πp𝐸 𝑘 p𝑥qq ' 𝑘 " 𝐸 𝑘 pΠp𝑥 ' 𝑘qq .

Thus, if we define the two random functions 𝑓 p𝑥q " Πp𝐸 𝑘 p𝑥qq'𝑥 and 𝑔p𝑥q " 𝐸 𝑘 pΠp𝑥qq' 𝑥, we have 𝑓 p𝑥q " 𝑔p𝑥 ' 𝑘q. With Simon's algorithm, 𝑘 can be recovered in 𝒪 `𝑛3 time and 𝒪p𝑛q Q2 queries. Various other attacks have appeared in subsequent works (see [BNS19a] for an exhaustive list). Most of them consist in rewriting the classical slide property as a slide-shift equation.

The Grover-meets-Simon Attack

The primary target of the Grover-meets-Simon algorithm [START_REF] Leander | Grover Meets Simon -Quantumly Attacking the FX-construction[END_REF] is the FX construction, which consists in transforming a block cipher 𝐸 𝑘 with whitening keys 𝑘 𝑖𝑛 and 𝑘 𝑜𝑢𝑡 (Figure 4.6). This construction is used to increase the key length of the cipher. Let 𝑛 be the block size and 𝑚 be the length of 𝑘. Since the cipher can be seen as an Even-Mansour with a keyed permutation instead of the keyless Π, the classical attacks are similar [START_REF] Dinur | Cryptanalytic Time-Memory-Data Tradeoffs for FX Constructions with Applications to PRINCE and PRIDE[END_REF]. In particular, one obtains a time-data trade-off 𝑇 ¨𝐷 " 2 𝑚`𝑛 , and the construction is proven to be secure up to 𝒪 `2p𝑛`𝑚q{2 ˘queries and computations if the underlying block cipher is secure [START_REF] Kilian | How to Protect DES Against Exhaustive Key Search[END_REF].

The FX design has been used for many block ciphers, such as DESX, proposed by Rivest in 1984 and analyzed in [START_REF] Kilian | How to Protect DES Against Exhaustive Key Search[END_REF], PRINCE [START_REF] Borghoff | PRINCE -A Low-Latency Block Cipher for Pervasive Computing Applications -Extended Abstract[END_REF], and PRIDE [START_REF] Albrecht | Block Ciphers -Focus on the Linear Layer (feat. PRIDE)[END_REF].

If 𝑘 was known, Kuwakado and Morii's attack would recover 𝑘 𝑖𝑛 and break the cipher. Leander and May [START_REF] Leander | Grover Meets Simon -Quantumly Attacking the FX-construction[END_REF] proposed to use a Grover search for 𝑘. In order to test if a guess of 𝑘 is the good one, they run Simon's algorithm with the function:

𝑓 𝑧 p𝑥q " FXp𝑥q ' 𝐸 𝑧 p𝑥q ,
which is periodic of period 𝑘 𝑖𝑛 if and only if 𝑧 " 𝑘, and random otherwise. Thus, they solve Problem 4.1.

Problem 4.1 (Finding a periodic function). Let 𝑓 : t0, 1u 𝑚 ˆt0, 1u 𝑛 Ñ t0, 1u ℓ be a family of functions indexed by t0, 1u 𝑚 and write 𝑓 p𝑖, ¨q " 𝑓 𝑖 p¨q. Assume that there exists exactly one 𝑖 0 P t0, 1u 𝑚 such that 𝑓 𝑖 0 is a random periodic function, and that all others are random functions. Then find 𝑖 0 .

It is easy to implement an oracle (Circuit 4.1) that flips the phase of the good key guess only, up to some error, using the quantum circuit for Simon's algorithm QSimon (Circuit 1.9), 𝒪p𝑛q queries to 𝑂 FX and 𝒪p𝑛q circuits 𝐸 computing the unitary |𝑧y |𝑥y |𝑦y 𝐸 Þ Ý Ñ |𝑧y |𝑥y |𝑦 ' 𝐸 𝑧 p𝑥qy. Thus, the keys can be recovered in time 𝒪 `𝑛3 2 𝑚{2 ˘, using 𝒪 `𝑛2 𝑚{2 ˘queries to 𝑂 FX , assuming that 𝑚 " 𝒪p𝑛q.

|𝑘y 𝐸 ¨¨¨𝐸 𝐸 ¨¨¨𝐸 |𝑘y |0 𝑛 y H b𝑛 𝑂 FX QSimon 𝑂 FX H b𝑛 |0 𝑛 y |0 𝑛 y |0 𝑛 y . . . |0 𝑛 y H b𝑛 𝑂 FX 𝐸 𝐸 𝑂 FX H b𝑛 |0 𝑛 y |0 𝑛 y |0 𝑛 y
Quantum Circuit 4.1: Quantum test for the Grover-meets-Simon algorithm applied to FX.

Theorem 4.1 (Grover-meets-Simon (adapted)). Consider the setting of Problem 4.1, and assume that the family p𝑓 𝑖 q satisfies the condition:

D𝑎 ą 0, max 𝑖Pt0,1u 𝑚 zt𝑖 0 u 𝑡Pt0,1u 𝑛 zt0 𝑛 u Pr 𝑥Ðt0,1u 𝑛 r𝑓 𝑖 p𝑥 ' 𝑡q " 𝑓 𝑖 p𝑥qs ď 𝑎𝑛 2 𝑛 . (4.1)
Then there exists a quantum algorithm that finds 𝑖 0 in time 𝒪 `p𝑛 `𝑚q 3 2 𝑚{2 ˘, with constant probability. It makes 𝒪 `p𝑛 `𝑚q2 𝑚{2 ˘queries to 𝐹 .

Proof. The condition (4.1) is a generalization of the definition of 𝜖p𝑓, 𝑠q in Equation (1.1).

In short, all functions 𝑓 𝑖 must be sufficiently far from periodic, so that the probability of raising false positive remains low. By Equation (1.2), this is true if the functions 𝑓 𝑖 are all independent random functions. By condition (4.1) and Theorem 1.4, the circuit QSimon adds an error vector of amplitude less than 𝑒2 ´𝑟{2`1 if we use 𝑛 `𝑟 queries.

Thus, QSimon qualifies as an approximate test by Definition 2.2, and furthermore, it does not yield false negatives. We can use an Amplitude Amplification with approximate test, where the test consists in making the appropriate queries and running QSimon. By Theorem 2.6, it suffices to have an error smaller than 2 ´𝑚{2 in the circuit to ensure a constant success probability, so 𝑟 " 𝑚 `3 is enough (and 𝑟 " 2𝑚 will ensure a probability of success exponentially close to 1). This attack is particularly relevant in the context of post-quantum symmetric cryptography, where we look for generic ways of extending the key length of block ciphers (in order to counter Grover's exhaustive search). In the Q2 setting, wrapping the cipher with whitening keys brings practically no advantage.

Attacks with Modular Additions

In all the attacks above, the primitive has a structure with bitwise XORs '. Alagic and Russell [START_REF] Alagic | Quantum-Secure Symmetric-Key Cryptography Based on Hidden Shifts[END_REF] proposed to replace ' by another group operation, to thwart Simon's algorithm and recover the lost security. Their most practical proposal, already in use in many designs, is the modular addition `. In that case, the Boolean hidden shift problem becomes an Abelian hidden shift in the group Z 2 𝑛 . Problem 4.2 (Abelian Hidden shift problem). Let pG, `q an Abelian group, 𝑔 0 , 𝑔 1 : G Ñ G two permutations such that there exists 𝑠 P G such that, for all 𝑥, 𝑔 0 p𝑥q " 𝑔 1 p𝑥 `𝑠q. Find 𝑠.

No quantum polynomial-time algorithm for Problem 4.2 is known. However, Kuperberg [Kup05;[START_REF] Kuperberg | Another Subexponential-time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF] gave an algorithm in time 2 𝒪p ? 𝑛q , of which many variants have been studied, both asymptotically [Reg04; CJS14] and non-asymptotically [START_REF] Bonnetain | Hidden Shift Quantum Cryptanalysis and Implications[END_REF]BS20].

Notably, Bonnetain and Naya-Plasencia computed explicit costs for Kuperberg's algorithm and found 2 ?

2 log 2 p3q𝑛 » 2 1.8

? 𝑛 for the group Z 2 𝑛 . Thus, if one tries to retain significant security levels in face of such an attack, the state size 𝑛 must be increased to a level that goes far outside the standards of symmetric cryptography. In general, replacing ' by `in insecure constructions often also produces an attack, though its cost may increase by a significant factor (polynomial to subexponential). Kuperberg's algorithm can be also be written as a quantum circuit without measurements, although with a herd of technical difficulties. Some examples of attacks that don't work anymore with modular additions can be found in [BNS19a]. These are slide attacks that use the involutory nature of the bitwise XOR.

Distinguisher on the One-Time Pad

The distinguisher on the one-time pad is a folklore result that shows the power of quantum adversaries and, at the same time, the difficulty in assessing the meaningfulness of a quantum attack. Let us consider an encryption scheme of the form: 𝐸 𝑘 p𝑁, 𝑚q " 𝑚 ' 𝑓 p𝑘, 𝑁 q where 𝑓 is any function and 𝑁 is a nonce that changes at each encryption query. Then it is possible to distinguish 𝐸 𝑘 p𝑁, 𝑚q from a random permutation Π with overwhelming probability, using a single superposition query to 𝐸 𝑘 for a randomly chosen nonce:

|𝑚y |𝑦y 𝑂 𝐸 𝑘 p𝑁,¨q Þ ÝÝÝÝÝÑ |𝑚y |𝑦 ' 𝑚 ' 𝑓 p𝑘, 𝑁 qy .
In particular, if 𝑓 is a random oracle, i.e., if 𝑓 p𝑘, 𝑁 q is randomly chosen, this construction is the well-known one-time pad 1 . It was proven by Shannon [Sha49] to achieve perfect secrecy, that is, the message cannot be recovered from the sole knowledge of the ciphertext. There exists no classical distinguisher between the one-time pad and true randomness.

Proposition 4.1 (Quantum distinguisher on the One-time Pad, informal). Assume that for some function 𝑓 , e.g., a random oracle, 𝐸 𝑘 p𝑁, 𝑚q " 𝑚 ' 𝑓 p𝑘, 𝑁 q. Then there exists a quantum algorithm that, given a standard oracle 𝑂 that is 𝑂 𝐸 𝑘 p𝑁,¨q or 𝑂 Π , makes a single query and distinguishes 𝑂 𝐸 𝑘 p𝑁,¨q from 𝑂 Π , where Π is a random permutation, with overwhelming success.

Proof. The distinguisher (Algorithm 4.1) uses the Deutsch-Jozsa algorithm [START_REF] Deutsch | Rapid solution of problems by quantum computation[END_REF] which, in a single query, is capable of distinguishing a random function from a constant one. For a mode of the given form, 𝐸 𝑘 p𝑚q ' 𝑚 " 𝑓 p𝑘, 𝑁 q is a constant function of 𝑚, while Πp𝑚q ' 𝑚 is random. Thus, in the former case, at Step 4 in Algorithm 4.1, the state obtained is ř 𝑚 |𝑚y |𝑓 p𝑘, 𝑁 qy and the Hadamard transform turns it to |0y, with a probability 1 of measuring 0. In the latter, the probability to measure 0 is:

ÿ 𝑎 ¨1 2 𝑛 ÿ 𝑚,𝑚'Πp𝑚q"𝑎 p´1q 𝑚¨0 '2 " ÿ 𝑎 ˆ|t𝑚, 𝑚 ' Πp𝑚q " 𝑎u| 2 𝑛 ˙2 1
In french, Le masque jetable (the disposable mask), a name that was ahead of its time.

which depends on the distribution of the number of preimages of Πp𝑚q ' 𝑚, but is negligible in general for a random permutation.

Algorithm return 0 Classically, such a distinguisher would need more than one query to obtain a significant success probability, but this is prevented by the change of nonces: in the case of the onetime pad, 𝑓 is a random oracle and a new, entirely independent keystream is produced at each query. However, the quantum attack uses the same nonce for all messages in the superposition. Thus it can be seen as a kind of nonce misuse.

It seems difficult to assert whether this distinguisher is a meaningful attack. On the one hand, it is non-trivial, and may be countered by other modes of encryption. On the other hand, it does not reveal any information on the key, and does not help to distinguish between classical messages, as we will see in Chapter 10, Section 10.3.1. This contrasts with all key-recovery or forgery attacks of this section, which result in a classical break.

Q1 Attacks on Symmetric Constructions

From the different attacks detailed in Section 4.1, we can infer a prevailing design pattern: these attacks exploit the algebraic structure of the primitive and use a quantum hidden shift algorithm to extract a secret from the oracle. We now turn ourselves towards Q1 attacks. For now, most of them reproduce a classical setup and use quantum search to obtain at best a quadratic acceleration. The first example of Q1 attacks reaching more

Q1 Attack on Even-Mansour

Kuwakado and Morii [START_REF] Kuwakado | Security on the quantum-type Even-Mansour cipher[END_REF] give an attack in the Q1 setting, that is analogous to the classical time-data trade-off [START_REF] Daemen | Limitations of the Even-Mansour Construction[END_REF].

Classical trade-off curve. Let us define:

𝑓 p𝑦q " Πp𝑦q ' Πp𝑦 ' 1q , 𝑔p𝑥q " EMp𝑥q ' EMp𝑥 ' 1q , then @𝑥, 𝑓 p𝑥 ' 𝑘 1 q " 𝑔p𝑥q.
Sample 𝑦 $ Ð Ý t0, 1u 𝑛 4: until D𝑥, p𝑥, 𝑓 p𝑦qq P ℒ 5: return 𝑦 ' 𝑥 Steps 2-4 cost 𝑇 " 2 𝑛 𝐷 , hence up to 𝐷 " 2 𝑛{2 , the trade-off curve is: 𝑇 ¨𝐷 " 2 𝑛 . Algorithm 4.3 Q1 trade-off on Even- Mansour.
Input: query access to 𝑔 (limited to 𝐷 queries) Output: 𝑘 1 (with constant probability) 1: Query 𝐷 values 𝑥, 𝑔p𝑥q and store them in a list ℒ 2: Find 𝑦 P t0, 1u 𝑛 such that: D𝑥, p𝑥, 𝑓 p𝑦qq P ℒ using quantum search 3: return 𝑦 ' 𝑥

Step 2 costs 𝑇 " b 2 𝑛 𝐷 , hence up to 𝐷 " 2 𝑛{3 , the trade-off curve is:

𝑇 2 ¨𝐷 " 2 𝑛 .
Notice that, since there is no quantum Pollard's rho method, the balanced point 𝑇 " 𝐷 " 2 𝑛{3 still requires 2 𝑛{3 , memory, whereas classically it needs polyp𝑛q only. The memory used here is QRACM.

Trade-off without QRACM. Hosoyamada and Sasaki [START_REF] Hosoyamada | Cryptanalysis Against Symmetric-Key Schemes with Online Classical Queries and Offline Quantum Computations[END_REF] proposed to replace QRACM by CSAM, using the multi-target preimage search algorithm that will be presented in Section 5.1. The trade-off curve becomes 𝐷 ¨𝑇 6 " 2 3𝑛 , with 𝐷 1{3 memory, and the balanced point is 𝐷 " 𝑇 " 2 3𝑛{7 . Similar results hold for the FX construction.

Quantum Collision Attacks more Efficient than Classical

Hosoyamada and Sasaki [START_REF] Hosoyamada | Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound[END_REF] observed that, since the quantum birthday bound on hash functions dropped from a generic 𝒪 `2𝑛{2 ˘to a generic 𝒪 `2𝑛{3 ˘, hence less than a quadratic speedup, some procedures less efficient than classical collision search may qualify as attacks in the quantum setting, if they benefit from a sufficient quantum speedup. For example, any Sample procedure benefits from a quadratic speedup, as we saw in Section 2.2.

This enabled Hosoyamada and Sasaki to show that some hash functions (AES-MMO and Whirlpool) had a smaller quantum security margin than classical. We will draw a similar result in Chapter 8 in collision attacks against Gimli-Hash.

Other Methods

Quantum cryptanalysis is a rapidly evolving field and new methods are still appearing and being investigated. An interesting example to mention is the algorithm for solving Boolean equations of Chen and Gao [START_REF] Chen | Quantum Algorithms for Boolean Equation Solving and Quantum Algebraic Attack on Cryptosystems[END_REF]. This algorithm is based on the HHL algorithm for linear systems [START_REF] Harrow | Quantum algorithm for linear systems of equations[END_REF], which has an exponential speedup. The authors propose to set up quantum algebraic attacks in which the problem of recovering the key of a block cipher, or finding a preimage of a hash function, is simply translated into a system of Boolean equations, which is solved using their new algorithm. At the time of writing, this attack is the only candidate for a more than quadratic speedup in the Q1 setting. However, its status remains unclear, because its complexity depends on a parameter (the condition number of a large sparse linear system) which has not yet been duly estimated.

Chapter 5 Quantum Merging Algorithms for the k-XOR Problem

This chapter and the next one focus on generic quantum algorithms that solve the 𝑘-XOR problem. It can be seen as a generalization of the collision search problem introduced in Section 2.3, where, instead of two colliding elements, we wish to find a 𝑘-tuple for some given 𝑘. Furthermore, there may be many solutions as in Section 2.3, but there may also be only a single expected one, which will be the case in Chapter 6. This versatile problem encompasses a variety of problems arising in symmetric and asymmetric cryptography. Some of these applications will be reviewed both in this chapter and Chapter 6. This chapter merges results published in [CNS17; GNS18; NS20] and adds new details. We introduce a new quantum algorithm for collision search and its applications. Next, we review the 𝑘-XOR problem, classical methods to solve it and introduce the framework of quantum merging and of merging trees. We describe the optimal merging strategies for quantum 𝑘-XOR with many solutions and prove this optimality among the set of merging trees.

Quantum Collision and Multi-Target Preimages without QRACM

Let us restate the collision search problem:

Problem 2.3 (collision search). Given access to ℎ : t0, 1u 𝑛 Ñ t0, 1u 𝑛 , find a collision pair: 𝑥 ‰ 𝑦 such that ℎp𝑥q " ℎp𝑦q.

We have seen in Section 2.3 that Pollard's rho algorithm solves this problem for a random function in time and queries 𝒪 `2𝑛{2 ˘, its lower bound, using a negligible memory, and that Brassard, Høyer and Tapp's algorithm (Algorithm 2.10) solved it in time and queries 𝒪 `2𝑛{3 ˘, also the quantum lower bound. But the BHT algorithm uses a QRACM of exponential size.

In this section, we study quantum speedups in the plain quantum circuit model. We show that it is possible to obtain a quantum gate count below 𝒪 `2𝑛{2 ˘.

Quantum Collision Search

The algorithm presented here (Algorithm 5.1) relies on the definition of a set of distinguished points, an idea that is reminiscent of the parallel collision search technique of [START_REF] Paul | Parallel Collision Search with Cryptanalytic Applications[END_REF].

Definition 5.1 (Distinguished points). Take an arbitrary prefix 𝑢 of 2 log 2 𝐿 bits. We say that 𝑥 P t0, 1u 𝑛 is distinguished if ℎp𝑥q has prefix 𝑢: ℎp𝑥q " 𝑢|˚. Let 𝑆 𝑢 Ď t0, 1u 𝑛 be the set of distinguished points.

With this definition, there are on average 2 𝑛 𝐿 2 distinguished points. Since ℎ is simply assumed to be a random function, the precise number of distinguished points is not known. However, its deviation from the average can be quantified with Chernoff-Hoeffding bounds [START_REF] Hoeffding | Probability inequalities for sums of bounded random variables[END_REF]. Let 𝑋 𝑖 , 0 ď 𝑖 ď 2 𝑛 be the independent random variables taking the value 1 if 𝑖 is distinguished and 0 otherwise, then for any constant 0 ď 𝛿 ď 1:

Pr ˜ˇˇˇˇÿ 𝑖 𝑋 𝑖 ´2𝑛 𝐿 2 ˇˇˇˇě 𝛿 2 𝑛 𝐿 2 ¸ď 2𝑒 ´𝛿2 2 𝑛 3𝐿 2
.

(5.1)

The exact value of the prefix does not matter, only its size and the fact that two distinguished points have a higher probability of forming a collision pair than two random points.

Then, the algorithm is divided into two main steps, which adapt the two steps of BHT collision search: 1. create a list of values p𝑦, ℎp𝑦qq for many 𝑦, where ℎp𝑦q P 𝑆 𝑢 ; 2. search for 𝑥 P t0, 1u 𝑛 such that D𝑦 ‰ 𝑥, p𝑦, ℎp𝑥qq P ℒ. We now prove its correctness and time complexity.

Theorem 5.1 (QRACM-free quantum collision search [CNS17]). For any memory limit 𝐿 ď 2 𝑛{5 , there exists a quantum algorithm solving the collision search problem for random functions, running in time 𝒪 ´𝐿2 `2𝑛{2

? 𝐿 ¯(counted in 𝑛-bit register operations and evaluations of ℎ), making 𝒪 ´𝐿2 `2𝑛{2 ? 𝐿 ¯queries to 𝑂 ℎ .

Proof. The average time complexity in Algorithm 5.1 is easy to compute. In the first step, there are 2 𝑛 𝐿 2 distinguished points, hence 𝒪p𝐿q iterations to find one, and we repeat this 𝒪p𝐿q times. The final Amplitude Amplification has (on average) 𝐿 solutions among |𝑆 𝑢 |, hence a quantum time complexity of order:

c |𝑆 𝑢 | 𝐿 ˆ𝐿 lo omo on Sample `𝐿 lo omo on Test ˙,
where the sample consists in running Grover's algorithm again, and the test contains a sequential membership circuit. The choice of distinguished points ensures that the time complexities of the sample and the test are balanced.

We now show that with probability exponentially close to 1, we stay close to the average. In the first step, it suffices to set the number of iterations of Grover search to

Y 𝜋 4 b 2 𝑛 𝐿 2 ]
, depending on the expected number of solutions. Taking 𝛿 " `𝐿2

2 𝑛 ˘1{3 in Equation

(5.1), we obtain that with overwhelming probability, the number of distinguished points is between:

2 𝑛 𝐿 2 ´`2 𝑛 𝐿 2 ˘2{3 and 2 𝑛 𝐿 2 ``2 𝑛 𝐿 2
˘2{3 . So the probability of success of the classical sampling (taking a point at random and checking if it is distinguished) lies in the interval:

2 𝑛 𝐿 2 ´`2 𝑛 𝐿 2 ˘2{3 2 𝑛 ď |𝑆 𝑢 | 2 𝑛 ď 2 𝑛 𝐿 2 ``2 𝑛 𝐿 2 ˘2{3 2 𝑛 ùñ 1 𝐿 2 ˜1 ´𝐿2{3 2 𝑛{3 ¸ď |𝑆 𝑢 | 2 𝑛 ď 1 𝐿 2 ˜1 `𝐿2{3 2 𝑛{3
¸.

Thus, the relative error vanishes and by Theorem 2.5, using Exact amplitude amplification, we can sample from 𝑆 𝑢 with error probability at most:

˜𝐿2{3 2 𝑛{3 ¸2 " 𝐿 4{3 2 2𝑛{3 ,
(5.2) so only 𝐿p1 `𝑜 p1qq samples are necessary to obtain 𝐿 different results with high probability.

In the second step, the list ℒ contains exactly 𝐿 fixed distinct elements 𝑥 0 , . . . , 𝑥 𝐿´1 and 𝐿 distinct images ℎp𝑥 0 q, . . . , ℎp𝑥 𝐿´1 q. There are on average p2 𝑛 ´𝐿q 𝐿 2 𝑛 " 𝐿 `1 ´𝐿 2 𝑛 ȇlements 𝑥 P t0, 1u 𝑛 zt𝑥 0 , . . . , 𝑥 𝐿´1 u such that ℎp𝑥q P tℎp𝑥 0 q, . . . , ℎp𝑥 𝐿´1 qu. Using the same inequality as (5.1), we can bound the probability 𝑝 that a random distinguished point is a solution:

𝐿 `1 ´𝐿 2 𝑛 ˘´𝐿 2{3 `1 ´𝐿 2 𝑛 ˘2{3 |𝑆 𝑢 | ď 𝑝 ď 𝐿 `1 ´𝐿 2 𝑛 ˘`𝐿 2{3 `1 ´𝐿 2 𝑛 ˘2{3 |𝑆 𝑢 | ùñ 𝐿 2 2 𝑛 ˜1 ´𝐿2{3 2 𝑛{3 ¸p𝐿 ´𝐿2{3 q ď 𝑝 ď 𝐿 2 2 𝑛 ˜1 `𝐿2{3 2 𝑛{3 ¸p𝐿 `𝐿2{3 q (5.3) (with an approximation: 𝐿 2 𝑛 ! 𝐿 1{3 2 𝑛{3
). We combine this with Equation (5.2) to bound the total error probability. The uncertainties from the sample and the number of solutions pile up additively. Applying Theorem 2.5 again, we find that the probability of success of this final Amplitude Amplification is exponentially close to 1.

Quantum Multi-Target Preimage Search

Algorithm 5.1 applies as well to multi-target preimage search.

Problem 2.7 (Multi-target Preimage Search). Given access to ℎ, and a list of targets ℒ " t𝑦 0 , . . . , 𝑦 𝐿´1 u (selected uniformly at random), find 𝑥 P t0, 1u 𝑛 such that D0 ď 𝑖 ď 𝐿 ´1, ℎp𝑥q " 𝑦 𝑖 .

The idea of Algorithm 5.2 below is to go back to the setting of Algorithm 5.1, with a search for a collision among distinguished points. Since the targets are random, we need to drop most of them and keep only the distinguished ones. Thus, the solution found will actually be a preimage of a distinguished target.

Algorithm 5.2 Quantum multi-target preimage search without QRACM.

Input: query access to 𝑂 ℎ , list ℒ " t𝑦 0 , . . . , 𝑦 𝐿´1 u of 𝐿 targets Output: a preimage of one of these targets: 𝑥 such that D𝑦 P ℒ, ℎp𝑥q " 𝑦 1: Initialize an empty list ℒ 1 of size minp𝐿 1{3 , 2 𝑛{7 q 2: Select a prefix 𝑢 of length 2 3 log 2 𝐿 3: for 𝑦 𝑖 P ℒ do 4:

if 𝑦 𝑖 has the prefix 𝑢 then 5:

Add 𝑦 𝑖 to ℒ 1 6: If ℒ 1 contains a collision, return it 7: Sample 𝑥 P 𝑆 𝑢 such that 8: D𝑦 ‰ 𝑥, p𝑦, ℎp𝑥qq P ℒ 1 9: EndSample return 𝑥, 𝑦
Theorem 5.2 (QRACM-free quantum multi-target preimage search [CNS17]). There exists a quantum algorithm solving the multi-target preimage search problem for random functions, for 𝐿 targets, running in time 𝒪 ´min ´𝐿 `2𝑛{2 𝐿 1{6 , 2 3𝑛{7 ¯¯(counted in 𝑛-bit register operations and evaluations of ℎ), making the same number of queries to 𝑂 ℎ , and using 𝐿 1{3 memory.

Proof. The runtime of Algorithm 5.2 is very similar to what we computed for Algorithm 5.1. In the first step, we only read the list of targets and stockpile the distinguished ones. In the second step, we search in the space of distinguished points, of size 2 𝑛 𝐿 2{3 , for one among 𝐿 1{3 solutions.

Our choice of prefix size ensures that the sampling and test in the second step are balanced. For 𝐿 ď 2 3𝑛{7 :

𝐿 `c |𝑆 𝑢 | 𝐿 1{3 loomoon Iterations ˆ𝐿1{3 lo omo on Sample `𝐿1{3 lo omo on Test ˙" 𝐿 `2𝑛{2 𝐿 1{6 . (5.4)
Even if ℒ is not stored, we assume that reading from it costs time 1. The trade-off remains valid only until both terms are balanced, which happens at 𝐿 " 2 3𝑛{7 . Thus, with an unlimited number of targets, the time complexity can decrease down to 𝒪 `23𝑛{7 ˘.

Discussion

Algorithm 5.1 shows that QRACM is not necessary in quantum collision search, up to the memory bound 2 𝑛{5 . While the time-memory trade-off curve remains 𝑇 2 ¨𝑀 " 2 𝑛 , a large part of this curve becomes achievable with classical memory only (and more precisely CSAM, as we have seen in Section 1.3.4). Three natural questions come to mind.

Open Problem 5.1. Is it possible to move further on this curve, for example to bring the time complexity down to 𝒪 `2𝑛{3 ˘, using 𝒪 `2𝑛{3 ˘classical memory?

We conjecture that this is unlikely, as a quantum circuit requiring 𝒪 `2𝑛{3 ˘time and classical memory would be accessing each classical cell at most 𝒪p1q times.

Open Problem 5.2. Is it possible to move below the curve 𝑇

" b 2 𝑛 𝑀 ?
We conjecture that this is unlikely.

Open Problem 5.3. Does there exist a quantum algorithm for collision search with r 𝒪 `2𝑛{3 ˘time (but using any amount of qubits), in the plain quantum circuit model?

Leaving aside Pollard's rho, classical collision search can be performed with 2 𝑛{2 memory and r 𝒪 `2𝑛{2 ˘time, without random access, by simply storing the 2 𝑛{2 elements and performing a sorting network (e.g., the AKS network [START_REF] Ajtai | An 𝒪p𝑛 log 𝑛q Sorting Network[END_REF]). This question asks whether a corresponding quantum method exist, that would then be free of qRAM gates.

Parallelization.

A distributed variant of Algorithm 5.1 was done in [CNS17]. This algorithm was improved subsequently in [JS20]. The main idea is that the first step can be easily distributed, since the distinguished points can be searched for by independent processors. Then, the second step can be distributed as a Grover search [CNS17], or using more complex unitary operators to accelerate the membership circuit [JS20]. The efficiency of the second variant depends on the connectivity of the quantum processors [START_REF] Beals | Efficient distributed quantum computing[END_REF].

Further works. The idea to replace quantum by classical memory was subsequently reused by Helm and May [START_REF] Helm | The Power of Few Qubits and Collisions -Subset Sum Below Grover's Bound[END_REF] in subset-sum algorithms. However, the restriction on the time-memory trade-offs available is quite strong, and their results do not outperform the best classical algorithms for this problem from the single metric of time complexity. Instead, they achieve better time-memory trade-offs quantumly than classically. Algorithm 5.2 was used in the attacks against Even-Mansour and FX of [START_REF] Hosoyamada | Cryptanalysis Against Symmetric-Key Schemes with Online Classical Queries and Offline Quantum Computations[END_REF].

Classical Merging Algorithms

In this section, we define the 𝑘-XOR Problem with many solutions and detail Wagner's algorithm [START_REF] Wagner | A Generalized Birthday Problem[END_REF], that efficiently solves it.

k-XOR Problems

The Generalized Birthday Problem was introduced by Wagner [Wag02], who solved it by generalizing a method credited to Camion and Patarin [START_REF] Camion | The Knapsack Hash Function proposed at Crypto'89 can be broken[END_REF]. It has many applications in cryptography.

We will consider several variants of this problem. The input data can be accessed via input lists or via an oracle. Classically, this does not make a significant difference. Quantumly, we need to take it into account, as it determines whether the data is accessed by a quantum or a classical oracle.

Problem 5.1 (𝑘-XOR with lists). Given ℒ 1 , . . . , ℒ 𝑘 lists of uniformly random 𝑛-bit strings, find 𝑥 1 , . . . , 𝑥 𝑘 P ℒ 1 ˆ. . . ˆℒ𝑘 such that 𝑥 1 ' . . . ' 𝑥 𝑘 " 0 in minimal time.

Problem 5.1 is the original problem solved by Wagner in [START_REF] Wagner | A Generalized Birthday Problem[END_REF], where the lists can be extended at will. We are in a situation where many solutions exist and we want to find only one. In that case, we will see that there exists an optimal list size, which is exponential in 𝑛 (otherwise we wouldn't expect a solution) and the same for all lists (otherwise we could increase the size of the non-maximal lists and simply drop the additional elements). The oracle version of this problem is as follows.

Problem 5.2 (𝑘-XOR with an oracle). Given oracle access to a random 𝑛-bit to 𝑛-bit function ℎ, find distinct inputs 𝑥 1 , . . . , 𝑥 𝑘 such that ℎp𝑥 1 q ' . . . ' ℎp𝑥 𝑘 q " 0.

When 𝑘 " 2, Problem 5.2 collapses to the collision search problem. Alternatively, one can define Problem 5.2 with 𝑘 different random functions, or Problem 5.1 with a single input list. For random objects, these formulations are equivalent up to a constant factor in 𝑘.

Extension to other operations. We choose to focus on the bitwise XOR operation ' for simplicity, but, as Wagner already remarks [START_REF] Wagner | A Generalized Birthday Problem[END_REF], the problem can be defined with modular additions instead (𝑘-SUM). All the algorithms of this chapter and the next one can also be applied in the 𝑘-SUM setting, which is also of cryptographic interest.

Query complexity of k-XOR.

In all variants, we consider 𝑘 to be a constant. Intuitively, increasing 𝑘 can only make the problem easier on average, since new degrees of freedom are available. The following folklore result is well-known. Proof. We make 𝑘2 𝑛{𝑘 queries to generate 2 𝑛 random independent sums 𝑥 1 ' . . . ' 𝑥 𝑘 . Then the probability that none of them is 0 is less than p1 ´2´𝑛 q 2 𝑛 ď 𝑒 ´1.

In the quantum setting, Zhandry proved a similar result, that includes the quantum collision lower bound as a special case. Proposition 5.2 ([Zha19], Corollary 3). Any algorithm that makes 𝑞 quantum queries to ℎ can only output a 𝑘-tuple 𝑥 1 , . . . , 𝑥 𝑘 such that ℎp𝑥 1 q ' . . . ' ℎp𝑥 𝑘 q " 0 with probability 𝒪 `𝑞𝑘`1 {2 𝑛 ˘. Consequently, any algorithm succeeding with constant probability must make at least Ω `2𝑛{p𝑘`1q ˘such queries.

Thus, algorithms for 𝑘-XOR have exponential query and time complexities in 𝑛: r 𝒪p2 𝛼 𝑘 𝑛 q for some 𝛼 𝑘 depending only on 𝑘. We will be focused on the algorithms achieving the best time complexities. Despite the favorable case of collisions, they generally require memories of exponential size.

Classical Merging

We will now detail the fundamental building block of Wagner's algorithm, and the whole class of merging algorithms that we explore in this chapter and the next one.

From now on, we adopt the following conventions: lists named ℒ 𝑖 have corresponding sizes 𝐿 𝑖 " 2 ℓ 𝑖 𝑛 (up to a constant). We write for simplicity that ℒ 𝑖 "has size ℓ 𝑖 ". All these ℓ 𝑖 are constants. Since all time complexities are exponential in 𝑛, we write them as 𝒪p2 𝛼𝑛 q and focus on the exponent 𝛼, which is also a constant. In other words, we often remove 𝑛 from our computations as a mere common factor.

Let ℒ 1 and ℒ 2 be two lists of 𝑛-bit strings selected uniformly and independently at random, of respective sizes 𝐿 1 » 2 ℓ 1 𝑛 and 𝐿 2 » 2 ℓ 2 𝑛 . We need the lists to be sorted to ensure the efficiency of the procedure. We select a prefix 𝑡 of 𝑢𝑛 bits (𝑢 ă 1), where 𝑢𝑛 is approximated to an integer. Definition 5.2 (Join operator). The "join" ℒ 1 ' 𝑢 ℒ 2 is the list of pairs 𝑥 1 P ℒ 1 , 𝑥 2 P ℒ 2 such that 𝑥 1 ' 𝑥 2 " 𝑡|˚. We say that such 𝑥 1 and 𝑥 2 partially collide on 𝑢𝑛 bits.

In the following, we will favor the term "merging" over "join". Instead of computing the join, we say that we merge ℒ 1 and ℒ 2 on 𝑢𝑛 bits. By construction, if both input lists are sorted, the join list will be as well.

Remark 5.1. Computationally, the join list will contain rather three-tuples 𝑥 1 , 𝑥 2 , 𝑥 1 ' 𝑥 2 , so that we keep the knowledge of 𝑥 1 and 𝑥 2 and do not recompute the sum.

If the lists ℒ 1 and ℒ 2 contain elements drawn uniformly at random,

ℒ 𝑢 " ℒ 1 ' 𝑢 ℒ 2 is of average size 𝐿 1 𝐿 2
2 𝑢𝑛 . Indeed, when 𝑥 1 P ℒ 1 and 𝑥 2 P ℒ 2 are selected uniformly at random, then Prp𝑥 1 ' 𝑥 2 " 𝑡|˚q " 2 ´𝑢𝑛 . This average follows by linearity of the expectation. Thus, the average time complexity of algorithms based on merging is easy to compute; this is what Wagner does [START_REF] Wagner | A Generalized Birthday Problem[END_REF]. However, in practice, and in order to simplify the analysis, we want to know how much we can deviate from this average.

If the elements of ℒ 𝑢 were all independent, this deviation would be small thanks to Chernoff bounds. But this is usually not the case, and assuming a small variance without further justification is a heuristic assumption. Minder and Sinclair bounded the variance in list sizes for Wagner's algorithm and more generally, for merging algorithms that start from lists of uniformly distributed elements [MS12, Section 4]. They used Chebyshev's inequality and bound the covariance between random variables that indicate whether a tuple of initial elements form a solution. Instead of going into the details of their proof, we will give alternative arguments sufficient for the algorithms presented in this chapter and the next one.

Lemma 5.1 (Classical merging). Let 𝑡 be an arbitrary prefix of 𝑢𝑛 bits. Let ℒ 1 and ℒ 2 be two lists of respective sizes 2 ℓ 1 𝑛 and 2 ℓ 2 𝑛 , of 𝑛-bit strings drawn uniformly at random.

Then the join list ℒ 𝑢 " ℒ 1 ' 𝑢 ℒ 2 can be computed in average time:

max ˆ𝐿1 𝐿 2 2 𝑢𝑛 , minp𝐿 1 , 𝐿 2 q ˙, (5.5) that is, in log 2 , maxpℓ 1 `ℓ2 ´𝑢, minpℓ 1 , ℓ 2 qq. This list is of size 𝐿 𝑢 such that E p𝐿 𝑢 q " 𝐿 1 𝐿 2 2 𝑢𝑛 .
Furthermore, if ℓ 𝑢 ď maxpℓ 1 , ℓ 2 q, there exists two constants 𝑎, 𝑏 ą 0 such that with probability 1 ´𝑒´𝑎𝑛 , a proportion 𝑏 of the elements of ℒ 𝑢 are drawn uniformly at random from all 𝑛-bit strings with prefix 𝑡.

Proof. The merging procedure is given in Algorithm 5.3. If 𝐿 1 ą 𝐿 2 , then we will roughly iterate on all elements of ℒ 1 while trying to find matching elements in ℒ 2 . If 𝐿 1 ă 𝐿 2 , the converse happens. The total time taken is at least the time to write the pairs; this gives Equation (5.5).

As an example of non-independence between the output pairs, let us consider 𝑥 1 , 𝑦 1 P ℒ 1 and 𝑥 2 , 𝑦 2 P ℒ 2 , then the events 𝑥 1 ' 𝑥 2 " 𝑡|˚, 𝑦 1 ' 𝑥 2 " 𝑡|˚, 𝑥 1 ' 𝑦 2 " 𝑡|å nd 𝑦 1 ' 𝑦 2 " 𝑡|˚are not independent. In order to recover independence when ℓ 𝑢 ď maxpℓ 1 , ℓ 2 q, we will use an argument similar to [START_REF] Lyubashevsky | The Parity Problem in the Presence of Noise, Decoding Random Linear Codes, and the Subset Sum Problem[END_REF]. We first need a technical result, which is a property of random mappings. Lemma 5.2. Let ℎ : t0, 1u 𝑛 Ñ t0, 1u 𝑛 be a random function. Let 𝑌 pℎq be the number of elements in t0, 1u 𝑛 without a preimage. Then: Prp𝑌 pℎq ą 0.4 ¨2𝑛 q ď 0.9987 2 𝑛 .

(5.6)

Proof. We write 𝑌 pℎq " ř 𝑖Pt0,1u 𝑛 𝑌 𝑖 pℎq. The 𝑌 𝑖 pℎq are not independent, but they are negatively correlated: knowing that 𝑥 has no preimage only decreases the probability that this is the case for 𝑥 1 ‰ 𝑥. In that case, a Chernoff bound applies [START_REF] Panconesi | Randomized Distributed Edge Coloring via an Extension of the Chernoff-Hoeffding Bounds[END_REF], and for any 𝛿 ą 0:

Pr ˆ𝑌 pℎq ě p1 `𝛿q2 𝑛 𝑒 ˙ď ˆ𝑒𝛿 p1 `𝛿q 1`𝛿 ˙2𝑛 𝑒 ,
where 2 𝑛 𝑒 is the average of 𝑌 pℎq, which is a standard result of random mappings [START_REF] Flajolet | Random Mapping Statistics[END_REF]. We then choose 𝛿 " 0.4𝑒 ´1 » 0.087 and obtain the claimed bound by rounding the term on the left side.

Assume without loss of generality that ℓ 1 ď ℓ 2 . The idea is that since ℓ 𝑢 ď ℓ 2 ùñ ℓ 1 ď 𝑢, a given element of ℒ 1 intervenes in one pair on average, which ensures independence between the pairs. We assume that ℓ 2 ´𝑢 ą 0.

First of all, we cut ℒ 2 into sublists ℒ 𝑥 2 depending on 𝑢𝑛-bit prefixes 𝑥. Then any element in ℒ 𝑢 is the sum of an element 𝑥 1 in ℒ 1 of prefix 𝑥, and an element of 𝑥 2 of ℒ 𝑥 2 . We use Chernoff bounds to show that the individual sizes of the ℒ 𝑥 2 do not deviate much from their expectation E p𝐿 𝑥 2 q " 2 𝑛pℓ 2 ´𝑢q . We have:

@𝑥, @𝛿 ď 1, Prp|𝐿 𝑥 2 ´E p𝐿 𝑥 2 q| ě 𝛿 E p𝐿 𝑥 2 qq ď 2𝑒 ´𝛿2 Ep𝐿 𝑥 2 q 3 , (5.7)
and by taking 𝛿 " pE p𝐿 𝑥 2 qq 1{3 , since E p𝐿 𝑥 2 q is exponential in 𝑛, taking a union bound over all prefixes 𝑥 does not change that the probability to deviate is vanishingly small:

Pr ´D𝑥, |𝐿 𝑥 2 ´E p𝐿 𝑥 2 q| ě E p𝐿 𝑥 2 q 2{3 ¯ď 2 𝑢𝑛`1 𝑒 ´Ep𝐿 𝑥 2 q 1{3 3 .
(5.8)

Focusing on ℒ 1 , we extract a sublist ℒ 1 1 of its elements having distinct prefixes of 𝑢𝑛 bits, and we show that the size of ℒ 1 1 is only smaller by a constant. This comes from Lemma 5.2. If we index elements of ℒ 1 by their ℓ 1 𝑛-bit prefix, then at least a constant proportion of these prefixes are occupied, with probability exponentially close to 1. In other words, we are free to store ℒ 1 in a unique prefix list. Combining this with Equation (5.8), we bound the deviation of the merged list size from its expectation.

It remains to observe that ℒ 1 1 ' ℒ 2 Ď ℒ 𝑢 contains independent sums, since each element of ℒ 2 appears at most once. In the case where ℓ 1 " ℓ 2 " 𝑢, taking unique prefixes for both lists ℒ 1 and ℒ 2 gives the same result.

Algorithm 5.3 Classical merging.

Input: ℒ 1 , ℒ 2 sorted lists of 𝑛-bit strings of sizes 𝐿 1 , 𝐿 2 , prefix 𝑡 of 𝑢𝑛 bits. Elements of these lists are denoted 𝑥 1,𝑖 1 and 𝑥 2,𝑖 2 respectively. Output:

join list ℒ 𝑢 " ℒ 1 ' 𝑢 ℒ 2 function Merge(ℒ 1 , ℒ 2 , 𝑡) Set 𝑏, 𝑠 " 1, 2 if 𝐿 1 ą 𝐿 2 and 2, 1 otherwise If 𝑡 is not provided, set 𝑡 " 0 𝑢𝑛 ℒ 𝑠 Ð t𝑥 ' p𝑡}0q, 𝑥 P ℒ 𝑠 u 𝑖 1 Ð 0, 𝑖 2 Ð 0 ℒ 𝑢 Ð H while 𝑖 1 ď 𝐿 1 and 𝑖 2 ď 𝐿 2 do if 𝑥 1,𝑖 1 | 𝑢𝑛 ą 𝑥 2,𝑖 2 | 𝑢𝑛 then Advance 𝑖 2 until 𝑥 1,𝑖 1 | 𝑢𝑛 ď 𝑥 2,𝑖 2 | 𝑢𝑛 else if 𝑥 1,𝑖 1 | 𝑢𝑛 ă 𝑥 2,𝑖 2 | 𝑢𝑛 then Advance 𝑖 1 until 𝑥 1,𝑖 1 | 𝑢𝑛 ě 𝑥 2,𝑖 2 | 𝑢𝑛 else ℒ 𝑢 Ð ℒ 𝑢 Y tp𝑥 𝑏,𝑖 𝑏 , 𝑥 𝑠,𝑖𝑠 ' 𝑡qu return ℒ 𝑢
A consequence of Lemma 5.1 is that it is sound to consider the merging operation to be exact, as long as the successive list sizes decrease. The situation is different if the list sizes increase, as in Minder and Sinclair's generalization [START_REF] Minder | The Extended k-tree Algorithm[END_REF] and in Chapter 6. For example, if we take the cross-product of two lists ℒ 1 ˆℒ2 " t𝑥 1 ' 𝑥 2 , 𝑥 1 P ℒ 1 , 𝑥 2 P ℒ 2 u, it is not statistically close to a list of random bit-strings of size 𝐿 1 𝐿 2 .

By abuse of notation, let us now denote by ℒ 𝑖 lists of random variables over t0, 1u 𝑛 following the uniform distribution. When we merge two lists ℒ 1 and ℒ 2 on a prefix of 𝑢𝑛 bits, we are actually selecting a subset of ℒ 1 ˆℒ2 ; a subset of all sums 𝑋 1 ' 𝑋 2 , 𝑋 1 P ℒ 1 , 𝑋 2 P ℒ 2 , depending on the 𝑢𝑛 first bits of 𝑋 1 and 𝑋 2 . But in the variables 𝑋 𝑖 , the 𝑢𝑛-bit prefix and the p1 ´𝑢q𝑛 remaining bits are independent. Thus, ℒ 𝑢 " ℒ 1 ' 𝑢 ℒ 2 will contain sums of the form 𝑡|𝑋 1 1 ' 𝑋 1 2 , where 𝑋 1 is a subset of p1 ´𝑢q𝑛 bits of 𝑋. At one limit case, all these sums are independent, this is the proof of Lemma 5.1. At the other limit, the list is a complete product. In general, we are somewhere in-between. We remark that such a list satisfies all the statistical properties that we need. In particular, when selecting a sublist based on a prefix, the sublist has a size close to its expectation, by a global constant, thanks to Chernoff bounds. Thus, subsequent merging operations will produce lists of adequate size, which will also contain sums of the initial 𝑋 𝑖 , and so on.

Lemma 5.3 (Classical merging (informal))

. Consider a sequence of merging operations (with a constant number of mergings), starting with lists of uniformly random bit-strings, of exponential size. Then there exists two constants 𝑎, 𝑏 ą 0 such that all subsequent lists ℒ have a size between 1 𝑏 E p𝐿q and 𝑏 E p𝐿q, with probability 1 ´𝑒𝑎𝑛 .

Wagner's Algorithm

Wagner's algorithm [START_REF] Wagner | A Generalized Birthday Problem[END_REF] solves Problem 5.1 using a recursive merging strategy, with a constant (in 𝑘) number of calls to the procedure Merge of Algorithm 5.3. It builds a sequence of lists of partial ℓ-XOR on 𝑢𝑛 bits, for increasing values of 𝑢 ă 1 and ℓ ă 𝑘, culminating into a single 𝑘-XOR (on expectation). In the following, we take a constant 𝑘 and a random ℎ : t0, 1u 𝑛 Ñ t0, 1u 𝑛 .

Example: 4-XOR. Wagner's algorithm for 4-XOR is detailed in Algorithm 5.4. Its strategy can be depicted by the binary tree of Figure 5.1.

Algorithm 5.4 Merging-based 4-XOR algorithm (breadth-first).

Input: oracle access to ℎ Output: 𝑥 1 , 𝑥 2 , 𝑥 3 , 𝑥 4 such that ℎp𝑥 1 q ' ℎp𝑥 2 q ' ℎp𝑥 3 q ' ℎp𝑥 4 q " 0

1: Create 4 lists ℒ 𝑖 , 1 ď 𝑖 ď 4 of pairs 𝑥, ℎp𝑥q, of size 2 𝑛{3 2: ℒ 12 Ð Mergepℒ 1 , ℒ 2 , 0 𝑛{3 q Ź ℒ 12 is of average size 2 𝑛{3 ˆ2𝑛{3 2 𝑛{3
" 2 𝑛{3 3: ℒ 34 Ð Mergepℒ 3 , ℒ 4 , 0 𝑛{3 q 4: Find a collision between ℒ 12 and ℒ 34 .

Ź There are 2 𝑛{3 ˆ2𝑛{3 pairs in ℒ 12 ˆℒ34 and 2𝑛 3 bits to put to zero.

Single 4-XOR on 𝑛 bits General k. We write 𝜅 " tlog 2 p𝑘qu for ease of notation. In the context of Wagner's algorithm, if 𝑘 is not a power of 2, we first take 𝑘 ´2𝜅 arbitrary elements 𝑧 1 , . . . , 𝑧 𝑘´2 𝜅 and then find a 2 𝜅 -XOR on their sum. So we assume without loss of generality that 𝑘 " 2 𝜅 . All the lists in the tree will have size 2 𝑛 𝜅`1 .

ℒ 34 2 𝑛{3 partial collisions p𝑥 3 , 𝑥 4 q, ℎp𝑥 3 q ' ℎp𝑥 4 q " 0 𝑛{3 |L 4 2 𝑛{3 elements p𝑥 4 , ℎp𝑥 4 qq ℒ 3 2 𝑛{3 elements p𝑥 3 , ℎp𝑥 3 qq ℒ 12 2 𝑛{3 partial collisions p𝑥 1 , 𝑥 2 q, ℎp𝑥 1 q ' ℎp𝑥 2 q " 0 𝑛{3 |L 2 2 𝑛{3 elements p𝑥 2 , ℎp𝑥 2 qq ℒ 1 2 𝑛{3 elements p𝑥 1 , ℎp𝑥 1 qq
• At the leaves of the tree (level 𝜅), we build 2 𝜅 lists of 2 𝑛 𝜅`1 single elements, making random queries to 𝐻.

• At level 𝜅 ´1, we merge the lists pairwise, obtaining 2 𝜅´1 lists, each one containing 2 𝑛 𝜅`1 collisions on 𝑛 𝜅`1 bits.

• At level 𝑖 (1 ď 𝑖 ď 𝜅 ´1), we have 2 𝑖 lists of 2 𝑖 -tuples which XOR to zero on 𝑖𝑛 𝜅`1 bits: each level puts 𝑛 𝜅`1 new bits to zero. Notice that all these bit-positions are arbitrary and fixed, for example prefixes of increasing size.

• Finally, we merge two lists of 2 𝜅´1 -tuples XORing to zero on p𝜅´1q𝑛 𝜅`1 bits, both lists having size 2 𝑛 𝜅`1 . We expect on average one 2 𝜅 -tuple to entirely XOR to zero. Proof. The only queries to ℎ are made at the first level. The algorithm calls the procedure Merge a constant (in 𝑘) number of times; for each merge, we apply Lemma 5.1. Note that we can store the lists in unique-prefix data structure, thus removing the need to sort if we have RAM access. Taking slightly bigger lists (but no more than by a constant in 𝑘) ensures that immediately before the root, we obtain two lists of size 2 𝑛 𝜅`1 . The deviation of the list sizes is negligibly small. A collision occurs then with constant probability.

Further works. Wagner's algorithm provides currently the best classical time complexity exponent of 1 tlog 2 p𝑘qu`1 for all 𝑘 (there are logarithmic improvements for non-powers of 2). Many subsequent works have improved the memory consumption and given new trade-offs [Ber+09; NS15; Din19], but we shall not study them in detail. Minder and Sinclair have studied a variation of Wagner's algorithm where the input list sizes are bounded. Their optimal algorithms roughly run in two steps: in the first levels of the binary tree, all pairs of elements are produced, increasing the list sizes; after this expansion step, classical merging is used.

Wagner's Binary Tree in a Breadth-first Order

To build a node of the tree, it suffices to have built its children; not necessarily all nodes of bigger depth. Wagner [START_REF] Wagner | A Generalized Birthday Problem[END_REF] already remarks that this allows to reduce the memory requirement of his algorithm from 2 𝜅 lists to 𝜅.

In Figure 5.2, we highlight the difference between these two strategies, by considering the 4-XOR tree of Figure 5.1. In a breadth-first manner, we build one level after another, and four lists need to be stored (the whole lowest level). In a depth-first manner, only two lists need to be stored. Step 1

Step 2

Step 3 This change of perspective has almost no incidence on Theorem 5.3, and the success of the merging strategy is still guaranteed. We illustrate this with a 4-XOR "breadth-first" merging algorithm, that we translate as a combination of Sample procedures. The strategy is the same, only the algorithm is rephrased. Instead of merging lists pairwise, we Sample from new lists, using the previously computed ones to eliminate some bits. There is a priori an issue with the variations in the number of partial solutions found. For example, in the loop that builds ℒ 34 , we should add all partial collisions found and not only the first one. However, by storing all lists in unique-prefix data structures, we will ensure a single partial solution at most at each time. We have seen in Section 5.2.2 that only a constant fraction of the lists is lost in this process.

Algorithm 5.5 Sample-based 4-XOR algorithm (depth-first).

Input: oracle access to ℎ Output: 𝑥 1 , 𝑥 2 , 𝑥 3 , 𝑥 4 such that ℎp𝑥 1 q ' ℎp𝑥 2 q ' ℎp𝑥 3 q ' ℎp𝑥 4 q " 0

1: Initialize ℒ 2 " H, ℒ 4 " H 2: Repeat 2 𝑛{3 times Ź We build ℒ 2 and ℒ 4 3:
Sample 𝑥 2 P t0, 1u 𝑛 4: Find p𝑥 2 , ℎp𝑥 2 qq P ℒ 2 such that ℎp𝑥 1 q ' ℎp𝑥 2 q " 0 𝑛{3 |( if there is no solution, abort) 17:

ℒ 2 Ð ℒ 2 Y tp𝑥 2 ,
if Dp𝑥 3 , 𝑥 4 , ℎp𝑥 3 q ' ℎp𝑥 4 qq P ℒ 34 , ℎp𝑥 1 q ' ℎp𝑥 2 q ' ℎp𝑥 3 q ' ℎp𝑥 4 q then 18:

exit and return 𝑥 1 , 𝑥 2 , 𝑥 3 , 𝑥 4 19: EndSample

Towards Quantum Merging

Quantum search has been a very useful tool in quantum collision search, for 𝑘 " 2. It seems natural to try to use it to speed-up classical merging algorithms for 𝑘-XOR. Unfortunately, the Merge function defined in Algorithm 5.3 cannot be accelerated: the bottleneck of the complexity is reading the input lists and writing the output list.

However, we have seen that the depth-first variant is a sequence of Sample procedures. Each procedure samples an element in a new list by partially matching (not merging) against the previous ones. We also know since Chapter 2 that Sample programs translate naturally into quantum algorithms. Together, these two ideas pave the way for quantum merging algorithms analogous to classical merging.

Merging Trees for the k-XOR Problem

In this section, we describe a framework of classical and quantum merging algorithms, that we name merging trees. Its goal is to describe merging strategies for 𝑘-XOR that directly translate into Sample programs. Merging trees can then be optimized for classical or quantum computations. We will, naturally, focus on the quantum case.

The presentation of merging trees in this section will differ from [NS20], but the trees will represent the same family of algorithms.

Examples of Quantum Merging

Let us start with some examples of optimal quantum merging trees for concrete values of 𝑘.

4-XOR

Translating Algorithm 5.5 into a quantum algorithm, we would obtain the following (heuristic) complexity:

2 𝑛{3 lo omo on ℒ 2 `2𝑛{3 lo omo on ℒ 4 `2𝑛{3 lo omo on ℒ 34 `𝒪´a 2 𝑛{3 looooomooooon Final sample " 𝒪 ´2𝑛{3 ¯, (5.9)
where the final Sample procedure requires QRACM access to ℒ 2 and ℒ 34 , and superposition queries to ℎ. As said before for merging, writing the lists ℒ 2 , ℒ 4 , ℒ 34 is a step that we do not expect to accelerate, and this is the bottleneck of the algorithm. Though it is not necessary to change the structure of the tree, this situation calls for an inherently quantum re-optimization of the parameters. This is displayed in Figure 5.3. We will decrease the size of the lists ℒ 2 , ℒ 4 , ℒ 34 and increase the size of ℒ 1 and ℒ 12 . The complexity becomes:

2 𝑛{4 lo omo on ℒ 2 `2𝑛{4 lo omo on ℒ 4 `2𝑛{4 lo omo on ℒ 34 `𝒪´a 2 𝑛{2 looooomooooon Final sample
" 𝒪 ´2𝑛{4 ¯.

(5.10) Thus, we have obtained an exponential quantum speedup for 4-XOR in the QRACM model. The same time complexity was obtained in [GNS18] in the QRAQM model, with a quantum walk, a more advanced algorithmic framework.

3-XOR

Classically, the 3-XOR problem is almost as hard as collision search, as only a logarithmic improvement is known (see [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] for a practical study). In the quantum setting, we will use a merging strategy that is inspired by classical rebound attacks [START_REF] Naya-Plasencia | How to Improve Rebound Attacks[END_REF].

Single 4-XOR on 𝑛 bits

ℒ 34 2 𝑛{4 partial collisions p𝑥 3 , 𝑥 4 q, ℎp𝑥 3 q ' ℎp𝑥 4 q " 0 𝑛{4 |L 4 2 𝑛{4 elements p𝑥 4 , ℎp𝑥 4 qq ℒ 3 2 𝑛{4 elements p𝑥 3 , ℎp𝑥 3 qq ℒ 12 2 𝑛{2 partial collisions p𝑥 1 , 𝑥 2 q, ℎp𝑥 1 q ' ℎp𝑥 2 q " 0 𝑛{4 |L 2 2 𝑛{4 elements p𝑥 2 , ℎp𝑥 2 qq ℒ 1 2 𝑛{2 elements p𝑥 1 ,
Output: 𝑥 1 , 𝑥 2 , 𝑥 3 such that ℎp𝑥 1 q ' ℎp𝑥 2 q ' ℎp𝑥 3 q " 0 1: Initialize ℒ 2 " ℒ 3 " H 2: Repeat 2 2𝑛{7 times Ź Building ℒ 2 3:
Sample 𝑥 2 P t0, 1u 𝑛 4:

ℒ 2 Ð ℒ 2 Y tp𝑥 2 , ℎp𝑥 2 qqu 5: EndRepeat 6: Repeat 2 𝑛{7 times Ź Building ℒ 3 7:
Sample 𝑥 3 P t0, 1u 𝑛 such that ℎp𝑥 3 q " 0 2𝑛{7 |8

: Find p𝑥 2 , ℎp𝑥 2 qq P ℒ 2 such that ℎp𝑥 1 q ' ℎp𝑥 2 q " 0 2𝑛{7 |1 2:

ℒ 3 Ð ℒ 3 Y tp𝑥 3 ,
if Dp𝑥 3 , ℎp𝑥 3 qq P ℒ 3 , ℎp𝑥 1 q ' ℎp𝑥 2 q ' ℎp𝑥 3 q then 13: exit and return 𝑥 1 , 𝑥 2 , 𝑥 3

14: EndSample

The heuristic complexity of Algorithm 5.6 is:

2 2𝑛{7 lo omo on ℒ 2 `2𝑛{7 ¨a2 2𝑛{7 loooooomoooooon ℒ 3 `a2 4𝑛{7 , (5.11)
as intuitively, the lists ℒ 2 and ℒ 3 allow to eliminate 3𝑛 7 bits, and 4𝑛 7 remain to be put to zero. Trying to optimize this strategy classically will not decrease the time complexity exponent below 1 2 . In the quantum setting, collision search does not benefit from a quadratic speedup, and using quantum search shifts the balance in our favor.

Single 3-XOR on 𝑛 bits

ℒ 3 2 𝑛{7 elements 𝑥 3 , ℎp𝑥 3 q " 0 2𝑛{7 |L 12 2 4𝑛{7 partial collisions p𝑥 1 , 𝑥 2 q, ℎp𝑥 1 q ' ℎp𝑥 2 q " 0 2𝑛{7 |L 2 2 2𝑛{7 elements p𝑥 2 , ℎp𝑥 2 qq ℒ 1 2 4𝑛{7 elements p𝑥 1 , ℎp𝑥 1 qq

Collisions

The BHT algorithm is a 2-XOR algorithm in the QRACM model, and the collision search algorithm of Section 5.1 is a 2-XOR algorithm in the circuit model. Both would be represented by trees of depth 1.

Definition of Merging Trees

The goal of merging trees is to represent quantum merging strategies for 𝑘-XOR in a purely syntactical way.

Definition 5.3 (Merging trees).

A 𝑘-merging tree 𝒯 𝑘 is a binary tree defined recursively as follows:

• A node is either labeled "Sample" (S-node) or "List" (L-node);

• If 𝑘 " 1, this is a leaf node 𝒯 1 ;

• If 𝑘 ą 1, 𝒯 𝑘 has two children: an S-node 𝒯 𝑘 𝑙 and an L-node 𝒯 𝑘𝑟 , where 𝑘 𝑙 `𝑘𝑟 " 𝑘.

It follows inductively that a 𝑘-merging tree has 𝑘 leaf nodes. Intuitively, an S-node represents a Sample from a given list and an L-node represents a list stored in memory, constructed with exponentially many samples.

By convention, we draw Sample nodes (dashed) on the left and List nodes (plain) on the right. To each node 𝒯 corresponds a list ℒ which is either built or sampled. Since the trees are binary, we adopt a simple numbering of lists ℒ 𝑗 𝑖 . The root node, at level 0 in the tree, is ℒ 0 0 , and the two children of ℒ 𝑗 𝑖 are numbered respectively ℒ 𝑗`1

2𝑖

for the sampled one and ℒ 𝑗`1 2𝑖`1 for the list one. We label a node with the following variables representing the characteristics of ℒ 𝑗 𝑖 :

• The width 𝑘 𝑗 𝑖 ;

• The number 𝑢 𝑗 𝑖 of bits set to zero (relatively to 𝑛); Merging strategy and constraints. We constraint the variables ℓ 𝑗 𝑖 and 𝑢 𝑗 𝑖 in order to represent a valid merging strategy. First, the goal is to output a single 𝑘-XOR solution.

Constraint 5.1 (Root node). At the root node: 𝑢 0 0 " 1 and ℓ 0 0 " 0.

As each node results from the merging of its two children, the number of zeros increases. Furthermore, two siblings shall have the same number of zeros: 𝑢 𝑗 2𝑖 " 𝑢 𝑗 2𝑖`1 . Otherwise, we could reduce this proportion to the minimum between them, obtaining an easier strategy.

Constraint 5.2 (Zero-prefixes). @𝑖, 𝑗 ě 1, 𝑢 𝑗 2𝑖 " 𝑢 𝑗 2𝑖`1 and 𝑢 𝑗´1 𝑖 ě 𝑢 𝑗 2𝑖
Finally, the size of a list is constrained by the sizes of its predecessors and the new constraint (p𝑢 𝑗´1 𝑖 ´𝑢𝑗

2𝑖`1 q𝑛 more bits to put to zero).

Constraint 5.3 (Size of a list).

@𝑖, 𝑗 ě 1, ℓ 𝑗´1 𝑖 " ℓ 𝑗 2𝑖 `ℓ𝑗 2𝑖`1 ´p𝑢 𝑗´1 𝑖 ´𝑢𝑗 2𝑖`1 q
An example of merging tree for 𝑘 " 7 is given in Figure 5.5.

ℒ 0 0 , k = 7 ℓ 0 0 , 𝑢 0 0 ℒ 1 1 , k = 3 ℓ 1 1 , 𝑢 1 1 ℒ 2 3 , k = 1 ℓ 2 3 , 𝑢 2 3 ℒ 2 2 , k = 2 ℓ 2 2 , 𝑢 2 2 ℒ 3 5 , k = 1 ℓ 3 5 , 𝑢 3 5 ℒ 3 4 , k = 1 ℓ 3 4 , 𝑢 3 4 ℒ 1 0 , k = 4 ℓ 1 0 , 𝑢 1 0 ℒ 2 1 , k = 2 ℓ 2 1 , 𝑢 2 1 ℒ 3 3 , k = 1 ℓ 3 3 , 𝑢 3 3 ℒ 3 2 , k = 1 ℓ 3 2 , 𝑢 3 2 ℒ 2 0 , k = 2 ℓ 2 0 , 𝑢 2 0 ℒ 3 1 , k = 1 ℓ 3 1 , 𝑢 3 1 ℒ 3 0 , k = 1 ℓ 3 0 , 𝑢 3 0 Figure 5
.5: Merging tree for 𝑘 " 7.

From Trees to Algorithms

Next, we show that a given merging tree always corresponds to a quantum algorithm for 𝑘-XOR, and we compute its time complexity depending on the tree parameters. We use a result analogous to Lemma 5.1.

Lemma 5.4 (Quantum merging). Let 𝑡 be an arbitrary prefix of 𝑢𝑛 bits. Let ℒ 1 and ℒ 2 be two lists of respective sizes 2 ℓ 1 𝑛 and 2 ℓ 2 𝑛 . Assume that ℒ 2 is stored either in QRACM or in CSAM, with a Unique prefix list data structure defined in Section 1.3.2. Assume that we are given a quantum sample for ℒ 1 : QSample ℒ 1 that returns (after measurement) an element of ℒ 1 selected uniformly at random, with probability 1 ´𝑒´𝑎𝑛 for some constant 𝑎 ą 0.

Then there exists a function QSample ℒ𝑢 that returns (after measurement) an element of ℒ 𝑢 , selected uniformly at random, with probability 1 ´𝑒´𝑏𝑛 for some other constant 𝑏 ą 0, where ℒ 𝑢 " ℒ 1 ' 𝑢 ℒ 2 . Up to a constant, the quantum time complexity of QSample ℒ𝑢 is:

T q `QSample ℒ𝑢 ˘" # T q `QSample ℒ 1 ˘¨maxp2 p𝑢´ℓ 2 q 2 𝑛 , 1q in the QRACM model `Tq `QSample ℒ 1 ˘`2 ℓ 1 𝑛 ˘¨maxp2 p𝑢´ℓ 2 q 2
𝑛 , 1q with CSAM (5.12) in qRAM gates and 𝑛-qubit register operations.

Proof. Using a unique prefix list avoids the issue of multiple matching solutions, and we can quickly see that it will bring no harm in a more general merging tree. The size of all lists is guaranteed by Lemma 5.1, and we have seen that the constraint of unique prefixes leads only to the loss of a constant fraction of the lists.

We use an Amplitude Amplification, where the amplified algorithm consists in running QSample ℒ 1 , finding whether there is a match of the given prefix in ℒ 2 , and returning the pair if it exists. The probability of success depends on the size of the merged list, which is controlled by the Chernoff bound of Lemma 5.1. Thus, we can use Theorem 2.5. The error of the full procedure will remain exponentially low.

To obtain the time complexity, we separate two cases: if 𝑢 ą ℓ 2 , then the amplification really needs to take place, and it has 2 p𝑢´ℓ 2 q𝑛 iterations up to a constant. Each iteration calls QSample ℒ 1 (setup) and queries the unique-prefix list. Without the QRACM, we use an emulation circuit.

If 𝑢 ă ℓ 2 , then a given element 𝑥 1 P ℒ 1 will have on average exponentially many 𝑥 2 P ℒ 2 such that 𝑥 1 ' 𝑥 2 " 𝑡|˚. As we want the uniform superposition of them, we use the ability of the unique-prefix list to return a superposition of elements of a given prefix. This also works with the emulation circuit. Time. We attach to each node another parameter 𝑡, which represents the sample time. Our intuition is that the time to sample from the list ℒ 𝑗 𝑖 represented by this node should be, in practice, 𝒪 `2𝑛𝑡 ˘.

Constraint 5.4 (Sampling). Let 𝒯 𝑗

𝑖 be a node in the tree, either an S-node or an L-node.

• if 𝒯 𝑗 𝑖 is a leaf, 𝑡 𝑗 𝑖 " 𝑢 𝑗 𝑖 2 .
• otherwise, 𝒯 𝑗 𝑖 has an S-child 𝒯 𝑗`1 2𝑖 and an L-child 𝒯 𝑗`1 2𝑖`1 , and:

𝑡 𝑗 𝑖 " $ ' & ' % 𝑡 𝑗`1 2𝑖 `1 2 maxp𝑢 𝑗 𝑖 ´𝑢𝑗`1 2𝑖 ´ℓ𝑗`1 2𝑖`1 , 0q in the QRACM model maxp𝑡 𝑗`1 2𝑖 , ℓ 𝑗`1 2𝑖`1 q `1 2 maxpp𝑢 𝑗 𝑖 ´𝑢𝑗`1 2𝑖 ´ℓ𝑗`1 2𝑖`1 , 0q with CSAM 𝑡 𝑗`1 2𝑖 `maxp𝑢 𝑗 𝑖 ´𝑢𝑗`1 2𝑖 ´ℓ𝑗`1 2𝑖`1 , 0q classically (5.13)
If the node is a leaf, then we simply run Grover's algorithm multiple times. Equation (5.13) is simply a translation of (5.12) in the case of a specific node. The third option is added only in the circuit model, in the case where quantum samplings are too costly (due to the membership queries) with respect to classical samplings. Notice that in that case, since the node can be sampled only classically, so will be its parent. Next, from the individual sampling times of each node, we can compute what should be the time complexity exponent of a tree. Definition 5.4. Let 𝒯 𝑘 be a 𝑘-merging tree. We define T q p𝒯 𝑘 q and M p𝒯 𝑘 q as:

T q p𝒯 𝑘 q " max ˆmax List nodes ´𝑡𝑗 𝑖 `ℓ𝑗 𝑖 ¯, 𝑡 0 0 Ṁ p𝒯 𝑘 q " max List nodes
´ℓ𝑗 𝑖 Īt should be noted that the list size of sample nodes plays only a role in the structural constraints, not in the time complexity. They should simply have a size sufficient to ensure the existence of a solution in the tree.

With these definitions, and with the help of Lemma 5.4, we are now ready to make merging trees correspond to merging algorithms. Theorem 5.4 (Quantum merging strategies). Let 𝒯 𝑘 be a 𝑘-merging tree and T q p𝒯 𝑘 q computed as in Definition 5.4. Then there exists a quantum merging algorithm that, given access to a quantum oracle 𝑂 ℎ , finds a 𝑘-XOR.

This algorithm succeeds with probability more than 1 ´𝑒´𝑎𝑛 for some constant 𝑎 ą 0. It runs in time 𝒪 `2Tqp𝒯 𝑘 q𝑛 ˘, counted in 𝑛-qubit register operations and qRAM gates, makes the same number of queries to 𝑂 ℎ . It requires only 𝒪p𝑛q computing qubits. It uses a memory 𝒪 `2Mp𝒯 𝑘 q𝑛 ˘, counted in 𝑛-bit registers (either CSAM, RAM or QRACM). The constants in the 𝒪 depend on 𝑘.

