Kotukh maps quantum side-channel edge to AES-128 rank 2^58.6

Yevgen Kotukh mapped a quantum-aware metric for side-channel key-rank tests in an arXiv preprint submitted Oct. 14, putting the AES-128 depth-limited window near rank 2^58.6.

The Oct. 14 arXiv preprint matters for hardware-security evaluations because laboratories assess residual secret spaces against thresholds near 2^48 and 2^60 after attacks that do not fully recover the cryptographic key.

Side-channel attacks exploit leaked information from an implementation, such as measurement traces, rather than defeating the block cipher directly. Kotukh’s paper addresses cases where those attacks leave a ranked list of possible secrets based on subkey posterior probabilities.

The preprint says a quantum attacker that first gathers traces classically and then searches with quantum hardware has a per-device advantage that is exactly quadratic. For a device with rank r, the paper says any quantum algorithm with classical access to the posteriors needs at least on the order of sqrt(r) cipher evaluations, while block search can also achieve on the order of sqrt(r).

That conclusion narrows a stronger interpretation of “search with advice.” Kotukh says super-quadratic exponents previously reported for that setting are averages over a prior distribution, not gains that apply to an individual device.

The constraint comes from circuit depth, a measure of how many sequential quantum operations can be run. Under the NIST MAXDEPTH budget D and a Grover iteration with g gates and depth d, the preprint says the quadratic advantage applies only up to ranks of (4D/(pi d))^2 and then falls to a constant-factor benefit.

Using what the paper describes as the best published AES-128 oracle and a depth budget of D = 2^40, Kotukh places that boundary near rank 2^58.6. That is close to the upper laboratory threshold cited in the abstract, but above the lower 2^48 threshold.

The proposed measure is called quantum-aware key rank. It represents the classical rank that would impose the same cost on an attacker, and the paper says it can be computed from rank estimators already used by evaluation laboratories.

The preprint also compares two quantum strategies. It says block search and amplitude amplification from a product-form posterior state are within a factor of two to four on Hamming-weight posteriors, making the cost of coherent indexing the deciding implementation issue.

The experiments cited in the abstract use simulated leakage and a toy cipher, not a full product evaluation. At signal-to-noise ratio 0.125, the paper says a depth-limited quantum adversary is equivalent to about 22 additional traces for a classical attacker, regardless of the size of its gate budget.

The arXiv record lists the work under Quantum Physics and Cryptography and Security. The supplied record does not provide peer review, a sample size beyond the abstracted experiments, or funding information.

Source: arXiv preprint, arXiv, Oct. 14, 2026