Breaking LWC candidates: sESTATE and Elephant in quantum setting

The competition for lightweight cryptography (LWC) launched by the National Institute of Standards and Technology (NIST) is an ongoing project calling for the standardization of lightweight cryptographic algorithms. The Report on Lightweight Cryptography specifically asks that submissions be quantum safe when long-term security is needed. However, this was not included in the “Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process.” Consequently, most candidates, including sESTATE and Elephant, make no claim regarding security with respect to quantum attacks. We propose quantum key recovery attacks on those second-round candidates. sESTATE is an authenticated encryption mode inspired by SUNDAE, as proposed in ToSC 2018. It claims that the adversary can get no information regarding the simplified tweakable block cipher. However, we show that quantum adversaries could extract the internal values, leading to a key-recovery attack on the only recommended scheme, sESTATE_TweAES-128-6, with \(2^{42.3}\) Q2 queries and a time equivalent to \(2^{52}\) AES encryptions. Technically, the attack is based on the combination of a quantum extracting method and quantum square attack. For Elephant mode, which internally uses a permutation masked by linear feedback shift registers (LFSRs) similar to the masked Even-Mansour construction proposed in EUROCRYPT 2016, we launch the attack based on the quantum attack proposed by Bonnetain et al., which depends on Simon’s algorithm without superposition queries and Grover’s algorithm. Our attack is generic and independent of internal permutation; hence, we obtain the quantum attacks on all instances with a tradeoff of classical and quantum queries. Remarkably, the attack complexities of both recommended instances are lower than that of the generic quantum attack on key, i.e., in time \({\mathcal {O}}({2}^{|K|/{2}})\) with \({\mathcal {O}}(1)\) queries.