Proof. We define recursively the correspondence 𝒯 𝑘 𝒜 Þ Ý Ñ 𝒜p𝒯 𝑘 q from a merging tree 𝒯 𝑘 to an algorithm 𝒜p𝒯 𝑘 q solving the 𝑘-XOR problem, with the wanted time and memory complexities.

Let 𝑁 p𝑘, 𝑢, ℓq be the root node of 𝒯 𝑘 and 𝑆p𝑘 1 , 𝑢 1 , ℓ 1 q and 𝐿p𝑘 2 , 𝑢 2 , ℓ 2 q its two children, if they exist.

ℒ 0 0 , k = 3 ℓ 0 0 " 0, 𝑢 0 0 " 1 𝑡 0 0 " 2 7 ℒ 1 1 , k = 1 ℓ 1 1 " 1 7 , 𝑢 1 1 " 2 7 𝑡 1 1 " 1 7 ℒ 1 0 , k = 2 ℓ 1 0 " 4 7 , 𝑢 1 0 " 2 7 𝑡 1 0 " 0 ℒ 2 1 , k = 1 ℓ 2 1 " 2 7 , 𝑢 2 1 " 0 𝑡 2 1 " 0 ℒ 2 0 , k = 1 ℓ 2 0 " 4 7 , 𝑢 2 0 " 0 𝑡 2 0 " 0 Figure 5
.6: 3-XOR (optimal) merging tree with QRACM.

• If it is a Sample leaf, then 𝒜p𝒯 𝑘 q simply consists in running Grover's algorithm in time 𝒪 `2𝑢𝑛{2 ˘.

• Otherwise, if it is a Sample:

1. we use 𝒜p𝐿q to sample repeatedly from the child 𝐿: we build the list. Each call costs time 𝒪 `2Tqp𝐿q𝑛 ˘and we need to make 𝒪 ´2ℓ 2 𝑛 ¯of them before we obtain a list of the wanted size, with high probability (there is some negligible variation).

2. then we apply Lemma 5.4, since we have a sample for the child 𝑆: 𝒜p𝑆q

• If it is a List, the situation is the same, except that we repeat the operation exponentially many times.

When taking sums of complexities exponential in 𝑛, we write 𝒪p2 𝛼𝑛 q `𝒪`2 𝛽𝑛 ˘"

𝒪 `2maxp𝛼,𝛽q𝑛 ˘, which remains sound since we do that only a constant number of times.

Thus, merging trees offer a compact and sound way to represent quantum merging algorithms for the 𝑘-XOR problem. As an example, we represent Algorithm 5.6 as a merging tree in Figure 5.6.

Finding Optimal Trees

Now that we have defined the set of merging trees, we can explore this space to search for the trees 𝒯 𝑘 that minimize T q p𝒯 𝑘 q.

Given a tree 𝒯 𝑘 , its time and memory complexity exponents T q p𝒯 𝑘 q and M p𝒯 𝑘 q are defined as the maximums of linear combinations of the parameters ℓ 𝑗 𝑖 , 𝑢 𝑗 𝑖 . Thus, there exists a choice of these parameters that minimizes T q p𝒯 𝑘 q, under Constraints 5.1, 5.2, 5.3 and 5.4. Finding this minimum is a linear problem that we can solve with Mixed Integer Linear Programming (MILP). Given 𝑘, we try all possible tree structures (all binary trees with 𝑘 leaves) and find the optimal one. As an example, the optimization problem for Figure 5.6 would be:

Optimize: maxp𝑡 0 0 , ℓ 1 1 `𝑡1 1 , ℓ 2 1 `𝑡2 1 q
Under the constraints:

𝑡 1 1 " 𝑢 1 1 2 , 𝑡 2 1 " 𝑢 2 1 2 , 𝑡 2 0 " 𝑢 2 0 2 , 𝑡 1 0 " 𝑡 2 0 `1 2 max `𝑢1 0 ´𝑢2 0 ´ℓ2 1 , 0 ˘, 𝑡 0 0 " 𝑡 1 0 `1 2 max `1 ´𝑢1 0 ´ℓ1 1 , 0 ˘, 𝑢 2 0 " 𝑢 2 1 , 𝑢 1 0 " 𝑢 1 1
There always exist an optimal tree 𝒯 𝑘 that achieves the best time complexity exponent T q p𝒯 𝑘 q, but there may also be more than one. It is also easy to see that the exponent obtained will be a rational number.

Extensions

The classical literature on merging algorithms contains many extensions to Wagner's algorithm [Din19; Bai+19; Din+12; NS15; MS12]. We tried to extend merging trees with some of these designs, but they did not seem to give an actual quantum improvement, whether in time or memory. [START_REF] Daniel | FSBday[END_REF] corresponds to taking non-empty prefixes of zeroes for leaf nodes, allowing for a time-memory trade-off. This is already accessible in the space of merging trees. [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF] use Hellman tables to replace leaf lists of pairs p𝑥, ℎp𝑥qq by lists of chain-ends p𝑥, ℎ 2 𝑠 p𝑥qq. This allows to reduce the memory used in Wagner's algorithm. However, as we saw before for collision search, in the quantum setting, finding elements with arbitrary prefixes is quadratically faster than iterating the function (which is not the case classically). Thus, chain-ends are not better than the clamping technique.

Clamping. The clamping technique

Chain-ends. Nikolic and Sasaki

Solving the k-SUM problem. Bitwise XORs can be replaced by modular additions without affecting the success probabilities and runtime of the algorithms. Indeed, classical merging algorithms are easily adapted to the 𝑘-SUM problem [START_REF] Wagner | A Generalized Birthday Problem[END_REF]. Suppose that all the elements lie in an interval r´𝑁 ; 𝑁 s where 𝑁 » 2 𝑛 is some modulus, and we are looking for a 𝑘-SUM to zero. Instead of using lists of partially colliding elements, we look for sums falling in successive reduced intervals

" ´𝑁 2 𝑢𝑛 ; 𝑁 2 𝑢𝑛 ‰ .
If 𝑁 is a power of 2, it is easy to adapt the algorithms. Otherwise, we may take the smallest power of 2 that is bigger than 𝑁 , and do as if the values ℎp𝑥q fell uniformly at random in r´2 𝑛 ; 2 𝑛 s. The statistical difference will be negligible.

Optimal Merging Trees for k-XOR

In this section, we give new quantum algorithms for the 𝑘-XOR problem with many solutions. We describe them using merging trees and prove their optimality among all merging trees. We distinguish two memory models: the QRACM model and the quantum circuit model (CSAM or classical RAM). To date, none of the best algorithms known for Problem 5.2 requires the QRAQM model.

Relation with previous results. With 𝑘 " 2, by optimizing a merging tree with three nodes, we obtain the BHT collision algorithm for random functions if QRACM is used, and Algorithm 5.1 without. They also give the best achievable memory complexity with quantum merging.

The results of [GNS18] are subsumed by the merging tree framework. Their algorithms without QRACM can be seen as special cases of merging trees, and their algorithms with QRAQM can be replaced by merging trees of the same time complexity. The results presented in this section improve on [GNS18] for almost all 𝑘.

Description of the Optimal Trees

Although more than one merging tree can achieve the optimal time exponent for a given 𝑘, we find that it is reached by a family of balanced trees 𝑇 𝑘 . Definition 5.5 (Trees 𝑇 𝑘 ). If 𝑘 " 1, then 𝑇 𝑘 is simply a leaf node. If 𝑘 " 2𝑘 1 , then the "Sample" child of 𝑇 𝑘 is 𝑇 𝑘 1 and the "List" child is 𝑇 𝑘 1 . If 𝑘 " 2𝑘 1 `1, then the "Sample" child of 𝑇 𝑘 is 𝑇 𝑘 1 `1 and the "List" child is 𝑇 𝑘 1 .

In particular, when 𝑘 " 2 𝜅 is a power of 2, 𝑇 𝑘 is Wagner's balanced binary tree. Proposition 5.3. Optimizing 𝑇 𝑘 under classical constraints gives the time complexity exponent of Wagner's algorithm:

T c p𝑇 𝑘 q " 1 𝜅`1 .
Quantumly, when 𝑘 is not a power of 2, 𝑇 𝑘 has the opportunity of a better quantum time exponent than 𝑇 𝑘´1 , for the same reason as in the example of 3-XOR: building a leaf list of elements with a non-empty zero-prefix costs relatively less than in the classical optimization.

Results

For our experiments, we used the MILP solver of the SCIP suite [Gle+18a; Gle+18b]. After trying with 𝑘 ď 20, we could can gain an intuition of the optimal tree shape 𝑇 𝑘 and conjecture closed formulas for the time complexity exponents, that we will prove in Sections 5.4.3 and 5.4.4.

QRACM Model

For powers of 2, we obtain 𝛼 𝑘 " 1 𝜅`2 , to compare with Wagner's algorithm: 1 𝜅`1 . But the exponent also decreases strictly when 𝑘 increases.

Theorem 5.5 (Quantum merging complexity for 𝑘-XOR, with QRACM). Let 𝑘 ě 2 be an integer and 𝜅 " tlog 2 p𝑘qu. The best quantum merging tree finds a 𝑘-XOR on 𝑛 bits in quantum time (and memory) r 𝒪p2 𝛼 𝑘 𝑛 q where 𝛼 𝑘 "

2 𝜅 p1`𝜅q2 𝜅 `𝑘 . To find 2 𝑐𝑛 𝑘-XORs for 𝑐 ą 0, the complexity exponent goes to max p𝛼 𝑘 p1 `2𝑐q, 𝑐q. Furthermore, for every 𝑘, the optimum is realized by 𝑇 𝑘 : 𝛼 𝑘 " T q p𝑇 𝑘 q. When 𝑘 is a power of 2, the tree is a complete binary tree and the optimization follows the 4-XOR example of Figure 5.3. Except the lists on the left branch of the tree, all lists are classically built and merged. They are of size 2 𝑛 𝜅`2 . Then, the final quantum search requires b 2 2𝑛 𝜅`2 " 2 𝑛 𝜅`2 iterations. When 𝑘 is not a power of 2, the optimization is more complex. We can see in Figure 5.7 that new leaves are introduced in the tree with non-empty zero-prefixes, in order to merge them with other lists that have already zeroes. The parameters can be derived recursively from the optimality proof of Section 5.4.3.

ℒ 0 0 , k = 6 ℓ 0 0 " 0, 𝑢 0 0 " 1 𝑡 0 0 " 2{9 ℒ 1 1 , k = 3 ℓ 1 1 " 2{9, 𝑢 1 1 " 1{3 𝑡 1 1 " 0 ℒ 2 3 , k = 1 ℓ 2 3 " 1{9, 𝑢 2 3 " 2{9 𝑡 2 3 " 1{9 ℒ 2 2 , k = 2 ℓ 2 2 " 2{9, 𝑢 2 2 " 2{9 𝑡 2 2 " 0 ℒ 3 5 , k = 1 ℓ 3 5 " 2{9, 𝑢 3 5 " 0 𝑡 3 5 " 0 ℒ 3 4 , k = 1 ℓ 3 4 " 2{9, 𝑢 3 4 " 0 𝑡 3 4 " 0 ℒ 1 0 , k = 3 ℓ 1 0 " 4{9, 𝑢 1 0 " 1{3 𝑡 1 0 " 0 ℒ 2 1 , k = 1 ℓ 2 1 " 1{9, 𝑢 2 1 " 2{9 𝑡 2 1 " 1{9 ℒ 2 0 , k = 2 ℓ 2 0 " 4{9, 𝑢 2 0 " 2{9 𝑡 2 0 " 0 ℒ 3 1 , k = 1 ℓ 3 1 " 2{9, 𝑢 3 1 " 0 𝑡 3 1 " 0 ℒ 3 0 , k = 1 ℓ 3 0 " 4{9, 𝑢 3 0 " 0 𝑡 3 0 " 0

Circuit Model

The situation is different in the circuit model, but the balanced 𝑇 𝑘 defined above remains an optimal tree shape.

Theorem 5.6. Let 𝑘 ą 2, 𝑘 ‰ 3, 5, 7 be an integer and 𝜅 " tlog 2 p𝑘qu. The best quantum merging tree finds a 𝑘-XOR on 𝑛 bits in quantum time and classical memory 𝒪 `2𝛽 𝑘 𝑛 where:

𝛽 𝑘 " # 1 𝜅`1 if 𝑘 ă 2 𝜅 `2𝜅´1 2 2𝜅`3 if 𝑘 ě 2 𝜅 `2𝜅´1
.

To find 2 𝑐𝑛 𝑘-XORs, the complexity exponent goes to max p𝛽 𝑘 p1 `𝑐q, 𝑐q. Furthermore, for every 𝑘 ‰ 3, 5, 7, the optimum is realized by 𝑇 𝑘 .

In this case, for 𝑘 ‰ 2, 3, 5, 7, the best strategy is always to use classical samplings (i.e., merging), except at some leaves of the tree, where some elements with zero-prefixes are produced using Grover search. If we use quantum search, we need to access the memory via a QRACM emulation circuit, and this becomes suboptimal.

This gives one intermediate level of complexity between two successive powers of 2. For collision search, we obtain Algorithm 5.1 with 𝛽 2 " 2 5 . Optimal merging strategies for 𝑘 " 3 and 𝑘 " 5 are given in Figure 5.8. The strategy for 𝑘 " 3 was already obtained manually in [GNS18] and reaches 𝛽 3 " 5 14 . The strategy for 𝑘 " 5 reaches a surprisingly non trivial1 𝛽 5 " 40 129 . The strategy for 𝑘 " 7 also reaches 𝛽 7 " 15 53 .

Comparisons

We plot the exponents depending on 𝑘 in Figure 5.9. We give numerical values of these exponents in Table 5.1. Our algorithms require as much memory as time, except the cases 𝑘 ď 5 in the circuit model. Comparison of time complexity exponents between the classical case and the best exponents given by Theorem 5.5 and Theorem 5.6. The complexities are 𝒪p2 𝛼 𝑘 𝑛 q or 𝒪p2 𝛽 𝑘 𝑛 q.

ℒ 0 0 , k = 2 ℓ 0 0 " 0, 𝑢 0 0 " 1 𝑡 0 0 " 2 5 ℒ 1 1 , k = 1 ℓ 1 1 " 1 5 , 𝑢 1 1 " 2 5 𝑡 1 1 " 1 5 ℒ 1 0 , k = 1 ℓ 1 0 " 2 5 , 𝑢 1 0 " 2 5 𝑡 1 0 " 1 5 ℒ 0 0 , k = 3 ℓ 0 0 " 0, 𝑢 0 0 " 1 𝑡 0 0 " 5 14 ℒ 1 1 , k = 1 ℓ 1 1 " 1 7 , 𝑢 1 1 " 3 7 𝑡 1 1 " 3 14 ℒ 1 0 , k = 2 ℓ 1 0 " 3 7 , 𝑢 1 0 " 3 7 𝑡 1 0 " 1 7 ℒ 2 1 , k = 1 ℓ 2 1 " 1 7 , 𝑢 2 1 " 2 7 𝑡 2 1 " 1 7 ℒ 2 0 , k = 1 ℓ 2 0 " 3 7 , 𝑢 2 0 " 2 7 𝑡 2 0 " 1 7 ℒ 0 0 , k = 5 ℓ 0 0 " 0, 𝑢 0 0 " 1 𝑡 0 0 " 40 129 ℒ 1 1 , k = 2 ℓ 1 1 " 17 129 , 𝑢 1 1 " 22 43 𝑡 1 1 " 23 129 ℒ 2 3 , k = 1 ℓ 2 3 " 20 129 , 𝑢 2 3 " 40 129 𝑡 2 3 " 20 129 ℒ 2 2 , k = 1 ℓ 2 2 " 23 129 , 𝑢 2 2 " 40 129 𝑡 2 2 " 20 129 ℒ 1 0 , k = 3 ℓ 1 0 " 46 129 , 𝑢 1 0 " 22 43 𝑡 1 0 " 17 129 ℒ 2 1 , k = 1 ℓ 2 1 " 16 129 , 𝑢 2 1 " 16 43 𝑡 2 1 " 8 43 ℒ 2 0 , k = 2 ℓ 2 0 " 16 43 , 𝑢 2 0 " 16 43 𝑡 2 0 " 16 129 ℒ 3 1 , k = 1 ℓ 3 1 " 16 129 , 𝑢 3 1 " 32 129 𝑡 3 1 " 16 129 ℒ , k = 1 ℓ 3 0 " 16 43 , 𝑢 3 0 " 32 129 𝑡 " 16 129 ℒ 0 0 , k = 7 ℓ 0 0 " 0, 𝑢 0 0 " 1 𝑡 0 0 " 15 53 ℒ 1 1 , k = 4 ℓ 1 1 " 11 53 , 𝑢 1 1 " 34 53 𝑡 1 1 " 4 53 ℒ 2 3 , k = 2 ℓ 2 3 " 15 53 , 𝑢 2 3 " 15 53 𝑡 2 3 " 0 ℒ 3 7 , k = 1 ℓ 3 7 " 15 53 , 𝑢 3 7 " 0 𝑡 3 7 " 0 ℒ 3 6 , k = 1 ℓ 3 6 " 15 53 , 𝑢 3 6 " 0 𝑡 3 6 " 0 ℒ 2 2 , k = 2 ℓ 2 2 " 15 53 , 𝑢 2 2 " 15 53 𝑡 2 2 " 0 ℒ 3 5 , k = 1 ℓ 3 5 " 15 53 , 𝑢 3 5 " 0 𝑡 3 5 " 0 ℒ 3 4 , k = 1 ℓ 3 4 " 15 53 , 𝑢 3 4 " 0 𝑡 3 4 " 0 ℒ 1 0 , k = 3 ℓ 1 0 " 8 53 , 𝑢 1 0 " 34 53 𝑡 1 0 " 11 53 ℒ 2 1 , k = 1 ℓ 2 1 " 6 53 , 𝑢 2 1 " 18 53 𝑡 2 1 " 9 53 ℒ 2 0 , k = 2 ℓ " 18 53 , 𝑢 2 0 " 18 53 𝑡 2 0 " 6 53 ℒ 3 1 , k = 1 ℓ 3 1 " 6 53 , 𝑢 3 1 " 12 53 𝑡 3 1 " 6 53 ℒ 3 0 , k = 1 ℓ 3 0 " 18 53 , 𝑢 3 0 " 12 53 𝑡 3 0 " 6

Proof of Optimality in the QRACM Setting

We prove Theorem 5.5:

For any integer 𝑘 and 𝑐 ą 0, the best quantum merging procedure that samples 2 𝑐𝑛 times a 𝑘-XOR on 𝑛 bits has a time complexity exponent max p𝛼 𝑘 p1 `2𝑐q, 𝑐q, where 𝛼 𝑘 "

2 𝜅 p1`𝜅q2 𝜅 `𝑘 .
Proof. We use a recurrence on 𝑘. For 𝑘 " 2, we have 𝜅 " 1 and 𝛼 2 " 1 3 . Finding 2 𝑐𝑛 collisions p𝑥 1 , 𝑥 2 , ℎp𝑥 1 q ' ℎp𝑥 2 q " 0q, or sampling a collision 2 𝑐𝑛 times can be done in time 2 p 2𝑐 3 `1 3 q𝑛 , using a re-optimization of the steps in BHT collision search. This works as long as 𝑐 ď 1, i.e., 2𝑐 `1 ď 3. Thus, the theorem is true for 𝑘 " 2.

Let us consider a merging tree 𝒯 𝑘 for some 𝑘 ą 2, with a list size 𝑐 ą 0 at the root. The root node has two subtrees: the "list" one 𝒯 𝑟 , on the right, and the "sampled" one 𝒯 𝑙 , on the left. Let 𝑢 be the length of the zero-prefix in both nodes. Let ℓ 𝑟 and ℓ 𝑙 be their respective sizes, let 𝑘 𝑟 `𝑘𝑙 " 𝑘 be their width.

First, notice that we have 1 ´𝑢 ´ℓ𝑟 ě 0, otherwise we could reduce the value of the parameter ℓ 𝑟 without increasing the time complexity.

We use the recurrence hypothesis on 𝒯 𝑙 and 𝒯 𝑟 , relatively to the number of zeros 𝑢 that they have (since they contain XORs on 𝑢𝑛 bits instead of 𝑛). The right list, of size 𝑢 ℓ𝑟 𝑢 , is produced in time max `𝛼𝑘𝑟 p1 `2 ℓ𝑟 𝑢 q, ℓ𝑟 𝑢 ˘𝑢 " max p𝛼 𝑘𝑟 p𝑢 `2ℓ 𝑟 q, ℓ 𝑟 q. Since we want to sample 𝑐 times from the root node, we need to sample 𝑐`1 2 p1´𝑢´ℓ 𝑟 q times from the left list, which costs:

max ˆ𝛼𝑘 𝑙 ˆ𝑢 `2 ˆ𝑐 `1 2 p1 ´𝑢 ´ℓ𝑟 q ˙˙, ˆ𝑐 `1 2 p1 ´𝑢 ´ℓ𝑟 q ˙˙.
We obtain that the time complexity exponent 𝑡 must be minimized under the constraints:

(C1) 𝑡 ě 𝛼 𝑘𝑟 p𝑢 `2ℓ 𝑟 q (C2) 𝑡 ě ℓ 𝑟 (C3) 𝑡 ě 𝛼 𝑘 𝑙 p2𝑐 `1 ´ℓ𝑟 q (C4) 𝑡 ě 𝑐 `1 2 ´𝑢 2 ´ℓ𝑟 2
By combining these inequalities, we will obtain information about the shape of the optimal trees. We combine (C1), (C4) and (C3) to eliminate 𝑢 and ℓ 𝑟 :

pC1q `2𝛼 𝑘𝑟 pC4q `𝛼𝑘𝑟 𝛼 𝑘 𝑙 pC3q ðñ 𝑡 ˆ1 `2𝛼 𝑘𝑟 `𝛼𝑘𝑟 𝛼 𝑘 𝑙 ˙ě 2𝛼 𝑘𝑟 p2𝑐 `1q .
Then this inequality becomes:

𝑡 ě 2𝛼 𝑘𝑟 1 `2𝛼 𝑘𝑟 `𝛼𝑘𝑟 𝛼 𝑘 𝑙 p2𝑐 `1q " 2𝛼 𝑘𝑟 𝛼 𝑘 𝑙 𝛼 𝑘 𝑙 `𝛼𝑘𝑟 `2𝛼 𝑘𝑟 𝛼 𝑘 𝑙 p2𝑐 `1q .
We are interested in the quantity

2𝛼 𝑘𝑟 𝛼 𝑘 𝑙 𝛼 𝑘 𝑙 `𝛼𝑘𝑟 `2𝛼 𝑘𝑟 𝛼 𝑘 𝑙
when 𝑘 𝑙 and 𝑘 𝑟 vary. We would like to make it minimal, since this loosens the constraint on 𝑡. Thus, we want to maximize its inverse:

1

`1 2𝛼 𝑘 𝑙 `1 2𝛼 𝑘𝑟 .
Since \ or the converse. In both cases, if we write 𝜅 " tlog 2 𝑘u, then tlog 2 t𝑘{2uu " tlog 2 p𝑘 ´t𝑘{2uqu " 𝜅 ´1. Using the recurrence hypothesis, we obtain that:

1 `1 2𝛼 𝑘 𝑙 `1 2𝛼 𝑘𝑟 " 1 `p1 `𝜅 ´1q2 𝜅´1 `𝑘 ´X 𝑘 2 \ 2 𝜅 `p1 `𝜅 ´1q2 𝜅´1 `X 𝑘 2 \ 2 𝜅 " 2 𝜅 p1 `𝜅q `𝑘 2 𝜅 .
Thus, we can write: 𝑡 ě p2𝑐 `1q

2 𝜅
2 𝜅 p1`𝜅q`𝑘 , which gives the expected formula for 𝛼 𝑘 . The second inequality 𝑡 ě 𝑐 stems trivially from (C4). We finish the proof of optimality by showing, also by induction on 𝑘, that the optimization of the balanced trees 𝑇 𝑘 indeed reaches this exponent.

Lemma 5.5. Optimizing the balanced trees 𝑇 𝑘 yields the optimal exponents of Theorem 5.5.

First, we focus on the case 𝑐 ď 𝛼 𝑘 1´2𝛼 𝑘 , where the complexity exponent is expected to be p2𝑐 `1q𝛼 𝑘 , and we consider an even 𝑘. We choose 𝑢 " p1 ´3𝛼 𝑘 qp2𝑐 `1q and ℓ 𝑟 " 𝛼 𝑘 p2𝑐 `1q. This gives that 𝑐 `1 2 ´𝑢 2 ´ℓ𝑟 2 " p2𝑐 `1q𝛼 𝑘 , so (C4) is satisfied. Second, we have: 𝛼 𝑘{2 p𝑢 `2ℓ 𝑟 q " p2𝑐 `1q𝛼 𝑘{2 p1 ´𝛼𝑘 q " p2𝑐 `1q𝛼 𝑘 by definition of the 𝛼 𝑘 (their formula implies

𝛼 𝑘{2
1`𝛼 𝑘{2 " 𝛼 𝑘 ). Thus (C1) is satisfied. By a similar computation, (C3) is satisfied since 𝛼 𝑘{2 p2𝑐 `1 ´ℓ𝑟 q " 𝛼 𝑘 p2𝑐 `1q. Finally, (C2) is trivially satisfied by our choice of ℓ 𝑟 .

If 𝑘 is odd, we choose 𝑢 " ˆ1´3𝛼 𝑘 `1 p1 `𝜅q2 𝜅 `𝑘 ˙p2𝑐 `1q and ℓ 𝑟 " ˆ𝛼𝑘 ´1 p1 `𝜅q2 𝜅 `𝑘 ˙p2𝑐 `1q .

Again, (C4) becomes an equality. (C1) is an equality as well, using the fact that 𝛼 𝑘𝑟 " 𝛼 t𝑘{2u " 𝛼 p𝑘´1q{2 . Indeed, we have:

𝛼 𝑘𝑟 p𝑢 `2ℓ 𝑟 q " 𝛼 p𝑘´1q{2 ˆ1 ´𝛼𝑘 ´1 p1 `𝜅q2 𝜅 `𝑘 " p2𝑐 `1q 2 𝜅´1 𝜅2 𝜅´1 `p𝑘 ´1q{2 ˆ2𝜅 p1 `𝜅q `𝑘 ´2𝜅 ´1 p1 `𝜅q2 𝜅 `𝑘 ˙" p2𝑐 `1q𝛼 𝑘 .
The constraints (C2) and (C3) become strict inequalities, but they are also satisfied.

When 𝑐 ě 𝛼 𝑘 1´2𝛼 𝑘 , all the merges become classical. The only quantum operations remaining are the Grover searches in some newly inserted leaves.

Proof of Optimality in the Circuit Model

We prove Theorem 5.6: For any integer 𝑘 ě 8 and 𝑐 ą 0, the best quantum merging procedure without QRACM that samples 2 𝑐𝑛 times a 𝑘-XOR on 𝑛 bits has a time complexity exponent max p𝛽 𝑘 p1 `𝑐q, 𝑐q, where:

𝛽 𝑘 " # 1 𝜅`1 if 𝑘 ă 2 𝜅 `2𝜅´1 2 2𝜅`3 if 𝑘 ě 2 𝜅 `2𝜅´1 .
And when 𝑘 ě 8, this procedure samples classically.

Proof. We prove this by induction on 𝑘. For small values of 𝑘, the experimental results give us the optimal trees. We consider a merging tree 𝒯 𝑘 for 𝑘 ě 8, with a list size 𝑐 ą 0 at the root. We use the same notations as in Section 5.4.3, and introduce 𝑘 𝑙 , 𝑘 𝑟 , 𝛽 𝑘 𝑙 , 𝛽 𝑘𝑟 and the variables 𝑢, ℓ 𝑟 .

For 𝑘 ď 7, we notice that the exponent is always at least maxp𝛽 𝑘 p1 `𝑐q, 𝑐q (it will lie somewhere between 𝛽 𝑘 p1 `𝑐q and 𝛽 𝑘 p1 `2𝑐q). Having `𝑐 instead of `2𝑐 comes from the use of a classical merging at the root. Once we know that the merge is classical, we can deduce easily that both subtrees must be of similar shapes, hence 𝑘 ℓ " X 𝑘 2 \ and 𝑘 𝑟 " P 𝑘 2 T or the converse. Then we can use the recurrence hypothesis easily: the two subtrees have the same complexity, which depends on the case for 𝑘.

If 𝑘 ă 2 𝜅 `2𝜅´1 , then X 𝑘 2 \ ă 2 𝜅´1 `2𝜅´2 ; and conversely, if 𝑘 ě 2 𝜅 `2𝜅´1 , then X 𝑘 2 \ ě 2 𝜅´1 `2𝜅´2 .
In order to prove that the root merge is classical, let us assume that it is quantum instead. We use the recurrence hypothesis for both subtrees. Although the actual optimal merging trees do not allow to sample quantumly, we suppose that they do. Thus, sampling 𝑐 `1 2 p1 ´𝑢 ´ℓ𝑟 q times from the left child is done in time maxp𝑐 `1 2 p1 ´𝑢 ´ ℓ 𝑟 q, 𝛽 𝑘 𝑙 `𝑢 `𝑐 `1 2 p1 ´𝑢 ´ℓ𝑟 q ˘q. We also do the same number of QRACM emulations, in time ℓ 𝑟 each. With the right child, we have at least maxp𝛽 𝑘𝑟 p𝑢 `ℓ𝑟 q, ℓ 𝑟 q (notice that this is not tight for small 𝑘 𝑟 ). Let 𝑡 be the time exponent, then we have the constraints:

(C1) 𝑡 ě 𝛽 𝑘𝑟 p𝑢 `ℓ𝑟 q (C2) 𝑡 ě 𝛽 𝑘 𝑙
2 p2𝑐 `1 `𝑢 ´ℓ𝑟 q (C3) 𝑡 ě 1 2 p2𝑐 `1 ´𝑢 `ℓ𝑟 q By combining (C2) and (C3), we obtain:

ˆ2 𝛽 𝑘 𝑙 `2˙𝑡 ě 2p2𝑐 `1q ùñ 𝑡 ě 𝛽 𝑘 𝑙 1 `𝛽𝑘 𝑙 p2𝑐 `1q " 𝛽 2𝑘 𝑙 p2𝑐 `1q ,
where the last equality follows by definition of the 𝛽 𝑖 . But since 𝑡 ď 𝛽 𝑘´1 p𝑐 `1q, we obtain that 𝛽 𝑘´1 ě 𝛽 2𝑘 𝑙 ùñ 2𝑘 𝑙 ě 𝑘 ´1 ùñ 𝑘 𝑙 ě t𝑘{2u. Furthermore, at the optimal point we expect:

𝛽 𝑘 𝑙 2 p2𝑐 `1 `𝑢 ´ℓ𝑟 q " 1 2 p2𝑐 `1 ´𝑢 `ℓ𝑟 q ùñ 𝑢 " ℓ 𝑟 `𝛽𝑘 𝑙 ´1 𝛽 𝑘 𝑙 `1 p2𝑐 `1q .
Next, we remark that an algorithm in the circuit model should cost at least as much as in the QRACM model, so we introduce:

pC4q 𝑡 ě 𝛼 𝑘𝑟 p𝑢 `2ℓ 𝑟 q ùñ 𝑡 ě 𝛼 𝑘𝑟 ˆ3ℓ 𝑟 `𝛽𝑘 𝑙 ´1 𝛽 𝑘 𝑙 `1 p2𝑐 `1q ˙.
Since 𝑢 ě 0, we should have ℓ 𝑟 ě `1 ě 𝛽 𝑘 𝑙 `1. In other words, while small values of 𝑘 may benefit from using a quantum search at the root of the tree (and this is indeed the case), for a general 𝑘, the root node is a classical merge between two classically stored lists.

Again, we can verify that the balanced trees 𝑇 𝑘 give the optimal results for 𝑘 ě 8. An example is given in Figure 5.10.

Applications

The algorithms that we presented in this chapter can efficiently replace Wagner's algorithm when 𝑘 is a constant and when quantum query access is allowed. The second condition actually occurs very often, e.g., when attacking hash functions. However, the first is not always satisfied. Some applications of Wagner's algorithm merge 𝒪 ´2? 𝑛 lists of size 𝒪

´2?

𝑛 ¯in subexponential time, a situation in which quantum merging does not seem to bring any advantage.

ℒ 0 0 , k = 6 ℓ 0 0 " 0, 𝑢 0 0 " 1 𝑡 0 0 " 2 7 ℒ 1 1 , k = 3 ℓ 1 1 " 2 7 , 𝑢 1 1 " 3 7 𝑡 1 1 " 0 ℒ 2 3 , k = 1 ℓ 2 3 " 1 7 , 𝑢 2 3 " 2 7 𝑡 2 3 " 1 7 ℒ 2 2 , k = 2 ℓ 2 2 " 2 7 , 𝑢 2 2 " 2 7 𝑡 2 2 " 0 ℒ 3 5 , k = 1 ℓ 3 5 " 2 7 , 𝑢 3 5 " 0 𝑡 3 5 " 0 ℒ 3 4 , k = 1 ℓ 3 4 " 2 7 , 𝑢 3 4 " 0 𝑡 3 4 " 0 ℒ 1 0 , k = 3 ℓ 1 0 " 2 7 , 𝑢 1 0 " 3 7 𝑡 1 0 " 0 ℒ 2 1 , k = 1 ℓ 2 1 " 1 7 , 𝑢 2 1 " 2 7 𝑡 2 1 " 1 7 ℒ 2 0 , k = 2 ℓ 2 0 " 2 7 , 𝑢 2 0 " 2 7 𝑡 2 0 " 0 ℒ 3 1 , k = 1 ℓ 3 1 " 2 7 , 𝑢 3 1 " 0 𝑡 3 1 " 0 ℒ 3 0 , k = 1 ℓ 3 0 " 2 7 , 𝑢 3 0 " 0 𝑡 3 0 " 0

Generalized Birthday Instances

We can list a few constructions that can be attacked with a 𝑘-XOR or 𝑘-SUM algorithm. Others are listed in [START_REF] Wagner | A Generalized Birthday Problem[END_REF].

Incremental hash functions. XHASH [BM97] is an incremental hash function defined as 𝐻p𝑥q "

À 𝑘 𝑖"1 ℎp𝑖|𝑥 𝑖 q, where each 𝑥 𝑖 is a 𝑏-bit block and ℎp¨q : t0, 1u ℓ Ñ t0, 1u 𝑛 for some parameters 𝑏 and ℓ. One can find collisions in XHASH, when restricted to 𝑘 blocks, with a 𝑘-XOR algorithm [BM97; CJ04].

Among other designs, this construction appears in the "fast syndrome-based" hash function (R)FSB [Aug+], a candidate of the SHA-3 competition, which has been analyzed in [START_REF] Coron | Cryptanalysis of a Provably Secure Cryptographic Hash Function[END_REF][START_REF] Daniel | FSBday[END_REF][START_REF] Kirchner | Improved Generalized Birthday Attack[END_REF][START_REF] Niebuhr | Improving the efficiency of Generalized Birthday Attacks against certain structured cryptosystems[END_REF].

SWIFFT [Mic+] is a candidate of the SHA-3 competition that admits a simple algebraic expression over some polynomial ring 𝑅 " Z 𝑝 r𝛼s{p𝛼 𝑛 `1q:

SWIFFTp𝑎, 𝑥q " 𝑚 ÿ 𝑖"1 𝑓 p𝑥 𝑖 q mod p𝛼 𝑛 `1q " 𝑚 ÿ 𝑖"1 p𝑎 𝑖 ¨𝑥𝑖 q mod p𝛼 𝑛 `1q ,
where the 𝑚 fixed elements 𝑎 1 , ..., 𝑎 𝑚 P 𝑅 -called multipliers -specify the hash function, and each 𝑥 𝑖 is an element of 𝑅. Examples of attacks on the SWIFFT hash function based on the 𝑘-SUM problem over the additive group pZ{2 256 Z, `q are given in [Kir11; NCB11; Bai+19]. XLS and CAESAR candidates. Some authenticated encryption schemes proposed at the CAESAR competition [CAESAR] can be attacked with 𝑘-XOR algorithms, namely those that use the XLS construction of Ristenpart and Rogaway [START_REF] Ristenpart | How to Enrich the Message Space of a Cipher[END_REF]. Although XLS was initially proven secure, Nandi [START_REF] Nandi | XLS is Not a Strong Pseudorandom Permutation[END_REF] pointed out flaws in the security proof and showed a very simple attack that required three queries to break the construction. Actually, the CAESAR candidates that rely on XLS do not allow this trivial attack as the required decryption queries are not permitted by the schemes. A possible way to overcome this limitation has been proposed by Nandi in [START_REF] Nandi | XLS is Not a Strong Pseudorandom Permutation[END_REF], whose forgery attack requires only encryption queries. It reduces to the 3-XOR problem. We refer to [START_REF] Nandi | Revisiting Security Claims of XLS and COPA[END_REF][START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF] for concrete examples of attacks.

With the algorithms presented in this chapter, Q2 access will be necessary to obtain a speedup. However, it is also possible to find a 3-XOR on 𝑛 bits in quantum time 𝒪 `2𝑛{3 ˘with only 𝒪 `2𝑛{3 ˘classical queries, and this is effective against XLS.

Approximate k-list Problem

In [START_REF] Both | The Approximate k-List Problem[END_REF], Both and May introduce and study the approximate k-list problem. It is a generalization of 𝑘-XOR in which the final 𝑛-bit value only needs to have a Hamming weight lower than 𝛼𝑛 for some fraction 0 ď 𝛼 ď 𝑛 2 (so the 𝑘-XOR is the special case 𝛼 " 0). Its main application is solving the parity check problem.

Problem 5.3 (Parity-check). Given an irreducible polynomial 𝑃 p𝑋q P F 2 r𝑋s of degree 𝑛, find a multiple 𝑄p𝑋q of 𝑃 p𝑋q of a certain weight and degree. This is used in fast correlation attacks on stream ciphers. For this application, we can consider quantum oracle access (the lists actually contain polynomials of the form 𝑋 𝑎 mod 𝑃 p𝑋q for many choices of 𝑎).

The match-and-filter algorithm of [BM17, Section 3] consists in running a 𝑘-XOR algorithm with a restricted number of bits to put to zero, and to tailor the length of the final list so that it will contain one element of low Hamming weight with certainty. With a quantum 𝑘-merging tree, we can always improve on this classical method in the QRACM model. Let 𝛼 𝑘 be the 𝑘-XOR optimal QRACM time exponent as defined in Theorem 5.5. We cut the left branch of the tree: in time 𝒪p2 𝛼 𝑘 𝑢𝑛 q, we can obtain a tuple of lists ℒ 1 , . . . , ℒ 𝑡 such that, given an 𝑛-bit element 𝑥, we can find 𝑥 1 P ℒ 1 , . . . , 𝑥 𝑡 P ℒ 𝑡 such that 𝑥 ' 𝑥 1 ' . . . ' 𝑥 𝑡 has p1 ´2𝛼 𝑘 q𝑢𝑛 bits to zero. Indeed, the Grover search at the root of the tree has also cost 𝒪p2 𝛼 𝑘 𝑢𝑛 q since everything is balanced, so it eliminates 2𝛼 𝑘 𝑢𝑛 bits.

Hence, if we want to be able to eliminate 𝑢𝑛 bits for some fraction 0 ď 𝑢 ď 1, we build all these lists in time 𝒪 ´2 𝛼 𝑘 p1´2𝛼 𝑘 q 𝑢𝑛 ¯.

Proposition 5.4. We can build in time 𝒪

´2 𝛼 𝑘 p1´2𝛼 𝑘 q 𝑢𝑛
¯a structure that allows, in constant time, to sample a 𝑘-tuple with 𝑢𝑛 bits to zero.

There remains p1 ´𝑢q𝑛 (random) bits. We want the Hamming weight of the result to be less than a target 𝑐 𝑤 𝑛. The proportion of p1 ´𝑢q𝑛-bit strings of Hamming weight less than 𝑐 𝑤 𝑛 is approximately: iterations, where H 𝑒 is an "extended" entropy function that gives H 𝑒 p𝑥q " 0 if 𝑥 ě 1. It suffices to look for 0 ď 𝑢 ď 1 which optimizes the sum of the time complexities of the two steps:

ˆp1 ´𝑢q𝑛 𝑐 𝑤 𝑛 ˙{2 p1´𝑢q𝑛 » 2 p1´𝑢q𝑛pHp𝑐𝑤{p1´𝑢qq´1qq
2 𝛼 𝑘 p1´2𝛼 𝑘 q 𝑢𝑛 `2 1 2 p1´𝑢q𝑛p1´H𝑒p𝑐𝑤{p1´𝑢qqqq .
We obtain the results of Table 5.2 by numerical optimization.

Open Questions

The presentation of merging trees that we gave in this chapter is slightly extended with respect to [NS20], but for a general 𝑘, we found the same results. Our proof of optimality holds only in this framework. With an extended framework, perhaps combining quantum walks instead of quantum searches, it might be possible to improve the complexities.

Open Problem 5.4. Does there exist better algorithms for 𝑘-XOR than our merging trees, that would reach exponentially better time complexities?

Finally, we have focused on the problem for constant 𝑘. But when 𝑘 is unbounded, Wagner's algorithm achieves a subexponential time 𝒪p2 2 ? 𝑛 q using 𝑘 " 𝒪p2 ? 𝑛 q and ? 𝑛 merging levels. In that case, the quantum advantage of merging algorithms vanishes, and no significant improvement is known. In this chapter, we amend the merging trees defined in Chapter 5 in order to solve 𝑘-XOR problems with any number of solutions. We show that both classical and quantum methods for such problems can be described in terms of extended merging trees. Focusing on the 𝑘-XOR problem with a single solution, we give strategies for every 𝑘 and prove their optimality among all merging trees. We study various cryptanalytic applications, including subset-sums, the generalization for 𝑟-composite problems and 𝑟-encryption. Some of the results that we present here are original and unpublished, as we introduce a more general definition of merging trees than in [NS20], which allows us to improve these previous results.

Open

Contents

Extending the Problem

In Chapter 5, we studied the 𝑘-XOR problem with many solutions: 109 Problem 5.2 (𝑘-XOR with an oracle). Given oracle access to a random 𝑛-bit to 𝑛-bit function ℎ, find distinct inputs 𝑥 1 , . . . , 𝑥 𝑘 such that ℎp𝑥 1 q ' . . . ' ℎp𝑥 𝑘 q " 0.

Indeed, when 𝑘 is a constant and ℎ a random function, there are expectedly 2 p𝑘´1q𝑛 distinct solution tuples 𝑥 1 , . . . , 𝑥 𝑘 . But the applications of Problem 5.2 for a constant 𝑘 are relatively rare.

However, many problems of cryptographic interest can be modeled as a variant of Problem 5.2 with limited domain, where ℎ is a random function from t0, 1u 𝑑𝑛 to t0, 1u 𝑛 for some parameter 𝑑 ď 1. Of special interest is the limit case where there is expectedly a single solution: we name it the Unique 𝑘-XOR problem. Problem 6.1 (Unique 𝑘-XOR with an oracle). Given query access to a random r𝑛{𝑘sbit to 𝑛-bit function ℎ, expecting that there exists a single 𝑘-tuple 𝑥 1 , . . . , 𝑥 𝑘 such that ℎp𝑥 1 q ' ℎp𝑥 2 q ' . . . ' ℎp𝑥 𝑘 q " 0, find it.

If 𝑘 is even, we must enforce the solution to be non-trivial: there does not exist a subset 𝑋 1 of the 𝑥 𝑖 of size 𝑘{2 which is equal to t𝑥 1 , . . . , 𝑥 𝑘 uz𝑋 1 . The alternative with lists, accessed only classically, is a very close problem that we will also study. Problem 6.2 (Unique 𝑘-XOR with lists). Given classical data as 𝑘 lists 𝐿 1 , . . . , 𝐿 𝑘 of uniformly random 𝑛-bit strings, of size 2 r𝑛{𝑘s , find a 𝑘-tuple 𝑥 1 , . . . , 𝑥 𝑘 P 𝐿 1 ˆ. . . ˆ𝐿𝑘 such that 𝑥 1 ' . . . ' 𝑥 𝑘 " 0, if it exists.

In the following, we will assume that 𝑛 is a multiple of 𝑘, writing 𝑛 𝑘 instead of P 𝑛 𝑘 T for the sake of simplicity, and without incidence on the complexities.

Classical Algorithms

We will first recall classical algorithms that solve Problem 6.1. As in the previous chapter, their complexities are exponential in 𝑛.

Naive meet-in-the-middle. A first idea is to cut the problem into halves (Algorithm 6.1). We compute all sums of X 𝑘 2 \ inputs, store them and look among all tuples of

𝑘 ´X 𝑘 2 \ " P 𝑘 2
T inputs for a collision on the stored data. The algorithm uses 𝒪 ´2t 𝑘 2 u 𝑛 𝑘 memory and 𝒪 ´2r 𝑘 2 s 𝑛 𝑘 ¯time. To date, there does not exist any generic improvement on this time complexity for the Unique 𝑘-XOR problem and all variants explored in this chapter, except for logarithmic factors. However, many classical algorithms allow to improve significantly on the memory complexity.

Parallel collision search. The case 𝑘 " 2 in Problem 6.1 arises in the literature under many names, such as golden collision search or element distinctness. The formulation of unique collision search is Problem 6.1: we are given a function ℎ : t0, 1u 𝑛{2 Ñ t0, 1u 𝑛 , we want to find its only (expected) collision. With the element distinctness problem, we want to know whether ℎ has such a collision or not. With the claw-finding variant, we Algorithm 6.1 Naive meet-in-the-middle 𝑘-XOR algorithm.

Input: oracle access to ℎ : t0, 1u 𝑛{𝑘 Þ Ñ t0, 1u 𝑛 Output: 𝑥 1 , . . . , 𝑥 𝑘 such that ℎp𝑥 1 q ' . . . ' ℎp𝑥 𝑘 q " 0.

1: Create a sorted list ℒ of size 2 t 𝑘 2 u 𝑛 𝑘 that contains:

@p𝑥 1 , . . . , 𝑥 t𝑘{2u q P ´t0, 1u 𝑛{𝑘 ¯t𝑘{2u , p𝑥 1 , . . . , 𝑥 t𝑘{2u , ℎp𝑥 1 q ' . . . ' ℎp𝑥 t𝑘{2u qq 2: for all p𝑥 t𝑘{2u`1 , . . . , 𝑥 𝑘 q P `t0, 1u 𝑛{𝑘 ˘𝑘´t𝑘{2u do 3:

if Dp𝑥 1 , . . . , 𝑥 t𝑘{2u , 𝑦q P ℒ, ℎp𝑥 t𝑘{2u`1 q ' . . . ' ℎp𝑥 𝑘 q " 𝑦 then 4:

return p𝑥 1 , . . . , 𝑥 t𝑘{2u , 𝑥 t𝑘{2u`1 , . . . , 𝑥 𝑘 q consider two functions 𝑔 and ℎ, looking for 𝑥 such that 𝑔p𝑥q " ℎp𝑥q, given the promise that there exists a single one or none. The cryptanalytic applications are rich. For example, the best attack on the isogenybased key-exchange SIKE [START_REF] Jao | Supersingular Isogeny Key Encapsulation[END_REF], one of the candidates of the NIST PQC project, reduces to a claw-finding problem.

While the naive algorithm solves the unique 2-XOR problem in time 𝒪 `2𝑛{2 ˘and memory 𝒪 `2𝑛{2 ˘, it achieves only a time-memory trade-off curve 𝑇 ¨𝑀 " 2 𝑛 . The parallel collision search algorithm of van Oorschot and Wiener [START_REF] Paul | Parallel Collision Search with Cryptanalytic Applications[END_REF] improves this to 𝑇 ¨𝑀 1{2 " 2 3𝑛{4 .

Schroeppel and Shamir's algorithm. In [START_REF] Schroeppel | A 𝑇 " 𝒪p2 𝑛{2 q, 𝑆 " 𝒪p2 𝑛{4 q Algorithm for Certain NP-Complete Problems[END_REF], Schroeppel and Shamir give an algorithm that improves the memory usage over the naive 2-list merge, whenever the problem can be rephrased as a 4-list merging problem. Rephrased in the setting of Problem 6.1, and reformulated in the merging framework, their idea is to merge 4 lists pairwise, with an arbitrary constraint 𝑠 of 𝑛 4 bits. By Lemma 5.1, the whole merging tree can be computed in time 𝒪 `2𝑛{4 ˘and memory 𝒪 `2𝑛{4 ˘. However, as there is only one solution, we must try all possible prefixes 𝑠 before finding a non-empty list at the root. Algorithm 6.2 Schroeppel and Shamir's algorithm.

Input: oracle access to ℎ : t0, 1u 𝑛{4 Ñ t0, 1u 𝑛 Output: 𝑥 1 , 𝑥 2 , 𝑥 3 , 𝑥 4 such that ℎp𝑥 1 q ' ℎp𝑥 2 q ' ℎp𝑥 3 q ' ℎp𝑥 4 q " 0 1: Create 4 lists ℒ 𝑖 , 1 ď 𝑖 ď 4, of size 2 𝑛{4 , where pairs 𝑥, ℎp𝑥q have arbitrary indices 2: for all Prefix 𝑠 of 𝑛 4 bits do 3:

ℒ 𝑠 12 Ð Mergepℒ 1 , ℒ 2 , 𝑠q Ź ℒ 𝑠 12 is of average size 2 𝑛{4 ˆ2𝑛{4 2 𝑛{4
" 2 𝑛{4 4:

ℒ 𝑠 34 Ð Mergepℒ 3 , ℒ 4 , 𝑠q 5:
if there is a collision between ℒ 12 and ℒ 34 then Ź Happens for a single 𝑠 (or with probability 2 ´𝑛{4 6:

return The collision Single 4-XOR on 𝑛 bits ℒ 𝑠 34 2 𝑛{4 partial collisions p𝑥 3 , 𝑥 4 q, ℎp𝑥 3 q ' ℎp𝑥 4 q " 𝑠|L 4 2 𝑛{4 elements p𝑥 4 , ℎp𝑥 4 qq The merging tree of Schroeppel and Shamir's algorithm is given in Figure 6.1. It has the same structure as the naive merging tree, which would simply put in ℒ 12 the product of ℒ 1 and ℒ 2 (and respectively for ℒ 34 ) as it needs to remember all the possibilities. It is contained in the naive tree, in the sense that all lists are contained in the corresponding naive lists.

ℒ 3 2 𝑛{4 elements p𝑥 3 , ℎp𝑥 3 qq ℒ 𝑠 12 2 𝑛{4 partial collisions p𝑥 1 , 𝑥 2 q, ℎp𝑥 1 q ' ℎp𝑥 2 q " 𝑠|L 2 2 𝑛{4 elements p𝑥 2 , ℎp𝑥 2 qq ℒ 1 2 𝑛{4 elements p𝑥 1 , ℎp𝑥 1 qq

Dissection algorithms.

The Dissection Algorithms of Dinur, Dunkelman, Keller, and Shamir [START_REF] Dinur | Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems[END_REF] generalize both Schroeppel and Shamir's technique and the parallel collision search technique to any 𝑘. In [START_REF] Dinur | Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems[END_REF], they are formulated in the framework of bicomposite problems, which is more general than unique 𝑘-XOR. Their method consists in guessing some intermediate values, then producing efficiently lists of partial guesses, before matching them. A bigger meet-in-the-middle instance is broken down into smaller ones. The algorithms of [Din+12, Section 3] correspond, in the classical setting, to the extended merging trees that we will shortly define. The algorithms of [Din+12, Section 4] improve the memory usage with parallel collision search. However, their power comes from iterating a random function, and we have seen in Chapter 5 that in the quantum setting, the advantage of iterating vanishes with respect to the quadratic speedup of quantum search, which is why we won't consider them for a quantum improvement.

Other improvements. The other works that we considered for the 𝑘-XOR problem and other merging problems [MS12; Bai+19; Din19; NS15] do not seem to perform better than Dinur, Dunkelman, Keller, and Shamir for the Unique 𝑘-XOR problem, and none of the techniques seemed to improve over the quantum merging algorithms that we will detail in the next section.

Quantum Algorithms

Despite its cryptanalytic applications, the Unique 𝑘-XOR problem has not been previously studied in full generality in the quantum setting. However, the element distinctness problem received significant attention, and an algorithm for 𝑘 " 4 was also known. In both cases, the best time complexity is obtained using a quantum walk. Input: oracle access to ℎ : t0, 1u 𝑛{2 Ñ t0, 1u 𝑛 Output: 𝑥, 𝑦 such that ℎp𝑥q ' ℎp𝑦q " 0

1: Repeat 2 𝑛{4 times Ź 2 𝑛{8 quantum search iterates 2:
Select a subset of size 2 𝑛{4 of the inputs of ℎ Ź e.g., using a prefix 3:

Fill a list ℒ " p𝑥, ℎp𝑥qq of size 2 𝑛{4

4:

With Grover's algorithm, look for 𝑦 P t0, 1u 𝑛 such that D𝑥, p𝑥, ℎp𝑦qq P ℒ Ź The search requires 𝒪 `2𝑛{4 ˘iterations

5:
if there is a solution 𝑦 then 6:

return p𝑥, 𝑦q 7: EndRepeat Ambainis' algorithm. Ambainis' celebrated algorithm [START_REF] Ambainis | Quantum Walk Algorithm for Element Distinctness[END_REF], based on a quantum walk, finds the solution in time r 𝒪 `22𝑛{3 ˘using 2 2𝑛{3 QRAQM. For a random oracle, it cannot be exponentially improved, as this would yield a better algorithm for collision search than the proven lower bound Ωp2 𝑛{3 q. With a memory restricted to 𝑀 , both Ambainis' algorithm and the previous one move on the time-memory trade-off curve 𝑇 2 ¨𝑀 " 2 2𝑛 . This is also the case of the algorithms for golden collision search that we give in [JS20], which allow to decrease the time complexity down to r 𝒪 `26𝑛{7 ˘with plain quantum circuits, and without QRAQM.

4-List merge with a quantum walk.

In [START_REF] Daniel | Quantum Algorithms for the Subset-Sum Problem[END_REF], Bernstein, Jeffery, Lange, and Meurer give a quantum walk algorithm for 4-SUM. It can solve Problem 6.1 in time r 𝒪 `20.3𝑛 ˘, using r 𝒪 `20.2𝑛 ˘QRAQM. This represents an exponential quantum time and memory improvement with respect to 𝑘 " 2, which shows once again that quantum merging algorithms differ from their classical cousins.

3-List merge with a Grover search. For 𝑘 " 3, we can give Algorithm 6.4. It gives actually the best quantum speedup known, for all 𝑘, when QRACM only is available. Algorithm 6.4 Quantum algorithm for the Unique 3-XOR problem, with QRACM.

Input: oracle access to ℎ : t0, 1u 𝑛{3 Ñ t0, 1u 𝑛 Output: 𝑥 1 , 𝑥 2 , 𝑥 3 such that ℎp𝑥 1 q ' ℎp𝑥 1 q ' ℎp𝑥 3 q " 0 1: Store all p𝑥 1 , ℎp𝑥 1 qq in a list ℒ of size 2 𝑛{3 (in QRACM) 2: Sample 𝑥 2 , 𝑥 3 P pt0, 1u 𝑛{3 q 2 such that 3:

if D𝑥 1 , p𝑥 1 , ℎp𝑥 2 q ' ℎp𝑥 3 qq P ℒ then 4:

return 𝑥 2 , 𝑥 3

5: EndSample

This algorithm solves Unique 3-XOR in time and memory 𝒪 `2𝑛{3 ˘. When the data is accessed via an oracle, and in the QRAQM model, we can reduce the memory down to 2 𝑛{6 with Algorithm 6.5. Algorithm 6.5 Quantum algorithm for the Unique 3-XOR problem, with QRAQM.

Input: oracle access to ℎ : t0, 1u 𝑛{3 Ñ t0, 1u 𝑛 Output: 𝑥 1 , 𝑥 2 , 𝑥 3 such that ℎp𝑥 1 q ' ℎp𝑥 1 q ' ℎp𝑥 3 q " 0 1: Sample 𝑠 P t0, 1u 𝑛{6 such that 2:

Build a list ℒ 2 of 2 𝑛{6 elements with prefix 𝑠, using Grover search in time 2 𝑛{12 ˆ2𝑛{6 " 2 𝑛{4 3:

Repeat 2 𝑛{6 times 4:
Build a list ℒ 1 of 2 𝑛{6 elements by querying ℎ 5:

Sample 𝑥 3 P t0, 1u 𝑛{3 such that 6:

Find p𝑥 1 , ℎp𝑥 1 qq P ℒ 1 with ℎp𝑥 1 q ' ℎp𝑥 3 q " 𝑠|7 : if there exists p𝑥 2 , ℎp𝑥 2 qq P ℒ 2 such that ℎp𝑥 1 q ' ℎp𝑥 3 q ' ℎp𝑥 2 q then 8:

return p𝑥 1 , 𝑥 2 , 𝑥 3 q 9: EndSample 10:

EndRepeat 11: EndSample
The time complexity of Algorithm 6.5 is:

2 𝑛{12 lo omo on Search on 𝑠 ˆ2𝑛{4 `2𝑛{12 ˆ2𝑛{6 lo omo on Produce ℒ 1 `2𝑛{6 lo omo on Search on 𝑥 3 ˙˙" 𝒪 ´2𝑛{3 ¯.
Naive algorithms. For any other 𝑘, a naive solution is to fall back on the previous strategies:

• Cut the problem in halves and use Ambainis' algorithm.

• Cut the problem in three and use Algorithm 6.4.

• Cut the problem in four and use the 4-list merging of [START_REF] Daniel | Quantum Algorithms for the Subset-Sum Problem[END_REF].

Remark 6.1 (Memory models). To date, all quantum speedups for Problem 6.1 require either QRAQM or QRACM. This includes all the algorithms presented in this section.

In the QRACM model, no improvement over the naive algorithm (cutting in three) is known, and for any 𝑘, the best time complexity achievable remains 𝒪 `2𝑛{3 ˘.

Extended Merging Trees

We will now adapt the merging trees defined in Chapter 5. Recall that we have formulated the Unique 𝑘-XOR problem in a way such that the domain of the oracle ℎ is restricted to t0, 1u 𝑛{𝑘 , while its codomain remains t0, 1u 𝑛 . We extend the definition in order to encompass Schroeppel and Shamir's algorithm, and the dissection algorithms of [Din+12, Section 3]. In short, extended merging trees are merging trees with additional variables, which handle the repetition of some of their subtrees. When subtrees are repeated, we change the arbitrary merging prefixes or we take an arbitrary sublist, as in Algorithms 6.3 and 6.5. Then, the mapping from trees to algorithms, and the formulas that determine the time and memory complexities, are adapted to take into account these loops. Structurally, we still consider binary trees as in Definition 5.3. We adopt the same numbering of nodes and keep the variables 𝑘 𝑗 𝑖 , 𝑢 𝑗 𝑖 , ℓ 𝑗 𝑖 that determine the shape of the list ℒ 𝑗 𝑖 . Thus, the tree still represents an appropriate merging process. We introduce a new variable 𝑟 for repetitions. Since we are solving Problem 6.1, we are in the situation of Schroeppel and Shamir's algorithm, where we cannot expect the tree to always contain a 𝑘-XOR. However, we can expect to find a partial 𝑘-XOR. Then, the tree must be re-computed many times before we find a full 𝑘-XOR to zero.

Constraints 5.3 and 5.2 are the same, but we adapt the constraint for the root node: Constraint 6.1 (Root node). At the root node: 𝑢 0 0 `𝑟 " 1 and ℓ 0 0 " 0.

Next, we add the new repetition variables 𝑟 𝑗 . On most nodes we set 𝑟 " 0, but we single out the right subtrees on the main branch, as depicted in Figure 6.2. Thus, there is only one non-zero repetition variable at each level, which is why we simply number them level by level.

For each subtree 𝒯 𝑗 , 𝑟 𝑗 represents the number of times it must be recomputed. Each computation should produce a new, independent list of elements, possibly with a new prefix. Constraint 6.2 (Repetitions). We have: 𝑟 " ř 𝑗 𝑟 𝑗 , and for each subtree 𝒯 𝑗 of width

𝑘 𝑗 : 𝑟 ď 𝑘 𝑗 𝑘 ´ℓ𝑗 (6.1)
where ℓ 𝑗 is the size of the list at the root of 𝒯 𝑗 .

In Constraint 6.2, the factor

𝑘 𝑗
𝑘 should be replaced by 𝑘 𝑗 𝑑 if the codomain of ℎ is 2 𝑑𝑛 .

We still denote by 𝑡 𝑗 𝑖 the sampling time of a node. Constraint 5.4 still applies, in its simplest form, since we use the QRAQM model only.

Root 𝑘 " 𝑘 1 1 `𝑘2 1 `𝑘3 1 `1 Subtree 𝒯 1 1 𝑘 1 1 , 𝑟 1 1 ℒ 1 0 𝑘 " 𝑘 2 1 `𝑘3 1 `1 Subtree 𝒯 2 1 𝑘 2 1 , 𝑟 2 1 ℒ 2 0 𝑘 " 𝑘 3 1 `1 Subtree 𝒯 3 1 𝑘 3 1 , 𝑟 3 1 ℒ 3 0 𝑘 " 1 Figure 6
.2: Main branch of a merging tree and all the subtrees that are attached to it.

Constraint 6.3 (Sampling). Let 𝑇 𝑗 𝑖 be a node in the tree, either an S-node or an L-node.

• If 𝑇 𝑗 𝑖 is a leaf, 𝑡 𝑗 𝑖 " 𝑢 𝑗 𝑖 2 .
• Otherwise, 𝑇 𝑗 𝑖 has an S-child 𝑆 𝑗`1 2𝑖 and an L-child 𝑆 𝑗`1 2𝑖`1 , and:

𝑡 𝑗 𝑖 " # 𝑡 𝑗`1 2𝑖 `1 2 maxp𝑢 𝑗 𝑖 ´𝑢𝑗`1 2𝑖 ´ℓ𝑗`1 2𝑖`1 , 0q quantumly 𝑡 𝑗`1 2𝑖 `maxp𝑢 𝑗 𝑖 ´𝑢𝑗`1 2𝑖 ´ℓ𝑗`1 2𝑖`1 , 0q classically . (6.2)
However, the total time complexity will be computed differently. Focusing on the subtrees 𝒯 𝑗 of the main branch, we let 𝑡 𝑗 denote their respective complete time complexities, that is, the time to build the whole subtree with quantum merging. Constraint 6.4 (Subtrees). Let 𝒯 𝑗 be the right subtree at level 𝑖. Then:

𝑡 𝑗 " max ˆmax List nodes of 𝒯 𝑗 p𝑡 𝑗 𝑖 `ℓ𝑗 𝑖 q ˙, (6.3)
where the sum is over all list nodes of 𝒯 𝑗 , including its own root (since this is a list node itself).

Then, we can now define the formulas for the time and memory complexities.

Definition 6.1. Let 𝒯 be an extended 𝑘-merging tree. Let 𝒯 1 , . . . , 𝒯 𝑝 be the right subtrees of the main branch. We define T q p𝒯 q, T c p𝒯 q and M p𝒯 q as:

M p𝒯 q " max List nodes pℓ 𝑗 𝑖 q T c p𝒯 q " max ˆ𝑟 `𝑡0 0 , 𝑟 1 `𝑡1 , 𝑟 1 `𝑟2 `𝑡2 , . . . , ˜𝑗 ÿ 𝑗 1 "1 𝑟 𝑗 1 ¸`𝑡 𝑗 , . . . , 𝑟 `𝑡𝑝 Ṫq p𝒯 q " max ˆ𝑟 2 `𝑡0 0 , 𝑟 1 2 `𝑡1 , 𝑟 1 `𝑟2 2 `𝑡2 , . . . , 1 2 ˜𝑗 ÿ 𝑗 1 "1 𝑟 𝑗 1 ¸`𝑡 𝑗 , . . . , 𝑟 2 `𝑡𝑝
Ṫhe idea of this definition is that the algorithm performs 𝑝 nested loops, one for each subtree of the main branch. We choose to nest from level 1 to 𝑝, as in Algorithm 6.6, with the idea that bigger and more costly subtrees may be attached to nodes at lower levels. We will see however that in the optimal algorithm for Unique 𝑘-XOR, all these levels collapse into a single one. Algorithm 6.6 Generic algorithm defined by an extended merging tree.

Input: oracle access to ℎ : t0, 1u 𝑛{𝑘 Ñ t0, 1u 𝑛 Output: 𝑘-XOR solution tuple 1: for all Choices of 𝒯 1 do Ź Either defined with a change of prefix, or a new choice of elements.

2:

Build 𝒯 1

3:

for all Choices of 𝒯 2 do 4:

Build 𝒯 2 . . .

5:

for all Choices of 𝒯 𝑝 do 6:

Build 𝒯 𝑝 7:

Sample 𝑥 P ℒ 𝑝 0 such that 8:
Find a match in 𝒯 𝑝

9:

Find a match in 𝒯 𝑝´1 . . .

EndSample

We can see that, with our definitions of 𝑡 𝑗 , 𝑡 0 , 𝑟 𝑗 and 𝑟, the time complexity of Algorithm 6.6, up to a polynomial factor, is going to be:

2 𝑛𝑟 1 ¨2𝑛𝑡 1 lo omo on 𝒯 1 `2𝑛𝑟 2 ¨2𝑛𝑡 2 lo omo on 𝒯 2 `. . . `2𝑛𝑟𝑝 ¨2𝑛𝑡𝑝 lo omo on 𝒯 𝑝 `2𝑛𝑡 0 lo omo on Sample ‹ '. . . ‹ ' ‹ ' , Root 𝑘 " 𝑘 1 1 `𝑘2 1 `𝑘3 1 `1 Subtree 𝒯 1 1 𝑘 1 1 , 𝑟 1 1 List ℒ 2 3 𝑘 2 3 , 𝑟 2 3 List ℒ 2 2 𝑘 2 2 ℒ 1 0 𝑘 " 𝑘 2 1 `𝑘3 1 `1 Subtree 𝒯 2 1 𝑘 2 1 , 𝑟 2 1 ℒ 2 0 𝑘 " 𝑘 3 1 `1 Figure 6.3: More complex repetition loops.
where we recover the equation of Definition 6.1. In the quantum setting, all these loops become nested quantum searches, and the time complexity can easily be obtained by the classical-quantum correspondence of Section 2.2.

Remark 6.2 (QRAQM requirement). In Chapter 5, we only needed QRACM, as all intermediate lists could be written down classically, and quantum access was necessary to sample new elements. However, here, the merging operations (writing down the lists) are performed under a quantum search, which is why QRAQM is necessary.

New Generalization

Until now, the presentation follows the merging trees of [NS20], but we remark that repetition loops can be laid out in an even more complex way. For example, not only subtrees of the main branch can be repeated, but also their subtrees.

With the example of Figure 6.3, we could write the complexity as:

max ˆ𝑟 2 `𝑡0 0 , 𝑟 2 3 2 `𝑡2 3 , 𝑟 2 3 `𝑟1 1 2 `𝑡1 1 , 𝑟 2 3 `𝑟1 1 2 `𝑡1 1 , 𝑟 2 3 `𝑟1 1 `𝑟2 1 2 `𝑡2 1 ˙,
where 𝑡 1 1 has only to take into account the node 𝒯 1 1 , not its sublist ℒ 2 3 that is already computed at this point. However, it is possible to show that adding new loops inside a subtree 𝒯 𝑖 of the main branch cannot improve the time complexity, with an exception: taking a list out of the loops over 𝒯 𝑖 . Thus, we make the following remark. Remark 6.3 (Amending the constraints). A subtree 𝒯 𝑗 of width 𝑘 𝑗 , can cost 0 inside the repetitions if a global cost 𝑘 𝑗 𝑘 (in time and memory) has been already paid. Indeed, when 𝒯 𝑗 is of width 1, a full lookup table of ℎ can be prepared beforehand and reused instead of rebuilding it at each iterate. Likewise, we can prepare the sorted list of all 𝑘 𝑗 -tuples in order to retrieve quickly those having a wanted prefix.

The more general case is ruled out by a proof similar to that of Lemma 6.3.

Correspondence between Trees and Algorithms

Similarly as in Chapter 5, to any extended merging tree corresponds a classical (respectively quantum) extended merging algorithm that has the wanted complexity. Theorem 6.1 (Quantum extended merging strategies). Let 𝒯 𝑘 be an extended 𝑘-merging tree and T q p𝒯 𝑘 q computed as in Definition 6.1. Then there exists a quantum extended merging algorithm that, given access to a quantum oracle 𝑂 ℎ , finds a 𝑘-XOR.

This algorithm succeeds with probability more than 1 ´𝑒´𝑎𝑛 for some 𝑎 ą 0. It runs in time r 𝒪 `2Tqp𝒯 𝑘 q𝑛 ˘, counted in 𝑛-qubit register operations, makes the same number of queries to 𝑂 ℎ . It uses a memory 𝒪 `2Mp𝒯 𝑘 q𝑛 ˘, counted in 𝑛-qubit registers (QRAQM). The constants in the 𝒪 depend on 𝑘.

Proof. We rely on Theorem 5.4 for the correctness of merging strategies. Each level of quantum search builds a new subtree, as in Algorithm 6.6. The search space itself is defined by an arbitrary prefix, either of the codomain (a merging constraint, as in Schroeppel and Shamir's algorithm) or of the domain (an input sublist, as in Algorithm 6.3). A given bit-string of the search space at level 𝑗 is good if, after building the corresponding subtree 𝒯 𝑗 , and after running the search at level 𝑗 `1, we find a solution 𝑘-XOR.

Among all repetitions of the subtrees 𝒯 1 , . . . , 𝒯 𝑝 , only one choice shall lead to a solution (otherwise there would be too many repetitions). We miss it if the corresponding merging tree fails to find it; but Theorem 5.4 ensures a probability of success exponentially close to 1. However, this requires to increase the list sizes by a constant factor, which is impossible in the limit case of a codomain 2 𝑛{𝑘 . In this case, we only get a constant success probability. We can give an example for 𝑘 " 4 (Algorithm 6.7) which is a quantum variant of Schroeppel and Shamir's 4-list merging.

The classical time complexity of Algorithm 6.7 would be:

2 0.25𝑛 lo omo on Choice of 𝑢 ˆ20.125𝑛 ˆ20.125𝑛 loomoon Intermediate list ℒ 1 1 `20.25𝑛 lo omo on Exhaustive search
˙˙" 2 0.625𝑛 , which is not optimal. However, as a quantum algorithm with nested Grover searches, it optimizes differently, since exhaustive search factors are replaced by their square roots:

2 0.125𝑛{2 ˆ20.125𝑛{2 ´20.125𝑛 `20.25𝑛{2 ¯" 2 0.3125𝑛 .
This is more than the complexity r 𝒪 `20.3𝑛 ˘of [START_REF] Daniel | Quantum Algorithms for the Subset-Sum Problem[END_REF], but we will see in Section 6.2 that this merging strategy has more applications than only the 𝑘-SUM problem. Algorithm 6.7 Optimal merging tree algorithm for Problems 6.2 and 6.1 with 𝑘 " 4.

Input: query access to ℎ : t0, 1u 𝑛{4 Ñ t0, 1u 𝑛 Output: a 4-tuple p𝑥 𝑖 q 0ď𝑖ď3 such that À ℎp𝑥 𝑖 q " 0 1: Query the codebook and build a list ℒ 2 1 " tp𝑥, ℎp𝑥qq, 𝑥 P t0, 1u 𝑛{4 u 2: Set ℒ 2 3 " ℒ 2 1 3: Sample each 𝑢 P t0, 1u 0.25𝑛 such that 4:

Repeat 2 0.125𝑛 times 5:

Build a list ℒ 1 1 of 2 0.125𝑛 partial collisions: p𝑥 2 , 𝑥 3 q such that ℎp𝑥 2 q ' ℎp𝑥 3 q " 𝑢|˚, in time 2 0.125𝑛 .

