Quantum meet-in-the-middle attack method and system for aes, electronic equipment and storage medium

Abstract

The application discloses a quantum meet-in-the-middle attack method and system for AES, electronic equipment and a storage medium, relates to the technical field of block cipher analysis, and is divided into a pre-computation stage and an online query stage. In the pre-computation stage, the present quantum attack exhaustively enumerates 11 byte parameters of a decision output partial differential sequence of a 4-round AES truncated differential distinguisher, calculates a differential sequence of a first byte of an output partial differential sequence of the differential distinguisher, and stores the differential sequence in a comparison table. In the online query stage, the present quantum attack online queries a reduced-round AES to obtain corresponding plaintext and ciphertext, exhaustively enumerates key bytes affected by input and output differentials of the 4-round AES truncated differential distinguisher, calculates a differential sequence of the first byte of the output partial differential sequence of the differential distinguisher, and then finds the same differential sequence generated in the two stages by using a quantum search algorithm, so that the corresponding key can be recovered; and thus the problem that the time complexity of the current quantum attack for AES is high is solved.

Description

Technical Field

[0001] This invention relates to the field of block cipher analysis technology, and in particular to a quantum encounter-in-the-middle attack method, system, electronic device, and storage medium for AES. Background Technology

[0002] AES (Advanced Encryption Standard) is one of the most widely used block cipher algorithms due to its excellent performance across various platforms. Security analysis of AES has long been a hot research topic in the field of cryptanalysis. With the continuous development of quantum computing technology, analyzing the security of AES in a quantum environment using the parallel characteristics of quantum computing has become a newly emerging and rapidly developing research direction in recent years.

[0003] Currently, existing technologies have proposed quantum square attacks against 7-round AES-192 and AES-256. This attack characterizes the square attack as a multi-layered nested search and utilizes an amplitude amplification algorithm to accelerate the search at each layer. Compared to the classical encounter-in-the-middle attack, this quantum attack can reduce the time complexity by at least [amount missing]. factor.

[0004] Currently, existing technologies have proposed quantum impossible differential attacks, which have been applied to 7 rounds of AES-192. The impossible differential attack mainly consists of two phases: a differential pair collection phase and a phase of filtering differential pairs based on partially guessed key pairs. By reconstructing the filtering step into a quantum search process, a significant speedup compared to the classical version can be achieved. Compared to the aforementioned quantum SQUARE attack method, the time complexity can be further reduced. Factors. However, the most effective classical analysis method for reduced-round AES is the encounter-in-the-middle attack. How to accelerate the encounter-in-the-middle attack using quantum algorithms, thereby reducing the time complexity, remains one of the challenges. Summary of the Invention

[0005] To address the above technical problems, this invention provides a quantum encounter-in-the-middle attack method for AES, comprising the following steps: Pre-computation stage: Based on the set truncated difference distinguisher, exhaustively enumerate some intermediate states related to the truncated difference distinguisher, and use the exhaustively enumerated intermediate states as the first state set; calculate the pre-computation difference sequence based on the first state set, and construct the mapping relationship between the first state set and the pre-computation difference sequence space. Online query phase: Construct plaintext set and obtain corresponding ciphertext set, and store plaintext-ciphertext pairs containing plaintext set and ciphertext set in quantum random access memory (QRAM); An initial quantum state is prepared, and the partial subkeys associated with the truncated differential distinguisher are enumerated. The space corresponding to the partial subkeys is taken as the partial subkey space. Based on the zero state, a superposition state containing the partial subkey space and the set of plaintext pairs is constructed through a Hadamard gate. The corresponding ciphertext in the quantum random access memory is queried using the plaintext superposition state to obtain the initial quantum state, which includes the partial subkey space, the set of plaintext pairs, and the corresponding set of ciphertext pairs. The quantum amplitude amplification algorithm is used to search for plaintext pairs that satisfy the input and output differences of the truncated differential discriminator and their corresponding ciphertext pairs, and the filtered quantum state is obtained. The quantum state includes a partial subkey space, a set of filtered plaintext pairs and a set of corresponding ciphertext pairs. In the filtered quantum state, based on any subkey value in the partial subkey space, any pair of plaintexts in the filtered plaintext pair set is encrypted to the intermediate state of the truncated differential discriminator input. All possible differences of the first byte are enumerated. The intermediate state is XORed with all possible differences, and the plaintext corresponding to all possible differences is calculated in reverse according to the subkey value. The ciphertext corresponding to the newly calculated plaintext is obtained by querying the quantum random access memory (QRAM). Then, based on any subkey value in the partial subkey space, all ciphertexts are decrypted to the first byte of the intermediate state of the truncated differential output, forming an online differential sequence. The partial subkey space and the filtered plaintext pair set are used as the second state set. The quantum collision search algorithm is used to find collisions between the online difference sequence and the pre-computed difference sequence in the mapping relationship constructed in the pre-computation stage, and the correct partial key is determined based on the collision results; The quantum amplitude amplification algorithm is used to search for and recover the remaining key in the remaining key space excluding the partial subkey space.

