Quantum forgery attacks against OTR structures based on Simon’s algorithm

Classical forgery attacks against Offset Two-round (OTR) structures require some harsh conditions, such as some plaintext and ciphertext pairs need to be known, and the success probability is not too high. To solve these problems, a quantum forgery attack on OTR structure using Simon’s algorithm is proposed. The attacker intercepts the ciphertext-tag pair [Formula: see text] between the sender and receiver, while Simon’s algorithm is used to find the period of the tag generation function in OTR, then we can successfully forge new ciphertext [Formula: see text] ([Formula: see text]) for intercepted tag [Formula: see text]. For a variant of OTR structure (Prøst-OTR-Even-Mansour structure), a universal forgery attack, in which it is easy to generate the correct tag of any given message if the attacker is allowed to change a single block in it, is proposed. It first obtains the secret parameter [Formula: see text] using Simon’s algorithm, then the secret parameter [Formula: see text] is used to find the keys [Formula: see text] and [Formula: see text], so that an attacker can forge the changed messages. It only needs several plaintext blocks to help obtain the keys to forge any messages. Performance analysis shows that the query complexity of our attack is [Formula: see text], and its success probability is very close to 1.