Pith. sign in

REVIEW 3 major objections 5 minor 47 references

Offline dedicated quantum attacks on block cipher constructions based on two parallel permutation-based pseudorandom functions

T0 review · 3 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper establishes that block-cipher constructions built from two parallel permutation-based pseudorandom functions can be key-recovered by an offline quantum attack that needs far fewer oracle queries than previous ones.

desk verdict Offline dedicated attack is a real advance for the identity-map instantiations, but the generic TPP-PRF claim rests on an unflagged truncation/linear-map assumption. read the letter →

arxiv 2510.14475 v4 pith:OPHKA7KJ submitted 2025-10-16 quant-ph

Xiao-Fan Zhen , Zhen-Qiang Li , Jia-Cheng Fan , Su-Juan Qin , Fei Gao This is my paper · ORCID
classification quant-ph MSC 81P9494A60
keywords offlinequantumattackXOR-typefunctiontruncationtechniquepermutation-basedpseudorandomEven-MansourconstructionSoEM22PolyMACcryptanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that four block-cipher constructions built from two parallel public permutations—XopEM, SoEM22, SUMPIP, and DS-SoEM—hide a periodic structure that a quantum attacker can exploit without needing continuous access to the encryption oracle. The trick is to rewrite the construction as a decoupled XOR-type function, in which the key-dependent part is public, so the attacker can prepare a useful quantum state from one branch and then do the expensive search offline. The claimed payoff is quantitative: in the quantum-query model the number of queries to the encryption oracle drops from O(2^((n+t)/2) (n-t)) to O(2^t (n-t)), and in the classical-query model both query and time complexity fall from O~(2^(2n/3)) to O~(2^((2n-t)/3)). The paper also shows that the MAC scheme PolyMAC falls to the earlier online version of the attack, answering an open question about which structures are vulnerable.

What carries the argument

The central object is the decoupled (public) XOR-type function, f(i,x)=g1(x) XOR p(x XOR i), with p public. Combined with the truncation technique—summing over a t-dimensional subspace L of low bits—it produces F_L(i^l,x^l) whose period in the high (n-t) bits is the secret period s^l, while the low key bits cancel out. Because the public branch can be evaluated offline, the algorithm separates an online preparation phase for the g1 superposition from an offline search phase, which is what converts the attack from online to offline.

What would settle it

Take a concrete TPP-PRF with a non-identity linear map l13 that mixes high and low bit positions, choose small n (e.g., n=6) and t=2, compute F_L of Eq. (8) by exhaustive enumeration, and test whether F_L(i_0^l,x^l)=F_L(i_0^l,x^l XOR s^l) holds for all x^l; if it does not, the central claim for generic TPP-PRFs fails. The same experiment with identity maps should reproduce the period, confirming the split is the load-bearing condition.

Watch

Extended reading notes

Core claim

For any decoupled XOR-type function f(i,x)=g1(x) XOR p(x XOR i) coming from a TPP-PRF, summing f over the low t-bit subspace L yields a function F_L(i^l,x^l) that has an (n-t)-bit period s^l exactly when the high bits of the secret state i equal i_0^l. Since p is public, the only part that needs the encryption oracle is g1, and the attack (Algorithm 4) prepares the state for G_L^1 once and then runs amplitude-amplification search offline over candidate i^l, recovering i_0^l and s^l. The paper claims Theorem 4: O(2^t (n-t)) quantum queries in the Q2 model, or O(2^(p+t)) classical queries with O(2^((2n-2t-p)/2) n^3) offline time in Q1, with a balanced optimum at O~(2^((2n-t)/3)). The same meth

Load-bearing premise

The whole truncated-function argument assumes the linear maps used inside the TPP-PRF respect the decomposition into high and low bits, so that summing over the low subspace cancels the low key bits and leaves the high period; for arbitrary n-bit linear maps this is false, and for SoEM22/XopEM it holds only because those maps are identities.

