3

I am wondering what is the exact post-quantum security of a PRF. I know that for most symmetric mechanisms, it is assumed it is sufficient to double the key size, but I am looking for a more precise analysis in the case of Pseudo-Random Functions (like $2^{(n/2)}$ operations with Grover algorithm for the preimage).

To clarify, I am searching for (1) generic attacks (not on any specific PRF) (2) for an attacker that only has classical access to the PRF.

Distic
  • 135
  • 5
  • Well it probably depends on which PRF... – fkraiem Sep 18 '19 at 05:38
  • fkraiem: no, I think about generic attacks on blackbox PRF (just like Grover algorithm provides generic attacks against Preimage Resistance). – Distic Sep 18 '19 at 06:45
  • Post-quantum security for collisions? – forest Sep 18 '19 at 09:32
  • @forest : What do you mean ? Post-Quantum Security for collisions is known to be somewhere between $2^{n/2}$ and $2^{n/3}$ but I do not see the point as finding collisions is not easier for a PRF (when compared to a random function). – Distic Sep 18 '19 at 09:43
  • Do you require quantum pseudorandomness of the PRF? I.e., security against quantum adversaries making only classical queries to the PRF, or security against quantum adversaries which can also make superposition of queries to the PRF? I think the answer is different depending on which case you consider. – Geoffroy Couteau Sep 18 '19 at 12:03
  • No I just consider an adversary that does classical requests. – Distic Sep 18 '19 at 14:10

1 Answers1

5

The best generic classical attack on a PRF is a generic preimage search for the unknown key. Given an input $x$ and an output $f_k(x)$ for uniform random $k \in \{0,1\}^n$, the best known algorithm costs about $2^n$ trial evaluations of $f$ to find $k$. Given multiple targets $(f_{k_1}(x), f_{k_2}(x), \dots, f_{k_t}(x))$, it costs about $2^n\!/t$ trial evaluations of $f$ to find at least one of the $k_i$, using a rainbow table search if it is done on a machine parallelized at least $t^2$ ways.

The best generic quantum preimage search costs about $\sqrt{2^n} = 2^{n/2}$ trial evaluations of quantum superpositions of $k \mapsto f_k(x)$, using Grover's algorithm. Grover's algorithm doesn't parallelize well: if parallelized $p$ ways, it returns an answer in time $\sqrt{2^n\!/p} = 2^{n/2} / \sqrt p$ and therefore costs $2^{n/2} \cdot \sqrt p$ to run a machine $p$ times larger for $1/\!\sqrt p$ times as long. In the single-target setting, Grover's algorithm is asymptotically optimal. The best known batch advantage for a multi-target search (not known to be optimal but dramatic improvements seem unlikely) is modest, reducing the cost by a mere factor of $\sqrt[4]{t}$ to find the first of $t$ targets.

There is also a fantasy threat model where not only does the adversary have a quantum computer, but where you for some inexplicable reason compute quantum superpositions of $x \mapsto f_k(x)$ on behalf of the adversary.

While I don't know of any generic attacks, many particular cryptosystems are breakable using Simon's algorithm (random example) in this doubly unrealistic threat model where the adversary has a quantum computer, you have a quantum computer, I have a quantum computer, and everyone and their dog has a quantum computer, and you blithely compute secret functions on quantum superpositions of inputs on request from the adversary.

Solution: When strange men in dark coats ask you on the street for quantum superpositions of your secret functions, RUN AWAY!

More seriously, if you are tempted to evaluate secret functions on a quantum computer yourself, on behalf of anyone including puppies and unicorns and not just strange men in dark coats, take a moment to do a literature search to reconsider your life choices.

Squeamish Ossifrage
  • 48,392
  • 3
  • 116
  • 223
  • For a given pair $x,y$, there is a high probability that there exists a key $k$ such that $y = F(k,x)$ even if $x$ and $y$ are random, so I think finding a key $k$ such that $y = F(k,x)$ does not help much. – Distic Sep 18 '19 at 14:17
  • Yes, there can be false positives, whether in the classical setting or in the quantum setting. – Squeamish Ossifrage Sep 18 '19 at 14:27
  • It seems to me this generic attack has no distinguishing power at alll. Can you quantify it to prove it is O(1) ? – Distic Sep 18 '19 at 14:49
  • Suppose $f_k$ and $f_{k^}$ are independent uniform random functions when $k\ne k^$. Note that $\Pr[k=k^*]=1/2^n$. If the range of $f$ is ${0,1}^t$, then $\Pr[f_k(x)=f_{k^}(x)\mid k\ne k^]=1/2^t$. Hence $$\Pr[f_k(x)=f_{k^*}(x)]=1/2^n+(1/2^t)(1-1/2^n),$$ so that the true positive rate is \begin{align}\Pr[k=k^\mid f_k(x)=f_{k^}(x)]&=\Pr[k=k^]\frac{\Pr[f_k(x)=f_{k^}(x)\mid k=k^]}{\Pr[f_k(x)=f_{k^*}(x)]}\&=(1/2^n)\frac{1}{1/2^n+(1/2^t)(1-1/2^n)}\&=\frac{2^t}{2^t+2^n-1}.\end{align*} When $t=n$, this is essentially $1/2$; when $t\gg n$, this is essentially $1$. – Squeamish Ossifrage Sep 18 '19 at 19:59
  • (Here $k^*$ is the true key, unknown to an adversary, and $k$ is any particular guess by the adversary.) – Squeamish Ossifrage Sep 18 '19 at 20:37