Abstract:
Recently, Hosoyamada and Sasaki (EUROCRYPT 2020), and Xiaoyang
Dong et al. (ASIACRYPT 2020) proposed quantum collision attacks against AES-like
hashing modes AES-MMO and AES-MP. Their collision attacks are based on the
quantum version of the rebound attack technique exploiting the differential trails
whose probabilities are too low to be useful in the classical setting but large enough
in the quantum setting. In this work, we present dedicated quantum free-start
collision attacks on Hirose’s double block length compression function instantiated
with AES-256, namely HCF-AES-256. The best publicly known classical attack against
HCF-AES-256 covers up to 9 out of 14 rounds. We present a new 10-round differential
trail for HCF-AES-256 with probability 2
−160, and use it to find collisions with a
quantum version of the rebound attack. Our attack succeeds with a time complexity
of 2
85.11 and requires 2
16 qRAM in the quantum-attack setting, where an attacker can
make only classical queries to the oracle and perform offline computations. We also
present a quantum free-start collision attack on HCF-AES-256 with a time complexity
of 2
86.07 which outperforms Chailloux, Naya-Plasencia, and Schrottenloher’s generic
quantum collision attack (ASIACRYPT 2017) in a model when large qRAM is not
availabl