Editorial extensions

If this is right

  • XopEM, SoEM22, SUMPIP, and DS-SoEM can be key-recovered by the offline attack.
  • In the Q2 model the oracle-query count is reduced from O(2^((n+t)/2) (n-t)) to O(2^t (n-t)); in Q1 both queries and time drop from O~(2^(2n/3)) to O~(2^((2n-t)/3)).
  • The attack produces the tradeoff T^2 D = 2^(2n-t) between classical queries D and offline quantum time T, so an attacker can choose a resource profile.
  • After recovering the high bits, the remaining t low key bits can be found with an offline period-finding step, giving full key recovery.
  • PolyMAC is a new target for the online XOR-type attack, extending the class of vulnerable constructions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the linear maps inside a TPP-PRF mix high and low bit positions instead of acting independently on the split, the truncated function is unlikely to have the claimed period; a designer could immunize the construction by ensuring such mixing.
  • The same decoupling idea may convert attacks on other two-branch public-permutation constructions (e.g., EDM/EDMD-style functions) into offline attacks whenever one branch is public.
  • The tunable truncation parameter t gives a knob that trades recovered key bits against query cost, which could be exploited to fit the attack on resource-constrained quantum devices.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes offline dedicated quantum key-recovery attacks on block cipher constructions built from two parallel permutation-based pseudorandom functions (TPP-PRFs). It first identifies PolyMAC as a new instance vulnerable to the online dedicated attack of Shi et al., then introduces a 'decoupled' p-XOR-type function and presents Algorithm 4, an offline dedicated attack that uses truncation. The claimed results are: in the Q2 model, encryption-oracle query complexity O(2^t(n-t)) instead of O(2^{(n+t)/2}(n-t)); in the Q1 model, a query/time tradeoff T^2 D = 2^{2n-t} balancing at O~(2^{(2n-t)/3}). Concrete instantiations XopEM, SoEM22, SUMPIP, and DS-SoEM are treated, and Theorem 4 is stated for generic decoupled XOR-type functions.

Significance. If the generic claim were fully established, the paper would answer an open question of Shi et al. and improve on both the online dedicated attack and the Q1 results of Sun et al. The offline-separation idea and the concrete identity-map instantiations are genuinely interesting, and the reported Q2 query reduction for SoEM22 and related schemes is plausible. However, the paper's central generic derivation for TPP-PRFs rests on an unstated blockwise-linearity assumption, and the full-key Q1 complexity claim is not supported by the stated algorithms. These issues are load-bearing and need correction before the contribution can be evaluated as claimed.

major comments (3)
  1. [Section III-B1, Eq. (8)] The derivation of the period of F^L assumes that the n-bit linear maps l13, l23, l14, l24 act blockwise on the p/(n-t-p)/t decomposition. Expressions such as '(l13 y ⊕ l14 k^{l1}_1)∥l14 k^{l2}_1∥0^t' and 'j^{l2} = l13^{-1}l14 k^{l2}_1' are only meaningful if these maps are block-diagonal; for an arbitrary invertible GF(2)-linear map, applying it to a split input mixes the components, and the displayed equality in the lines following Eq. (8) does not follow. In particular, the period condition requires the middle part of the vector s = l13^{-1}l14(k1), which equals l13^{-1}l14(k1^{l2}) only under a blockwise assumption. The same issue affects i^l = l23^{-1}l24 k^l_2. Thus Theorem 4 is not established for generic TPP-PRFs; the supported cases are those where the l maps are identity or at least blockwise on the chosen split.
  2. [Section III-B2, after Theorem 4] The paper claims that the remaining t-bit key can be recovered by applying the offline Simon algorithm, and the abstract/conclusion state a balanced O~(2^{(2n-t)/3}) classical-query complexity. In the Q1 model, however, running offline Simon on the full n-bit function would require O(2^n) classical queries to prepare the necessary superposition, which dominates O~(2^{(2n-t)/3}). Theorem 4's bound is only for recovering the high (kappa-t) bits (and the period). If the authors intend only partial-key recovery, the abstract and conclusion should say so; if they claim full-key recovery, the stated complexity is incorrect.
  3. [Section III-A1, Eq. (3)] The PolyMAC formula uses undefined notation 'k2_1' and 'k2_3', and the claimed period relation s=(k1⊕k3)(β0⊕β1) with α_i=k1(β0⊕β1) or k3(β0⊕β1) is not derivable from the displayed equation as written. Since PolyMAC is presented as the first new instance answering Shi et al.'s open question, this is a load-bearing part of the paper and must be corrected and expanded with a clear definition of the scheme.
minor comments (5)
  1. [Eq. (8)] The domain of F^L is given as {0,1}^{n-t} × {0,1}^{n-t-p} × {0,1}^p, but the first argument is written as i^l∥j^{l2}, which has length 2n-2t-p. The types should be made consistent.
  2. [Section III-B1] The notation l=l1∥l2 is used both for the index in Eq. (8) and for the original key l; this is confusing. Also, 'l1' and 'l2' are used as both bit lengths and strings.
  3. [Eq. (3)] If 'k2_1' and 'k2_3' are intended to be k1^2 and k3^2, this should be written unambiguously with a definition of the finite-field multiplication.
  4. [Algorithm 4] The prepared state notation is missing parentheses: it should clearly indicate tensor products over c' copies of the superposition. The line breaks in the description also make the algorithm harder to read.
  5. [Eq. (6)] The condition 'l_ij ≠ 0' should be supplemented by invertibility or a precise blockwise condition; the paper's later truncation arguments rely on such structure.