[0006] The technical solution further defined in this invention is: Furthermore, the pre-computation phase specifically includes: Exhaustively enumerate the intermediate states at both ends of the differential divider; By utilizing the differential characteristics of the S-box in the AES algorithm, the state values ​​of intermediate state bytes subject to differential constraints on the propagation path of the truncated differential discriminator are determined based on partial intermediate states. By combining the linear characteristics of row shifting, column obfuscation, and key XOR operation in the AES algorithm, the pre-computed difference sequence is derived and calculated in both forward and reverse directions.

[0007] The quantum encounter-in-the-middle attack method against AES described above includes the following steps in storing the plaintext-ciphertext pair into a quantum random access memory (QRAM): Construct multiple structures, and exhaustively enumerate all possible values ​​of the active plaintext byte in each structure to form a plaintext pair. All plaintext bytes in the structure except the active plaintext byte are fixed constants. Obtain the ciphertext pairs corresponding to all plaintext pairs. The plaintext pairs and ciphertext pairs together form a plaintext-ciphertext pair. Plaintext pairs and their corresponding ciphertext pairs are stored as key-value data in a quantum random access memory (QRAM) for querying in quantum state superposition.

[0008] The quantum intermediate encounter attack method for AES described above, specifically for preparing the initial quantum state, is as follows: Prepare a superposition state containing a key that needs to be guessed, and a superposition state containing plaintext pairs and ciphertext pairs; By applying a Hadamard gate to the zero state and combining it with QRAM querying techniques, an initial quantum state containing joint information of key and plaintext-ciphertext pairs is prepared.

[0009] The quantum encounter attack method against AES described above, which utilizes a quantum collision search algorithm to find collisions, specifically includes the following steps: Randomly select a subset of size 1 from the first set of states, and sort the elements in the subset according to the difference sequence values; A subset of the second size is randomly selected from the second set of states, and the corresponding quantum states are prepared. For any element in the second-sized subset, perform a binary search on the sorted first-sized subset to determine if the collision condition is met. By combining the quantum amplitude amplification algorithm for elements in the second-scale subset, element pairs that satisfy the collision condition are searched and output in the first-scale and second-scale subsets. The element pairs include elements from the first state set and the second state set, respectively. The correct partial key is confirmed based on the element pairs.

[0010] As mentioned earlier, the quantum intermediate encounter attack method against AES uses an 8-round AES-256 algorithm for the reduced-round AES; correspondingly, the truncated differential discriminator is a 4-round AES truncated differential discriminator.

[0011] As mentioned earlier, the quantum encounter attack method against AES uses the quantum amplitude amplification algorithm to search for and recover the remaining key. Specifically, the quantum amplitude amplification algorithm is used to search for the remaining 56 bits of the key excluding the part of the key determined by the collision.

[0012] This invention also provides a quantum encounter-in-the-middle attack system against AES, including... The pre-computation module is used to exhaustively enumerate some intermediate states related to the truncated difference distinguisher based on the set truncated difference distinguisher, and use the exhaustively enumerated intermediate states as the first state set; calculate the pre-computation difference sequence based on the first state set, and construct the mapping relationship between the first state set and the pre-computation difference sequence space. The storage and preparation module is used to construct a plaintext set and obtain the corresponding ciphertext set. It stores plaintext-ciphertext pairs containing the plaintext and ciphertext sets into a quantum random access memory (QRAM). It also exhaustively enumerates the partial subkeys associated with the truncated differential distinguisher and uses the space corresponding to the partial subkeys as the partial subkey space. Based on the zero state, it constructs a superposition state containing the partial subkey space and the plaintext pair set through a Hadamard gate. It uses the plaintext superposition state to query the corresponding ciphertext in the quantum random access memory to obtain the initial quantum state, which includes the partial subkey space, the plaintext pair set, and the corresponding ciphertext pair set. The quantum filtering module is used to search for plaintext pairs and their corresponding ciphertext pairs that satisfy the input and output difference of the truncated differential discriminator using the quantum amplitude amplification algorithm, and obtain the filtered quantum state, which includes a partial subkey space, a set of filtered plaintext pairs and a set of corresponding ciphertext pairs. The intermediate encounter module is used to, within the filtered quantum state, encrypt any pair of plaintexts in the filtered plaintext pair set to an intermediate state of the truncated differential distinguisher input based on any subkey value in the partial subkey space. It exhaustively enumerates all possible differences for the first byte, XORs the intermediate state with all possible differences, and then calculates the plaintext corresponding to all possible differences based on the subkey value. It queries the quantum random access memory (QRAM) to obtain the ciphertext corresponding to the newly calculated plaintext. Then, based on any subkey value in the partial subkey space, it decrypts all ciphertexts to the first byte of the intermediate state of the truncated differential output, forming an online differential sequence. The partial subkey space and the filtered plaintext pair set are used as the second state set. A quantum collision search algorithm is used to find collisions between the online differential sequence and the pre-calculated differential sequence in the mapping relationship constructed in the pre-computation stage, and the correct partial key is determined based on the collision results. The remaining key recovery module is used to search for and recover the remaining key in the remaining key space, excluding the partial subkey space, using a quantum amplitude amplification algorithm.