Ź if we take any element, we expect a partial collision on 0.25𝑛 bits with some other in ℒ 2 3 . Thus, each element of ℒ 1 1 is drawn in expected time 1 6:

Sample 𝑥 0 P t0, 1u 𝑛{4 such that 7:

Find 𝑥 1 P ℒ 2 1 such that ℎp𝑥 0 q ' ℎp𝑥 1 q " 𝑢|8 :

if Dp𝑥 2 , 𝑥 3 q P ℒ 1 1 ,

À 𝑖 ℎp𝑥 𝑖 q " 0 then 9:
Exit and return the tuple 𝑥 0 , 𝑥 1 , 𝑥 2 , 𝑥 3 10:

EndSample 11: Our definition allows to extend the Dissection framework, which was intended to solve the problem with a single solution, to any intermediate domain size.

EndRepeat 12: EndSample ℒ 0 0 , 𝑘 " 4 ℓ 0 0 " 0, 𝑢 0 0 " 5 8 𝑡 0 0 " 1 8 ℒ 1 1 , 𝑘 " 2 ℓ 1 1 " 1 8 , 𝑢 1 1 " 1 4 𝑡 1 1 " 0, 𝑟 1 " 3 8 ℒ 2 3 , 𝑘 " 1 ℓ 2 3 " 1 4 , 𝑢 2 3 " 0 𝑡 2 3 " 0 ℒ 2 2 , 𝑘 " 1 ℓ 2 2 " 1 8 , 𝑢 2 2 " 0 𝑡 2 2 " 0 ℒ 1 0 , 𝑘 " 2 ℓ 1 0 " 1 4 , 𝑢 1 0 " 1 4 𝑡 1 0 " 0 ℒ 2 1 , 𝑘 " 1 ℓ 2 1 " 1 4 , 𝑢 2 1 " 0 𝑡 2 1 " 0 ℒ 2 0 , 𝑘 " 1 ℓ 2 0 " 1 4 , 𝑢 2 0 " 0 𝑡 2 0 " 0

New Results for Unique k-XOR

For a general 𝑘, the algorithms for Problem 6.2 and Problem 6.1 achieve the same time complexities in the QRAQM model: accessing the data classically or quantumly makes little difference for the unique 𝑘-XOR problem. The reason is that the amount of data accessed (for example, 2 𝑛{4 for 𝑘 " 4) is lower than the best time complexity (for example, 2 0.3125𝑛 for 𝑘 " 4). Thus, we can query the whole codebook, store it in QRAQM and emulate quantum oracle queries. For 𝑘 " 3, this makes only a difference in the memory complexity.

If we optimized the trees without Remark 6.3, we would obtain the following optimal complexity, which is from [NS20]: Theorem 6.2 (Optimal trees from [NS20]). Let 𝑘 ą 2 be an integer. There exists a merging tree that given 𝑘 lists of uniformly distributed 𝑛-bit strings, of size 2 𝑛{𝑘 each, a 𝑘-XOR on 𝑛 bits (if it exists) in quantum time 𝒪p2 𝛾 𝑘 𝑛 q where 𝛾 𝑘 " 1 𝑘 𝑘`r𝑘{5s 4

. In particular, it converges towards a minimum 0.3, which is reached by multiples of 5. For 𝑘 ě 5 the memory (QRAQM) used is ď 2 0.2𝑛 . However, this small remark (taking some subtrees outside the repetitions, by performing trivial products of lists) allows to reach slightly improved exponents, and to break the previous lower bound 0.3 for 𝑘-list merging. This is a new result from this thesis. Theorem 6.3 (New trees for unique 𝑘-XOR). Let 𝑘 ą 2 be an integer. The best merging tree (with our definition) finds a 𝑘-XOR in time r 𝒪p2 𝛾 𝑘 𝑛 q where: We defer the full proof of this optimality to Section 6.1.7 and focus for now on the description of the optimal trees, which is actually very simple, despite the number of a priori possible strategies.

𝛾 𝑘 " 𝑘 `X 𝑘`6 7 \ `X 𝑘`1 7 \ ´X 𝑘 7 \ 4𝑘 . ( 6

Description of the Optimal Trees

For 𝑘 ď 5, the results of Theorem 6.3 and Theorem 6.2 coincide. Examples for 𝑘 " 4 and 𝑘 " 3 were given in Algorithm 6.7 and Algorithm 6.5. Next, we can have a look at the Unique 5-XOR algorithm (Algorithm 6.8). It uses a single repetition loop, over a prefix 𝑠 of 𝑛 5 bits. Inside this loop, a merging of two lists of size 2 𝑛 5 is performed using the prefix 𝑠. One can then compute the time complexity as: Input: query access to ℎ : t0, 1u 𝑛{5 Ñ t0, 1u 𝑛 Output: a 5-tuple p𝑥 𝑖 q 1ď𝑖ď5 such that À 𝑖 ℎp𝑥 𝑖 q " 0 1: Query the codebook and build a list ℒ 3 1 " tp𝑥, ℎp𝑥qq, 𝑥 P t0,

1u 𝑛{5 u 2: Set ℒ 2 1 " ℒ 3 1 3: Set ℒ 2 3 " ℒ 3 1 4: Sample 𝑠 P t0, 1u 𝑛{5 such that 5:
Using ℒ 2 3 , build a list ℒ 1 1 of 2 𝑛{5 3-tuples p𝑥 1 , 𝑥 2 , ℎp𝑥 1 q ' ℎp𝑥 2 qq such that ℎp𝑥 1 q ' ℎp𝑥 2 q " 𝑠|˚.

6:

Sample p𝑥 4 , ℎp𝑥 4 qq in ℒ 3 1 such that 7:

Sample 𝑥 5 P t0, 1u 𝑛{5 such that 8:

Find p𝑥 3 , ℎp𝑥 3 qq P ℒ 2 1 such that ℎp𝑥 3 q ' ℎp𝑥 4 q ' ℎp𝑥 5 q " 𝑠|9 :

Find p𝑥 1 , 𝑥 2 , ℎp𝑥 1 q ' ℎp𝑥 2 qq P ℒ 1 1 such that:

À 5 𝑖"1 ℎp𝑥 𝑖 q " 0 2𝑛{5 |1 0:
if This is equal to zero then 11:

Exit and return p𝑥 𝑖 q 1ď𝑖ď5 12:

EndSample 13:

EndSample 14: EndSample ℒ 0 0 , 𝑘 " 5 ℓ 0 0 " 0, 𝑢 0 0 " 3 5 𝑡 0 0 " 1 5 ℒ 1 1 , 𝑘 " 2 ℓ 1 1 " 1 5 , 𝑢 1 1 " 1 5 𝑡 1 1 " 0, 𝑟 1 " 1 5 ℒ 2 3 , 𝑘 " 1 ℓ 2 3 " 1 5 , 𝑢 2 3 " 0 𝑡 2 3 " 0 ℒ 2 2 , 𝑘 " 1 ℓ 2 2 " 1 5 , 𝑢 2 2 " 0 𝑡 2 2 " 0 ℒ 1 0 , 𝑘 " 3 ℓ 1 0 " 2 5 , 𝑢 1 0 " 1 5 𝑡 1 0 " 0 ℒ 2 1 , 𝑘 " 1 ℓ 2 1 " 1 5 , 𝑢 2 1 " 0 𝑡 2 1 " 0 ℒ 2 0 , 𝑘 " 2 ℓ 2 0 " 2 5 , 𝑢 2 0 " 0 𝑡 2 0 " 0 ℒ 3 1 , 𝑘 " 1 ℓ 3 1 " 1 5 , 𝑢 3 1 " 0 𝑡 3 1 " 0, 𝑟 3 " 0 ℒ 3 0 , 𝑘 " 1 ℓ 3 0 " 1 5 , 𝑢 3 0 " 0 𝑡 " 0 Figure 6
.6: Optimal Unique 5-XOR merging tree.

The novelty of Theorem 6.3 appears with Algorithm 6.9, whose total time complexity is: It benefits from computing some products of lists outside any repetitions. Interestingly, this also modifies the memory requirements: only 2 𝑛{7 QRAQM is required, in order to hold ℒ , and 2 2𝑛{7 QRACM is needed for ℒ 34 and ℒ 67 .

2 2𝑛{7 lo
0 3𝑛{7 |˚𝑠 |˚ℒ 67 ℒ 7 ℒ 6 ℒ 5 𝑠|˚ℒ 34 ℒ 4 ℒ 3 ℒ 12 ℒ 2 ℒ 1 Figure 6
.7: Unique 7-XOR merging tree of Algorithm 6.9.

For a bigger 𝑘, it is possible to reach the optimal complexity by mimicking the 7-XOR strategy. We introduce two integer variables 𝑘 1 and 𝑘 2 with the values:

# 𝑘 1 " X 3𝑘 7 T 𝑘 2 " X 2𝑘 7 \ ´X 𝑘´1 7 \ `X 𝑘´2 7 \ (6.5)
Algorithm 6.9 Unique 7-XOR algorithm. Input: 7 lists ℒ 𝑖 Output: a 7-tuple p𝑥 𝑖 q P ś 𝑖 ℒ 𝑖 that XORs to 0 1: Build ℒ 67 " ℒ 6 ' 0 ℒ 7 (all sums between these two lists) 2: Build ℒ 34 " ℒ 3 ' 0 ℒ 4 (all sums between these two lists) 3: Sample 𝑠 P t0, 1u 2𝑛{7 such that Ź 2 𝑛{7 quantum search iterates 4:

Build ℒ 567 " ℒ 5 ' 𝑠 ℒ 67 Ź Time 2 𝑛{7 , which is the size of the list 5:

Sample 𝑥 P ℒ 1 ˆℒ2 such that Ź 2 𝑛{7 quantum search iterates 6:
Find 𝑦 P ℒ 34 such that 𝑥 ' 𝑦 " 𝑠|7

:

Find 𝑧 P ℒ 567 such that 𝑥 ' 𝑦 ' 𝑧 " 0 3𝑛{7 |8 : if 𝑥 ' 𝑦 ' 𝑧 " 0 then 9:
Exit and return the result 10:

EndSample 11: EndSample and we perform Algorithm 6.10. Thus, the tree structure is overly simple (Figure 6.8): there are four subtrees, each of which is a trivial product of lists (a merge with empty prefixes). There is only a single repetition loop, and the whole algorithm contains only two levels of quantum search. The fact that this choice of structure matches the complexity given by Theorem 6.3 is not obvious, but it will follow naturally from the proof of the theorem in Section 6.1.7.

Root 𝑢 " 𝑘 2 𝑘 `𝑘´𝑘 1 ´𝑘2 2𝑘 ℒ 1 , 𝑠|p refix: 𝑢 " 𝑘 2 𝑘 𝒯 3 width 𝑘 2 𝒯 2 of width 𝑘 1 ´𝑘2 ℒ Ď 𝒯 2 size 𝑘´𝑘 1 ´𝑘2 2𝑘 𝑠|˚𝒯 1 width 𝑘 2 𝒯 0 width 𝑘 ´𝑘1 ´𝑘2
Figure 6.8: Generic merging tree that reaches the optimal complexity for unique 𝑘-XOR (see Algorithm 6.10).

Memory Usage

Our algorithms for Unique 𝑘-XOR reach the best time complexity 𝒪 `22𝑛{7 ˘when 𝑘 is a multiple of 7, but at these points, they require a QRACM of size 2 2𝑛{7 . This is suboptimal with respect to the time-memory product, a metric that makes sense if the qubits used for QRAQM storage need active error correction (see [START_REF] Lov | How significant are the known collision and element distinctness quantum algorithms?[END_REF] or [START_REF] Jaques | Quantum Cryptanalysis in the RAM Model: Claw-Finding Attacks on SIKE[END_REF]), Algorithm 6.10 Generic Unique 𝑘-XOR algorithm.

Input: 𝑘 lists ℒ 𝑖 Output: a 𝑘-tuple p𝑥 𝑖 q P ś 𝑖 ℒ 𝑖 that XORs to 0 1: Select 𝑘 1 , 𝑘 2 by Equation 6.5 2: Build 𝒯 1 and 𝒯 3 , each with the product of 𝑘 2 lists 3: Sample 𝑠 P t0, 1u

𝑘 2 𝑘 𝑛 such that 4: Sample Sublists ℒ of 𝒯 2 of size 𝑘´𝑘 1 ´𝑘2 2𝑘 such that 5:
Merge ℒ with 𝒯 3 to obtain an intermediate list ℒ 1 with prefix of 𝑘 2 𝑘 𝑛 bits and size 𝑘´𝑘 1 ´𝑘2 2𝑘 6:

Sample 𝑥 P 𝒯 0 such that Ź 2 𝑘´𝑘 1 ´𝑘2 2𝑘
𝑛 quantum search iterates 7:

Find 𝑦 P 𝒯 1 such that 𝑥 ' 𝑦 " 𝑠|8 :
if There is a collision on ℒ 1 then 9:

Exit and return the result In order to find the best time-memory product, we change the optimization goal. We find that for Problem 6.2, the memory used is exactly the storage of the lists. Lemma 6.1. The optimal 𝑘-merging trees for Problem 6.2 with respect to the timememory product use a memory of 2 𝑛{𝑘 . For Problem 6.1, there are improvements for small values of 𝑘, but not for 𝑘 ě 8. Thus, we actually optimize the tree under a memory constraint of 2 𝑛{𝑘 . We obtain results analogous to the classical Dissection technique [Din+12, Section 3], given in Table 6.1. In particular: Proposition 6.2. The optimal time complexity exponent with 2 𝑛{𝑘 memory is:

𝑘´𝒪p ? 𝑘q 2𝑘
. It converges towards 1 2 when 𝑘 Ñ `8. The time-memory product admits a global minimum over 𝑘.

Note that these results are given by the trees of [NS20], as our improvements in time given by Theorem 6.3 rely on a higher memory consumption. We remark that these algorithms often reach a square root speedup upon [Din+12, Section 3]. As we have discussed before, the iteration technique of [Din+12, Section 4] is unlikely to improve the time nor the memory usage in the quantum setting. Thanks to a simplification of the constraints of [NS20], we are able to compute the time for higher values of 𝑘 and to obtain the results of Table 6.2 and Figure 6.9. Proposition 6.3. The time-memory product for unique 𝑘-XOR merging trees is lower bounded by: r 𝒪 ´2 7 17 𝑛 ¯which is reached by 𝑘 " 17.

Proof of Optimality

We now prove Theorem 6.3. We will first prove the following result, and show later how it implies the formula for the optimal complexity and the shape of the optimal trees that we gave.

Theorem 6.4. For any 𝑘, the optimal time 𝑡 for the unique 𝑘-XOR problem, with our merging tree framework, is given by:

𝑡 " min 𝑘 1 ,𝑘 2 PN 2 ,𝑘 1 `𝑘2 ď𝑘 ˆmax ˆ𝑘2 𝑘 , 1 2
ˆ1 ´𝑘1 𝑘 ˙, 1 4
ˆ1 `𝑘1 ´𝑘2 𝑘 ˙˙˙, (6.6)
and can thus be obtained by solving a simple mixed integer linear program.

We cut down the proof of this statement into two steps.

1. We first massively restrict the space of possible strategies, and show that we can still obtain the optimal strategy. In Lemma 6.2, we show that a merging tree using QRAQM (without repetitions) can be optimized so that only the list nodes (including the root) have non-trivial sampling procedures. This helps us to show Lemma 6.3: the subtrees of an extended merging tree are classical merging trees, that do not use quantum search, and finally Lemma 6.4: these classical trees can be seen as trees with only 2 levels, merging two lists of trivial sums with a single non-empty prefix.

2. The optimal time complexity becomes the solution of a much simpler linear program, that we write down. We simplify it considerably in order to obtain Equation 6.6; at the same time, we show that there indeed exists merging trees that allow to reach this complexity. These are the trees given in Theorem 6.3.

Step 1: Reducing the Search Space

Lemma 6.2 (Optimization of merging with QRAQM). A quantum merging tree using QRAQM can be optimized such that all Sample nodes are sampled in time 1. Proof. As an example, consider the situation of Figure 6.10. The time to build the root is the following, depending on the list sizes of the subtrees, and prefixes chosen at each level:

ℓ 0 `1 2 `maxp𝑢´𝑢 1 ´ℓ1 1 , 0q `maxp𝑢 1 ´𝑢2 ´ℓ2 1 , 0q `maxp𝑢 2 ´𝑢3 ´ℓ3 1 , 0q `𝑢3 ˘.
Note that we will only change the prefix sizes, so we may consider lists of fixed or limited size (as is the case in our problem). We prove that we can set these prefixes so that 𝑢 1 " 𝑢 2 `ℓ2 1 , 𝑢 2 " ℓ 3 1 , 𝑢 3 " 0 and similarly for any tree height. First, we perform the same operation recursively on the subtrees. Next, we remark that 𝑢 3 " 0 can be set without increasing the time complexity. Finally, assume e.g. that 𝑢 1 ´𝑢2 ´ℓ2

1 ą 0, Root 𝑘 " 𝑘 1 1 `𝑘2 1 `𝑘3 1 `1, ℓ 0 Subtree 𝒯 1 1 𝑘 1 1 , ℓ 1 1 , 𝑢 1 ℒ 1 0 𝑘 " 𝑘 2 1 `ℓ3 1 `1 Subtree 𝒯 2 1 𝑘 2 1 , ℓ 2 1 , 𝑢 2 ℒ 2 0 𝑘 " 𝑘 3 1 `1 Subtree 𝒯 3 1 𝑘 3 1 , ℓ 3 1 , 𝑢 3 ℒ 3 0 𝑘 " 1 Figure 6
.10: A merging tree using QRAQM.

then we will decrease 𝑢 1 to 𝑢 2 ´ℓ2 1 . The time complexity for sampling the root is left unchanged, because we increase the number of iterations at the next level in the same amount as we decrease it at this level. Since we are reducing 𝑢 1 , the time complexity of 𝒯 1 1 can only be decreased as well.

This is also true of the merging trees in the QRACM model of Chapter 5: only at list nodes, and in particular the root, is the sampling time different from 1. Note, however, that this property does not hold for merging trees with classical memory, for 𝑘 ď 7, as our examples have shown. Lemma 6.3. For any 𝑘, the optimal time complexity is reached by an extended merging tree where all subtrees 𝒯 1 , . . . , 𝒯 𝑝 of the main branch are built by classical merges, with their complexities equal to their size.

Proof. The reason of this fact is that, when merging, we drop many tuples. Since all possibilities must be studied in the end, the more we merge, the more repetitions need to be made. For example, Schroeppel and Shamir's algorithm requires 2 𝑛{4 repetitions due to the intermediate prefix of 𝑛 4 bits. A subtree which uses quantum merging can be replaced by a subtree using classical merging only, which is bigger, but which will be repeated less.

We define the total guessed prefixes TGP of a tree to be the sum of all prefix sizes 𝑢 𝑖 𝑗 , where 𝑢 𝑟 " 𝑢 𝑙 is counted once only for two sibling nodes. For example, TGPp𝒯 q " 𝑢 if 𝒯 is a leaf list with a prefix size 𝑢. Denoting by 𝑢 the prefix of 𝒯 , we remark: TGPp𝒯 q " 𝑢 `TGPp𝒯 1 q `. . . `TGPp𝒯 𝑝 q . This corresponds to the total amount of prefixes that are arbitrarily fixed, and restrict the number of solutions of the merge. The reason for defining TGP is that, while solving the Unique 𝑘-XOR problem, a subtree 𝒯 merging a fixed number of lists of fixed size will be repeated at least TGPp𝒯 q times: we must try all possible values for these prefixes. We can show:

If 𝒯 is a quantum merging tree producing a list of size ℓ with prefix 𝑢, then there exists a classical merging tree 𝒯 1 , producing a list of size ℓ 1 ě ℓ with prefix 𝑢 1 ď 𝑢, satisfying: 𝑢 1 `ℓ1 " 𝑢 `ℓ, and:

T c
`𝒯 1 ˘ď T q p𝒯 q `TGPp𝒯 q ´TGPp𝒯 1 q 2 . (6.7) Remark 6.5. Here we assume that neither 𝒯 nor 𝒯 1 contain internal repetition loops, which greatly simplifies the definition of T c p𝒯 1 q and T q p𝒯 q (time complexities of the complete subtrees). But a more involved proof would dismiss this case as well.

We prove (6.7) by induction on the tree structure. First, this is obviously true for leaf lists: if we produce a list of size ℓ having a prefix 𝑢, this costs quantumly ℓ `𝑢 2 . Classically, we remove the prefix condition: the time increases to ℓ `𝑢 " ℓ `𝑢 2 `𝑢 2 .

Consider a generic tree, properly optimized, with subtrees 𝒯 1 , . . . , 𝒯 𝑝 on the main branch. We will first replace them by the classical 𝒯 11 , . . . , 𝒯 1𝑝 . Since 𝑢 𝑖 `ℓ𝑖 " 𝑢 1𝑖 `ℓ1𝑖 , the tree structure remains the same. We have: T c `𝒯 1𝑖 ˘ď T q `𝒯 𝑖 ˘`TGPp𝒯 𝑖 q´TGPp𝒯 1𝑖 q 2 . At the root 𝒯 1 , we will set 𝑢 1 " 𝑢 1 `ℓ1 and ℓ 1 " ℓ `𝑢 ´𝑢1 . In other words, we set precisely the prefix that allows to sample the list in time 1. Let 𝑡 1 be the time to build the whole list at the root, and 𝑡 the corresponding time for 𝒯 . We have in particular:

T c `𝒯 1 ˘" max 𝑖 p𝑡 1 , T c
`𝒯 1𝑖 ˘q and T q p𝒯 q " max 𝑖 p𝑡, T q `𝒯 𝑖 ˘q .

Then 𝑡 1 " ℓ `𝑢 ´p𝑢 1 `ℓ1 q " ℓ `p𝑢´p𝑢 1 `ℓ1 qq 2 `p𝑢´𝑢 1 q 2 " 𝑡 `p𝑢´𝑢 1 q 2 . Next, we use the recurrence hypothesis for the subtrees. We have:

max 𝑖 p𝑡 1 , T c `𝒯 1𝑖 ˘q ď max 𝑖 ˆ𝑡 `𝑢 ´𝑢1 2 , T q `𝒯 𝑖 ˘`TGPp𝒯 𝑖 q ´TGPp𝒯 1𝑖 q 2 Ṫc `𝒯 1 ˘ď 𝑢 ´𝑢1 2 `ÿ 𝑖 TGPp𝒯 𝑖 q ´TGPp𝒯 1𝑖 q 2 `max 𝑖 p𝑡, T q `𝒯 𝑖 ˘q ď T q p𝒯 q `TGPp𝒯 q ´TGPp𝒯 1 q 2 .
Which proves the property. This formula displays the idea of this lemma in a clearer way: although there is an advantage in merging quantumly instead of classically, this advantage vanishes if we must repeat the merge for all possible prefix guesses. We obtain:

T c `𝒯 1 ˘`TGPp𝒯 1 q 2 ď T q p𝒯 q `TGPp𝒯 q 2 .
Thus, replacing 𝒯 by 𝒯 1 in the extended merging tree does not increase the time complexity. Lemma 6.4. For any 𝑘, the optimal time complexity is reached by a tree where all main subtrees are classical trivial merges: 𝒯 𝑖 has no guessed prefix, except at its root.

Proof. The idea is that, when repeating a subtree, we might as well take sublists instead of the intermediate prefixes. The number of repetitions will be the same and the merge, when optimized, costs the same as well.

As an example, consider a 2-level merging tree with lists ℒ 1 , ℒ 2 , ℒ 3 , ℒ 4 of sizes ℓ 1 , ℓ 2 , ℓ 3 , ℓ 4 , a prefix 𝑢 1 at level 1 and a prefix 𝑢 0 at level 0. Merging pairwise gives two lists ℒ 12 and ℒ 34 of sizes ℓ 1 `ℓ2 ´𝑢1 and ℓ 3 `ℓ4 ´𝑢1 , then a final list of size ř 𝑖 ℓ 𝑖 ´𝑢´𝑢 1 , and the merging needs to be repeated 𝑢 0 `𝑢1 2 times. The fact that the tree is correctly balanced, and that the merging is purely classical, implies that ℓ 1 `ℓ2 ´𝑢1 ě ℓ 1 and that ℓ 3 `ℓ4 ´𝑢1 ě ℓ 3 , i.e., ℓ 2 ě 𝑢 1 and ℓ 3 ě 𝑢 1 . We also have ℓ 3 `ℓ4 ě 𝑢 0 . Suppose without loss of generality that ℓ 1 `ℓ2 ě ℓ 3 `ℓ4 , that is, in the sampling-based version, we sample from ℒ 1 and try to match against ℒ 2 , then ℒ 34 . Now, we remark that the constructions of ℒ 12 and ℒ 34 only need to be repeated 𝑢 1 2 times. The total cost is hence:

𝑢 1 2 `maxpℓ 4 , ℓ 3 `ℓ4 ´𝑢1 , ℓ 2 , ℓ 1 `ℓ2 ´𝑢1 , 𝑢 0 2 `ÿ 𝑖 ℓ 𝑖 ´𝑢1 ´𝑢0 q .
Now, consider a modified merging tree in which we replace ℒ 4 by a sublist of size ℓ 4 ´𝑢1 ě 0. There still is a repetition loop of 𝑢 1 2 iterations, since we need to span all such sublists. However, ℒ 12 does not need the prefix 𝑢 1 anymore, so it can go outside the repetition loop for 𝑢 1 .

Remark 6.6. The change brought by Remark 6.3 appears here, as ℒ 12 has become a list independent from all repetition loops, that is built only once. Thus, we total cost becomes:

maxpℓ 1 `ℓ2 , 𝑢 1 2 `ℓ4 ´𝑢1 , 𝑢 1 2 `ℓ3 `ℓ4 ´𝑢1 , ℓ 2 , 𝑢 0 `𝑢1 2 `ÿ 𝑖 ℓ 𝑖 ´𝑢1 ´𝑢0 q .
But we remark that:

𝑢 0 `𝑢1 2 `ÿ 𝑖 ℓ 𝑖 ´𝑢1 ´𝑢0 ě 𝑢 0 `𝑢1 2 `ℓ1 `ℓ2 ´𝑢1 ě ℓ 1 `ℓ2 .
In other words, removing the prefix 𝑢 1 has two consequences: ' we can put the merging of ℓ 1 and ℓ 2 outside the loop over 𝑢 0 , which makes the procedure overall more efficient; ' we can replace the loop over a prefix 𝑢 1 by a loop over sublists of size ℓ 4 ´𝑢1 of the previous ℓ 4 .

Thus, when we consider the main branch of an extended merging tree, all its subtrees are built by merging two classical lists, which can be precomputed from the data, on a given prefix 𝑢 that needs to be repeated. This simplifies considerably the shape of the trees and our complexity analysis.

Step 2: Simplifying the Constraints

From now on, we write 𝒯 𝑖 the subtrees at level 𝑖, instead of 𝒯 𝑖 , and put also 𝑖 in index for all parameters. By Lemmas 6.3 and 6.4, we can write down the shape of an optimal extended merging tree for unique 𝑘-XOR as follows:

• It has a main branch with 𝑝 levels, and subtrees 𝒯 1 , . . . , 𝒯 𝑝 attached respectively at levels 1 to 𝑝.

• There is a subtree 𝒯 1 𝑝 at level 𝑝 on the left, which is simply sampled. We have

ℓ 1 𝑝 " 𝑘 1
𝑝 𝑘 , i.e., this subtree does not need to be repeated. Hence, all constraints on 𝑡 can be rewritten in the 𝑘 𝑖 and the ℓ 𝑖 :

$ ' ' ' ' ' & ' ' ' ' ' % 𝑡 ě max 1ď𝑖ď𝑝´1 ´𝑘𝑝 𝑘 , 𝑘 𝑙 𝑖 𝑘 , 𝑘 𝑟 𝑖 𝑘 t ě ř 𝑖 𝑟 𝑖 `1 2 ´1 ´ř𝑖 𝑘 𝑖 𝑘 ¯" 1 2 p1 ´ř𝑖 ℓ 𝑖 q 𝑘𝑝 𝑘 ě ℓ 𝑝 @1 ď 𝑖 ď 𝑝 ´1 ´𝑡 ě ´ř𝑖 𝑗"1 𝑟 𝑗 ¯`ℓ 𝑖 , 𝑘 𝑙 𝑖 𝑘 ě ℓ 𝑖 , 𝑘 𝑟 𝑖 𝑘 ě ř 𝑝 𝑗"𝑖`1 ℓ 𝑗 ¯(6.8)
The problem becomes much easier to solve, since the cut of 𝑘 can be handled by integer variables. However, we can simplify (6.8) further.

For more simplicity, let us consider a fixed height of 4, as in Figure 6.11. By rewriting (6.8) with the ℓ 𝑖 only, we obtain:

(C1) 𝑡 ě 1 2 p1 ´ℓ1 ´ℓ2 ´ℓ3 q (C2) 𝑡 ě 1 2 ˆ𝑘1 `𝑘2 𝑘 ´ℓ1 `ℓ2 (C3) 𝑡 ě 1 2 ˆ𝑘1 𝑘 `ℓ1 (C4) 𝑘 3 𝑘 ě ℓ 3 , 𝑘 𝑟 2 𝑘 ě ℓ 3 , 𝑘 𝑙 2 𝑘 ě ℓ 2 , 𝑘 𝑟 1 𝑘 ě ℓ 3 `ℓ2 , 𝑘 𝑙 1 𝑘 ě ℓ 1 Root 𝑘 " 𝑘 1 `𝑘2 `𝑘3 `𝑘1 3 𝒯 1 𝑘 1 " 𝑘 𝑟 1 `𝑘𝑙 1 , ℓ 1 , 𝑢 1 " ℓ 3 `ℓ2 𝑢 1 ď 𝑘 𝑟 1 𝑘 , ℓ 1 ď 𝑘 𝑙 1 𝑘 , 2𝑟 1 " 𝑘 1 𝑘 ´ℓ1 𝒯 2 𝑘 2 " 𝑘 𝑟 2 `𝑘𝑙 2 , ℓ 2 , 𝑢 2 " ℓ 3 𝑢 2 ď 𝑘 𝑟 2 𝑘 , ℓ 2 ď 𝑘 𝑙 2 𝑘 , 2𝑟 2 " 𝑘 2 𝑘 ´ℓ2 𝒯 3 𝑘 3 , ℓ 3 , 𝑢 3 " 0 ℓ 3 ď 𝑘 3 𝑘 , 2𝑟 3 " 𝑘 3 𝑘 ´ℓ3 𝒯 1 3 𝑘 1 3 , ℓ 1 3 " 𝑘 1 3 𝑘 Figure 6
.11: Generic main branch for an optimal extended merging tree, with 4 levels.

(C5) 𝑡 ě 1 𝑘 max ´𝑘3 , 𝑘 𝑟 2 , 𝑘 𝑙 2 , 𝑘 𝑙 1 , 𝑘 𝑟 1
We will first obtain the lower bound 2 7 for 𝑡. By combining (C1) with (C4), we get: 𝑡 ě 1 2 `1 ´𝑘1 𝑘 ˘. Next, we know that 𝑡 ě 𝑘 3 𝑘 , and that 𝑘 2 𝑘 "

𝑘 𝑟 2 𝑘 `𝑘𝑙 2 𝑘 ě ℓ 2 `ℓ3
. By combining this with (C1) we obtain: 𝑡 ě 1 2 p1 ´ℓ1 ´𝑘2 𝑘 q. We add this with (C3) to get: 4𝑡 ě 1 `𝑘1 ´𝑘2 𝑘 . Summing (C1) with (C2), we eliminate ℓ 2 , replace ℓ 3 , use 𝑡 ě 1 2 `1 ´𝑘1 𝑘 to eliminate ℓ 1 and obtain: 8𝑡 ě 1 `3𝑘 1 `𝑘2 ´𝑘3 𝑘 . Hence, we have four constraints that depend only on 𝑘 1 , 𝑘 2 , 𝑘 3 :

8𝑡 ě 1 `3𝑘 1 `𝑘2 ´𝑘3 𝑘 2𝑡 ě 1 ´𝑘1 𝑘 4𝑡 ě 1 `𝑘1 ´𝑘2 𝑘 𝑡 ě 𝑘 3 𝑘 . (6.9)
Taking an appropriate linear combination yields 𝑡 ě 2 7 . For 𝑘 " 7, it is possible to realize this optimum by setting 𝑘 1 " 3, 𝑘 2 " 2, 𝑘 3 " 2. In other words, the list ℓ 1 3 is actually empty and not used; the main branch collapses to a length 3 only. We obtain the unique 7-XOR example mentioned above.

If we reduce the depth by 1, we remove one subtree and obtain similar constraints:

𝑡 ě 𝑘 2 𝑘 2𝑡 ě 1 ´𝑘1 𝑘 4𝑡 ě 1 `𝑘1 ´𝑘2 𝑘 .
(6.10) Summing all three of them gives 7𝑡 ě 2 again, which suggests that a main branch with three levels may actually be enough. This is what we prove next: minimizing 𝑡 under the constraints of Equation (6.9) cannot give a better result than under the constraints of Equation (6.10). A similar result will follow for any depth.

Lemma 6.5. Let 𝑘 1 , 𝑘 2 , 𝑘 3 be integers such that 𝑘 1 `𝑘2 `𝑘3 ď 𝑘. We have:

max ˆ𝑘3 𝑘 , 1 2 ˆ1 ´𝑘1 𝑘 ˙, 1 4 ˆ1 `𝑘1 ´𝑘2 𝑘 ˙, 1 8 ˆ1 `3𝑘 1 `𝑘2 ´𝑘3 𝑘 ˙ě min 𝑘 1 ,𝑘 2 PN 2 ,𝑘 1 `𝑘2 ď𝑘 ˆmax ˆ1 4 ˆ1 `𝑘1 ´𝑘2 𝑘 ˙, 1 2 ˆ1 ´𝑘1 𝑘 ˙, 𝑘 2 𝑘 ˙˙.
Proof. On the right, we choose the same 𝑘 1 and 𝑘 2 as on the left. Since 𝑘 1 `𝑘2 `𝑘3 ď 𝑘, the constraint 𝑘 1 `𝑘2 ď 𝑘 is trivially satisfied. Removing one of the terms of the left hand side, we will show that: max

ˆ𝑘3 𝑘 , 1 2
ˆ1 ´𝑘1 𝑘 ˙, 1 4
ˆ1 `𝑘1 ´𝑘2 𝑘 ˙ě max ˆ1 4 ˆ1 `𝑘1 ´𝑘2 𝑘 ˙, 1 2 ˆ1 ´𝑘1 𝑘 ˙, 𝑘 2 𝑘 ˙,
which implies the statement of the Lemma. We separate two cases.

• If 𝑘 3 𝑘 ě 1 2 `1 ´𝑘1 𝑘 ˘: this implies 2𝑘 3 ě 𝑘 ´𝑘1 , that is, 𝑘 3 ě 𝑘 ´𝑘1 ´𝑘3 ě 𝑘 2 . Thus, we have 𝑘 3 𝑘 ě 𝑘 2
𝑘 and the result follows. • Otherwise, the same result follows trivially. By Lemma 6.5, we cannot obtain better merging trees by increasing the depth of the main branch. Finally, we show that the constraints (6.10) are necessary and sufficient: given a choice of 𝑘 1 , 𝑘 2 , we exhibit merging trees that reach the prescribed complexity. These trees are those given in Theorem 6.3. Lemma 6.6. Let 𝑘 1 , 𝑘 2 be such that 𝑘 1 `𝑘2 ď 𝑘. Then there exists an extended merging tree algorithm solving Unique 𝑘-XOR in time:

𝑡 " max ˆ𝑘2 𝑘 , 1 2
ˆ1 ´𝑘1 𝑘 ˙, 1 4
ˆ1 `𝑘1 ´𝑘2 𝑘 ˙˙. (6.11)
Proof. First of all, consider the case 𝑘 1 ď 𝑘 2 , i.e., the subtree at level 2 is bigger than the subtree at level 1. This implies in particular 𝑡 ě 𝑘 2 𝑘 ě 𝑘 1 𝑘 and 𝑡 ě 1 2 p1 ´𝑘1 𝑘 q, thus 𝑡 ě 1 3 : this is unlikely to be a good parameter choice. In that case, we must find 𝑡 ď max `𝑘2 𝑘 , 1 2 `1 ´𝑘1 𝑘 ˘˘. This is easily obtained with a trivial tree, that has only two subtrees: one is obtained by the product of 𝑘 1 lists (time 𝑘 1 𝑘 ď 𝑘 2 𝑘 ), and the other is an exhaustive search over all 𝑘 ´𝑘1 remaining lists, in time 1 2 `1 ´𝑘1 𝑘 ˘. There are no repetitions. Notice that this is actually the optimal strategy for 𝑘 " 3, 6 with 𝑘 1 " 𝑘 2 " 𝑘 3 . So we can now suppose that 𝑘 1 ě 𝑘 2 . We notice that:

1 2 ˆ1 ´𝑘1 𝑘 ˙ě 1 4 ˆ1 `𝑘1 ´𝑘2 𝑘 ˙ðñ 1 ´2𝑘 1 𝑘 ě 𝑘 1 ´𝑘2 𝑘 ðñ 𝑘 ě 3𝑘 1 ´𝑘2 . 𝑘 𝒯 1 , 𝑘 1 ℓ 1 " 𝑘´𝑘 1 ´𝑘2 2𝑘 , 𝑢 1 " ℓ 2 " 𝑘 2 𝑘 ℓ 𝑟 1 " 𝑘 2 𝑘 No prefix ℓ 𝑙 1 " 𝑘´𝑘 1 ´𝑘2 2𝑘 No prefix 𝒯 2 , 𝑘 2 ℓ 2 " 𝑘 2 𝑘 No prefix 𝒯 3 𝑘 3 " 𝑘 ´𝑘1 ´𝑘2 Figure 6
.12: Tree of Lemma 6.6.

So we next focus on the case 𝑘 ď 3𝑘 1 ´𝑘2 and we try to obtain a complexity 𝑡 ď max `𝑘2

𝑘 , 1 4 `1 `𝑘1 ´𝑘2 𝑘 ˘˘. The merging tree that we use is drawn in Figure 6.12. We attach two subtrees of width 𝑘 2 and 𝑘 1 to the main branch, there remains a subtree of width 𝑘 ´𝑘1 ´𝑘2 to explore exhaustively. We build the subtree 𝒯 2 in time 𝑘 2 𝑘 , externally, by constructing the product of 𝑘 2 lists. Then we repeat 𝒯 1 , which builds a list of size

ℓ 1 " 𝑘´𝑘 1 ´𝑘2 2𝑘 .
With our choice of parameters, we have to iterate:

1 2 ˆ𝑘1 𝑘 ´ℓ1 ˙" 1 4𝑘 p2𝑘 1 ´𝑘 `𝑘1 `𝑘2 q " 1 4𝑘 p3𝑘 1 `𝑘2 ´𝑘q
times, which is positive, since 𝑘 ď 3𝑘 1 ´𝑘2 ď 3𝑘 1 `𝑘2 . In each iteration, we build the subtree 𝒯 1 in time ℓ 1 and exhaust the subtree 𝒯 3 with quantum search, with the same time. Thus, the total time complexity is given by:

𝑡 " max ˆ𝑘2 𝑘 , 1 2 ˆ𝑘1 𝑘 `ℓ1 ˙˙" max ˆ𝑘2 𝑘 , 1 4
ˆ1 `𝑘1 ´𝑘2 𝑘 ˙˙.
Finally, in the case 3𝑘 1 `𝑘2 ď 𝑘, we notice that 3𝑘 1 ď 𝑘 implies 1 2 `1 ´𝑘1 𝑘 ˘ě 1 3 , as it happened before for the case 𝑘 1 ď 𝑘 2 . Further, 1 2 `1 ´𝑘1 𝑘 ˘ě 𝑘 1 𝑘 . The same strategy works: we build an intermediate subtree with a product of 𝑘 1 lists, in time 𝑘 1 𝑘 , then look for a collision on it with a single quantum search in the product of the 𝑘 ´𝑘1 remaining lists.

Thus, regardless the choice of 𝑘 1 and 𝑘 2 , we can meet the time complexity given by Equation (6.11).

Finally, we observe that the minimization over 𝑘 1 , 𝑘 2 of this quantity gives the formula of 𝛾 𝑘 of Theorem 6.3, finishing the proof of the theorem:

min 𝑘 1 ,𝑘 2 PN 2 𝑘 1 `𝑘2 ď𝑘 max ˆ𝑘2 𝑘 , 1 2
ˆ1´𝑘 1 𝑘 ˙, 1 4
ˆ1 `𝑘1 ´𝑘2 𝑘 ˙˙" 𝑘 `X 𝑘`6 7 \ `X 𝑘`1 7 \ ´X 𝑘 7 \ 4𝑘 .
The minimum can be reached by choosing:

# 𝑘 1 " X 3𝑘 7 T 𝑘 2 " X 2𝑘 7 \ ´X 𝑘´1 7 \ `X 𝑘´2 7 \ , where X 3𝑘 7 T
is the integer that is closest to 3𝑘 7 . We have obtained the tree structure given in Figure 6.8 and Algorithm 6.10 and proven its optimality among merging trees.

Optimizing the Time-Memory Product

In the case where the optimization goal is the time-memory product, we will also be able to restrict the space of possible trees and obtain simpler constraints. Let us follow the proof for the time optimization and amend it where necessary. Lemma 6.2 can be used unchanged, since adding the memory does not change the optimization of the formulas. Next, we find that: Lemma 6.7. In the time-memory product optimization of Problem 6.2, the memory used is 2 𝑛{𝑘 . Proof (informal). We use at least 2 𝑛{𝑘 memory since this is required to store the lists. If some list in the tree was bigger than that, we would be able to reduce it and transfer this complexity to a repetition loop. This can only improve the time complexity. Thus, only algorithms with little memory may be optimal for the time-memory product. We can write down the shape of an optimal tree as follows:

• It has a main branch with 𝑝 levels, subtrees 𝒯 𝑖 , and 𝒯 𝑝 is a leaf node with 𝑢 𝑝 " 0.

Each 𝒯 𝑖 is of width 𝑘 𝑖 , and the 𝑘 𝑖 decrease (otherwise, exchanging two of the subtrees would reduce the time complexity).

• At level 𝑝 on the left, there is a subtree 𝒯 1 𝑝 which is of width 𝑘 1 𝑝 , with

ř 𝑝 𝑖"1 𝑘 𝑖 `𝑘1 𝑝 " 𝑘 .
• Each 𝒯 𝑖 induces a repetition loop with 𝑟 𝑖 " 1 2 ´𝑘𝑖 𝑘 ´ℓ𝑖 ¯. Since the ℓ 𝑖 are of size 1 𝑘 at most, and 𝑘 𝑖 decreases with 𝑖, the number of repetitions decreases with 𝑖.

• @𝑖, ℓ 𝑖 ď 1 𝑘 and 𝑢 𝑖´1 " 𝑢 𝑖 `ℓ𝑖 (as before), so we still have 𝑢 𝑖 "

ř 𝑝 𝑗"𝑖`1 ℓ 𝑗 . Furthermore 𝑢 𝑖 `ℓ𝑖 ď 𝑘 𝑖 𝑘 .
Thus the time complexity 𝑡 satisfies the constraints:

$ ' ' & ' ' % @𝑖, 1 𝑘 ě ℓ 𝑖 ě 0, 𝑘 𝑖 𝑘 ě ř 𝑝 𝑗"𝑖 ℓ 𝑗 𝑡 ě ř 𝑖 𝑟 𝑖 `1 2 ´1 ´ř𝑖 𝑘 𝑖 𝑘 ¯" 1 2 p1 ´ř𝑖 ℓ 𝑖 q @1 ď 𝑖 ď 𝑝 ´1, 𝑡 ě ´ř𝑖 𝑗"1 𝑟 𝑗 ¯`1 2 max ´př 𝑝 𝑗"𝑖`1 ℓ 𝑗 q ´tlog 2 𝑘 𝑖 u 𝑘 , 0 ¯`ℓ 𝑖 (6.12)
Contrary to the previous minimization, we will find that the depth of the tree increases with 𝑘, and the merging is not as trivial as before. By bounding the ℓ 𝑖 , we obtain that 𝑘 1 𝑘 ě ř 𝑝 𝑗"1 ℓ 𝑗 and 𝑝 𝑘 ě ř 𝑝 𝑗"1 ℓ 𝑗 . Thus, 𝑡 is lower bounded by:

𝑡 ě 1 2 ˆ1 ´max ˆ𝑘1 𝑘 , 𝑝 𝑘 ˙˙.
This is to say, the tree should have the bigger depth possible, while at the same time, having the widest possible subtree at level 1. In practice, we observe that the constraints (6.12) are sufficient to obtain the best trees. The successive 𝑘 𝑖 are strictly decreasing, except in some cases. We can still find optimal trees by enforcing: |𝑘 𝑖`1 ´𝑘𝑖 | ď 1, and forbidding to have three successive equal 𝑘 𝑖 , which reduces greatly the search space.

Both 𝑘 1 and the number of levels in the tree are of order 𝒪 `?𝑘 ˘.

Applications

In this section, we elaborate on different problems that can be reduced to 𝑘-XOR or 𝑘-SUM. We show that, more generally, the optimal algorithms that we presented above apply to the class of bicomposite problems studied by Dinur, Dunkelman, Keller, and Shamir [START_REF] Dinur | Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems[END_REF].

Bicomposite Problems

The classical Dissection algorithms of [START_REF] Dinur | Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems[END_REF] are not formulated as Unique 𝑘-XOR algorithms, although they can be used in this context. They solve a slightly more general problem that we will now define. In this definition, the notation 𝑟 assumes the same role as 𝑘.

Problem 6.3 (𝑟-composite search). Let p𝑋 𝑖 , 1 ď 𝑖 ď 𝑟 `1q be a family of 𝑟 `1 finite sets of same cardinality (say, 2 𝑛 for some parameter 𝑛). Let ℱ 1 , . . . , ℱ 𝑟 be 𝑟 families of functions: 𝑓 𝑖 P ℱ 𝑖 : 𝑋 𝑖 Ñ 𝑋 𝑖`1 , e.g., permutations or random functions, with the same cardinality 2 𝑛 . Let p𝑥 1 1 , . . . , 𝑥 1 𝑟 q P 𝑋 1 and p𝑥 𝑟`1 1 , . . . , 𝑥 𝑟`1 𝑟 q P 𝑋 𝑟`1 . Find 𝑓 1 P ℱ 1 , . . . , 𝑓 𝑟 P ℱ 𝑟 such that: @𝑖, p𝑓 𝑟 ˝. . . ˝𝑓1 qp𝑥 1 𝑖 q " 𝑥 𝑟`1 𝑖 .

In other words, we are given lists of transitions (the families ℱ 𝑖 ) that act on 𝑟 inputs (the 𝑥 1 𝑖 ), and we want to find a sequence of such transitions that brings these inputs to 𝑟 given targets. The bicomposite nature of this problem comes from the orthogonality between the choices of the transitions and the targets. For example, assume that 𝑥 𝑖`1 1 , . . . , 𝑥 𝑖`1 𝑖 are given, then we can find immediately the sequence of 𝑖 transitions 𝑓 𝑖 ˝. . . ˝𝑓1 that lead to these values: it is not necessary to guess the full tuple 𝑥 𝑖`1 1 , . . . , 𝑥 𝑖`1 𝑟 . Remark 6.7. This property of partial guesses is the only one necessary for the definition of the problem, not that the 𝑓 𝑖 are permutations or random functions.

A prominent example of a bicomposite problem is the case where all the 𝑓 𝑖 are permutations: this is the multiple-encryption problem. Problem 6.4 (𝑟-encryption). Let 𝐸 1 , . . . , 𝐸 𝑟 be 𝑟 block ciphers on 𝑛 bits, indexed by key spaces of the same size 2 𝑛 . Assume that we are given 𝑟 plaintext-ciphertext pairs p𝑝 𝑖 , 𝑐 𝑖 q, encrypted by the composition of the 𝐸 𝑖 under a sequence of independent keys 𝑘 1 , . . . , 𝑘 𝑟 : @𝑖, 𝑐 𝑖 " `𝐸𝑟 𝑘𝑟 ˝. . . ˝𝐸1 𝑘 1 ˘p𝑝 𝑖 q , then retrieve 𝑘 1 , . . . , 𝑘 𝑟 .

The number of given plaintext-ciphertext pairs is enough to discriminate the good sequence of keys with constant probability, as each key is of 𝑛 bits and each plaintext is of 𝑛 bits.

Relation with 𝑘-XOR. The Unique 𝑘-XOR and 𝑘-SUM problems are naturally 𝑘-composite, and any algorithm that solves 𝑘-composite problems will also solve them. Proposition 6.4. Unique 𝑘-XOR (with random input lists) can be reduced to 𝑘-composite search.

Proof. Given an instance of unique 𝑘-XOR, with 𝑘 lists ℒ 1 , . . . , ℒ 𝑘 of 𝑛-bit strings, we are looking for 𝑦 1 P ℒ 1 , . . . , 𝑦 𝑘 P ℒ 𝑘 such that À 𝑖 𝑦 𝑖 " 0. In the asymptotic world, we assume that 𝑛 is divisible by 𝑘.

For all 1 ď 𝑖 ď 𝑘, we set 𝑥 1 𝑖 " p0 𝑛{𝑘 , 𝑖 ´1q. We then define the families of functions ℱ 1 , . . . , ℱ 𝑘 as follows: for each 𝑗, 𝑓 𝑗 P ℱ 𝑗 is the addition of some bits of some element 𝑦 𝑗 P ℒ 𝑗 . More precisely, the initial state: 𝑥 1 1 , . . . , 𝑥 1 𝑘 " p0 𝑛{𝑘 , 0q, p0 𝑛{𝑘 , 1q, p0 𝑛{𝑘 , 2q, . . . , p0 𝑛{𝑘 , 𝑘 ´1q will be transformed by 𝑓 1 by adding the 𝑛{𝑘 first bits of 𝑦 1 to 𝑥 1 1 , the 𝑛{𝑘 second bits to 𝑥 1 2 , etc. Since the lists are assumed to contain random bit-strings, the knowledge of partial intermediate states is enough to know which elements 𝑦 𝑗 led to these values.

It is interesting to notice that the bicomposite nature of the problem stems from our capacity to divide our intermediate state 𝑥 𝑖 , which is an 𝑛-bit string, into a product of 𝑘 strings of 𝑛{𝑘 bits. This is also the case in the 𝑟-encryption problem, since 𝑟 tplaintext, ciphertextu pairs are given. A 𝑘-composite algorithm applied to the problem will make some guesses for partial intermediate states, which correspond to merging the lists ℒ 𝑖 with arbitrary prefixes. In contrast, the commutativity of the `or ' operations is not necessary. For example, given a permutation 𝜎 P 𝑆 𝑛 , finding a composition of 𝑟 permutations 𝜎 𝑖 of 𝑆 𝑛 such that 𝜎 𝑟 ˝. . . ˝𝜎1 " 𝜎 is an 𝑟-composite problem.

This relation goes the other way. Instead of trying to prove a full-fledged correspondence between unique 𝑟-XOR algorithms of our framework and 𝑟-composite problems, we can focus on the optimal algorithms presented in Section 6.1.6. For simplicity, we consider a single family of permutations ℱ, of size 2 𝑛 , although this works as well with 𝑟 families and for one-way functions. We write down Algorithm 6.11. Its time complexity is computed with the same formula as the 𝑘-XOR variant. Algorithm 6.11 Quantum 𝑟-composite search.

Input: two 𝑟-tuples 𝑥 1 " p𝑥 1 1 , . . . , 𝑥 1 𝑟 q and 𝑥 𝑟`1 " p𝑥 𝑟`1 1 , . . . , 𝑥 𝑟`1 𝑟 q, a family of permutations ℱ indexed by a "key" 𝑘 P 𝐾, with quantum oracle access to:

𝑥, 𝑘 Þ Ñ 𝑓 𝑘 p𝑥q
Output: a sequence of "keys" 𝑘 1 , . . . , 𝑘 𝑟 such that 𝑥 1 is mapped to 𝑥 𝑟`1 by 𝑓 𝑘𝑟 ˝. . . ˝𝑓𝑘 1 1: Select 𝑟 1 , 𝑟 2 with Equation 6.5 2: Build a list ℒ 1 :

ℒ 1 " tp𝑓 𝑘𝑟 2 ˝. . . ˝𝑓𝑘 1 qp𝑥 1 q, 𝑘 𝑟 2 , . . . , 𝑘 1 P 𝐾u Ź Thus, the list contains all possible choices for the 𝑟 2 first steps 3: Build a list ℒ 3 : EndSample 17: EndSample Theorem 6.5. For any 𝑟 ě 2, let 𝛾 𝑟 be the optimal time complexity exponent for unique 𝑟-XOR with merging trees, given by Theorem 6.3. Then there exists a quantum algorithm for 𝑟-composite search, with domain size 2 𝑛 , of time complexity 𝒪p2 𝛾𝑟𝑟𝑛 q.

ℒ 3 " tp𝑓 ´1 𝑘 𝑟´𝑟 2 ˝. . . ˝𝑓 ´1 𝑟 qp𝑥 𝑟`1 q, 𝑘 𝑟´𝑟 2 `1, . . . ,

Solving the Multiple-encryption Problem

We now focus on Problem 6.4. Classically, the best time complexity to date is essentially 𝒪 `2r𝑟{2s𝑛 ˘and the question is to obtain better time-memory trade-offs than a simple meet-in-the-middle approach, as it is the case in [START_REF] Dinur | Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems[END_REF]. Let us start with the example of Schroeppel and Shamir's algorithm, that can be used to solve 4-encryption, as done in [START_REF] Dinur | Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems[END_REF], in time 𝒪 `22𝑛 ˘and memory 𝒪p2 𝑛 q. For ease of notation, we assume that the successive encryption functions are the same block cipher 𝐸, with blocks and keys of 𝑛 bits. Notice that in Algorithm 6.12, decryptions are required. However, if we replaced 𝐸 by a one-way function, we could tabulate its inverse. Algorithm 6.12 Schroeppel and Shamir's algorithm for 4-encryption.

Input: 4 plaintext-ciphertext pairs p𝑝 𝑖 , 𝑐 𝑖 q which form each an 𝑛-bit condition Output: 4 𝑛-bit keys 𝑘 1 , 𝑘 2 , 𝑘 3 , 𝑘 4 such that 𝐸 𝑘 4 ˝𝐸𝑘 3 ˝𝐸𝑘 2 ˝𝐸𝑘 1 p𝑝 𝑖 q " 𝑐 𝑖 1: for all Intermediate state 𝑠 of 𝑛 bits do 2:

Compute the list ℒ 𝑠 12 of all keys p𝑘 1 , 𝑘 2 q such that 𝐸 𝑘 2 ˝𝐸𝑘 1 p𝑝 1 q " 𝑠 Ź ℒ 𝑠 12 is of average size 2 𝑛 3:

Compute also 𝐸 𝑘 2 ˝𝐸𝑘 1 p𝑝 𝑖 q for the other plaintexts 4:

Compute the list ℒ 𝑠 34 of all keys p𝑘 3 , 𝑘 4 q such that 𝐸 𝑘 4 ˝𝐸𝑘 3 p𝑠q " 𝑐 1

5:

Compute also p𝐸 𝑘 4 ˝𝐸𝑘 3 q ´1p𝑐 𝑖 q for the other ciphertexts 6:

Find p𝑘 1 , 𝑘 2 q P ℒ 𝑠 12 and p𝑘 3 , 𝑘 4 q P ℒ 𝑠 34 such that all values in the middle match 7:

if there exists such a solution then Ź Happens for a single 𝑠 8:

return the sequence of keys Results in the quantum setting. Classically, using more but smaller keys makes the problem easier from the point of view of memory complexity. The best known algorithms do not obtain a better time than the simple meet-in-the-middle technique.

In the quantum setting, this will be different.

In [START_REF] Kaplan | Quantum attacks against iterated block ciphers[END_REF], Kaplan proves that 2-encryption is (quantumly) equivalent to element distinctness. For 𝑟 " 4, it must be remarked that the 4-XOR algorithm of [START_REF] Daniel | Quantum Algorithms for the Subset-Sum Problem[END_REF] cannot be used to attack 4-encryption. Indeed, in the quantum optimization of [START_REF] Daniel | Quantum Algorithms for the Subset-Sum Problem[END_REF], the size of the "intermediate value" that is guessed is not a multiple of 𝑛 bits. This has no consequence on the Unique 𝑘-XOR problem, but if we try to translate the algorithm to attack multiple-encryption, we cannot solve efficiently the smaller meet-in-the middle problems. It would require to produce efficiently (in time 2 0.8𝑛 ), from 2 0.8𝑛 choices of 𝑘 1 and 𝑘 2 , the list of 2 0.8𝑛 pairs 𝑘 1 , 𝑘 2 such that 𝐸 𝑘 1 ˝𝐸𝑘 2 p𝑝q has some fixed 0.8𝑛-bit prefix.

Thus, the best quantum algorithm for 4-encryption to date (𝒪 `25𝑛{4 ˘for 4 keys of 𝑛 bits) is given by Algorithm 6.13, which adapts Algorithm 6.7. Algorithm 6.13 Quantum 4-encryption algorithm.

Input: 4 plaintext-ciphertext pairs p𝑝 𝑖 , 𝑐 𝑖 q which form each an 𝑛-bit condition Output: 4 𝑛-bit keys 𝑘 1 , 𝑘 2 , 𝑘 3 , 𝑘 4 such that 𝐸 𝑘 4 ˝𝐸𝑘 3 ˝𝐸𝑘 2 ˝𝐸𝑘 1 p𝑝 𝑖 q " 𝑐 𝑖 1: Compute 𝐸 ´1 𝑘 2 p𝑐 1 q for all 𝑘 2 2: for all Intermediate state 𝑠 of 𝑛 bits do 3: for all 𝑥 of 𝑛{2 bits do 4:

Compute the list ℒ 𝑠

12 of all keys p𝑘 1 , 𝑘 2 q such that 𝐸 𝑘 2 ˝𝐸𝑘 1 p𝑝 1 q " 𝑠 and 𝑘 1 has prefix 𝑥 Ź ℒ 𝑠 12 is of average size 2 𝑛{2 5:

Encrypt the other plaintexts 6:

for all 𝑘 3 do 7:

Find 𝑘 4 such that 𝐸 𝑘 3 p𝑠q " 𝐸 ´1 𝑘 4 p𝑐 1 q Ź We now have that 𝐸 𝑘 4 ˝𝐸𝑘 3 ˝𝐸𝑘 2 ˝𝐸𝑘 1 p𝑝 1 q " 𝑐 1 for each 𝑘 1 , 𝑘 2 in ℒ 𝑠 12 8:

Decrypt the other ciphertexts with 𝑘 3 , 𝑘 4

9:

Find if there exists 𝑘 1 , 𝑘 2 in ℒ 𝑠 12 such that the intermediate states match.

For other values of 𝑟, the correspondence with 𝑟-XOR gives the best quantum time complexities known for 𝑟-encryption, and shows that contrary to the classical setting, the time complexity decreases significantly with respect to 2-encryption.

Improved Quantum Time-Memory Trade-off for Subsetsums

The random subset-sum problem is the following.

Problem 6.5. Given 𝑎 1 , . . . , 𝑎 𝑛 , 𝑡 chosen uniformly at random from Z ℓ , find a subset of indices 𝐼 Ă t1, . . . , 𝑛u such that ř 𝑖P𝐼 𝑎 𝑖 " 𝑡 mod 2 ℓ . The hardness of this problem is related to the density 𝑛{ℓ. When ℓ " 𝑝𝑜𝑙𝑦p𝑛q, i.e., the density is close to 1, we expect a single solution with high probability. Finding this solution can be recast as a 𝑘-SUM problem for any 𝑘. Indeed, it suffices to separate the set t1, . . . , 𝑛u into 𝑘 disjoint parts 𝐽 1 Y . . . Y 𝐽 𝑘 and to start from the lists 𝐿 1 , . . . , 𝐿 𝑘 , with list 𝐿 𝑗 containing all the sums ř 𝑖P𝐼 𝑎 𝑖 for 𝐼 Ă 𝐽 𝑗 (we may assume that 𝑛 is a multiple of 𝑘 for this purpose).

The best classical worst-case algorithm for subset-sum known is Schroeppel and Shamir's algorithm. But in the case of random subset-sums, an algorithm with time r 𝒪 `20.337 ˘was given by Howgrave-Graham and Joux [START_REF] Howgrave | New Generic Algorithms for Hard Knapsacks[END_REF], later improved to r 𝒪 `20.291𝑛 by Becker, Coron, and Joux [START_REF] Becker | Improved Generic Algorithms for Hard Knapsacks[END_REF], then r 𝒪 `20.283𝑛 ˘ [Bon+20]. Quantum algorithms for the problem include those of [Ber+13; HM18] and [Bon+20]. The best quantum time complexity given in [Bon+20] is r 𝒪 `20.216𝑛 ˘, using as much QRAQM.

Using the extended merging trees for 𝑘-SUM, we can reach a better quantum timememory product (this was also the case in [START_REF] Dinur | Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems[END_REF] for classical algorithms). We have seen that 𝑘 " 17 minimizes the time-memory product, with a time 𝒪 `26𝑛{17 ˘and a memory 2 𝑛{17 . The product is 𝒪 `27𝑛{17 ˘" 𝒪 `20.4118𝑛 ˘, which is less than the exponent 0.423𝑛 obtained with the dedicated methods.

Quantum Algorithms for LPN and LWE

Merging algorithms can be used in the context of Learning Parity with Noise (LPN). Problem 6.6 (Learning Parity with Noise (in dimension 𝑛)). We can query noisy samples of the form p𝑎, 𝑎 ¨𝑠 ' 𝑒q where 𝑠 P t0, 1u 𝑛 is a secret, 𝑎 P t0, 1u 𝑛 is chosen uniformly at random and 𝑒 P t0, 1u is a Bernoulli noise: 𝑒 " 𝐵𝑒𝑟 𝑝 , i.e., Prp𝑒 " 1q " 𝑝 for some constant error rate 𝑝. We must find 𝑠.

Learning With Errors (LWE) is a generalization of LPN from F 2 to F 𝑞 for some prime 𝑞. The hardness of this problem for classical and quantum computers underlies several proposals in the NIST PQC project.

In [START_REF] Blum | Noise-tolerant learning, the parity problem, and the statistical query model[END_REF], Blum, Kalai, and Wasserman introduced an algorithm solving LPN in time 𝒪 `2𝑛{ log 𝑛 ˘, using 2 𝑛{ log 𝑛 samples. Their idea is to combine samples: given p𝑎 1 , 𝑎 1 ¨𝑠 ' 𝑒 1 q and p𝑎 2 , 𝑎 2 ¨𝑠 ' 𝑒 2 q one can compute p𝑎 1 ' 𝑎 2 , p𝑎 1 ' 𝑎 2 q ¨𝑠 ' 𝑒 1 ' 𝑒 2 q. This combination brings the noise closer to uniform, as prescribed by the Piling-Up Lemma. Lemma 6.8 (Adding Bernoulli noises). Let 𝑒 1 , . . . , 𝑒 𝑘 " 𝐵𝑒𝑟p𝑝q be Bernoulli noises of correlation 𝜖 " 1 ´2𝑝. Then 𝑒 1 ' . . . ' 𝑒 𝑘 " 𝐵𝑒𝑟p𝑝 𝑘 q is a Bernoulli noise of correlation 𝜖 𝑘 , that is, 𝑝 𝑘 " 1 2 `1 ´p1 ´2𝑝q 𝑘 ˘.

The goal is to produce sufficiently many sums of 𝑎 𝑖 with almost all bits to zero, so that one can learn a bit of 𝑠 from the samples gathered. If there was no noise, this would require 2 ? 𝑛 samples with Wagner's algorithm. However, the noise limits the number of samples that we can sum together. The same principle applies to LWE, although we focus on LPN for simplicity.

In its original version, the BKW algorithm uses 2 𝑛{ log 𝑛 samples and memory. It starts from the list of samples and repeatedly finds partial collisions, canceling 𝑛{ log 𝑛 bits in the 𝑎 𝑖 , until it produces a list of 2 𝑛{ log 𝑛 samples with a single nonzero bit. Thus, the algorithm can be seen as a binary merging tree with log 𝑛 levels.

The 𝑐-sum-BKW algorithm is a variant proposed by Esser et al. [START_REF] Esser | Dissection-BKW[END_REF], that combines 𝑐 ą 2 samples at a time, and replace the 2-list merges in BKW by a 𝑐list algorithm. This allows to reduce the memory used, which is crucial for practical implementations of the BKW algorithm. This also reduces the number of samples: we start from a smaller list. The 𝑐-sum-BKW algorithm is built upon the 𝑐-SUM-Problem as defined in [Ess+18, Definition 3.1]:

Given a list ℒ of 𝑁 uniformly random 𝑏-bit strings, given 𝑡 P t0, 1u 𝑛 , find at least 𝑁 distinct 𝑐-tuples of elements of ℒ that XOR to 𝑡.

They use the Dissection algorithms, with a memory limited to 𝑁 . They also prove that: . Theorem 6.6 applies even if the building block is a quantum algorithm. The authors proposed to solve 𝑐-SUM with a naive Grover search in the QRACM model: they store ℒ in QRACM and perform a Grover search on all 𝑐 ´1 tuples of ℒ, for those who XOR to an element of ℒ. The memory used is 𝑁 . As the parameters are tailored for 𝑁 solutions in total, the quantum time complexity is 𝑁 𝑐{2´1 for a single solution and 𝑁 𝑐{2 for all of them.

Better trade-offs. We can answer the open question of [Ess+18, Section 1] and improve the quantum-BKW algorithm with our new optimizations. We are in a situation in which the input list is of size 𝑁 𝑐 and there are 𝑁 𝑐 solutions to recover. It is as if we were solving a 𝑐-XOR problem on 𝑛 bits with 𝑐 lists of size 𝑁 𝑐 " 2 𝑛{p𝑐´1q each, and wanted all the 2 𝑛{p𝑐´1q expected solutions. Furthermore, we limit the memory (QRAQM or QRACM) used to 𝑁 𝑐 . We simply solve the problem r 𝒪 `2𝑛{p𝑐´1q ˘times, as in the naive Grover case.

Discussion

In Chapter 5 and this chapter, we have seen that some merging problems (𝑘-XOR, 𝑘-SUM or bicomposite) can benefit from a significant quantum speedup. However, this class of quantum merging algorithms contains many counterintuitive speedups, and we managed to explore them only thanks to an automatic search for merging strategies, which provided us with some intuition for the best strategies.

While it is easy to account for these algorithms after having found them, we can only claim their optimality up to the constraints which were used in the search. In particular, removing only a little constraint from [NS20] allowed us to obtain the exponent 2 7 , which sets at 𝒪 `22𝑛{7 ˘the lowest time complexity for Unique 𝑘-XOR, for any 𝑘.

Open Problem 6.1. Can we extend further the search space, and reach an exponent below 2 7 ? Again remains the question whether other families of quantum algorithms, for example, quantum walks, could reach better complexities. Even the quantum walk for 4-XOR of [START_REF] Daniel | Quantum Algorithms for the Subset-Sum Problem[END_REF] is beaten by quantum merging when 𝑘 is a multiple of 4 greater than 20, as our exponent converges towards 2 7 .

Open Problem 6.2. Does better quantum algorithms for 𝑘-XOR exist, not based on the quantum merging framework, for a generic 𝑘?

We conjecture that this should be true at least in the single-solution case, because quantum walks offer generally an incompressible speedup when the sizes of the lists to merge are very constrained: this is what happens for 𝑘 " 4, and this is also what we observed when comparing quantum walks and quantum merging in the case of the dense subset-sum problem [Bon+20].

Chapter 7 The Offline Simon's Algorithm

This chapter is dedicated to the Offline Simon's Algorithm, that we introduced in [Bon+19], and its applications. This new quantum algorithm is dedicated to keyrecovery attacks against symmetric cryptographic constructions, including some of those seen in Chapter 4. It provides the first application of Simon's algorithm in the Q1 setting, solving a problem that had remained open since the dawn of Q2 attacks, and showing that the structure behind quantum polynomial-time attacks in the Q2 setting can also be leveraged with classical queries only.

We give a presentation of this algorithm different from [Bon+19], that emphasizes its similarities with the Grover-meets-Simon attack of Leander and May. Next, we show how it improves the query complexity of some Q2 attacks, and how to apply it in the Q1 setting.

Contents

The Offline Simon's Algorithm

In the Grover-meets-Simon problem (Problem 4.1 in Section 4.1.5), we search a family of functions for the single periodic one. Our results in [Bon+19] focus on a variant of this problem, where the search space has additional structure.

Problem 7.1 (Asymmetric Search of a Period). Let 𝑓 : t0, 1u 𝑚 ˆt0, 1u 𝑛 Ñ t0, 1u ℓ and 𝑔 : t0, 1u 𝑛 Ñ t0, 1u ℓ be two functions. Assume that there exists exactly one 𝑖 0 P t0, 1u 𝑚 such that 𝑓 p𝑖 0 , ¨q'𝑔 has a hidden period, i.e.: @𝑥 P t0, 1u 𝑛 , 𝑓 p𝑖 0 , 𝑥q'𝑔p𝑥q " 𝑓 p𝑖 0 , 𝑥'𝑠q'𝑔p𝑥'𝑠q for some 𝑠. Find 𝑖 0 .

The formulation of Problem 7.1 captures most cryptanalytic scenarios such as the FX construction, and the algorithm presented in this chapter can improve Grover-meets-Simon in this context.

With this formulation, in the functions 𝑓 p𝑖, ¨q ' 𝑔, the function 𝑔 intervenes always in the same way. In Leander and May's Grover-meets-Simon algorithm, at each iteration of the search, we perform 𝒪p𝑛q new queries to 𝑔. But these queries are always the same: they produce a uniform superposition ř 𝑥 |𝑥y |𝑔p𝑥qy, before XORing 𝑓 p𝑖, 𝑥q into it and running Simon's algorithm.

Instead of re-constructing the same states ř 𝑥 |𝑥y |𝑔p𝑥qy at each iteration, and throwing them away, our idea is to make the queries to 𝑔 onces and for all, at the beginning of the search, and store these states.

Description of the Algorithm

We can represent our intuition with a single quantum circuit. Consider two successive iterations of the Grover search for 𝑖 0 , with a register for 𝑖 and ancilla registers required for the test. This test (Circuit 4.1) contains a call to the quantum operator QSimon and oracle calls to 𝑥 Þ Ñ p𝑓 𝑖 ' 𝑔qp𝑥q. These oracle calls are realized by first computing 𝑔p𝑥q in an output register, then XORing 𝑓 𝑖 p𝑥q into this register (we simply draw a box for this second step).

We draw these two iterations in Circuit 7.1. The successive tests use ancilla qubits initialized to |0 𝑛 y and put them back to this state. We remark that they do not need to. In fact, the operations in the dotted box (𝑂 𝑔 , then H, then H, then 𝑂 𝑔 ) are redundant, and they cancel out.

