Quantum key-recovery attack on Feistel constructions: Bernstein-Vazirani meet Grover algorithm

The development of quantum computers has urged the cryptographic community to prepare cryptographic primitives for the eventual arrival of the post-quantum world. At Asiacrypt 2017, Leander and May combined Grover's and Simon's quantum algorithms to break the FX-based block ciphers. Technically this result is based on the combination of the quantum algorithms of Grover's and Simon's for the first time in the cryptographic setting. In this study, we using Bernstein-Vazirani's and Grover's algorithms to generate a new quantum key-recovery attacks on different rounds of Feistel constructions. An advantage of our attack is the keys can be divided into multiple blocks to enter the S-box and realize the process of recovery; this method greatly reduces the complexity of key recovery. Hence, it has strong practicability for key recovery (e.g., DES, Camellia, etc.). In order to show that, a detailed process has been provided in this paper.