Circularity Check

0 steps flagged · score 1.0 of 10

No circularity: the offline attack applies known Simon/offline-Simon/dedicated-XOR techniques to TPP-PRFs; claimed periods are derived explicitly, with the only self-citations used as baselines or auxiliary verification.

full rationale

The central derivation (Section III-B1, Eqs. 7-8) constructs a p-XOR-type function f from the TPP-PRF and explicitly verifies the period s^{l1}=l13^{-1}l14 k1^{l1} by expanding F_L at the claimed key. This is a mathematical derivation from the construction, not an assumption of the conclusion. Algorithm 4/Theorem 4 combine the offline Simon algorithm [34] and Shi et al.'s truncated dedicated attack [37]; the query counts follow from the algorithm structure, not from parameters fitted to the target. The self-citations [35,36] are used for baseline comparisons and for a periodicity fact that the text also derives in place; they are not invoked as an unverified uniqueness theorem and are not the only support for the central claim. The known gap concerning the high/low-bit split assumption for general linear maps l_{ij} is a correctness concern about the scope of the derivation, not a circular reduction: Eq. (8) implicitly assumes blockwise action, and if that fails F_L need not be periodic, but the derivation is still not equivalent by definition to its output. Hence no circular step is identified.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No empirical constants are fitted. The main ledger items are the truncation-compatible linear-map assumption (ad hoc, load-bearing for the generic TPP-PRF claim) and the unstated QRAM-style lookup for state preparation. The t and p trade-off parameters are algorithm choices, not fitted values.

free parameters (2)
  • truncation parameter t = 0 < t < n (e.g., t = n/2 for the balanced Q1 tradeoff)
    Chosen by hand to balance query and time complexity; not fitted to data, but part of the attack's trade-off.
  • partition parameter p = 0 < p < n-t; balanced choice p+t = (2n-t)/3
    Chosen by hand to balance classical query D=2^{p+t} and offline time T=2^{(2n-2t-p)/2}; not fitted to data.
assumptions (5)
  • standard math Simon's algorithm and the offline Simon's algorithm (Bonnetain et al. 2019) are correct under the stated promise of a unique hidden period.
    Used as black boxes in Theorems 1-2 and Algorithm 4-5.
  • domain assumption The encryption oracle can be queried in superposition in Q2 and classically in Q1; both models permit arbitrary offline quantum computation after the online phase.
    Standard Q1/Q2 threat model in quantum cryptanalysis; defines the attack setting.
  • domain assumption The random permutations P1, P2 (and block cipher E in PolyMAC) behave so that the periodicity of f(i,x) is unique or near-unique for the actual key.
    The attack needs a small set of candidate keys i0 in the searched space; with arbitrary permutations this is expected but not proven.
  • ad hoc to paper The linear maps l13, l23, l14, l24 in the generic TPP-PRF derivation can be truncated blockwise: applying them to x^l||0^t XOR u preserves the split into high and low parts as used in Eq. (8).
    Not stated in the paper and false for general GF(2^n) linear maps; it is the hinge of the generic TPP-PRF period proof.
  • domain assumption Preparing |psi_GL> from O(2^p) classical queries can be done with a unitary that writes GL(x^l) into a quantum register at negligible extra cost (Algorithm 6).
    Requires QRAM or an exponentially large lookup circuit; common but unstated in offline Simon attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Offline dedicated quantum attacks on block cipher constructions based on two parallel permutation-based pseudorandom functions." pith.science (2026). https://pith.science/paper/OPHKA7KJ

