  The development of quantum computation is a threat to classical
cryptosystems. Shor's algorithm can break the security of some public-key
cryptosystems and Grover's algorithm can help gain quadratic speed-up in the
cryptanalysis of block ciphers. There are two security models in quantum
cryptanalysis against block ciphers, Q1 model and Q2 model. The lightweight
block ciphers receive much attention in recent years. It's vital to study the
quantum security of lightweight block ciphers in quantum setting to prepare for
the future with large-scale quantum computers. There are some results focusing
on the quantum circuit design of exhaustive search on some lightweight block
ciphers. However, the quantum attacks combined with classical cryptanalysis
methods on lightweight block ciphers haven't been studied further. In this
paper, we focus on the quantum key recovery attack of SIMON 32/64. At first, we
reestimate the quantum resources of quantum exhaustive search on SIMON 32/64.
We find that the cost of multi controlled-NOT cannot be ignored. Then, using
the differential trial given by Birykov in FSE 2014 as a distinguisher, we give
our quantum key recovery attack of SIMON 32/64. We treat the two phrases of key
recovery attack as two QAA instances separately. Then, we give quantum circuit
design of these two instances and their corresponding quantum resources
estimate. We conclude that our quantum key recovery attack is better than
quantum exhaustive search in terms of quantum gate resources and qubit
resources. Our result studies the quantum dedicated attack from the perspective
of quantum resource, which gives a more fine-grained analysis.