Thus, almost all queries to 𝑔 are removed from the algorithm, and they only need to be made at the beginning of the Grover search, in an offline manner. This changes dramatically our point of view: the ancilla qubits that were before put back to |0y at each iteration contain now the state:

|𝜓 𝑔 y " 𝑛`𝑟 â ÿ 𝑥 |𝑥y |𝑔p𝑥qy .
This state |𝜓 𝑔 y, that we name the 𝑔-database, contains all the information that we need about this function 𝑔. We summarize our procedure in Algorithm 7.1. Proof. The condition and proof are exactly the same as in the Grover-meet-Simon attack, since we simply remove the queries to 𝑂 𝑔 inside the algorithm. By Lemma 1.4, the condition (7.1) is satisfied for families of random functions of which a single one is a random periodic function. We can apply Theorem 4.1. In particular, our algorithm simply runs a Grover search as if QSimon was perfect, then measures and outputs a good result with high probability. Uncompute 𝑓

8:

Apply H b𝑚 𝑂 0 H b𝑚 on the first register 9: EndRepeat 10: Measure the index register 𝑖, return 𝑖

Consequence in the Q2 Setting

The obvious advantage of OfflineSimon in the context of Q2 attacks is to reduce drastically the number of queries required (although the time complexity is unchanged). In what follows, we consider that all conditions of Theorem 7.1 are met, and that 𝑚 " 𝒪p𝑛q.

Let us recall the FX construction:

FX 𝑘,𝑘 𝑖𝑛 ,𝑘𝑜𝑢𝑡 p𝑥q :" 𝐸 𝑘 p𝑥 ' 𝑘 𝑖𝑛 q ' 𝑘 𝑜𝑢𝑡 .

Then, similarly as in the Grover-meet-Simon attack, we consider:

𝑖, 𝑥 Þ Ñ FXp𝑥q ' 𝐸 𝑖 p𝑥q .

New Q1 Attacks based on Simon's Algorithm

Besides reducing the number of queries in Q2 attacks, we can use this algorithm to propose new improvements in the Q1 setting.

Using Classical Queries Only

The main idea involved here is to substitute the superposition queries to 𝑔 by classical queries, that we use to build artificially the 𝑔-database |𝜓 𝑔 y. A superposition on the whole domain of 𝑔 requires too many queries and is generally too expensive. But the structure of the problem will often allow us to exploit superpositions on a subset of the domain.

Lemma 7.1. Let 𝑔 : t0, 1u 𝑛 Ñ t0, 1u 𝑛 be any function computable in time polyp𝑛q. There exists a quantum procedure that creates ř 𝑥Pt0,1u 𝑛 |𝑥y |𝑔p𝑥qy using less than p2𝑛 ´3q2 𝑛 Toffoli gates, 𝑛2 𝑛 NOT gates, 𝑛2 𝑛 CNOT gates, 𝑛 ´1 ancillas qubits, 2 𝑛 classical evaluations of 𝑔 and only polyp𝑛q classical memory.

Proof. We reuse the same circuits as in QRACM emulation (Lemma 1.2). Indeed, building the state ř 𝑥Pt0,1u 𝑛 |𝑥y |𝑔p𝑥qy is the same task as performing a quantum randomaccess call to the codebook of 𝑔. Furthermore, as this codebook needs only to be read once, we shall not store it in classical memory.

Previously, we remarked that the algorithm was always performing the same queries to 𝑔, and we stored these queries in the 𝑔-database. We are now building the same state |𝜓 𝑔 y with mere classical access, confirming the asymmetry between 𝑔 and 𝑓 in the formulation of Problem 7.1. As only 𝑔 contains a secret, we are now falling in the Q1 setting.

Trade-offs for the Even-Mansour Construction

We have mentioned the Even-Mansour construction [START_REF] Even | A Construction of a Cipher from a Single Pseudorandom Permutation[END_REF] in Section 4.1.2. In the Q2 setting, it is broken in polynomial time due to its strong algebraic structure. The best Q1 time-data trade-off to date is 𝑇 2 ¨𝐷 " 2 𝑛 , and reaches a minimal 𝑇 " 2 𝑛{3 . But prior to our results, this trade-off required a massive use of QRACM. Trying to overcome this requirement gives the trade-offs of [START_REF] Hosoyamada | Cryptanalysis Against Symmetric-Key Schemes with Online Classical Queries and Offline Quantum Computations[END_REF].

New attack. We will now show how to obtain the trade-off 𝑇 2 ¨𝐷 " 2 𝑛 , the same as the attack of [START_REF] Kuwakado | Security on the quantum-type Even-Mansour cipher[END_REF], up to a polynomial factor, using only polyp𝑛q qubits and classical memory.

Contrary to previous work in the Q1 setting, we use the algebraic structure of the primitive. We artificially divide the 𝑛-bit key 𝑘 1 in 𝑘 p1q 1 of 𝑢 bits and 𝑘 p2q 1 of 𝑛 ´𝑢 bits, in order to obtain an instance of Problem 7.1. If we define 𝑓 : t0, 1u 𝑛´𝑢 ˆt0, 1u 𝑢 Ñ t0, 1u 𝑛 by 𝑓 p𝑖, 𝑥q " Πp𝑥}𝑖q and 𝑔 : t0, 1u 𝑢 Ñ t0, 1u 𝑛 by 𝑔p𝑥q " EM 𝑘 1 ,𝑘 2 p𝑥}0 𝑛´𝑢 q, then 𝑓 p𝑖, ¨q ' 𝑔 is periodic if and only if 𝑖 " 𝑘 p2q 1 , of period 𝑘 p1q 1 . Indeed:

𝑓 p𝑘 p2q 1 , 𝑥q ' 𝑔p𝑥q " 𝑃 p𝑥}𝑘 p2q 1 q ' 𝑃 pp𝑥 ' 𝑘 p1q 1 q}𝑘 p2q 1 q ' 𝑘 2 .
This idea is depicted in Figure 7

ˆ𝑛3

lo omo on Simon's circuit ˙, classical memory polyp𝑛q, quantum memory 𝒪 `𝑛2 ˘(qubits of the database) and using 𝒪p2 𝑢 q classical chosen-plaintext queries to EM.

Proof. Since the functions that we consider in the Grover search have 𝑢-bit inputs, and the search runs for 2 𝑛´𝑢 2

iterates, the database needs 𝒪p𝑢 `p𝑛 ´𝑢qq copies of the uniform query state, each of which is built with 𝒪p𝑛2 𝑢 q quantum gates by Lemma 7.1. Each of Grover's iterates solves a system of dimension 𝒪p𝑢 `p𝑛 ´𝑢qq in 𝒪 `𝑛3 ˘operations, and performs 𝑛 computations of Π in 𝑛 3 operations.

An exhaustive comparison with other attacks is given in Table 7.1. Note that while the classical time-data trade-off on Even-Mansour can be made known-plaintext, this is not the case here, as we need to query a vector subspace of t0, 1u 𝑛 for the database.

2 p𝑛`𝑚q{2 (𝑚 ď 𝑛) - 2 3p𝑛`𝑚q{7 (𝑚 ď 4𝑛{3) 2 p𝑛`𝑚q{3 (𝑚 ď 2𝑛)

Related-key Attacks

We will now show that the offline Simon's algorithm provides an efficient generic upper bound for related-key attacks against block ciphers in the Q1 scenario.

Let 𝐸 𝑘 be a block cipher with a key and block size of 𝑛 bits. In the related-key setting, as introduced in [WH87], we are allowed to query 𝐸 𝑘'ℓ p𝑚q for any 𝑛-bit difference ℓ and message 𝑚. Classically, this is a very powerful model, but it becomes especially meaningful when the block cipher is used inside a mode of operation (e.g., a hash function) in which key differences can be controlled by the attacker. It is shown in [START_REF] Winternitz | Chosen-Key Attacks on a Block Cipher[END_REF] that a secret key recovery in this model can be performed in 2 𝑛{2 operations, as it amounts to find a collision between some query 𝐸 𝑘'ℓ p𝑚q and some offline computation 𝐸 ℓ 1 p𝑚q.

In the Q2 setting, we have mentioned in Chapter 3 the attack of Rötteler and Steinwandt [START_REF] Rötteler | A note on quantum related-key attacks[END_REF], which recovers 𝑘 with Simon's algorithm if quantum query access to ℓ Þ Ñ 𝐸 𝑘'ℓ p𝑚q is allowed.

The offline Simon's algorithm translates this related-key superposition attack into an attack where the related-key oracle is queried only classically, making it more practical. We write 𝑘 " 𝑘 1 ||𝑘 2 where 𝑘 1 has 𝑛{3 bits and 𝑘 2 has 2𝑛{3 bits. We can query 𝐸 p𝑘 1 ||𝑘 2 q'pℓ 1 ||0q p𝑚q for a fixed 𝑚 and all 𝑛{3-bit differences ℓ 1 . Then we can perform a Grover search on 𝑘 2 . The classical security level in presence of a related-key oracle of this form, which is 2 𝑛{2 , is reduced quantumly to 2 𝑛{3 . This shows that the transition to a quantum setting has an impact on the related-key security even if the oracle remains classical.

Attacking Concrete Instances in Q1

We give below a non-exhaustive list of designs that can be targeted by Algorithm 7.1, providing better attacks than the previous ones (that would either use QRACM or have a worse time complexity).

Even-Mansour instances. Although the Even-Mansour construction is very common, the offline Simon's algorithm is not the best attack in all instances: if the masks are derived from a smaller key, a direct key-recovery using Grover's algorithm may be more efficient. This is for example the case in the CAESAR candidate Minalpher [START_REF] Sasaki | Minalpher v1.1. Submission to the CAESAR competition[END_REF].

In general, we need to have a secret key of at least two thirds of the state size for our attack to beat the exhaustive search.

The Farfalle construction [START_REF] Bertoni | Farfalle: parallel permutation-based cryptography[END_REF] degenerates to an Even-Mansour construction if the input message is only 1 block long. Instances of this construction use variable states and key sizes. Xoofff [START_REF] Daemen | The design of Xoodoo and Xoofff[END_REF] has a state size of 384 bits and a key size between 192 and 384 bits. Using 2 128 data (which is exactly the data limit of Xoofff) and time, our attack can recover the key. Hence, it is relevant if the key size is greater than 256. Note that the authors made a security claim in the Q1 setting that this attack does not contradict (nor any attack using QRACM). Chaskey. The lightweight MAC Chaskey [Mou+14] (Figure 7.4) is very close to an Even-Mansour construction operating on 128 bits. Since the last message block (𝑚 2 in Figure 7.4) is XORed to the key 𝐾 1 , we can immediately apply our Q1 attack and recover 𝐾 1 and the value of the state before the XORing of the last message block. As Π is a permutation easy to invert, this allows to retrieve 𝐾. Chaskey contains 16 rounds with 4 modular additions on 32 bits, 4 XORs on 32 bits and some rotations. With a data limit of 2 48 , as advocated in the specification, our attack would require roughly 2 p128´48q{2 ˆ219 " 2 59 quantum gates, where the dominant cost is solving the 80-dimensional linear system inside each iteration of Grover's algorithm.

𝑚

Sponges.

The offline Simon's algorithm can be used to recover an internal state if this state has a fixed value, and is XORed to a controlled input. A simple duplexed Sponge does not seem to have such vulnerability, but there are some cases in which this algorithm applies effectively.

The Beetle mode of lightweight authenticated encryption [START_REF] Chakraborti | Beetle Family of Lightweight and Secure Authenticated Encryption Ciphers[END_REF], has an initialization phase described as p𝐾 1 '𝑁 q}𝐾 2 Þ Ñ 𝑓 pp𝐾 1 '𝑁 q}𝐾 2 q, where 𝐾 1 , 𝑁 P t0, 1u 𝑟 , 𝐾 2 P t0, 1u 𝑐 , and 𝑓 is a p𝑟 `𝑐q-bit permutation. Here, we will use the nonce as a varying value, and encrypt the same message under a sequence of nonces forming an affine subspace. Nonce-respecting adversaries are often assumed to freely choose the nonces that they use, but our assumption is weaker. In practice, nonces are often implemented using internal counters, so even if the adversary has no control over the nonce, the attack may still be possible.

In Beetle[Light+], the rate is 𝑟 " 64 bits and the capacity 𝑐 " 80 bits. The rate is sufficiently large to embed 48 varying bits for the nonce; in that case, by making 2 48 classical queries and 2 48 Grover iterations, we can recover the secret 𝐾 1 ||𝐾 2 . In Beetle[Secure+], 𝑟 " 𝑐 " 128 bits. We can recover 𝐾 1 ||𝐾 2 with 2 85 messages and Grover iterations. As the key has the same length as the state, the attack would still work if the nonce was added after the first permutation.

Discussion

The algorithm that we presented in this chapter is the first use of Simon's algorithm in a Q1 setting. It shows that a strong algebraic structure, besides paving the way for powerful Q2 attacks, can also make a difference in the Q1 setting.

The results that we obtained are three-fold: ' we improved the query complexity of many Q2 attacks from exponential to polynomial; ' we increased the applicability of many Q1 attacks by removing their QRACM usage, and in doing so, ' we could improve the memory complexity in addition to the time complexity.

As an example, let us consider the attack on Even-Mansour. At any point of the trade-off curve 𝑇 2 ¨𝐷 " 2 𝑛 , the quantum algorithm does not require more than polyp𝑛q memory. Let us consider the scenario where 𝐷 " 2 𝑛{3 is the data limitation (which is coherent with the example of Chaskey). Then at this point, the algorithm provides a quadratic time speedup with respect to the classical attack, up to a small polynomial factor.

Exhaustive key search also has a quadratic speedup. However, it competes against a very efficient classical algorithm, which is easily distributed. Meanwhile, the classical attack on Even-Mansour runs in time 2 2𝑛{3 under a data limitation 2 𝑛{3 , and requires a memory of size 2 𝑛{3 . Such an algorithm cannot be parallelized without accounting for massive hardware, memory accesses, and so on [START_REF] Michael | The Full Cost of Cryptanalytic Attacks[END_REF]. This makes our attack relatively more appealing.

The main open question is whether an offline variant, using classical queries only, exist for more Q2 attacks. As an example, quantum slide attacks need to look for a shift between two functions containing the secret key. Thus, the asymmetry of Problem 7.1 is lost. Only some of the attacks given in [BNS19a] can benefit from the offline Simon's algorithm. These are typically the attacks that, similarly to the Grover-meets-Simon attack, need to guess some subkey and run Simon's algorithm for each guess.

Cryptanalysis of Spook

Spook [Bel+19] is a second-round candidate of the NIST LWC process. It is based on the Sponge One-Pass mode of operation (S1P) [START_REF] Guo | Towards Low-Energy Leakage-Resistant Authenticated Encryption from the Duplex Sponge Construction[END_REF], which allows to obtain security guarantees even when nonces are misused and all intermediate computations are leaked to the adversary (except the secret key). The S1P mode is a duplex-like Authenticated Encryption with Associated Data (AEAD) based on a permutation, that requires in addition to call a tweakable block cipher during its initialization and finalization phases. Thus, the authors define the tweakable block cipher Clyde-128 and the permutation Shadow, our main target. Its two variants, Shadow-384 and Shadow-512, use the same subcomponents as Clyde.

Since the submission aims at lightness and side-channel resistance, it follows the paradigm of LS-designs, which was introduced with the block ciphers Robin and Fantomas [START_REF] Grosso | LS-Designs: Bitslice Encryption for Efficient Masked Software Implementations[END_REF]. In such a block cipher, the state is represented as a matrix of 𝑠 ˆℓ bits; a linear L-Box 𝐿 is defined, alongside a nonlinear S-Box 𝑆. Each round has a substitution layer and a linear layer: the substitution layer simply applies 𝑆 to each column of the matrix, while the linear layer applies 𝐿 to each row, then adds the round key (i.e., the master key K and a round constant). This is represented in Figure 8 Our main target Shadow can be seen as a keyless LS-design modified to accommodate a large state size. Its specification will be given in Section 8.1.1. We do not target the block cipher Clyde-128 and we will consider it as a black-box.

Spook and Spook V2. In the rest of this chapter, "Spook" refers to the version of Spook submitted for the second round of the LWC process [START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF]. After private communication of the results presented here, the designers of Spook decided to tweak their design. This is discussed in [START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF], which defines "Spook V2" as opposed to the initial submission. The attacks of this section are not applicable to Spook V2.

Summary of the results. The S1P mode of operation is proven secure if used with a random permutation. However, the designers of Spook do not rely explicitly on the hermetic sponge strategy, and they allow the existence of distinguishers, if they have no incidence on the cipher.

In [START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF], Section 4.3, they mention a "minimum [of] 128-bit security against linear cryptanalysis", and "an algebraic degree 128", both of which are achieved by Shadow-512. However, in order to avoid forgeries, it is also necessary to "ensure collision resistance for the 255 bits that are used to generate the tag". In terms of differential cryptanalysis, this means that "truncated differentials with probability larger than 2 ´128 for those 255 bits" are avoided. The authors declare:

A conservative heuristic for this purpose is to require that no differential characteristic has probability better than 2 ´385 , which happens after twelve rounds (six steps).

In Section 8.1.5, we exhibit a practical truncated differential distinguisher on the full version of Shadow-512 (6 steps), and on a shifted version of Shadow-384 (6 steps, or 5 steps of the actual permutation), thus disproving this heuristic. The distinguisher against Shadow-512 would even work against an extended version with 7 steps.

In Section 5 of the specification document, the authors encourage the cryptanalysis of reduced-round version of Spook, and state:

The recommended parameters are 12 rounds for Clyde-128 and 12 rounds for Shadow-512. We additionally provide aggressive parameters, with 12 rounds for Clyde-128 and 8 rounds for Shadow-512, as an interesting target for cryptanalysis.

In Section 8.1.7, we show that our observations on Shadow allow to mount a practical existential forgery attack on the S1P mode, when Shadow-512 is reduced to 8 rounds (4 steps) out of 12, thus breaking the version with "aggressive" parameters proposed by the authors. In this attack, we stand in the nonce-misuse scenario, which is allowed by the CIML2 security game considered by the authors of Spook.

Specification of Shadow and Notations

The Spook algorithm uses two variants of the permutation Shadow, of state sizes 512 and 384 respectively, but Shadow-512 is the one used in the primary candidate of the NIST LWC process. The permutation uses a multiple LS-design (mLS), which is a variant of an LS-design represented in Figure 8.2.

Internal state. The internal state associates 𝑚 bundles of dimensions 𝑠 ˆℓ, where 𝑠 " 4, ℓ " 32, 𝑚 " 3 in Shadow-384 and 4 in Shadow-512. (Thus, the bundles are always of 128 bits.) As in Figure 8.2 a round of Shadow applies the 4-bit S-Box on the columns of each bundle (S-Box layer), and then one of two linear functions: one that mixes inside each bundle with the L-Box (round A), and one that mixes the bundles together with Step 𝑖 of a generic mLS-design, with two rounds. Note that in Shadow, the L-Box is applied to two rows instead of a single one.

a diffusion layer (round B). Two such rounds form a step. The full versions of both variants iterate 6 steps, thus 12 rounds. As they use similar bundles, only the D layer and the round constants are different. We will be interested in the values of individual columns rather than rows of a bundle. For a bundle 𝑦, we let 𝑦 31 , . . . , 𝑦 0 denote its columns. We represent bundles and states with column 31 on the left, and column 0 on the right.

S-Box layer.

The 4-bit S-Box used in Shadow will be denoted 𝑆, and its lookup table is given in Table 8.1. By abuse of notation, we also denote by 𝑆 the S-Box layer applied to a bundle, or to a complete Shadow state. The L-Box is denoted L 1 , and it applies to two rows of a bundle instead of a single one. It is defined by:

L 1 p𝑥, 𝑦q " ˆcircp0xec045008q ¨𝑥𝑇 ' circp0x36000f60q ¨𝑦𝑇 circp0x1b0007b0q ¨𝑥𝑇 ' circp0xec045008q ¨𝑦𝑇 ˙, (8.1)
where circp𝐴q stands for a circulant matrix whose first line is a row vector given by the binary decomposition of 𝐴. We let 𝐿 denote the parallel application of the L-Box.

Diffusion layer.

The diffusion layer applies a transformation D on the 4 (respectively 3) bits having the same positions in each bundle. For Shadow-512, D is an involution given by a near-MDS matrix which appeared previously in the design of the block ciphers Midori [START_REF] Banik | Midori: A Block Cipher for Low Energy[END_REF] and Mantis [START_REF] Beierle | The SKINNY Family of Block Ciphers and Its Low-Latency Variant MANTIS[END_REF]:

Dp𝑎, 𝑏, 𝑐, 𝑑q " ¨0 1 1 1 1 0 1 1 1 1 0 1 1 1 1 0 ‹ ‹ ' ˆ¨𝑎 𝑏 𝑐 𝑑 ‹ ‹ ' . (8.2)
It can be observed that this matrix has branching number 4. That is, the minimal number of non-zero values in Dp𝑎, 𝑏, 𝑐, 𝑑q and p𝑎, 𝑏, 𝑐, 𝑑q is 4, while an MDS matrix would have a branching number 5.

For Shadow-384, a different D needs to be defined, as there are only 3 bundles to mix:

Dp𝑎, 𝑏, 𝑐q " ¨1 1 1 1 0 1 1 1 0 'ˆ¨𝑎 𝑏 𝑐 ' . (8.3)
Round constants. The rounds constants used, both in rounds of type A and of type B, are given in Table 8.2. These constants are of 4 bits only, and correspond to the internal state of a 4-bit LFSR. If bundles are numbered from 0 to 3 (or 2 for Shadow-384), then the constant addition is defined as follows: for 𝑏 " 0, 1, 2, 3, the 4-bit constant given in Table 8.2 is XORed to column number 𝑏 in bundle 𝑏. When considering a single step, we will often name 𝑐 the 4-bit round constant of Round A and 𝑐 1 the constant of Round B. (1,0,0,0) 1 (0,1,0,0) 2 (0,0,1,0) 3 (0,0,0,1)

4 (1,1,0,0) 5 (0,1,1,0) 6 (0,0,1,1) 7 (1,1,0,1) 8 (1,0,1,0) 9 (0,1,0,1) 10 (1,1,1,0) 11 (0,1,1,1)
Super S-Box. It is possible to rewrite Shadow as an SPN operating on 𝑚 128-bit Super S-Boxes, which are the bundles. The transformation D becomes the linear layer of this SPN, and the Super S-Box is the composition of the S-Box layer of round A, the L-Box layer of round A, the constant addition of round A, and the S-Box layer of round B (see Algorithm 8.1). We let 𝜎 𝑗 for 𝑗 P t0, . . . , 𝑚 ´1u denote the parallel Super S-Boxes applying to bundle 𝑗. Note that, since the round constant RC 2𝑖 is XORed in different positions, 𝜎 𝑗 are different functions. However, we will observe in the next section that despite this difference, a natural symmetry property can be transmitted through some Shadow steps.

Algorithm 8.1 The Shadow permutation.

Input: 𝑚 bundles 𝑥 0 , . . . , 𝑥 𝑚´1 of dimensions 𝑠 ˆℓ 1: for 𝑖 from 0 to 5 do Ź 6 steps 2:

Apply 𝑆 column-wise to the bundles XOR RC 2𝑖 to column 𝑏 in bundle 𝑏

5:

Apply 𝑆 column-wise to the bundles 6:

Apply D to the bundles: 𝑥 0 , . . . , 𝑥 𝑚´1 Ð Dp𝑥 0 , . . . , 𝑥 𝑚´1 q 7:

XOR RC 2𝑖`1 to column 𝑏 in bundle 𝑏

Defining i-Identical States in Shadow-512

Although our distinguishers on Shadow variants are limited-birthday distinguishers, they do not rely on finding a differential trail with high probability, which would likely contradict the security analysis of the authors. Instead, we will define internal states with strong symmetry properties, namely equal bundles, and show that despite the addition of round constants, on certain conditions, this symmetry can be preserved.

Definition 8.1 (𝑖-identical state). We call 𝑖-identical an internal state of Shadow in which 𝑖 bundles are equal.

The propagation of 𝑖-identical states is a strong property that stems from the interaction of round constants in Shadow. We illustrate this with the evolution of a 4-identical state through a Shadow-512 step, in Figure 8.3.

4-Identical states.

Let 𝑋 " p𝑥, 𝑥, 𝑥, 𝑥q be a 4-identical state in input to a Shadow step. We let 𝑐 and 𝑐 1 denote the two 4-bit constants added in round A and B respectively (their values depend on the round index). After the first S-Box layer and the L-Box layer, this state is still 4-identical, thus we omit these operations, and denote by 𝑌 " p𝑦, 𝑦, 𝑦, 𝑦q the state obtained before XORing the first constant 𝑐 " RC 2𝑖 . After applying the constant addition and the S-Box layer, only the first four columns of the bundles differ: Bundle 0 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 q 𝑆p𝑦 2 q 𝑆p𝑦 1 q 𝑆p𝑦 0 ' 𝑐q Bundle 1 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 q 𝑆p𝑦 2 q 𝑆p𝑦 1 ' 𝑐q 𝑆p𝑦 0 q Bundle 2 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 q 𝑆p𝑦 2 ' 𝑐q 𝑆p𝑦 1 q 𝑆p𝑦 0 q Bundle 3 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 ' 𝑐q 𝑆p𝑦 2 q 𝑆p𝑦 1 q 𝑆p𝑦 0 q Next, we apply the transformation D. Column 𝑖 of bundle 𝑏 is mapped to the sum of columns 𝑖 of the three other bundles. Thus, the columns 31 downto 4 remain unchanged, and the four last columns are modified as follows: Bundle 0 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 ' 𝑐q 𝑆p𝑦 2 ' 𝑐q 𝑆p𝑦 1 ' 𝑐q 𝑆p𝑦 0 q Bundle 1 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 ' 𝑐q 𝑆p𝑦 2 ' 𝑐q 𝑆p𝑦 1 q 𝑆p𝑦 0 ' 𝑐q Bundle 2 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 ' 𝑐q 𝑆p𝑦 2 q 𝑆p𝑦 1 ' 𝑐q 𝑆p𝑦 0 ' 𝑐q Bundle 3 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 q 𝑆p𝑦 2 ' 𝑐q 𝑆p𝑦 1 ' 𝑐q 𝑆p𝑦 0 ' 𝑐q Finally, 𝑐 1 is added, exactly in the columns that were not affected by 𝑐:

Bundle 0 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 ' 𝑐q 𝑆p𝑦 2 ' 𝑐q 𝑆p𝑦 1 ' 𝑐q 𝑆p𝑦 0 q ' 𝑐 1 Bundle 1 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 ' 𝑐q 𝑆p𝑦 2 ' 𝑐q 𝑆p𝑦 1 q ' 𝑐 1 𝑆p𝑦 0 ' 𝑐q Bundle 2 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 ' 𝑐q 𝑆p𝑦 2 q ' 𝑐 1 𝑆p𝑦 1 ' 𝑐q 𝑆p𝑦 0 ' 𝑐q Bundle 3 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 q ' 𝑐 1 𝑆p𝑦 2 ' 𝑐q 𝑆p𝑦 1 ' 𝑐q 𝑆p𝑦 0 ' 𝑐q From these formulas, Proposition 8.1 follows immediately (see also Figure 8.3).

Proposition 8.1. Let 𝑌 " p𝑦, 𝑦, 𝑦, 𝑦q be the value of a 4-identical state before the first constant addition in a Shadow-512 step. Let 𝑐, 𝑐 1 be the constants. If the following holds:

# 𝑆p𝑦 3 ' 𝑐q " 𝑆p𝑦 3 q ' 𝑐 1 , 𝑆p𝑦 1 ' 𝑐q " 𝑆p𝑦 1 q ' 𝑐 1 𝑆p𝑦 2 ' 𝑐q " 𝑆p𝑦 2 q ' 𝑐 1 , 𝑆p𝑦 0 ' 𝑐q " 𝑆p𝑦 0 q ' 𝑐 1 . ,
then the state after this step remains 4-identical.

Recall that 𝑐 and 𝑐 1 vary with the step index. Depending on their values, the system of equations of Proposition 8.1 will either be satisfied with a rather high probability, or not at all. More precisely, the existence of solutions p𝑦 0 , 𝑦 1 , 𝑦 2 , 𝑦 3 q for a given pair 𝑐, 𝑐 1 , and the probability of success, depends on the coefficients of the differential distribution table of the S-Box 𝑆. We can easily compute them and verify the results experimentally. They are given in Table 8.3.

3-and 2-identical states.

Similar results apply if we want only three or two bundles to be identical, as long as the indices of the equal bundles are the same in input and output. In that case, respectively three and two S-Box equations have to be satisfied, and the relations are the same as in Proposition 8.1. Thus, the probability to propagate an 𝑖-identical state is either nonzero for all 𝑖 " 2, 3, 4, either zero for all. These values are given in Table 8.3.

As an example, consider a 3-identical state 𝑋 " p𝑥, 𝑥, 𝑥, 𝑧q and its value 𝑌 " p𝑦, 𝑦, 𝑦, 𝑤q after the first S-Box and L-Box layers. We can still focus on the first four columns. Due to the choice of D, a quadruple of columns 𝑆p𝑦 𝑖 q, 𝑆p𝑦 𝑖 q, 𝑆p𝑦 𝑖 q, 𝑆p𝑤 𝑖 q is mapped to 𝑆p𝑤 𝑖 q, 𝑆p𝑤 𝑖 q, 𝑆p𝑤 𝑖 q, 𝑆p𝑦 𝑖 q which remains 3-identical in the same positions. The first four columns become:

equal bundles

After RC 2𝑖 After the S-Box layer

After D After RC 2𝑖`1 𝑦 0 ' 𝑐 𝑆p𝑦 0 ' 𝑐q 𝑦 0 ' 𝑐 1 𝑦 1 ' 𝑐 𝑆p𝑦 1 ' 𝑐q 𝑦 1 ' 𝑐 1 𝑦 2 ' 𝑐 𝑆p𝑦 2 ' 𝑐q 𝑦 2 ' 𝑐 1 𝑦 3 ' 𝑐 𝑆p𝑦 3 ' 𝑐q 𝑦 3 ' 𝑐 1
𝑆p𝑤 3 ' 𝑐q 𝑆p𝑤 3 ' 𝑐q 𝑆p𝑤 3 ' 𝑐q 𝑆p𝑦 3 q ' 𝑐 loooomoooon Column 3
, 𝑆p𝑦 2 q ' 𝑆p𝑦 2 ' 𝑐q ' 𝑆p𝑤 2 q 𝑆p𝑦 2 q ' 𝑆p𝑦 2 ' 𝑐q ' 𝑆p𝑤 2 q 𝑆p𝑤 2 q ' 𝑐 1 , 𝑆p𝑦 2 ' 𝑐q loooooooooooooooomoooooooooooooooon Column 2

, 𝑆p𝑦 1 q ' 𝑆p𝑦 1 ' 𝑐q ' 𝑆p𝑤 1 q 𝑆p𝑤 1 q ' 𝑐 1 𝑆p𝑦 1 q ' 𝑆p𝑦 1 ' 𝑐q ' 𝑆p𝑤 1 q 𝑆p𝑦 1 ' 𝑐q loooooooooooooooomoooooooooooooooon Column 1 , 𝑆p𝑤 0 q ' 𝑐 1 𝑆p𝑦 0 q ' 𝑆p𝑦 0 ' 𝑐q ' 𝑆p𝑤 0 q 𝑆p𝑦 0 q ' 𝑆p𝑦 0 ' 𝑐q ' 𝑆p𝑤 0 q 𝑆p𝑦 0 ' 𝑐q loooooooooooooooomoooooooooooooooon Column 0

Thus, the state remains 3-identical if and only if the following holds:

$ ' & ' % 𝑆p𝑦 2 ' 𝑐q " 𝑆p𝑦 2 q ' 𝑐 1 𝑆p𝑦 1 ' 𝑐q " 𝑆p𝑦 1 q ' 𝑐 1 𝑆p𝑦 0 ' 𝑐q " 𝑆p𝑦 0 q ' 𝑐 1 , (8.4)
which does not depend on the value of 𝑤, but only on the value 𝑦 taken by the three identical bundles.

Table 8.3: Probability that an i-identical state maps to an i-identical state through step 𝑗 of Shadow-512.

Step 𝑗

0 1 2 3 4 5 4-identical 0 0 0 2 ´12 2 ´8 0 3-identical 0 0 0 2 ´9 2 ´6 0 2-identical 0 0 0 2 ´6 2 ´4 0

2-identical States in Shadow-384

The D-layer in Shadow-512 is particularly favorable to the propagation of identical states. This situation changes in Shadow-384. However, we are able to propagate 2-identical states where bundles 1 and 2 are equal. Similar equations hold, so the probabilities of remaining 2-identical with this form are the same as in Table 8.3. Let 𝑋 " p𝑥, 𝑧, 𝑧q be a 2-identical state and 𝑌 " p𝑦, 𝑤, 𝑤q be the state after the S-Box and L-Box layers. After the addition of the round constant 𝑐 and the second S-Box layer, we obtain the following: Bundle 0 : 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 3 q 𝑆p𝑦 2 q 𝑆p𝑦 1 q 𝑆p𝑦 0 ' 𝑐q Bundle 1 : 𝑆p𝑤 31 q ¨¨¨𝑆p𝑤 3 q 𝑆p𝑤 2 q 𝑆p𝑤 1 ' 𝑐q 𝑆p𝑤 0 q Bundle 2 : 𝑆p𝑤 31 q ¨¨¨𝑆p𝑤 3 q 𝑆p𝑤 2 ' 𝑐q 𝑆p𝑤 1 q 𝑆p𝑤 0 q

Recall that in Shadow-384, D maps p𝑎, 𝑏, 𝑐q to p𝑎 ' 𝑏 ' 𝑐, 𝑎 ' 𝑐, 𝑎 ' 𝑏q. After applying this mapping and the second constant addition, we obtain: Bundle 0: Bundle 1: Bundle 2: 𝑆p𝑦 31 q 𝑆p𝑦 31 q ' 𝑆p𝑤 31 q 𝑆p𝑦 31 q ' 𝑆p𝑤 31 q looooooooomooooooooon Column 31 . . . . . . . . . 𝑆p𝑦 3 q 𝑆p𝑦 3 q ' 𝑆p𝑤 3 q 𝑆p𝑦 3 q ' 𝑆p𝑤 3 q looooooomooooooon Column 3

, 𝑆p𝑦 2 q ' 𝑆p𝑦 2 ' 𝑐q ' 𝑆p𝑤 2 q 𝑆p𝑦 2 q ' 𝑆p𝑤 2 ' 𝑐q 𝑆p𝑤 2 q ' 𝑆p𝑦 2 q ' 𝑐 1 loooooooooooooooomoooooooooooooooon Column 2

, 𝑆p𝑦 1 q ' 𝑆p𝑤 1 ' 𝑐q ' 𝑆p𝑤 1 q 𝑆p𝑦 1 q ' 𝑆p𝑤 1 q ' 𝑐 1 𝑆p𝑦 1 q ' 𝑆p𝑤 1 ' 𝑐q looooooooooooooooomooooooooooooooooon Column 1 , 𝑆p𝑦 0 ' 𝑐q ' 𝑐 1 𝑆p𝑦 0 ' 𝑐q ' 𝑆p𝑤 0 q 𝑆p𝑦 0 ' 𝑐q ' 𝑆p𝑤 0 q loooooooooomoooooooooon Column 0

Thus, the state will remain 2-identical if the two following equations are satisfied:

# 𝑆p𝑤 2 ' 𝑐q " 𝑆p𝑤 2 q ' 𝑐 1 𝑆p𝑤 1 ' 𝑐q " 𝑆p𝑤 1 q ' 𝑐 1 . (8.5)

A Distinguisher Against 5-round Shadow-512

All our attacks against Shadow combine the following properties:

1. For Shadow-512, D is not an MDS matrix;

2. Although Super S-Boxes are different functions, they still behave very closely one to another. Thus, it is easy to find differential pairs for multiple Super S-Boxes with the same differences, and potentially equal input values;

3. 𝑖-identical states can be mapped to 𝑖-identical states with high probability through steps 3 and 4.

In this section, we start by combining 1. and 2. to distinguish a reduced-round version of Shadow with 5 steps out of 6. This truncated differential distinguisher will work regardless of the round constants applied, so we may choose either the 5 first or the 5 last rounds. It has complexity 1, which means that it costs less than the equivalent of an evaluation of Shadow. It outputs a pair of states with difference 0 on the last bundle that, after 5 steps, arrive at a difference 0 on the last bundle. Since a bundle is of 128 bits, the complexity to obtain such a pair for a random permutation would be 2 64 by the results of [START_REF] Iwamoto | Limited-Birthday Distinguishers for Hash Functions -Collisions beyond the Birthday Bound Can Be Meaningful[END_REF]. Thus, this is a valid limited-birthday distinguisher.

The truncated differential path that we use is displayed in Figure 8.4, where an denotes an unknown difference. We use the Super S-Box notation and denote by 𝜎 𝑖 the Super S-Box applied to bundle 𝑖; we emphasize that the 𝜎 𝑖 are distinct functions, but we omit the fact that they are also distinct between different rounds, for more readability. The slow diffusion of the D layer. The fact that D is not an MDS matrix allows to span more steps. Indeed, if D was MDS, an input (respectively output) with one active Super S-Boxes would map to an output (resp. input) with all active Super S-Boxes, and the path would not span Round 0 and Round 4, as it does in Figure 8.4.

Simultaneous differentials for the Super S-Boxes.

From the beginning of Step 2 forwards, and from the end of Step 2 backwards, all transitions represented in Figure 8.4 hold with probability one. Our distinguisher starts from the middle: we must find three values for the bundles 0, 1, 2 that have the same difference in input to their respective Super S-Boxes, and in output.

If the Super S-Boxes were random functions, this would be difficult. However, only the position where the round constant 𝑐 is XORed differs between them. This makes it easy to build an input difference 𝛼 that maps to the same difference for all three Super S-Boxes 𝜎 0 , 𝜎 1 and 𝜎 2 simultaneously. Lemma 8.1. If 𝑥 P F 128 2 and 𝛼 P F 128 2 are such that p𝐿 ˝𝑆qp𝑥q ' p𝐿 ˝𝑆qp𝑥 ' 𝛼q " 𝛽 and if 𝛽 is set to 0 on the 4 columns that can receive the round constant 𝑐 (columns 0 to 3), then the value of 𝜎 𝑏 p𝑥q ' 𝜎 𝑏 p𝑥 ' 𝛼q does not depend on the bundle index 𝑏.

Proof. We let 𝑦 and 𝑦 ' 𝛽 denote the respective values of p𝐿 ˝𝑆qp𝑥q and p𝐿 ˝𝑆qp𝑥 ' 𝛼q. By expanding these into column notation we get:

𝑦 " 𝑦 31 ¨¨¨𝑦 4 𝑦 3 𝑦 2 𝑦 1 𝑦 0 𝑦 ' 𝛽 " 𝑦 31 ' 𝛽 31 ¨¨¨𝑦 4 ' 𝛽 4 𝑦 3 𝑦 2 𝑦 1 𝑦 0
We use the Kronecker symbol notation: 𝛿 𝑖𝑗 " 1 iff 𝑖 " 𝑗 and 0 otherwise. XORing the constant and applying 𝑆 to this pair of inputs, we obtain respectively for 𝜎 𝑖 p𝑥q and 𝜎 𝑖 p𝑥 ' 𝛼q, for all ď 𝑖 ď 3: 𝑆p𝑦 31 q ¨¨¨𝑆p𝑦 4 q 𝑆p𝑦 3 ' 𝛿 𝑖3 𝑐q 𝑆p𝑦 2 ' 𝛿 𝑖2 𝑐q 𝑆p𝑦 1 ' 𝛿 𝑖1 𝑐q 𝑆p𝑦 0 ' 𝛿 𝑖0 𝑐q 𝑆p𝑦 31 ' 𝛽 31 q ¨¨¨𝑆p𝑦 4 ' 𝛽 4 q 𝑆p𝑦 3 ' 𝛿 𝑖3 𝑐q 𝑆p𝑦 2 ' 𝛿 𝑖2 𝑐q 𝑆p𝑦 1 ' 𝛿 𝑖1 𝑐q 𝑆p𝑦 0 ' 𝛿 𝑖0 𝑐q so summing these equations yields 𝜎 𝑖 p𝑥q ' 𝜎 𝑖 p𝑥 ' 𝛼q " 𝛾 31 ¨¨¨𝛾 4 0 0 0 0 Thus, by making a right choice of 𝛼, we can get the same difference in output of the 4 Super S-Boxes, regardless of the input value.

Our distinguisher is described in Algorithm 8.2. Starting from the middle, it uses Lemma 8.1 and then follows the path depicted in Figure 8.4. Using the property of the Super S-Boxes and of the D layer alone, it does not seem easy to extend this to more steps. For this, we need to use the mapping of 𝑖-identical states described in Section 8.1.2. Algorithm 8.2 A distinguisher for 5-step Shadow-512.

Attacks: the permutation Π defined as 5-step Shadow Output: a pair of states p𝑋 0 , 𝑋 1 0 q such that:

# 𝑋 0 ' 𝑋 1 0 " p˚, ˚, ˚, 0q Πp𝑋 0 q ' Πp𝑋 1 0 q " Dp˚, ˚, ˚, 0q 1: Choose 𝛽 P F 128 2
such that it is set to 0 on columns 0 to 3 2: Choose a random 𝑦 P F 128 2 and a random 𝑧 P F 128 2 3: Compute 𝑥 " 𝜎 ´1 0 p𝑦q and 𝑥 ' 𝛼 " 𝜎 ´1 0 p𝑦 ' 𝛽q, 4: Set the two states at step 2 to be 𝑋 2 " p𝑥, 𝑥, 𝑥, 𝑧q and 𝑋 1 2 " p𝑥 ' 𝛼, 𝑥 ' 𝛼, 𝑥 ' 𝛼, 𝑧q .

5: Invert step 1 and step 0 on 𝑋 2 and 𝑋 1 2 to obtain a pair of states p𝑋 0 , 𝑋 1 0 q 6: return p𝑋 0 , 𝑋 1 0 q

A Distinguisher Against Full Shadow-512

In this section, Π will now denote an extended Shadow-512 permutation, with 7 steps. We exhibit a distinguisher that output pairs p𝑋 0 , 𝑋 1 0 q of 512-bit states such that:

𝑋 0 ' 𝑋 1 0 " p˚, ˚, ˚, 0q and Πp𝑋 0 q ' Πp𝑋 1 0 q " Dp˚, ˚, ˚, 0q . (8.6)
This is the trivial extension of a distinguisher for 6-step Shadow-512, that outputs Πp𝑋 0 q ' Πp𝑋 1 0 q " p0, 0, 0, ˚q; since Dp0, 0, 0, ˚q " p˚, ˚, ˚, 0q the complexity is the same in both cases, regardless of the round constants that might be used in this additional step. In both cases, the limited-birthday problem would have a complexity of around 2 64 queries for a random permutation, and we are able to solve it in practical time, using about 2 15 queries.

The distinguisher combines the 5-step truncated differential path of Section 8.1.4 with the observation on 3-identical states of Section 8.1.2. It is summarized in Figure 8.5.

Step 0 and Step 6 are traversed exactly as in the 5-step truncated differential path of Section 8.1.4, by mapping the difference p0, 0, 0, ˚q to p˚, ˚, ˚, 0q through D forwards and backwards.

Structure of the Distinguisher

As before, we start from the middle, namely from an input at Step 2. This time, we constraint it more in order to have a pair of 3-identical states at the beginning of Step 3, and Step 4. The rest of the path follows the truncated differential path of Section 8.1.4. We let 𝑋 𝑖 denote a Shadow-512 state (512 bits, 4 bundles) in input of step 𝑖.

• We start by building 𝑋 2 and 𝑋 1

2 such that $ ' & ' % 𝑋 2 ' 𝑋 1 2 " p𝛼, 𝛼, 𝛼, 0q 𝑋 3 ' 𝑋 1
3 " p0, 0, 0, 𝛽q 𝑋 3 and 𝑋 1 3 are 3-identical • We map both 3-identical states 𝑋 3 and 𝑋 1 3 to 3-identical states 𝑋 4 and 𝑋 1 4 at the beginning of Step 4. By the results of Table 8.3, this event occurs with probability 2 ´9. The input difference at the end of Step 3 is then equal to p𝛾, 𝛾, 𝛾, 0q.

• Next, we hope that the difference at end of Step 4, before the D layer, has the form p𝛿, 𝛿, 𝛿, 0q. We will show that this occurs with probability 2 ´7.245 .

• The rest of the path follows from the mapping of differences through D, and is satisfied with probability 1.

We now detail these different steps.

Satisfying the Conditions at Step 2

We reduce the conditions of Step 2 to two properties, (8.7) and (8.8) below, and we show how to satisfy them. More precisely, we need to find 128-bit values 𝑥, 𝛼, 𝛽, 𝜖 and 𝜖 1 such that:

$ ' & ' % 𝜎 0 p𝑥q `𝜎0 p𝑥 `𝛼q " 𝛽 𝜎 1 p𝑥 `𝜖q `𝜎1 p𝑥 `𝜖 `𝛼q " 𝛽 𝜎 2 p𝑥 `𝜖1 q `𝜎2 p𝑥 `𝜖1 `𝛼q " 𝛽 , (8.7)
where 𝜎 0 , 𝜎 1 , 𝜎 2 are the Super S-Boxes at Step 2. Setting 𝑋 2 " p𝑥, 𝑥 `𝜖, 𝑥 `𝜖1 , 𝑧q and 𝑋 1 2 " p𝑥 `𝛼, 𝑥 `𝜖 `𝛼, 𝑥 `𝜖1 `𝛼, 𝑧q for some 𝑧, this first condition ensures that 𝑋 2 ' 𝑋 1 2 " p𝛼, 𝛼, 𝛼, 0q as requested by our differential path. However, we also want 𝑋 3 and 𝑋 1 3 to be 3-identical, that is:

# pRC ˝Dq `𝜎0 p𝑥q, 𝜎 1 p𝑥 `𝜖q, 𝜎 2 p𝑥 `𝜖1 q, 𝑧 ˘" p𝑦, 𝑦, 𝑦, 𝑧 1 q pRC ˝Dq `𝜎0 p𝑥 `𝛼q, 𝜎 1 p𝑥 `𝛼 `𝜖q, 𝜎 2 p𝑥 `𝛼 `𝜖1 q, 𝑧 ˘" p𝑦, 𝑦, 𝑦, 𝑧 1 `𝛽q . (8.8)

where RC is the last constant addition of Step 3.

Finding Starting Points at Step 2

In order to satisfy Properties (8.7) and (8.8), we use a specific truncated differential with probability 1.

Lemma 8.2. Let 𝛼 P F 128 2 be a bundle difference that is non-zero only in columns 22 and 23. Then after any Super S-Box 𝜎, at any step, and for any input 𝑥 P F 128 2 , we have: 𝜎p𝑥q ' 𝜎p𝑥 ' 𝛼q " p˚, ˚, ..., ˚, 0, 0, 0, 0q .

where the output difference depends only on 𝛼 and on columns 31 to 4 of 𝜎p𝑥q.

Proof. This special difference comes from the definition of the linear layer. Let 𝑒 22 and 𝑒 23 be the vectors of F 64 2 (hence rows of a bundle) having respectively a single 1 in Thus, 𝜎 0 p𝑥 2 q, 𝜎 1 p𝑦 2 q and 𝜎 2 p𝑧 2 q differ only on columns 3 to 0, and they have the same values on columns 31 to 4. By Lemma 8.2, we find that the difference 𝜎 0 p𝑥 2 q ' 𝜎 0 p𝑥 2 ' 𝛼q is active only on columns 31 to 4, and does only depend on columns 31 to 4 of 𝜎 0 p𝑥 2 q. The same holds for 𝜎 1 p𝑦 2 q and 𝜎 2 p𝑧 2 q. Thus, the statement follows.

Verifying Steps 3 and 4

The transitions of Step 3 and Step 4 are probabilistic, and we have now to evaluate these probabilities. At the beginning of Step 3, we have two 3-identical states 𝑋 3 and 𝑋 1 3 and we want to map them to two 3-identical states 𝑋 4 and 𝑋 1 4 . We have seen in Section 8.1.2 that each of these states remains 3-identical with probability 2 ´9. However, they have the same values in the identical bundles in input, and if we write down the equations that must be satisfied, we obtain twice the same. Thus, the probability of the transition for both states is 2 ´9 instead of its square.

Going through

Step 4. We aim at a difference p0, 0, 0, 𝛿q for a non-zero 𝛿 at the beginning of Step 5 (see Figure 8.5). This means that the difference at the end of Step 4, before the D layer, must be p𝛿, 𝛿, 𝛿, 0q. To estimate the probability of this event, let us write the corresponding equations. We let p𝑦, 𝑦, 𝑦, 𝑤q and p𝑦 1 , 𝑦 1 , 𝑦 1 , 𝑤q denote the two respective states after the application of 𝑆 and 𝐿 of Step 4. Since the input of Step 4 is 3-identical, 𝑦 𝑖 " 𝑦 1𝑖 for all 𝑖 ą 3. We just have to focus on the last 4 columns. After D and RC, their values are as follows for p𝑦, 𝑦, 𝑦, 𝑤q: Bundle 0: Bundle 1: Bundle 2: Bundle 3: 𝑆p𝑤 3 ' 𝑐q 𝑆p𝑤 3 ' 𝑐q 𝑆p𝑤 3 ' 𝑐q 𝑆p𝑦 3 q ' 𝑐 1 loooomoooon Column 3 , 𝑆p𝑦 2 q ' 𝑆p𝑦 2 ' 𝑐q ' 𝑆p𝑤 2 q 𝑆p𝑦 2 q ' 𝑆p𝑦 2 ' 𝑐q ' 𝑆p𝑤 2 q 𝑆p𝑤 2 q ' 𝑐 1 𝑆p𝑦 2 ' 𝑐q loooooooooooooooomoooooooooooooooon Column 2

, 𝑆p𝑦 1 q ' 𝑆p𝑦 1 ' 𝑐q ' 𝑆p𝑤 1 q 𝑆p𝑤 1 q ' 𝑐 1 𝑆p𝑦 1 q ' 𝑆p𝑦 1 ' 𝑐q ' 𝑆p𝑤 1 q 𝑆p𝑦 1 ' 𝑐q loooooooooooooooomoooooooooooooooon Column 1 , 𝑆p𝑤 0 q ' 𝑐 1 𝑆p𝑦 0 q ' 𝑆p𝑦 0 ' 𝑐q ' 𝑆p𝑤 0 q 𝑆p𝑦 0 q ' 𝑆p𝑦 0 ' 𝑐q ' 𝑆p𝑤 0 q 𝑆p𝑦 0 ' 𝑐q loooooooooooooooomoooooooooooooooon Column 0 and similarly for p𝑦 1 , 𝑦 1 , 𝑦 1 , 𝑤q, by replacing 𝑦 𝑖 by 𝑦 1𝑖 . Since we want these two states to have a zero difference except in Bundle 3, we need the following relations to be satisfied: 𝑆p𝑦 12 q ' 𝑆p𝑦 12 ' 𝑐q " 𝑆p𝑦 2 q ' 𝑆p𝑦 2 ' 𝑐q 𝑆p𝑦 11 q ' 𝑆p𝑦 11 ' 𝑐q " 𝑆p𝑦 1 q ' 𝑆p𝑦 1 ' 𝑐q 𝑆p𝑦 10 q ' 𝑆p𝑦 10 ' 𝑐q " 𝑆p𝑦 0 q ' 𝑆p𝑦 0 ' 𝑐q .

Since we are looking at Step 4, the constant 𝑐 is equal to 0𝑥5 and then each equality has a probability equal to 2 ´2.415 to be verified (assuming that the value of 𝑦 and 𝑦 1 are independent).

Description of the Full Distinguisher

Our distinguisher is detailed in Algorithm 8.3. Since Step 3 is passed with probability 2 ´9 and Step 4 with probability p2 ´2.415 q 3 , the path from Step 2 to Step 4 succeeds with probability 2 ´16.245 . The rest has probability 1. Algorithm 8.3 Our 7-step distinguisher against Shadow-512.

Attacks: the permutation Π defined as 7-step Shadow Output: a pair of states p𝑋 0 , 𝑋 1 0 q such that, with probability at least 2 ´16.245 :

# 𝑋 0 ' 𝑋 1 0 " p˚, ˚, ˚, 0q Πp𝑋 0 q ' Πp𝑋 1 0 q " Dp˚, ˚, ˚, 0q
1: Select a difference 𝛼 P ∇.

2: Select a state 𝑋 3 " p𝑦 3 , 𝑦 3 , 𝑦 3 , 𝑧 3 q at the beginning of Step 3 3: Invert step 2 on p𝑦 3 , 𝑦 3 , 𝑦 3 , 𝑧 3 q, obtaining p𝑥 2 , 𝑦 2 , 𝑧 2 , 𝑡 2 q. 4: Invert step 1 on p𝑥 2 , 𝑦 2 , 𝑧 2 , 𝑡 2 q and p𝑥 2 ' 𝛼, 𝑦 2 ' 𝛼, 𝑧 2 ' 𝛼, 𝑡 2 q, obtaining p𝑥 1 , 𝑦 1 , 𝑧 1 , 𝑡 1 q and p𝑥 1 , 𝑦 1 , 𝑧 1 , 𝑡 1 1 q. 5: Invert step 0, obtaining a pair of 512-bit states with a zero-difference in bundle 3 6: return this pair of states. With probability ě 2 ´16.24 , it satisfies the truncated trail of Figure 8.5.

Experimental results.

Experiments showed that the probability of the distinguisher is slightly higher than what we expected. In fact, the trail of Figure 8.5 is not the only one that leads to the required output difference (see the Appendix of [Der+20]). By running Algorithm 8.3 for 2 22 times, we obtained 124 successful pairs, a probability close to 2 ´15 . Our unoptimized C++ implementation found all these pairs in less than 30 seconds on a desktop computer.

A Distinguisher Against 6-step Shadow-384

In this section, Π will denote the "shifted" Shadow-384 permutation, from Step 1 to 6 included. We build a distinguisher that uses essentially the same ideas as the one for full-round Shadow-512. It immediately implies a distinguisher on 5 steps of the original Shadow-384 permutation, where Step 0 has been removed.

• Due to the change of D, we must use another truncated differential path. At the end of Step 1, we have a difference p0, 𝛼, 𝛼q. Since D is now the transformation:

Dp𝑎, 𝑏, 𝑐q " ¨1 1 1 1 0 1 1 1 0 'ˆ¨𝑎 𝑏 𝑐 ',
it maps a difference p0, 𝛼, 𝛼q to p0, 𝛼, 𝛼q backwards, but after the inverse Super S-Box of Step 1, we obtain two unknown differences, whereas we had only one previously. This is why Step 0 cannot be covered anymore.

• We start in the middle, at Step 2, as before. We adapt properties (8.7) and (8.8), and Lemma 8.2, and obtain essentially the same results for a 3-bundle state.

• We propagate 2-identical states instead of 3-identical ones, using the property studied in Section 8.1.3. Before we only needed to do that through a single step; now we do that for one step more. This allows us to reclaim one of the steps that we lost with the change of D.

The path is represented in Figure 8.6 and the procedure is given in Algorithm 8.4.

Bundle 2

Bundle 1 Bundle 0

˚𝜎2 𝜎 1 𝜎 0 0 D
Step 0 (not covered)

0 𝜎 2 𝜎 1 𝜎 0 𝛼 𝛼 0 D Step 1 𝛼 𝛼 0 𝜎 2 𝜎 1 𝜎 0 𝛽 𝛽 0 D Step 2: Start 𝛽 𝛽 0 𝜎 2 𝜎 1 𝜎 0 𝛾 𝛾 0 D Step 3 𝛾 𝛾 0 𝜎 2 𝜎 1 𝜎 0 𝛿 𝛿 0 D Step 4 𝛿 𝛿 0 𝜎 2 𝜎 1 𝜎 0 0 D
Step 5

0 𝜎 2 𝜎 1 𝜎 0 0 D Step 6 Prob. 2 ´12 Prob. 2 ´8 Prob. 2 ´4.83
Figure 8.6: A (1-step shifted) 6-step distinguisher against Shadow-384. We emphasize that Step 0 is not covered anymore by the truncated differential pattern. Gray boxes denote that, in addition to the constrained difference, both states in the pair are 2-identical.

Starting in the middle. Our observation on L 1 is independent on the number of bundles involved. We choose 𝛼 in the vector space ∇ " t𝑎 ˆ𝑒22 `𝑏 ˆ𝑒23 , 𝑎 P F 4 2 , 𝑏 P F 4 2 u. By taking a 2-identical state before Step 3, inverting Step 2, and adding the difference 𝛼, we obtain a state 𝑋 1 2 that maps to another 2-identical state, with 𝑋 1 2 ' 𝑋 2 " p0, 𝛽, 𝛽q.

Algorithm 8.4 Our 6-step distinguisher against Shadow-384. Attacks: the permutation Π defined as 6-step Shadow-384 (from Step 1 to Step 6) Input: no input Output: a pair of states p𝑋 1 , 𝑋 1 1 q such that, with probability at least 2 ´24.483 :

# 𝑋 1 ' 𝑋 1 1 " p0, ˚, ˚q Πp𝑋 1 q ' Πp𝑋 1 1 q " Dp0, ˚, ˚q 1: Select a difference 𝛼 P ∇.
2: Select a 2-identical state 𝑋 3 " p𝑧 3 , 𝑦 3 , 𝑦 3 q at the beginning of Step 3 3: Invert step 2 on p𝑧 3 , 𝑦 3 , 𝑦 3 q, obtaining p𝑥 2 , 𝑦 2 , 𝑧 2 q. 4: Invert step 1 on p𝑥 2 , 𝑦 2 , 𝑧 2 q and p𝑥 2 , 𝑦 2 ' 𝛼, 𝑧 2 ' 𝛼q, obtaining 𝑋 1 and 𝑋 1 1 . 5: Invert step 0, obtaining a pair of 512-bit states with a zero-difference in bundle 3 6: return this pair of states. With probability ě 2 ´24.483 , it satisfies the truncated trail of Figure 8.6.

Mapping 2-identical states. Since 𝑋 3 and 𝑋 1 3 are 2-identical, they can be mapped to 2-identical states through Step 3 and Step 4, with the probabilities given in Section 8.1.3. Notice that the steps that we attack are constrained by this property, which is why it works best for a shifted version. As in the distinguisher on Shadow-512, the two states must remain 2-identical, but the equations that must be satisfied are the same. Thus, the probabilities for Step 3 and 4 are respectively 2 ´12 and 2 ´8.

Going through

Step 5. We aim at a difference p0, ˚, ˚q at the end of Step 5 (see Figure 8.6). As before, we write the equations that must be satisfied for this event to occur, starting from the fact that the input to Step 5 is 2-identical. We let p𝑤, 𝑧, 𝑧q and p𝑤, 𝑧 1 , 𝑧 1 q denote the two states after the application of 𝑆 and 𝐿, and 𝑐 and 𝑐 1 denote the two round constants. We focus on the last 3 columns, that are influenced by the constants. After D and AC, their values are as follows for p𝑤, 𝑧, 𝑧q:

Bundle 0: Bundle 1: Bundle 2: 𝑆p𝑤 2 q ' 𝑆p𝑧 2 q ' 𝑆p𝑧 2 ' 𝑐q 𝑆p𝑤 2 q ' 𝑆p𝑧 2 ' 𝑐q 𝑆p𝑤 2 q ' 𝑆p𝑧 2 q ' 𝑐 1 loooooooooooooooomoooooooooooooooon Column 2
, 𝑆p𝑤 1 q ' 𝑆p𝑧 1 ' 𝑐q ' 𝑆p𝑧 1 q 𝑆p𝑤 1 q ' 𝑆p𝑧 1 q ' 𝑐 1 𝑆p𝑤 1 q ' 𝑆p𝑧 1 ' 𝑐q loooooooooooooooomoooooooooooooooon Column 1 , 𝑆p𝑤 0 ' 𝑐q ' 𝑐 1 𝑆p𝑤 0 ' 𝑐q ' 𝑆p𝑧 0 q 𝑆p𝑤 0 ' 𝑐q ' 𝑆p𝑧 0 q loooooooooomoooooooooon Column 0 and the expressions are the same for p𝑤, 𝑧 1 , 𝑧 1 q, by replacing 𝑧 𝑖 by 𝑧 1𝑖 . For the first bundles to be equal, the following relations must hold:

𝑆p𝑧 12 q ' 𝑆p𝑧 12 ' 𝑐q " 𝑆p𝑧 2 q ' 𝑆p𝑧 2 ' 𝑐q 𝑆p𝑧 11 q ' 𝑆p𝑧 11 ' 𝑐q " 𝑆p𝑧 1 q ' 𝑆p𝑧 1 ' 𝑐q , and each has probability 2 ´2.415 to be satisfied.

Experimental results.

Experiments showed that the success probability of the distinguisher is very close to what we expected. By testing 2 30 pairs, we obtained 31 successes, a probability close to 2 ´25 . Our unoptimized C++ implementation took less than 70 minutes on a desktop computer to find these pairs, i.e., about 2 minutes per pair on average.

Forgeries with 4-Step Shadow in the Nonce Misuse Scenario

In this section, we show how to use the properties exploited in the distinguishers to create existential forgeries for the S1P mode of operation [START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF]. We use a variant of Shadow-512 reduced to 4 steps, starting at Step 2 instead of 0. These 4 steps correspond to the "aggressive parameters" specified in [Bel+19, Section 5]. We consider the single user setting.

The authors of Spook used the S1P mode for its strong integrity guarantees in presence of nonce misuse and leakage, which are formalized in the CIML2 security definition [START_REF] Berti | On Leakage-Resilient Authenticated Encryption with Decryption Leakages[END_REF] in the unbounded leakage model. Our attack requires only to reuse the same nonce three times. Thus, it falls into this scenario, but no more control is necessary.

Given access to an oracle that enciphers and tags messages with Spook (with the reduced-step Shadow-512 considered), our attack builds two messages that have the same authentication tag. This also implies a collision of the hash function where one would remove duplexing and only output the authentication tag as a hash value.

Throughout this section, Π will denote the Shadow-512 permutation reduced to Step 2-5 included. We represent the S1P mode in a very abstract manner in Figure 8.7. In particular:

• We use an empty associated data;

• We only consider two-block messages, i.e., two pairs of bundles p𝑚 0 , 𝑚 1 q, p𝑚 2 , 𝑚 3 q;

• We do need to specify the procedures Initialize and Finalize, both of which combine Shadow and the block cipher Clyde. The only requirement is that Initialize produces a 512-bit state from the nonce 𝑁 and the secret key 𝐾, and Finalize produces a 128-bit authentication tag from the current 512-bit state.

Messages are XORed to the rate part, which is of 256 bits, and constituted by bundles 0 and 1. The value of the rate is outputted as the ciphertext blocks, and thus, can be observed. The capacity (bundles 2 and 3) cannot be observed.

𝑁, 𝐾 Initialize

Initialize Initialize Attack outline. Our goal is to output two plaintexts and a nonce 𝑁 that yield the same authentication tag. In order to do that, we obtain a collision on the internal state before Finalize. This means that any pair of messages built by appending the same blocks to our colliding pair would also yield the same tag provided that the nonce is reused.

p𝑚 0 , 𝑚 1 q p𝑐 0 , 𝑐 1 q 𝜋 Π Π p𝑚 2 , 𝑚 3 q p𝑐 2 ,
The attack calls an offline subroutine and performs three encryption queries with the same nonce. It succeeds with a probability given in Lemma 8.4.

Offline step: we create two pairs of rate values that, for a given capacity value, will yield to a collision on the capacity with high probability after the application of Π.

First query: we encrypt a zero message in order to retrieve the value of the rate after the Initialize function.

Second and third query: we inject the values computed in the offline step. We retrieve the corresponding ciphertexts.

Result: if a collision on the capacity has occurred, then by combining the results of the second and third queries, it is possible to output two plaintexts that yield a collision on the full state before Finalize, thus a collision of the tag.

The whole attack is described in Algorithm 8.6. Before going into its details, we present its offline subroutine (Algorithm 8.5) and study its success probability. Lemma 8.4. Let p˚, ˚, 𝑎 2 , 𝑏 2 q be a Shadow-512 state. Then Algorithm 8.5 returns 4 bundles p𝑥 2 , 𝑦 2 q, p𝑥 1 2 , 𝑦 1 2 q such that Πp𝑥 2 , 𝑦 2 , 𝑎 2 , 𝑏 2 q ' Πp𝑥 1 2 , 𝑦 1 2 , 𝑎 2 , 𝑏 2 q " p˚, ˚, 0, 0q with a probability 𝑝 » 2 ´24.83 .

Proof. The property follows from the path depicted in Figure 8.8. On input p𝑥 2 , 𝑦 2 , 𝑎 2 , 𝑏 2 q, let us apply the Super S-Boxes, D and add the second round constant, we obtain the Algorithm 8.5 Algorithm to generate candidate pairs for our 4-step property.

Output: two pairs of rate bundles p𝑥 2 , 𝑦 2 q, p𝑥 1 2 , 𝑦 1 2 q such that Πp𝑥 2 , 𝑦 2 , 𝑎 2 , 𝑏 2 q ' Πp𝑥 1 2 , 𝑦 1 2 , 𝑎 2 , 𝑏 2 q " p˚, ˚, 0, 0q with a probability 𝑝 given by Lemma 8.4. 1: Select a random 128-bit bundle 𝑤 3 . 2: Invert step 2 on p𝑤 3 , 𝑤 3 , 0, 0q, obtaining p𝑥 2 , 𝑦 2 , ˚, ˚q 3: Select a difference 𝜖 P ∇ 4: return p𝑥 2 , 𝑦 2 q, p𝑥 2 ' 𝜖, 𝑦 2 ' 𝜖q state: p𝜎 2 p𝑎 2 q ' 𝜎 3 p𝑏 2 q ' 𝑤 3 , 𝜎 2 p𝑎 2 q ' 𝜎 3 p𝑏 2 q ' 𝑤 3 , ˚, ˚q, which is 2-identical. We note it p𝑥 3 , 𝑥 3 , 𝑎 3 , 𝑏 3 q. By definition of 𝜖, the difference goes through the Super S-Boxes and the state p𝑥 2 ' 𝜖, 𝑦 2 ' 𝜖, 𝑎 2 , 𝑏 2 q also maps to a 2-identical state.

The probability to remain 2-identical through Step 3 is 2 ´6 and through Step 4 it is 2 ´4; the states are independent so that each step counts twice.

Finally, we want a zero-difference in the capacity after Step 5. An analysis analogous to the one of Section 8.1.6 gives a probability approximately equal to 2 ´4.83 . We obtain a total probability of:

lo omo on

Step 2

ˆ2´12 lo omo on

Step 3

ˆ2´8 lo omo on

Step 4

ˆ2´4.83 lo omo on

Step 5

" 2 ´24.83 . 𝑥 2 𝑦 2 𝑎 2 𝑏 2 𝑥 2 '𝜖 𝑦 2 ' 𝜖 𝑎 2 𝑏 2 𝑥 3 𝑥 3 𝑎 3 𝑏 3 𝑦 3 𝑦 3 𝑎 3 𝑏 3 𝑥 4 𝑥 4 𝑎 4 𝑏 4 𝑦 4 𝑦 4 𝑎 4 𝑏 4 𝑥 5 𝑥 5 𝑎 5 𝑏 5 𝑦 5 𝑦 5 𝑎 5 𝑏 5 ˚˚𝑎 6 𝑏 6 ˚˚𝑎 6 𝑏 6
Step 2: prob. 1

Step 2: prob. 1

Step 3: prob. 2 ´6

Step 3: prob. 2

´6

Step 4: prob. 2 ´4

Step 4: prob. 2

´4

Step 5: prob. 2 ´4.83 In a nutshell, this property allows us to find a collision on the capacity part of the state after having applied Π. Since we can control the differences in the rate before and after Π, we then obtain a collision on the full 512-bit state. This is summarized in Algorithm 8.6.

Algorithm 8.6 Collision attack on reduced-round Spook

Input: access to the S1P mode using 4-step Shadow-512, and reusing nonces Output: two messages having the same authentication tag, with probability of success 2 ´24.83

1: First query: Encrypt an arbitrary two-block (4-bundle) message, for example, p0, 0q, p0, 0q, and obtain ciphertexts p𝑑 0 , 𝑑 1 q, p𝑑 2 , 𝑑 3 q. Let 𝑥 2 , 𝑦 2 , 𝑎, 𝑏 be the 4-bundle state after Initialize (immediately before the first application of Π). Then 𝑑 0 , 𝑑 1 " 𝑥 2 , 𝑦 2 .

2: Offline step: Use Algorithm 8.5 to obtain two pairs of rate bundles p𝑥 1 2 , 𝑦 1 2 q, p𝑥 2 2 , 𝑦 2 2 q such that Πp𝑥 1 2 , 𝑦 1 2 , 𝑎, 𝑏q ' Πp𝑥 2 2 , 𝑦 2 2 , 𝑎, 𝑏q " p˚, ˚, 0, 0q with probability 𝑝 » 2 ´24.83 . Ź Since 𝑎, 𝑏 is the unknown capacity value, it is impossible to know whether the algorithm has succeeded, and we must proceed to the next steps in all cases.

3: Second query: Encrypt (with the same nonce) p𝑥 2 ' 𝑥 1 2 , 𝑦 2 ' 𝑦 1 2 q, p0, 0q and obtain p𝑐 1 0 , 𝑐 1 1 q, p𝑐 1 2 , 𝑐 1 3 q. Then p𝑐 1 2 , 𝑐 1 3 q is the value of the rate after the application of Π on p𝑥 1 2 , 𝑦 1 2 , 𝑎, 𝑏q. 4: Third query: Encrypt (with the same nonce) p𝑥 2 ' 𝑥 2 2 , 𝑦 2 ' 𝑦 2 2 q, p0, 0q and obtain p𝑐 2 0 , 𝑐 2 1 q, p𝑐 2 2 , 𝑐 2 3 q. Then p𝑐 2 2 , 𝑐 2 3 q is the value of the rate after the application of Π on p𝑥 2 1 , 𝑦 2 1 , 𝑎, 𝑏q. 5: return the two 4-bundle plaintexts:

p𝑥 2 ' 𝑥 1 2 , 𝑦 2 ' 𝑦 1 2 q, p𝑐 1 2 , 𝑐 1 3 q and p𝑥 2 ' 𝑥 2 2 , 𝑦 2 ' 𝑦 2
2 q, p𝑐 2 2 , 𝑐 2 3 q and the nonce 𝑁 that was used. Then these plaintexts, encrypted with this nonce, yield the same internal state before the Finalize procedure, and the same tag, with probability 𝑝 » 2 ´24.83 .

Experimental results. The probability of success given in Lemma 8.4 has been verified independently. Furthermore, we have fully implemented the attack against 4step S1P itself. After 2 30 trials, we obtained 41 successful collisions, with an experimental probability of success of 2 ´24.64 which backs the theoretical 2 ´24.83 . In practice, our un-optimized C++ implementation needs about 15 minutes to find one collision.

Discussion

The attacks against Shadow and Spook that we presented do not, despite their efficiency, contradict the security analysis of the designers. For example, with Algorithm 8.5, we are able to obtain input pairs which will make the capacity collide with high probability, but this does not hold for random input pairs. Possible extensions. Our forgery attack uses the same properties as the distinguishers, with a difference in ∇ and the mapping of 2-identical states to 2-identical states. However, since we cannot control the capacity part, we cannot consider the steps before Step 2.

We remark that we can add a round at the end of the reduced-step Shadow, as this additional round does not traverse 𝐿. But this falls outside the scope of the primitive. We also remark that the differences obtained at the input of step 2 are very sparse. Since the generic complexity for a collision on the 256-bit capacity is 2 128 , there is much room for an extended attack with one more round at the beginning. But this seems far from trivial and less interesting now that the designers have moved to a new version.

A design criterion for constants. The goal of round constants is to break the symmetry in a primitive, whether between successive rounds or within the same round. This is especially important if the primitive handles a big state, as in permutation-based cryptography. Our attacks on Spook provide a new criterion for choosing round constants: they should not allow the kind of internal cancellation that we observed. However, we expect such a property to be rather rare, and it does not seem to apply to other designs in the LWC process.