@misc{pith2026251014475,
  author       = {Pith},
  title        = {Pith review of: Offline dedicated quantum attacks on block cipher constructions based on two parallel permutation-based pseudorandom functions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OPHKA7KJ}},
  note         = {Machine review of arXiv:2510.14475}
}
abstract

Quantum cryptanalysis is essential for evaluating the security of cryptographic systems against the threat of quantum computing. Recently, Shi {\it et al.} introduced a dedicated quantum attack on block cipher constructions based on XOR-type functions, which greatly reduces the required resources (including circuit depth, width, and the number of gates) compared to the parallel Grover-meets-Simon algorithm. Here, our contribution is in two aspects. On the one hand, we discover new cryptographic structures amenable to this attack: PolyMAC and constructions based on two parallel permutation-based pseudorandom functions (TPP-PRFs), including XopEM, SoEM22, SUMPIP, and DS-SoEM, thereby answering Shi {\it et al.}' s open question. On the other hand, for constructions based on TPP-PRFs, we break the obstacle that this attack relies on online query by constructing decoupled XOR-type functions, then propose an offline quantum attack on them. Compared to previous results, our offline attack exhibits significantly reduced query complexity. Specifically, the number of queries to the encryption oracle is reduced from $O(2^{(n+t)/2}\cdot (n-t))$ to $O(2^{t}\cdot (n-t))$ in the quantum query model, where $0<t<n$, $t$ is a truncation parameter, and $n$ is the input length of constructions. Further, we enable its implementation in the classical query model, optimizing both the classical query complexity and time complexity from $\tilde O(2^{2n/3})$ to $\tilde O(2^{(2n-t)/3})$ for $0<t \leq n/2$.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 1 linked inside Pith

  1. [1]

    Quantum algorithm for linear systems of equations,

    A. W. Harrow, A. Hassidim, and S. Lloyd, “Quantum algorithm for linear systems of equations,”Physical review letters, vol. 103, no. 15, p. 150502, 2009

    2009

  2. [2]

    Asymptotic quantum algorithm for the toeplitz systems,

    L.-C. Wan, C.-H. Yu, S.-J. Pan, F. Gao, Q.-Y . Wen, and S.-J. Qin, “Asymptotic quantum algorithm for the toeplitz systems,”Physical Review A, vol. 97, no. 6, p. 062322, 2018

    2018

  3. [3]

    Potential quantum advantage for simulation of fluid dynamics,

    X. Li, X. Yin, N. Wiebe, J. Chun, G. K. Schenter, M. S. Cheung, and J. M ¨ulmenst¨adt, “Potential quantum advantage for simulation of fluid dynamics,”Phys. Rev. Res., vol. 7, p. 013036, Jan 2025

    2025

  4. [4]

    An efficient quan- tum proactive incremental learning algorithm,

    L. Li, J. Li, Y . Song, S. Qin, Q. Wen, and F. Gao, “An efficient quan- tum proactive incremental learning algorithm,”Science China Physics, Mechanics & Astronomy, vol. 68, no. 1, p. 210313, 2025

    2025

  5. [5]

    Power of data in quantum machine learning,

    H.-Y . Huang, M. Broughton, M. Mohseni, R. Babbush, S. Boixo, H. Neven, and J. R. McClean, “Power of data in quantum machine learning,”Nature communications, vol. 12, no. 1, p. 2631, 2021

    2021

  6. [6]

    Variational quantum algorithms,

    M. Cerezo, A. Arrasmith, R. Babbush, S. C. Benjamin, S. Endo, K. Fujii, J. R. McClean, K. Mitarai, X. Yuan, L. Cincioet al., “Variational quantum algorithms,”Nature Reviews Physics, vol. 3, no. 9, pp. 625– 644, 2021

    2021

  7. [7]

    Noise-induced barren plateaus in variational quantum algorithms,

    S. Wang, E. Fontana, M. Cerezo, K. Sharma, A. Sone, L. Cincio, and P. J. Coles, “Noise-induced barren plateaus in variational quantum algorithms,”Nature communications, vol. 12, no. 1, p. 6961, 2021

