Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IEEE Transactions on Computers

Alternative Tower Field Construction for Quantum Implementation of the AES S-Box

Doyoung Chung, Seungkwang Lee, Dooho Choi, Jooyoung Lee

Published Dec 15, 2021• 22 citations
Publisher

Abstract

Grover’s search algorithm allows a quantum adversary to find a$k$-bit secret key of a block cipher by making O($2^{k/2}$) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by the$\textit {T}$-depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requires$\textit {T}$-gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with low$\textit {T}$-depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing its$\textit {T}$-depth.

DOI
10.1109/tc.2021.3135759

Related papers

Constructing resource-efficient quantum circuits for AES

Liang Jiang, Bin‐Bin Cai, Fei Gao +3 more

An efficient quantum implementation of the advanced encryption standard (AES) is crucial for reducing the complexity of implementing an exhaustive key search through Grover’s algorithm. In this paper, we study how to construct resource-efficient quantum circuits for AES. We consider the product of T-gates depth and width (TDW) and the product of full depth and width (FDW) as optimization targets. We propose a generic method, called the controlled control qubit cascade (CCQC) technique, to construct quantum circuits for nonlinear components with reduced TDW and FDW. Using this, we construct a quantum circuit for the AES S-box. Compared with recent work presented at ASIACRYPT 2023, our S-box quantum circuit achieves reductions of 2.3% in TDW and 45.2% in FDW. Additionally, we propose a new key schedule strategy to reduce the full depth of the AES quantum circuit. Finally, the trade-offs between T-gates depth and width and the parallel numbers of S-box and TDW are analyzed.

Frontiers in Physics•Apr 22, 2025•2 citations

Efficient Implementation of PRESENT and GIFT on Quantum Computers

Kyungbae Jang, Gyeongju Song, Hyunjun Kim +3 more

Grover search algorithm is the most representative quantum attack method that threatens the security of symmetric key cryptography. If the Grover search algorithm is applied to symmetric key cryptography, the security level of target symmetric key cryptography can be lowered from n-bit to n2-bit. When applying Grover’s search algorithm to the block cipher that is the target of potential quantum attacks, the target block cipher must be implemented as quantum circuits. Starting with the AES block cipher, a number of works have been conducted to optimize and implement target block ciphers into quantum circuits. Recently, many studies have been published to implement lightweight block ciphers as quantum circuits. In this paper, we present optimal quantum circuit designs of symmetric key cryptography, including PRESENT and GIFT block ciphers. The proposed method optimized PRESENT and GIFT block ciphers by minimizing qubits, quantum gates, and circuit depth. We compare proposed PRESENT and GIFT quantum circuits with other results of lightweight block cipher implementations in quantum circuits. Finally, quantum resources of PRESENT and GIFT block ciphers required for the oracle of the Grover search algorithm were estimated.

Applied Sciences•May 23, 2021•54 citations

QUANTUM-ENHANCED SYMMETRICAL CRYPTOANALYSIS OF S-AES

InfoTeCS JSC, A. D. Moiseevskiy, Sofya Manko +1 more

Objective of the study: to study the possibility of reducing quantum resource requirements for Grover's algorithm attack on block ciphers. Simplified-AES is considered as an example. To investigate the possibilities of using a partial key leakage. To estimate the required resources and to simulate a quantum attack on S-AES with reduced requirements. Research methods: algebraic analysis, numerical simulation. Research results: we have demonstrated the possibility of significantly reducing the number of qubits required to attack Simplified-AES by optimizing Grover's oracle. The resource requirements are reduced sufficiently, allowing to study quantum attack on Simplified-AES using numerical simulation on a PC with 400 MB of RAM in about 30 minutes (depending on the CPU configuration). A numerical simulation of a quantum attack on S-AES has been carried out for the case of an ideal leakage configuration, taking into account the elementary quantum noises. Scientific novelty: a new quantum attack algorithm for Simplified-AES cipher with significantly reduced requirements for the qubits number is proposed. Numerical simulation of the attack using this algorithm is carried out, which was practically impossible for previously known approaches. The results illustrate that our ideas about the resource requirements for a quantum attack and, as a consequence, the possible time of its practical implementation can be significantly incorrect if an alternative method for implementing even an already known asymptotically unimprovable quantum attack algorithm is found.

