Simon's Algorithm for the Even-Mansour Cipher on Quantum Hardware

TL;DR

This paper demonstrates the practical application of Simon's quantum algorithm to cryptanalyze the Even-Mansour cipher on current NISQ hardware, successfully recovering small keys and highlighting scalability challenges.

Contribution

It provides the first proof of concept quantum cryptanalysis of the Even-Mansour cipher on NISQ devices, with experimental results for small key sizes and insights into scalability issues.

Findings

Successfully recovered secret keys for N=3 and N=4 on ibm_miami.

Identified memory bottleneck in circuit optimization at N=5.

Showed Simon's algorithm is effective for small-scale quantum cryptanalysis.

Abstract

Simon's algorithm is a polynomial period-finding algorithm that has been used to exploit the algebraic structure of specific symmetric ciphers, showing that exponential speedups in their cryptanalysis are theoretically possible. While the theoretical framework for an attack using Simon's algorithm on the Even-Mansour cipher is well-established, practical implementations on noisy intermediate-scale quantum (NISQ) hardware remain limited. This paper presents a proof of concept quantum cryptanalysis of the Even-Mansour cipher using Simon's period-finding algorithm on NISQ hardware. For N = 3 and N = 4, we successfully demonstrate secret key recovery for N-bit constructions on the ibm_miami processor. Our experiments also identify a scaling limitation in the classical pre-processing stage: The DORCIS circuit optimization tool encountered a memory bottleneck at N = 5, preventing the generation of optimized circuits for larger key lengths. Our results suggest firstly that Simon's algorithm is effective for the Even-Mansour cipher for short bit lengths on current quantum hardware. Secondly, while DORCIS is effective for the small-scale S-boxes for which it was designed, there remains a need for the investigation of more scalable and efficient synthesis tools capable of handling larger and more general permutations in the context of Even-Mansour ciphers.