[0013] The present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program executable by the processor, and the processor executes the computer program to implement the above-described quantum intermediate encounter attack method against AES.

[0014] The present invention also provides a storage medium on which a computer program is stored. When the computer program is read and executed, the above-mentioned quantum intermediate encounter attack method against AES is implemented.

[0015] The beneficial effects of this invention are: (1) In this invention, by dividing the encounter-in-the-middle attack against AES into a pre-computation stage and an online query stage, and using a 4-round AES truncation differential distinguisher as the core discrimination condition for the connection between the two stages, the attack process no longer depends on the direct exhaustive search of the complete key space. In the pre-computation stage, some intermediate states related to the truncation differential propagation path are exhaustively searched first. The differential characteristics of the S-box in AES and the linear propagation law of row shift, column confusion, key XOR and other operations are used to construct the mapping relationship of "partial intermediate state - differential sequence" in advance. In the online query stage, it is only necessary to calculate the corresponding online differential sequence based on the candidate partial subkey and the filtered plaintext and ciphertext, and perform collision matching with the pre-computation result. This design splits the key guessing, differential propagation and state matching process that were originally coupled together into two smaller and clearer subproblems from the technical principle, reducing repeated calculations, reducing the computational burden of the online stage, and making the encounter-in-the-middle attack of AES more suitable for combination with the quantum search process, thereby effectively reducing the time complexity of the reduced-round AES key recovery attack. (2) In this invention, by introducing the quantum amplitude amplification algorithm, the QRAM superposition query mechanism, and the quantum collision search algorithm into the AES intermediate encounter attack process, quantum acceleration of the candidate plaintext pair, partial subkey, and differential sequence matching process is achieved. Specifically, the QRAM is used to store the structured plaintext set and its corresponding ciphertext, enabling the algorithm to query plaintext and ciphertext information in parallel under the quantum superposition state. The quantum amplitude amplification algorithm is used to screen effective plaintext pairs from the large-scale plaintext pair set that satisfy the input and output differential conditions of the 4-round AES truncation differential distinguisher, thereby avoiding the enumeration of each pair in the classical scenario. The high overhead of screening; the quantum collision search algorithm is further used to find collisions between pre-computed difference sequences and online difference sequences, and to determine the correct partial key accordingly; this technical approach is not a simple application of Grover's search to the classical exhaustive process, but combines the AES differential propagation structure, intermediate encounter matching conditions and quantum search model, so that the quantum algorithm only operates on the critical search space after the truncated difference constraint, which improves the search's targeting and effectiveness, and provides a less complex attack implementation method for quantum security analysis of reduced round AES such as 8-round AES-256. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the overall process of the present invention; Figure 2 This is a schematic diagram of a four-round AES cutoff differential divider in an embodiment of the present invention; Figure 3 This is a schematic diagram of the round function of AES in an embodiment of the present invention; Figure 4 This is a schematic diagram of the differential features of 8 rounds of AES in an embodiment of the present invention. Detailed Implementation

[0017] This embodiment provides a quantum encounter attack method against AES, such as... Figure 1 As shown, it includes the following steps: Pre-computation stage: Based on the set truncated difference distinguisher, exhaustively enumerate some intermediate states related to the truncated difference distinguisher, and use the exhaustively enumerated intermediate states as the first state set; calculate the pre-computation difference sequence based on the first state set, and construct the mapping relationship between the first state set and the pre-computation difference sequence space.

[0018] The pre-computation stage specifically includes: exhaustively enumerating some intermediate states at both ends of the truncated differential distinguisher; utilizing the differential characteristics of the S-box in the AES algorithm, determining the state values ​​of intermediate state bytes subject to differential constraints on the propagation path of the truncated differential distinguisher based on some intermediate states; and deriving and calculating the pre-computed differential sequence in both forward and reverse directions by combining the linear characteristics of row shifting, column obfuscation, and key XOR operations in the AES algorithm.

