During the project we have been able to achieve several interesting results.
Some of our results have been unexpected and surprising, and they have been very encouraging for continuing our work and finding new interesting problems.
I will detail here some of our most important results produced during QUASYModo:
We proposed new, efficient quantum algorithms for solving some generic problems that are recurrent in cryptanalysis, as collision or K-xor solving algorithms (published at Asiacrypt 17 and 18); we have evaluated and improved Kuperberg’s (Asiacrypt 18), building efficient related attacks and detailed new application on some existing constructions, as Poly-1305 or some isogeny-based primitives, showing the close link between symmetric and asymmetric cryptanalysis.
We have also generalized, developed and proposed new quantum slide attacks, quantum boomerang attacks, as well as performed the first extensive analysis of the quantum security of AES, the block cipher standard. These results are published at SAC2019, SAC2021, DCC2023, TOSC 2019.
In addition, we have designed a family of primitives, Saturnin, including a block cipher, AE primitives and a hash function, that proposes post-quantum security in the superposition model. We submitted this family to the NIST lightweight competition.
At Asiacrypt 2019 we published a nice an surprising result ( that was later accepted for a plenary presentation at QIP 2020), in a collaboration resulting from Akinori Hosoyamada and Yu Sasaki's visit, where we showed how to use Simon's algorithm in symmetric cryptanalysis without needing to perform superposition queries. This had been an open problem for a while and a result that interested parts of both the cryptographic and the quantum theory communities. Also at Asiacrypt 19 a result on better understanding s-boxes and avoiding constructions that might have backdoors was proposed.
We had three accepted papers at Eurocrypt 2020: one on a quantum cryptanalysis on an isogenie-based construction, CSIDH, using kuperberg's algorithms, and showed the close link between symmetric and asymmetric cryptanalysis, and how some tools can be used in both scenarios. A second one on optimal merging quantum algorithms for the k-xor problems, where we analyzed more scenarios and improved our previous ones, and finally a third improving the key-recovery part of linear attacks, one of the two most important families of cryptanalysis.
We received the best paper award at Asiacrypt 2020 for our results on the full round permutation of the Gimli construction, showing some non-random and unexpected properties both in the classical and in the quantum setting. These results were later extended in a publication at the Journal of Cryptology.
We proposed an efficient AE construction in one-pass that would resist to all quantum attacks, QCB; a new type of quantum superposition attacks using other algorithms than Simon in linearization attacks, and a new generic framework for improving the key-guessing step of several types of cryptanalysis. These three results were published at Asiacrypt2021.
We proposed some improvements on differential linear attacks (published in CT-RSA 2022 and at Journal of Cryptology), a full break of a newly proposed primitive, SPEEDY (Eurocrypt 2023), and a new family of cryptanalysis: differential meet-in-the-middle attacks.
Finally, we have built a construction, QuEME, that allows us to safely double block ciphers in the post-quantum world, which we showed was needed when considering collision attacks on internal states. In this work, actually under submission, we analyze previous potential candidates, and propose a new quantum attack that combines BHT with Simon, as well as propose a new safe construction, with a classical proof, and a quantum proof not tight but showing that the security won't collapse with superposition attacks in the quantum setting.
A list of results and (invited) presentations can be found on the web of the project.
