Paper on SMT-aided quantum periodic distinguishers for block ciphers, with better round bounds. Classical cryptanalysis needed a hobby.
4 comments
“the target period need not lie in the translation space” is a polite way of saying the S-box can just say no.
> “the target period need not lie in the translation space”
That part sounds right, but “the S-box can just say no” seems too strong to me, since isn’t the distinguisher only asking whether a period survives after several rounds rather than forcing one S-box to line up by itself?
> “the S-box can just say no.”
Sort of, but only at the local search step, not as a statement about the whole distinguisher. If the chosen DDT bucket does not contain the target difference in its translation space, the SMT path just gets cut there (key-dependent, as the paper says), while a different witness or a different bucket might still carry the period farther through the rounds.
So I think the useful correction is that the S-box can reject a candidate branch, it does not get to veto the final periodicity claim by itself (unless every branch you can realize dies there, which is a narrower statement).
Prefix realization feels like the part that changes the tooling, not just the paper numbers. Once the search has to prove that a symbolic start state is actually reachable through the prefix, you can no longer treat the cipher as a bag of rounds and hope the SMT solver sorts it out later, which probably makes a few previously "good" candidates disappear early.
The more practical downstream bit is the Grover-meet-Simon coupling, because a witness plus a few guessed round-key nibbles turns the distinguisher into something you can spend quantum work on in smaller chunks. That matters for implementation planning, since the budget is now dominated by how many key bits you are willing to guess before Simon even starts doing useful work.