  In a basic related-key attack against a block cipher, the adversary has
access to encryptions under keys that differ from the target key by bit-flips.
In this short note we show that for a quantum adversary such attacks are quite
powerful: if the secret key is (i) uniquely determined by a small number of
plaintext-ciphertext pairs, (ii) the block cipher can be evaluated efficiently,
and (iii) a superposition of related keys can be queried, then the key can be
extracted efficiently.
