MIBS算法量子密码分析  

Quantum Cryptanalysis of MIBS

作　　者：李艳俊[1,2,3] 林昊 易子晗 谢惠琴 LI Yan-Jun;LIN Hao;YI Zi-Han;XIE Hui-Qin(Beijing Electronic Science and Technology Institute,Beijing 100070,China;State Key Laboratory of Cryptology,Beijing 100878,China;Guangxi Key Laboratory of Cryptography and Information Security,Guilin University of Electronic Technology,Guilin 541004,China)

机构地区：[1]北京电子科技学院,北京100070 [2]密码科学技术国家重点实验室,北京100878 [3]桂林电子科技大学广西密码学与信息安全重点实验室,桂林541004

出　　处：《密码学报》2021年第6期989-998,共10页Journal of Cryptologic Research

基　　金：中央高校基本科研业务费(328201901);广西密码学与信息安全重点实验室开放课题(GCIS201912)。

摘　　要：随着量子计算的发展,一些分组密码可能不再安全.在ISIT 2010会议上,学者基于Simon算法提出了Feistel结构密码的3轮量子区分器,并证明能在多项式时间内求解,但该量子区分器的构建并没有考虑到密码算法的轮函数.本文研究构建与轮函数有关的量子区分器.轻量级分组密码算法MIBS的设计目标是普遍适用于资源受限的环境,如RFID标签和传感器网络.我们充分考虑了MIBS的轮函数及其线性变换的性质,由此提出了5轮量子区分器.然后我们遵循Leander和May的密钥恢复攻击框架,即Grover-meet-Simon算法,在Q2模型下对MIBS进行了7轮量子密钥恢复攻击,时间复杂度为2^(12).With the development of quantum computing,some block ciphers may become insecure.At ISIT 2010,Kuwakado and Morii designed a 3-round quantum distinguisher of the Feistel structured cipher based on Simon’s algorithm,and proved that it can be solved in polynomial time.However,the quantum distinguisher does not consider the round function of the cipher.This paper studies the construction of a quantum distinguisher related to the round function.MIBS is a lightweight block cipher,aiming at resource-constrained devices such as RFID tags and sensors.By taking the properties of MIBS round function and its linear transformation into consideration,this paper proposes a 5-round quantum distinguisher.Based on the key-recovery attack framework made by Leander and May,i.e.,Grover-meet-Simon algorithm,a quantum key-recovery attack on 7-round MIBS in Q2 model is given,and the time complexity of the proposed attack is 2^(12).

关 键 词：MIBS算法 量子密码分析 Simon算法 GROVER算法 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]