The security of classical symmetric-key primitives is fundamentally challenged by the emergence of quantum computing, necessitating a rigorous evaluation of their post-quantum resilience. This paper presents a comprehensive quantum circuit realization and Grover cryptanalysis of GFSPX, a lightweight block cipher featuring a 64-bit data block and a 128-bit secret key. GFSPX utilizes a unique hybrid architecture that integrates a 4-branch generalized Feistel structure with both Addition-Rotation-XOR (ARX) and Substitution-Permutation Network (SPN) components. Our quantum implementation optimizes resource distribution by exploiting the inherent reversibility of the Feistel network and employing a compact ripple-carry adder for the ARX layers. The proposed architecture achieves a qubit-optimized footprint of 209 qubits with a baseline quantum cost of 32,498 and a circuit depth of 7,617. To evaluate the cipher's resistance against quantum adversaries, we construct a parallelized Grover oracle using three plaintext-ciphertext pairs to eliminate spurious matches. Our analysis reveals that the total quantum cost of a key-recovery attack on GFSPX is $1.12 \times 2^{159}$ quantum gates. Although this cost falls below the NIST Level 1 security threshold of $2^{170}$, the hybrid ARX-SPN design demonstrates a higher quantum attack resistance among other lightweight designs. These findings provide critical insights into the balance between classical efficiency and quantum resilience in next-generation cryptographic designs for resource-constrained environments.
The security of classical symmetric-key primitives is fundamentally challenged by the emergence of quantum computing, necessitating a rigorous evaluation of their post-quantum resilience. This paper presents a comprehensive quantum circuit realization and Grover cryptanalysis of GFSPX, a lightweight block cipher featuring a 64-bit data block and a 128-bit secret key. GFSPX utilizes a unique hybrid architecture that integrates a 4-branch generalized Feistel structure with both Addition-Rotation-XOR (ARX) and Substitution-Permutation Network (SPN) components. Our quantum implementation optimizes resource distribution by exploiting the inherent reversibility of the Feistel network and employing a compact ripple-carry adder for the ARX layers. The proposed architecture achieves a qubit-optimized footprint of 209 qubits with a baseline quantum cost of 32,498 and a circuit depth of 7,617. To evaluate the cipher's resistance against quantum adversaries, we construct a parallelized Grover oracle using three plaintext-ciphertext pairs to eliminate spurious matches. Our analysis reveals that the total quantum cost of a key-recovery attack on GFSPX is 1.12×2159 quantum gates. Although this cost falls below the NIST Level 1 security threshold of 2170, the hybrid ARX-SPN design demonstrates a higher quantum attack resistance among other lightweight designs. These findings provide critical insights into the balance between classical efficiency and quantum resilience in next-generation cryptographic designs for resource-constrained environments.
Abstract The advent of quantum computing necessitates a rigorous reassessment of classical cryptographic primitives, particularly lightweight block ciphers (LBCs) deployed in resource-constrained environments. This work presents a comprehensive quantum implementation and security analysis of the Feistel-based LBC MIBS against quantum cryptanalysis. Using the inherent reversibility of its structure, we develop a novel ancilla-free quantum circuit that optimizes qubit count and depth. For MIBS-64 and MIBS-80, our implementation achieves quantum costs of 23,371 and 24,363, requiring 128 and 144 qubits, respectively, with a depth of 4,768. We subsequently quantify the cipher’s vulnerability to Grover’s key-search algorithm under the NIST PQC security constraint M A X D E P T H MAXDEPTH . By constructing Grover oracles using inner parallelization with multiple plaintext-ciphertext pairs to suppress false positives, we demonstrate total quantum attack costs of approximately 2 94 for MIBS-64 and 2 111 for MIBS-80. These values fall below NIST’s Level-1 security threshold (2 170 ), confirming the susceptibility of both MIBS variants to quantum key-recovery attacks despite their classical lightweight efficiency.
Abstract We present a novel quantum implementation of SLIM, a lightweight 32/80-bit Feistel cipher. By inverting its Key addition-Substitution-Permutation (KSP) layers without ancillary qubits, we construct the full quantum circuit using 112 qubits with quantum cost 30,404 and depth 4,066. To assess quantum resilience, we implement Grover’s algorithm with three plaintext-ciphertext pairs (r = 3; 337 qubits), yielding an attack cost of 2 111 under NIST’s MAXDEPTH constraints—below the Level-1 threshold 2 170 . While SLIM falls short of NIST’s security threshold for near-term quantum attacks, among other lightweight BCs, its efficient architecture retains practical advantages for constrained applications.