[0019] Online query phase: Construct the plaintext set and obtain the corresponding ciphertext set, and store the plaintext-ciphertext pairs containing the plaintext set and the ciphertext set in the quantum random access memory (QRAM).

[0020] The steps of storing plaintext-ciphertext pairs in a quantum random access memory (QRAM) include: constructing multiple structures, exhaustively listing all possible values ​​of the active plaintext byte within each structure to form a plaintext pair, wherein all plaintext bytes in the structure other than the active plaintext byte are fixed constants; obtaining the ciphertext pairs corresponding to all plaintext pairs, and the plaintext pairs and ciphertext pairs together form a plaintext-ciphertext pair; storing the plaintext pairs and their corresponding ciphertext pairs as key-value data in the QRAM for querying via quantum state superposition.

[0021] An initial quantum state is prepared by exhaustively enumerating the partial subkeys associated with the truncated differential distinguisher and using the space corresponding to the partial subkeys as the partial subkey space. Based on the zero state, a superposition state containing the partial subkey space and the set of plaintext pairs is constructed using a Hadamard gate. The corresponding ciphertext in the quantum random access memory is queried using the plaintext superposition state to obtain the initial quantum state, which includes the partial subkey space, the set of plaintext pairs, and the corresponding set of ciphertext pairs.

[0022] The specific method for preparing the initial quantum state is as follows: prepare a superposition state containing the key that needs to be guessed, and a superposition state containing plaintext and ciphertext information; by applying a Hadamard gate to the zero state and combining it with QRAM querying technology, prepare the initial quantum state containing the key and the joint information of plaintext and ciphertext pairs.

[0023] The quantum amplitude amplification algorithm (Brassard G, Høyer P, Mosca M, Tapp A. QuantumAmplitude Amplification and Estimation. Quantum Computation and Information. 53–74. (2002)) is used to search for plaintext pairs that satisfy the input and output differences of the truncated differential discriminator and their corresponding ciphertext pairs, thus obtaining the filtered quantum state, which includes a partial subkey space, the filtered set of plaintext pairs, and the corresponding set of ciphertext pairs.

[0024] In the filtered quantum state, based on any subkey value in the partial subkey space, any pair of plaintexts in the filtered plaintext pair set is encrypted to the intermediate state of the truncated differential discriminator input. All possible differences of the first byte are enumerated. The intermediate state is XORed with all possible differences, and the plaintext corresponding to all possible differences is calculated in reverse according to the subkey value. The ciphertext corresponding to the newly calculated plaintext is obtained by querying the quantum random access memory (QRAM). Then, based on any subkey value in the partial subkey space, all ciphertexts are decrypted to the first byte of the intermediate state of the truncated differential output, forming an online differential sequence. The partial subkey space and the filtered plaintext pair set are used as the second state set.

[0025] The quantum collision search algorithm is used to find collisions between the online difference sequence and the pre-computed difference sequence in the mapping relationship constructed in the pre-computation stage, and the correct partial key is determined based on the collision results.

[0026] The steps for finding collisions using the quantum collision search algorithm specifically include: Randomly select a subset of size 1 from the first set of states, and sort the elements in the subset according to the difference sequence values; A subset of the second size is randomly selected from the second set of states, and the corresponding quantum states are prepared. For any element in the second-sized subset, perform a binary search on the sorted first-sized subset to determine if the collision condition is met. By combining the quantum amplitude amplification algorithm for elements in the second-scale subset, element pairs that satisfy the collision condition are searched and output in the first-scale and second-scale subsets. The element pairs include elements from the first state set and the second state set, respectively. The correct partial key is confirmed based on the element pairs.

[0027] The quantum amplitude amplification algorithm is used to search for and recover the remaining key in the remaining key space excluding the partial subkey space; the quantum amplitude amplification algorithm is also used to search for the remaining 56 bits of key excluding the partial key determined by collision.

[0028] In one embodiment, such as Figure 2 As shown, the truncated differential divider is a 4-round AES truncated differential divider.

[0029] Each round of encryption in the AES algorithm is as follows: Figure 3 As shown, it consists of 4 operations, namely: Byte substitution (SB): Non-linear byte replacement is performed using the S-box; Row Shift (SR): Shifts the status byte cyclically by row; Column Mixing (MC): Performs a linear mixing transformation on the state column; Key XOR (ARK): XOR the intermediate state with the round key bitwise.

