Quantum Query Lower Bounds for Key Recovery Attacks on the Even-Mansour Cipher

TL;DR

This paper establishes that any quantum algorithm attempting to recover the key of the Even-Mansour cipher requires at least linear quantum queries, confirming the optimality of previous quantum attacks.

Contribution

It proves a lower bound of (n) quantum queries for key recovery, showing the optimality of known quantum attacks even with adaptive queries.

Findings

Quantum query complexity for key recovery is (n)

Previous quantum attack is optimal up to a constant factor

Quantum security of EM cipher is well-characterized against quantum adversaries

Abstract

The Even-Mansour (EM) cipher is one of the famous constructions for a block cipher. Kuwakado and Morii demonstrated that a quantum adversary can recover its $n$-bit secret keys only with $O(n)$ nonadaptive quantum queries. While the security of the EM cipher and its variants is well-understood for classical adversaries, very little is currently known of their quantum security. Towards a better understanding of the quantum security, or the limits of quantum adversaries for the EM cipher, we study the quantum query complexity for the key recovery of the EM cipher and prove every quantum algorithm requires $\Omega(n)$ quantum queries for the key recovery even if it is allowed to make adaptive queries. Therefore, the quantum attack of Kuwakado and Morii has the optimal query complexity up to a constant factor, and we cannot asymptotically improve it even with adaptive quantum queries.