Paper 2010/506

Quantum Preimage and Collision Attacks on CubeHash

Gaëtan Leurent


In this paper we show a quantum preimage attack on CubeHash-512-normal with complexity 2^192 . This kind of attack is expected to cost 2^256 for a good 512-bit hash function, and we argue that this violates the expected security of CubeHash. The preimage attack can also be used as a collision attack, given that a generic quantum collision attack on a 512-bit hash function require 2^256 operations, as explained in the CubeHash submission document. This attack only uses very simple techniques, most of which are borrowed from previous analysis of CubeHash: we just combine symmetry based attacks [1,8] with Grover's algorithm. However, it is arguably the first attack on a second-round SHA-3 candidate that is more efficient than the attacks considered by the designer.

Available format(s)
Secret-key cryptography
Publication info
Published elsewhere. Unknown where it was published
Hash functionsSHA-3CubeHash
Contact author(s)
gaetan leurent @ ens fr
2010-11-30: revised
2010-10-05: received
See all versions
Short URL
Creative Commons Attribution


      author = {Gaëtan Leurent},
      title = {Quantum Preimage and Collision Attacks on CubeHash},
      howpublished = {Cryptology ePrint Archive, Paper 2010/506},
      year = {2010},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.