[0030] The symbols and variables used in this embodiment are explained below: Symbols and Variables , , , This can be interpreted as: In the i-th round of AES encryption: This represents the intermediate state after the key XOR operation in the (i-1)th round; This indicates the intermediate state after byte substitution; This indicates the intermediate state after row shifting; This indicates the intermediate state after column confusion.

[0031] Symbols and Variables , explained as: Let be the round key for the i-th round. Furthermore, let the whitened round key before the first round of encryption be denoted as . .

[0032] Symbols and Variables , , , , , explained as: Represents the intermediate state of the i-th round. The j-th byte (0≤j≤15). , , , The definition is similar. Furthermore, Representing state The Middle 1 byte.

[0033] Symbols and Variables This can be explained as follows: In some scenarios, it is necessary to swap the order of operations for column obfuscation and key XOR, therefore, an equivalent round key is defined: ,in This is the inverse transform of column mixing operations.

[0034] Symbols and Variables , , explained as: The set consists of 256 plaintexts The structured set consists of one active byte that iterates through all 256 possible values, and the remaining 15 bytes are fixed constants. For plain text The corresponding ciphertext.

[0035] Symbols and Variables , , , , interpreted as: plain text During the encryption process, the intermediate state of the i-th round The j-th byte is denoted as . , , The definition is similar.

[0036] Symbols and Variables , explained as: It can be used as a prefix for the above symbols to indicate difference.

[0037] In this embodiment, the specific technical solution is as follows: Pre-calculation stage: based on Figure 2 The 4-round AES truncation differential divider in the middle, exhaustively enumerate , , , and Calculate all sequences . Set to sequence space The mapping is defined as a function , , .

[0038] Step 1: Exhaustive search After byte substitution, it can be calculated that Then it is possible to construct Difference After row shifting and column scrambling operations, we can obtain kind .

[0039] Step 2, Exhaustive search It can be deduced in reverse. Then it is possible to construct Difference After further column obfuscation and row shifting operations, we can obtain kind .

[0040] Step 3 kind and kind Can be composed of right Based on the differential properties of the S-box in AES, for each pair It can be determined The value. Also, because this 4-round AES truncation differential divider is from both ends ( and (spreading towards the center) All possible values ​​are determined by , , , Sure.

[0041] Step 4: Exhaustive search ,calculate After the S-box operation, the difference sequence can be calculated. Since row shifting, column obfuscation, and key XOR are linear, it is possible to calculate... .according to The value can be calculated. .

[0042] Step 5, known Since row shifting, column obfuscation, and key XOR are linear, it is possible to calculate According to the calculation ,available Based on the calculated and The subkey bytes can be derived. Through subkey bytes and It can be calculated Because row shifting, column obfuscation, and key XOR are linear, the sequence can be computed. .

[0043] Online query stage: Step 6, Build There are *n* structures, and within each structure, all possible values ​​of P[0,5,10,15] are enumerated. Articles of text can form plaintext Then, classically query all plaintexts and their corresponding ciphertexts C. These plaintext and ciphertexts are then stored in QRAM (Quantum Random Access Memory).

[0044] Step 7: Prepare the initial state: ; in, This represents all keys affected by the 4-round AES truncation differential divider, with a size of ; Indicates plaintext and its corresponding ciphertext pair To prepare It can be prepared first. Then, QRAM technology is used to query the corresponding ciphertext to obtain... . and It can be used in the zero state through the Hadamard gate. Obtained from above.

[0045] Step 8. Use the quantum amplitude amplification algorithm to search for the input and output differences that satisfy the 4-round AES truncation differential divider. (Assume the probability of satisfying the input and output differential of a 4-round AES truncation differential is...) ), to obtain the quantum state: .

[0046] Step 9: Based on the filtered results Calculate the value. The value is used to obtain the quantum state: .

[0047] Step 10, according to The quantum state is calculated as follows: .

[0048] Step 11, according to and The value can be deduced from this. Then use QRAM technology to query Corresponding ciphertext The quantum state is obtained: .

[0049] Step 12, according to The value is calculated in The difference at each point constitutes a sequence The quantum state is obtained: ; Among them, the function Represents a set to sequence space The mapping, , .

[0050] Step 13: Use the following quantum algorithm to search for (x, y) such that F(x) = G(y), then... Corresponding key That is correct.

[0051] Collision search algorithm between functions F and G: i. From the set Randomly select a subset of size m .

[0052] ii. Sort the elements in set A according to the value of F(x).

[0053] iii. From the set Randomly select a size of subset of Preparation of quantum states .

[0054] iv. For any Perform a classic binary search on the sorted set A to determine if it exists. This satisfies F(a) = G(b); combined with the quantum amplitude amplification algorithm search of elements in set B, in Search for collisions.

