CENC of Eq. (2), and many more schemes whose security analysis is in the standard model [1, 4, 5, 18, 22, 26, 29, 32, 34, 41, 46, 47, 49].3 We remark that Xxxxxxxx et al. [21] and Song [51] already considered how to lift classical security proofs to the quantum world. However, their focus was on adversaries with quantum interaction to the secret key material, making the conditions stricter and the lifting harder to verify. We focus on the setting where the secret key material is stored in classical hardware, and our lifting conditions are easily verified. Admittedly, the gap between our attack and our security bound is not tight. Informally, this gap is caused by a specific step in the analysis that upper bounds the success probability of guessing the secrets key of the r PRPs by r times the 2 An earlier, yet unrelated and less profound, application of claw finding to cascaded encryption appeared by Xxxxxx [27]. 3 The lifting does not apply to ideal-model proofs, such as the ones used for sponge functions [3, 40], Even-Xxxxxxx constructions [11, 14], and some tweakable block cipher designs [17, 38], which is because in ideal-model proofs the adversary has quantum query access to idealized primitives.