Changes made by the designers. In the Spook V2 proposal [START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF], the authors made several changes to Shadow that aim at avoiding the attacks proposed in this section, without harming its performance: in fact, it becomes even better. No changes were made to Clyde nor the mode of operation.

First of all, they replace the D transform by an MDS matrix taken from [START_REF] Duval | MDS Matrices with Lightweight Circuits[END_REF]. Notably, the distinguisher presented in Section 8.1.5 cannot reach 6 steps anymore, and the forgery attack of Section 8.1.7 is also mitigated. Next, they change the constants and the way they are added to the bundles: ' for round A, a constant word of 32 bits is added to the second row of each bundle. ' for round B, a constant word of 32 bits is added to all rows of the first bundle. Since the internal symmetries that we exploited explicitly relied on the sparseness of the constants and their interaction in the first 4 columns of each bundle, it is extremely unlikely that such properties remain in Spook V2.

Cryptanalysis of Gimli

Gimli is another second-round candidate of the NIST LWC process. The submission is also permutation-based and proposes the following algorithms:

• Gimli, a cryptographic permutation operating on states of 384 bits;

• Gimli-Hash, a hash function using Gimli in a Sponge mode, producing digests of 256 bits;

• Gimli-Cipher, an AEAD using Gimli in a Sponge Duplex mode.

In particular, the definition of Gimli-Hash and Gimli-Cipher are much simpler than in Spook, since they are only based on the full permutation. Gimli was the subject of a previous publication in CHES 2017 [START_REF] Daniel | Gimli : A Cross-Platform Permutation[END_REF]. Apart from its lightness, it is also intended to be "cross-platform", thus being efficient and easy to implement both in software and hardware.

In this section, we analyze the permutation Gimli and describe reduced-round attacks on the hash function Gimli-Hash. On a very abstract level, our attacks work by combining two properties of the permutation: ' it has a rather slow diffusion, and ' it exhibits strong internal symmetries. The combination of these properties first allows us to build a distinguisher on full Gimli, with a cost 2 64 against a generic 2 96 . A practical variant attacking 23 rounds out of 24, or 24 rounds of a shifted version of Gimli, costs 2 32 instead of 2 96 , and has been implemented. Next, we study collisions on the hash function. Since Gimli is used in a Sponge mode, the attack setting is rather simple, as it amounts to find two rate inputs that, for a given capacity value, make the output capacity collide. We show how to attack 12 rounds out of 24 and 8 rounds in practical time. Finally, we also design semi-free start collision attacks, where the internal state value can be controlled, reaching up to 18 rounds.

In the quantum setting, the comparison with generic quantum collision search is more favorable, as it was exploited for the first time in [START_REF] Hosoyamada | Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound[END_REF]. Our collision and semi-free start collision attacks can be respectively extended to 14 and 20 rounds.

Description of Gimli and Gimli-Hash

We first describe Gimli and Gimli-Hash. We adopt the following notations: !, ", ă ă ă, ą ą ą represent respectively shift left, shift right, rotate left and rotate right operations on 32 bits. The variables 𝑥, 𝑦, 𝑧 will denote elements of F 32 2 . We let 𝑥 𝑖 denote the p𝑖 mod 32q 𝑡ℎ bit of 𝑥 (𝑥 33 " 𝑥 1 q with 𝑥 0 least significant (right-most).

Internal state. We let 𝑆 denote a 384-bit Gimli state, which is the concatenation of 4 columns of 96 bits, that we name 𝐴, 𝐵, 𝐶, 𝐷, where 𝐴 is column number 0, and 𝐷 is column number 3. Each column is cut into three 32-bit words 𝑥, 𝑦, 𝑧 which are denoted 𝐴 𝑥 , 𝐴 𝑦 , 𝐴 𝑧 . Thus, the state is a 4 ˆ3 ˆ32 parallelepiped. We will speak of the 𝑥 lane to denote the sequence or concatenation of words 𝐴 𝑥 , 𝐵 𝑥 , 𝐶 𝑥 , 𝐷 𝑥 .

SP-Box. The only non-linear operation in

Gimli is the SP-Box, which is applied columnwise. On input 𝑥, 𝑦, 𝑧, it updates the three words as follows:

1. Rotate 𝑥 and 𝑦: 𝑥 Ð 𝑥 ă ă ă 24, 𝑦 Ð 𝑦 ă ă ă 9 .

2. Perform the following non-linear operations in parallel (note that shifts are used rather than rotations):

𝑥 Ð 𝑥 ' p𝑧 ! 1q ' pp𝑦 ^𝑧q ! 2q , 𝑦 Ð 𝑦 ' 𝑥 ' pp𝑥 _ 𝑧q ! 1q , 𝑧 Ð 𝑧 ' 𝑦 ' pp𝑥 ^𝑦q ! 3q .
3. Swap 𝑥 and 𝑧: p𝑥, 𝑧q Ð p𝑧, 𝑥q .

Rounds. Gimli applies a sequence of 24 rounds numbered from 24 downto 1 inclusively. Each round applies an SP-Box layer, then performs a swap (every two rounds, either a "big swap" or a "small swap") and a constant addition (every four rounds). The constant at round 𝑖 is RC 𝑖 " 0x9e377900 ' 𝑖. Note that all the attacks studied hereafter are independent of the choice of round constants. An algorithmic depiction of full Gimli is given in Algorithm 8.7, and the rounds are represented as in Figure 8.9. The state before round 𝑖 is denoted 𝑆 𝑖 " 𝐴 𝑖 , 𝐵 𝑖 , 𝐶 𝑖 , 𝐷 𝑖 . Thus, 𝐴 𝑖 𝑥 denotes the 𝑥 branch of the 𝐴 column before the SP-Box of round 𝑖 is applied, and so on. When considering reduced-round versions of Gimli, we let Gimlip𝑟, 𝑟 1 qp𝑆q denote the application of rounds 𝑟 to 𝑟 1 included, where 𝑟 1 ď 𝑟. if 𝑟 mod 4 " 0 then 4:

Swap 𝐴 𝑥 and 𝐵 𝑥 , swap 𝐶 𝑥 and 𝐷 𝑥 Ź small swap 5:

𝐴 𝑥 Ð 𝐴 𝑥 ' RC 𝑟 Ź Constant addition 6:
else if 𝑟 mod 2 " 0 then 7:

Swap 𝐴 𝑥 and 𝐶 𝑥 , swap 𝐵 𝑥 and 𝐷 𝑥 Ź big swap Return 𝑆 Gimli-Hash. This function is built using the Gimli permutation in a Sponge construction, as represented in Figure 8.10 and Algorithm 8.8. The Gimli state is initialized to the all-zero value. The message is padded and separated into blocks of size 𝑟 " 128, introducing message blocks of 128 bits between two permutation applications by XORing them to the first 128 bits of the state. Once all the padded message blocks are processed, a 32-byte hash is generated by outputting the rate value, applying once Algorithm 8.8 Gimli-Hash (from [START_REF] Daniel | Gimli. Submission to NIST-LWC[END_REF]).

Input: 𝑀 P t0, 1u

Output:

ℎ P t0, 1u 256 1: 𝑆 Ð 0 Ź Initialize state to 0 2: 𝑚 1 , . . . , 𝑚 𝑡 Ð padp𝑀 q 3: for 𝑖 from 1 to 𝑡 do 4: if 𝑖 " 𝑡 then 5: 𝐷 𝑧 Ð 𝐷 𝑧 ' 0x01000000 6: 𝑆 Ð absorbp𝑆, 𝑚 𝑖 q Ź XOR 𝑚 𝑖 in

Previous work

We provide here a brief overview of the main previous third-party results of cryptanalysis against either the permutation or the NIST candidate Gimli. A summary of these results, including the results of [Fló+20] that will not be presented in this chapter (linear and differential-linear cryptanalysis), is given in Table 8.4. Notice that all the cryptanalysis previously considered were classical attacks.

Structural permutation distinguisher on 22.5 rounds. In [START_REF] Hamburg | Cryptanalysis of 22 1/2 rounds of Gimli[END_REF], Hamburg proposed the first third-party cryptanalysis of the Gimli permutation, providing distinguishers on reduced-round versions of the permutation. This analysis does not depend on the details of the SP-Box, and is based only on the slow diffusion of Gimli. Thus, it follows a similar path as the distinguishers of Section 8.2.3. In his work, Hamburg defines a PRF with 192-bit input 𝑥 and 192-bit key 𝑘 that computes 𝐹 p𝑘, 𝑥q " trunc 192 pGimlip𝑘}𝑥qq. He gives a distinguishing attack in time 2 64 for 15.5 rounds (omitting the final swap), and a key-recovery attack on 𝐹 when using 22.5 rounds of Gimli, precisely rounds 25 to 2.5 (omitting again the final swap). This attack runs in time 2 138.5 with a memory requirement of 2 129 , which is faster than the expected 2 192 , and thus shows that 22.5-round Gimli behaves differently than what could be expected from a random permutation.

Hamburg's attacks are based on a meet-in-the-middle approach, exploiting the slow diffusion by tabulating some of the values that are passed from an SP-Box to another. The 15.5-round distinguisher relies on a table of size 2 64 , and the 22.5-round attack on a table of size 2 128 . These attacks are far from practical.

Zero-sum permutation distinguishers on 14 rounds. In [START_REF] Cai | Zerosum Distinguishers for Round-reduced GIMLI Permutation[END_REF], Cai, Wei, Zhang, Sun and Hu present a zero-sum distinguisher on 14 rounds of Gimli. This distinguisher uses the inside-out technique and improves by one round the integral distinguishers given by the designers.

ZID permutation distinguishers.

In an independent work [START_REF] Liu | Exploiting Weak Diffusion of Gimli: A Full-Round Distinguisher and Reduced-Round Preimage Attacks[END_REF], Liu, Isobe, and Meier present a "hybrid zero-internal differential" (ZID) distinguisher on full Gimli, which extends a ZID distinguisher of previous unpublished work. The basic ZID distinguisher happens to be what we call an internal symmetry distinguisher, where states with symmetries are produced in the input and in the output of a reduced-round variant of Gimli. A "hybrid" one adds a limited birthday-like property (which is absent from our distinguishers). The steps that they take are however different from ours, as this distinguisher only spans 14 rounds. Compared with our analysis in Section 8.2.3, they will actually start from a much more constrained middle state, which limits the number of rounds by which one can extend the distinguisher afterwards (or significantly increases the complexity). In contrast, we complete the middle state in multiple successive steps, each step ensuring that more rounds will be later covered. After the publication of our distinguisher, the authors of [START_REF] Liu | Exploiting Weak Diffusion of Gimli: A Full-Round Distinguisher and Reduced-Round Preimage Attacks[END_REF] proposed to modify it in order to reduce the time complexity to 2 52 instead of 2 64 .

Collisions and preimages on Gimli-Hash. In [ZDW19], Zong, Dong and Wang study Gimli among other candidates of the competition. They present a 6-round collision attack on Gimli-Hash of complexity 2 113 , using a 6-round differential characteristic where the input and output differences are active only in the rate. This differential characteristic was invalidated in [START_REF] Liu | Automatic Verification of Differential Characteristics: Application to Reduced Gimli[END_REF].

In [START_REF] Liu | Preimages and Collisions for Up to 5-Round Gimli-Hash Using Divide-and-Conquer Methods[END_REF], [START_REF] Liu | Exploiting Weak Diffusion of Gimli: A Full-Round Distinguisher and Reduced-Round Preimage Attacks[END_REF] and [START_REF] Liu | Automatic Verification of Differential Characteristics: Application to Reduced Gimli[END_REF] Liu, Isobe and Meier give collision and preimage attacks on reduced-round Gimli-Hash. Their attacks rely on divide-and-conquer methods, exploiting the lack of diffusion between the columns, as did Hamburg, but they also rely on SP-Box equations in order to attack the hash function itself. These equations are different from those that we will solve in Section 8.2.4, and they mostly relate the input and outputs of a single SP-Box, whereas we study directly two SP-Boxes. Their analysis is also much more precise, since they prove running times of solving these equations.

After giving a meet-in-the-middle generic preimage attack of time and memory complexity 2 128 , which sets a bound against the sponge construction used in Gimli-Hash, they give practical preimage attacks on 2-round Gimli-Hash and practical collision attacks on 3-round Gimli-Hash. They give a collision attack on 5-round Gimli-Hash with a time complexity 2 65 and a second preimage attack with time complexity 2 96 . They give in [START_REF] Liu | Exploiting Weak Diffusion of Gimli: A Full-Round Distinguisher and Reduced-Round Preimage Attacks[END_REF] a preimage attack on 5-round Gimli-Hash. In [START_REF] Liu | Automatic Verification of Differential Characteristics: Application to Reduced Gimli[END_REF], they give a semi-free start collision attack on 8 rounds and a state-recovery attack on the AE scheme for 9 rounds.

Internal Symmetry Distinguishers against Gimli

In this section, we present distinguishers on the Gimli permutation that allow to reach its full 24-round version. A practical version on 23 runs in time 2 32 and was implemented. Our results do not rely on the specification of the SP-Box, neither on the value of the round constants: we can replace the SP-Box by any permutation picked uniformly at random, and we can also replace the round constants by random 32-bit values.

The only property that we exploit is the slow diffusion of Gimli via the Small and Big Swap operations, allowing to propagate states with internal symmetries. We define a notion of 2-identical states for Gimli, which is similar to the definition given in Section 8.1.2 for Shadow states. Definition 8.2 (2-identical states). A state 𝑆 is 2-identical if 𝐵 " 𝐷, if 𝐴 " 𝐶, or if one of these properties holds up to a swap and a constant addition.

Our internal symmetry distinguishers find a 2-identical input that is mapped to a 2-identical output. Since there are 96 bits of constraint, a generic algorithm returning such an input should run in time 2 96 by evaluating the permutation on a set of inputs satisfying the property until the output matches it by chance. Our aim is to find more efficient algorithms in the case of Gimli. This is slightly different from the limitedbirthday distinguishers that we used in the case of Shadow, since we do not consider pairs of states satisfying a truncated differential, but a single state that belongs to a vector space.

23-round Practical Distinguisher

We design an internal symmetry distinguisher on 23 rounds of Gimli, that is represented in Figure 8.11, running in time equivalent to 2 32 evaluations of Gimli on average. Algorithm 8.9 starts from a symmetric state in the middle and completes the state 𝑆 11 in three steps. Each step assigns a value to more words of the state, and ensures that the 2-identical symmetry property goes through more rounds.

Algorithm 8.9 23-round internal symmetry distinguisher. Output: a 2-identical state 𝑆 such that Gimlip23, 1qp𝑆q is 2-identical We start from the middle. We will be interested in the state 𝑆 11 . • 𝑆 23 is 2-identical: indeed, 𝐴 and 𝐶 will remain identical from rounds 16 to 19 backwards. Then, the small swap backwards injects the same value in 𝐴 and 𝐶 since 𝐵 and 𝐷 are also identical. Thus, 𝐴 23 " 𝐶 23 .

Select

• 𝑆 7 is 2-identical: indeed, since 𝐵 11 𝑥 " 𝐷 11 𝑥 , 𝐵 and 𝐷 remain equal until the SP-Box layer of round 8, and the 2-identical property remains after the small swap of round 8. Once good values have been found, we can compute part of the state 𝑆 11 : 𝐴 11 𝑦,𝑧 , 𝐶 11 𝑦,𝑧 , and 𝐵 11 𝑥 " 𝐷 11 𝑥 are fixed. The rest remains free.

Select 𝐴 11

𝑥 " 𝐶 11 𝑥 ' RC 12 such that 𝐵 7 𝑥 " 𝐶 7 𝑥 . At this point, the two-identicality of the output state is preserved through 4 more rounds (until round 4 included):

𝑆 3 is 2-identical.
In the state 𝑆 11 , 𝐵 11 𝑦,𝑧 " 𝐷 11 𝑦,𝑧 remain free.

Select 𝐵 11

𝑦,𝑧 " 𝐷 11 𝑦,𝑧 such that 𝐵 3 𝑥 " 𝐶 3 𝑥 . Thus, the output 𝑆 0 is 2-identical.

Each step of Algorithm 8.9 requires to evaluate a few SP-Boxes 2 32 times (we do not even need to evaluate the inverse SP-Box). The total amount of computations is Step 1

Step 2

Step 3 Figure 8.11: Distinguisher on Gimlip23, 1q. The same color for symmetric branches or columns at a given round means that they are equal. smaller than 2 32 evaluations of 23-round Gimli. Notice also that the algorithm uses only a small amount of memory. Our implementation of Algorithm 8.9 ran in less than one hour on a regular laptop.

The time complexity of the algorithm can be computed as follows: 8 ˆ232 SP-Box evaluations for the first step, 8 ˆ232 for the second and 16 ˆ232 for the third, meaning a total of 8 ˆ232 `8 ˆ232 `16 ˆ232 " 40 ˆ232 which is less than 2 32 evaluations of 23-round Gimli (each of them consisting essentially of 92 SP-Box evaluations). This complexity is to be compared to that of the generic algorithm for obtaining our internal symmetry property, which costs 2 96 .

An unoptimized C++ implementation finds a valid state in about 900 seconds on a standard laptop. Below is an example: 7f9fcf70 6aedf7e6 7f9fcf70 cb2f0e6a 𝑆 23 : 0ba2f1f9 f339b619 0ba2f1f9 f70cf15c b2ee8259 df0b4801 b2ee8259 3856106d a8ef848d 8c17b743 9615b3bc 8c17b743 𝑆 0 " Gimlip23, 1qp𝑆 23 q: 541122c5 30530879 8d9d5d30 30530879 74b6dbe6 18885a6e 744b55c1 18885a6e

Distinguisher on full Gimli and Extensions

An extension of our distinguisher to the full Gimli is a trivial matter. Indeed, after running Algorithm 8.9, we obtain a 2-identical input state 𝑆 23 " 𝐴 23 , 𝐵 23 , 𝐶 23 , 𝐷 23 with 𝐴 23 " 𝐶 23 . Then, if 𝐵 23 𝑥 " 𝐷 23 𝑥 , which is a 32-bit condition, the state remains 2-identical after the inverse round 24. By repeating the previous procedure 2 32 times, we should find an input value that verifies the output property. The generic complexity of finding a 2-identical input that generates a 2-identical output is still 2 96 . Thus, full Gimli can be distinguished in time less than 2 32`32 " 2 64 full Gimli evaluations, and constant memory.

An interesting question is: how many rounds of a Gimli-like permutation can we target? The distinguisher works mainly because the diffusion in Gimli is somewhat slow. Thus, a possible fix would be to increase the number of swaps, for example by having one in each round instead of every two rounds. An attack exploiting this behavior that worked previously for 𝑟 rounds would now a priori work for 𝑟{2 rounds only. Of course, the details of the SP-box could allow further improvement of these results given that a single iteration would now separate the swaps rather than a double.

Extending to 28 rounds. It is trivial to adapt this distinguisher to an extended version of Gimli with more rounds. The 2-identicality of 𝑆 0 is preserved after one round since the next round would apply only an SP-Box layer and a small swap. Similarly, the 2-identicality of 𝑆 24 is preserved after 3 more inverse rounds since the next swap operation is a big swap which exchanges data between 𝐴 and 𝐶 only. Thus, our practical distinguisher works against Gimlip23, 0q (a 24-round version of Gimli shifted by one round), and our extended distinguisher works against Gimlip27, 0q (a 28-round version of Gimli).

Classical Collisions on Reduced-Round Gimli-Hash

We now present collision attacks on the hash function Gimli-Hash instantiated with a round-reduced Gimli. We will consider two kinds of collisions:

Full-state collisions (standard): given an internal state 𝑆 " 𝑆 𝑥 , 𝑆 𝑦 , 𝑆 𝑧 of 384 bits that is not controlled, we find two rate values 𝑆 1 𝑥 and 𝑆 2 𝑥 (the 𝑥 lane) such that Gimlip𝑟, 𝑟 1 qp𝑆 1 𝑥 , 𝑆 𝑦 , 𝑆 𝑧 q " 𝑇 1 𝑥 , 𝑇 𝑦 , 𝑇 𝑧 and Gimlip𝑟, 𝑟 1 qp𝑆 2 𝑥 , 𝑆 𝑦 , 𝑆 𝑧 q " 𝑇 2 𝑥 , 𝑇 𝑦 , 𝑇 𝑧 collide on the capacity (the 𝑦 and 𝑧 lanes). This gives two triples of message blocks 𝑀 0 , 𝑀 1 , 𝑀 2 and 𝑀 0 , 𝑀 1 1 , 𝑀 1 2 such that the full state after absorbing them is equal:

• 𝑀 0 determines the value of 𝑆;

• 𝑀 1 and 𝑀 1 1 are 𝑆 𝑥 ' 𝑆 1 𝑥 and 𝑆 𝑥 ' 𝑆 2 𝑥 respectively; • 𝑀 2 and 𝑀 1 2 are 0 and 𝑇 1 𝑥 ' 𝑇 2 𝑥 respectively.

Appending any sequence message blocks afterwards will yield a collision of the hash value.

Semi-free start collisions: we find pairs of (384-bit) states 𝑆, 𝑆 1 such that 𝑆 and 𝑆 1 differ only in the 𝑥 lane before and after Gimlip𝑟, 𝑟 1 q. This does not yield a collision on the hash function as we would need to choose the value of the same initial state; however, it represents a vulnerability that may be used in the context of the Gimli modes of operation, or if the adversary is given more control. In Gimli-Cipher, it enables someone to create a key, a nonce and a pair of messages which yield the same tags.

These results are summarized in Table 8.5.

SP-Box Equations and How to Solve Them

Our attacks exploit the slow diffusion of Gimli and the simplicity of the SP-Box (contrary to the distinguishers on the permutation, which worked regardless of the SP-Box used).

In this section, we describe a series of "double SP-Box equations"; solving them will be the main building block of our attacks. We define the following equations.

Given 𝑦, 𝑧, find 𝑥 ‰ 𝑥 1 such that 𝑆𝑃 2 p𝑥, 𝑦, 𝑧q 𝑥 " 𝑆𝑃 2 p𝑥 1 , 𝑦, 𝑧q 𝑥 . (8.9)

Given 𝑦, 𝑧, 𝑦 1 , 𝑧 1 , find 𝑥 such that 𝑆𝑃 2 p𝑥, 𝑦, 𝑧q 𝑥 " 𝑆𝑃 2 p𝑥, 𝑦 1 , 𝑧 1 q 𝑥 . (8.10)

Given 𝑦, 𝑧, 𝑦 1 , 𝑧 1 , find 𝑥 such that 𝑆𝑃 2 p𝑥, 𝑦, 𝑧q 𝑧 " 𝑆𝑃 2 p𝑥, 𝑦 1 , 𝑧 1 q 𝑧 . (8.11)

Given 𝑦, 𝑧, 𝑥 1 , find 𝑥 such that 𝑆𝑃 2 p𝑥, 𝑦, 𝑧q 𝑥 " 𝑥 1 . (8.12) Number of solutions. Except Equation (8.9), all these equations have on average, when the inputs are drawn uniformly at random, a single solution. However, the variance on the number of solutions depends on the equation considered. For example, only approx. 6.2% of inputs to Equation (8.10) have a solution, and they have on average 82.4 solutions each. Equation (8.12) gives a little more than 1.5 solutions. This variance is not a problem for us, as long as we can produce efficiently all solutions of the equations, which remains the case. In order to simplify our presentation, we will do as if equations (8.10), (8.11) and (8.12) always gave exactly a single solution for each input.

Solving the equations. We use an off-the-shelf SAT solver [START_REF] Soos | Extending SAT Solvers to Cryptographic Problems[END_REF]. In some cases, more time seems spent building the SAT instance rather than solving it, and we believe that our current implementation is highly unoptimized.

The solver allows us to retrieve all solutions of a given equation (we treat Equation (8.9) differently because it has on average 2 32 of them). Let us consider the average time to produce a solution when random inputs are given. On a standard laptop, this time varies between approximately 0.1 milliseconds (Equation (8.10)) and 1 millisecond (Equation (8.12)). This difference mainly stems from the fact that Equation (8.10) often has no solutions, and that the solver quickly finds a counterexample, while Equation (8.12) practically always has solutions that must be found.

On the same computer, an evaluation of the full Gimli permutation (not reducedround) takes about 1 microsecond, so there is approximately a factor 1000 between computing Gimli and solving a double SP-Box equation.

We consider that all equations have approximately the same complexity and introduce a factor 𝑡 𝑒 that expresses the time taken to solve them in number of evaluations of Gimli.

Full-State Collisions

We consider the reduced-round permutation Gimlip21, 14q (8 rounds). We omit the last swap, because it does not mix between the rate and the capacity. The situation is represented in Figure 8.12 and described in Algorithm 8.10. As before, we name 𝑆 𝑖 the state immediately before round 𝑖. 𝑥 respectively in the rate, after Gimlip21, 14q (without the last swap), the state differs only on 𝐴 𝑥 . Note that with this attack, the two 128-bit message blocks differ only on 32 bits. Complexity: 7 ˆ232 ˆ𝑡𝑒 evaluations of Gimli and 2 32 memory or 8 ˆ232 ˆ𝑡𝑒 and negligible memory.

The attack runs in two main steps, both of which must solve 2 32 times a sequence of SP-Box equations.

Step 8.12). We expect on average a single solution, and little variation on the number of solutions, as only Equation (8.12) is involved.

Step 2: find 𝐵 21 𝑥 , 𝐶 21 𝑥 , 𝐷 21 𝑥 . 𝑥 that will conform to these branches. Then, the whole states are deduced. The branches 𝐴 13 𝑥 and 𝐴 11 𝑥 remain to match.

Find

Algorithm 8.10 finds on average a single solution, with any input state. There is some variance on the number of solutions, that is induced by the SP-Box equations, but it is small in practice. Furthermore, we can eliminate the memory requirement by solving Equation (8.9) for many input random states. Starting from a given state, it suffices to apply one more Gimli permutation with a random message block, in order to re-randomize the input.

Remark that if we omit the second step then we already have a semi-free-start collision attack, because we can reconstruct the inputs 𝐶 21 and 𝐷 21 immediately from the middle.

Practical application: first step. Since the experimental value of 𝑡 𝑒 that we obtained was around 2 10 evaluations of Gimli, the expected cost of this 8-round collision attack was around 8 ˆ232 ˆ210 " 2 45 evaluations of Gimli, so we could try to perform a practical implementation. We considered rounds 21 to 14 included. We solved Step 1 first, starting from 0, 0, 0, 0 and using a random message of the form 𝑚 1 , 0, 0, 0 to randomize the first block. We also solved at the same time the two Equations (8.12) that enabled us to go back to 𝐴 17 𝑥 , 𝐵 17 𝑥 . We had to produce 15582838652 » 2 33.86 solutions for Equation (8.9) until we found a solution for Step 1 and for both equations. We verified experimentally that each solution for Equation (8.9) yielded on average a solution for the final equation. We obtained in total 5 solutions, as shown below. There are two different solutions for 𝐴 15 𝑥 ' RC 16 , which yield two and three solutions respectively for 𝐵 17 𝑥 . The total computation ran in less than 5000 core-hours (parallelized).

𝑚 Practical application: second step. We solved Step 2, that is, looking for 𝐶 21 𝑥 , 𝐷 21 𝑥 that lead to one of the pairs 𝐴 17 𝑥 , 𝐵 17 𝑥 . This step was much faster than the previous one, although it ought to have the same complexity: this is because we paid in step 1 the probability to find a solution (twice) in Equation (8.12), while in step 2 we benefited from having 5 different possible solutions. We found two solutions: 𝐶 21 𝑥 , 𝐷 21 𝑥 " 819b1392, 9f4d3233 and 𝐶 21 𝑥 , 𝐷 21 𝑥 " aa9f6f2d, 3a6e613a.

Putting both steps together. With these solutions, we built two full-state collisions on Gimli-Hash using 8-round Gimlip21, 14q. We start from 𝑚 1 , 0, 0, 0, then after one round, we inject the values 𝐴 𝑥 respectively in the rate; then we obtain two states that differ only on the 𝑥-coordinate of the third column (not the first, due to a big swap), and we inject two different blocks to cancel out this difference, obtaining the same state. The full state then collides, and we can append any message block that we want. An example is given in Table 8.6. Table 8.6: An 8-round collision on Gimli-Hash.

First message block dc84bf38 00000000 00000000 00000000 dc84bf38 00000000 00000000 00000000

Second message block bbdb41f3 4333192c bc17e444 8a9d06c7 1b1da6e4 4333192c bc17e444 8a9d06c7

Third message block 00000000 00000000 00000000 00000000 00000000 00000000 afad801e 00000000 Extending the attack. Remark that the first step can be extended to span any number of 𝑆𝑃 2 -boxes. However, each time we add two more rounds, there is one more branch coming from the 𝐵, 𝐶, 𝐷 states which has to match an expected value, so we multiply the complexity by a factor 2 32 . Since 𝑡 𝑒 ! 2 32 , we can do that twice before

' RC20 ' RC16 ' RC12
Step 1 fix branches

Step meeting the bound 2 128 . Thus, a collision on 12-round Gimli-Hash can be built in time 2 96 ˆ4 ˆ𝑡𝑒 .

Semi-free Start Collisions

Exploiting the same principles (the weak diffusion of Gimli and the simplicity of solving the SP-Box equations), we can design semi-free start collision attacks reaching more rounds. This time, our goal is to obtain two input states 𝑆, 𝑆 1 that differ only in the rate (in practice, only in 𝐴 𝑥 ) and such that after applying a reduced-round Gimli, the output states differ only in the rate (in practice, only in 𝐴 𝑥 before the swap). The previous "first step" remains the same, with an extension to whichever number of rounds we are targeting. The "second step" is changed, because we can now choose completely the columns 𝐵, 𝐶, 𝐷, e.g., by starting from the middle instead of having to choose only the input rate.

Doing this allows us to reach 4 rounds more for the same cost as before, as outlined in Figure 8.13 and Algorithm 8.11. We can then append new rounds as before, reaching 16 rounds classically in time 2 96 ˆ10 ˆ𝑡𝑒 .

Another improvement using precomputations. We are going to win a factor 2 32 using 2 64 ˆ𝑡𝑒 precomputations and a table of size 2 64 . This way, we can attack two more rounds. Indeed, once we have computed the first step, the two branches 𝐶 17 𝑥 and Algorithm 8.11 12-round semi-free start collision attack (see Figure 8.13).

Input: an initial 𝐴 (can be given) Output: 𝐴 𝑥 , 𝐴 1 𝑥 , 𝐵, 𝐶, 𝐷 such that after Gimlip21, 10q, only the rate differs. Complexity: 2 32 ˆ10 ˆ𝑡𝑒 evaluations of Gimli As before, we don't write the last swapping step.

Step 1: Same step as in Algorithm 8.10, extended to 12 rounds. It gives a total of 10 32-bit branches (input values) that are required, that are represented in red on Figure 8.13.

Step 2: we will start from the middle.

2.1

We take an arbitrary value for 𝐵 19 𝑦,𝑧 . This guess enables to deduce all values of the column 𝐵, from 𝐵 21 to 𝐵 10 , either by simply computing the SP-Box, or by solving Equation (8.12) (given two input branches 𝑦, 𝑧, given the output 𝑥, deduce the input 𝑥). From this, we deduce the value in all branches that go from 𝐵 to 𝐷 in Figure 8.13, hence 4 branches.

2.2

We take an arbitrary value for 𝐷 19 𝑦,𝑧 . Again, this enables to deduce the whole sequence of states from 𝐷 20 to 𝐷 10 , either by computing the SP-Box when possible, or by finding the input 𝑥 value corresponding to a given output. We also obtain the values of branches that are transmitted from 𝐷 to 𝐶.

We now guess 𝐶 15

𝑧 . Given this, and 𝐶 15 𝑥 , and the output 𝐴 13 𝑥 that must be met, we obtain the whole state by solving another simple SP-Box equation (which is not Equation (8.12), but has a similar form).

1. Having deduced 𝐶 15 , we have only 2 ´32 chances of obtaining the right 𝐶 17 𝑥 , so we have to repeat all of this 2 32 times.

In total, we have to solve 5 SP-Box equations, 2 32 times, in both steps, so the time complexity is 2 32 ˆ10 ˆ𝑡𝑒 .

𝐴 13

𝑥 contain arbitrary fixed values. Then, when we try to find the right 𝐶, we could have a table that for all 𝐶 15 𝑦 , 𝐶 15 𝑧 , gives all input-output values for 𝐶 17 and 𝐶 14 , and we could directly use this table to match the values 𝐶 15 𝑥 and 𝐷 15 𝑥 that come from 𝐷 (instead of having to make a guess of 𝐶 15 𝑧 . Let us fix 𝐶 17 𝑥 " 𝐴 13 𝑥 " 0. Thus, we repeat step 1 in Algorithm 8.11 a total of 2 64 times in order to have 𝐶 17 𝑥 " 𝐴 13 𝑥 " 0.

Step 1 now costs 2 96 ˆ𝑡𝑒 . The table that we precompute shall contain: for each 𝑥 1 , 𝑥 2 , all values (on average 1) of 𝑦 1 , 𝑧 1 such that 𝑆𝑃 2 p0, ˚, ˚q " 𝑥 1 , 𝑦 1 , 𝑧 1 and 𝑆𝑃 2 p𝑥 2 , 𝑦 1 , 𝑧 1 q " 0, ˚, ˚. Now, in Algorithm 8.11, for each guess of 𝐵 19 𝑦,𝑧 , and for each guess of 𝐷 19 𝑦,𝑧 , we can find the value of 𝐶 that matches all the fixed branches in time 1, using this table. Thus, we can repeat this 2 96 times, extending the attack by 6 rounds.

• Step 1 costs 2ˆ2 96 ˆ𝑡𝑒 (we solve only 2 equations most of the time, before aborting if the wanted "0" do not appear).

• The table costs 2 64 ˆ𝑡𝑒 , which is negligible

•
Step 2 costs 2 96 ˆ5 ˆ𝑡𝑒 , since it is the same as before, and we only need forwards computation of SP-Boxes to check if the full path is correct.

Note that we can get rid of the term 𝑡 𝑒 if we use a memory of size 2 96 to store the solutions of the SP-Box equations. In that case, the overall time complexity is slightly below 2 96 evaluations of Gimli, since fewer SP-Boxes are evaluated in each step than in the full primitive.

Quantum Collision Attacks on Gimli

As was shown for the first time in [START_REF] Hosoyamada | Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound[END_REF], collision attacks may reach more rounds in the quantum setting than in the classical one. This will be the case here. Note that these attacks do not require any form of black-box query, since the hash function is public by nature, hence we stay in the Q1 setting. Intuitively, each step in these attacks is an independent exhaustive search on some well-defined search space. The generic quantum collision search complexity on Gimli-Hash is approximately 2 256{3 " 2 85.3 computations of Gimli, using the BHT algorithm (Algorithm 2.10 in Section 2.3). In Section 8.2.4, we limited ourselves to attacks of complexity approximately 2 96 ˆ𝑡𝑒 , because the generic complexity lies at 2 128 Gimli evaluations. But classical attacks with a time as high as 2 128 ˆ𝑡𝑒 , if they benefit from a square-root speedup, will quantumly fall at 2 64 ˆ𝑡𝑒 which is below generic.

In this section, we will rely on two generic tools to turn a classical attack algorithm into a quantum one: Amplitude Amplification (Section 2.1) to replace the exhaustive search steps and generic quantum embeddings of classical algorithms (Section 1.2.3). Indeed, we know that the SP-Box equations that we defined can be solved in a time complexity of about 𝑡 𝑒 " 2 10 evaluations of Gimli. Consequently, there exists quantum algorithms to solve these equations with a quantum time complexity of about 𝑡 𝑞𝑒 » 𝑡 𝑒 quantum evaluations of Gimli. This allows to compare our complexities with the generic ones without going into the details of a quantum circuit for Gimli.

Example. We consider the 8-round collision attack of Algorithm 8.10. Both its steps run in classical time 2 32 ˆ4 ˆ𝑡𝑒 by running 2 32 iterates of a randomized algorithm of time complexity 4 ˆ𝑡𝑒 :

• In the first step, we try all 𝐴 21 𝑥 to find the one such that, after solving a sequence of SP-Box equations, a 32-bit condition is met: the first equation finds 𝐴 121 𝑥 such that there is a collision in 𝑥 after two SP-Boxes, the second equation finds 𝐴 19 𝑥 such that there is a collision in 𝑥 after two SP-Boxes, etc., and the final 32-bit condition is that 𝐴 113 𝑧 and 𝐴 13 𝑧 must collide. • In the second step, we try all 𝐶 21 𝑥 to find the one that satisfies a 32-bit condition.

Using Amplitude Amplification, we obtain a corresponding quantum algorithm with time complexity approximately 2 16 ˆ4 ˆ𝑡𝑒 . This approximation comes from different factors:

• a small constant factor 𝜋 2 which is inherent to quantum search.

• the trade-offs between time and space in the detailed implementations of the primitive and its components. In fact, Gimli is not so difficult to implement using Clifford+T quantum gates, compared with the AES (Chapter 9) that requires a custom quantum circuit for its S-Box.

We are mainly interested in the security margin, and these approximations will be sufficient for us to determine whether a given algorithm runs faster or slower than the corresponding quantum generic attack. Thus, we will write that the quantum 8-round attack on Gimli-Hash runs in time » 2 16 ˆ4 ˆ𝑡𝑒 .

Collisions. By adding another 32-bit condition in the classical 12-round collision attack, we obtain a procedure which runs classically in time 4 ˆ2128 ˆ𝑡𝑒 , which is too high. However, using Amplitude Amplification, we obtain a procedure that runs in quantum time » 4 ˆ264 ˆ𝑡𝑒 and reaches 14 rounds.

Semi-free start collisions.

We can extend the 18-round semi-free start collision attack in the same way. Building the table will still cost a time 2 64 . This table must be stored in a classical memory with quantum random access. The first step goes from 2 ˆ296 ˆ𝑡𝑒 classically to approximately 2 ˆ248 ˆ𝑡𝑒 quantumly. The second step does as well. Thus, adding a 32-bit condition enables us to attack 20 rounds in quantum time 2 64 ˆ4 ˆ𝑡𝑒 .

Discussion

The results presented in this section exploit the relatively slow diffusion between the columns of the Gimli state. Indeed, swaps occur only once every two rounds. Thus, the Gimli SP-Box is always applied twice, except at the first and last rounds, and the permutation can be viewed as an SPN with only 12 rounds, with very simple linear layers.

The distinguisher on Gimli also draws on the fact that the constant addition occurs only every four rounds and only on a single column. In short, a 32-bit condition is enough for two columns to remain symmetric after four rounds of Gimli. Starting from the middle is a clear advantage. The slow diffusion helps in guessing the middle state piece by piece.

The collision attacks on Gimli combine this with the simplicity of the double SP-Box. Solving equations between inputs and outputs of a double SP-Box is a trivial matter. Thus, it becomes easier to set some state values in order to satisfy a condition many rounds later.

The strength of this distinguisher and its low complexity shows that Gimli cannot be used in a hermetic sponge strategy. Although the collision attacks do not target the full mode, it seems worth to tweak the permutation in order to increase its security margin. The designers of Gimli mention in the submission package [START_REF] Daniel | Gimli. Submission to NIST-LWC[END_REF] that they had studied other linear layers than the swaps, in particular using an MDS transformation or the linear layer of SPARX [START_REF] Dinu | Design Strategies for ARX with Provable Bounds: Sparx and LAX[END_REF]. They state:

We found some advantages in Gimli-MDS and Gimli-SPARX in proving security against various types of attacks, but it is not clear that these advantages outweigh the costs.

The attacks of this section do not apply to the other variants, and they seem a priori much stronger to our internal symmetry and guess-and-determine approach. This makes their advantage clearer, although a renewed analysis would be needed.

Further developments. These results may have appeared surprising, as Gimli was a permutation proposed much earlier than the LWC process (in 2017), and it had already attracted a reasonable amount of third-party cryptanalysis.

In August 2020, our paper [Fló+20] was accepted at ASIACRYPT 2020. It later received a "best paper" award. The full version contains more results than the contents of this section, notably an analysis of linear and linear-differential distinguishers on the permutation, which had not been done before.

In September 2020, between the second and third round of the process, the NIST proposed to the submitters of second-round algorithms to publish status updates. In their document, the designers of Gimli [START_REF] Daniel | Gimli: NIST LWC Second-round Candidate Status Update[END_REF] briefly dismissed the notion of a distinguisher for a permutation as follows:

The state-of-the-art permutation distinguisher is a generic distinguisher of the form "is 𝑃 p0q " 𝑥?" that succeeds against every permutation in time 1, when 𝑥 is chosen appropriately. This statement obviously misinterprets the notion of a "distinguisher" in this context. It has also the undesirable effect of dismissing all security analyses of permutations and block ciphers in the known-key model in general, which represents a long-standing line of work.

Chapter 9

Quantum Security Analysis of AES As Grover's algorithm speeds up exhaustive key search by a square root factor, a 128-bit security level in the quantum world seems to require keys of at least 256 bits. Fortunately, the current block cipher standard [AES] allows such key lengths, and its 256-bit version is recommended for post-quantum security. This is stated in the report on quantum computing from the National Academy Sciences, Engineering, and Medicine [START_REF]Quantum Computing: Progress and Prospects[END_REF]:

Even if a computer existed that could run Grover's algorithm to attack AES-GCM, the solution is quite simple: increase the key size of AES-GCM from 128-bit to 256-bit keys.

At the same time, some desired levels of security in the NIST call for post-quantum public-key cryptosystems [START_REF]Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process[END_REF] are defined relatively to the hardness of exhaustive key search on AES variants. Thus, the optimization of quantum circuits for AES key search is motivated not only by determining the post-quantum security of AES, but also by reaching a better precision in the NIST post-quantum cost metrics.

AES is one of the most used and studied block ciphers classically (if not the most). It has been the subject of a continued cryptanalysis effort, allowing to determine and refine its security margin and to have a more than justified confidence in it. However, prior to our results from [BNS19b], no such study had been performed against quantum adversaries, Q1 or Q2 alike. The results of [BNS19b], that we will detail in this chapter, give a first overview of the post-quantum security of AES. They suggest that AES seems as safe in the quantum world as in the classical one. As a side effect, our results also improved the memory complexity of some of the best known classical attacks on AES.

Introduction

We study reduced-round attacks on AES variants, in the secret-key model, in a chosenplaintext or chosen-ciphertext scenario. There has been many other results on related-key attacks against AES, that are discussed e.g. in [START_REF] Daemen | On the related-key attacks against AES[END_REF], but the secret-key setting remains the most significant. Problem 9.1 (AES secret-key recovery). Given access to an oracle, quantum or classical, for a block cipher 𝐸 𝑘 that implements a reduced-round variant of AES, and possibly to its inverse, find 𝑘.

Classically, a cipher is broken if a procedure more efficient than exhaustive search exists. Quantumly, exhaustive search benefits from a quadratic speedup, but some algorithms perform worse (for example, collision search). Thus, the quantum security margin may be higher. On the other hand, higher than quadratic speedups have occurred in the Q2 setting (Chapter 4) and nothing prevents AES from a devastating, yet unknown, quantum attack. This is also stated in [START_REF]Quantum Computing: Progress and Prospects[END_REF]:

[...]
it is possible that there is some currently unknown clever quantum attack on AES-GCM that is far more efficient than Grover's algorithm.

The same set of principles that gave confidence in the classical security of AES apply to its post-quantum security. This algorithm should have a detailed security evaluation, evolving through time, advancing hand in hand with our understanding of quantum algorithms.

Summary

Previous security analyses of AES in the quantum world targeted only exhaustive key search with Grover's algorithm, and whether it put AES variants at risk or not. A general discussion was given in [START_REF] Rao | The AES-256 Cryptosystem Resists Quantum Attacks[END_REF], an analysis of Grover combined with side channel attacks in [START_REF] Daniel | Quantum Key Search with Side Channel Advice[END_REF].

We start in Section 9.3 by discussing the attacks that did not seem to obtain a good speedup. Next, we describe quantum Square attacks on 6-round AES-128, 7-round AES-192 and 7-round AES-256 (Section 9.4), and a quantum Demirci-Selçuk Meet-inthe-Middle attack on 8-round AES-256 (Section 9.5), which is the best known quantum key-recovery attack against AES-256 in number of rounds.

We write these attacks as Sample programs, with the notations of Section 2.2. We will consider Q1 or Q2 adversaries, but our best attacks can be placed in the Q1 model. We will also consider qRAM, but only the quantum Square attacks of Section 9.4.2 require QRAQM. Our 8-round attack can rely exclusively on classical memory thanks to the mapping from QRACM to CSAM, by the emulation unitary of Lemma 1.2. Our results are summarized in Table 9.6 at the end of this chapter.

Classically, DS-MITM attacks against AES-256 (together with impossible differential attacks) reach up to 9 rounds, and as we will see, designing such a quantum attack is a nontrivial process. In Section 9.6, we show that some of our ideas can be used in the classical setting as well, providing notably the best known attacks so far on 9-round AES-256.

Description of AES

Designed by Daemen and Rijmen, the block cipher [AES] AES state and round function. The cipher encrypts blocks of 128 bits, split into 16 bytes organized in a square (Figure 9.1). The round function has four operations: first, AddRoundKey (ARK), which XORs the round key (and round constant) with the current state. Second, SubBytes (SB), which applies the AES S-Box to each byte. The S-Box is a nonlinear function over F 2 8 , which combines an affine transformation of the byte with the multiplicative inverse in F 2 8 . Third, ShiftRows (SR), which shifts the 𝑖-th row by 𝑖 bytes left and finally, MixColumns (MC), which multiplies each column by the AES MDS matrix. It is a linear transformation over pF 2 8 q 4 :

¨𝑏0 𝑏 1 𝑏 2 𝑏 3 ‹ ‹ ' " ¨2 3 1 1 1 2 3 1 1 1 2 3 3 1 1 2 ‹ ‹ ' ˆ¨𝑎 0 𝑎 1 𝑎 2 𝑎 3 ‹ ‹ ' .
It has branching number 5, meaning that among 𝑏 0 , 𝑏 1 , 𝑏 2 , 𝑏 3 , 𝑎 0 , 𝑎 1 , 𝑎 2 , 𝑎 3 defined as above, no more than 3 of the bytes can be 0 at the same time. The last round has no MixColumns and applies a final key addition (there are 𝑟 `1 subkeys for 𝑟 rounds). In this chapter, we consider reduced-round versions with a MixColumns in their last round.

Notations. We write 𝑥 𝑖 , 𝑦 𝑖 , 𝑧 𝑖 , 𝑤 𝑖 the successive AES states (see Figure 9.7) after applying the 4 round operations ARK, SB, SR and MC at round 𝑖. The S-Box is denoted 𝑆. We note 𝑘 𝑖 the key at round 𝑖 and 𝑢 𝑖 " 𝑀 𝐶 ´1p𝑘 𝑖 q the "equivalent" round keys, such that adding 𝑘 𝑖 after the MC operation is equivalent to adding 𝑢 𝑖 before this step. We note 𝑥r0, 1, . . .s when selecting bytes from these states. We use the usual AES byte numbering of Figure 9.1. When we consider a pair, the states are denoted 𝑥 𝑖 , 𝑥 1 𝑖 . We also note Δ𝑥 𝑖 " 𝑥 𝑖 ' 𝑥 1 𝑖 . Furthermore, equalities such as 𝑥 4 r1, 2, 3s " 𝑥 1 4 r1, 2, 3s are to be understood byte per byte.

Key-schedule relations. While the round function has a strong design (it ensures total diffusion after two rounds), the key schedule has been held as a weaker point (as in [START_REF] Orr Dunkelman | Improved Single-Key Attacks on 8-Round AES-192 and AES-256[END_REF]). An AES with 𝑟 rounds needs 𝑟 `1 round keys. Key-schedule relations have often been used to speed up cryptanalysis of reduced-round . Later on in this chapter, we will use some relations derived from the AES-256 key schedule, which is depicted in Figure 9.2, where the symbol « denotes shifting upwards the bytes of a column. It maps a pair of round keys 𝑘 2𝑖 , 𝑘 2𝑖`1 to 𝑘 2𝑖`2 , 𝑘 2𝑖`3 . First of all, notice that the linear layer is easy to implement. The ShiftRows amounts only to a renumbering of the qubits, so it can be done without any quantum computation. The MixColumns step requires only some CNOTs that can be computed in place, without any involvement of ancilla qubits. The evaluation of the S-Box, which is the only nonlinear component of AES, happens to be the crucial operator in the quantum circuit. Indeed, classically, the S-Box can be realized with a lookup table, but the quantum equivalent would require QRACM storage. Thus, quantum circuits for the AES depend on efficient quantum circuits for computing the S-Box.

Remark 9.1. Since our attacks use the components of AES in the same proportions, the S-Box remains also the most costly component in all our procedures. In Table 9.1, we give the counts from [START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF]. The S-Box circuits in [START_REF] Langenberg | Reducing the Cost of Implementing AES as a Quantum Circuit[END_REF] and [START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF] are respectively based on the classical circuits of [START_REF] Boyar | A New Combinational Logic Minimization Technique with Applications to Cryptology[END_REF] and [START_REF] Boyar | A Small Depth-16 Circuit for the AES S-Box[END_REF]. They are out of place, meaning that the output is computed in an additional register, as shown in Circuit 9.1. Quantum circuit for AES. A rapid comparison between the cost of the S-Box and the rest (MixColumns, but also the operator 𝑂 0 in the Grover iterate) suggests to take the S-Box as the main cost metric, instead of the Clifford+T gate set (Section 1.2). This makes the analysis simpler. Counts for complete AES circuits are given in Table 9.2. The number of S-Boxes used stems from the rounds and from the key-expansion together. For example, in AES-128, there are 10 SubBytes operations and 10 round keys to compute, each requiring 4 S-Boxes. As each S-Box will be uncomputed, the total number of S-Box circuits is: 2 ˆp10 ˆ16 `10 ˆ4q " 400. Finally, as the S-Boxes are out of place, the computation of each round leaves behind the state at the previous round, and adds roughly 128 ancilla qubits. Note that in the Grover oracle, we need to compute AES, to check equality with the target ciphertext, and to uncompute AES. This leaves the counts in Table 9.2 unchanged, as the uncomputation of the rounds can be deferred. Thus, Grover oracles for AES-128, AES-192 and -256 require respectively 400, 896 and 1656 S-Boxes. Multiplying by the number of Grover iterates

X 𝜋 4 2 𝜅{2 \
where 𝜅 is the key length, one obtains the counts of Table 9.3, with optimized gate counts of [START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF] and approximate counts in number of S-Boxes. Remark 9.2 (On improved exhaustive search). In the classical setting, there exists procedures that accelerate the exhaustive search, e.g., using bicliques [START_REF] Bogdanov | Biclique Cryptanalysis of the Full AES[END_REF]. This is currently not the case in the quantum setting. It seems for now that by trying to translate these procedures into quantum searches, one would lose more than there is to gain, due to uncomputation factors (early-abort techniques require a high level of nesting).

Resource Estimates for Reduced-round AES

As our attacks target reduced-round variants of AES, we must adapt the key-recovery accordingly. This is summarized in Table 9.4.

The most precise estimation that we shall need is for 8-round AES-256.

Lemma 9.2 (Grover Search on 8-round AES-256). Using Grover search and three classical queries to a secret-key 8-round AES-256 oracle, the key can be recovered in approximately X 𝜋 4 2 128 \ ˆ160 ˆ6 " 2 137.56 reversible S-Boxes, using at most 1500 qubits.

Proof. We use three plaintexts to have an overwhelming probability of success (two plaintexts would give 1 𝑒 ). Forward computations of 8-round AES-256 require 160 S-Boxes,

Discussion on Quantum Attacks

In order to provide a starting point in the secret-key setting, the most reasonable approach seems to start from the best classical attacks against reduced-round AES and try to quantize them, in a way similar to [START_REF] Kaplan | Quantum Differential and Linear Cryptanalysis[END_REF] for (generic) linear and differential attacks against block ciphers. Table 9.5 provides a summary of the best known classical attacks on AES in the secret key model. The results in this chapter follow the observation of [START_REF] Kaplan | Quantum Differential and Linear Cryptanalysis[END_REF], that the best quantum attack is not always as simple as a quantum version of the best classical one.

In this section, we give a short discussion on attacks based on Impossible Differentials and Simon's algorithm. More detailed explanations for Square and DS-meet-in-themiddle attack will follow in Section 9.4 and Section 9.5 respectively, as these are the attack patterns that we managed to quantize.

Impossible Differential Attacks

Impossible differential attacks rely on differential patterns that cannot occur in the cipher. Such a pattern provides a distinguisher for several middle rounds, which is extended a few rounds backwards and forwards, involving some bits of the secret key. The attacker then guesses these bits. For a good guess, the middle pattern cannot occur by definition, and for bad guesses, it may occur. Thus, the attacker sieves the key space Table 9.5: Summary of classical cryptanalysis on AES in the single secret key setting. Time is given in equivalent trial encryptions and memory in 128-bit blocks. We omit generic attacks, including the ones that perform an intelligent exhaustive search on the key like [START_REF] Bogdanov | Biclique Cryptanalysis of the Full AES[END_REF]. We include the new significant trade-offs that we introduce in Section 9.6. by removing wrong guesses, allowing to significantly reduce the amount of possible key candidates. This strategy is generalized and improved against SPNs in [START_REF] Boura | Making the Impossible Possible[END_REF].

The best impossible differential attack on AES-128 [START_REF] Boura | Making the Impossible Possible[END_REF] targets 7 rounds (Table 9.5), and provides a comparable trade-off, with some advantages, to the best DS-MITM attacks.

Impossible differential attacks run in two steps. First, the attacker computes pairs p𝑃, 𝑃 1 q, p𝐶, 𝐶 1 q of plaintexts and ciphertexts satisfying the input-output conditions of the differential path: 𝑃, 𝑃 1 and 𝐶, 𝐶 1 must partially collide. These pairs might lead to the impossible differential in the middle rounds. But the quantum speedup of this step tends to be less than a square root, even in the QRAQM model and with Q2 queries. Second, the attacker discards the wrong keys associated to each pair in the most efficient way possible, thanks to the early abort technique. The good key will be among the ones that have not been discarded. This sieving step can be accelerated, although all the classical techniques (like state-test techniques or multiple differentials as in [START_REF] Boura | Scrutinizing and Improving Impossible Differential Attacks: Applications to CLEFIA, Camellia, LBlock and Simon[END_REF]) need or would need specific adaptations. In [START_REF] David | Quantum impossible differential attack[END_REF], David studied quantum impossible differential attacks and concluded that they did not seem to give an advantage in the case of AES.

Attacks based on Simon's Algorithm

Attacks in the Q2 model that use Simon's algorithm and its offline variant (detailed in Section 4.1 and Chapter 7), for example quantum slide attacks, crucially rely on a strong algebraic structure. Thanks to its key-schedule, AES seems immune to them, even on reduced-round variants. Thus, to date, there does not exist an attack with an exponential acceleration in the Q2 setting.

Quantum Square Attacks on the AES

The Square or integral attack was proposed in [START_REF] Daemen | The Block Cipher Square[END_REF] against the block cipher Square. It was studied in the original specification document AES [START_REF] Daemen | AES proposal: Rijndael[END_REF] targeting 6 rounds, and extended later to 7 rounds when considering . It relies on a distinguisher for 3 rounds of AES, that is extended into a key-recovery.

In this section, we design quantum variants of the Square attack. We remain in the Q1 setting and in the QRAQM model. For quantum exhaustive search on 6 and 7-round AES-128, we give estimates using Table 9.4.

The Classical Square Attack

The Square attack relies on a distinguisher on 3 rounds of AES, depicted in Figure 9.3. Definition 9.1 (𝛿-set). A 𝛿-set in byte 0 is a set of 2 8 AES states that take all values on byte 0 but are constant on the other bytes. Proposition 9.1 (Square distinguisher [START_REF] Daemen | AES proposal: Rijndael[END_REF]). Let 𝑃 0 , . . . , 𝑃 255 be a 𝛿-set. Let 𝐶 0 , . . ., 𝐶 255 be the set of encryptions of 𝑃 𝑗 through 3 rounds of AES, regardless of the round keys. Let 0 ď 𝑖 ď 15 be any byte. Then À 0ď𝑗ď255 𝐶 𝑗 r𝑖s " 0. The byte is said balanced.

Proof. The S-Box is a bijective function, hence after the first SubBytes layer, the 𝛿-set remains a 𝛿-set. Besides, each byte in the active column at the end of the first round takes 256 values. This remains true after the second round and the third round, again by bijectivity of the S-Box. The sum in any byte position before the last MixColumns is zero. This remains zero after MixColumns by linearity. Notice that Proposition 9.1 remains valid for any input byte, by symmetry.

Proposition 9.1 yields a distinguisher since, for a random function, the probability that a selected byte is balanced is 1 2 8 . Square Attack on 6-round AES. The resulting attack on 6 rounds was designed in [START_REF] Daemen | The Block Cipher Square[END_REF] and improved in [START_REF] Ferguson | Improved Cryptanalysis of Rijndael[END_REF]. It is described in Figure 9.4. We append one round before and two rounds after the distinguisher. We encrypt a set of 2 32 plaintexts that take all values in the main diagonal but are constant on the other bytes. Then, regardless of the first round key, they give 2 24 𝛿-sets at the end of the first round. When given to the three inner rounds, this gives balanced bytes as well. Using this, we don't have to guess the first round key.

‹ ARK SB ‹ SR ‹ MC ‹ ‹ ‹ ‹ ‹ ARK SB ‹ ‹ ‹ ‹ SR ‹ ‹ ‹ ‹ MC ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ARK SB ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ SR ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ MC ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ 0

Q1 Square Attack on 6-round AES

First, we focus on the initial 6-round Square attack from [START_REF] Daemen | The Block Cipher Square[END_REF]. In Algorithm 9.1, we rewrite it as a classical Sample, with a simple translation as a quantum algorithm. Using the square property as a 3-round distinguisher, each structure gives a one-byte condition. Although 5 would be enough, we use 8 structures in order to ensure that only the right key guess passes the test, with overwhelming probability. Hence the number of Grover iterations is exactly known. As each partial decryption requires 5 S-Boxes, the classical time complexity in S-Boxes is: Partial Sums Technique. The partial sums technique from [START_REF] Ferguson | Improved Cryptanalysis of Rijndael[END_REF] already makes the classical time complexity decrease to 2 52 S-Boxes (2 44 encryptions). In order to adapt this technique, we will rely on QRAQM.

2 40 ˆ232
For readability, we omit the last MixColumns and Shiftrows: the five guessed key bytes are now 𝑢 5 r0s and 𝑘 6 r0, 1, 2, 3s. We want to find values of those bytes such that the sum of 𝑥 4 r0s on all 2 32 ciphertexts 𝐶 𝑖 is zero:

à 𝑖 𝑥 4 r0s 𝑖 " à 𝑖 𝑆 ´1p𝑦 4 r0s 𝑖 q .
We write 𝑦 4 r0s as a combination of 𝑥 5 r0, . . . , 3s: The presentation from [START_REF] Ferguson | Improved Cryptanalysis of Rijndael[END_REF] constructs successive tables containing partial sums. The final table contains, for each 5-byte key guess (2 48 ), the value of the whole sum. In Algorithm 9.2, we rewrite this procedure as a composition of Samples. Having 8 structures ensures that only the right key guess passes at each step with overwhelming probability. For each structure, we create successive tables 𝑇 1 , 𝑇 2 , 𝑇 3 such that:

à 𝑖 𝑥 4 r0s 𝑖 " à 𝑖 𝑆 ´1 `
1. 𝑇 1 counts, for each triple of bytes, how many times 𝑎 0 𝑆 ´1p𝐶 𝑖 r0s ' 𝑘 6 r0sq ' 𝑎 1 𝑆 ´1p𝐶 𝑖 r1s ' 𝑘 6 r1sq, 𝐶 𝑖 r2s, 𝐶 𝑖 r3s takes this value when 𝐶 𝑖 runs over all ciphertexts in the structure.

2. 𝑇 2 counts, for each pair of bytes, how many times 𝑎 0 𝑆 ´1p𝐶 𝑖 r0s ' 𝑘 6 r0sq ' 𝑎 1 𝑆 ´1p𝐶 𝑖 r1s ' 𝑘 6 r1sq ' 𝑎 2 𝑆 ´1p𝐶 𝑖 r2s ' 𝑘 6 r2sq, 𝐶 𝑖 r3s takes this value when 𝐶 𝑖 runs over all ciphertexts in the structure.

3. 𝑇 3 counts, for each byte value, how many times the following quantity takes this value when 𝐶 𝑖 runs over all ciphertexts in the structure: We can bound it as less than 2 54 S-Boxes. Furthermore, this procedure uses 2 35 classical queries and 8 ˆ224 32-bit registers of classical RAM (each step needs efficient random-access to the table of the previous step).

𝑎 0 𝑆 ´1p𝐶
Quantum equivalent. The quantum equivalent of Algorithm 9.2 performs nested quantum searches, as in Section 2.2. It requires 8 ˆ224 32-qubit registers in the QRAQM model, as some data is written in the tables 𝑇 1 , 𝑇 2 , 𝑇 3 inside quantum searches, and 2 35 256-bit registers of classical memory to store the chosen-plaintext queries. The nested searches need to distinguish whether there is a solution or none, and if there is a solution, we are guaranteed that there is exactly one. Thus, we can run Exact Amplitude Amplification (Theorem 2.3). The time complexity, adapted from the classical one, is:

Q 𝜋 4 2 8 U ´2ˆ2 36 `2 Q 𝜋 4 2 4 U ´2ˆ2 27 `2 ˆQ 𝜋 4 2 4 U ´2 ˆ219 `2 Q 𝜋 4 2 4 U ˆ2 ˆ211
¯¯q uantum S-Boxes. Notice that each level of nesting adds a factor 𝜋 2 , since quantum search contains a factor 𝜋 4 and the nested searches need to be uncomputed. The number of iterations of each subprocedure are P 𝜋 4 2 4 T " 13 and P 𝜋 4 2 8 T " 201. We obtain a quantum time equivalent to 2 44.73 reversible S-Boxes.

Q1 Square Attack on 7-round AES

To attack 7 rounds of AES, we append a round to the previous attack and guess completely the last round key 𝑘 7 . With this method, the 256 and 192 variants are within reach.

Without partial sums.

Using the attack framework of [START_REF] Daemen | The Block Cipher Square[END_REF], we retrieve the key with 2 37 chosen-plaintext queries, a quantum time equivalent to 2 121 reversible S-Boxes, a small number of qubits, 2 37 classical memory and no QRAQM.

First of all, we increase the key search space to 20 unknown bytes, so we need more chosen plaintext queries as before. 2 5 structures of 2 32 plaintexts are sufficient and ensure to have only one result with high probability. We perform quantum search over a search space of size 2 20ˆ8 (the partial key bytes) and expect one solution; testing is done sequentially in time 2 32 ˆ25 ˆ5 S-Boxes, by computing the 2 5 XORs in 𝑥 4 r0s. So the quantum time complexity is P 𝜋 4 2 20ˆ4 T `232 ˆ25 ˆ10 ˘" 2 119.97 S-Boxes. This complexity falls between Grover search for 7-rounds AES-192 and for AES-256. This procedure does also not better than the classical 7-round impossible differential and Meet-in-the-middle attacks recalled in Table 9.5.

With partial sums. We obtain a better time complexity by wrapping Algorithm 9.2 inside a Grover search over the additional key bytes. This "outer" search is actually merged with the outer sampling loop in Algorithm 9.2, to avoid losing a factor 𝜋 2 to uncomputations. For AES-256, there are 15 more key bytes to search for, hence the number of iterations is multiplied by 2 60 and the complexity becomes 2 44.73`2`60 " 2 106.73 as we use 4 times more structures. For , there is one less key byte to guess, due to key-schedule properties.

Quantum DS-MITM Attack on 8-round AES-256

The Demirci-Selçuk Meet-in-the-Middle (DS-MITM) attack against reduced-round AES was introduced in [DS08]. Many improvements have been proposed since; the most efficient ones are described in [START_REF] Derbez | Improved Key Recovery Attacks on Reduced-Round AES in the Single-Key Setting[END_REF]. This attack also relies on a distinguisher on 4 rounds of AES, that is extended into a key-recovery.

In this section, we give a quantum DS-MITM attack on 8 rounds of AES-256. This attack will be completely described in Section 9.5.6 on page 227. It reaches the highest number of rounds in the quantum setting. Before going into the details of our procedure, we will recall the classical DS-MITM attack on 7-round AES and detail the main ideas that enable to add one more round. The new quantum attack procedure will differ significantly from the classical ones, although it uses the same ideas. We will show in Section 9.6 how to exploit this new attack design to improve the memory cost of classical attacks.

The AES S-Box Differential Equation

As a building block of our attack, we need to solve the AES S-Box differential equation: given Δ 𝑥 , Δ 𝑦 , find 𝑥 such that:

𝑆p𝑥q ' 𝑆p𝑥 ' Δ 𝑥 q " Δ 𝑦 . (9.2)
This cost is classically neglected, as we would use a 2 8 ˆ28 lookup table. However, the quantum equivalent would require QRACM. Thus, this analysis is crucial if we want our attack to beat Grover search without QRACM. As we count the complexity in S-Boxes, note that making the comparison with the circuit of [Jaq+20] instead of [START_REF] Grassl | Applying Grover's Algorithm to AES: Quantum Resource Estimates[END_REF] induces a little change with respect to the analysis of [BNS19b], to our disadvantage.

Lemma 9.3 (S-Box differential equation).

Given Δ 𝑥 and Δ 𝑦 such that Δ 𝑥 Δ 𝑦 ‰ 0, there exists either zero, two or four pairs 𝑥, 𝑦, 𝑥 1 , 𝑦 1 such that 𝑆p𝑥q " 𝑦, 𝑆p𝑥 1 q " 𝑦 1 , 𝑥'𝑥 1 " Δ 𝑥 , 𝑦 ' 𝑦 1 " Δ 𝑦 .

There exists a quantum unitary SBDiff that, given such Δ 𝑥 and Δ 𝑦 , finds a solution 𝑥 if it exists and output (𝑥, OK) in this case, and outputs (0, none) otherwise. The time complexity of SBDiff is around 18 S-Box computations and it uses 22 ancilla qubits.

If we only want to know if a solution exists and not an explicit solution, the cost drops to 9 S-Box computations and 15 ancilla qubits. The technical material skipped here can be found in [BNS19b]. The idea is to reduce the differential equation to a quadratic equation in F 2 8 , whose solutions are tabulated, and to use an optimized QRACM emulation circuit. The counts obtained in [BNS19b] are the following:

• 32 qubits (16 inputs, 1 output, 15 ancilla) and 8886 Clifford+T gates to check the existence of a solution;

• 47 qubits (16 inputs, 9 output, 22 ancilla) and 17507 gates to get an explicit solution.

These numbers correspond respectively to 9 and 18 S-Box circuits of [START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF].

Distinguisher on 4-round AES

Recall that 𝑥 𝑖 , 𝑦 𝑖 , 𝑧 𝑖 , 𝑤 𝑖 denote the successive AES states after each transformation at round 𝑖, 𝑘 𝑖 denotes the subkey at round 𝑖 and 𝑢 𝑖 " 𝑀 𝐶 ´1p𝑘 𝑖 q. We denote by r𝑗s the byte 𝑗 corresponding to the byte ordering described in Figure 9.1, so 𝑥 𝑖 r𝑗s refers to the 𝑗th byte of the state before 𝑆𝐵 from round 𝑖. The classical DS-MITM attack relies on a distinguisher for 4-round AES, which is depicted in Figure 9.5 and proven in Lemma 9.4. Proof. This comes from the fact that the AES S-Box equation has on average one solution. Thus, knowing differences before and after a SubBytes layer constrains the values of the states. Find a pair of plaintexts 𝑃, 𝑃 1 such that the differences 𝑃 ' 𝑃 1 and Πp𝑃 q ' Πp𝑃 1 q are active respectively in bytes 𝑖 and 𝑗 (as in Figure 9.5) 2: Compute the sequence 𝐶 0 " Πp𝑃 0 q, . . . , 𝐶 255 " Πp𝑃 255 q by making byte 𝑖 of 𝑃 assume all values 3: if the multiset t𝐶 0 r𝑗s, . . . , 𝐶 255 r𝑗su is in 𝑇 then

return false

Without loss of generality, consider the path of Figure 9.5, where we have taken 𝑖 " 3 and 𝑗 " 5. In the forwards direction, we guess the values of 𝑥 1 r3s, 𝑥 1 1 r3s, 𝑥 2 r4 ´7s. Then we can deduce 𝑦 1 r3s and 𝑦 1 1 r3s and propagate the difference Δ𝑦 1 r3s through the linear layer, until Δ𝑥 2 r4 ´7s. Since we know 𝑥 2 r4 ´7s and Δ𝑥 2 r4 ´7s, we also deduce 𝑥 1 2 r4 ´7s and go through the SubBytes layer at round 2. We deduce Δ𝑥 3 r´s.

In the backwards direction, we guess Δ𝑥 4 r5s " Δ𝑤 4 r5s, 𝑦 4 r0, 5, 0, 14s. Thus we know 𝑦 1 4 r0, 5, 0, 14s as well and we can go through the SubBytes layer backwards. Next, we obtain Δ𝑦 3 r´s.

For each byte, we solve the S-Box differential equation. There is on average one solution. Thus, for each guess of the 10 bytes 𝑥 1 r3s, 𝑥 1 1 r3s, 𝑥 2 r4´7s, Δ𝑥 4 r5s, 𝑦 4 r0, 5, 0, 14s, we obtain on average one complete path, and we know all the states depicted in Figure 9.5.

Since we know all these states, we can now make the difference in 𝑥 1 r3s vary and collect the corresponding differences in 𝑥 5 r5s. Thus, we obtain a table of 2 80 possible multisets.

As a random multiset of 256 bytes can assume 2 506 values ([DFJ13]), we can distinguish 4 rounds of AES from a random permutation with a negligible probability of error (smaller than 2 80´506 ).

Classical DS-MITM Attack on 7-round AES

The classical DS-MITM attack on 7-round AES appends 1 round before and 2 rounds after the distinguisher of Figure 9.5, as displayed in Figure 9.6.

In order to reach a single-byte difference before and after the 4 rounds of the distinguisher, the attack starts by producing many plaintext-ciphertext pairs with input differences in Δ 𝑖𝑛 and output differences in Δ 𝑜𝑢𝑡 , where Δ 𝑖𝑛 is a diagonal and Δ 𝑜𝑢𝑡 is the MixColumns of an antidiagonal. Without loss of generality, we use again the path of Figure 9.7. We need 2 48 such pairs. Lemma 9.5 (Finding pairs [DFJ13, Section 4.1]). There exists a classical procedure FindPairs that, with 2 113 encryption queries, returns 2 48 plaintext-ciphertext pairs p𝑃, 𝑃 1 q, p𝐶, 𝐶 1 q such that:

• The difference Δ𝑃 " 𝑃 ' 𝑃 1 is active only in bytes 0, 5, 10, 15,

• The difference 𝑀 𝐶 ´1pΔ𝐶q " 𝑀 𝐶 ´1p𝐶 ' 𝐶 1 q is active only in bytes 0, 7, 10, 13.

Proof. We encrypt structures of 2 32 plaintexts that make the main diagonal take all values, hence the input differential is always satisfied. By sorting the ciphertexts, we find easily the pairs satisfying the output differential. Each structure yields 2 32 p2 32 ´1q{2 pairs and each pair has a probability 2 ´96 of satisfying the output constraint. Hence, we need to encrypt 2 81 structures.