Voprosy kiberbezopasnosti•Jan 1, 2025•0 citations

Implementing Grover’s on AES-based AEAD schemes

Surajit Mandal, Ravi Anand, Mostafizar Rahman +2 more

Extensive research is currently underway to determine the security of existing ciphers in light of the advancements in quantum computing. Against symmetric key cryptography, Grover’s search algorithm is a prominent attack, capable of reducing search costs to the square root. For using Grover’s algorithm, it is imperative to embed the target cipher into a quantum circuit. Even so, this area of research is relatively new; it has garnered significant attention from the research community. In this study, we provide the first estimation of the cost of Grover’s key search attack against the AES-based AEAD schemes Rocca-S, AEGIS-128, and Tiaoxin-346. Our analysis considers circuit depth restrictions specified in NIST’s PQC standardization process. Considering NIST’s maximum depth constraints, We present the overall cost of these attacks using gate count and depth-times-width metrics. We observed that for $$\textsf{MAXDEPTH} = 2^{40}$$ , Rocca-S, AEGIS-128, and Tiaoxin-346 can be retrieved using Grover’s search algorithm with gate count of 1.09 × 2253, 1.14 × 2124, and 1.22 × 2124 respectively. Concerning the current updated values by NIST, these ciphers are secure in terms of the cost of implementing Grover’s attack for key recovery. The quantum circuits of these ciphers are implemented using QISKIT, an open-source software development kit (SDK) designed for working with quantum computers running on the IBM Quantum Experience platform.

Scientific Reports•Sep 10, 2024•9 citations

Grover on Korean Block Ciphers

Kyoungbae Jang, Seungju Choi, Hyeokdong Kwon +3 more

The Grover search algorithm reduces the security level of symmetric key cryptography with n-bit security level to O(2n/2). In order to evaluate the Grover search algorithm, the target block cipher should be efficiently implemented in quantum circuits. Recently, many research works evaluated required quantum resources of AES block ciphers by optimizing the expensive substitute layer. However, few works were devoted to the lightweight block ciphers, even though it is an active research area, nowadays. In this paper, we present optimized implementations of every Korean made lightweight block ciphers for quantum computers, which include HIGHT, CHAM, and LEA, and NSA made lightweight block ciphers, namely SPECK. Primitive operations for block ciphers, including addition, rotation, and exclusive-or, are finely optimized to achieve the optimal quantum circuit, in terms of qubits, Toffoli gate, CNOT gate, and X gate. To the best of our knowledge, this is the first implementation of ARX-based Korean lightweight block ciphers in quantum circuits.

Applied Sciences•Sep 14, 2020•34 citations

Investigating the Impact of Grover's Algorithm on AES S-Box

Nur Fahima Iwani binti Ahmad Irwan, Md Nabil Ahmad Zawawi, Reema Thabit

Quantum computing poses a significant threat to classical cryptographic algorithms, particularly the Advanced Encryption Standard (AES). This study investigates the impact of Grover's algorithm on the AES S-box, a fundamental component of the AES encryption process. By leveraging quantum mechanics, Grover's algorithm can potentially reduce the time required to break AES encryption from 2128operations to 264operations, thus presenting a substantial security risk. This research aims to evaluate the feasibility of such quantum attacks on AES S-box by conducting experiments using virtual quantum simulators. The study examines the resource requirements, including the number of gates and qubits, and assesses the scalability of Grover's algorithm across different data sizes and types. The findings indicate that, while theoretically effective, the practical implementation of Grover's algorithm is currently hindered by significant resource constraints on existing quantum hardware. These results underscore the need for continued advancements in quantum technology and the development of quantum-resistant cryptographic methods to ensure data security in the quantum era. This research contributes to the understanding of quantum vulnerabilities in classical cryptography and supports the development of robust encryption strategies that can withstand future quantum attacks.