    2021

  8. [8]

    Topology-driven quantum architecture search framework,

    J. Su, J. Fan, S. Wu, G. Li, S. Qin, and F. Gao, “Topology-driven quantum architecture search framework,”Science China Information Sciences, vol. 68, no. 8, p. 180507, 2025

    2025

Show all 47 references
  1. [9]

    Resource-efficient adaptive variational quantum algorithm for combi- natorial optimization problems,

    S.-Y . Wu, Y .-Q. Song, R.-Z. Li, S.-J. Qin, Q.-Y . Wen, and F. Gao, “Resource-efficient adaptive variational quantum algorithm for combi- natorial optimization problems,”Advanced Quantum Technologies, p. 2400484, 2025

    2025

  2. [10]

    Quantum hamiltonian algorithms for maximum independent sets,

    X. Zhao, P. Ge, H. Yu, L. You, F. Wilczek, and B. Wu, “Quantum hamiltonian algorithms for maximum independent sets,”National Sci- ence Review, vol. 12, no. 9, p. nwaf304, 2025

    2025

  3. [11]

    Quantum- assisted hierarchical fuzzy neural network for image classification,

    S. Wu, R. Li, Y . Song, S. Qin, Q. Wen, and F. Gao, “Quantum- assisted hierarchical fuzzy neural network for image classification,” IEEE Transactions on Fuzzy Systems, 2024

    2024

  4. [12]

    Image classification with rotation-invariant variational quantum circuits,

    P. S. S. Sein, M. Ca ˜nizo, and R. Or ´us, “Image classification with rotation-invariant variational quantum circuits,”Physical Review Re- search, vol. 7, no. 1, p. 013082, 2025

    2025

  5. [13]

    A variational eigenvalue solver on a photonic quantum processor,

    A. Peruzzo, J. McClean, P. Shadbolt, M.-H. Yung, X.-Q. Zhou, P. J. Love, A. Aspuru-Guzik, and J. L. O’brien, “A variational eigenvalue solver on a photonic quantum processor,”Nature communications, vol. 5, no. 1, p. 4213, 2014

    2014

  6. [14]

    A quantum federated learning framework for classical clients,

    Y . Song, Y . Wu, S. Wu, D. Li, Q. Wen, S. Qin, and F. Gao, “A quantum federated learning framework for classical clients,”Science China Physics, Mechanics & Astronomy, vol. 67, no. 5, p. 250311, 2024

    2024

  7. [15]

    Algorithms for quantum computation: discrete logarithms and factoring,

    P. Shor, “Algorithms for quantum computation: discrete logarithms and factoring,” inProceedings 35th Annual Symposium on Foundations of Computer Science, 1994, pp. 124–134

    1994

  8. [16]

    A fast quantum mechanical algorithm for database search,

    L. K. Grover, “A fast quantum mechanical algorithm for database search,” inProceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing, 1996, pp. 212–219

    1996

  9. [17]

    Re- ducing quantum resources for attacking s-aes on quantum devices,

    Z. Wang, M. Zheng, J. Wu, K. Wen, S. Wei, and G.-L. Long, “Re- ducing quantum resources for attacking s-aes on quantum devices,”npj Quantum Information, vol. 11, no. 1, p. 157, 2025

    2025

  10. [18]

    Variational quantum attacks threaten advanced encryption standard based symmetric cryptog- raphy,

    Z. Wang, S. Wei, G.-L. Long, and L. Hanzo, “Variational quantum attacks threaten advanced encryption standard based symmetric cryptog- raphy,”Science China Information Sciences, vol. 65, no. 10, p. 200503, 2022

    2022

  11. [19]

    Variational quantum solutions to the shortest vector problem,

    M. R. Albrecht, M. Prokop, Y . Shen, and P. Wallden, “Variational quantum solutions to the shortest vector problem,”Quantum, vol. 7, p. 933, 2023

    2023

  12. [20]

    Quantum-classical hybrid algorithm for solving the learning-with-errors problem on nisq devices,

    M. Zheng, J. Zeng, W. Yang, P.-J. Chang, Q. Lu, B. Yan, H. Zhang, M. Wang, S. Wei, and G.-L. Long, “Quantum-classical hybrid algorithm for solving the learning-with-errors problem on nisq devices,”Commu- nications Physics, vol. 8, no. 1, p. 208, 2025