After having precomputed the table of Lemma 9.4 and these pairs, we perform an exhaustive search for the 9 key bytes of 𝑘 0 , 𝑢 6 and 𝑢 7 shown on Algorithm 9.4. The probability of failure of the distinguisher is so low that computing a single multiset is Find in 𝑇 1 a pair 𝑃, 𝑃 1 , 𝐶, 𝐶 1 such that 𝑥 1 is active only in byte 3 and 𝑦 6 is active only in byte 5

Ź This is a 6-byte condition, which is why we need 2 48 pairs in 𝑇 1

5:

Make 𝑥 1 r3s assume all values 0, . . . , 255

6:

Using the known key bytes of 𝑘 0 , find the corresponding plaintexts 𝑃 0 , . . . , 𝑃 255

7:

Encrypt 𝑃 0 , . . . , 𝑃 255 , obtain 𝐶 0 , . . . , 𝐶 255

8:

Decrypt partially 𝐶 0 , . . . , 𝐶 255 using the known key bytes of 𝑢 6 and 𝑢 7 , and obtain the sequence of 256 differences in 𝑥 5 r5s 9:

if the multiset of differences is in 𝑇 then 10: return 𝑘 0 r0, 5, 10, 15s, 𝑢 6 r1s, 𝑢 7 r0, 7, 10, 13s

Modifications to the Distinguisher

A classical DS-MITM attack on 8-round AES-256 and AES-192 already exists, but it adds the 8th round at the end of the cipher. Unfortunately, with this attack setting, the complexity of finding the input-output pairs (Lemma 9.5) increases dramatically and we need many more of them. Similarly as impossible differential attacks (Section 9.3.1), this makes a significant speedup unlikely. Thus, we use the alternative idea of adding a round in the middle of the differential path, which is classically used in a 9-round attack on AES-256 [START_REF] Derbez | Improved Key Recovery Attacks on Reduced-Round AES in the Single-Key Setting[END_REF]. Lemma 9.4 is adapted as follows. Its proof is similar to Lemma 9.4, except that since we traverse one more round, we have a full 16-byte state to guess. Lemma 9.6 (5-round distinguisher on AES [DFJ13, Section 4.2]). Suppose that we are given a plaintext-ciphertext pair active in one byte before and after 5 AES rounds. If we make the difference in input take all 2 8 values and collect the multiset of output differences in output, there are only 2 208 " 2 26ˆ8 (26 byte-conditions) possibilities.

Next, our attack strategy will allow to replace multisets by 𝛿-sequences. While multisets are of fixed size 2 8 , 𝛿-sequences can be smaller, since we only need to ensure a negligible probability of failure in the distinguisher. As they are ordered, less information is also lost. We will take sequences of 2 5 single-byte differences. Definition 9.2 (𝛿-sequence). Let 𝑃, 𝑃 1 be a pair of plaintexts that satisfies the full differential path of Figure 9.7. Let 𝑃 1 , . . . , 𝑃 32 the 255 plaintexts obtained by making the difference with the state of 𝑃 in 𝑥 1 r3s (Δ𝑥 1 r3s) assume the values 1, . . . , 32. We name 𝛿-sequence the corresponding sequence of differences in 𝑥 6 r5s.

By definition, a 𝛿-sequence contains 32 ˆ8 " 256 bits of information. We adapt the distinguisher of Lemma 9.6 for 𝛿-sequences. Lemma 9.7 (5-round distinguisher for sequences). Suppose that we are given a plaintextciphertext pair p𝑃, 𝑃 1 q, p𝐶, 𝐶 1 q active in one byte 𝑖 before and one byte 𝑗 after 5 AES rounds. Suppose also that the input and output differences in these bytes are given. Consider the plaintexts 𝑃 0 " 𝑃 1 , . . . 𝑃 32 obtained from 𝑃 by making the difference in byte 𝑖 assume all values from 1 to 32, that is, 𝑃 1 corresponds to adding 1 in byte 𝑖, etc. Collect the corresponding ciphertexts 𝐶 1 , . . . 𝐶 32 and the ordered sequence of differences with 𝐶 in byte 𝑗 (𝛿-sequence). Then there are only 2 192 possibilities among 2 256 .

Proof. The proof follows Lemmas 9.4 and 9.6, except that, since the input and output differences of the pair are known, the whole space of 𝛿-sequences is reduced by 2 16 (two bytes) in size.

False positives. The probability of failure of the distinguisher based on 𝛿-sequences seems to be dangerously low. Indeed, by Lemma 9.7, the distinguisher incorrectly recognizes a random permutation as a 5-round AES with probability 2 192´256 " 2 ´64 . Thus, if we use the distinguisher approximately 2 64 times, we will start to find false positives. The same goes if we use the distinguisher inside a Grover search.

However, in what follows, we will decrease the number of possible 𝛿-sequences to 2 20ˆ8 " 2 160 , and we will use the distinguisher 2 80 times. Thus, the expected number of false positives encountered during the search is 2 ´16 . The error in Grover's algorithm will also be low enough to be neglected.

Idea of Our Attack

The full differential path of our attack is depicted in Figure 9.7. A major change with respect to the classical setting is that we do not build the multiset table, which might be somewhat counterintuitive at first sight. This is summarized in Algorithm 9.5.

We will first compute enough plaintext-ciphertext pairs so that, given a guess for the outer key bytes (denoted by ' in Figure 9.7), we find a pair that satisfies the middle round (𝑦 1 to 𝑥 6 ) differential. After that, we compute the corresponding 𝛿-sequence, by making the value in 𝑥 1 r3s assume the values 1, . . . , 32. This 𝛿-sequence is of length 256 bits. With Lemma 9.7, we are ensured that the sequence takes one of 2 192 possibilities; it is determined by 24 state and key bytes.

If the guess of the key bytes ' is good, then the computed 𝛿-sequence can be obtained by some choice of these 24 inner byte-conditions. To verify this, we will do another search. If the guess of the bytes ' is not the good one, then with high probability, the 𝛿-sequence that we computed will not appear. Having exactly 256 bits of information return the current guess of the key bytes ' ensures a good overall success probability, and reducing the amount of computations from 2 8 to 2 5 partial encryptions is crucial for the complexity of our attack.

First complexity estimation.

As there are 10 outer key bytes in the search and possibly as high as 2 10`16 𝛿-sequences to sieve at Step 9 in Algorithm 9.5, the complexity could reach higher than exhaustive search of the key. But we use different ideas to reduce the amount of work when trying all possible 𝛿-sequences at Step 9. First of all, using 𝛿-sequences instead of multisets reduces the amount of partial encryptions from 2 8 to 2 5 for each one. Next, since the pair 𝑃, 𝑃 1 , 𝐶, 𝐶 1 is known at the time of test, there are two less byte-degrees of freedom than in the table-based approach, as the input and output differences 𝑃 ' 𝑃 1 and 𝐶 ' 𝐶 1 are known. Finally, we use the key-schedule relations of Lemma 9.1, specific to AES-256, that remove 4 degrees of freedom from this search.

All in all, we now expect the complexity to be below exhaustive search. By writing the algorithm as a Sample program, we will obtain the same result in the quantum setting, and beat the bound set by the exhaustive search of the key with Grover's algorithm.

Classical Description of Our Attack

In Algorithm 9.6, we describe our attack classically, as a Sample procedure, in the framework introduced in Chapter 2. The remaining of this section is devoted to its details and complexity. This attack uses memory, but except in FindPairs, we resort only to sequential lookup circuits such as Lemma 1.2. We count the running time in AES S-Boxes.

Classical exhaustive search of the key takes approximately 160 ˆ2256 " 2 263.32 S-Boxes. We prove that our procedure goes below that. We use the fact (Section 9.5.1) that solving the S-Box differential equation costs approximately 9 S-Boxes existentially (when we only test if there is a solution) and 18 S-Boxes to output the solution.

Remark 9.3. We suppose that all the differential equations have either zero or two solutions. Only 40 S-Box equations will be involved in the distinguisher, and there is only one good guess of key bytes, and one corresponding good 𝛿-sequence. The probability that this good path encounters an S-Box equation with 4 solutions is 1 ´`127 128 ˘40 » 27%. Our assumption that this event does not occur multiplies the average complexity by a small factor.

Finding the pairs. We use the same set of plaintext-ciphertext pairs as in the 7-round classical one, given in Lemma 9.5. They are found classically by the procedure FindPairs, and since the running time is below 2 128 , this procedure can remain the same in the quantum attack.

Lemma 9.8 (The Good Pair). Given the set of pairs of Lemma 9.5, given a guess for 𝑘 0 r0, 5, 10, 15s and 𝑢 8 r0, 7, 10, 13s, there exists approximately one pair p𝑃, 𝐶q, p𝑃 1 , 𝐶 1 q that satisfies the full inner differential characteristic. Besides, there exists a quantum unitary that, on input 𝑘 0 r0, 5, 10, 15s and 𝑢 8 r0, 7, 10, 13s, returns this pair. It runs in approximately 2 53 S-Boxes computations.

Proof. We test sequentially each of the 2 48 possible pairs. There are 16 S-Box computations to do for each pair (4 in round 0 and round 8 for both members of the pair), to check if it is the good one, and to uncompute.

Computing a 𝛿-sequence. Once we have the pair 𝑃, 𝑃 1 , 𝐶, 𝐶 1 from Lemma 9.8, we can compute the associated 𝛿-sequence, using the key guesses. The plaintexts are computed thanks to 𝑘 1 r3s and 𝑘 0 r0, 5, 10, 15s, then encrypted, and the ciphertexts are partially decrypted using 𝑢 8 and 𝑢 7 in order to obtain the sequence of differences in 𝑥 6 r5s. This list contains 2 5 byte values, hence 256 bits are sufficient to store it. This overhead is small with respect to the amounts (thousands) needed to perform reversible AES encryption. Lemma 9.9 (Computing the 𝛿-sequence). Given the subkey guesses in 𝑘 0 , 𝑘 1 , 𝑢 7 , 𝑢 8 , and a pair satisfying the inner differential, we can compute the expected 𝛿-sequence using 2 13 S-Boxes.

Proof. Each of the 2 5 elements of the 𝛿-sequence requires a call to the secret-key oracle, which costs ď 2 8 S-Boxes. The other computations are negligible.

State equations.

Let ℓ 2 and ℓ 3 be the linear functions that, on input a column, give the third (respectively fourth) byte of this mixed column, and ℓ the linear function which, on input a column 𝐶, gives the first byte of 𝑀 𝐶 ´1p𝐶q. Equations (9.3), (9.4), (9.5) and (9.6) below are respectively derived from the four key-schedule relations given in Lemma 9.1, where we replace some key bytes by sums of state bytes. We have now determined all state bytes. There are 40 bytes (represented in Figure 9.8) that can take two values each. Thus the full sequence of states can admit one of 2 40 values, and is not completely determined yet. But the state equations stemming from the key-schedule allow to reduce this space.

1. In Equation (9.3), there are 10 bytes involved, 2 choices for each, thus 2 10 computations to make. But no S-Boxes are involved, so this cost is negligible. The same goes for Equation (9.4). 4 solutions are expected for each.

2. We test Equation (9.5) afterwards. where we highlight the number of iterations of each Sample, on which we are going to take the square root.

A direct computation gives a classical complexity of 2 250.61 S-Boxes. 1 We can check that the computation of 𝛿-sequences is the dominant term. Taking into account the key-schedule relations, we do an exhaustive search over 30 bytes, so the best complexity that we can expect is 2 240 times the computation of a 𝛿-sequence, which stands at 2 250.3 .

Quantum Complexity

By the correspondence of Section 2.2, Algorithm 9.4 has a quantum equivalent in terms of nested Amplitude Amplification procedures. A first estimation, by replacing the iteration counts in Equation (9.7), gives:

2 Q 𝜋 4 2 40 U ´2 Q 𝜋 4 2 76 U ´Q 𝜋 4 2 4 U ˆ4 ˆ72 ˆ2 `Q 𝜋 4 2 4 U ˆ2 ˆ1280 ¯¯, (9.8)
where each new factor "2" comes from an uncomputation level. As we have P 𝜋 4 2 4 T " 13, this gives approximately 2 132.62 S-Boxes. As this is very close to the Grover search complexity of 2 137.56 S-Boxes, we have to go into further detail.

S-Box property. The differential property can yield 4 solutions, and our quantum circuit SBDiff (Lemma 9.3) yields only 2 of them. As we go through 40 S-Boxes, the probability to hit only differential equations with 2 solutions (for the good path) is `127 128 ˘40 » 2 ´0.45 . Furthermore, when restricting to non-zero differentials, the differential equation does not admit exactly 1 2 solutions on average, but 127 255 . Thus, the total search space for the state bytes (Line 7) is of size 2 191.86 instead of 2 192 , and the probability to pass the differential equations is 2 ´40.23 instead of 2 ´40 . The space of state differences admitting solutions is thus of size 2 151.64 .

Precision. The variance in the number of solutions will increase the complexity with respect to (9.8).

1. Sample of 𝑘 0 r0, 5, 10, 15s, 𝑘 1 r3s, 𝑢 7 r1s, 𝑢 8 r0, 7, 10, 13s (Line 2): there is exactly a single solution which is accepted by the test. Even the error of the distinguisher, which we know exactly, can be taken into account by Exact Amplitude Amplification (Theorem 2.3). Thus, there is no error term here.

2. Sample of Δ𝑦 2 r4-7s, Δ𝑥 5 r3, 4, 9, 14s, Δ𝑥 4 (Line 7). When matching Δ𝑦 2 r4-7s and Δ𝑦 5 r4, 9, 14s against Δ𝑥 2 and Δ𝑦 5 , the number of solutions is always the same regardless of the previous key guesses. However, the equations involving Δ𝑥 4 have a varying number of solutions.

We simulated the variations column by column. We found that the number of solutions when fixing Δ𝑥 3 (deduced from Δ𝑦 2 ) and Δ𝑦 4 (deduced from Δ𝑥 5 ) was in 98% of the cases in the interval 2 27.95 p1 ˘2´9 q. As we have 4 columns, we can estimate that in more than 90% cases we will have a number of solutions that varies by a factor less than 2 ´7 around the mean.

This varying number of solutions changes the probability of success of the Sample from 2 ´151.6 to a value somewhere between 2 ´151.6 p1 ´2´7 q and 2 ´151.6 p1 `2´7 q.

Here we are exactly in the situation of Theorem 2.5, with a success probability that is known with a small relative error. By doing 𝜋 4 2 75.8 iterations, we obtain a value that passes the test with probability greater than 1 ´2´14 . This modifies in turn the success probability of the Sample 1, and increases negligibly the number of iterations that we should perform.

3. Sequential test of the 4 key conditions: the right guess of key and state differences may admit more solutions than the average. Overall, we consider that the 4 equations for the good path might have 4 solutions.

4. Innermost Sample (Line 19): the search spans exactly 2 8 tuples (note that the superposition of them can be computed efficiently), and since there is exactly one solution or none, we can use Exact Amplitude Amplification. However, although this Sample loop runs on average once, we need to take into account the maximal number of solutions for the key equations. Thus, the search space increases to a size 2 10 , and we can still use Exact Amplitude Amplification (if the equations do not have enough solutions to fill the space, we add dummy elements which always fail).

The final complexity, taking into account the success probability and the precision problems is: Making the attack Q1. The quantum version of Algorithm 9.4 requires superposition encryption queries. Indeed, some of them (for computing the 𝛿-sequences) appear inside a Sample, and would occur inside an Amplitude Amplification subroutine. However, it is possible to make the attack Q1 only. Suppose we have guessed the 9 key bytes 𝑘 0 r0, 5, 10, 15s, 𝑘 1 r3s, 𝑢 8 r0, 7, 10, 13s and we are given a corresponding good pair, as computed at Line 3 in Algorithm 9.6. The expected 𝛿-sequence is obtained by encrypting a set of plaintexts which depends on this pair and on 𝑘 0 r0, 5, 10, 15s, 𝑘 1 r3s. There are 2 48 pairs. There are 2 40 choices of 𝑘 0 r0, 5, 10, 15s, 𝑘 1 r3s. This means that in total, the whole procedure actually queries 2 48 ˆ240 " 2 88 distinct plaintexts.

It is possible to perform all these queries beforehand. In the outermost Sample, instead of computing the 𝛿-sequence on the fly, we go through the set of stored queries and find the ones that interest us (those which correspond to the current pair). This can be done using a sequential circuit similar to QRACM emulation (Lemma 1.2). Each outer iteration now requires 2 88 computations (comparisons only, not S-Boxes). This term is not dominant, and does not change the attack complexity.

Improving Classical DS-MITM Attacks

During this chapter, we went from the classical to the quantum world, as we started with classical cryptanalytic techniques and applied them in the quantum setting. In this last section, we will go backwards and show that our quantum DS-MITM design can have applications in classical cryptanalysis. This can seem counter-intuitive. The fact is that the quantum setting forced us to adopt a new viewpoint (re-ordering the steps) that had been previously overlooked. Notably, this helps in reducing the memory complexity in the classical DS-MITM attacks, which had been for a long time their bottleneck. For 7-round AES, we can reach new intersting time-memory trade-offs, comparable to the best previous ones (if not better) and for 9-round AES-256, the best known classical attack to date.

Re-ordering the steps.

In the standard DS-MITM attack, the distinguisher in the middle rounds uses a precomputed table, while the online phase (making a key guess, finding pairs, querying and computing multisets) does not use memory. In our new quantum attack, we computed the distinguisher online. Going back to the classical setting, we can decide to keep it this way and, instead, store what was previously the online phase: all key guesses, corresponding pairs and multisets (or 𝛿-sequences). Now, we will perform an exhaustive search over the middle multiset values (what was previously stored in a table) and look for a match among the precomputed key guesses. The data and time complexities will be similar (as we are basically doing the same computations in a different order), but the memory can be reduced.

Improved Attack on 9-rounds AES-256

We focus on the 9-round AES-256 attack of [DFJ13, Fig. 6], which is similar to Figure 9.7, with an additional round at the end. The attacker first obtains 2 144 plaintext-ciphertext pairs satisfying the input differential with 2 113 queries, then sieves the outer key bytes. Each pair gives 2 48 possible values for 𝑘 ´1r0, 5, 10, 15s, 𝑘 8 , 𝑢 7 that satisfy the whole differential pattern of Figure 9.7. These values can be enumerated in time 2 48 . For each of them, a 𝛿-set is encrypted and the associated multiset is compared to the table of precomputed possibilities: as there are 26 byte parameters that determine the middle rounds, the precomputed table has size 2 210 . This can be reduced by a factor 2 7 , by replaying the attack 2 7 times (with an increase in the data and time complexities).

By reordering the steps, we obtain a new attack based on this previous one that still needs 2 113 data, 2 210 time and now only 2 144 ˆ248 ˆ4 " 2 194 memory (the 4 factor stands for the storage of a multiset). We can propose a trade-off different from [START_REF] Derbez | Improved Key Recovery Attacks on Reduced-Round AES in the Single-Key Setting[END_REF], by considering a factor of 2 𝑥 less states to try in the middle if we store 2 𝑥 times more possible pairs. For this we need a data complexity increased by a factor 2 𝑥{2 (that generates 2 𝑥 times more pairs), and a time complexity that will be the maximum between 2 210´𝑥 and 2 194´𝑥 .

In order to reach a memory of 2 194 with the attack from [DFJ13], one would need a time complexity of 2 212 and a data complexity of 2 124.5 . Hence, we obtained a better trade-off, as summarized in Table 9.5.

New Trade-offs on 7-rounds AES-128

The best attacks on AES-128 are impossible differential, and our new trade-offs can not always improve on them. However, we can improve previous DS-MITM attacks, at least with respect to the memory. Let us consider the DS-MITM 7-round AES-128 attack of Section 9.5.3. By reordering the steps, we obtain for instance 2 113 data, 2 113 `284 time and 2 74 memory. This can be improved by considering multiple differentials, and enables us to reach 2 105 data, 2 105 `295 time and 2 81 memory.

Discussion

In this chapter, we presented quantum square attacks against 6-round AES, 7-round AES-192 and AES-256, and a quantum DS-MITM attack against 8-round AES-256. All these attacks could be applied in the Q1 setting. The best known classical non-generic key-recoveries target up to 9 rounds of AES-256. Hence, the security margin of AES-256 determined by these attacks is bigger in the post-quantum world.

Although our DS-MITM attack uses the same weaknesses that enabled the classical attacks in the first place, we had to modify considerably its design pattern, in order to compete against Grover's algorithm. Some of the ideas that we used on the way to our quantum design have classical implications: quantum cryptanalysis is a good motivation to think differently about classical attack designs.

DS-MITM

The results of this chapter concern only quantum key-recovery attacks. The work of Hosoyamada and Sasaki [START_REF] Hosoyamada | Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound[END_REF] showed that AES-based hash functions might benefit from a smaller security margin in the quantum world, due to the gap between the quadratic speedup of Grover search and the non-quadratic speedup of collision search.

Going further, many modes of operation offer only a security up to the birthday bound, and can be attacked by finding collisions. AES has a block size of 128 bits which, contrary to the key length, cannot be raised. The corresponding quantum collision bound is of 2 42.7 only. As we discussed in Chapter 2, no generic quantum collision speedup with polynomial memory exists at the moment. However, both the collision search without qRAM of Section 5.1 and the offline Simon's algorithm of Chapter 7 show that it is possible to work around these memory requirements. In the long term, it seems preferable to use a cipher with a higher block size. Saturnin, pronounced , is the eponymous hero of the french TV series Les Aventures de Saturnin (The Adventures of Saturnin) [START_REF] Tourane | Les Aventures de Saturnin [Television series[END_REF], which was broadcasted between 1965 and 1970. The series narrates the life of the duck Saturnin in a village inhabited by animals, using real life footage of animals and voice actors.

Chapter 10 Saturnin

Saturnin [Can+20] is a family of lightweight symmetric algorithms aiming at postquantum security, which was submitted to the NIST LWC project and is currently1 in the second round 2 . The core primitive of the submission is the block cipher Saturnin, which has 256-bit keys, 256-bit blocks and a 9-bit domain separator. Its design allows simultaneously an abstract representation which makes it similar to the AES, and an efficient bitsliced implementation, using only lightweight components (e.g., 4-bit S-Boxes).

Key size. We chose a block cipher design with a key of 256 bits. This naturally follows from the applicability of Grover search against smaller key sizes. In Chapter 9, we recalled that the gate counts for Grover exhaustive search of the keys against AES-128 were of the order of 2 80 Clifford+T gates. This represents actually a massive amount of operations, orders of magnitude higher than Shor's algorithm applied to standard RSA parameters. And this cost will increase if the adversary tries to parallelize such key-recovery. This is why the NIST PQC project actually considers Grover's exhaustive key search of AES-128 as one of its standard security levels.

It is unlikely that a first large-scale quantum attacker, capable of breaking RSA-2048, will also be able of running this Grover search. However, new optimizations may be reachable. A multi-user key-recovery will be more efficient than a single-user one, as it increases the number of good solutions; it can also improve the parallelization trade-off. In a related-key setting, the offline Simon's attack of Chapter 7 can decrease the security level down to 2 128{3 » 2 43 , using only negligible quantum memory.

State size. The security of most modes of operation (encryption or MACs) is given by a collision bound, which is 𝒪 `2𝑛{2 ˘for an internal state of size 𝑛. Using a cipher with 128-bit blocks, this represents a bound 2 64 which is usually enhanced at the specification level, with a data limit. For example, Chaskey [START_REF] Mouha | Chaskey: An Efficient MAC Algorithm for 32-bit Microcontrollers[END_REF] has a 128-bit state, and limits the data encrypted to 2 48 , in order to meet a security level of 2 80 instead of 2 64 . Most candidates in the LWC process enforce such limitations.

However, there are many ways in which a quantum adversary can use a small block or internal state size to attack a construction. First of all, the quantum collision bound on 128-bit blocks falls from 2 128{2 to 2 128{3 » 2 43 . Although a quantum speedup for collision search with polynomial memory is not known at the moment, the algorithms that we have presented in Section 5.1 always apply. Better trade-offs between classical and quantum resources may still be at reach. Finally, the offline Simon's attack of Chapter 7 reaches the collision bound 𝒪 `2𝑛{3 ˘for block sizes 𝑛 with polyp𝑛q memory, although it concerns only specific constructions.

Thus, we choose an internal state of 256 bits, twice the size of the AES. Many of the designs submitted to the NIST LWC project also use keys of 256 bits and internal states of at least the same size, but these are often Sponge constructions. Among the second-round candidates based on block ciphers, 11 proposals use variants of AES, GIFT, Skinny, Speck and CHAM (by order of frequency) [GJN19; Cha+20; And+19; Ban+19b; Cha+19b; Cha+19a; CN19; Gou+19; Nai+19; Bei+20; Ban+19a] and three proposals, including Saturnin, define custom block ciphers [START_REF] Goudarzi | Pyjamask: Block Cipher and Authenticated Encryption with Highly Efficient Masked Implementation[END_REF][START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF]. All these designs, except Saturnin, use blocks of 128 bits or less.

Quantum-secure modes of operation. We have seen in Chapter 4 that many classically secure authentication modes suffer from polynomial-time attacks in the Q2 model. Since post-quantum security is one of our main goals, we choose the most efficient possible modes of operation with Q2 security.

AES with bigger states. Our first aim was to create a 256-bit block cipher with an efficient bitsliced implementation, that could be used on devices with little computing power, e.g., microcontrollers. At the same time, we took advantage of the knowledge obtained from the analysis of the [AES]. AES can safely be considered the most analyzed block cipher to date, in the classical setting. The results that we presented in Chapter 9 also provide a first security analysis in the quantum setting.

Saturnin can be seen as a 3-dimensional AES, in which the strongly-aligned version of the wide-trail strategy [Dae95; DR02a] can be applied. In short, the wide-trail strategy aims at minimizing low-weight differential and linear trails by choosing small S-Boxes with good differential and linear properties, and using a linear layer with a high branch number. Alignment between the linear and substitution layers allows to easily derive bounds on the number of active S-Boxes. In the AES, the composition of a state-wise permutation of the bytes and of a column-wise MDS transformation is a good compromise. These transformations will be adapted to our design. This is not the first time that variants of AES with larger states have been proposed. In fact, the Rijndael family of block ciphers [DR99] included versions with larger states than 128 bits. However, these states were represented as a rectangle of bytes instead of a square, which made the diffusion relatively slower. Many attacks exploited this fact [GM08; MPP09; NP07; Zha+08; Wan+12; Sas10]. The variants of AES or Rijndael with longer keys than blocks are also relatively less secure with respect to related-key attacks [START_REF] Biryukov | Distinguisher and Related-Key Attack on the Full AES-256[END_REF][START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF].

The applicability of the wide-trail strategy in more dimensions than 2 was studied in [START_REF] Daemen | The Design of Rijndael: AES -The Advanced Encryption Standard. Information Security and Cryptography[END_REF]. In [START_REF] Nakahara | 3D: A Three-Dimensional Block Cipher[END_REF], Nakahara Jr defined the block cipher 3D, an AES-like cipher in three dimensions with similar subroutines. However, our cipher was designed with lightness in mind, and all our operations benefit from an efficient bitsliced implementation. This means that our three-dimensional state can be projected onto 2 dimensions, and represented as a set of 32-bit registers.

Some hash function candidates of the SHA-3 competition, like Lane [Ind+08], Grøstl [START_REF] Gauravaram | Grøstl -a SHA-3 candidate[END_REF], and ECHO [START_REF] Gilbert | SHA-3 proposal: ECHO[END_REF], used AES transformations (ShiftRows, Mix-Columns) with bigger internal states. However, these designs handle their state in a different way from Saturnin.

Specification of Saturnin

In this section, we specify the different components of the Saturnin suite3 :

• Saturnin-CTR-Cascade is an authenticated cipher with associated data (AEAD) that follows the Encrypt-then-MAC composition [START_REF] Bellare | Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm[END_REF]. Its encryption uses the Counter mode (CTR) and its MAC uses the Cascade construction [START_REF] Bellare | Keying Hash Functions for Message Authentication[END_REF].

• Saturnin-Short is an authenticated cipher for messages of length smaller than 128 bits. It calls Saturnin only once.

• Saturnin-Hash is a hash function with 256-bit output.

We note that among these modes, only Saturnin-Short requires the implementation of the inverse of Saturnin. We defer the security claims of Saturnin to the next section, in which we will define in detail what kind of classical and quantum access is allowed to the block cipher and the modes.

The Block Cipher Saturnin

Saturnin is a Substitution-Permutation Network with 256-bit blocks, a 256-bit key, and a 4-bit domain separator, which simplifies the layout of its modes of operation (they use the same cipher with different values of 𝐷). It has a 256-bit internal state. We define in this section a family of keyed permutations Saturnin 𝐷 𝑅 parameterized by:

• A number 𝑅 of super-rounds. 𝑅 belongs to t10, . . . , 31u and is equal to 10 by default; smaller values of 𝑅 can be used to define weakened versions of the cipher for analysis purposes)

• A domain separator 𝐷 P F 4 2 " Saturnin 𝐷 𝑅 : F 256 2 ˆF256 2 Ñ F 256 2 X , K Þ Ñ Saturnin 𝐷 𝑅 pX, Kq (10.1)
The key K in input is denoted the master key. Since 𝑅 " 10 by default, we write Saturnin 𝐷 for Saturnin 𝐷 10 .

Internal State

Round keys and internal states of Saturnin can be equivalently represented as:

• a 4 ˆ4 ˆ4 cube of 4-bit nibbles: the 3-dimensional abstract representation (Figure 10.1, left);

• sixteen 16-bit registers, indexed from 0 to 15: the 2-dimensional bitsliced representation (Figure 10.1, right).

In this section, we use the abstract representation, as it allows to represent the operations of the cipher in a more intuitive way. In Section 10.2.2, we will show how to translate the operations on the cube into the bitsliced representation.

The numbering of the cube nibbles goes from 0 to 63, as displayed in Figure 10.1. Each nibble can also be defined by coordinates p𝑥, 𝑦, 𝑧q such that the coordinates p𝑥, 𝑦, 𝑧q correspond to the nibble with index p𝑦 `4𝑥 `16𝑧q. We number the bits within each nibble from 0 to 3, where 0 is the least significant bit. Subsets of the state. The various transformations in Saturnin are applied on different subsets of its state. Below, we define three such subsets of the cube, based on the same terminology as for parts of the Keccak-f state in SHA-3 (see Figure 1.1 in [START_REF] Bertoni | Submission to the SHA-3 competition (round 3)[END_REF]).

Slice. In the cube, a slice is a subset of the nibbles such that 𝑧 is constant.

Sheet. In the cube, a sheet is a subset of the nibbles such that 𝑥 is constant.

Columns. Columns are the intersection of a sheet and a slice. They correspond to the sets of nibbles with 𝑥 and 𝑧 constant.

Specification of the Block Cipher

The SPN in Saturnin 𝐷 𝑅 has 2𝑅 rounds numbered from 0 to 2𝑅 ´1. We define a super-round as the composition of two consecutive rounds with indices 2𝑟 and p2𝑟 `1q. We now detail the operations of the cipher, acting on a a 256-bit internal state X and a 256-bit key K, both represented as a p4 ˆ4 ˆ4q-cube of nibbles. Two additional 16-bit words RC 0 and RC 1 are used for generating the successive round constants. Pseudo-code describing a full block encryption is given in Algorithm 10.1.

Initialization. X and K are respectively initialized with the input and with the master key. Both 16-bit registers RC 0 and RC 1 are initialized as the bit-string 1 . . . 1 lo omo on where the rightmost bit of the register is the least significant bit. The first four bits are given by the domain separator ř 3 𝑖"0 𝐷 𝑖 2 𝑖 " 𝐷, while the 5-bit integer ř 4 𝑖"0 𝑅 𝑖 2 𝑖 is equal to the number of super-rounds 𝑅. Round 0 starts by XORing K to the internal state.

Round function. Each round, starting from Round 0, then successively applies the following transformations to the internal state:

• An S-Box layer S, which applies the same 4-bit S-Box 𝜎 0 to all nibbles with an even index, and the same 4-bit S-Box 𝜎 1 to all nibbles with an odd index. These two S-Boxes are defined by their lookup tables which are given in Table 10.1, where 𝑥 such that ř 3 𝑖"0 𝑥 𝑖 2 𝑖 " 𝑥 corresponds to a nibble containing p𝑥 3 , 𝑥 2 , 𝑥 1 , 𝑥 0 q. An efficient implementation of the S-Boxes is shown in Figure 10.2.

• A nibble permutation SR 𝑟 which depends on the round number 𝑟. For all even rounds, SR 𝑟 is the identity function. For odd rounds of index 𝑟 with 𝑟 mod 4 " 1, SR 𝑟 " SR slice consists of the parallel application of 𝑅 slice on each slice independently. This operation maps the nibble with coordinates p𝑥, 𝑦, 𝑧q to p𝑥 `𝑦 mod 4, 𝑦, 𝑧q.

For odd rounds of index 𝑟 with 𝑟 mod 4 " 3, SR 𝑟 " SR sheet consists of the parallel application of 𝑅 sheet on each sheet independently. This operation maps the nibble with coordinates p𝑥, 𝑦, 𝑧q to p𝑥, 𝑦, 𝑧`𝑦 mod 4q. The SR 𝑟 transformation is depicted in Figure 10.4 and Figure 10.5.

• A linear layer MC composed of 16 copies of a linear operation 𝑀 over pF 4 2 q 4 which is applied in parallel to each column of the internal state. 𝑀 is defined as:

𝑀 : ¨𝑎 𝑏 𝑐 𝑑 ‹ ‹ ' Þ Ñ ¨𝛼2 p𝑎q ' 𝛼 2 p𝑏q ' 𝛼p𝑏q ' 𝑐 ' 𝑑 𝑎 ' 𝛼p𝑏q ' 𝑏 ' 𝛼 2 p𝑐q ' 𝑐 ' 𝛼 2 p𝑑q ' 𝛼p𝑑q ' 𝑑 𝑎 ' 𝑏 ' 𝛼 2 p𝑐q ' 𝛼 2 p𝑑q ' 𝛼p𝑑q 𝛼 2 p𝑎q ' 𝑎 ' 𝛼 2 p𝑏q ' 𝛼p𝑏q ' 𝑏 ' 𝑐 ' 𝛼p𝑑q ' 𝑑 ‹ ‹ '
where 𝑎 is the nibble with the lowest index, and 𝛼 transforms the four bits 𝑥 0 , . . . , 𝑥 3 of each nibble by the following multiplication

¨0 1 0 0 0 0 1 0 0 0 0 1 1 1 0 0 ‹ ‹ ' ¨𝑥0 𝑥 1 𝑥 2 𝑥 3 ‹ ‹ ' .
This transformation corresponds to the next-state function of an LFSR of length 4, in Fibonacci mode, with feedback polynomial 𝑋 4 `𝑋3 `1.

The transformation 𝑀 can be implemented efficiently as depicted in Figure 10.3 (which corresponds to Figure 13 in [START_REF] Duval | MDS Matrices with Lightweight Circuits[END_REF] up to a rotation of the nibbles). It is chosen among the mappings exhibited in [START_REF] Duval | MDS Matrices with Lightweight Circuits[END_REF] for its implementation cost.

• The inverse of the previous nibble permutation, namely SR ´1 𝑟 .

• A sub-key addition at odd rounds only (i.e., at the end of each super-round).

The sub-key is composed of the XOR of a round constant and either the master key or a rotated version of the master key:

Round constant. Round key. If the round index 𝑟 is such that 𝑟 mod 4 " 3, the master key K is XORed to the internal state; otherwise (i.e., when 𝑟 mod 4 " 1), a rotated version of the key is added instead: the nibble with index 𝑖 receives the key nibble with index p𝑖 `20q mod 64, for 0 ď 𝑖 ď 63.

Table 10.1: Lookup tables of the S-Boxes in Saturnin.

𝑥 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 𝜎 0 p𝑥q 0 6 14 1 15 4 7 13 9 8 12 5 2 10 3 11 𝜎 1 p𝑥q 0 9 13 2 15 1 11 7 6 4 5 3 8 12 10 14

Operations on the Bitsliced Representation

The bitsliced or register representation is at the heart of the design of Saturnin.

Although the specification that we gave above relies on the cube, as do many security arguments, all implementations of Saturnin will represent its internal state as sixteen 16-bit registers as shown in Figure 10.1. In this bitsliced representation, the bit of lowest weight of each register has index 0 and the bit of highest weight has index 15. A bit is then defined by the index 𝑖 of its register and its index 𝑏 within its register. The bits with coordinates p4𝑖, 𝑏q, p4𝑖 `1, 𝑏q, p4𝑖 `2, 𝑏q and p4𝑖 `3, 𝑏q, which are therefore taken from registers 4𝑖 to 4𝑖 `3, correspond to nibble p𝑥, 𝑦, 𝑧q " p𝑏 mod 4, 𝑖, t𝑏{4uq in the cube. 𝑖 0 1 2 3 𝜋 0 p𝑖q 3 0 1 2 𝜋 1 p𝑖q 2 1 3 0 it is summarized in Figure 10.6. Nibble permutation in a slice. In order to mix the columns in each slice, we use SR slice which consists in the parallel application of 𝑅 slice on each slice independently. This operation maps the nibble with coordinates p𝑥, 𝑦, 𝑧q to p𝑥 `𝑦 mod 4, 𝑦, 𝑧q. Its implementation on 16-bit registers is summarized in Figure 10.7. It can be implemented by rotating each 4-bit word in register 𝑖 by t𝑖{4u.

Nibble permutation in a sheet. We proceed with sheets as we did with slices. In order to mix the columns in each sheet, we use SR sheet which consists in the parallel application of 𝑅 sheet on each sheet independently. This operation maps the nibble with coordinates p𝑥, 𝑦, 𝑧q to p𝑥, 𝑦, 𝑧 `𝑦 mod 4q. It is summarized in Figure 10.8. It can be implemented with a rotation of the 16-bit register 𝑖 by 4t𝑖{4u.

Linear layer. The matrix 𝑀 is defined over pF 2 4 q 4 and is applied in parallel on each column of the state. In the register representation, it is applied in a bitsliced fashion over the whole state at once as summarized in Figure 10.9.

Key addition.

The key addition is applied in a very straightforward way by XORing 16-bit registers in the key state with their counterparts in the internal state of the cipher. Before. After.

Figure 10.8:

The SR sheet operation that mixes the columns in each sheet separately.

In odd super-rounds, each register of the master key is rotated just before being added, meaning we can use operators combining the XOR and the rotation when available.

Constant addition.

The bits in which the constants RC 0 and RC 1 are XORed correspond to registers 0 and 8 respectively. This operation is implemented using two word-wise XORs. The 16-bit state of each LFSR naturally corresponds to one 16-bit register. The mode is specified in Algorithm 10.2 and depicted in Figures 10.10, 10.11 and 10.12. We first encrypt using the Counter mode, then process the associated data and the ciphertexts by a MAC based on the Cascade construction [START_REF] Bellare | Keying Hash Functions for Message Authentication[END_REF]. This MAC is very similar to an NMAC [START_REF] Bellare | Keying Hash Functions for Message Authentication[END_REF] using Saturnin in Matyas-Meyer-Oseas (MMO) mode [START_REF] Matyas | Generating strong one-way functions with cryptographic algorithm[END_REF].

The Authenticated Cipher Saturnin-CTR-Cascade

When decrypting, the authentication tag is first recomputed, and compared with the received value; on mismatch, the encrypted message is rejected. If the authentication tags match, then decryption is identical to encryption. The comparison between authentication tags should endeavor not to reveal the bit position at which mismatched tags diverge.

In general, whenever our proposed modes require padding a value of less than 256 bits into a 256-bit block, we use the following padding rule, and denote as padp𝑥q the padding of block 𝑥. We use the same rule to pad the nonce into the 161-bit string 𝑁 . Definition 10.1 (Padding rule). The padding rule consists in appending a single bit of value 1, followed by as many zeroes as necessary to reach the next block boundary.

In the Counter mode (CTR) depicted in Figure 10.10, we define a keystream by encrypting blocks composed of 𝑁 concatenated with a 95-bit counter which is increased by one for each new call: 𝑧 𝑖 " Saturnin 1 p𝑘, 𝑁 }𝑖 `1q (the counter starts at 1 for the block 𝑧 0 ). The counter is encoded with the big-endian convention: if the counter numerical value 𝑢 is:

𝑢 " 94 ÿ 𝑖"0 𝑢 𝑖 2 𝑖 ,
then each bit 𝑢 𝑖 becomes bit 255 ´𝑖 in the input block. Thus, in a byte-oriented implementation and with a 128-bit nonce, the input to Saturnin 1 for the computation of 𝑧 0 will consist in the 16 bytes of the nonce, followed by a byte of value 0x80 (first padding byte for the nonce), followed by 14 bytes of value 0x00, followed by one byte of value 0x01.

The Authenticated Cipher Saturnin-Short

For some practical scenarios, we propose a second authenticated cipher4 for handling messages of length strictly less than 128 bits (without additional data) and nonces of size up to 128 bits: Saturnin-Short (Figure 10.13). We adopt the same padding convention as in Section 10.2.3 for messages shorter than 128 bits. In Saturnin-Short, we use the fact that Saturnin has a 256-bit block size, allowing to mix together the nonce and the message. We use the variant Saturnin6 . It is worth noticing that the ciphertext and the tag are not two separate values. Given a nonce 𝑁 and a ciphertext 𝑐, the tag can be verified by deciphering 𝑐 and comparing the left half with 𝑁 .

Since Saturnin-Short does not allow additional data, we recommend that protocols based on Saturnin-Short use a counter as the nonce to prevent reordering of the ciphertexts and to detect replay attacks.

The Hash Function Saturnin-Hash

We also propose a 256-bit hash function5 based on Saturnin with the Merkle-Damgård construction [Mer89; Dam89], as shown in Figure 10.14. We use Saturnin 16 (i.e., Saturnin with 16 super-rounds 6 ) because we want the compression function to be resistant to related-key attacks. The compression function uses the MMO [START_REF] Matyas | Generating strong one-way functions with cryptographic algorithm[END_REF] mode (𝑓 p𝑐 𝑖 , 𝑚q " 𝐸 𝑐 𝑖 p𝑚q ' 𝑚) to compress a 256-bit chaining value 𝑐 𝑖 and a 256-bit message block 𝑚. Therefore, Saturnin-Hash (Algorithm 10.3) is similar to the above Cascade, except that there is no key as starting point but a fixed value, 0.

#

Saturnin-Hash : t0, 1u ˚Ñ t0, 1u 256 𝑚 Þ Ñ 𝑡 .

(10.3)

Values of the Domain Separator

We summarize the values of 𝐷 used in the different modes in Table 10.3. Saturnin 𝐷 can either be seen as a small family of independent block ciphers or as a tweakable block cipher with tweak 𝐷.

Security Claims

Having entirely described the members of the Saturnin suite, we formulate security claims. In general, we claim that for the block cipher and the constructions, there is no attack significantly7 better than the generic ones, either classical or quantum. In this section, we will use the term attack in an informal way; more details will be given in Section 10.3. The success probability of an attack is denoted 𝑝. Its time complexity 𝒯 , data complexity 𝒟 and memory complexity ℳ are counted in the following way. Quantum Complexities. 𝒯 is expressed in units equivalent to the cost of one quantum circuit for Saturnin, written with the Clifford+T gate set, without qRAM access (see Section 1.2). This makes our security levels independent of the actual optimization of a quantum circuit for Saturnin, which would be required to run a Grover search for the keys. Our quantum adversaries are Q2. When attacking the block cipher with a secret key, 𝒟 is simply the number of encryption or decryption queries, with superposed messages. When attacking Saturnin-Hash, there is no notion of data.

Classical

When attacking Saturnin-CTR-Cascade or Saturnin-Short, we give the attacker superposition access to the message and AD. She can also call a decryption oracle in superposition (which will return K unless the tag is valid). In both cases, nonces and message lengths remain classical, and nonces are not repeated. This means that the adversary actually accesses a family of quantum oracles 𝑂 𝑁,ml,al Enc 𝑘 for (padded) nonces 𝑁 , message bit-lengths ml and AD bit-lengths al, and similarly, a family of quantum oracles 𝑂 𝑁,ml,al Dec 𝑘 , with the restriction that a given 𝑁 can be used only once. Before each query, a message length, AD length and a nonce are chosen. 𝒟 is the sum of the number of 256-bit blocks of message and AD (full or partial) over all oracle queries. These quantum oracles also come with a time cost, which is the number of single-block evaluations of Saturnin inside the construction. Hybrid Claims. We consider that classical oracle calls cost the same as quantum ones. On the one hand, classical queries are a particular type of quantum queries, so they should be at least easier to make. On the other hand, assuming the converse means that quantum queries are cheap, and this not only simplifies, but also strengthens our claims. Some generic attacks that can target our modes (e.g., BHT collision search, see Section 2.3) are hybrid, and may run differently if different costs are assigned to classical and quantum queries.

Block cipher. By default, Saturnin denotes the block cipher with at least 10 superrounds, i.e., 20 single-rounds. Saturnin 16 corresponds to the block cipher with 16 super-rounds. For related-key attacks, we consider a small number of related keys derived under the conditions of [START_REF] Bellare | A Theoretical Treatment of Related-Key Attacks: RKA-PRPs, RKA-PRFs, and Applications[END_REF], which ensure that no generic attack exists.

Claim 1 (Security of the block cipher Saturnin).

' There exists no classical attack in the single-key setting with 𝒯 𝑝 ă 2 224 . Saturnin 16 provides a similar security level against related-key attacks involving a small number of keys. ' There exists no quantum attack in the single-key setting with 𝒯 2 𝑝 ă 2 224 . Authenticated encryption. In the following security claims, 𝜏 is the length of the tags in bits (256 by default, but it can be less if the tags are truncated). We do not claim security in nonce-misuse or nonce-repetition scenarios. As mentioned above, we do not consider nonce-superposition scenarios, and our Q2 adversaries choose also a classical nonce value.

Claim 2 (Security of Saturnin-CTR-Cascade). ' There exists no classical attack satisfying 𝒟 2 `𝒯 `𝒟2 We also claim security against classical related-key attacks (with the same restrictions on the related keys as for Claim 1) when Saturnin is replaced by Saturnin 16 .

Hash function. Saturnin-Hash is based on Saturnin 16 . In what follows, ℳ 𝑞 is the size of the quantum memory measured in registers of 256 qubits. In these claims we consider 𝑝 ě 1{2. We assume of course that ℳ 𝑞 ě 1. The claim for collisions implies that there is no quantum attack with 𝒯 ă 2 75 , because we necessarily have ℳ 𝑞 ă 𝒯 .

Claim 4 (Security of Saturnin-Hash).

' There exists no classical collision attack with 𝒯 ă 2 112 . There exists no classical second-preimage attack with 𝒯 ă 2 224´ℓ for messages of length 2 ℓ . There exists no classical preimage attack with 𝒯 ă 2 224 . ' There exists no quantum collision attack satisfying 𝒯 5 ˆℳ𝑞 ă 2 448 . There exists no quantum second-preimage attack with 𝒯 ă 2 112´ℓ{2 for messages of length 2 ℓ . There exists no quantum preimage attack with 𝒯 ă 2 112 .

Security of the Modes of Operation

The available literature on post-quantum modes of operation conditioned our choice for Saturnin. In this section, we introduce some standard classical and quantum security definitions and show how the security of the modes of operation used in Saturnin-CTR-Cascade, Saturnin-Hash and Saturnin-Short can be reduced formally to that of the block cipher. For convenience, we recall some notations: nonces are denoted 𝑁 , messages are denoted 𝑚, ADs are denoted 𝑎 and their respective bit-length ml and al.

Throughout this section, we define an adversary as a quantum algorithm, that accesses one or more oracles, classical or quantum. In the latter case, we consider standard oracles without loss of generality. Thus, although we give some classical definitions, we consider a quantum attacker making classical queries (Q1) in this context. The quantum definitions that we introduce afterwards model Q2 adversaries. Note that a quantum adversary is free to call unkeyed primitives, such as Saturnin-Hash or Saturnin itself, in superposition.

Interface and Security Goals for an AEAD Scheme

Our primary target is Saturnin-CTR-Cascade, which is modeled as a nonce-based AEAD scheme pEncrypt 𝑘 , Decrypt 𝑘 q of signature: where 𝑘 is taken from some key space 𝒦. Accept is J if and only if the tag recomputed from 𝑁, 𝑎, 𝑐 matches 𝑡, and in that case, the ciphertext is correctly decrypted, otherwise Decrypt 𝑘 returns K, K. Alternatively, 𝑁 can be considered to be part of the ciphertext (since it must be transmitted alongside).

$
We use game-based classical and quantum security definitions, whose goal is to show that, under some assumptions, an adversary cannot win some security game with more than non-negligible advantage. More modern classical proofs consider instead the ability of the adversary to distinguish between a real world and an ideal world, in which she interacts with different oracles. We keep the former definitions for their proximity to the quantum definitions that we will introduce later. Furthermore, we adapt all definitions to the nonce-based case (the literature often considers randomness instead of nonces, with no practical difference for us).

Example: IND-CPA

We define the IND-CPA security game, in which an adversary 𝒜 interacts with a challenger.

IND-CPA game

Key generation: 𝑘

$ Ð Ý 𝒦, 𝑏 $ Ð Ý t0, 1u.
Challenge queries: 𝒜 chooses two message / AD pairs 𝑎 0 , 𝑚 0 , 𝑎 1 , 𝑚 1 , a nonce 𝑁 that has not been used before; the challenger responds with Encrypt 𝑘 `𝑁, 𝑎 𝑏 , 𝑚 𝑏 ˘.

Encryption queries: 𝒜 chooses a message / AD 𝑎, 𝑚, a nonce 𝑁 that has not been used before; the challenger responds with Encrypt 𝑘 p𝑁, 𝑎, 𝑚q.

Guess: 𝒜 produces a bit 𝑏 1 and wins if 𝑏 " 𝑏 1 .

On this simple example, we will define the advantage of 𝒜 and the IND-CPA security of Encrypt 𝑘 . A scheme defined as above is said indistinguishable under chosen-plaintext attacks (IND-CPA) if the IND-CPA advantage in function of 𝑞 is small (i.e., an exponential number of queries is required to make it constant). More generally, we let Adv 𝑂 Game p𝑞, 𝒯 q denote the maximal advantage of adversaries running in Game, making 𝑞 queries to an oracle 𝑂 and running in time 𝒯 , and we give bounds on this quantity.

Unforgeability and IND-CCA2.

Indistinguishability under Adaptive Chosen-ciphertext Attacks (IND-CCA2) is an enhanced version in which the adversary is allowed encryption and decryption queries, but cannot decrypt one of the challenge queries.

IND-CCA2 game

Key generation: 𝑘

$ Ð Ý 𝒦, 𝑏 $ Ð Ý t0, 1u.
Challenge queries: 𝒜 chooses two message / AD pairs 𝑎 0 , 𝑚 0 , 𝑎 1 , 𝑚 1 , a nonce 𝑁 that has not been used before; the challenger responds with Encrypt 𝑘 `𝑁, 𝑎 𝑏 , 𝑚 𝑏 ˘.

Encryption queries: 𝒜 chooses a message / AD 𝑎, 𝑚, a nonce 𝑁 that has not been used before and; the challenger responds with Encrypt 𝑘 p𝑁, 𝑎, 𝑚q.

Decryption queries: 𝒜 chooses a ciphertext / tag 𝑐, 𝑡; the challenger responds with Decrypt 𝑘 p𝑐, 𝑡q if 𝑐, 𝑡 was not the result of a challenge query, and K otherwise.

Guess: 𝒜 produces a bit 𝑏 1 and wins if 𝑏 " 𝑏 1 .

Notice that we remove the nonce from the decryption call, and consider that it is part of the ciphertext. Thus we follow the definition where the encryption is randomized and the decryption is deterministic. Next, we define Strong Unforgeability under Chosen-Message Attacks (SUF-CMA) for a nonce-based MAC scheme.

SUF-CMA game

Key generation: 𝑘

$ Ð Ý 𝒦.
MAC queries: 𝒜 chooses a message 𝑚, a nonce 𝑁 that has not been used before and queries the MAC.

Verification queries: 𝒜 chooses a message 𝑚, a tag 𝑡. The challenger returns J if the tag is valid and K otherwise. The adversary wins if she queries here a pair which is not the result of a previous MAC query.

Bellare and Namprempre [START_REF] Bellare | Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm[END_REF] studied several compositions of a MAC and an encryption scheme in the classical setting: MAC-then-encrypt (used in TLS 1.0), Encryptand-MAC (used in SSH), and encrypt-then-MAC (used in IPSec). The latter is defined from an encryption scheme 𝐸 𝑘 , 𝐷 𝑘 (randomized or stateful) and a MAC scheme 𝑀 𝑘 , 𝑉 𝑘 as: Encrypt 𝑘 p𝑁, 𝑚q " 𝐸 𝑘 p𝑁, 𝑚q, 𝑀 𝑘 p𝑁, 𝐸 𝑘 p𝑁, 𝑚qq. Proposition 10.1 (From [START_REF] Vivekanand Anand | Post-Quantum Security of the CBC, CFB, OFB, CTR, and XTS Modes of Operation[END_REF]). Let Encrypt 𝑘 be a mode defined by: Encrypt 𝑘 p𝑁, 𝑚q " 𝑚 ' 𝑓 p𝑘, 𝑁 q where 𝑓 is an extendable-output function. Then: On the negative side, we have seen in Chapter 4 that the Deutsch-Jozsa algorithm allows to distinguish such a mode with Q2 queries (Proposition 4.1), even though this distinguisher does not contradict the IND-qCPA security. This means that the adversary cannot obtain from the Q2 queries an information that would help her win the IND-CPA security game, for example the secret key.

Adv

Unforgeability and IND-qCCA

Defining a quantum notion of unforgeability is a bigger challenge than IND-qCPA, because the output forgery must be that of a message previously unqueried, while the queries are made in superposition. Again, the literature considers deterministic MACs without nonces, and we adapt the definitions to our setting.

Boneh and Zhandry [START_REF] Boneh | Quantum-Secure Message Authentication Codes[END_REF] proposed the following definition: the adversary makes 𝑞 quantum queries and shouldn't be able to output 𝑞 `1 valid tmessage, tagu pairs with more than negligible probability. However, Alagic, Majenz, Russell, and Song [START_REF] Alagic | Quantum-Access-Secure Message Authentication via Blind-Unforgeability[END_REF] noticed a caveat: it is possible to build a MAC such that a part of its message space contains a secret value that enables the adversary to find a valid tmessage, tagu outside this space. Such a pair should be intuitively regarded as a forgery. A pathological example of such a MAC scheme can be found in [START_REF] Alagic | Quantum-Access-Secure Message Authentication via Blind-Unforgeability[END_REF]. To date, no practical BU-secure and BZ-insecure MAC is known.

In order to overcome this issue, they define the Blind-Unforgeability (BU) security game. The challenger chooses a random blinding 𝐵 𝜀 , which specifies a fraction of the message space in which the adversary cannot query the MAC. The candidate forgery must then occur in this space. The BU game is a quantum version of the classical EUF-CMA game, to which it reduces if only classical queries are considered. Note that in the definition of [START_REF] Alagic | Quantum-Access-Secure Message Authentication via Blind-Unforgeability[END_REF] the adversary is not allowed superposition access to the verification oracle.

In our case, the nonce-based MAC 𝑀 𝑘 will be replaced by a "blinded" version 𝐵 𝜀 𝑀 𝑘 :

$ & % 𝐵 𝜀 𝑀 𝑘 : t0, 1u ˚ˆt0, 1u 𝜈 Ñ t0, 1u 𝜏 p𝑁, 𝑚q , 𝑚 R 𝐵 𝜀 Þ Ñ 𝑀 𝑘 p𝑁, 𝑚q p𝑁, 𝑚q , 𝑚 P 𝐵 𝜀 Þ Ñ K

.

BU game Setup: the challenger picks a random key 𝑘 and a random blinding 𝐵 𝜀 MAC queries: 𝒜 chooses a nonce 𝑁 that has not been used before, and performs a call to the unitary 𝑂 𝐵𝜀𝑀 𝑘 on her registers.

Forgery attempt: 𝒜 chooses a nonce 𝑁 that has not been used before, and produces a candidate forgery p𝑚, 𝑁 q, 𝑡. The adversary wins if 𝑉 𝑘 p𝑚, 𝑁, 𝑡q " J and 𝑚 P 𝐵 𝜀 .

While BU-unforgeability avoids the problematic case explained in [START_REF] Alagic | Quantum-Access-Secure Message Authentication via Blind-Unforgeability[END_REF], it also implies the security notion of Boneh and Zhandry (BZ) [START_REF] Boneh | Quantum-Secure Message Authentication Codes[END_REF].

Proposition 10.2 (Theorem 13 in [START_REF] Alagic | Quantum-Access-Secure Message Authentication via Blind-Unforgeability[END_REF]). A BU-secure MAC is BZ-secure.

Composition results. The reason for proving IND-qCPA and BU-security together is that these two notions should imply indistinguishability of under quantum chosenciphertext attacks. A definition of IND-qCCA2 is given by Boneh and Zhandry in [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF]. In [START_REF] Soukharev | Post-Quantum Security Models for Authenticated Encryption[END_REF], Soukharev, Jao, and Seshadri proved that IND-qCPA and BZ imply IND-qCCA2 for Encrypt-then-MAC, as in the classical setting. However, in [START_REF] Chevalier | On the Security Notions for Encryption in a Quantum World[END_REF], Chevalier, Ebrahimi, and Vu state that the proof contains a loophole, and incorrectly assumes the ability to record some quantum queries. A similar composition result is proven in [START_REF] Chevalier | On the Security Notions for Encryption in a Quantum World[END_REF], but for a stronger security notion than IND-qCPA, which allows the one-time pad attack.

qPRFs and qPRPs

The basic security that we expect from Saturnin (with 10 or 16 super-rounds) is to be a strong quantum pseudorandom permutation (sqPRP) in the following sense. `𝒜𝑂 Π ˘p𝑞q " 1 ˘ˇˇˇˇw here 𝒜 𝑂 p𝑞q is a distinguisher, i.e., a quantum adversary making 𝑞 queries to its oracle 𝑂 and outputting a bit 𝑏; 𝐸 k and Π ˘are functions of 𝑛 `1 bits, that either call the permutation or its inverse.

Note that it is equivalent, up to a constant factor in the number of queries, to have access to two separate oracles 𝑂 𝐸 𝑘 and 𝑂 𝐸 ´1 𝑘 , or to a single oracle 𝑂 𝐸 k . Definition 10.4 (Strong qPRP). 𝐸 𝑘 is a strong qPRP if Adv 𝐸 𝑘 sqPRP p𝑞, 𝒯 q is negligible for polynomial-time adversaries. It is a qPRP if the same holds without the inverse queries.

With this definition, the expected security of Saturnin (Claim 1) can be formulated more precisely: @𝑞, 𝒯 , Adv Saturnin 𝑘 sqPRP p𝑞, 𝒯 q ď 𝒯 2 2 224 . (10.5)

This bound is matched by a secret key-recovery using Grover's algorithm. A stronger requirement is to behave as a (quantum) ideal cipher [START_REF] Hosoyamada | Building Quantum-One-Way Functions from Block Ciphers: Davies-Meyer and Merkle-Damgård Constructions[END_REF], which we expect from Saturnin 16 . In this model, the cipher behaves as a family of independent permutations drawn at random. Definition 10.6 (qPRF). 𝐹 𝑘 is a qPRF if Adv 𝐹 𝑘 qPRF p𝑞, 𝒯 q for polynomial-time adversaries is negligible.

Notice that in both these definitions, while the adversary queries her oracle in superposition, 𝑘 is always a classical value. The following proposition makes qPRFs particularly interesting for us.

Proposition 10.3 ([Ala+20b]

). Let 𝐹 𝑘 be a qPRF. Then 𝐹 𝑘 is a BU-secure MAC.

So far, all MACs with quantum unforgeability that can be found in the literature are actually quantum PRFs. This is the case of NMAC, HMAC and the Cascade construction, which were studied in [START_REF] Song | Quantum Security of NMAC and Related Constructions -PRF Domain Extension Against Quantum attacks[END_REF]. Thus, we will obtain BU-unforgeability thanks to Proposition 10.3.

Security Reductions

We are now sufficiently equipped to prove the security of our modes of operation.

Indistinguishability of Saturnin-CTR

We prove the following property of our Saturnin 𝑘 -CTR encryption. Notice that in this bound, Adv Saturnin 𝑘 PRP p𝒯 , 𝑞q is the distinguishing advantage of quantum adversaries running in time 𝒯 and making 𝑞 classical queries to Saturnin 𝑘 and its inverse, which is weaker than qPRP security. Proof. The classical security of the CTR mode has been studied in [START_REF] Bellare | A Concrete Security Treatment of Symmetric Encryption[END_REF]. The proof assumes that for any fixed key, the inputs of block cipher calls are never reused [START_REF]SP 800-38A: Recommendation for Block Cipher Modes of Operation: Methods and Techniques[END_REF]. This is the case in Saturnin-CTR-Cascade, since we concatenate the nonce with a block counter. By Theorem 13 in [START_REF] Bellare | A Concrete Security Treatment of Symmetric Encryption[END_REF], if Saturnin is replaced by a pseudorandom function 𝐹 𝑘 : Adv 𝐹 ´𝐶𝑇 𝑅 IND´CPA p𝑞, 𝒯 q ď 2 ¨Adv 𝐹 PRF p𝑞, 𝒯 q (10.6)

where 𝑞 denotes the total number of block cipher calls in the queries. Next, the PRP-PRF switching lemma can be used (Proposition 8 in [START_REF] Bellare | A Concrete Security Treatment of Symmetric Encryption[END_REF]) which states that it is impossible to distinguish Saturnin 𝑘 from a PRF, up to a birthday bound.

Adv Saturnin

PRF p𝑞, 𝒯 q ď Adv Saturnin PRP p𝑞, 𝒯 q `𝑞2 2 256`1 . (10.7) Furthermore, this bound is independent of the time 𝒯 . Indeed, one cannot distinguish a function from a permutation unless outputting a collision of this function. Thus, in the classical setting, we have:

Adv

Unforgeability of Saturnin-Cascade

We define the compression function ℎp𝑘, 𝑚q " Saturnin 𝑘 p𝑚q ' 𝑚, where Saturnin is used with a domain separator equal to 2, 3, 4 or 5 (but for simplicity, we do not consider the different domain separators, nor associated data). We define the length-ℓ Cascade 𝐻 ℓ by: 𝐻 ℓ 𝑘 p𝑚 0 , . . . 𝑥 ℓ q " ℎp. . . ℎpℎp𝑘, 𝑚 0 q, 𝑚 1 q . . . 𝑚 ℓ qq . Then, we have the following. Proposition 10.5 (Theorem 5.1 in [START_REF] Song | Quantum Security of NMAC and Related Constructions -PRF Domain Extension Against Quantum attacks[END_REF]). If ℎp𝑘, ¨q is a qPRF, then 𝐻 ℓ 𝑘 is also a qPRF: Next, we show that Adv 𝐸 𝑘 qPRF p𝑞, 𝒯 q ď Adv 𝐸 𝑘 qPRP p𝑞, 𝒯 q`𝒪 ´𝑞3 2 𝑛 ¯. This is the quantum PRP-PRF switching lemma, shown in [START_REF] Zhandry | A note on the quantum collision and set equality problems[END_REF]: random functions are indistinguishable from random permutations up to the quantum birthday bound.

Adv

Combining this with Proposition 10.3, we obtain that if Saturnin is a qPRP, then Saturnin-Cascade is a BU-secure MAC.

Saturnin-Short

In [START_REF] Bellare | Encode-Then-Encipher Encryption: How to Exploit Nonces or Redundancy in Plaintexts for Efficient Cryptography[END_REF], the authors prove the security (assuming a strong PRP) of an encodethen-encrypt construction. Saturnin-Short can be seen as such, where the encoding corresponds to appending the nonce 𝑁 , which is transmitted with the message. With small modifications, confidentiality and authenticity come from Theorems 4.1 and 4.2 in [START_REF] Bellare | Encode-Then-Encipher Encryption: How to Exploit Nonces or Redundancy in Plaintexts for Efficient Cryptography[END_REF]. Quantumly, Saturnin 𝑘 -Short is a qPRF of 𝑘, which implies security against forgeries by Proposition 10.3.

Saturnin-Hash

Contrary to Saturnin-CTR-Cascade and Saturnin-Short, the security of Saturnin-Hash does not stem from the security of Saturnin as a PRP (resp. qPRP), but as an ideal cipher, which is why the mode Saturnin-Hash uses a version of Saturnin with more rounds.

Classically, the security of Merkle-Damgård is related to that of the compression function. Ours uses the Matyas-Meyer-Oseas (MMO) mode, similar to the Cascade: ℎ 𝑖`1 " Saturnin ℎ 𝑖 p𝑚 𝑖 q ' 𝑚 𝑖 . It is dual to the Davies-Meyer construction, which injects the message block 𝑚 𝑖 into the key, and would give rather ℎ 𝑖`1 " Saturnin 𝑚 𝑖 pℎ 𝑖 q ' ℎ 𝑖 [START_REF] Preneel | Hash Functions Based on Block Ciphers: A Synthetic Approach[END_REF].

In [START_REF] Zhandry | How to Record Quantum Queries, and Applications to Quantum Indifferentiability[END_REF], Zhandry proves the quantum indifferentiability of the Merkle-Damgård construction if it uses a prefix-free encoding (hence a good padding), and if the underlying compression function is a random function. The compression function we use here is: ℎp𝑥, 𝑦q " Saturnin 𝑥 p𝑦q ' 𝑦. If Saturnin is a quantum ideal cipher by the definition of [START_REF] Hosoyamada | Building Quantum-One-Way Functions from Block Ciphers: Davies-Meyer and Merkle-Damgård Constructions[END_REF], then ℎ cannot be distinguished from a random function. Consequently, Zhandry's proof applies.

Attacks against the Modes of Operation

We summarize here the best generic attacks known against Saturnin-CTR-Cascade, Saturnin-Short and Saturnin-Hash, explaining the rationale behind the claims of Section 10.2.7. These attacks use either search or collision search with a limited number of queries, or quantum collision search with a limited memory. We do not consider parallelization or multiple targets.

Classical attacks against Saturnin-CTR-Cascade. Let 𝜏 be the tag length and 𝑝 the probability of success of a classical adversary against Saturnin-CTR-Cascade in breaking its confidentiality, integrity or authenticity. We claim:

𝑝 ă 𝒯 2 256 `𝒟2 2 256 `𝒟2 ´𝜏 ,
where the adversary is entitled to encryption or verification queries of a total of 𝒟 blocks, and 𝒯 computation time. Among these terms, 𝒯 2 256 accounts for the exhaustive search of the key, which breaks the PRP security of Saturnin. The term 𝒟 2 2 256 accounts for finding a collision on an internal state. The term 𝒟2 ´𝜏 accounts for asking the verification queries of random ciphertexts and tags. Each of them has a probability 2 ´𝜏 of being accepted: the verifier will decipher and recompute the corresponding tag, ending up with a random string that must match the adversary's tag. Hence the probability of success after 𝒟 verification queries is 𝒟2 ´𝜏 .

Quantum attacks against Saturnin-CTR-Cascade. With the same notations as above, we claim:

𝑝 ă 𝒯 2 2 256 `𝒟3 2 256 `𝒟2 2 ´𝜏 ,
where the adversary is entitled to encryption or verification queries of a total of 𝒟 blocks (in superposition), and 𝒯 computation time. The term 𝒯 2 2 256 accounts for quantum search of the block cipher key, with limited time (see Lemma 2.3). The term 𝒟 3 2 256 accounts for finding a collision on 256 bits after 𝒟 queries. Finally, the term 𝒟 2 2 ´𝜏 accounts for making the verifier accept a random tag, using Grover's algorithm with the verifier as oracle.

Attacks against Saturnin-Short. In Saturnin-Short, the generic attacks are slightly different from Saturnin-CTR-Cascade. Although the tag is not truncated to 128 bits, the attack using verification queries applies as if it were the case. Indeed, a forgery using verification queries amounts to finding 𝑐, 𝑁 such that 𝐸 ´1 𝑘 p𝑐q contains 𝑁 on its 128 right bits. 𝑁 is not queried in superposition, and the adversary has only access to the verification result, not the value. So this amounts to look for 2 256 good elements (sound pairs 𝑐, 𝑁 ) among 2 256`128 (all choices) with the verifier as oracle. Classically, the probability of success after 𝒟 trials is 𝒟2 ´128 .

Quantumly, Grover's algorithm speeds up the search for a random ciphertext and nonce giving a good verification result. With 𝒟 superposition verification queries, the success probability is 𝒟 2 2 ´128 , so everything happens as if the tag was actually truncated to 128 bits.

Attacks against Saturnin-Hash. For finding preimages, the best attacks are classical or quantum exhaustive search, which give the bounds in the claims. Our security claim against collision search takes into account the quantum memory available to the attacker. We detail the rationale of this claim.

Given a standard oracle 𝑂 ℎ for a random function ℎ : t0, 1u 𝑛 Ñ t0, 1u 𝑛 , the BHT algorithm (Algorithm 2.10 in Section 2.3) reaches a time-memory trade-off curve 𝒯 2 ¨ℳ " 2 𝑛 until ℳ " 2 𝑛{3 using QRACM. Algorithm 5.1, presented in Section 5.1 reaches the same curve until ℳ " 2 𝑛{5 , without QRACM. By subsuming these two results, as shown in Figure 10.15, we can make the following conjecture. columns of C independently, while for odd 𝑟, it applies to its rows. In other words, a super-round has the following structure: the S-box S 16 is applied to each 16-bit word, then L 64 is applied to the four columns of C, and the matrix C is transposed.

Saturnin is then very similar to an AES operating on 16-bit words (supernibbles) except that the ShiftRows transformation is replaced by a transposition, exactly as it was in Square [DKR97], a predecessor of the AES. The key-schedule of this cipher is also very simple. The subkey at even rounds is the master key K. At odd rounds, the key is shifted by 5 bytes and transposed.

This Super S-Box representation will help us analyze the resistance of Saturnin to the main classes of attacks.

Design of the Super-S-Box

We recall the following standard definitions. Definition 10.7 (Linearity). The Walsh transform of an S-Box 𝑆 is defined as: @𝛼, 𝛽 P F 16 2 , 𝛽 ‰ 0, p 𝑆p𝛼, 𝛽q "

ÿ 𝑥PF 16 2 p´1q 𝛽¨𝑆p𝑥q`𝛼¨𝑥 .
The linearity of 𝑆 is the highest magnitude taken by its Walsh transform.

Definition 10.8 (Differential Uniformity). The differential uniformity of an S-Box 𝑆 is defined as the largest number of solutions 𝑥 to the equation: 𝑆p𝑥 ' 𝛼q ' 𝑆p𝑥q " 𝛽, 𝛼, 𝛽 P F 16 2 , 𝛽 ‰ 0 .

A standard requirement of cryptographic designs is to lower at best the linearity and differential uniformity of their subcomponents, in order to resist linear and differential cryptanalysis. This constrains the design of the Super S-Box in Saturnin.

The two S-Boxes 𝜎 0 and 𝜎 1 , which apply to the nibbles with an even index and with an odd index respectively, are the composition of the same S-Box 𝜎, followed by two different permutations of the output bits given in Table 10.2.

Choice of 𝜎.

The 4-bit S-Box 𝜎 has been chosen among the 4-bit S-Boxes with optimal cryptographic parameters, i.e., in one of the equivalence classes named optimal in the classification established by Leander and Poschmann [START_REF] Leander | On the Classification of 4 Bit S-Boxes[END_REF]. These S-Boxes are those with differential uniformity 4 and linearity 8. Moreover, we chose for 𝜎 an S-Box minimizing the number of operations in the bitslice implementation, both for 𝜎 and 𝜎 ´1 in order to compute efficiently the inverse cipher for decryption with Saturnin-Short.

