Imagine you're designing a combination lock, but your adversary can try all combinations simultaneously in superposition — testing exponentially many keys at once. A classical lock with one tumbler falls instantly. The question this paper settles: how many tumblers do you actually need before even a quantum lockpick can't crack it? The committed claim: the two-round Even-Mansour cipher — one of the simplest pseudorandom permutation constructions in cryptography — is information-theoretically secure in the ideal permutation model against adversaries making polynomially many adaptive, forward-and-inverse quantum queries. This is the first proof of quantum security for Even-Mansour against fully adaptive quantum adversaries. The result also proves minimality: any cipher built from a single call to a public permutation is quantumly insecure. The Even-Mansour construction is deceptively simple: take a public permutation, XOR a secret key before and after applying it — that's one round. Stack two rounds and you get two public permutations interleaved with three key XORs. Classically, even one round is secure in the ideal permutation model. Quantumly, Simon's algorithm kills one round dead. Prior quantum security results for two rounds only covered non-adaptive adversaries — those who must commit all queries upfront. Adaptive adversaries, who choose each query based on previous answers, are strictly more powerful. Closing that gap is the core technical contribution. The proof architecture is rooted in the compressed oracle framework introduced by Zhandry, extended here to permutation oracles. The key move is constructing a custom isometry that relates the real cipher experiment (with the actual keyed construction) to the ideal experiment (a truly random permutation). The security argument then reduces to bounding the distinguishing advantage between these two experiments via careful norm bounds on the difference between real and ideal states. This is information-theoretic — no computational assumptions, no conjectured hardness. The only assumption is the ideal permutation model itself. Integrity here is strong in a specific way: this is a mathematical proof, not an empirical benchmark. The validation is a formal argument, checked within the conventions of the theoretical cryptography and quantum computing communities. There is no experiment to replicate — the result either holds or a counterexample breaks it. The authors explicitly address the strongest known attack model (adaptive, forward-and-inverse quantum queries to all oracles), which is the most honest adversarial framing available. The practical significance is both foundational and forward-looking. Pseudorandom permutations secure against quantum queries are load-bearing primitives for constructing pseudorandom unitaries — a hot topic in quantum complexity theory — and have recently appeared in complexity separations (SZK vs BQP). This result means the simplest known construction suffices, which simplifies downstream results that currently invoke more complex or less-understood quantum-secure PRPs. It also establishes a sharp threshold: one round is insecure, two rounds suffice, and the proof technique may extend to tighter concrete bounds or related constructions. The obvious next experiment the authors did not run — and likely are saving for a follow-up — is extending the compressed permutation oracle technique to three or more rounds to obtain tighter concrete security bounds. The two-round result is asymptotic (polynomial queries); pinning down exact query complexity for small parameters and additional rounds is the natural sequel. Whether the technique generalizes cleanly or hits structural obstacles at higher round counts is the open question the community will now probe.