International Conference on Knowledge and Systems Engineering/Proceedings•Nov 5, 2024•0 citations
Grover’s search algorithm allows a quantum adversary to find akkk-bit secret key of a block cipher by making O(2k/22^{k/2}2k/2) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by theT\textit {T}T-depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requiresT\textit {T}T-gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with lowT\textit {T}T-depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing itsT\textit {T}T-depth.
An efficient quantum implementation of the advanced encryption standard (AES) is crucial for reducing the complexity of implementing an exhaustive key search through Grover’s algorithm. In this paper, we study how to construct resource-efficient quantum circuits for AES. We consider the product of T-gates depth and width (TDW) and the product of full depth and width (FDW) as optimization targets. We propose a generic method, called the controlled control qubit cascade (CCQC) technique, to construct quantum circuits for nonlinear components with reduced TDW and FDW. Using this, we construct a quantum circuit for the AES S-box. Compared with recent work presented at ASIACRYPT 2023, our S-box quantum circuit achieves reductions of 2.3% in TDW and 45.2% in FDW. Additionally, we propose a new key schedule strategy to reduce the full depth of the AES quantum circuit. Finally, the trade-offs between T-gates depth and width and the parallel numbers of S-box and TDW are analyzed.
Grover search algorithm is the most representative quantum attack method that threatens the security of symmetric key cryptography. If the Grover search algorithm is applied to symmetric key cryptography, the security level of target symmetric key cryptography can be lowered from n-bit to n2-bit. When applying Grover’s search algorithm to the block cipher that is the target of potential quantum attacks, the target block cipher must be implemented as quantum circuits. Starting with the AES block cipher, a number of works have been conducted to optimize and implement target block ciphers into quantum circuits. Recently, many studies have been published to implement lightweight block ciphers as quantum circuits. In this paper, we present optimal quantum circuit designs of symmetric key cryptography, including PRESENT and GIFT block ciphers. The proposed method optimized PRESENT and GIFT block ciphers by minimizing qubits, quantum gates, and circuit depth. We compare proposed PRESENT and GIFT quantum circuits with other results of lightweight block cipher implementations in quantum circuits. Finally, quantum resources of PRESENT and GIFT block ciphers required for the oracle of the Grover search algorithm were estimated.
Objective of the study: to study the possibility of reducing quantum resource requirements for Grover's algorithm attack on block ciphers. Simplified-AES is considered as an example. To investigate the possibilities of using a partial key leakage. To estimate the required resources and to simulate a quantum attack on S-AES with reduced requirements. Research methods: algebraic analysis, numerical simulation. Research results: we have demonstrated the possibility of significantly reducing the number of qubits required to attack Simplified-AES by optimizing Grover's oracle. The resource requirements are reduced sufficiently, allowing to study quantum attack on Simplified-AES using numerical simulation on a PC with 400 MB of RAM in about 30 minutes (depending on the CPU configuration). A numerical simulation of a quantum attack on S-AES has been carried out for the case of an ideal leakage configuration, taking into account the elementary quantum noises. Scientific novelty: a new quantum attack algorithm for Simplified-AES cipher with significantly reduced requirements for the qubits number is proposed. Numerical simulation of the attack using this algorithm is carried out, which was practically impossible for previously known approaches. The results illustrate that our ideas about the resource requirements for a quantum attack and, as a consequence, the possible time of its practical implementation can be significantly incorrect if an alternative method for implementing even an already known asymptotically unimprovable quantum attack algorithm is found.
Extensive research is currently underway to determine the security of existing ciphers in light of the advancements in quantum computing. Against symmetric key cryptography, Grover’s search algorithm is a prominent attack, capable of reducing search costs to the square root. For using Grover’s algorithm, it is imperative to embed the target cipher into a quantum circuit. Even so, this area of research is relatively new; it has garnered significant attention from the research community. In this study, we provide the first estimation of the cost of Grover’s key search attack against the AES-based AEAD schemes Rocca-S, AEGIS-128, and Tiaoxin-346. Our analysis considers circuit depth restrictions specified in NIST’s PQC standardization process. Considering NIST’s maximum depth constraints, We present the overall cost of these attacks using gate count and depth-times-width metrics. We observed that for MAXDEPTH=240\textsf{MAXDEPTH} = 2^{40}MAXDEPTH=240 , Rocca-S, AEGIS-128, and Tiaoxin-346 can be retrieved using Grover’s search algorithm with gate count of 1.09 × 2253, 1.14 × 2124, and 1.22 × 2124 respectively. Concerning the current updated values by NIST, these ciphers are secure in terms of the cost of implementing Grover’s attack for key recovery. The quantum circuits of these ciphers are implemented using QISKIT, an open-source software development kit (SDK) designed for working with quantum computers running on the IBM Quantum Experience platform.
The Grover search algorithm reduces the security level of symmetric key cryptography with n-bit security level to O(2n/2). In order to evaluate the Grover search algorithm, the target block cipher should be efficiently implemented in quantum circuits. Recently, many research works evaluated required quantum resources of AES block ciphers by optimizing the expensive substitute layer. However, few works were devoted to the lightweight block ciphers, even though it is an active research area, nowadays. In this paper, we present optimized implementations of every Korean made lightweight block ciphers for quantum computers, which include HIGHT, CHAM, and LEA, and NSA made lightweight block ciphers, namely SPECK. Primitive operations for block ciphers, including addition, rotation, and exclusive-or, are finely optimized to achieve the optimal quantum circuit, in terms of qubits, Toffoli gate, CNOT gate, and X gate. To the best of our knowledge, this is the first implementation of ARX-based Korean lightweight block ciphers in quantum circuits.
Quantum computing poses a significant threat to classical cryptographic algorithms, particularly the Advanced Encryption Standard (AES). This study investigates the impact of Grover's algorithm on the AES S-box, a fundamental component of the AES encryption process. By leveraging quantum mechanics, Grover's algorithm can potentially reduce the time required to break AES encryption from 2128operations to 264operations, thus presenting a substantial security risk. This research aims to evaluate the feasibility of such quantum attacks on AES S-box by conducting experiments using virtual quantum simulators. The study examines the resource requirements, including the number of gates and qubits, and assesses the scalability of Grover's algorithm across different data sizes and types. The findings indicate that, while theoretically effective, the practical implementation of Grover's algorithm is currently hindered by significant resource constraints on existing quantum hardware. These results underscore the need for continued advancements in quantum technology and the development of quantum-resistant cryptographic methods to ensure data security in the quantum era. This research contributes to the understanding of quantum vulnerabilities in classical cryptography and supports the development of robust encryption strategies that can withstand future quantum attacks.