Design of S 16 . The MDS matrix 𝑀 has the property of mapping the subspace of F 4 2 4 defined by tp𝑥, 𝑥, 0, 0q, 𝑥 P F 2 4 u onto the subspace tp𝑦, 𝑦, 0, 𝑦q, 𝑦 P F 2 4 u. This implies that, if the nonlinear layer in S 16 uses four copies of the same S-Box 𝜎, then S 16 transforms the affine subspace of dimension 4 tp𝑥, 𝑥, 𝜎 ´1p0q, 𝜎 ´1p0qq, 𝑥 P F 2 4 u into the affine subspace tp𝑦, 𝑦, 𝜎p0q, 𝑦q, 𝑦 P F 2 4 u. The propagation of this simple 4-dimensional subspace is a strong property that could be cryptanalytically exploited. Furthermore, if we base the Super S-Box S 16 only on the single 𝜎, we obtain a linearity equal to 2 12 " 4096, which is higher than what we could achieve. Thus, we use the two different S-Boxes 𝜎 0 , applied to the nibbles with an even index, and 𝜎 1 , applied to the nibbles with an odd index. We define both from 𝜎 using a pair of bit permutations p𝜋 0 , 𝜋 1 q of the four output bits. p𝜋 0 , 𝜋 1 q were chosen among all possible pairs as to minimize the differential uniformity (80) and linearity (3072) of the corresponding S 16 .

Key Schedule and Round Constants

In the Super S-Box representation of Saturnin, the key schedule corresponds to shifting the supernibbles by 5 positions (with the standard AES byte numbering). This increases the resistance of Saturnin against related-key attacks. A detailed analysis is given in [START_REF] Canteaut | Saturnin. Submission to NIST-LWC (2nd Round)[END_REF].

As for the round constants, there are 2 9 possible seeds. They generate 2 9 sequences of values of RC 0 , RC 1 . Between any pair of such sequences, seen as two pairs of 512-bit words p𝑥, 𝑦q, p𝑥 1 , 𝑦 1 q, there does not exist 𝑡 0 ă 496 such that @𝑡 ě 0, 𝑥 𝑡 " 𝑥 1 𝑡`𝑡 0 and 𝑦 𝑡 " 𝑦 1 𝑡`𝑡 0 . In other words, the states of the LFSRs between position 0 in the first sequence and position 𝑡 0 in the second cannot collide.

Security of the Block Cipher

As explained in Section 10.4.1, the structure of the Saturnin block cipher is very similar to the structure of an AES operating on 16-bit words, replacing the AES S-Box by the Saturnin Super S-Box. Saturnin then benefits from the 20-year cryptanalytic effort against the AES and from the quantum security analysis done in Chapter 9. For most attacks, a super-round in Saturnin offers a resistance similar to a single round in AES-128 (relatively to the different block sizes).

As AES-128 has 10 rounds, and still benefits from a 3-round security margin, 10 superrounds (i.e., 20 rounds) seem to be a natural choice. In [START_REF] Canteaut | Saturnin. Submission to NIST-LWC (2nd Round)[END_REF], we give a key-recovery attack attack on 7.5 Saturnin super-rounds, slightly more than the AES, using the simplified key-schedule of Saturnin. This leaves currently a 2.5-super-round security margin. 8 super-rounds might be reachable by exploiting further the key-schedule, but we shall leave this as an open question.

We did not perform related-key attacks, but the available literature on the related-key cryptanalysis of the AES (including full AES-256) motivates us to choose more super rounds when related-key security is necessary. of subspace trails: two linear subspaces 𝑈 and 𝑉 of states such that the image by the round function of any coset of 𝑈 is included in a coset of 𝑉 . Such subspace trails occur for two rounds of AES. A limitation on the existence of such trails was given in [START_REF] Leander | Searching for Subspace Trails and Truncated Differentials[END_REF]: if the S-Box does not have a linear structure (which is the case of Saturnin's Super S-Box), then subspace trails are the direct product of subspace trails of the single S-Box, i.e., the trivial t0u or F 16 2 . Thus Saturnin behaves exactly as the AES with respect to subspace trails, and a distinguisher based on this property cannot reach more than five super-rounds.

Security of the Block Cipher Against Quantum Attacks

Quantum exhaustive search of the key requires approximately 2 256{2 " 2 128 iterations, each of which calls a quantum embedding of Saturnin. A quantum circuit for Saturnin may cost likely less than the AES, since the AES S-Box, its most costly quantum component, has been replaced by 4-bit S-Boxes only (see Section 9.2).

The analysis of the AES done in Chapter 9 can be transferred to Saturnin. In particular, a quantum version of the AES-128 Square attack can target up to 6 superrounds of Saturnin in the Q1 setting. Counting the time spent in Super S-Boxes instead of AES S-Boxes, we take the square of the numbers in Table 9.6. Proposition 10.6. There exists a quantum algorithm that retrieves the key of a secretkey oracle for Saturnin with 6 super-rounds, using approximately 2 35 classical chosenplaintext queries, 2 89 Super S-Boxes, 2 50 QRAQM registers of 256 bits, 2 72 classical registers of 256 bits.

Without QRAQM, the quantum version of the Square attack cannot use the partial sums technique, and it reaches a higher time than the classical version. Thus, with these preliminary results: ' with or without QRAQM, the highest number of super-rounds broken in the quantum setting (with a complexity lower than 2 128 quantum circuits for Saturnin) is 6; ' without QRAQM, the best quantum attack is the classical 6-round Square attack with partial sums of [START_REF] Ferguson | Improved Cryptanalysis of Rijndael[END_REF]; ' these results are unchanged if Q2 queries are allowed.

The DS-MITM attack on 8-round AES-256 cannot apply to Saturnin, as it relies heavily on the difference between key and state size. Reaching more than 6 super-rounds is yet an open problem, similar to attacking more than 6 AES-128 rounds in the quantum setting.

Discussion

Improving the classical and quantum key-recovery attacks is an interesting open question, with ties to the security analysis of AES. Saturnin with 8 super-rounds seems an interesting target for impossible differential attacks, while 6.5-super-round Saturnin may be the next target of quantum key-recoveries.

Open Problem 10.1. Design a classical key-recovery on more than 7.5 super-rounds, or a quantum key-recovery on more than 6 rounds.

Before the start of the NIST LWC process, we had tried to include in Saturnin an AEAD mode of rate one, that is, with on average a single block cipher call per message block. Indeed, in Saturnin-CTR-Cascade, the CTR mode requires an encryption per message block, and the Cascade another encryption for each ciphertext block. More modern modes based on block ciphers, such as OCB3 [START_REF] Krovetz | The Software Performance of Authenticated Encryption Modes[END_REF], have rate one. OCB3 is proven secure in the classical world if it uses a strong PRP, but it admits a Q2 key-recovery attack based on Simon's algorithm. The suitable security definition to use is not even completely clear. Indeed, IND-qCPA and BU are respectively defined with encryption or MACs in mind, not the combination of both.

At the time of writing8 , our work on this topic has significantly moved on. The submitted paper [Bha+20] defines QCB, a rate-one authenticated encryption with associated data. It follows the TAE [LRW02; LRW11] and ΘCB [KR11; Rog04] paradigms. It is based on a tweakable block cipher (TBC), a construction that defines a family of independent block ciphers indexed by a tweak. In order to use QCB with Saturnin, we define a TBC from Saturnin 16 by XORing the tweak to the key. This is the only known construction giving us, with a rate one, the quantum security expected in QCB. Consequently, the security of Saturnin-QCB relies on the related-key security of Saturnin 16 .

In order to encourage third-party analysis of Saturnin 16 in the related-key setting, and to gain a better understanding of its security margin, a challenge9 has been launched in December 2020.

Conclusion and Perspectives

Since the dawn of Q2 quantum attacks, the field of symmetric quantum cryptanalysis has seen many surprises, and several conjectural thoughts or beliefs about quantum attacks10 have been undermined by further results. At the same time, the quantum Eve is not an all-powerful attacker, and our understanding of her limits is constantly improving. I11 will conclude this document by recalling some of the results obtained and pointing out some open problems and promising research directions. At the time of writing, I am involved in several projects that investigate some of these questions.

New "offline" attacks. In Chapter 7, we saw that a quantum attacker in the Q1 model (classical queries) could exploit the algebraic structure of some symmetric primitives, in order to reduce an exponential memory requirement to polynomial. While the classical attack consists in solving a more generic problem (a multi-target preimage search), we introduced the dedicated offline Simon's algorithm that replaces the classical memory with a compressed quantum state.

The idea that underlies the offline Simon's algorithm could be applied in more settings. There are two interesting directions to follow: the first one would be to study quantum algorithms with a rather small query complexity, so that the few superposition queries that they make can be emulated by classical queries only. Another direction would be to look at classical algorithms using structured memories, or memories in which a hidden structure is embedded. It may then be possible to compress these memories in such a way that a quantum algorithm may detect this structure, while using only a few qubits of memory.

We have briefly mentioned in Section 3.4.2 that there exists breaks of some publickey schemes in the superposition query model (for example LWE [START_REF] Grilo | Learning-with-errors problem is easy with quantum samples[END_REF]). Although these breaks are not considered meaningful, they may reveal a structure that could be exploited, as we did with Simon's algorithm, in order to devise an improved quantum time-memory trade-off.

We have mentioned in Chapter 7 that Kuperberg's algorithm could be performed in a reversible way and combined with Grover's exhaustive search. However, no more precise analysis has been done yet. We are currently working on the offline Kuperberg's algorithm and its applications.

Merging and memory. In Chapter 5 and Chapter 6, we showed that quantum merging algorithms, apart from reaching generic speedups and the best quantum time complexities known for generalized birthday algorithms, benefited from some degrees of freedom that have no consequence on the classical time complexity.

In some generalized birthday algorithms, we have seen how to switch between quantum memory models, replacing more powerful quantum memories by less powerful ones. This replacement leaves us on the same time-memory trade-off curve, but it is only applicable for some portion of the curve, degrading the time complexity when memory is unbounded.

There is currently no generic principle or impossibility result dictating the replacement, say, of QRAQM by QRACM, or of QRAQM by plain quantum circuits. Quantum cryptanalysis would certainly benefit of further investigation of these trade-offs, since they may bring us towards more realizable quantum algorithms.

Improving our quantum toolbox. During this thesis, we have used and combined several quantum tools: quantum search, Abelian and Boolean hidden shift algorithms, quantum walks based on the MNRS framework. Adapting quantum search to our use cases (Chapter 2) has been easy. Simon's algorithm is well understood, and the family of Abelian hidden shift algorithms that originated with Kuperberg's work has benefited from a non-asymptotic study in several recent works (including [BS20]). However, some shadowy areas remain. In particular, some cryptanalytic applications of the MNRS quantum walk framework have been accompanied by an ad hoc conjecture which was first discussed in [START_REF] Helm | Subset Sum Quantumly in 1.17 𝑛[END_REF], in the context of subset-sum algorithms.

In our work on the subset-sum problem [Bon+20], we tried to overcome this conjecture using modified quantum data structures, but this led to a split between a conjectured time complexity and a non-conjectured one. I believe that a more general study is required to remove this conjecture, which would make quantum walks more flexible and easier to use in cryptanalytic algorithms, and we are working on the case of subset-sums. Q2 attacks. In the Q2 setting, a quantum adversary is allowed to query keyed primitives in superposition over their inputs, as black boxes in her quantum computations. This is a very powerful model. But so far, Q2 attacks have remained very limited. In our analysis of AES of Chapter 9, all the interesting attacks that we obtained used classical queries only, and using superposition queries could not allow better attacks. As shown in Chapter 4, known Q2 breaks are only based on a direct application of Simon's and Kuperberg's algorithms, sometimes in combination with an exhaustive search as in Leander and May's attack. Some quantum linear and differential attacks of [START_REF] Kaplan | Quantum Differential and Linear Cryptanalysis[END_REF] are of type Q2, but they do not lead to more than quadratic speedups. Other quantum attacks include the distinguishers based on Deutsch-Jozsa's algorithm (the distinguisher on the one-time pad of Section 4.1.7 and its application to modes of operation), but this is a weaker attack model, as it does not recover a key or allow a classical forgery.

There are two possible ways to interpret this situation: either Q2 attacks are actually rare, and rapidly vanish if we use ciphers without strong structures; or we lack dedicated Q2 cryptanalysis. I believe this question to be one of the most interesting, and perhaps the most challenging, in quantum cryptanalysis. Dedicated cryptanalysis. In Chapter 9, we performed one of the first studies of dedicated quantum attacks on a block cipher, namely the standard AES. In this setting, the quantum attacks corresponding to classical design patterns seem to perform relatively worse compared to exhaustive search. However, the quantum collision attacks of [START_REF] Hosoyamada | Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound[END_REF] have shown that the converse can occur. They are the first example of a reduced security margin in the Q1 setting, since the less than quadratic speedup for generic quantum collision search favors quantum dedicated attacks based on quantum search components. We have encountered this situation in Chapter 8 in the cryptanalysis of Gimli. Many hash functions will certainly be attacked in the future, and this area of research will certainly help us expand our quantum cryptanalysis toolbox. I will start to work on this topic in a few months.

Better quantum-safe symmetric cryptography. In Chapter 10, we defined the new block cipher Saturnin and its associated modes of operation. As symmetric cryptosystems become lighter and lighter, the goal of Saturnin is to show that postquantum security is not orthogonal to lightness, but complementary, and that tomorrow's authenticated ciphers may have the best of both worlds.

In the design of Saturnin, we wanted to use a block cipher-based AEAD with quantum indistinguishability and unforgeability guarantees. However, the constructions available from the literature allowed us only to define an authenticated cipher of rate two (Saturnin-CTR-Cascade), with two block cipher calls per message block processed. Since then, we have been able to define a rate-one parallelizable authenticated cipher, QCB [Bha+20]. It relies on a quantum-secure tweakable block cipher (TBC). In the classical setting, there exists a rate-one construction of a TBC from a block cipher secure as a pseudorandom permutation (PRP). In the quantum setting, we currently need a stronger security assumption on the cipher, namely its related-key security. Whether a quantum-secure rate-one AE can be built from a qPRP only remains an open question.

Figure 1 :

 1 Figure 1: Illustration of "Mosca's theorem".

  CNOT and Toffoli gates.

Definition 1. 7 (

 7 Quantum oracles). Let 𝑓 : t0, 1u 𝑛 Ñ t0, 1u 𝑚 . The standard oracle SO 𝑓 and the phase oracle PO 𝑓 act on 𝑛 `𝑚 qubits as: SO 𝑓 |𝑥y |𝑦y Þ Ñ |𝑥y |𝑦 ' 𝑓 p𝑥qy and PO 𝑓 |𝑥y |𝑦y Þ Ñ p´1q 𝑓 p𝑥q¨𝑦 |𝑥y |𝑦y .

  Uncomputing a quantum circuit while keeping its result.

  |𝑥y |0y Þ Ñ |𝑥y |𝑓 p𝑥qy Þ Ñ |𝑥 ' 𝑓 ´1p𝑓 p𝑥qqy |𝑓 p𝑥qy " |0y |𝑓 p𝑥qy .

  |𝑎y |𝑏y |𝑐y Þ Ñ |𝑎y |𝑏y |p𝑐 ' p𝑎 ^𝑏q ' pā ^𝑏qy " |𝑎y |𝑏y |𝑐 ' 𝑏y , and if there are two: |𝑎y |𝑏y |𝑐y Þ Ñ |𝑎y |𝑏y |p𝑐 ' p𝑎 ^𝑏q ' pā ^bqy " |𝑎y |𝑏y |𝑐 ' 𝑎 ' 𝑏y .

Figure 1 . 1 :

 11 Figure 1.1: State of a bucket-brigade qRAM with 8 registers and 7 switches, after reading the address 011 (0 = left, 1 = right).

Algorithm 2. 1

 1 Implementation of Sample 𝐺 1: repeat 2:

Lemma 2. 5 .

 5 Let 𝜃 " arcsin b |𝐺| |𝑋| , then:

Figure 2 . 2 :

 22 Figure 2.2: Illustration of Pollard's rho

Figure 3 . 2 :

 32 Figure 3.2: Example of Sponge with two output blocks.

  Contents 4.1 Q2 Attacks on Symmetric Constructions . . . . . . . . . . . . . . . 63 4.1.1 Distinguishers on the Luby-Rackoff Constructions . . . . . . 63 4.1.2 The Even-Mansour Cipher . . . . . . . . . . . . . . . . . . . 65 4.1.3 Attacks on MACs . . . . . . . . . . . . . . . . . . . . . . . . 65 4.1.4 Quantum Slide Attacks . . . . . . . . . . . . . . . . . . . . 66 4.1.5 The Grover-meets-Simon Attack . . . . . . . . . . . . . . . 67 4.1.6 Attacks with Modular Additions . . . . . . . . . . . . . . . 69 4.1.7 Distinguisher on the One-Time Pad . . . . . . . . . . . . . . 70 4.2 Q1 Attacks on Symmetric Constructions . . . . . . . . . . . . . . . . 71 4.2.1 Q1 Attack on Even-Mansour . . . . . . . . . . . . . . . . . 72 4.2.2 Quantum Collision Attacks more Efficient than Classical . . 73 4.2.3 Other Methods . . . . . . . . . . . . . . . . . . . . . . . . . 73

Figure 4 . 2 :

 42 Figure 4.2: The Even-Mansour construction.

Figure 4 . 3 :

 43 Figure 4.3: CBC-MAC with two blocks 𝛼 𝑏 ‖ 𝑥 and two keys 𝑘, 𝑘 1 , producing a tag 𝜏 .

Figure 4 . 4 :Figure 4 . 5 :

 4445 Figure 4.4: Illustration of the basic slide property.

FXp𝑥q"Figure 4 . 6 :

 46 Figure 4.6: The FX construction. A thick line represents the input of the key.

Contents 5 . 1

 51 Quantum Collision and Multi-Target Preimages without QRACM . 76 5.1.1 Quantum Collision Search . . . . . . . . . . . . . . . . . . . 76 5.1.2 Quantum Multi-Target Preimage Search . . . . . . . . . . . 78 5.1.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 5.2 Classical Merging Algorithms . . . . . . . . . . . . . . . . . . . . . . 80 5.2.1 k-XOR Problems . . . . . . . . . . . . . . . . . . . . . . . . . 81 5.2.2 Classical Merging . . . . . . . . . . . . . . . . . . . . . . . . 82 5.2.3 Wagner's Algorithm . . . . . . . . . . . . . . . . . . . . . . 85 5.2.4 Wagner's Binary Tree in a Breadth-first Order . . . . . . . 87 5.2.5 Towards Quantum Merging . . . . . . . . . . . . . . . . . . 88 5.3 Merging Trees for the k-XOR Problem . . . . . . . . . . . . . . . . 89 5.3.1 Examples of Quantum Merging . . . . . . . . . . . . . . . . 89 5.3.2 Definition of Merging Trees . . . . . . . . . . . . . . . . . . . 91 5.3.3 From Trees to Algorithms . . . . . . . . . . . . . . . . . . . 93 5.3.4 Finding Optimal Trees . . . . . . . . . . . . . . . . . . . . . 95 5.3.5 Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 75 5.4 Optimal Merging Trees for k-XOR . . . . . . . . . . . . . . . . . . . 97 5.4.1 Description of the Optimal Trees . . . . . . . . . . . . . . . 97 5.4.2 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 5.4.3 Proof of Optimality in the QRACM Setting . . . . . . . . . . 101 5.4.4 Proof of Optimality in the Circuit Model . . . . . . . . . . . 103 5.5 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 5.5.1 Generalized Birthday Instances . . . . . . . . . . . . . . . . 105 5.5.2 Approximate k-list Problem . . . . . . . . . . . . . . . . . . 106 5.5.3 Open Questions . . . . . . . . . . . . . . . . . . . . . . . . . 107

Algorithm 5. 1 ℒ

 1 Quantum collision search without QRACM. Input: query access to 𝑂 ℎ , memory bound 𝐿 ď 2 𝑛{5 Output: a collision of ℎ 1: Initialize an empty list ℒ of size 𝐿 2: Select a prefix 𝑢 of length 2 log 2 𝐿 3: Repeat 𝐿 times 4: Sample 𝑦 P t0, 1u 𝑛 such that 5: 𝑦 P 𝑆 𝑢 (ℎp𝑦q has the right prefix) Ð ℒ Y tp𝑦, ℎp𝑦qqu 8: EndRepeat 9: If ℒ contains a collision, return it 10: Sample 𝑥 P 𝑆 𝑢 such that 11: D𝑦 ‰ 𝑥, p𝑦, ℎp𝑥qq P ℒ 12: EndSample return 𝑥, 𝑦

Proposition 5. 1 .

 1 The classical query complexity of 𝑘-XOR (Problem 5.1 or Problem 5.2) is Ωp2 𝑛{𝑘 q.

Figure 5 . 1 :

 51 Figure 5.1: Structure of Wagner's 4-XOR tree.

Figure 5 . 2 :

 52 Figure 5.2: Building the 4-XOR tree of Figure 5.1 in a breadth-first (above) or depthfirst manner (below). The new nodes are put in bold. Between two steps, only the lists in bold are stored. Dotted lists are either discarded at this step, or do not need to be stored at all.

Figure 5 . 4 :

 54 Figure 5.4: Quantum 3-XOR merging strategy (with QRACM).

Figure 5 . 7 :

 57 Figure 5.7: Optimal merging tree for 6-XOR, with QRACM.

Figure 5 . 8 :

 58 Figure 5.8: Optimal 𝑘-XOR merging trees in the circuit model for 𝑘 " 2, 3, 5 and 7.

Figure 5 . 10 :

 510 Figure 5.10: Optimal merging tree for 6-XOR (circuit model).

  Problem 5.5. Does there exist a quantum algorithm for the 𝑘-SUM problem with unbounded 𝑘, with a significant speedup over Wagner's algorithm?

Figure 6 . 1 :

 61 Figure 6.1: Structure of Schroeppel and Shamir's merging tree.

  Element distinctness. In[START_REF] Buhrman | Quantum Algorithms for Element Distinctness[END_REF], Buhrman et al. give an algorithm running in time 𝒪 `23𝑛{8 ˘, with memory (QRAQM) 𝒪 `2𝑛{4 ˘. This algorithm is simply based on quantum search and can be reframed as a 2-list merging algorithm with a repeating loop. Algorithm 6.3 Element distinctness (unique 2-XOR) algorithm ofBuhrman et al.

  if this gives a complete 𝑘-XOR to zero then 12: return the solution 13:

Figure 6 . 4 :

 64 Figure 6.4: Extended merging tree for Algorithm 6.7.

  intermediate merge and the quantum search are nicely balanced, and a time complexity of 𝒪 `20.3𝑛 ˘is reached. Algorithm 6.8 Quantum algorithm for the unique 5-XOR problem, with or without oracle access.

  EndSamplemeaning that a memory of size 𝑀 costs 𝑀 classically controlled operations at each time step.

  Two iterations of Grover-meet-Simon, with the internal cancellation of 𝑂 𝑔

Figure 7 . 4 :Figure 7 . 5 :

 7475 Figure 7.4: Two-block Chaskey example.

Figure 8 . 1 :

 81 Figure 8.1: Round 𝑖 of a generic LS-design.

  Figure 8.2:Step 𝑖 of a generic mLS-design, with two rounds. Note that in Shadow, the L-Box is applied to two rows instead of a single one.

3 :

 3 Apply L 1 to each pair of lines in the bundles

Figure 8 . 3 :

 83 Figure 8.3: Propagation of a 4-identical state through a Shadow-512 step (illustration of Proposition 8.1). We represent only partially the bundles, in order to focus on equal columns. Two columns with the same color (except white) contain equal values.

Figure 8 . 4 :

 84 Figure 8.4: A 5-step distinguisher against Shadow-512.

Figure 8 . 5 :

 85 Figure8.5: A 7-step distinguisher against Shadow-512. Gray boxes denote that, in addition to the constrained difference, both states in the pair are 3-identical.

Figure 8 . 7 :

 87 Figure 8.7: S1P mode in our attack. Π denotes the Shadow-512 permutation reduced to Steps 2 to 5 (included).

Figure 8 . 8 :

 88 Figure 8.8: 4-Step path of Lemma 8.4.

Algorithm 8. 7

 7 The full Gimli permutation. Input: State 𝑆 " 𝐴, 𝐵, 𝐶, 𝐷 Output: Gimlip𝑆q 1: for 𝑟 " 24 downto 1 inclusive do 2: 𝐴, 𝐵, 𝐶, 𝐷 Ð 𝑆𝑃 p𝐴q, 𝑆𝑃 p𝐵q, 𝑆𝑃 p𝐶q, 𝑆𝑃 p𝐷q Ź SP-Box layer 3:

Figure 8 . 9 :Figure 8 . 10 :

 89810 Figure 8.9: Our representation of Gimli rounds (here Gimlip24, 20q). Each wire represents a word.

Contents 9 .

 9 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 9.1.1 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 9.1.2 Description of AES . . . . . . . . . . . . . . . . . . . . . . . 203 9.2 Exhaustive Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 9.2.1 Full-Round AES Key Search . . . . . . . . . . . . . . . . . . 205 9.2.2 Resource Estimates for Reduced-round AES . . . . . . . . . 207 9.3 Discussion on Quantum Attacks . . . . . . . . . . . . . . . . . . . . 208 9.3.1 Impossible Differential Attacks . . . . . . . . . . . . . . . . 208 201

Figure 9 . 1 :

 91 Figure 9.1: AES byte ordering.

Figure 9 . 2 :

 92 Figure 9.2: AES-256 key schedule [Jea16].

  Out-of-place circuit for the S-Box.

Figure 9 . 3 :

 93 Figure 9.3: Integral distinguisher on 3 rounds of AES. A byte marked by 0 is balanced.

  Circuit that computes a solution of a differential equation on the AES S-Box.

  ˆ4 ˆ4 cube of 4-bit nibbles. The boundaries between the nibbles are in gray.As sixteen 16-bit registers. The indices and boundaries of the registers are in black, those of the bits are in gray.

Figure 10 . 1 :

 101 Figure 10.1: The 3-dimensional and 2-dimensional representations of the 256-bit state of Saturnin. Nibbles and their corresponding bits are represented with the same color in each representation.

  7 ones 𝑅 4 . . . 𝑅 0 loooomoooon 𝑅 𝐷 3 . . . 𝐷 0 loooomoooon 𝐷 ,

𝜎 0 𝜎 1 Figure 10 . 2 :Figure 10 . 3 :Figure 10 . 4 :Figure 10 . 5 :

 1102103104105 Figure 10.2: Bitslice implementation of the S-Boxes.

Figure 10 . 6 :

 106 Figure 10.6: The application of the 4-bit S-Boxes (S) in the bitsliced representation. 𝜎 0 is represented by continuous blue arrows, 𝜎 1 by dashed brown ones.

Figure 10 . 7 :

 107 Figure 10.7: The SR slice operation that mixes the columns in each slice separately.

Figure 10 . 9 :

 109 Figure10.9: The parallel application of the 16 ˆ16 matrix 𝑀 , i.e., the operation MC.

Figure 10 . 10 :Figure 10 . 11 :Figure 10 . 12 :Figure 10 . 13 :

 1010101110121013 Figure 10.10: Saturnin-CTR encryption, where 𝐸 𝑖 denotes Saturnin with domain separator 𝑖. A thick line represents the input of the key.

Definition 10. 2 .

 2 The IND-CPA advantage of an adversary 𝒜 making 𝑞 queries to Encrypt 𝑘 is defined as:Adv IND´CPA p𝒜, 𝑞q "nd the IND-CPA advantage is the maximum over all adversaries making 𝑞 queries:Adv IND´CPA p𝑞q " max 𝒜 with 𝑞 queries

Definition 10. 3 (

 3 Strong qPRP advantage). Let 𝐸 𝑘 be a family of permutations of t0, 1u 𝑛 indexed by 𝑘 P 𝒦. The strong qPRP distinguishing advantage against 𝐸 𝑘 is:Adv 𝐸 𝑘sqPRP p𝑞, 𝒯 q " max 𝒜

qPRF distinguishers.

  Similarly to a qPRP, it is possible to define a quantum pseudorandom function (qPRF). Definition 10.5 (qPRF advantage). Let 𝐹 𝑘 be a family of functions from t0, 1u 𝑛 to t0, 1u 𝑚 , indexed by 𝑘 P 𝒦. The qPRF distinguishing advantage against 𝐹 𝑘 is:Adv 𝐹 𝑘 qPRP p𝑞, 𝒯 q " max 𝒜 ˇˇˇˇˇP r 𝑘 $ Ð Ý𝒦 ´𝒜𝑂 𝐹 𝑘 p𝑞q " 1 ¯´Pr 𝐺 $ Ð Ýtt0,1u 𝑛 Ñt0,1u 𝑚 u`𝒜𝑂 𝐺 p𝑞q " 1 ˘ˇˇˇˇˇ.

Proposition 10. 4 .

 4 if Saturnin 𝑘 is a PRP, then Saturnin 𝑘 -CTR is IND-qCPA: Adv Saturnin 𝑘 ´𝐶𝑇 𝑅 IND´qCPA p𝑞, 𝒯 q ď 2 ¨Adv Saturnin 𝑘 PRP p𝑞, 𝒯 q `𝑞2 2 257 .

  Saturnin´𝐶𝑇 𝑅 IND´CPA p𝑞, 𝒯 q ď 2 ¨Adv Saturnin PRP p𝑞, 𝒯 q `𝑞2 2 257 . (10.8)The result in the quantum setting follows by Proposition 10.1:Adv Saturnin´𝐶𝑇 𝑅 IND´qCPA p𝑞, 𝒯 q ď Adv Saturnin´𝐶𝑇 𝑅 IND´CPA p𝑞, 𝒯 q .

Figure 10 . 15 :

 1015 Figure 10.15: Quantum collision search with limited quantum memory: putting together the algorithms of Section 2.3 and Section 5.1 in a single (maybe non-tight) curve.

  𝑋 exhaustive search space 𝐺 "good" subspace 𝐺 Ď 𝑋 𝐵 "bad" subspace 𝐵 " 𝑋z𝐺 𝑓 test function (𝑓 : 𝑋 Ñ t0, 1u) 𝑋 |𝑓 subset of elements of 𝑋 that satisfy 𝑓 𝒜 classical or quantum algorithm T c p𝒜q average classical time complexity of 𝒜 T q p𝒜q quantum time complexity of 𝒜 M p𝒜q memory complexity (classical or quantum) of 𝒜 ℎ random 𝑛-bit to 𝑛-bit function 𝑢|˚bit-string starting with the prefix 𝑢 𝑘 number of lists to merge 𝜅 tlog 2 p𝑘qu ℒ 𝑖 a list of bit-strings (of exponential size) 𝐿 𝑖 size of ℒ 𝑖 ℓ 𝑖 1 𝑛 log 2 𝐿 𝑖 ℒ 1 ' 𝑢 ℒ 2 "join" operator 0 𝑚 zero bit-string of length 𝑚 𝒯 merging tree, subtree or root node 𝑇 𝑘 family of optimal trees for quantum merging Shadow 64-bit L-Box D Shadow diffusion layer RC 𝑖 round constant of step 𝑖 𝜎 0 , 𝜎 1 , 𝜎 2 , 𝜎 3 Shadow Super S-Boxes ARK AES AddRoundKey operation SB AES SubBytes operation SR AES ShiftRows operation MC AES MixColumns operation 𝑘, 𝑘 𝑖 master key, round key at round 𝑖 𝑆 AES 8-bit S-Box 𝑥 𝑖 , 𝑦 𝑖 , 𝑧 𝑖 , 𝑤 𝑖 AES state after ARK, SB, SR, MC 𝒟, ℳ time, data, memory used by the attacker RC 0 , RC 1 pair of Saturnin round constants S S-Box layer 𝜎 0 , 𝜎 1 Saturnin S-Boxes SR 𝑟 , SR slice , SR sheet nibble permutations MC Saturnin MixColumns S 16 super S-Box

	All chapters Chapter 2 Chapter 9
	' bitwise addition (XOR)
	`integer addition (modular addition)
		¨scalar product between vectors or bit-strings
		¨product (example: 𝑇 ¨𝑀 " 2 𝑛 )
		¨placeholder (example: 𝑓 p¨q)
		} concatenation of bit-strings
	𝛿 𝑖𝑗 Kronecker symbol
	|𝑋| cardinality of a set 𝑋
	𝑎 𝑛´1 . . . 𝑎 0	𝑏	integer written as 𝑎 𝑛´1 . . . 𝑎 0 in basis 𝑏
	Chapter 10		When 𝑏 " 2, this corresponds to big-endian (the most significant bit is written first)
	𝑥 negation of the Boolean 𝑥 𝐷 domain separator
	¨^¨Boolean AND 𝑅 number of super-rounds
	¨_ ¨Boolean OR 𝐸 𝑘 block cipher with a secret key 𝑘 Chapter 5 and Chapter 6 𝒯 ,
	Π permutation
	𝑓, 𝑔, ℎ functions
	AES Advanced Encryption Standard
	AEAD Authenticated encryption with associated data Chapter 1
	CCA Chosen-ciphertext attack ℋ finite-dimensional Hilbert space CPA chosen-plaintext attack x¨|¨y inner product in ℋ CSAM Classical memory with sequential access } ¨} inner norm in ℋ DES Data Encryption Standard |¨| modulus of a complex number DLP Discrete logarithm problem |𝑥y basis vector in ℋ (𝑥 is an integer or a bit-string) DS-MITM Demirci-Selçuk Meet-in-the-Middle LWC Lightweight cryptography (NIST project) x𝑥| linear form (basis vector in the dual space ℋ ˚) Chapter 8 |𝜑y b |𝜓y tensor product of states NISQ Noisy intermediate-scale quantum (devices) U unitary operator 0 ˚˚˚01 ˚˚truncated differential pattern NIST National Institute of Standards and Technology U : adjoint of U (uncomputation) 𝑆 Shadow 4-bit S-Box MAC Message authentication code PQC Post-quantum cryptography (NIST project) Q1 Quantum attacks with classical queries Q2 Quantum attacks with quantum queries QRACM Classical memory with quantum random-access U 1 b U 2 tensor product of operators H Hadamard gate H b𝑛 Hadamard transform X or NOT bitflip gate Z phaseflip gate L 1 𝑆 Gimli state QRAQM Quantum memory with quantum random-access T T-gate 𝐴, 𝐵, 𝐶, 𝐷 Gimli columns qRAM Quantum random-access memory CNOT CNOT gate 𝑥, 𝑦, 𝑧 32-bit words in a column RAM (Classical) random-access memory Tof Toffoli gate !, " shift left, shift right (32-bit words) RSA Rivest-Shamir-Adleman cryptosystem nTof 𝑛-qubit Toffoli gate ă ă ă, ą ą ą rotate left, rotate right (32-bit words) SPN Substitution-Permutation Network I identity gate or operator 𝑆𝑃 Gimli Substitution-Permutation function ZRR Zone à régime restrictif (Restricted Area) 𝑂 𝑓 standard or phase oracle for 𝑓 RC 𝑖 round constant of round 𝑖
			xxxi xxxii xxxiii

  Quantum Computations . . . . . . . . . . . . . . . . . . . . . . . . 3 1.2.1 Quantum Systems . . . . . . . . . . . . . . . . . . . . . . . 3 1.2.2 Quantum Circuits . . . . . . . . . . . . . . . . . . . . . . . 4 1.2.3 Quantum Algorithms . . . . . . . . . . . . . . . . . . . . . . 8 1.2.4 Quantum Complexity Notions . . . . . . . . . . . . . . . . . . 11 1.3 Quantum Memory Models . . . . . . . . . . . . . . . . . . . . . . . 12 1.3.1 Variants of qRAM . . . . . . . . . . . . . . . . . . . . . . . Membership Queries . . . . . . . . . . . . . . . . . . . . . . Simon's Problem . . . . . . . . . . . . . . . . . . . . . . . . 19 1.4.2 Description of the Algorithm . . . . . . . . . . . . . . . . . 20 1.4.3 Weakening the Promise . . . . . . . . . . . . . . . . . . . . 22 1.4.4 Simon's Algorithm as a Quantum Circuit . . . . . . . . . . 24

		12
	1.3.2 Quantum Data Structures using qRAM . . . . . . . . . . .	13
	1.3.3 Emulating qRAM Gates . . . . . . . . . . . . . . . . . . . .	14
	1.3.4

1.1 History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.2 15 1.3.5 Discussion and Comparisons . . . . . . . . . . . . . . . . . . 17 1.4 Simon's Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1 1.4.1

  The data at index 𝑖 is accessed and put into the output register 𝑦 (which is always quantum). Depending on whether the data in |𝑥 0 y , . . . , |𝑥 𝑁 ´1y, and the index register, are classical or not, we obtain the four models of Table1.1.

	Index (𝑖) Classical Superposition	|𝑥 0 y |𝑥 1 y . . . |𝑥 𝑁 ´1y |𝑖y |𝑦y Memory (𝑥 𝑗 ) |𝑦 ' 𝑥 Table 1.1: qRAM variants. qRAM |𝑥 0 y |𝑥 1 y . . . |𝑥 𝑁 ´1y |𝑖y Classical Superposition Classical RAM Quantum circuit model QRACM QRAQM

𝑖 y

Quantum Circuit 1.5: The qRAM gate.

  Proposition 1.3. Fix a universal set of 𝑐 gates of bounded arity 𝑟. Let 𝑅 𝑞,𝑁,𝑚 be the smallest number of quantum gates such that, for all lists ℒ of 𝑚-bit strings of size 𝑁 , there exists a circuit using 𝑞 qubits (including ancillas), with at most 𝑅 𝑞,𝑁,𝑚 gates computing Membership ℒ . Then 𝑅 𝑞,𝑁,𝑚 ě 𝑚𝑁 log 2 𝑐`𝑟 log 2 𝑞 . 𝑅 𝑞,𝑁,𝑚 gates, since at each new gate, we select its 𝑟 input qubits among 𝑞. There are 2 𝑚𝑁 different lists ℒ, which need different circuits. Hence:

	Proof. There are less than	ˆ𝑐 ˆ𝑞 𝑟	˙˙𝑅	such quantum circuits with less than 𝑅 "

  Classical Sampling . . . . . . . . . . . . . . . . . . . . . . . 28 2.1.2 Grover's Algorithm . . . . . . . . . . . . . . . . . . . . . . . 29 2.1.3 Discussion on the Algorithm . . . . . . . . . . . . . . . . . . . 31 2.1.4 Amplitude Amplification . . . . . . . . . . . . . . . . . . . . 32 2.1.5 Finding Many Solutions . . . . . . . . . . . . . . . . . . . . 34 2.1.6 Approximate Test Functions . . . . . . . . . . . . . . . . . . 35 2.2 Nested Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 2.2.1 Quantum Search as a Sampling Procedure . . . . . . . . . . 37 2.2.2 Nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.2.3 Quantum-Classical Correspondence . . . . . . . . . . . . . . 39 2.2.4 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 2.3 Collisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 2.3.1 Classical Algorithms . . . . . . . . . . . . . . . . . . . . . . 42 2.3.2 Quantum Collision Search . . . . . . . . . . . . . . . . . . . 43 2.3.3 Quantum Multicollision Search . . . . . . . . . . . . . . . . 45

Contents 2.1 Unordered Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 2.1.1

  𝑛 or 𝑛-bit integers. Hence, the test is a function 𝑓 : t0, 1u 𝑛 Ñ t0, 1u. Circuit 2.1) applies a first Hadamard transform H b𝑛 , after which the state is |𝑋y. Then it iterates the operator:𝒢 " H b𝑛 𝑂 0 H b𝑛 𝑂 𝑓 ,where 𝑂 0 is an "inversion around 0" which flips the phase of all basis vectors except |0y and 𝑂 𝑓 is the phase oracle for 𝑓 .After each iterate 𝒢, the current state remains a linear combination of |𝐺y and |𝐵y, and the angle increases by 2𝜃. Grover's iterate 𝒢 is a rotation of angle 2𝜃 in the plane spanned by |𝐺y and |𝐵y.Proof. We show that 𝒢 is a composition of two reflections in Span p|𝐺y , |𝐵yq. First, 𝑂 𝑓 is a reflection around |𝐵y, since it flips the phase of all good vectors:

	Algorithm description. Let |𝑋y "	ř	𝑥P𝑋 |𝑥y, |𝐺y "	ř 𝑥P𝐺 |𝑥y and |𝐵y "	ř 𝑥P𝐵 |𝑥y
	be the uniform superpositions over 𝑋, 𝐺 ("good" elements) and 𝐵 ("bad" elements).
	Grover's algorithm (|0y H |0y H |0y H |𝐺y 𝜃 Lemma 2.2. 𝑂 𝑓 H 𝑂 0 H 𝑂 𝑓 H H H H |𝜓y |𝑋y |𝐺y	H H H	𝑂 0 𝒢 |𝜓y	H H H	. . . . . . . . . |𝑋y |𝜓y
	𝜃	𝜃 𝜓 𝜃 𝜓	𝜃 𝜓	`𝜃	|𝐵y		𝜃	𝜃 𝜓	`𝜃	|𝐵y
				𝑂 𝑓 |𝜓y				𝑂 𝑓 |𝜓y

Quantum Circuit 2.1: Quantum circuit of Grover's algorithm. 𝜓 `𝜃 2𝜃 Figure 2.1: Rotation realized by 𝒢 in the plane Span p|𝐵y , |𝐺yq. The initial state is |𝜓y. Action of 𝒢. Grover's algorithm is usually presented with a geometrical point of view, as in Figure 2.1. The initial state can be written as: |𝑋y " sin 𝜃 |𝐺y `cos 𝜃 |𝐵y for 𝜃 " arcsin ˜d |𝐺| |𝑋| ¸. 𝑂 𝑓 " 2 |𝐵y x𝐵| ´I . Next, the operator H b𝑛 𝑂 0 H b𝑛 , which can be implemented using 𝒪p𝑛q quantum gates, realizes an inversion around the average. On input ř 𝑥P𝑋 𝛼 𝑥 |𝑥y, let 𝐴 " 1 2 𝑛 ř 𝛼 𝑥 be the average amplitude, then:

  What remains is to compute the number of iterates after which the current state will be closest to |𝐺y. We have:|𝜓 𝑡 y " sinpp2𝑡 `1q𝜃q |𝐺y `cospp2𝑡 `1q𝜃q |𝐵y , which means that we must choose 𝑡 such that cos 2 pp2𝑡 `1q𝜃q is at its smallest. If we iterate too much, we start moving away from |𝐺y, what is metaphorically called the soufflé property of Grover's algorithm (we say that the state is overcooked).

	Proof. With this choice of 𝑡, we have: 𝜋 4𝜃 ´1 ă 𝑡 ď 𝜋 4𝜃 hence 𝜋 2 ´𝜃 ă p2𝑡 `1q𝜃 ď 𝜋 2 `𝜃, hence |cospp2𝑡 `1q𝜃q| ď cos `𝜋 2 ´𝜃˘" sin 𝜃 " b |𝐺| |𝑋| .
	If we immediately measure the output state, then with probability at least 1 ´|𝐺| |𝑋| , we obtain an element of 𝐺. Conditioned on being in 𝐺, this element is sampled uniformly at
	random. In general, we have |𝐺| |𝑋| ! 1 and the approximation 𝜃 »	b	|𝐺| |𝑋| is valid. Hence,
	Grover's algorithm requires 𝒪 ´b |𝐺| |𝑋| ¯iterates for a constant (and often negligible)
	probability of error, offering a well-known square-root speedup on classical unordered
	search.
	Theorem 2.1. By choosing 𝑡 "	X 𝜋 4𝜃	\ , Grover's algorithm produces:
			a	p1 ´𝛼2 q |𝐺y `𝛼 |𝐵y ,
	where |𝛼| ď	b	|𝐺| |𝑋| .

. Let |𝜓 𝑡 y be the state after 𝑡 iterates. As we have seen: |𝜓 0 y " sin 𝜃 |𝐺y `cos 𝜃 |𝐵y , with 𝜃 " arcsin ´b |𝐺| |𝑋| ¯, and each iterate increases this angle by 2𝜃.

  Lemma 2.3. If 𝑓 is a random oracle, then any quantum algorithm that makes 𝑞 queries to 𝑂 𝑓 can only output 𝑥 P 𝐺 with probability 𝒪 ´𝑞2 |𝐺|

|𝑋|

¯.

  1 2 𝜖 . Quantum search QSearchp𝒜, 𝑓 q Input: 𝒜, 𝑓 1: Set ℓ " 0 and 𝑐 a constant such that 1 ă 𝑐 ă 2 Compute 𝒬 𝑗 𝒜 |0y where 𝒬 is the Amplitude Amplification iterate, measure and obtain 𝑧.

	Algorithm 2.2 2: repeat
	3:	ℓ Ð ℓ `1, 𝑀 Ð	P	𝑐 ℓ T
	5:	Pick 𝑗	$ Ð Ý r1; 𝑀 s
	6:

4:

Compute 𝒜 |0y, measure and obtain 𝑧. If 𝑓 p𝑧q " 1, return 𝑧 7: until 𝑓 p𝑧q " 1 return 𝑧 and stop Corollary 2.1. If 𝑎 " 0 or 𝑎 ě 𝑏, there is an algorithm QFindp𝒜, 𝑓, 𝑏q that returns a correct solution or K using an expected 𝒪 ´1 ? 𝑎 ¯number of iterations if 𝑎 ą 0 or 𝒪 ´1 ? 𝑏 ōtherwise.

  Theorem 2.6 (Amplitude amplification with approximate test). Let 𝒜, 𝑎, 𝜃 𝑎 , be as in Theorem 2.2 a quantum algorithm, its success probability and corresponding angle. Let

	𝑂 1

𝑓 be an approximate test of error 𝜖. On input |𝜓y b p𝒜 |0yq, run 𝑡 " Y 𝜋 4𝜃𝑎

  , 𝑓 1 could be evaluating if a key 𝑘 encrypts a given message 𝑚 1 to a given ciphertext 𝑐 1 , 𝑓 2 if 𝑚 2 encrypts to 𝑐 2 , and their combination would ensure that 𝑘 is the good key. A classical sampling Sample 𝑋| 𝑓 1 ^𝑓2 can be implemented in different ways.Depending on the cardinalities of 𝑋, 𝑋| 𝑓 1 , 𝑋| 𝑓 2 , and on the costs of 𝑓 1 and 𝑓 2 , a combination of samples might perform better than a mere exhaustive search in 𝑋.

	Algorithm 2.4 Direct implementation	Algorithm 2.5 Nested implementation
	of Sample 𝑋| 𝑓 1 ^𝑓2	of Sample 𝑋| 𝑓 1 ^𝑓2
	1: repeat	1: repeat
	2: 3: until 𝑓 1 ^𝑓2 p𝑥q 𝑥 Ð Sample 𝑋	2: 3: until 𝑓 2 p𝑥q 𝑥 Ð Sample 𝑋| 𝑓 1
	return 𝑥	return 𝑥
	Algorithm 2.4 has a complexity:

Algorithm 2.8 Example of Sample program

  . 𝑓 1 , 𝑓 2 , 𝑓 3 , 𝑓 4 are arbitrary functions, 𝑋 and 𝑍 are sets which can be sampled efficiently.

		Input: no input.
		Output: 𝑥 P 𝑋 such that 𝑓 2 p𝑥, 𝑓 1 p𝑥qq and D𝑧, 𝑓 3 p𝑥, 𝑧q ^𝑓4 p𝑥, 𝑓 1 p𝑥q, 𝑧q, or K if it
		doesn't exist.
	1: Sample 𝑥 P 𝑋 such that
		Ź Inside this block, the variable 𝑥 holds a fixed value
	2:	𝑦 Ð 𝑓 1 p𝑥q
	3:	if not 𝑓 2 p𝑥, 𝑦q then abort
	4:	Sample 𝑧 P 𝑍 such that
	5:	if not 𝑓 3 p𝑥, 𝑧q then abort
	6:	EndSample
		Ź Here 𝑧 holds a value such that 𝑓 3 p𝑥, 𝑧q, or K if there is none
	7:	if not 𝑓 4 p𝑥, 𝑦, 𝑧q then abort
	8: EndSample
		return 𝑥
	Problem 2.3 (Collision search). Given access to ℎ : t0, 1u 𝑛 Ñ t0, 1u

𝑛

, find a collision of ℎ: 𝑥 ‰ 𝑦 such that ℎp𝑥q " ℎp𝑦q.

  𝐿 bits. After making 𝐿 queries, the number of cells that contain an element is on average p1 ´𝑒´1 q𝐿, since we have drawn log 2 𝐿 bits a number of 𝐿 times, and this is a random mapping from log 2 𝐿 bits to log 2 𝐿 bits[START_REF] Flajolet | Random Mapping Statistics[END_REF].

	Algorithm 2.10 Brassard, Høyer, and Tapp's (BHT) quantum collision search
	algorithm.
	Input: quantum query access to ℎ : t0, 1u 𝑛 Ñ t0, 1u 𝑛 , a random function
	Output: a collision of ℎ
	1: Build a list ℒ of 𝐿 pairs p𝑥, ℎp𝑥qq for 𝐿 arbitrary values of 𝑥
	2: Use Grover's algorithm to find 𝑥 P t0, 1u 𝑛 such that D𝑦 ‰ 𝑥, p𝑦, ℎp𝑥qq P ℒ
	3: return 𝑥, 𝑦
	Theorem 2.8. Used with a memory of size 𝐿, Algorithm 2.10 outputs a collision using
	an expected number of 𝒪 ´𝐿 `b 2 𝑛 𝐿 ¯qRAM gates, queries and 𝑛-qubit register operations.
	Proof. We store ℒ in a simple unique prefix list (Section 1.3.2), i.e., QRACM memory
	cells where each element is indexed by a prefix of log 2

  Sample 𝑥 P t0, 1u 𝑛 such that Dp𝑡, 𝑦q P ℒ 𝑖´1 , ℎp𝑥q " 𝑦 and 𝑥 R 𝑡

	Algorithm 2.11 Quantum multicollision-finding algorithm (version of [Hos+19]).
	Taking 𝑟 " 2 gives Algorithm 2.10.
		Input: 𝑟, query access to 𝑂 ℎ
		Output: an 𝑟-collision of ℎ
	1: Choose wisely ℓ 1 , . . . , ℓ 𝑟 " 0 depending only on 𝑟
	2: 𝑖 Ð 1
	3: Initialize ℒ 1 Ð H
	4: repeat
	5:	Sample 𝑥 P t0, 1u 𝑛
	6:	Add pt𝑥u, ℎp𝑥qq to ℒ 1
	7: until ℒ 1 is of size 2 𝑛ℓ 1
	8: while 𝑖 ă 𝑟 do
	9:	𝑖 Ð 𝑖	`1
	10:	Initialize ℒ 𝑖 Ð H		Ź ℒ 𝑖 will contain 𝑖-collisions
	11:	repeat
	12:
	13:	Add 𝑡 Y t𝑥u, 𝑦 to ℒ 𝑖
	14:	until ℒ 𝑖 is of size 2 𝑛ℓ 𝑖
	15: return the single element in ℒ 𝑟
	Since the total complexity is (up to a constant):
		2 ℓ 1 𝑛 `2ℓ 2 𝑛 2 loooooomoooooon 1 2 p1´ℓ 1 q𝑛	`. . . `2ℓ 𝑖 𝑛 2 looooooomooooooon 1 2 p1´ℓ 𝑖´1 q𝑛	`. . .	2 p1´ℓ 𝑟´1 q𝑛 `2 1 looooomooooon
			Creating ℒ 2	Creating ℒ 𝑖	Finding the
					𝑟-collision
					˙.

  3.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . In his account of the Gallic wars [Cae69, Book 5, Chapter 48], Caesar records using another trick to send a letter to the surrounded camp of his general Cicero.

	cipher). Tum cuidam ex equitibus Gallis magnis praemiis persuadet uti ad
	Ciceronem epistolam deferat. Hanc Graecis conscriptam litteris mittit, ne
	intercepta epistola nostra ab hostibus consilia cognoscantur. Si adire non
	possit, monet ut tragulam cum epistola ad amentum deligata intra munitionem
	castrorum abiciat.
		47
	3.1.1 Symmetric Cryptography and its Security . . . . . . . . . .	49
	3.1.2 Asymmetric Cryptography and Hard Problems . . . . . . .	50
	3.2 Post-Quantum Cryptography . . . . . . . . . . . . . . . . . . . . . . . 51
	3.3 Lighweight Cryptography . . . . . . . . . . . . . . . . . . . . . . . .	53
	3.4 Symmetric Primitives . . . . . . . . . . . . . . . . . . . . . . . . . .	54
	3.4.1 Primitives . . . . . . . . . . . . . . . . . . . . . . . . . . . .	54
	3.4.2 Attack Settings . . . . . . . . . . . . . . . . . . . . . . . . .	58
	3.4.3 Summary of Main Generic Attacks . . . . . . . . . . . . . .	59
	3.5 Preliminaries of Cryptanalysis . . . . . . . . . . . . . . . . . . . . .	60
	3.5.1 Differential Cryptanalysis . . . . . . . . . . . . . . . . . . .	60
	3.5.2 Distinguishers on Permutations . . . . . . . . . . . . . . . . . 61
	3.5.3 Limited-birthday Distinguishers . . . . . . . . . . . . . . . . . 61
	3.1 Overview
	Cryptography is the science of protecting information, transmitted by insecure
	means, against adversaries which are either passively listening to the communications
	(eavesdroppers) or actively tampering with them. Its history dates back as early as the
	antiquity. One of the most prominent adopters of cryptographic techniques is certainly
	Julius Caesar. The roman historian Suetonius reports that he encrypted secret messages
	by shifting the letters by three positions in the Latin alphabet (the well-known Caesar
	47

Figure 3.1: Landscape of symmetric attacks. 3.1.2 Asymmetric Cryptography and Hard Problems

  .1 summarizes these distinctions. Diffie-Hellman key-exchange between Alice and Bob. 1: Setup: Alice and Bob select an Abelian group, e.g., Z 𝑝 for a prime 𝑝, and a random generator 𝑔 of Z Alice sends 𝑔 𝑎 ; Bob sends 𝑔 𝑏 5: Both Alice and Bob compute: p𝑔 𝑎 q 𝑏 " p𝑔 𝑏 q 𝑎 Let 𝑔 be a generator of Z p . On input 𝑔 𝑎 , where 𝑎 is chosen uniformly at random, compute 𝑎.

	Algorithm 3.1 p
	2: Alice does: 𝑎	$ Ð Ý Z p
	3: Bob does: 𝑏	$ Ð Ý Z
	Security notions. The security of public-key schemes follows a slightly different
	approach from symmetric schemes. In public-key cryptography, the cryptosystem's
	security is reduced to one or more hard problems, believed to be intractable. Many of
	these problems are not proven to be NP-complete, and admit better algorithms than
	Constructions, modes of operation simple exhaustive search. For example, the Discrete Logarithm Problem (DLP) in Z 𝑝 Generic attacks Chapters 4 and 7 (and so, a hard problem behind the Diffie-Hellman key-exchange in Z 𝑝 ) is solved in Have subexponential time with index calculus methods. Ex.: key-recovery on the Ex.: GCM Even-Mansour cipher Problem 3.1 (Discrete Logarithm Problem).
			Fit in
	Ideal Ex.: Ideal cipher primitives	Have	Generic bounds search Ex.: exhaustive key Section 3.4
			Materialized by
	Real primitives Ex.: AES	Have	Security margin	Determined by	Dedicated attacks Chapters 8 and 9 attacks on AES Ex.: reduced-round
	Introduced by Diffie and Hellman in a seminal work [DH76], asymmetric (or public-key)
	cryptography considers a setting where Alice and Bob do not have any pre-established
	secret. Still, they want to communicate securely. Diffie and Hellman proposed to use a
	public-key cryptosystem, in which the encryption key 𝐾 𝑒 is different from the decryption
	key 𝐾 𝑑 . Further, they introduced the Diffie-Hellman key exchange (Algorithm 3.1).
	Later on the RSA cryptosystem, based on the hardness of integer factorization, was
	designed by Rivest, Shamir and Adleman [RSA78]. It became the most widely used
	public-key scheme.

p 4:

Table 3 . 1 :

 31 Main classical and quantum generic attacks on block ciphers, hash functions and MACs. Polynomial factors are omitted from the time complexity.

	Primitive	Attacks	Time	Data	Memory
			Classical
	Block cipher 𝑛 block size 𝑚 key size	Key-recovery 2 𝑚 2 𝑡 -user key-recov 2 𝑚´𝑡	P 𝑚 𝑛 P 𝑚 𝑛	T T	KP 2 𝑡 KP	P 𝑚 𝑛 P 𝑚 𝑛	T T	2 𝑡 RAM
	Hash function 𝑛 output size	Collision 2 𝑛{2 Preimage 2 𝑛 2 𝑡 -target preimage 2 𝑛´𝑡	None None None	polyp𝑛q 𝑛 𝑛2 𝑡 RAM
	MAC	Forgery	2 𝑡	2 𝑡 verif. queries 𝑡
	𝑡, 𝑚	Key-recovery 2 𝑚	P 𝑚 𝑡	T	KP	𝑡 P 𝑚	T
			Quantum
	Block cipher	Key-recovery 2 𝑚{2 2 𝑡 -user key-recov 2 p𝑚´𝑡q{2 P 𝑚 P 𝑚 𝑛 𝑛	T T	KP (Q1) 2 𝑡 KP (Q1)	P 𝑚 𝑛 P 𝑚 𝑛	T T	2 𝑡 QRACM
		Collision 2 𝑛{2´𝐿{2 None	𝑛2 𝐿 QRACM
	Hash function	Preimage 2 𝑛{2	None	𝑛
		2 𝑡 -target preimage	2 p𝑛´𝑡q{2 None	𝑛2 𝑡 QRACM
	MAC	Forgery	2 𝑡{2	2 𝑡{2 Q2 verif. queries	𝑡
		Key-recovery 2 𝑚{2	P 𝑚 𝑡	T	KP	𝑡 P 𝑚	T

  Initialize a register for 𝑛-bit messages and another for the outputs Ź |0 𝑛 y |0 𝑛 y 2: Apply a Hadamard transform H b𝑛 and CNOTs Ź

	ÿ
	|𝑚y |𝑚y
	𝑚Pt0,1u 𝑛

4.1 Distinguisher on the one-time pad based on Deutsch-Jozsa's algorithm. Input: oracle access to 𝑂 𝑔 Output: 1 if 𝑔 " Encrypt 𝑘 for some 𝑘 and 0 if 𝑔 " 𝐹 . 1: 3: Apply 𝑂 𝑔 Ź ÿ 𝑚Pt0,1u 𝑛 |𝑚y |𝑔p𝑚q ' 𝑚y 4: Apply a Hadamard transform on the first register to produce: Ź ÿ 𝑦Pt0,1u 𝑛 ÿ 𝑚Pt0,1u 𝑛 p´1q 𝑦¨𝑚 |𝑦y |𝑔p𝑚q ' 𝑚y 5: Measure the first register 6: if The result is 0 then 7: return 1 8: else 9:

  Theorem 5.3 (Correctness of Wagner's algorithm). When ℎ : t0, 1u 𝑛 Ñ t0, 1u 𝑛 is a random function, Wagner's algorithm runs in time: 𝒪

		´2 𝑛 𝜅`1 ¯, and succeeds with constant
	probability. It uses 𝒪	´2 𝑛 𝜅`1 ¯queries to ℎ and classical RAM. The constant in 𝒪 depends
	on 𝑘.

  ℎp𝑥 2 qqu

	5:	Sample 𝑥 4 P t0, 1u 𝑛
	6:	ℒ 4 Ð ℒ 4 Y tp𝑥 4 , ℎp𝑥 4 qqu
	7: EndRepeat
	8: Initialize ℒ 34 " H
	9: Repeat 2 𝑛{3 times	Ź We build ℒ 34
	10:	Sample 𝑥 3 P t0, 1u 𝑛
	11:

if Dp𝑥 4 , ℎp𝑥 4 qq P ℒ 4 , ℎp𝑥 3 q ' ℎp𝑥 4 q " 0 𝑛{3 |˚then 12:

ℒ 34 Ð ℒ 34 Y tp𝑥 3 , 𝑥 4 , ℎp𝑥 3 q ' ℎp𝑥 4 qu 13: EndRepeat 14: Drop ℒ 4 15: Sample 𝑥 1 P t0, 1u 𝑛 such that Ź We build the root node 16:

  ℎp𝑥 3 qqu 9: EndRepeat 10: Sample 𝑥 1 P t0, 1u 𝑛 such that

	11:

  • The size ℓ 𝑗 𝑖 of this list: following our conventions, ℓ 𝑗 𝑖 represents a size of 2 ℓ 𝑗 𝑖 𝑛 .

	Thus, ℒ 𝑗 𝑖 is a list of 𝑘 𝑗 𝑖 -tuples 𝑥 1 , . . . , 𝑥 𝑘 𝑗 𝑖 𝑖 𝑛 , which may or may not be stored in memory. such that 𝑥 1 ' . . . ' 𝑥 𝑘 𝑗 𝑖 2 ℓ 𝑗	" 0 𝑢 𝑗 𝑖 𝑛 |˚, of size

Table 5

 5

		Classical	QRACM model	Circuit model
	𝑘 As fraction Rounded As fraction Rounded As fraction Rounded
	2	1/2	0.5	1/3	0.3333	2/5	0.4
	3	1/2	0.5	2/7	0.2857	5/14	0.3571
	4	1/3	0.3333	1/4	0.25	1/3	0.3333
	5	1/3	0.3333	4/17	0.2353	40/129	0.3101
	6	1/3	0.3333	2/9	0.2222	2/7	0.2857
	7	1/3	0.3333	4/19	0.2105	15/53	0.2830
	8	1/4	0.25	1/5	0.2	1/4	0.25
	9	1/4	0.25	8/41	0.1951	1/4	0.25
	10	1/4	0.25	4/21	0.1905	1/4	0.25
	11	1/4	0.25	8/43	0.186	1/4	0.25
	12	1/4	0.25	2/11	0.1818	2/9	0.2222
	13	1/4	0.25	8/45	0.1778	2/9	0.2222
	14	1/4	0.25	4/23	0.1739	2/9	0.2222
	. . .	. . .	. . .	. . .	. . .	. . .	. . .

.1: Best time complexity exponents of 𝑘-XOR optimized merging trees for 𝑘 up to 14. In the circuit model, we highlight speedups with respect to Wagner's algorithm.

  𝛼 𝑘 𝑙 is a decreasing function of 𝑘 𝑙 , this sum becomes maximal when 𝑘 𝑙 is close to 𝑘 𝑟 " 𝑘 ´𝑘𝑙 . More precisely: if 𝑘 is even, then 𝑘 𝑟 " 𝑘 𝑙 " 𝑘 2 gives the smallest sum possible. If 𝑘 is odd, then 𝑘 𝑙 " X 𝑘

2

\

and 𝑘 𝑟 " 𝑘 ´X 𝑘 2

  Since we have 𝑘 𝑙 ě t𝑘{2u, at the same time, we should have 𝑘 𝑟 ď r𝑘{2s so 𝑘 𝑟 ď 𝑘 𝑙 `1 and 𝛼 𝑘𝑟 ě 𝛼 𝑘 𝑙 `1. This inequality becomes 𝑡 ě 2𝛼 𝑘 𝑙 `1 1´𝛽 𝑘 𝑙 𝛽 𝑘 𝑙 `1 p2𝑐 `1q. A quick computation of the first values of 𝛼 𝑖 and 𝛽 𝑖 shows that for 𝑘 𝑙 ě 15, 2𝛼 𝑘 𝑙

	1´𝛽 𝑘 𝑙 𝛽 𝑘 𝑙 `1 p2𝑐 `1q. But then we find 𝑡 ě 2𝛼 𝑘𝑟	𝛽 𝑘 𝑙 𝛽 𝑘 𝑙	´1 `1 p2𝑐 `1q.
	`1 1´𝛽 𝑘 𝑙 𝛽 𝑘 𝑙

Table 5 . 2 :

 52 Quantum speedup of the approximate 𝑘-list problem of[START_REF] Both | The Approximate k-List Problem[END_REF], in the QRACM model.

			𝑘 " 2			𝑘 " 3
	𝑐 𝑤 log 𝑇 {𝑛	log 𝑇 {𝑛	𝑐 𝑤 log 𝑇 {𝑛	log 𝑇 {𝑛
		(classical) (quantum)	(classical) (quantum)
	0	0.5000	0.3333	0	0.5000	0.2857
	0.1 0.2920	0.1876	0.1 0.2769	0.1641
	0.2 0.1692	0.1046	0.2 0.1590	0.0935
	0.3 0.0814	0.0481	0.3 0.0778	0.0440
	0.4 0.0232	0.0129	0.4 0.0221	0.0122
			𝑘 " 8			𝑘 " 1024
	𝑐 𝑤 log 𝑇 {𝑛	log 𝑇 {𝑛	𝑐 𝑤 log 𝑇 {𝑛	log 𝑇 {𝑛
		(classical) (quantum)	(classical) (quantum)
	0	0.2500	0.2000	0	0.1667	0.1429
	0.1 0.1576	0.1200	0.1 0.1091	0.0889
	0.2 0.0984	0.0714	0.2 0.0704	0.0548
	0.3 0.0518	0.0355	0.3 0.0387	0.0284
	0.4 0.0170	0.0106	0.4 0.0914	0.0091
	if 𝑐 ď p1 ´𝑢q and 1 otherwise, where H is the binary entropy function. Hence, we run
	a quantum search with: 2	1 2 p1´𝑢q𝑛p1´H𝑒p𝑐𝑤{p1´𝑢qqqq

  Bicomposite Problems . . . . . . . . . . . . . . . . . . . . . 137 6.2.2 Solving the Multiple-encryption Problem . . . . . . . . . . . 140 6.2.3 Improved Quantum Time-Memory Trade-off for Subset-sums 141 6.2.4 Quantum Algorithms for LPN and LWE . . . . . . . . . . . 142 6.2.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

6.1 Extending the Problem . . . . . . . . . . . . . . . . . . . . . . . . . 109 6.1.1 Classical Algorithms . . . . . . . . . . . . . . . . . . . . . . 110 6.1.2 Quantum Algorithms . . . . . . . . . . . . . . . . . . . . . . 113 6.1.3 Extended Merging Trees . . . . . . . . . . . . . . . . . . . . 115 6.1.4 New Generalization . . . . . . . . . . . . . . . . . . . . . . . 118 6.1.5 Correspondence between Trees and Algorithms . . . . . . . 119 6.1.6 New Results for Unique k-XOR . . . . . . . . . . . . . . . . . 121 6.1.7 Proof of Optimality . . . . . . . . . . . . . . . . . . . . . . . 128 6.1.8 Optimizing the Time-Memory Product . . . . . . . . . . . . 136 6.2 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 6.2.1

  comparison of these results is given in Figure6.5, and corresponding values in Table6.1.

	0.38						Theorem 6.2
							Theorem 6.3
	0.36					The complexities
	5 are 𝒪p2 𝛾 Table 6.1: Quantum time and memory (QRAQM or QRACM) complexities for Prob-10 15 20 25 30 35 40 0.28 0.3 0.32 0.34 𝑘 𝛾 𝑘
	lem 6.1.
		Best time	Corresponding mem. Best t.-m. product
	𝑘 As fraction Rounded As fraction Rounded As fraction Rounded
	2	3/8	0.375	1/4	0.25	1/2	0.5
	3	1/3	0.3333	1/6	0.1667	1/2	0.5
	4	5/16	0.3125	1/4	0.25	11/24	0.4583
	5	3/10	0.3	1/5	0.2	9/20	0.45
	6	1/3	0.3333	1/6	0.1667	4/9	0.4444
	7	2/7	0.2857	2/7	0.2857	19/42	0.4524
	8	5/16	0.3125	1/8	0.125	7/16	0.4375
	9	11/36	0.3056	1/6	0.1667	4/9	0.4444
	10 11	3/10 13/44	0.3 0.2955	1/5 3/11	0.2 0.2727	9/20 5/11	0.45 0.4545	.4)
	12 In particular, it converges towards a minimum 2 7/24 0.2917 1/4 7 , which is reached by multiples of 7. 0.25 7/16 0.4167 . . . . . . . . . . . . . . . . . . . . .

Remark 6.4. Many different equivalent closed expressions for 𝛾 𝑘 are possible, but none of them without at least three tu or rs. 𝑘 𝑛 q Figure 6.5: Best time complexities obtained for Unique 𝑘-XOR with merging trees, with Theorem 6.2 and Theorem 6.3. A

Table 6 . 2 :

 62 Quantum time and memory (QRAQM or QRACM) complexities for Unique 𝑘-XOR when the memory is 2 𝑛{𝑘 .

		Time	QRAQM	Product
	𝑘 As fraction Rounded As fraction Rounded As fraction Rounded
	4	5/16	0.3125	1/4	0.25	9/16	0.5625
	5	3/10	0.3	1/5	0.2	1/2	0.5
	6	1/3	0.3333	1/6	0.1667	1/2	0.5
	7	9/28	0.3214	1/7	0.1429	13/28	0.4643
	8	5/16	0.3125	1/8	0.125	7/16	0.4375
	9	1/3	0.3333	1/9	0.1111	4/9	0.4444
	10	7/20	0.35	1/10	0.1	9/20	0.45
	11	15/44	0.3409	1/11	0.0909	19/44	0.4318
	12	1/3	0.3333	1/12	0.0833	5/12	0.4167
	13	9/26	0.3462	1/13	0.0769	11/26	0.4231
	14	5/14	0.3571	1/14	0.0714	3/7	0.4286
	15	11/30	0.3667	1/15	0.0667	13/30	0.4333
	16	23/64	0.3594	1/16	0.0625	27/64	0.4219
	17	6/17	0.3529	1/17	0.0588	7/17	0.4118
	18	13/36	0.3611	1/18	0.0556	5/12	0.4167
	. . .	. . .	. . .	. . .	. . .	. . .	. . .

  • Each 𝒯 𝑖 has a width 𝑘 𝑖 , a list length ℓ 𝑖 , a prefix size 𝑢 𝑖 and we have

		ř 𝑝 𝑖"1 𝑘 𝑖	`𝑘1
	each of these lists induces a global (but not repeated) cost of	𝑘 𝑙 𝑖 𝑘 and ℓ 𝑟 𝑖 ď 𝑘 and 𝑘 𝑙 𝑖 𝑘 𝑟 𝑖 𝑘 respectively. 𝑘 𝑟 𝑖 𝑘 , and

𝑝 " 𝑘

• The first subtree 𝒯 𝑝 builds a list ℒ 𝑝 with no prefix: 𝑢 𝑝 " 0 .

• Each 𝒯 𝑖 induces a repetition loop with 𝑟 𝑖 " 1 2 ´𝑘𝑖 𝑘 ´ℓ𝑖 ¯.

• Each 𝒯 𝑖 , except 𝒯 𝑝 , has two children: ℒ 𝑙 𝑖 and ℒ 𝑟 𝑖 , of width 𝑘 𝑙 𝑖 and 𝑘 𝑟 𝑖 . We have 𝑘 𝑖 " 𝑘 𝑟 𝑖 `𝑘𝑙 𝑖 . We also have ℓ 𝑖 " ℓ 𝑙 𝑖 and 𝑢 𝑖 " ℓ 𝑟 𝑖 . We have ℓ 𝑙 𝑖 ď • We have @𝑖, 𝑢 𝑖´1 " 𝑢 𝑖 `ℓ𝑖 , hence 𝑢 𝑖 " ř 𝑝 𝑗"𝑖`1 ℓ 𝑗 .

