Abstract In this paper, we present a new framework to construct a quantum circuit of S-boxes.We first model the quantum circuits of S-boxes based on the Toffoli and linear layers. We generate vector spaces with the values of qubits used in the linear layers and apply them to find quantum circuits.Our technique find the quantum circuit by matching the vector space's elements to the S-box's input and output, based on the meet-in-the-middle strategy.We applied our technique to 4-bit S-boxes.While existing LIGHTER-R tools only find 4-bit S-boxes circuits that can be implemented with 4 qubits, our tool accomplishes the same with 5 qubits.Our tool also finds reversible quantum circuits of 4-bit S-boxes, which are odd permutations that LIGHTER-R cannot.We expect our technique will become an important step towards finding optimized S-box quantum circuits.
Abstract In this paper, we present a new framework to construct a quantum circuit of S-boxes.We first model the quantum circuits of S-boxes based on the Toffoli and linear layers. We generate vector spaces with the values of qubits used in the linear layers and apply them to find quantum circuits.Our technique find the quantum circuit by matching the vector space's elements to the S-box's input and output, based on the meet-in-the-middle strategy.We applied our technique to 4-bit S-boxes.While existing LIGHTER-R tools only find 4-bit S-boxes circuits that can be implemented with 4 qubits, our tool accomplishes the same with 5 qubits.Our tool also finds reversible quantum circuits of 4-bit S-boxes, which are odd permutations that LIGHTER-R cannot.We expect our technique will become an important step towards finding optimized S-box quantum circuits.
Abstract— This article presents a comprehensive analysis of Denisenko's method for constructing quantum circuits for S-boxes without using ancilla qubits. We elaborate on this methodology in terms of practical aspects that can be applied to S-boxes or permutations of arbitrary sizes. In addition, we created an automatic tool in C++ language that allows to construction of quantum circuits for any S-box without ancilla qubits. Furthermore, a quantum circuit for an 8-bit S-box of the MKV block cipher standard in the civilian sector of Vietnam is also provided using this tool.
In recent years, quantum technology has been rapidly developed. As security analyses for symmetric ciphers continue to emerge, many require an evaluation of the resources needed for the quantum circuit implementation of the encryption algorithm. In this regard, we propose the quantum circuit decision problem, which requires us to determine whether there exists a quantum circuit for a given permutation f using M ancilla qubits and no more than K quantum gates within the circuit depth D. Firstly, we investigate heuristic algorithms and classical SAT-based models in previous works, revealing their limitations in solving the problem. Hence, we innovatively propose an improved SAT-based model incorporating three metrics of quantum circuits. The model enables us to find the optimal quantum circuit of an arbitrary 3 or 4-bit S-box under a given optimization goal based on SAT solvers, which has proved the optimality of circuits constructed by the tool, LIGHTER-R. Then, by combining different criteria in the model, we find more compact quantum circuit implementations of S-boxes such as RECTANGLE and GIFT. For GIFT S-box, our model provides the optimal quantum circuit that only requires 8 gates with a depth of 31. Furthermore, our model can be generalized to linear layers and improve the previous SAT-based model proposed by Huang et al. in ASIACRYPT 2022 by adding the criteria on the number of qubits and the circuit depth.
Substitution boxes (S-boxes) serve as fundamental non-linear components in symmetric cryptography, and their quantum circuit implementation is critical for quantum security. This work addresses the dual challenges of quantum circuit depth optimization and computational intractability in S-box synthesis. We introduce memory-optimized data structures, a pointer-efficient RandomAccessSet and a dynamic devector, that reduce memory overhead by 12 times per element, thereby mitigating the computational complexity associated with Pauli representation. Our enhanced Meet-in-the-Middle framework achieves exhaustive depth optimization for standardized S-boxes, demonstrating up to 8.5% depth reduction over DORCIS baselines at equivalent T-depth. The approach scales to 5-8-bit primitives, establishing memory efficiency as an independent resource dimension in quantum circuit synthesis. Comparative analysis under varied cost parameters provides new insights for resource-efficient cryptographic implementations on quantum hardware.
Two different algorithms are presented for generating a quantum circuit realization of a matrix representing a permutation on 2n letters. All circuits involve n qubits and only use multi--controlled Toffoli gates. The first algorithm constructs a circuit from any decomposition of the permutation into a product of transpositions, but uses one ancilla line. The second, which uses no ancillae, constructs a circuit from a decomposition into a product of transpositions that have a Hamming distance of one. We show that any permutation admits such a decomposition, and we give a strategy for reducing the number of transpositions involved.
In this paper, we consider the problem of quantum implementation of the symmetric-key ciphers. The typical ciphers in this category have two main components, the linear and the non-linear layers, we consider both. The linear layer can be described as a non-singular matrix over binary operations. The in-place implementation is one of the main considerations for implementing such layer to minimize the number of qubits. We discuss the research works that have been done to this point on this subject matter and report the improved implementation of some of the matrices. Lists of our modifications include; making it more efficient (specially for the larger matrices), consideration for quantum depth (along with a randomized algorithm for optimization), etc. We report benchmarks for the ASCON and SHA-2 linear matrices. As for the non-linear layer, the constituent block is called an substitution box (an S-box, for short). Our “DORCIS” tool presented in this paper, finds a quantum circuit with an optimized depth for given S-boxes of size 3- and 4-bit. It is a follow-up work on LIGHTER-R (which is applicable for 4-bit S-boxes only) with multiple extensions. Unlike LIGHTER-R, our DORCIS takes a quantum decomposition based on Clifford and T gates. Also, both the full quantum depth and the T depth can be optimized by DORCIS. We compare our implementation with other optimized quantum circuits shown in the other research works and show that we find an implementation with the same cost metric, or find an implementation with lower cost metric, compared other tools proposed in the literature, apart from being simpler and more efficient.
Abstract Quantum computing poses a significant threat to modern cryptosystems, prompting nations to initiate the development of next-generation cryptographic algorithms where quantum security assessment constitutes a critical task. In this work, we present the first complete quantum attack circuit construction and security evaluation of quantum resistance for the authenticated encryption algorithm MK-3, which features 16-bit S-boxes. Firstly, we achieve breakthroughs in finite field arithmetic. The arrangement method of Toffoli gates in the subfield F24 F 2 4 enables two types of optimized F28 F 2 8 multiplication circuits to reduce DW-cost by at least 50%. For F28 F 2 8 inversion, by proposing a new intermediate state uncomputing technique, the DW-cost of the inversion circuit is reduced by at least 40% compared with existing solutions. This can also be used to optimize the quantum circuits of block ciphers such as AES and SM4. Secondly, we propose three types of quantum circuits for MK-3’s 16-bit S-box. The basic circuit reduces multiplicative bit operations to 115, representing at least 20% reduction. We propose a more compact S-box structure, reducing the number of circuit qubits for two types of S-boxes from 52 to 40. Finally, we implement full-algorithm quantum attacks and conduct security evaluations for MK-3. Complete quantum circuits supporting 128-bit and 256-bit keys are constructed, enabling Grover key search attacks. Security assessments confirm the 128-bit version meets NIST Security Category 1 (with reasonable inference of achieving Category 2), while the 256-bit version satisfies the highest Category 5 standards, demonstrating resistance against large-scale quantum computing attacks. This work achieves the first quantum circuit implementation for 16-bit S-boxes and provides critical evaluation benchmarks for post-quantum cryptography standardization.