National Institute of Standards and Technology における超伝導研究及び生活

We give a new signature scheme for isogenies that combines the class group actions of CSIDH with the notion of Fiat-Shamir with aborts. Our techniques allow to have signatures of size less than one kilobyte at the 128-bit security level, even with tight security reduction (to a non-standard problem) in the quantum random oracle model. Hence our signatures are potentially shorter than lattice signatures, but signing and verification are currently very expensive.

/pdf/seasign-compact-isogeny-signatures-from-class-group-actions-3czvzs15ch.pdf

SeaSign: Compact isogeny signatures from class group actions.

Recently, Castryck, Lange, Martindale, Panny, and Renes proposed CSIDH (pronounced “sea-side”) as a candidate post-quantum “commutative group action.” It has attracted much attention and interest, in part because it enables noninteractive Diffie–Hellman-like key exchange with quite small communication. Subsequently, CSIDH has also been used as a foundation for digital signatures.

He Gives C-Sieves on the CSIDH

Grover’s search algorithm gives a quantum attack against block ciphers by searching for a key that matches a small number of plaintext-ciphertext pairs. This attack uses \(O(\sqrt{N})\) calls to the cipher to search a key space of size N. Previous work in the specific case of AES derived the full gate cost by analyzing quantum circuits for the cipher, but focused on minimizing the number of qubits.

Implementing Grover Oracles for Quantum Key Search on AES and LowMC

To quantify security levels in a postquantum scenario, it is common to use the quantum resources needed to attack the Advanced Encryption Standard (AES) as a reference value. Specifically, in the National Institute of Standards and Technology's ongoing postquantum standardization effort, different security categories are defined that reflect the quantum resources needed to attack AES-128, AES-192, and AES-256. This article presents a quantum circuit to implement the S-box of AES. Also, leveraging an improved implementation of the key expansion, we identify new quantum circuits for all three AES key lengths. For AES-128, the number of Toffoli gates can be reduced by more than 88% compared to Almazrooie et al. 's and Grassl et al. 's estimates while simultaneously reducing the number of qubits. Our circuits can be used to simplify a Grover-based key search for AES.

/pdf/reducing-the-cost-of-implementing-aes-as-a-quantum-circuit-2kjf8k1wss.pdf

Reducing the Cost of Implementing AES as a Quantum Circuit

We introduce models of computation that enable direct comparisons between classical and quantum algorithms. Incorporating previous work on quantum computation and error correction, we justify the use of the gate-count and depth-times-width cost metrics for quantum circuits. We demonstrate the relevance of these models to cryptanalysis by revisiting, and increasing, the security estimates for the Supersingular Isogeny Diffie–Hellman (SIDH) and Supersingular Isogeny Key Encapsulation (SIKE) schemes. Our models, analyses, and physical justifications have applications to a number of memory intensive quantum algorithms.

Quantum Cryptanalysis in the RAM Model: Claw-Finding Attacks on SIKE

/pdf/implementing-grover-oracles-for-quantum-key-search-on-aes-mppislj6nd.pdf

Implementing Grover oracles for quantum key search on AES and LowMC.

We present improved quantum circuits for elliptic curve scalar multiplication, the most costly component in Shor’s algorithm to compute discrete logarithms in elliptic curve groups. We optimize low-level components such as reversible integer and modular arithmetic through windowing techniques and more adaptive placement of uncomputing steps, and improve over previous quantum circuits for modular inversion by reformulating the binary Euclidean algorithm. Overall, we obtain an affine Weierstrass point addition circuit that has lower depth and uses fewer T gates than previous circuits. While previous work mostly focuses on minimizing the total number of qubits, we present various trade-offs between different cost metrics including the number of qubits, circuit depth and T-gate count. Finally, we provide a full implementation of point addition in the Q# quantum programming language that allows unit tests and automatic quantum resource estimation for all components.

/pdf/improved-quantum-circuits-for-elliptic-curve-discrete-2bqqth73ks.pdf

Improved Quantum Circuits for Elliptic Curve Discrete Logarithms

We analyze linear maps on matrix algebras that become entanglement breaking after composing a finite or infinite number of times with themselves. This means that the Choi matrix of the iterated linear map becomes separable in the tensor product space. If a linear map becomes entanglement breaking after finitely many iterations, we say that the map has a finite index of separability. In particular, we show that every unital positive partial transpose (PPT) channel has a finite index of separability and that the class of unital channels that have a finite index of separability is a dense subset of the unital channels. We construct concrete examples of maps which are not PPT but have a finite index of separability. We prove that there is a large class of unital channels that are asymptotically entanglement breaking. Our work is motivated by Christandl’s PPT-squared conjecture. This conjecture states that every PPT channel, when composed with itself, becomes entanglement breaking.

Samuel Jaques

Papers

Implementing Grover Oracles for Quantum Key Search on AES and LowMC

Quantum Cryptanalysis in the RAM Model: Claw-Finding Attacks on SIKE

Implementing Grover oracles for quantum key search on AES and LowMC.

Improved Quantum Circuits for Elliptic Curve Discrete Logarithms

Eventually entanglement breaking maps