Quantum Security Analysis of AES

• Published in: IACR Transactions on Symmetric Cryptology Vol. 2019; no. 2; pp. 55 - 93
• Main Authors: Bonnetain, Xavier, Naya-Plasencia, María, Schrottenloher, André
• Format: Journal Article
• Language: English
• Published: Ruhr Universität Bochum 11.06.2019; Ruhr-Universität Bochum
• Subjects: AES; classical cryptanalysis; Computer Science; Cryptography and Security; quantum algorithms; quantum cryptanalysis; security margin; symmetric cryptanalysis; Quantum algorithms; Post-quantum security; Quantum cryptanalysis; Classical crypt-analysis; Symmetric cryptanalysis; Security margin; DS-meet-in-the-middle; Amplitude amplification; Square attack; AES
• DOI: 10.13154/tosc.v2019.i2.55-93
• ISSN: 2519-173X

In this paper we analyze for the first time the post-quantum security of AES. AES is the most popular and widely used block cipher, established as the encryption standard by the NIST in 2001. We consider the secret key setting and, in particular, AES-256, the recommended primitive and one of the few existing ones that aims at providing a post-quantum security of 128 bits. In order to determine the new security margin, i.e., the lowest number of non-attacked rounds in time less than 2^128 encryptions, we first provide generalized and quantized versions of the best known cryptanalysis on reduced-round AES, as well as a discussion on attacks that don't seem to benefit from a significant quantum speed-up. We propose a new framework for structured search that encompasses both the classical and quantum attacks we present, and allows to efficiently compute their complexity. We believe this framework will be useful for future analysis. Our best attack is a quantum Demirci-Selçuk meet-in-the-middle attack. Unexpectedly , using the ideas underlying its design principle also enables us to obtain new, counter-intuitive classical TMD trade-offs. In particular, we can reduce the memory in some attacks against AES-256 and AES-128. One of the building blocks of our attacks is solving efficiently the AES S-Box differential equation, with respect to the quantum cost of a reversible S-Box. We believe that this generic quantum tool will be useful for future quantum differential attacks. Judging by the results obtained so far, AES seems a resistant primitive in the post-quantum world as well as in the classical one, with a bigger security margin with respect to quantum generic attacks.