[0055] v. Apply the quantum amplitude amplification algorithm to steps i-iv, and output the element pairs that satisfy F(x)=G(y). .

[0056] Step 14: Use the quantum amplitude amplification algorithm to search for... The remaining keys besides those.

[0057] In another embodiment, the reduced-round AES is an 8-round AES-256 algorithm; correspondingly, the truncated differential discriminator is a 4-round AES truncated differential discriminator, and the differential distribution of the 8-round AES-256 based on this truncated differential discriminator is as follows. Figure 4 As shown. The specific technical solution is as follows: Pre-calculation stage: based on Figure 2 The 4-round AES truncation differential divider in the middle, exhaustively enumerate , , , and Calculate all sequences . Set to sequence space The mapping is defined as a function , , .

[0058] Step 1: Exhaustive search After byte substitution, it can be calculated that Then it is possible to construct Difference After row shifting and column scrambling operations, we can obtain kind .

[0059] Step 2, Exhaustive search It can be deduced in reverse. Then it is possible to construct Difference After further column obfuscation and row shifting operations, we can obtain kind .

[0060] Step 3 kind and kind Can be composed of right Based on the differential properties of the S-box in AES, for each pair It can be determined The value. Also, because this 4-round AES truncation differential divider is from both ends ( and (spreading towards the center) All possible values ​​are determined by , , , Sure.

[0061] Step 4: Exhaustive search ,calculate After the S-box operation, the difference sequence can be calculated. Since row shifting, column obfuscation, and key XOR are linear, it is possible to calculate... .according to The value can be calculated. .

[0062] Step 5, known Since row shifting, column obfuscation, and key XOR are linear, it is possible to calculate According to the calculation ,available Based on the calculated and The subkey bytes can be derived. Through subkey bytes and It can be calculated Because row shifting, column obfuscation, and key XOR are linear, the sequence can be computed. .

[0063] Online query stage: Step 6, Build There are *n* structures, and within each structure, all possible values ​​of P[0,5,10,15] are enumerated. Articles of text can form plaintext Then, perform a classic query to find the ciphertext C corresponding to all plaintexts. Store these plaintext and ciphertexts in QRAM.

[0064] Step 7: Prepare the initial state: ; in, This indicates that the key needs to be guessed. , scale ; Indicates plaintext and its corresponding ciphertext pair To prepare It can be prepared first. Then, QRAM technology is used to query the corresponding ciphertext to obtain... . and It can be used in the zero state through the Hadamard gate. Obtained from above.

[0065] Step 8: Use the quantum amplitude amplification algorithm to search for the input and output differences that satisfy the 4-round AES truncation differential divider. (The probability that the input and output differentials of the 4-round AES truncation differential distinguisher are) ), to obtain the quantum state: .

[0066] Step 9: Based on the filtered results Calculate the value. The value is used to obtain the quantum state: .

[0067] Step 10, according to The quantum state is calculated as follows: .

[0068] Step 11, according to and The value can be deduced from this. Then use QRAM technology to query Corresponding ciphertext The quantum state is obtained: .

[0069] Step 12, according to The value is calculated in The difference at each point constitutes a sequence The quantum state is obtained: ; Among them, the function Represents a set to sequence space The mapping, , .

[0070] Step 13: Use the following quantum algorithm to search for (x, y) such that F(x) = G(y), then... Corresponding key That is correct.

[0071] Collision search algorithm between functions F and G: i. From the set Randomly select a size of subset of .

[0072] ii. Sort the elements in set A according to the value of F(x).

[0073] iii. From the set Randomly select a size of subset of Preparation of quantum states .

[0074] iv. For any Perform a classic binary search on the sorted set A to determine if it exists. This satisfies F(a) = G(b); combined with the quantum amplitude amplification algorithm search of elements in set B, in Search for collisions.

[0075] v. Apply the quantum amplitude amplification algorithm to steps i-iv, and output the element pairs that satisfy F(x)=G(y). .

[0076] Step 14: Use the quantum amplitude amplification algorithm to search for... The remaining 56 bits of the key.

[0077] As shown in Table 1, in the specific embodiment applied to 8 rounds of AES-256, the time complexity of the method in this embodiment is reduced compared to the method of Bonnetain et al. (Bonnetain, X., Naya-Plasencia, M., Schrottenloher, A.: Quantum Security Analysis of AES. IACR Transactions on Symmetric Cryptology 2019(2), 55–93 (2019)). The factor can be improved by one round compared to the method of David et al. (David, N., Naya-Plasencia, M., Schrottenloher, A.: Quantum impossible differential attacks: Applications to AES and SKINNY. Cryptology ePrint Archive, Paper 2022 / 754(2022)).