  This is done by computing the images of 𝑦 1 , . . . , 𝑦 𝑟 2 by all keys and trying to match an element of ℒ 3

	10:	Match against the values in ℒ 1
	11:	Obtain a sequence of keys for steps 1, . . . , 𝑟 2 , 𝑟 2 `1, . . . , 𝑟 ´𝑟1 that map
	12:	𝑥 1 1 , . . . , 𝑥 1 𝑟 2 to 𝑦 1 , . . . , 𝑦 𝑟 2 Compute the rest of the intermediate state 𝑥 𝑟´𝑟 1 and try to match against
		ℒ 23
	13:	if There is a match then
	14:	Exit and return the full key sequence
	15:	EndSample
	16:

𝑘 𝑟 P 𝐾u Ź Thus, the list contains all possible choices for the 𝑟 2 last steps 4: Sample 𝑦 1 , . . . , 𝑦 𝑟 2 such that Ź These guesses are from the intermediate state 𝑥 𝑟´𝑟 1 5: Define: ℒ 2 the list of all key sequences for steps 𝑟 ´𝑟1 `1, . . . , 𝑟 ´𝑟2 `1 6: Sample Sublists ℒ 1 2 of ℒ 2 of size 𝑟 ´𝑟1 ´𝑟2 such that 7: Compute the list ℒ 23 of all key sequences from ℒ 1 2 ˆℒ3 for steps 𝑟´𝑟 1 `1, . . . , 𝑟 such that 𝑦 1 , . . . , 𝑦 𝑟 2 is mapped to 𝑥 𝑟`1 1 , . . . , 𝑥 𝑟`1 𝑟 2 . Ź 8: Sample Key sequences for step 𝑟 2 `1, . . . , 𝑟 ´𝑟1 such that Ź There remains 𝑟 ´𝑟1 ´𝑟2 subkeys to try 9: Compute the inverse by 𝑓 𝑘 𝑟 2 `1 ˝. . . ˝𝑓𝑘 𝑟´𝑟 1 of 𝑦 1 , . . . , 𝑦 𝑟 2

  Theorem 6.6[START_REF] Esser | Dissection-BKW[END_REF]). If there exists an algorithm solving 𝑐-SUM in time 𝑇 𝑐,𝑁 and memory 𝑀 𝑐,𝑁 with overwhelming probability, for 𝑏 " log 𝑐 𝑛p1`𝜖q log 𝑛 and 𝑁 ě 2

			𝑏`𝑐 log 𝑐`1 𝑐´1	,
	then there exists an algorithm solving LPN in dimension 𝑛 in time 𝑇 𝑐,𝑁 1`𝑜p1q	and memory
	𝑀	1`𝑜p1q 𝑐,𝑁

Table 6 . 3 :

 63 Improvements on the quantum-BKW algorithm of[START_REF] Esser | Dissection-BKW[END_REF] (see Table1in[START_REF] Esser | Dissection-BKW[END_REF]).

		Previous (naive + Grover)		New results
	𝑐 Memory	Time	Memory Time Time exponent
	3	𝑁 𝑐	𝑁 𝑐 3{2	𝑁 𝑐	𝑁 𝑐 5{3	5{3 " 1.667
	4	𝑁 𝑐	𝑁 2 𝑐	𝑁 𝑐	𝑁 𝑐 13{7	13{7 " 1.857
	5	𝑁 𝑐	𝑁 𝑐 5{2	𝑁 𝑐	𝑁 2 𝑐	2
	6	𝑁 𝑐	𝑁 3 𝑐	𝑁 𝑐	𝑁 𝑐 5{2	5{2 " 2.5
	7	𝑁 𝑐	𝑁 𝑐 7{2	𝑁 𝑐	𝑁 𝑐 11{4	11{4 " 2.75
	8	𝑁 𝑐	𝑁 4 𝑐	𝑁 𝑐	𝑁 3 𝑐	3

  Algorithm 7.1 The offline Simon's algorithm OfflineSimon. Steps 5 to 8 simply realize an iteration of the quantum search for 𝑖 0 . Start in the all-zero state. Ź |0 𝑚 y Apply Hadamard gates and 𝑂 𝑔 to create the 𝑔-database state.

			𝑛`𝑟
			â	|0 𝑛 y |0 𝑛 y
	2: Ź |0 𝑚 y Initialize the first register with the uniform superposition of indices: 𝑛`𝑟 â |𝑥y |𝑔p𝑥qy 3: ˆÿ 𝑥
	Ź	ˆÿ 𝑖Pt0,1u 𝑚	|𝑖y ˙b |𝜓 𝑔 y
	Ź Apply the circuit QSimon	ÿ 𝑖	𝛼 𝑖 |𝑖y	𝑛`𝑟 â	ˆÿ 𝑥	|𝑥y |𝑔p𝑥q ' 𝑓 𝑖 p𝑥qy	6:
	7:

1:

4: Repeat 𝒪 `2𝑚{2 ˘times 5:

Compute 𝑓 , controlled on the value of 𝑖, directly into the database.

  This function is periodic (of period 𝑘 𝑖𝑛 ) if and only if 𝑖 " 𝑘. It is the sum of 𝑓 p𝑖, 𝑥q :" 𝐸 Algorithm 7.1 can be applied. Although FX and 𝐸 are random permutations, and not random functions, the condition (7.1) is still valid. Once 𝑘 has been found, Simon's algorithm can recover 𝑘 𝑖𝑛 . The keys 𝑘, 𝑘 𝑖𝑛 , 𝑘 𝑜𝑢𝑡 can be recovered in time 𝒪 `p𝑛 `𝑚q 3 2 𝑚{2 ˘by making 𝒪p𝑛 `𝑚q superposition queries to FX 𝑘,𝑘 𝑖𝑛 ,𝑘𝑜𝑢𝑡 .

	Proposition 7.1.

𝑖 p𝑥q, that depends on 𝑖 but not on the secret, and of 𝑔p𝑥q :" FXp𝑥q, that does not depend on 𝑖, but contains the secret. Finding the key 𝑘 is an instance of Problem 7.1, and

  .1 and detailed in Algorithm 7.2.

			p2q 1 𝑘
			𝑘 2
	𝑛	´𝑢 𝑢	Π
			p1q 1 𝑘
	p2q 1 . Find 𝑘 1 with Simon's algorithm. p1q
	Proposition 7.2. Algorithm 7.2 returns 𝑘 1 in quantum time:
	𝒪 `𝑛2 2 𝑢 looomooon	2 `𝒪ˆ2 𝑛´𝑢 lo omo on
	Database	Grover iterates

𝑛

Grover search space Apply Simon's algorithm Figure 7.1: Idea of our Q1 attack on the Even-Mansour cipher, using the Offline Simon's algorithm. Algorithm 7.2 Q1 attack on Even-Mansour.

1: Input: parameter 𝑢, classical query access to EM 𝑘 1 ,𝑘 2 2: Returns: 𝑘 1 3: Start in the all-zero state 4: Build the database state for the function: 𝑥 Þ Ñ EMp𝑥}0 𝑛´𝑢 q 5: Search for 𝑖 such that 𝑥 Þ Ñ EMp𝑥}0 𝑛´𝑢 q ' Πp𝑥}𝑖q is periodic, using Algorithm 7.1 6: Now 𝑖 " 𝑘

Table 7 . 1 :

 71 Trade-offs for Q1 attacks on the Even-Mansour construction. In this table we omit 𝒪 notations, and ignore polynomial factors in the first and last rows.Trade-off of 𝐷 ¨𝑇 " 2 𝑛 𝑇 " 2 𝑛{2 , 𝐷 ¨𝑇 6 " 2 3𝑛 𝐷 " 2 𝑛{3 , 𝐷 ¨𝑇 2 " 2 𝑛𝐷 and 𝑇 𝐷 " cons p𝐷 ď 2 3𝑛{7 q 𝑇 " 2 𝑛{3 classical memory polyp𝑛q, quantum memory 𝒪pp𝑛 `𝑚q𝑛q (qubits of the database) and using 𝒪p2 𝑢 q classical chosen-plaintext queries to FX.A comparison with previous attacks is given in Table7.2.

	Reference	Classical attack	Grover	[HS18a]	[KM12] Algorithm 7.2
	QRACM	-	-	-		2 𝑛{3	-
	Qubits	-	polyp𝑛q	polyp𝑛q	polyp𝑛q	polyp𝑛q
	Classical memory	𝐷	polyp𝑛q	𝐷 1{3		polyp𝑛q	polyp𝑛q
	Balanced
	point of	2 𝑛{2	-	2 3𝑛{7		-	2 𝑛{3
	𝐷 and 𝑇
	7.2.3 Trade-offs for the FX Construction
	p2q 𝑖𝑛 (see Figure 7.2). If we assume that the internal cipher 𝐸 can be evaluated in quantum time 𝒪 `𝑛2	˘,
	then similarly to Proposition 7.2, we obtain:
	Proposition 7.3. There exists a quantum algorithm that returns 𝑘 and 𝑘 𝑖𝑛 in quantum
	time:						˙,
	𝒪pp𝑛 `𝑚q𝑛2 𝑢 q loooooooomoooooooon	`𝒪ˆ2 𝑛`𝑚´𝑢 2 loomoon	ˆp𝑛 `𝑚q 3 loooomoooon
		Database	Grover iterates		Simon's circuit

A similar situation occurs for the FX construction FX 𝑘,𝑘 𝑖𝑛 ,𝑘𝑜𝑢𝑡 , where we just need to balance differently the database setup and the Grover search. We divide the 𝑛-bit key 𝑘 𝑖𝑛 in 𝑘 p1q 𝑖𝑛 of 𝑢 bits and 𝑘 p2q 𝑖𝑛 of p𝑛 ´𝑢q bits. We apply Simon's algorithm to recover 𝑘 p1q 𝑖𝑛 while we perform Grover search on 𝑘 in addition to 𝑘

Table 7 . 2 :

 72 Trade-offs for Q1 attacks on the FX construction. We omit 𝒪 notations, and ignore polynomial factors in the first and last rows.

	Reference	Classical	Grover	[HS18a]	Proposition 7.3
	QRACM	-	-	-	-
	Qubits	-	polyp𝑛q	polyp𝑛q	polyp𝑛q
	Classical memory	𝐷	polyp𝑛q	𝐷 1{3	polyp𝑛q
	Balanced
	point of
	𝐷 and 𝑇

Trade-off of 𝐷𝑇 " 2 𝑛`𝑚 𝑇 " 2 p𝑛`𝑚q{2 𝐷 ¨𝑇 6 " 2 3p𝑛`𝑚q 𝐷 ¨𝑇 2 " 2 𝑛`𝑚 𝐷 and 𝑇 p𝐷 ď 2 𝑛 q 𝐷 " cons p𝐷 ď mint2 𝑛 , 2 3𝑛{7 uq p𝐷 ď 2 𝑛 q

  8.2.4 Classical Collisions on Reduced-Round Gimli-Hash . . . . . 190 8.2.5 Quantum Collision Attacks on Gimli . . . . . . . . . . . . . 197 8.2.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Table 8 . 1 :

 81 Lookup table of the S-Box used in Shadow.

Table 8 .2:

 8 Round constants RC 𝑖 used in Shadow. Note that the LSB is on the left.

	Round Constant Round Constant Round Constant Round Constant
	0

  the rate: 𝐴 𝑥 , 𝐵 𝑥 , 𝐶 𝑥 , 𝐷 𝑥 , apply Gimli 7: ℎ Ð 𝐴 𝑥 }𝐵 𝑥 }𝐶 𝑥 }𝐷 𝑥 8: 𝑆 Ð Gimlip𝑆q 9: ℎ Ð ℎ}𝐴 𝑥 }𝐵 𝑥 }𝐶 𝑥 }𝐷 𝑥 Return ℎ more the permutation, and outputting the rate again. In Gimli-Hash, the rate is the 𝑥 lane 𝑆 𝑥 " 𝐴 𝑥 , 𝐵 𝑥 , 𝐶 𝑥 , 𝐷 𝑥 and the capacity is 𝑆 𝑦,𝑧 " 𝐴 𝑦,𝑧 , 𝐵 𝑦,𝑧 , 𝐶 𝑦,𝑧 , 𝐷 𝑦,𝑧 .

  𝐴 15 𝑥 , 𝐴 15 𝑦 , 𝐴 15 𝑧 and 𝐶 15 𝑥 " 𝐴 15 𝑥 ' RC 16 , 𝐶 15 𝑦 " 𝐴 15 𝑦 , 𝐶 15 𝑧 " 𝐴 15 𝑧 such that 𝐵 11 𝑥 " 𝐷 11 𝑥 . Notice that due to the small swap operation, the values 𝐵 11 𝑥 and 𝐷 11 𝑥 actually come from 𝐴 and 𝐶 and depend only on 𝐴 15 and 𝐶 15 . At this point, we have ensured that for any values of 𝐵 15 " 𝐷 15 :

Table 8 .5:

 8 Collision attacks on round-reduced Gimli. 𝑡 𝑒 denotes the time to solve one of the Equations (8.9) to (8.12).

	Type	Nbr of rounds Time complexity	Memory
	Standard	8	8 ˆ232 ˆ𝑡𝑒 (practical) negl.
	Standard	12	8 ˆ296 ˆ𝑡𝑒	negl.
	Quantum	14	» 8 ˆ264 ˆ𝑡𝑒	negl.
	Semi-free start	12	10 ˆ232 ˆ𝑡𝑒	negl.
	Semi-free start	16	10 ˆ296 ˆ𝑡𝑒	negl.
	Semi-free start	18	7 ˆ296 ˆ𝑡𝑒	2 64
	Semi-free start	18	2 96	2 96
	Semi-free start, quantum 20	» 2 64 ˆ10 ˆ𝑡𝑒	2 64

  Algorithm 8.10 8-round collision attack on Gimli. Input: an input state 𝐴 21 , 𝐵 21 , 𝐶 21 , 𝐷 21 .

	Output: values 𝐴 21 𝑥 , 𝐴 121 𝑥 , 𝐵 21 𝑥 , 𝐶 21 𝑥 , 𝐷 21 𝑥 such that by putting 𝐴 21 𝑥 , 𝐵 21 𝑥 , 𝐶 21 𝑥 , 𝐷 21 𝑥 and 𝐴 121 𝑥 , 𝐵 21 𝑥 , 𝐶 21 𝑥 , 𝐷 21

  1: find good 𝐴 21 𝑥 , 𝐴 121 𝑥 . 1. Find all pairs 𝐴 21 𝑥 , 𝐴 121 𝑥 such that the branch 𝐵 19 𝑥 collides (there are 2 32 such pairs, that can be found in time 2 32 ).

	2. For each pair, compute 𝐴 19 𝑦 , 𝐴 19 𝑧 , 𝐴 119 𝑦 , 𝐴 119 𝑧 and solve the SP-Box equation (8.10): find 𝐴 19 𝑥 such that the branch 𝐶 17 𝑥 collides (there is on average one
	solution)
	3. Given this value, compute 𝐴 17 𝑦 , 𝐴 17 𝑧 , 𝐴 117 𝑦 , 𝐴 117 𝑧 and solve the SP-Box equation (8.10) again: find 𝐴 17 𝑥 such that the branch 𝐵 15 𝑥 collides (there is on average
	one solution)
	4. Given these values, compute 𝐴 15 𝑦 , 𝐴 15 𝑧 , 𝐴 115 𝑦 , 𝐴 115 𝑧 and solve Equation (8.11): find 𝐴 15 𝑥 such that 𝐴 13 𝑧 " 𝐴 113 𝑧 .
	Since we do that 2 32 times, we expect on average a single solution which also has
	𝐴 13 𝑦 " 𝐴 113 𝑦 .
	Now that we have found 𝐴 21 𝑥 , 𝐴 121 𝑥 , it remains to find 𝐵 21 𝑥 , 𝐶 21 𝑥 , 𝐷 21 𝑥 that give the wanted 𝐴 19 𝑥 , 𝐴 17 𝑥 , 𝐴 15

𝑥 (in red in Figure

  𝐵 21 𝑥 by solving Equation (8.12), given the input 𝑦 and 𝑧, and the output 𝑥 wanted. Deduce the values of 𝐵 17 𝑦 , 𝐵 17 Collision attack on 8 rounds of Gimli, extended to 12 rounds. The first step fixes the branches in red, which have equal values for the two inputs 𝐴 21 𝑥 , 𝐴 121 𝑥 . Then we find values of 𝐵 21 𝑥 , 𝐶 21 𝑥 , 𝐷 21

			Step 1
			fix branches
	RC20	'
			Step 2.1:
			find 𝐵 21 𝑥
			Step 2.2:
			find 𝐵 17 𝑥
	RC16	'	Step 2.3:
			match 𝐴 17 𝑥 and 𝐶 17 𝑥
	RC12	'
	Figure 8.12:
		𝑧
	2.2 Given 𝐵 17 𝑦 , 𝐵 17 𝑧 , and 𝐴 15 𝑥 , solve Equation (8.12) again to find 𝐵 17 𝑥 .
	2.3 Find 𝐶 21 𝑥 , 𝐷 21 𝑥 that lead to the wanted 𝐴 17 𝑥 , 𝐵 17 𝑥 . First guess the value of 𝐶 21 𝑥 , deduce 𝐶 19 𝑦 , 𝐶 19 𝑧 and with 𝐶 19 𝑦 , 𝐶 19 𝑧 , 𝐴 17 𝑥 , solve Equation (8.12) to obtain 𝐶 19 𝑥 . Next, given 𝐷 21 𝑦 , 𝐷 21 𝑧 and 𝐶 19 𝑥 , solve Equation (8.12) to obtain 𝐷 21 𝑥 . Deduce a value for 𝐵 17 𝑥 and check if it matches what we want; we expect to find a match after trying all 2 32 guesses for 𝐶 21 𝑥 .

  21 𝑥 , 𝐵 21 𝑥 , 𝐶 21 𝑥 , 𝐷 21 𝑥 and 𝐴 121 𝑥 , 𝐵 21 𝑥 , 𝐶 21 𝑥 , 𝐷 21

  Semi-free start collision attack on 12 rounds of Gimli.

	2.1:
	guess 𝐵 19 𝑦 , 𝐵 19 𝑧 ,
	find all 𝐵 𝑖
	Step 2.2:
	guess 𝐷 19 𝑦 , 𝐷 19 𝑧 ,
	find all 𝐷 𝑖
	Step 2.3:
	guess 𝐶 15 𝑧
	deduce all
	Figure 8.13:

Table 9 .

 9

	1: Resource estimates for the AES S-Box quantum circuit, taken from [Jaq+20],
	Table 1.
	Reference CNOT	1-qubit T-gates Clifford	Measure-T-depth ments	Full Qubits depth
	[Gra+16] 8683 1028	3584	0	217	1692	44
	[LPS19] 818	264	164	41	35	497	41
	[Jaq+20] 654	184	136	34	6	101	137

Table 9 . 2 :

 92 Number of S-Box circuits used in the quantum circuits for AES in[START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF] (see Table3in[START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF]). Both forwards and backwards computations are counted.

	Variant Number of S-Boxes Number of qubits
	AES-128	400	1785
	AES-192	448	2105
	AES-256	552	2425

Table 9 . 3 :

 93 Estimates for a full-round key-recovery on AES variants, for an overwhelming success probability (see Table10in[START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF]).

	Variant	Number of plaintexts Clifford T-gates Measures Gate counts	S-Boxes
	AES-128 AES-192 AES-256	2 2 3	2 83.2 2 115.3 2 112.6 2 80.4 2 148.2 2 145.4	2 78.4 2 110.6 2 143.4	X 𝜋 4 2 64 \ X 𝜋 4 2 96 \ X 𝜋 4 2 128 \ ˆ1656 " 2 138.34 ˆ800 " 2 73.30 ˆ896 " 2 105.46

Table 9 . 4 :

 94 Cost benchmarks for quantum reversible AES components. The S-Boxes have 8-bit inputs and 8-bit outputs. The number of qubits required can be approximated by 8 times the number of (forward) S-Boxes, plus 137 ancillas. The number of qubits comes from the number of rounds computed and the key-schedule, which are below a full

	Component	Number of S-Boxes
	S-Box	1
	128-bit key-schedule (10 rounds/10 keys)	40
	192-bit key schedule (12 rounds/8 keys)	32
	256-bit key schedule (14 rounds/7 keys)	56
	6-round AES (no key schedule)	6 ˆ16 " 96
	7-round AES (no key schedule)	7 ˆ16 " 112
	8-round AES (no key schedule)	8 ˆ16 " 128
	6-round AES-128 (with key schedule)	120
	7-round AES-192 (with key schedule)	132
	7-round AES-256 (with key schedule)	140
	8-round AES-256 (with key schedule)	8 ˆ16 `8 ˆ4 " 160
	and they are uncomputed afterwards.

  𝑎0 𝑥 5 r0s 𝑖 ' 𝑎 1 𝑥 5 r1s 𝑖 ' 𝑎 2 𝑥 5 r2s 𝑖 ' 𝑎 3 𝑥 5 r3s 𝑖 ' 𝑢 5 r0s for some known coefficients 𝑎 0 , 𝑎 1 , 𝑎 2 , 𝑎 3 . In turn this rewrites: 𝑆 ´1p𝐶 𝑖 r0s ' 𝑘 6 r0sq ' 𝑎 1 𝑆 ´1p𝐶 𝑖 r1s ' 𝑘 6 r1sq ' 𝑎 2 𝑆 ´1p𝐶 𝑖 r2s ' 𝑘 6 r2sq ' 𝑎 3 𝑆 ´1p𝐶 𝑖 r3s ' 𝑘 6 r3sq ' 𝑢 5 r0s ˙.(9.1)

	à	𝑆	´1ˆ𝑎	0
	𝑖

  𝑖 r0s ' 𝑘 6 r0sq ' 𝑎 1 𝑆 ´1p𝐶 𝑖 r1s ' 𝑘 6 r1sq ' 𝑎 2 𝑆 ´1p𝐶 𝑖 r2s ' 𝑘 6 r2sq ' 𝑎 3 𝑆 ´1p𝐶 𝑖 r3s ' 𝑘 6 r3sq ' 𝑢 5 r0s .Allocate a table 𝑇 1 of 2 24 one-byte entries, labeled by three bytes, initially 0𝑏 1 , 𝑏 2 , 𝑏 3 Ð 𝑎 0 𝑆 ´1p𝐶 𝑖 r0s ' 𝑘 6 r0sq ' 𝑎 1 𝑆 ´1p𝐶 𝑖 r1s ' 𝑘 6 r1sq, 𝐶 𝑖 r2s, 𝐶 𝑖 r3s 𝑇 1 r𝑏 1 , 𝑏 2 , 𝑏 3 s Ð 𝑇 1 r𝑏 1 , 𝑏 2 , 𝑏 3 s `1Allocate a table 𝑇 2 of 2 16 one-byte entries, labeled by two bytes, initially0 Address 𝑏 1 , 𝑏 2 , 𝑏 3 in 𝑇 1 do Compute 𝑏 4 , 𝑏 5 Ð 𝑏 1 ' 𝑎 2 𝑆 ´1p𝑏 2 ' 𝑘 6 r2sq, 𝑏 3 𝑇 2 r𝑏 4 , 𝑏 5 s Ð 𝑇 2 r𝑏 4 , 𝑏 5 s `1 Compute 𝑏 6 Ð 𝑏 4 ' 𝑎 3 𝑆 ´1p𝑏 5 ' 𝑘 6 r3sqIf there is a result for 𝑢 5 r0s, return this guess of 𝑘 6 r3sIf there is a result for 𝑘 6 r3s, return this guess of 𝑘 6 r2s

		The classical time complexity of this procedure (in S-Boxes and inverse S-Boxes) is:
		2 2ˆ8 lo omo on	ˆ16 ¨232 `28 lo omo on	ˆ224 ¨8 `28 lo omo on	ˆ216 ¨8 `28 lo omo on	¨28 ¨8˙˙˙.
	Algorithm 9.2 Square attack on 6-round AES with the partial sums technique. Input: 8 structures of 2 32 classical chosen-plaintext queries such that the main Over 𝑘 6 r0, 1s Over 𝑘 6 r2s Over 𝑘 6 r3s Over 𝑘 6 r3s
		diagonal 𝑥 0 r0, 5, 10, 15s takes all values
		Output: the key bytes 𝑢 5 r0s, 𝑘 6 r0, 1, 2, 3s
	1: Sample 𝑘 6 r0s, 𝑘 6 r1s such that		Ź One solution among 2 16
	2:	for all Input structures 𝐶 do
	3:
	4:	for all Ciphertext 𝐶 𝑖 P 𝐶 do
	5:	Compute:
	6:
	7:
	8:	Sample 𝑘 6 r2s such that			Ź One solution among 2 8
	9:	for all Input structures 𝐶 do
	10:
	11: for all 12:
	13:
	14:	Sample 𝑘 6 r3s such that		Ź One solution among 2 8
	15:	for all Input structures 𝐶 do
	16:		Allocate 𝑇 3 of 2 8 one-byte entries, initially 0
	17:		for all Address 𝑏 4 , 𝑏 5 in 𝑇 2 do
	18:
	19:		𝑇 3 r𝑏 6 s Ð 𝑇 3 r𝑏 6 s	`1
	20:	Sample 𝑢 5 r0s such that	Ź One solution among 2 8
	21:		for all Input structures 𝐶 do
	22:		Using table 𝑇 3 , compute the sum (9.1)
	23:		If the sum is not zero, abort
	24:	EndSample
	25:
	26:	EndSample
	27:
	28:	EndSample
	29:	If there is a result for 𝑘 6 r2s, return this guess of 𝑘 6 r0, 1s
	30: EndSample

  𝑃 1 q, p𝐶, 𝐶 1 q active in one byte 𝑖 before and one byte 𝑗 after 4 AES rounds. Consider the plaintexts 𝑃 0 " 𝑃, . . . , 𝑃 255 obtained from 𝑃 by making the difference in byte 𝑖 assume all values, that is, 𝑃 1 corresponds to adding 1 to 𝑃 in byte 𝑖, etc. Collect the corresponding ciphertexts 𝐶 0 " 𝐶, . . . , 𝐶 255 and the unordered multiset of differences in byte 𝑗. Then this multiset can only assume 2 80 values. There is a procedure MultisetTable that tabulates these values in 2 88 equivalent encryptions.

	Lemma 9.4 (4-round property ([DFJ13], Proposition 2)). Suppose that we are given a
	plaintext-ciphertext pair p𝑃,

  Distinguisher on 4-round AES. It is valid for any position of the active bytes in 𝑃 and 𝐶.

		𝑃, 𝑃 1
	𝑘 1	𝑥 1	𝑦 1	𝑧 1	𝑤 1
		SB	SR	MC
	ARK
	𝑘 2	𝑥 2	𝑦 2	𝑧 2	𝑤 2
		SB	SR	MC
	ARK
	𝑘 3	𝑥 3	𝑦 3	𝑧 3	𝑤 3
		SB	SR	MC
	ARK
	𝑘 4	𝑥 4	𝑦 4	𝑧 4	𝑤 4
		SB	SR	MC
	ARK
	𝑘 5	𝐶, 𝐶 1
	ARK
	Figure 9.5: Algorithm 9.3 Distinguisher on 4-round AES.
	Precomputation: create the table of multisets: 𝑇 Ð MultisetTablepq
					Ź See Lemma 9.4
	Input: access to a permutation Π that is either random, or a 4-round AES
	Output: true if this is AES, false otherwise
	1:

  Full differential path used in the classical 7-round attack. Guessed key bytes are denoted by '. enough to discriminate the good key guess with overwhelming probability. Once these key bytes have been found, the recovery can be finished by exhaustive search or by running Algorithm 9.4 with another choice of input diagonal. Create the table of multisets: 𝑇 Ð MultisetTablepq Ź See Lemma 9.4 2: Create a table of pairs: 𝑇 1 Ð FindPairspq Ź See Lemma 9.5 3: for all values of 𝑘 0 r0, 5, 10, 15s, 𝑢 6 r1s, 𝑢 7 r0, 7, 10, 13s do

	𝑃
	Plaintexts
	MC MC MC MC MC MC MC MC on the path of Figure 9.6. 𝑢 0 ARK 𝑘 0 ' ' ' ' 𝑢 1 ARK 𝑘 1 𝑢 2 ARK 𝑘 2 𝑢 3 ARK 𝑘 3 𝑢 4 ARK 𝑘 4 𝑢 5 ARK 𝑘 5 𝑢 6 ' ARK 𝑘 6 𝑢 7 ' ' ' ' ARK 𝑘 7 Input: encryption query access to a 7-round AES oracle SB 𝑥 0 SR 𝑦 0 MC 𝑧 0 SB 𝑥 1 SR 𝑦 1 MC 𝑧 1 SB 𝑥 2 SR 𝑦 2 MC 𝑧 2 SB 𝑥 3 SR 𝑦 3 MC 𝑧 3 SB 𝑥 4 SR 𝑦 4 MC 𝑧 4 SB 𝑥 5 SR 𝑦 5 MC 𝑧 5 SB 𝑥 6 SR 𝑦 6 MC 𝑧 6 𝐶 Output: secret key bytes 𝑘 0 r0, 5, 10, 15s, 𝑢 6 r1s, 𝑢 7 r0, 7, 10, 13s 𝑤 0 𝑤 1 𝑤 2 𝑤 3 𝑤 4 𝑤 5 𝑤 6 Figure 9.6: Algorithm 9.4 Classical DS-MITM attack on 7-round AES [DFJ13, Section 4.1], based Round 0 Round 1 Round 2 Round 3 Round 4 Round 5 Round 6 Ciphertexts 1: 4:

  Full differential path used in the quantum attack. Key bytes guessed in the outer Grover procedure are denoted by '.Find in 𝑇 1 a pair 𝑃, 𝑃 1 , 𝐶, 𝐶 1 such that 𝑥 1 is active only in byte 3 and 𝑦 6 is active only in byte 5 Make the value in 𝑥 1 r3s assume all values 1, . . . , 32 Using the known key bytes ', find the corresponding plaintexts 𝑃 1 , . . . , 𝑃 32Encrypt 𝑃 1 , . . . , 𝑃 32 , obtain 𝐶 1 , . . . , 𝐶 32 Decrypt partially 𝐶 1 , . . . , 𝐶 32 and obtain the 𝛿-sequence in 𝑥 6 r5s

	𝑃 𝑥 0 𝑥 1 𝑥 2 𝑥 3 𝑥 4 𝑥 5 𝑥 6 𝑥 7 𝐶 Input: query access to an 8-round AES-256 oracle MC 𝑢 0 ARK 𝑘 0 ' ' ' ' SB SR 𝑦 0 𝑧 0 MC 𝑢 1 ARK 𝑘 1 ' SB SR 𝑦 1 𝑧 1 MC 𝑢 2 ARK 𝑘 2 SB SR 𝑦 2 𝑧 2 MC 𝑢 3 ARK 𝑘 3 SB SR 𝑦 3 𝑧 3 MC 𝑢 4 ARK 𝑘 4 SB SR 𝑦 4 𝑧 4 MC 𝑢 5 ARK 𝑘 5 SB SR 𝑦 5 𝑧 5 MC 𝑢 6 ARK 𝑘 6 SB SR 𝑦 6 𝑧 6 MC 𝑢 7 ' ARK 𝑘 7 SB SR 𝑦 7 𝑧 7 MC 𝑢 8 ' ' ' ' ARK 𝑘 8 Output: some key bytes 1: Create a table of pairs: 𝑇 Ð FindPairspq 2: for all Values of the key bytes ' do 3: 4: 5: 6: 7: 8: Check if this 𝛿-sequence is a possible one: 9: for all possible values of the 𝛿-sequence do 10: if there is a match then Figure 9.7: Algorithm 9.5 Our new attack on 8-round AES-256 (sketch). MC MC MC MC MC MC MC MC 11:	𝑤 0 𝑤 1 𝑤 2 𝑤 3 𝑤 4 𝑤 5 𝑤 6 𝑤 7	Plaintexts Round Round Round Round Round Round Round Round Ciphertexts Ź See Lemma 9.5 Ź See Figure 9.7

  The search space of differences is of size 2 24ˆ8 " 2 192 . We solve 40 S-Box differential equations in total. In solving them, the most costly step is matching between Δ𝑥 3 , Δ𝑥 4 and Δ𝑦 4 : as we traverse one round, we cannot match byte per byte, but column by column. For each column, we need to solve the AES S-Box differential equation 4 times between Δ𝑥 3 and Δ𝑥 4 , and for each of the 2 4 solutions if they exist, 4 times again between Δ𝑥 4 and Δ𝑦 4 . This takes p2 8 ˆˆ18q equivalent S-Boxes per group of 4 bytes.

	𝑥 2	𝑥 3	𝑥 4	𝑥 5
	0 1 2 3 0 1 2 3 4 5 6 7 8 9 101112131415 0 1 2 3 4 5 6 7 8 9 101112131415 3 4 9 14
		𝑥 3 r0, 5, 10, 15s and 𝑥 3 r2, 7, 8, 13s	𝑥 4 r2, 10s
	(9.3)
		𝑥 3 r3, 4, 9, 14s and 𝑥 3 r1, 6, 11, 12s	𝑥 4 r7, 15s
	(9.4)
		𝑥 3 r1, 6, 11, 12s and 𝑥 3 r2, 7, 8, 13s	𝑥 4 r0, 5, 10, 11, 15s	𝑥 5 r3s
	(9.5)
	𝑥 2	𝑥 3 r0, 3s	𝑥 4 r0, 1, 2, 3, 4, 5, 6, 7s
	(9.6)
	Figure 9.8: All key relations (9.3), (9.4), (9.5), (9.6) and the 8 remaining "free" bytes
	Sampling the 16 `8 differences (Step 7).

  There are 2 4 choices of 𝑥 5 r3s, 𝑥 4 r0, 5, 11s, and the other bytes were involved in(9.3) and (9.4), thus 2 8 choices on average. Due to the previous constraints, 𝑥 4 r15s ' ℓ 3 p𝑦 3 r1, 6, 11, 12sq can take on average only 4 values and 𝑥 4 r11s ' ℓ 3 p𝑦 3 r8, 13, 2, 7sq only 8. Thus, we don't have to recompute the S-Boxes in this equation for all 2 8 choices,: we evaluate only 4 `8 S-Boxes, which is negligible.where 16 ˆ9 stems from the outer S-Box differential equations, s' is the next Sample, and 2 ´40 is the probability that a guess satisfies the differential equations. At Step 19, we have 8 remaining free state bytes, represented in black in Figure9.8, that can take two values. Thus there are 2 8 possible states that we must check. For each possibility, we compute the 𝛿-sequence using 2 5 ˆ40 " 1280 S-Boxes and match against the expected one. If there is no match, this wasn't the good state sequence. If there is one, we have found the solution. The cost is 2 8 ˆ1280 .

	Sampling the state sequences. In total we obtain
	2 80 `253 `2152 ``4 ˆp2 8 ˆ72q ˘`2 8 ˆ1280 ˘˘,	(9.7)
	3. At this point, a significant proportion of the state should be determined. Although
	there are 14 state bytes in Equation (9.6), only 8 of them are truly free. Thus we
	do 2 8 computations without S-Boxes.
	So the full cost of the Sample is:
	2 p16`8qˆ8´40 `16 ˆ9 `4 ˆp2 8 ˆ4 ˆ18q `s1 ˘,

  134.8 S-Boxes and falls indeed below exhaustive search. The dominating term remains the computation of 𝛿-sequences, as expected.

	which is less than 2
	10 9 loomoon 2 0.45	ˆQ 𝜋 4 loomoon 2 40 U	ˆ2ˆQ 𝜋 4	2 75.8	U	2 ˆQ 𝜋 4	2 4	U	ˆ8ˆ72	looomooon 4 2 4`1 U `Q 𝜋	ˆ2ˆ1280	˙˙
	Assumptions on	Exact AA							Exact AA
	the good path

Table 9 . 6 :

 96 Summary of quantum attacks on reduced-round AES of this chapter, compared with Grover search. Quantum time is given in reversible S-Boxes. Memory is counted in 128-bit registers.

	Version Rounds Data Time Q. mem C. mem	Technique
	128	6 6	2 2 72.56 negl. 2 35 2 44.73 2 25	negl. 2 36	Exhaustive search Square (partial sums)
	192	7 7	2 2 104.70 negl. 2 37 2 102.73 2 27	negl. 2 38	Exhaustive search Square (partial sums)
		7	3 2 137.37 negl.	negl.	Exhaustive search
	256	7	2 37 2 106.73	2 27	2 38	Square (partial sums)
		8	3 2 137.56 negl.	negl.	Exhaustive search
		8	2 113 2 134.8	2 88	negl.

  The round constants RC 0 and RC 1 are updated by clocking 16 times two independent LFSRs of length 16 in Galois mode with respective feedback polynomials 𝑋 16 `𝑋5 `𝑋3 `𝑋2 `1 and 𝑋 16 `𝑋6 `𝑋4 `𝑋 `1. In other words, we repeat 16 times the following operation: if the most significant bit of RC 𝑖 is 0, RC 𝑖 is replaced by RC 𝑖 ! 1, otherwise, it is replaced by pRC 𝑖 ! 1q^poly 𝑖 with poly 0 " 0x1002d and poly 1 " 0x10053. The two 16-bit words RC 0 , RC 1 are then XORed to the internal state. Bit number 𝑖 in RC 0 is added to Bit 0 of the nibble with index 4𝑖, for 0 ď 𝑖 ď 15.

Similarly, Bit number 𝑖 in RC 1 is added to Bit 0 of the nibble with index p4𝑖`2q, for 0 ď 𝑖 ď 15.

Table 10 . 2 :

 102 Correspondence between the input and output bit indices in 𝜋 0 and 𝜋 1 .

  Algorithm 10.2 Saturnin-CTR-Cascade. All Saturnin calls use Algorithm 10.1 with 𝑅 " 10 super-rounds. 5 domain separators (1, 2, 3, 4, 5) are used in total. Input: message 𝑚, associated data 𝑎, nonce of 160 bits or less, key 𝑘 Requirements: nonces should not be reused, 𝑚 should have a length less than 2 94 ˆ256 bits Output: ciphertext 𝑐, tag 𝑡 1: Pad the nonce to obtain the 161-bit value 𝑁 2: Split 𝑚 into full blocks 𝑚 0 , 𝑚 1 , . . . 𝑚 ℓ and a final partial block 𝑚 Split 𝑎 into 𝑎 0 , 𝑎 1 , . . . 𝑎 𝑗 , 𝑎 𝑐 𝑖 Ð 𝑚 𝑖 ' Saturnin 1 p𝑘, 𝑁 }𝑖 `1q Ź Encryption of block 𝑖 6: 𝑐 ˚Ð 𝑚 ˚' trunc 𝑛 pSaturnin 1 p𝑘, 𝑁 }ℓ `2qq Ź Encryption of the final block Where 𝑛 is the bit-length of 𝑚 ˚and trunc 𝑛 truncates to the first 𝑛 bits 7: 𝑡 Ð p𝑁 }0q ' Saturnin 2 p𝑘, 𝑁 }0q 8: for all 𝑖 " 0 to 𝑗 do 𝑡 Ð 𝑎 𝑖 ' Saturnin 2 p𝑡, 𝑎 𝑖 q Ź Absorb AD block 𝑖 10: 𝑡 Ð padp𝑎 ˚q ' Saturnin 3 p𝑡, padp𝑎 ˚qq Ź Absorb the final AD block 11: for all 𝑖 " 0 to ℓ do 𝑡 Ð 𝑐 𝑖 ' Saturnin 4 p𝑡, 𝑐 𝑖 q Ź Absorb ciphertext block 𝑖 13: 𝑡 Ð padp𝑐 ˚q ' Saturnin 5 p𝑡, padp𝑐 ˚qq Ź Absorb the final ciphertext block 14: return 𝑐 " p𝑐 0 }𝑐 1 } . . . }𝑐 ℓ }𝑐 ˚q, 𝑡

	3:
	4:
	for all 𝑖 " 0 to ℓ do
	5:
	9:
	12:

Table 10 .3:

 10 Complexities. Classically, 𝒯 is expressed in units equivalent to the cost of one evaluation of the involved Saturnin block cipher (either Saturnin 10 or Saturnin 16 for the primary designs). 𝒟 is the number of encryption and decryption queries, in Algorithm 10.3 Saturnin-Hash. All Saturnin calls use Algorithm 10.1 with 𝑅 " 16 super-rounds. 2 domain separators (6, 7) are used. Split 𝑚 into full blocks 𝑚 0 , 𝑚 1 , . . . 𝑚 ℓ and a final partial block 𝑚 Ź 𝑚 ˚may be empty, but never full 2: 𝑡 Ð 0 Ź the all-zero 256-bit block 3: for all 𝑖 " 0 to ℓ do 𝑡 Ð 𝑚 𝑖 ' Saturnin 7 16 p𝑡, 𝑚 𝑖 q 5: 𝑡 Ð padp𝑚 ˚q ' Saturnin 8 16 p𝑡, padp𝑚 ˚qq 6: return 𝑡 The hash function Saturnin-Hash, where 𝐸 𝑖 is Saturnin 16 with domain separator 𝑖. A thick line represents the input of the key. Correspondence between the value of the domain separator 𝐷 and the usage of Saturnin 𝐷 . -bit blocks of message and AD (that is, a query of ℓ blocks counts ℓ). It is worth noticing that 𝒯 ě 𝒟 since the time for generating the data must be taken into account.

	Input: message 𝑚
	Output: hash output 𝑡
	1: 4:
		𝑚 0	𝑚 1		𝑚 ℓ	padp𝑚 ˚q
	0	𝐸 7	𝐸 7	. . .	𝐸 7	𝐸 8	𝑡
	Figure 10.14: Value of 𝐷 Use
		0	Saturnin block cipher
		1	Saturnin-CTR
		2	Saturnin-Cascade AD
		3	Saturnin-Cascade AD final
		4	Saturnin-Cascade message
		5	Saturnin-Cascade message final
		6	Saturnin-Short
		7	Saturnin-Hash
		8	Saturnin-Hash final

  There exists no quantum attack satisfying𝒟 3 `𝒯 2 `𝒟2 2 256´𝜏 𝑝 ă 2 224 .Claim 3 (Security of Saturnin-Short).' There exists no classical attack with 𝒟 2 `𝒯 `𝒟2 128 There exists no quantum attack with 𝒟 3 `𝒯 2 `𝒟2 2 128

256´𝜏 𝑝 ă 2 224 . ' 𝑝 ă 2 224 . ' 𝑝 ă 2 224 .

  Encrypt 𝑘 : t0, 1u 𝜈 ˆt0, 1u ˚ˆt0, 1u ˚Ñ t0, 1u ˚ˆt0, 1u 𝜏 : t0, 1u 𝜈 ˆt0, 1u ˚ˆt0, 1u ˚ˆt0, 1u 𝜏 Ñ tJ, Ku ˆt0, 1u ˚Y K

	'
	'
	'
	' &	𝑁	,	𝑎	,	𝑚 Þ Ñ	𝑐	,	𝑡
	' ' ' ' % Decrypt 𝑁	,	𝑎	,	𝑐	,	𝑡	Þ Ñ Accept ,	𝑚

𝑘

  Encrypt 𝑘 IND´qCPA p𝑞, 𝒯 q ď Adv In other words, if Encrypt 𝑘 is IND-CPA secure, then it is IND-qCPA secure.Proof. Given an adversary 𝒜 for the IND-qCPA game, we construct an adversary ℬ for the IND-CPA game with the same advantage, runtime and number of queries. ℬ simulates 𝒜. Whenever 𝒜 makes a superposition query to 𝑂 Encrypt 𝑘 p𝑁,¨q , ℬ queries classically Encrypt 𝑘 p𝑁, 0q " 𝑓 p𝑘, 𝑁 q and maps |𝑚y |𝑦y to |𝑚y |𝑦 ' 𝑚 ' 𝑓 p𝑘, 𝑁 qy, which perfectly simulates the query. Thus, the final state of ℬ is the same as the final state of 𝒜, and they have the same advantage.

	Encrypt 𝑘 IND´CPA p𝑞, 𝒯 q .	(10.4)

  Remark 10.1. The proofs given in[START_REF] Song | Quantum Security of NMAC and Related Constructions -PRF Domain Extension Against Quantum attacks[END_REF] do not seem tight, and they do not match the best upper bound known.It remains to show that if Saturnin is a qPRP, then ℎp𝑘¨q is a qPRF of 𝑘. Let 𝐸 𝑘 be a block cipher with block size 𝑛. Then for any number of queries 𝑞 and time 𝒯 :Adv 𝑚Þ Ñ𝐸 𝑘 p𝑚q'𝑚 qPRF p𝑞, 𝒯 q ď Adv 𝐸 𝑘 qPRF p𝑞, 𝒯 q . Indeed,if 𝒜 is a qPRF distinguisher for 𝑚 Þ Ñ 𝐸 𝑘 p𝑚q ' 𝑚, we can create a qPRF distinguisher ℬ for 𝐸 𝑘 as follows: ℬ runs 𝒜. Whenever 𝒜 queries 𝑚 Þ Ñ 𝐸 𝑘 p𝑚q ' 𝑚, ℬ queries 𝐸 𝑘 p𝑚q and XORs 𝑚. If the oracle is a random function, feedforwarding keeps the output random and the result is unchanged.

	Lemma 10.1. Adv	𝑚Þ Ñ𝐸 𝑘 p𝑚q'𝑚 qPRF	p𝑞, 𝒯 q ď Adv 𝐸 𝑘 qPRP p𝑞, 𝒯 q	2 𝑛 `𝒪ˆ𝑞 3	˙.
	Proof. First of all, we show that:
		𝐻 ℓ 𝑘 qPRF p𝑞q ď 34ℓ𝑞 3{2	b	Adv	ℎp𝑘,¨q qPRF p4𝑞q .

We consider that Eve is the mastermind behind this quantum attack.

Note that the exponents for 5 and 7 are slightly below those of[NS20]. This comes from our redefinition of merging trees, with less constraints than before. This is the only difference with the results of[NS20] in this chapter.

In[BNS19b], a slightly smaller count of

250.3 is obtained, because the S-Box differential equations are assumed to cost less with respect to an S-Box.

October

2 Contrary to the TV series of the same name, no animals were harmed during the production of Saturnin. During the shooting of the series, more than 50 ducklings had to play the role of Saturnin, as they often died or grew up too fast[START_REF] Ridet | Saturnin, Rintintin, Flipper... le douloureux destin des animaux stars[END_REF].

The detail of the specification, and the illustrations, are taken from[Can+20].

Codename: poussin.

Codename: parmentier de canard.

Codename: faturnin.

Thus putting aside biclique cryptanalysis and the accelerations of exhaustive search.

October 2020

It can be found on this webpage.

Including many conjectures made by the author of these lines.

The use of a personal pronoun emphasizes that, while all of these works are collaborative, the opinions drawn here are personal.

Remerciements

Chapter 8 Cryptanalysis Based on Symmetries

In this chapter, we will present cryptanalysis results on two of the 32 second-round candidates of the NIST lightweight cryptography project [START_REF]Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process[END_REF]: Spook [START_REF] Bellizia | Spook: Sponge-Based Leakage-Resilient Authenticated Encryption with a Masked Tweakable Block Cipher[END_REF] and Gimli [START_REF] Daniel | Gimli. Submission to NIST-LWC[END_REF]. These results were respectively published in [Der+20] and [Fló+20]. Most of them are classical, although we will also obtain dedicated quantum cryptanalysis results on Gimli. But quantum cryptanalysis is a superset of classical cryptanalysis, and as we have remarked before, the latter retains all its importance. These results have in common that they draw on the power of internal symmetries. In both cases, the baseline primitive that we will analyze is a permutation with a quite large internal state, from 384 up to 512 bits. Notably, in the case of Spook, we will exploit the cancellation of round constants within the round function of the permutation. In the case of Gimli, we exploit the slowness of the diffusion. In both cases, we are able to create symmetric internal states and propagate this property through many rounds.

Both candidates are based on permutations and define an authenticated cipher (and a hash function for Gimli) using Sponges and duplexing. We will show that the above properties enable distinguishers on the full permutations. These distinguishers have low complexities and admit practical variants. In the case of Spook, the same properties intervene in a reduced-round forgery attack, and in the case of Gimli, in reduced-round collision attacks. L 1 p0, 𝑒 22 q " p1b880510, 6c06f000q L 1 p𝑒 22 , 0q " p36037800, 1b880510q L 1 p0, 𝑒 23 q " p37100a20, d80de000q L 1 p𝑒 23 , 0q " p6c06f000, 37100a20q , that is, a difference in positions 22 or 23 does not influence the first four columns (those on which the constants are added). Thus, after applying the first S-Box layer and the linear layer:

Contents

p𝐿 ˝𝑆qp𝑥q ' p𝐿 ˝𝑆qp𝑥 ' 𝛼q " p˚, ˚, ..., ˚, 0, 0, 0, 0q .

The constant addition only modifies the four first columns, on which there is no difference. Thus, after the second S-Box layer, the difference between these columns remain the same. Meanwhile, the difference between columns 31 to 4 is independent of the constants, thus of the Super S-Box chosen.

Besides, the difference is a function of columns 31 to 4 of p𝐿 ˝𝑆qp𝑥q and p𝐿 ˝𝑆qp𝑥 ' 𝛼q (since only another 𝑆 is applied afterwards). Columns 31 to 4 of p𝐿 ˝𝑆qp𝑥 ' 𝛼q are a function of columns 31 to 4 of p𝐿 ˝𝑆qp𝑥q and of 𝛼, since the introduction of 𝛼 does not modify any of the first 4 columns. By inverting 𝑆, p𝐿 ˝𝑆qp𝑥q is a function of 𝜎p𝑥q, which completes the result. Lemma 8.2 allows to define a vector space ∇ Ă pF 2 4 q 32 that contains 2 16 ´1 such non-zero differences, by taking any non-zero difference in columns 22 and 23 of the bundle:

∇ " t𝑎 ˆ𝑒22 `𝑏 ˆ𝑒23 , 𝑎 P F 4 2 , 𝑏 P F 4 2 u , where the multiplications are done in the finite field F 4 2 . In order to satisfy conditions (8.7) and (8.8), we start from a 3-identical state 𝑋 3 " p𝑥 3 , 𝑥 3 , 𝑥 3 , 𝑦 3 q at the beginning of Step 3. We invert Step 2 on this state, obtaining a state 𝑋 2 " p𝑥 2 , 𝑦 2 , 𝑧 2 , 𝑡 2 q that is not 3-identical anymore. Then we add a difference 𝛼 from the subspace ∇ to three bundles of this state, obtaining 𝑋 1 2 " p𝑥 2 ' 𝛼, 𝑦 2 ' 𝛼, 𝑧 2 ' 𝛼, 𝑡 2 q. We now use the observation of Lemma 8.2 to show that the difference after the Super S-Boxes 𝜎 0 , 𝜎 1 , 𝜎 2 in Step 2 is the same 𝛽. Together with the 3-identicality of 𝑋 3 , this implies that 𝑋 1 3 is 3-identical.

Lemma 8.3. Let 𝑋 3 " p𝑥 3 , 𝑥 3 , 𝑥 3 , 𝑦 3 q be a 3-identical state, 𝑋 2 " p𝑥 2 , 𝑦 2 , 𝑧 2 , 𝑡 2 q be the state obtained after inverting Step 2. Let 𝛼 be a difference in ∇. Then:

Proof. We invert the D layer and the constant addition on 𝑋 3 . There exists a quadruple of values 𝑐 0 , 𝑐 1 , 𝑐 2 , 𝑐 3 , that are nonzero only on columns 0 to 3, such that the obtained state has the form: p𝑦 3 ' 𝑐 0 , 𝑦 3 ' 𝑐 1 , 𝑦 3 ' 𝑐 2 , 𝑥 3 ' 𝑐 3 q (these 𝑐 𝑖 correspond to the inversion of D on the round constant addition). With this notation, we have: 𝑥 2 " 𝜎 ´1 0 p𝑦 3 ' 𝑐 0 q, 𝑦 2 " 𝜎 ´1 1 p𝑦 3 ' 𝑐 1 q, 𝑧 2 " 𝜎 ´1 2 p𝑦 3 ' 𝑐 2 q. " 𝑘 1 r3s ' 𝑆p𝑘 4 r15sq ' 𝑆p𝑘 4 r11s ' 𝑘 4 r15sq 𝑘 2 r4-7s " 𝑘 4 r0-3s ' 𝑘 4 r4-7s

.

Proof. The AES-256 key schedule is represented in Figure 9.2. We have: 𝑘 2 r0s " 𝑘 0 r0s ' 𝑆p𝑘 1 r13sq; 𝑘 2 r4s " 𝑘 0 r0s ' 𝑘 0 r4s ' 𝑆p𝑘 1 r13sq; . . . and in particular, 𝑘 0 r10s " 𝑘 2 r10s ' 𝑘 2 r6s and 𝑘 0 r15s " 𝑘 2 r11s `𝑘2 r15s.

Besides, the same relations hold between 𝑘 4 and 𝑘 2 , so: 𝑘 2 r10s " 𝑘 4 r10s ' 𝑘 4 r6s, 𝑘 2 r6s " 𝑘 4 r6s ' 𝑘 4 r2s, 𝑘 2 r11s " 𝑘 4 r7s ' 𝑘 4 r11s and 𝑘 2 r15s " 𝑘 4 r11s ' 𝑘 4 r15s, so: 𝑘 0 r10s " 𝑘 4 r2s ' 𝑘 4 r10s and 𝑘 0 r15s " 𝑘 4 r7s ' 𝑘 4 r15s .

When 𝑖 is odd, the first column of 𝑘 𝑖 is equal to the first column of 𝑘 𝑖´2 , to which we add the last column of 𝑘 𝑖´1 , going through S-Boxes. Hence: 𝑘 5 r3s " 𝑘 3 r3s ' 𝑆p𝑘 4 r15sq and 𝑘 3 r3s " 𝑘 1 r3s ' 𝑆p𝑘 2 r15sq, so: 𝑘 5 r3s " 𝑘 1 r3s ' 𝑆p𝑘 4 r15sq ' 𝑆p𝑘 4 r11s ' 𝑘 4 r15sq .

Exhaustive Search

In order to compare it with our attacks, we must first focus on the exhaustive search of the key. The first quantum resource estimates were done in [START_REF] Grassl | Applying Grover's Algorithm to AES: Quantum Resource Estimates[END_REF] and they have been improved afterwards in [Alm+18; LPS19], with the best estimates to date obtained in [START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF]. The estimates used in [BNS19b] were those of [START_REF] Grassl | Applying Grover's Algorithm to AES: Quantum Resource Estimates[END_REF], but we will use [START_REF] Jaques | Implementing Grover Oracles for Quantum Key Search on AES and LowMC[END_REF] here, for a meaningful comparison.

Full-Round AES Key Search

Quantum exhaustive search requires one or two plaintext-ciphertext pairs p𝑝 𝑖 , 𝑐 𝑖 q depending on the key length 𝜅. Then it applies a quantum search QSearch to find a key 𝑘 such that:

There is always a solution, but there may be false positives. By using two pairs with AES-128, two with AES-192 and three with AES-256, we obtain a negligible probability that a false positive exists (which is important, as in this case, the procedure may fail). 𝑘 0 r10s " 𝑘 4 r2s ' 𝑘 4 r10s ùñ 𝑘 0 r10s " 𝑥 4 r2s ' 𝑥 4 r10s ' ℓ 2 p𝑦 3 r0, 5, 10, 15sq ' ℓ 2 p𝑦 3 r8, 13, 2, 7sq (9.3) 𝑘 0 r15s " 𝑘 4 r7s ' 𝑘 4 r15s ùñ 𝑘 0 r15s " 𝑥 4 r7s ' 𝑥 4 r15s ' ℓ 3 p𝑦 3 r3, 4, 9, 14sq ' ℓ 3 p𝑦 3 r1, 6, 11, 12sq (9.4) 𝑘 5 r3s " 𝑘 1 r3s ' 𝑆p𝑘 4 r15sq ' 𝑆p𝑘 4 r11s ' 𝑘 4 r15sq ùñ 𝑥 5 r3s ' ℓ 3 p𝑦 4 r0, 5, 10, 15sq " 𝑘 1 r3s ' 𝑆 ´𝑥4 r15s ' ℓ 3 p𝑦 3 r1, 6, 11, 12sq ' 𝑆 ´𝑥4 r15s ' ℓ 3 p𝑦 3 r1, 6, 11, 12sq ' 𝑥 4 r11s ' ℓ 3 p𝑦 3 r8, 13, 2, 7sq ¯(9.5) 𝑘 2 r4-7s " 𝑘 4 r0-3s ' 𝑘 4 r4-7s ùñ 𝑥 2 r4-7s ' 𝑀 𝐶p𝑦 1 r3, 4, 9, 14sq " 𝑥 4 r0-3s ' 𝑀 𝐶p𝑦 3 r0, 5, 10, 15sq ' 𝑥 4 r4-7s ' 𝑀 𝐶p𝑦 3 r3, 4, 9, 14sq ùñ ℓp𝑥 2 r4-7sq ' 𝑦 1 r3s " ℓp𝑥 4 r0-3sq ' 𝑦 3 r0s ' ℓp𝑥 4 r4-7sq ' 𝑦 3 r3s (9.6) Sieving with the state equations. After Step 14 in our attack, we have two choices for each byte of 𝑥 2 r0-3s (one column of 𝑥 2 ), each byte of 𝑥 3 , each of 𝑥 4 and each byte of 𝑥 5 r3, 4, 9, 14s,which are solutions of the corresponding differential equations. We use the 4 key relations (9.3) to (9.6), which are translated into relations between these bytes, to sieve them. As there are 40 bit-degrees of freedom and 4 byte constraints, we expect 2 8 possibilities to pass. These relations turn out to constrain completely 32 of the byte values and leave the 8 others free: these 8 bytes appear in none of the relations. This is represented in Figure 9.8, with the bytes of 𝑥 2 , 𝑥 3 , 𝑥 4 and 𝑥 5 concerned. We consider that the states 𝑥 2 , 𝑥 3 , 𝑥 4 , 𝑥 5 are independent, due to the MixColumns or SubBytes operations traversed.

Classical Complexity

There are three nested Samples in Algorithm 9.6. We compute their complexity from the outermost to the innermost one.

Sampling the key guesses (

Step 2). We guess 10 key bytes; there are thus 2 10ˆ8 possibilities. We expect exactly one of them to be good. Given such a guess, we can compute the good pair (Line 3) in 2 53 S-Boxes, and start to compute the middle states. Compute the associated 𝛿-seq. of differences in 𝛿𝑤 5 r5s Ź oracle queries 5:

Compute 𝑥 1 r3s, 𝑥 1 1 r3s and obtain Δ𝑥 2 r4-7s

6:

Compute 𝑥 6 r5s, 𝑥 1 6 r5s and obtain Δ𝑦 5 r3, 4, 9, 14s Store the two solutions for each byte 11:

From Δ𝑦 2 r4-7s, compute Δ𝑥 3 12:

From Δ𝑥 5 r3, 4, 9, 14s, compute Δ𝑦 4 13:

Match Δ𝑥 4 against Δ𝑦 4 and Δ𝑥 3 , column by column.

14:

if they do not match abort Ź prob. 2 ´8 for each column Ź Here, one guess over 2 40 has passed the S-Box differential equations 15:

Write (9.3) for all 2 10 choices of 𝑥 4 r2s, 𝑥 4 r10s, 𝑦 3 r0, 5, 10, 15, 8, 13, 2, 7s 4 of them are expected to pass. Store them.

16:

Write (9.4) for all 2 10 choices of 𝑥 4 r7s, 𝑥 4 r15s, 𝑦 3 r3, 4, 9, 14, 1, 6, 11, 12s 4 of them are expected to pass. Store them.

17:

For each of the 4 ˆ4 stored choices and 2 4 choices of 𝑥 5 r3s, 𝑥 4 r0, 5, 11s, write Equation (9.5): one of these 2 8 possibilities is expected to pass Ź The full state 𝑦 3 and 𝑥 4 r0, 2, 5, 7, 10, 11, 15s, 𝑥 5 r3s are now determined.

18:

For these bytes and each 2 8 choices of 𝑥 2 r4-7s, 𝑥 4 r1, 3, 4, 6s, write Equation (9.6): one choice is expected to pass Ź In the end, the full state 𝑥 3 is determined, alongside 𝑥 5 r3s, 𝑥 2 r4-7s and 𝑥 4 r0-7, 10, 11, 15s. Bytes 𝑥 4 r8, 9, 12, 13, 14s and 𝑥 5 r4, 9, 14s remain free.

19:

Sample choices for 𝑥 4 r8, 9, 12, 13, 14s and 𝑥 5 r4, 9, 14s such that Ź There are exactly 2 8 possibilities to explore 20:

Since the whole sequence of states 𝑥 2 r4, 5, 6, 7s, 𝑥 3 , 𝑥 4 , 𝑥 5 r3, 4, 9, 14s is known, compute the expected 𝛿-sequence in 𝛿𝑤 5 r5s Ź 2 5 ˆ40 S-Boxes

21:

If it does not equal the expected sequence, abort If there is no solution, abort 26: EndSample Saturnin is then used in block cipher operation modes for AEAD and hashing that benefit from quantum security guarantees, and that are immune to the Q2 attacks based on Simon's algorithm explored in Chapter 4.

In this chapter, we present the specification of Saturnin, its rationale and security claims; we give a security analysis of the cipher and its modes of operation.

Contents

Introduction

The objective of Saturnin is to provide a lightweight and quantum secure family of symmetric algorithms. Quantum security is mentioned in the report on lightweight cryptography NISTIR8114 [START_REF]Report on Lightweight Cryptography[END_REF].

When long-term security is needed, these algorithms should either aim for post-quantum security, or the application should allow them to be easily replaceable by algorithms with post-quantum security.

Before getting to the specification, let us give some general thoughts about the constraints of a quantum-secure cipher and how to build one.

Algorithm 10.1 Saturnin block encryption

In/Out: X P pF 16 2 q 16 , K P pF 16 2 q 16 , 𝑅 P N, 𝐷 P F 4 2 1: X Ð X ' K 2: RC 0 Ð 0xfe00|p𝑅 ! 4q|𝐷; RC 1 Ð RC 0 3: for all 𝑟 from 0 to 𝑅 ´1 do // First round of the super-round 4:

X Ð SpXq for all 𝑗 from 0 to 15 do 18:

A slice in the cube corresponds to bits with indices p𝑖, 𝑏q such that t𝑏{4u is constant, while a sheet corresponds to bits with indices p𝑖, 𝑏q such that p𝑏 mod 4q is constant. Therefore, the columns in the cube are composed of bits p𝑖, 𝑏q with a constant 𝑏 in the registers. The transformations involved in the round function of Saturnin are then implemented as follows.

S-box layer. The 4-bit S-boxes 𝜎 0 and 𝜎 1 are applied in parallel, each over a half of the whole state. As can be seen in Figure 10.2, these permutations are such that 𝜎 0 " 𝜋 0 ˝𝜎 and 𝜎 1 " 𝜋 1 ˝𝜎 where 𝜎 is another S-Box, 𝜋 0 and 𝜋 1 are bit permutations. Their action on the index of the bits in each nibble is given in Table 10.2.

In the register representation, the S-Boxes are applied in a bitsliced fashion over all registers with indices 4𝑖 `0, ..., 4𝑖 `3, where 𝑖 P t0, 2u for 𝜎 0 and 𝑖 P t1, 3u for 𝜎 1 . The full parallel application of the S-Boxes is denoted S and, in the register representation, Theorem 10.1 (From [START_REF] Bellare | Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm[END_REF]). Encrypt-then-MAC is IND-CCA secure if the underlying encryption scheme is IND-CPA secure and the MAC is SUF-CMA secure:

SUF´CMA p𝑞 𝑒 , 𝑞 𝑑 , 𝒯 q `Adv 𝐸 𝑘 IND´CPA p𝑞 𝑒 , 𝒯 q . In addition to this strong security reduction, the encrypt-then-MAC composition allows to reject forgeries without even decrypting the ciphertext.

IND-qCPA

Indistinguishability against quantum chosen-plaintext attacks (IND-qCPA) is one of the first quantum security notions introduced in the literature. It takes into account some of the Q2 attacks recalled in Chapter 4. We adapt the definition given by Boneh and Zhandry [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF], as it considers initially an encryption scheme based on randomness. Hereafter, IND-qCPA will denote the adaptation for a nonce.

In this game, superposition access to the messages is allowed. As remarked in Section 10.2.7, nonces, message and AD lengths remain classical values. The encryption oracle Encrypt 𝑘 is replaced by a family of standard oracles parameterized by a choice of nonce and input length. For simplicity, we omit these additional parameters and denote by 𝑂 Encrypt 𝑘 any of these oracles. As in the classical game, nonces are not repeated.

IND-qCPA game

Key generation: 𝑘

Challenge queries: 𝒜 chooses two message / AD pairs of same lengths 𝑎 0 , 𝑚 0 , 𝑎 1 , 𝑚 1 , a nonce 𝑁 that has not been used before; the challenger responds with Encrypt 𝑘 `𝑁, 𝑎 𝑏 , 𝑚 𝑏 ˘.

Encryption queries: 𝒜 chooses a message and AD length, a nonce 𝑁 that has not been used before and calls 𝑂 Encrypt 𝑘 on her input registers.

Guess: 𝒜 produces a bit 𝑏 1 and wins if 𝑏 " 𝑏 1 .

In this game, the encryption queries are quantum, while the challenge queries are classical. Intuitively, IND-qCPA security prevents key-recovery attacks based on Simon's algorithm; if the adversary finds the key, then it is able to distinguish between the classical challenges. Conversely, modes which are known not to be IND-qCPA secure usually admit such powerful breaks.

Both the power and the limits of the IND-qCPA definition can be illustrated on encryption modes that XOR a pseudo-random keystream to their input. On the positive side, it is very easy to prove the IND-qCPA security of such a mode. Conjecture 10.1. There exists no quantum algorithm that, on input a random function ℎ, outputs a collision of ℎ, runs in time 𝒯 and uses a quantum memory ℳ 𝑞 , with: 𝒯 5 ¨ℳ𝑞 ă 2 2𝑛 . Conjecture 10.1 formalizes the idea that if one tries to go below the point 𝒯 " 2 2𝑛{5 , a massive quantum memory has to be used (we shall not specify which type, but QRACM seems sufficient). This conjecture is implicit in the collision security claim of Saturnin-Hash, which takes into account the amount of quantum memory given to the adversary. Thus, should a better quantum collision algorithm disprove Conjecture 10.1, it could also break the security claim.

Otherwise, the best time achievable is (roughly) 2 85 with a QRACM of size 2 85 , given by Algorithm 2.10. Without qRAM, the best quantum time known is 2 102 , given by Algorithm 5.1.

Rationale of the Block Cipher

We have previously specified the block cipher Saturnin and its bitsliced representation, which motivates some of the design choices. In this section, we explain the rest of the design by trying to obtain the best resistance against linear, differential, algebraic, invariant and related-key attacks. We introduce notably the Super S-Box representation of Saturnin, which will be used in the security analysis of Section 10.5.

Super S-Box Representation

The general structure of Saturnin mimics the AES, which is arguably the best understood symmetric primitive. Let us denote by S 16 the 16-bit Super S-Box in Saturnin, i.e., the permutation of F 16 2 composed of the succession of an S-Box layer, the linear MDS function 𝑀 , and a second S-Box layer. The composition of two rounds of indices p2𝑟, 2𝑟 `1q can then be seen as the application of this Super S-Box to each column of the internal state, followed by SR ´1 2𝑟`1 ˝MC ˝SR 2𝑟`1 .

• If 𝑟 is even, then the slices are invariant under SR 2𝑟`1 . This implies that the linear layer SR ´1 2𝑟`1 ˝MC ˝SR 2𝑟`1 consists of the concatenation of four copies of the same function L 64 of pF 16 2 q 4 , which applies to the slices independently.

• If 𝑟 is odd, then the sheets are invariant under SR 2𝑟`1 . In this case, the linear layer consists of the concatenation of four copies of the same function L 64 , which applies to the sheets independently. Moreover, it is easy to prove, e.g., by Theorem 1 in [START_REF] Albrecht | Block Ciphers -Focus on the Linear Layer (feat. PRIDE)[END_REF], that L 64 has branch number 5 with respect to F 16 2 .

Let us then represent in a 4 ˆ4 matrix C the 16-bit words C 0,0 , . . . , C 3,3 corresponding to the 16 columns of the cube, where C 𝑖,𝑗 corresponds to the column defined by 𝑥 " 𝑖, 𝑧 " 𝑗. This means that each slice in the cube is a column of the matrix C, while each sheet in the cube is a row of C. When 𝑟 is even, the linear function L 64 applies to the

Security of the Block Cipher against Classical Attacks

Differential cryptanalysis. The Super S-Box 𝑆 16 has differential uniformity 80, so the highest probability for a non-trivial differential is 80 ˆ2´16 " 2 ´9.68 . The AES structure guarantees that any four consecutive rounds have at least 25 active Super S-Boxes. This implies that the best differential characteristics over 4 super-rounds and 8 super-rounds have probability at most 2 ´241.9 and 2 ´483.9 respectively. Moreover, it is worth noticing that the proportion of differentials for the Super S-Box with probability higher than 2 ´10 is very small since there are only 110 such differentials (among 2 32 ); moreover, all these 110 differentials have exactly five active nibbles.

Linear cryptanalysis. The linearity of the Super S-Box is equal to 3072, or equivalently the maximal squared correlation for a linear relation equals 3072 2 ˆ2´32 " 2 ´8.83 . By the same arguments as previously, we deduce that the highest squared correlation for a linear trail (linear potential) over 4 rounds and over 8 rounds is at most 2 ´220.7 and 2 ´441.5 respectively. Algebraic degree. It is estimated in [START_REF] Canteaut | Saturnin. Submission to NIST-LWC (2nd Round)[END_REF], using standard arguments, that the full algebraic degree of Saturnin is reached after five super-rounds.

Bicliques. The exhaustive search attack with bicliques [START_REF] Bogdanov | Biclique Cryptanalysis of the Full AES[END_REF] always allows to gain a small factor against the baseline exhaustive key search, by testing all the keys faster than an evaluation of the cipher. It is applicable to Saturnin, as to any cipher, with a likely transposition of the results previously obtained for AES. This does not contradict our security claims.

Impossible differential attacks. Impossible differential attacks were introduced by Knudsen [Knu94] and by Biham, Biryukov and Shamir [START_REF] Biham | Cryptanalysis of Skipjack Reduced to 31 Rounds Using Impossible Differentials[END_REF]. As we saw in Chapter 9, they provide some of the best known attacks on reduced-round AES [START_REF] Boura | Making the Impossible Possible[END_REF], together with the Demirci-Selçuk MITM attacks [START_REF] Demirci | A Meet-in-the-Middle Attack on 8-Round AES[END_REF]. To date, the best impossible differential attack on AES-128 [START_REF] Boura | Making the Impossible Possible[END_REF] targets 7 rounds and it requires, with 2 105 chosen plaintexts, a time of 2 106.88 and memory of 2 74 . We estimate that a similar impossible differential attack can be applied to 7 super-rounds of Saturnin, with twice these complexity exponents. As the key-schedule of Saturnin is simpler than that of the AES, it may be possible to extend this attack to 7.5 super-rounds, or even 8 super-rounds, which would be a very impressive result.

DS-MITM attacks.

A classical DS-MITM attack similar to the ones of Section 9.6 is given in [START_REF] Canteaut | Saturnin. Submission to NIST-LWC (2nd Round)[END_REF]. This is currently the best key-recovery on reduced-round Saturnin, reaching 7.5 super-rounds.

Subspace trails. Recent distinguishers on 5-round AES [Sun+16; GRR17; RBH17; Gra18] and improved attacks on reduced-round versions [START_REF] Bar-On | Improved Key Recovery Attacks on Reduced-Round AES with Practical Data and Memory Complexities[END_REF] have used the existence