On the Security of Symmetric Key Ciphers against Quantum Adversaries

Our trust in specific symmetric primitives relies on their ability to resist all known cryptanalytic attacks. Therefore, cryptanalysis is the only proper way to evaluate their security. In this paper, we investigate the behavior of symmetric primitives in the quantum world. This requires to extend the toolkit of symmetric cryptanalysis to the quantum setting, eventually including new attacks. While running Grover’s search algorithm on a quantum computer brings a quadratic speedup for brute-force attacks, we show that the situation is more subtle when considering differential cryptanalysis. We consider two variants of differential cryptanalysis and apply them to concrete implementations of block ciphers. From these applications, we conclude that increasing the key length may not always be the best strategy to increase the security, and that the best quantum attack is not always the same as the best classical attack.