



@article {2931,
	title = {Post-Quantum Security of the Even-Mansour Cipher},
	journal = {Eurocrypt},
	year = {2022},
	month = {12/14/2021},
	abstract = {<p>The Even-Mansour cipher is a simple method for constructing a (keyed) pseudorandom permutation E from a public random permutation~P:{0,1}n\&rarr;{0,1}n. It is secure against classical attacks, with optimal attacks requiring qE queries to E and qP queries to P such that qE\&sdot;qP\&asymp;2n. If the attacker is given \emph{quantum} access to both E and P, however, the cipher is completely insecure, with attacks using qE,qP=O(n) queries known. In any plausible real-world setting, however, a quantum attacker would have only \emph{classical} access to the keyed permutation~E implemented by honest parties, even while retaining quantum access to~P. Attacks in this setting with qE\&sdot;q2P\&asymp;2n are known, showing that security degrades as compared to the purely classical case, but leaving open the question as to whether the Even-Mansour cipher can still be proven secure in this natural, \&quot;post-quantum\&quot; setting. We resolve this question, showing that any attack in that setting requires qE\&sdot;q2P+qP\&sdot;q2E\&asymp;2n. Our results apply to both the two-key and single-key variants of Even-Mansour. Along the way, we establish several generalizations of results from prior work on quantum-query lower bounds that may be of independent interest.\&nbsp;</p>},
	doi = {https://doi.org/10.48550/arXiv.2112.07530},
	url = {https://arxiv.org/abs/2112.07530},
	author = {Gorjan Alagic and Chen Bai and Jonathan Katz and Christian Majenz}
}
@article {3201,
	title = {Post-Quantum Security of the (Tweakable) FX Construction, and Applications},
	year = {2022},
	month = {8/29/2022},
	abstract = {<p>The FX construction provides a way to increase the effective key length of a block cipher E. We prove security of a tweakable version of the FX construction in the post-quantum setting, i.e., against a quantum attacker given only classical access to the secretly keyed construction while retaining quantum access to E, a setting that seems to be the most relevant one for real-world applications. We then use our results to prove post-quantum security\&mdash;in the same model\&mdash;of the (plain) FX construction, Elephant (a finalist of NIST\&$\#$39;s lightweight cryptography standardization effort), and Chaskey (an ISO-standardized lightweight MAC</p>},
	url = {https://eprint.iacr.org/2022/1097},
	author = {Gorjan Alagic and Chen Bai and Jonathan Katz and Christian Majenz and Patrick Struck}
}