[0078] Table 1. Comparison of the complexity of different quantum attack methods against AES

[0079] In summary, the purpose of this embodiment is to propose a quantum encounter-in-the-middle attack against reduced-round AES, addressing the high time complexity of current quantum attacks against AES. The overall method consists of two stages: a pre-computation stage and an online query stage. In the pre-computation stage, this quantum attack exhaustively enumerates 11 byte parameters that determine the output difference sequence based on a 4-round AES truncated differential divider, calculates the difference sequence of the first byte of the differential divider's output, and stores it in a lookup table. In the online query stage, this quantum attack queries the reduced-round AES to obtain the ciphertext of the corresponding plaintext, exhaustively enumerates the key bytes affected by the input and output differences of the 4-round AES truncated differential divider, calculates the difference sequence of the first byte of the differential divider's output, and then uses a quantum search algorithm to find the same difference sequence generated in both stages, thus recovering the corresponding key; thereby solving the problem of high time complexity in current quantum attacks against AES.

[0080] In addition to the embodiments described above, the present invention may have other implementations. All technical solutions formed by equivalent substitution or equivalent transformation fall within the protection scope claimed by the present invention.

Claims

1. A quantum encounter-in-the-middle attack method for AES, characterized in that: Includes the following steps: Pre-computation stage: Based on the set truncated difference distinguisher, exhaustively enumerate some intermediate states related to the truncated difference distinguisher, and use the exhaustively enumerated intermediate states as the first state set; calculate the pre-computation difference sequence based on the first state set, and construct the mapping relationship between the first state set and the pre-computation difference sequence space. Online query phase: Construct plaintext set and obtain corresponding ciphertext set, and store plaintext-ciphertext pairs containing plaintext set and ciphertext set in quantum random access memory (QRAM); An initial quantum state is prepared, and the partial subkeys associated with the truncated differential distinguisher are enumerated. The space corresponding to the partial subkeys is taken as the partial subkey space. Based on the zero state, a superposition state containing the partial subkey space and the set of plaintext pairs is constructed through a Hadamard gate. The corresponding ciphertext in the quantum random access memory is queried using the plaintext superposition state to obtain the initial quantum state, which includes the partial subkey space, the set of plaintext pairs, and the corresponding set of ciphertext pairs. The quantum amplitude amplification algorithm is used to search for plaintext pairs that satisfy the input and output differences of the truncated differential discriminator and their corresponding ciphertext pairs, and the filtered quantum state is obtained. The quantum state includes a partial subkey space, a set of filtered plaintext pairs and a set of corresponding ciphertext pairs. In the filtered quantum state, based on any subkey value in the partial subkey space, any pair of plaintexts in the filtered plaintext pair set is encrypted to the intermediate state of the truncated differential discriminator input. All possible differences of the first byte are enumerated. The intermediate state is XORed with all possible differences, and the plaintext corresponding to all possible differences is calculated in reverse according to the subkey value. The ciphertext corresponding to the newly calculated plaintext is obtained by querying the quantum random access memory (QRAM). Then, based on any subkey value in the partial subkey space, all ciphertexts are decrypted to the first byte of the intermediate state of the truncated differential output, forming an online differential sequence. The partial subkey space and the filtered plaintext pair set are used as the second state set. The quantum collision search algorithm is used to find collisions between the online difference sequence and the pre-computed difference sequence in the mapping relationship constructed in the pre-computation stage, and the correct partial key is determined based on the collision results; The quantum amplitude amplification algorithm is used to search and recover the remaining key in the remaining key space excluding the partial subkey space; The steps for finding collisions using the quantum collision search algorithm specifically include: Randomly select a subset of size 1 from the first set of states, and sort the elements in the subset according to the difference sequence values; A subset of the second size is randomly selected from the second set of states, and the corresponding quantum states are prepared. For any element in the second-sized subset, perform a binary search on the sorted first-sized subset to determine if the collision condition is met. By combining the quantum amplitude amplification algorithm for elements in the second-scale subset, element pairs that satisfy the collision condition are searched and output in the first-scale and second-scale subsets. The element pairs include elements from the first state set and the second state set, respectively. The correct partial key is confirmed based on the element pairs.

2. The quantum encounter-in-the-middle attack method against AES according to claim 1, characterized in that: The pre-calculation stage specifically includes: Exhaustively enumerate the intermediate states at both ends of the differential divider; By utilizing the differential characteristics of the S-box in the AES algorithm, the state values ​​of intermediate state bytes subject to differential constraints on the propagation path of the truncated differential discriminator are determined based on partial intermediate states. By combining the linear characteristics of row shifting, column obfuscation, and key XOR operation in the AES algorithm, the pre-computed difference sequence is derived and calculated in both forward and reverse directions.