    2025

  13. [21]

    Analysis of learning with errors problems with variational quantum algorithms,

    J. Zeng, M. Zheng, H. Li, S. Wei, and G. Long, “Analysis of learning with errors problems with variational quantum algorithms,”Europhysics Letters, vol. 150, no. 5, p. 58001, 2025

    2025

  14. [22]

    On the power of quantum computation,

    D. Simon, “On the power of quantum computation,” inProceedings 35th Annual Symposium on Foundations of Computer Science, 1994, pp. 116–123

    1994

  15. [23]

    Quantum distinguisher between the 3-round feistel cipher and the random permutation,

    H. Kuwakado and M. Morii, “Quantum distinguisher between the 3-round feistel cipher and the random permutation,” in2010 IEEE JOURNAL OF LATEX CLASS FILES, VOL. XX, NO. X, XXXX XXXX 9 international symposium on information theory. IEEE, 2010, pp. 2682– 2685

    2010

  16. [24]

    Security on the quantum-type even-mansour cipher,

    ——, “Security on the quantum-type even-mansour cipher,” in2012 International Symposium on Information Theory and its Applications, 2012, pp. 312–316

    2012

  17. [25]

    Quantum attacks on sum of even-mansour pseudorandom functions,

    K. Shinagawa and T. Iwata, “Quantum attacks on sum of even-mansour pseudorandom functions,”Information Processing Letters, vol. 173, p. 106172, 2022

    2022

  18. [26]

    Quantum related-key attack based on simon’s algorithm and its applications,

    P. Zhang, “Quantum related-key attack based on simon’s algorithm and its applications,”Symmetry, vol. 15, no. 5, p. 972, 2023

    2023

  19. [27]

    Grover meets simon–quantumly attacking the fx-construction,

    G. Leander and A. May, “Grover meets simon–quantumly attacking the fx-construction,” inInternational conference on the theory and application of cryptology and information security. Springer, 2017, pp. 161–178

    2017

  20. [28]

    Quantum key-recovery attack on feistel struc- tures,

    X. Dong and X. Wang, “Quantum key-recovery attack on feistel struc- tures,”Science China Information Sciences, vol. 61, no. 10, p. 102501, 2018

    2018

  21. [29]

    Quantum chosen-ciphertext attacks against feistel ciphers,

    G. Ito, A. Hosoyamada, R. Matsumoto, Y . Sasaki, and T. Iwata, “Quantum chosen-ciphertext attacks against feistel ciphers,” inCryptog- raphers’ Track at the RSA Conference. Springer, 2019, pp. 391–411

    2019

  22. [30]

    Quantum attacks on lai-massey structure,

    S. Mao, T. Guo, P. Wang, and L. Hu, “Quantum attacks on lai-massey structure,” inInternational Conference on Post-Quantum Cryptography. Springer, 2022, pp. 205–229

    2022

  23. [31]

    Simon’s algorithm and sym- metric crypto: Generalizations and automatized applications,

    F. Canale, G. Leander, and L. Stennes, “Simon’s algorithm and sym- metric crypto: Generalizations and automatized applications,” inAnnual International Cryptology Conference. Springer, 2022, pp. 779–808

    2022

  24. [32]

    Attacks on beyond-birthday- bound macs in the quantum setting,

    T. Guo, P. Wang, L. Hu, and D. Ye, “Attacks on beyond-birthday- bound macs in the quantum setting,” inInternational Conference on Post-Quantum Cryptography. Springer, 2021, pp. 421–441

    2021

  25. [33]

    Quantum at- tacks on beyond-birthday-bound macs,

    H.-W. Sun, B.-B. Cai, S.-J. Qin, Q.-Y . Wen, and F. Gao, “Quantum at- tacks on beyond-birthday-bound macs,”Physica A: Statistical Mechanics and its Applications, vol. 625, p. 129047, 2023

    2023

  26. [34]

    Quantum attacks without superposition queries: the offline simon’s algorithm,

    X. Bonnetain, A. Hosoyamada, M. Naya-Plasencia, Y . Sasaki, and A. Schrottenloher, “Quantum attacks without superposition queries: the offline simon’s algorithm,” inInternational conference on the theory and application of cryptology and information security. Springer, 2019, p...

