Quantum Key Recovery Attacks on 4-Round Iterated Even-Mansour with Two Keys

In this paper, we propose quantum key recovery attacks on 4-round iterated Even-Mansour (IEM) with a key schedule that applies two keys alternately. We first show that a conditional periodic function such that one of the secret keys appears as a period conditionally can be constructed using the encryption function and internal permutations. By applying the offline Simon’s algorithm to this function, we construct a key recovery attack with a complexity of O(NlogN) for N=2ⁿ, where n is the block size and one secret key size. Using quantum queries, this attack outperforms the generic quantum attack, i.e., Grover’s search which takes the time complexity of O(N). Moreover, we propose the quantum version of the multibridge attack proposed by Dinur et al. in ASIACRYPT 2014 to analyze the 4-round IEM. As a result, we show that the quantum multibridge attack can achieve the optimal complexity of O(N) even if we have only O(1) data without quantum queries, while the classical attack requires O(N) data to achieve the same time complexity. Furthermore, we show that the quantum multibridge attack slightly outperforms Grover’s search when considering the quantum circuit depth for these attacks.