3. The quantum encounter attack method against AES according to claim 1, characterized in that: During the online query phase, plaintext-ciphertext pairs containing both plaintext and ciphertext sets are stored in the quantum random access memory (QRAM), including: Construct multiple structures, and exhaustively enumerate all possible values ​​of the active plaintext byte in each structure to form a plaintext pair. All plaintext bytes in the structure except the active plaintext byte are fixed constants. Obtain the ciphertext pairs corresponding to all plaintext pairs. The plaintext pairs and ciphertext pairs together form a plaintext-ciphertext pair. Plaintext pairs and their corresponding ciphertext pairs are stored as key-value data in a quantum random access memory (QRAM) for querying in quantum state superposition.

4. The quantum encounter-in-the-middle attack method against AES according to claim 1, characterized in that: The specific method for preparing the initial quantum state is as follows: Prepare a superposition state containing a key that needs to be guessed, and a superposition state containing plaintext pairs and ciphertext pairs; By applying a Hadamard gate to the zero state and combining it with QRAM querying techniques, an initial quantum state containing joint information of key and plaintext-ciphertext pairs is prepared.

5. The quantum encounter-in-the-middle attack method against AES according to any one of claims 1-4, characterized in that: The AES algorithm is an 8-round AES-256 algorithm; correspondingly, the truncated differential discriminator is a 4-round AES truncated differential discriminator.

6. The quantum encounter-in-the-middle attack method against AES according to claim 5, characterized in that: The method of using the quantum amplitude amplification algorithm to search for and recover the remaining key specifically involves using the quantum amplitude amplification algorithm to search for the remaining 56 bits of the key excluding the part of the key determined by collision.

7. A quantum encounter-in-the-middle attack system against AES, for performing the method according to any one of claims 1-6, characterized in that: include: The pre-computation module is used to exhaustively enumerate some intermediate states related to the truncated difference distinguisher based on the set truncated difference distinguisher, and use the exhaustively enumerated intermediate states as the first state set; calculate the pre-computation difference sequence based on the first state set, and construct the mapping relationship between the first state set and the pre-computation difference sequence space. The storage and preparation module is used to construct a plaintext set and obtain the corresponding ciphertext set, and to store the plaintext-ciphertext pair containing the plaintext set and the ciphertext set into the quantum random access memory (QRAM). It exhaustively enumerates the partial subkeys associated with the truncated differential distinguisher and uses the space corresponding to the partial subkeys as the partial subkey space. Based on the zero state, it constructs a superposition state containing the partial subkey space and the set of plaintext pairs through a Hadamard gate. It uses the plaintext superposition state to query the corresponding ciphertext in the quantum random access memory to obtain the initial quantum state, which includes the partial subkey space, the set of plaintext pairs, and the corresponding set of ciphertext pairs. The quantum filtering module is used to search for plaintext pairs and their corresponding ciphertext pairs that satisfy the input and output difference of the truncated differential discriminator using the quantum amplitude amplification algorithm, and obtain the filtered quantum state, which includes a partial subkey space, a set of filtered plaintext pairs and a set of corresponding ciphertext pairs. The intermediate encounter module is used to, within the filtered quantum state, encrypt any pair of plaintexts in the filtered plaintext pair set to an intermediate state of the truncated differential distinguisher input based on any subkey value in the partial subkey space. It exhaustively enumerates all possible differences for the first byte, XORs the intermediate state with all possible differences, and then calculates the plaintext corresponding to all possible differences based on the subkey value. It queries the quantum random access memory (QRAM) to obtain the ciphertext corresponding to the newly calculated plaintext. Then, based on any subkey value in the partial subkey space, it decrypts all ciphertexts to the first byte of the intermediate state of the truncated differential output, forming an online differential sequence. The partial subkey space and the filtered plaintext pair set are used as the second state set. A quantum collision search algorithm is used to find collisions between the online differential sequence and the pre-calculated differential sequence in the mapping relationship constructed in the pre-computation stage, and the correct partial key is determined based on the collision results. The remaining key recovery module is used to search for and recover the remaining key in the remaining key space, excluding the partial subkey space, using a quantum amplitude amplification algorithm.

8. An electronic device, characterized in that: It includes a memory and a processor, the memory storing a computer program executable by the processor, the processor executing the computer program to implement the quantum intermediate encounter attack method against AES as described in any one of claims 1-6.

9. A storage medium, characterized in that: The storage medium stores a computer program, which, when read and executed, implements the quantum intermediate encounter attack method against AES as described in any one of claims 1-6.

Images