    2019

  27. [35]

    Quantum attacks on sum of even-mansour construction utilizing online classical queries,

    Z. Li, S. Fan, F. Gao, Y . Hao, H. Sun, X. Hu, and D. Li, “Quantum attacks on sum of even-mansour construction utilizing online classical queries,”EPJ Quantum Technology, vol. 12, no. 1, p. 67, 2025

    2025

  28. [36]

    Quantum key-recovery attacks on permutation-based pseudorandom functions,

    H.-W. Sun, F. Gao, R.-X. Xu, D.-D. Li, Z.-Q. Li, and K.-J. Zhang, “Quantum key-recovery attacks on permutation-based pseudorandom functions,”IEEE Internet of Things Journal, 2025

    2025

  29. [37]

    Dedicated quantum attacks on xor-type function with applications to beyond-birthday-bound macs,

    T. Shi, W. Wu, B. Hu, J. Guan, H. Sui, S. Wang, and M. Zhang, “Dedicated quantum attacks on xor-type function with applications to beyond-birthday-bound macs,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 5971–5984, 2024

    2024

  30. [38]

    Quantum amplitude amplification and estimation,

    G. Brassard, P. Hoyer, M. Mosca, and A. Tapp, “Quantum amplitude amplification and estimation,”arXiv preprint quant-ph/0005055, 2000

    2000 arXiv

  31. [39]

    Tight bounds for simon’s algorithm,

    X. Bonnetain, “Tight bounds for simon’s algorithm,” inInternational Conference on Cryptology and Information Security in Latin America. Springer, 2021, pp. 3–23

    2021

  32. [40]

    Tight security bounds for double-block hash-then-sum macs,

    S. Kim, B. Lee, and J. Lee, “Tight security bounds for double-block hash-then-sum macs,” inAnnual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 2020, pp. 435–465

    2020

  33. [41]

    How to build pseudorandom functions from public random permutations,

    Y . L. Chen, E. Lambooij, and B. Mennink, “How to build pseudorandom functions from public random permutations,” inAnnual International Cryptology Conference. Springer, 2019, pp. 266–293

    2019

  34. [42]

    Luby-rackoff backwards: Increasing security by making block ciphers non-invertible,

    M. Bellare, T. Krovetz, and P. Rogaway, “Luby-rackoff backwards: Increasing security by making block ciphers non-invertible,” inInter- national Conference on the Theory and Applications of Cryptographic Techniques. Springer, 1998, pp. 266–280

    1998

  35. [43]

    Beyond-birthday secure domain-preserving prfs from a single permutation,

    C. Guo, Y . Shen, L. Wang, and D. Gu, “Beyond-birthday secure domain-preserving prfs from a single permutation,”Designs, Codes and Cryptography, vol. 87, no. 6, pp. 1297–1322, 2019

    2019

  36. [44]

    Cencpp*: beyond- birthday-secure encryption from public permutations,

    A. Bhattacharjee, A. Dutta, E. List, and M. Nandi, “Cencpp*: beyond- birthday-secure encryption from public permutations,”Designs, Codes and Cryptography, vol. 90, no. 6, pp. 1381–1425, 2022

    2022

  37. [45]

    Quantum attacks on type-1 generalized feistel schemes,

    H.-W. Sun, B.-B. Cai, S.-J. Qin, Q.-Y . Wen, and F. Gao, “Quantum attacks on type-1 generalized feistel schemes,”Advanced Quantum Technologies, vol. 6, no. 10, p. 2300155, 2023

    2023

  38. [46]

    Ewcdm: an efficient, beyond-birthday secure, nonce-misuse resistant mac,

    B. Cogliati and Y . Seurin, “Ewcdm: an efficient, beyond-birthday secure, nonce-misuse resistant mac,” inAnnual International Cryptology Conference. Springer, 2016, pp. 121–149

    2016

  39. [47]

    Encrypted davies-meyer and its dual: Towards optimal security using mirror theory,

    B. Mennink and S. Neves, “Encrypted davies-meyer and its dual: Towards optimal security using mirror theory,” inAnnual International Cryptology Conference. Springer, 2017, pp. 556–583

    2017

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.