Quantum security of AES-128 under HHL algorithm

Abstract

There have been a lot of researches about algebric analysis of AES. In this paper, we turned to quantum algorithm to analyze security of AES-128 against the modified HHL algorithm, which is a quantum algorithm used to get classical solutions of multivariate equation system. We constructed two types of equation systems of AES, and solved them with several variants of HHL algorithms respectively. The resulting complexities involved the condition number are given. We analyzed the reasons for the different complexity of the two equation systems and their solution methods, and pointed out that the combination of the boolean equation system and (the improved) BoolSol is more threatening to AES. With a lower bound on the condition number presented by Ding et al., we show that, for AES-128, HHL algorithm is difficult to achieve better attack effect than Grover algorithm. Our results have some enlightening significance for analyzing the post-quantum security of AES-like block ciphers.