Quantum-Aware Key Rank for Side-Channel Attacks evaluation
Researchers define a quantum-aware key rank for side-channel labs facing a quantum search adversary.
The paper models an adversary who collects side-channel traces classically and finishes the remaining key search on a quantum computer. For a key of rank r, any quantum algorithm with classical access to the posteriors needs Omega(sqrt(r)) cipher evaluations, and block search achieves O(sqrt(r)). Under a NIST MAXDEPTH budget of 2^40 and the best published AES-128 oracle, the quadratic advantage holds only up to about rank 2^58.6. Experiments at SNR 0.125 find a depth-limited quantum adversary worth about 22 traces versus a classical one.
- Per-device quantum advantage is quadratic, Omega(sqrt(r)) to O(sqrt(r)) cipher evaluations.
- With MAXDEPTH 2^40 the AES-128 window closes near rank 2^58.6.
- Quantum-aware key rank is computed from laboratory rank estimators already in use.
- At SNR 0.125 a depth-limited quantum adversary is worth about 22 traces.
From the original article
1 min read at arxiv.orgSide-channel attacks on block ciphers rarely recover the key outright: they leave a residual key space ordered by subkey posteriors, and evaluation laboratories report the key rank of the true key against thresholds near 2^48 and 2^60. No evaluation framework models an adversary who collects traces classically and finishes the search on a quantum computer, although quantum search with advice provides exactly that.
By Yevgen Kotukh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.