The emergence of quantum computing demands rigorous reassessment of classical cryptographic primitives, particularly lightweight block ciphers (LBCs). This work addresses this critical need by presenting the first comprehensive quantum implementation and security analysis of the Feistel-based LBCs SLIM and MIBS against quantum cryptanalysis. Leveraging the inherent reversibility of the ciphers, we develop novel ancilla-free quantum circuits optimizing qubit utilization and depth. For SLIM-80, our design achieves 30,404 quantum cost with 112 qubits and depth of 4,066. For MIBS-64 and MIBS-80, we implement circuits with 23,371 and 24,363 quantum costs requiring 128 and 144 qubits, respectively, and a uniform depth of 4,768. We then quantify vulnerability to Grover’s key-search under the NIST PQC security constraint MAXDEPTH. By constructing Grover oracles under inner parallelization with multiple plaintext-ciphertext pairs to suppress false positives, we demonstrate total attack costs of 2^111 for SLIM-80 and MIBS-80, and 2^94 for MIBS-64. These costs fall below NIST’s Level-1 security threshold 2^170, confirming both ciphers’ susceptibility to quantum threats despite their lightweight efficiency. Our methodology establishes a quantum implementation framework for Feistel ciphers, revealing critical trade-offs among qubit efficiency, depth, and quantum resilience.
Key recovery attack on SPN ciphers such as AES is NP hard in complexity. Previous studies have estimated the quantum resources required for implementing Grover’s key search for AES, but these are largely theoretical in nature. The key challenges to implement Grover’s algorithm on current quantum hardware include the number of available qubits, noise, and decoherence. However, the rapid advancement of hardware has brought us closer to practical realization for the cryptanalysis of light-weight SPN ciphers. This study presents an efficient quantum circuit implementation of Mini-AES, a 16-bit variant of AES, employing standard CNOT and Toffoli gates. To the best of our knowledge, our work provides the first complete quantum implementations of all core Mini-AES components for the quantum oracle. The effects of noise are emulated for each module of the quantum oracle and quantified. Furthermore, Grover’s algorithm is applied to Mini-AES to perform successful key recovery through a known-plaintext attack, demonstrating significant amplitude amplification while using near-optimal Grover’s iterations, thereby reducing the total quantum volume. The optimal Grover’s iterations have been obtained empirically as well as validated with finite-shot analysis. Notably, the application of Grover’s algorithm reveals key clustering behavior in Mini-AES, which has been corroborated through classical simulation.
With the advancement of quantum computing, quantum circuit implementations of symmetric cryptographic algorithms are essential for evaluating their resistance to quantum attacks. As an ISO-standardized cipher, the efficient quantum circuit construction of Camellia is of great significance. Focusing on minimizing the DW-cost (qubits × Toffoli-depth) while balancing ancilla qubits and Toffoli-depth, this paper proposes an optimized quantum circuit design for Camellia. Specifically: (1) using a serial-multiplication and out-of-place inversion architecture under composite-field decomposition, combined with hierarchical screening for parallelizing bilinear multiplications, a compact in-place S-box quantum circuit is constructed with a DW-cost of 276, 28% lower than the state of the art; (2) a low-gate-count linear-layer circuit is obtained via heuristic search, and gate-sequence reordering then reduces the full depth from 9 to 7 without increasing the gate count; (3) Camellia-128/192/256 quantum circuits are constructed with DW-costs of 119,168, 257,664, and 257,664, achieving reductions of 48%, 52%, and 52% respectively over prior work. A pipelined Grover oracle is further designed and the total resources required for a full Grover search attacking Camellia are evaluated. For Camellia-128, the complete Grover search requires a T-depth of 2.10 × 2⁷⁶ and a total TDW-cost (qubits × T-depth) of 1.00 × 2⁸⁶, reducing T-depth by 75% and TDW-cost by 84% over prior work. The first full Grover search resource estimates for Camellia-192/256 are also presented, with T-depths of 7.20 × 2¹⁰⁸ and 8.11 × 2¹⁴⁰ and TDW-costs of 2.03 × 2¹²³ and 2.79 × 2¹⁵³, respectively. These results show that Grover's attack on Camellia requires fewer quantum resources than on AES at the 128-bit level, implying comparatively weaker post-quantum security at that key size, while the picture reverses at larger key sizes (Section 4).
Abstract Grover’s algorithm reduces the security level of the target cipher from n-bit to n/2-bit. To implement Grover’s algorithm, a quantum circuit capable of performing the target cipher operations must be constructed. In this paper, we propose a quantum circuit implementation scheme for the involutive lightweight block cipher (IVLBC) block cipher. We utilized the DORCIS tool to implement the quantum circuit for the S-box and applied Gaussian elimination to construct the quantum circuit for matrix multiplication. Subsequently, we evaluated the overall quantum resource consumption required for the implementation. Based on this, we performed a quantum attack on IVLBC using Grover’s algorithm, calculating the attack cost using the NCT gate library, and further analyzed its security. Finally, we conducted a comparative analysis of the classical attack complexity and quantum attack complexity of IVLBC, highlighting the potential of using quantum complexity as a standard for future security assessments.