In recent years, the quantum circuit implementation in symmetric cryptography has attracted widespread attention. The SM4 block cipher algorithm is China's first commercial cipher standard and was accepted as an ISO/IEC international standard in 2021. S-box is the most complex component in the SM4 block cipher algorithm. This study investigates the quantum circuit implementation of the SM4 S-box. Based on the algebraic structure, using tower filed decomposition technology, the quantum circuit of the SM4 S-box is built. Based on the number of NCT gate sets, our quantum circuit requires 20 qubits, 52 Toffoli gates, 196 CNOT gates, and 13 X gates. The Toffoli depth of our circuit is 36. Compared with previous literature, the quantum circuit proposed herein requires fewer quantum resources.
In recent years, the quantum circuit implementation in symmetric cryptography has attracted widespread attention. The SM4 block cipher algorithm is China's first commercial cipher standard and was accepted as an ISO/IEC international standard in 2021. S-box is the most complex component in the SM4 block cipher algorithm. This study investigates the quantum circuit implementation of the SM4 S-box. Based on the algebraic structure, using tower filed decomposition technology, the quantum circuit of the SM4 S-box is built. Based on the number of NCT gate sets, our quantum circuit requires 20 qubits, 52 Toffoli gates, 196 CNOT gates, and 13 X gates. The Toffoli depth of our circuit is 36. Compared with previous literature, the quantum circuit proposed herein requires fewer quantum resources.
Abstract SM4 cryptographic algorithm is a block cipher algorithm issued by China's state cryptographic administration and has become an international standard. we implement the quantum circuits of SM4 Block cipher by optimizing the number of qubits and the value of depth-times-width. When the S-box is implemented, four kind of improved quantum circuits of S-box are presented for different phases in SM4 based on composite field arithmetic. When optimizing the number of qubits, we implement the quantum circuit of SM4 by connecting the quantum subcircuits in series. The implemented quantum circuit of SM4 only uses 260 qubits, which is the least number of qubits used not only in implementing the SM4 quantum circuit, but also in implementing the block cipher algorithms with 8-bit S-box, 128-bit plaintext and 128-bit secret key. When optimizing the value of depth-times-width, we achieve it through parallel implementation. The trade-off quantum circuit uses a total of 288 quantum bits and the Toffoli depth is 1716. The depth-times-width is 494208, which is less than the existing best value 825792.
Camellia, after AES, is one of the most competitive block cipher algorithms. It has been widely used in many fields of information security. Camellia's distinctive nonlinear component is the S-box. This paper studies how to build the quantum circuit of the Camellia S-box at lower costs. First, the multiplicative inversion in F_2^8can be obtained by the multiplicative inversion (and multiplication) in F_2^4via a mapping matrix, and the latter can be implemented by the automation tool LIGHTER-R. The affine transformation of the S-box is then implemented with CNOT and NOT gates using the PLU decomposition and elimination approach. Finally, the Camellia S-box quantum circuit is built with 20 qubits, 54 Toffoli gates, 196 CNOT gates, 13 NOT gates, and a Toffoli depth of 42. In comparison with the previous study, which required 23 qubits, 67 Toffoli, and 38 CNOT gates, and a Toffoli depth of 53, the S-box quantum circuit in this paper requires fewer resources. Furthermore, the S-box quantum circuit used in the study can reduce the quantum resources in implementing Camellia, reducing the quantum circuit scale required to attack Camellia by the Grover algorithm.
Abstract With the rapid development of quantum technology, modern cryptography is facing an increasing number of security threats. Given that the quantum circuit of symmetric‐key ciphers frequently serves as the core element of quantum attacks, it has attracted extensive attention. In this work, it is investigated that how the quantum circuit of SM4 and Camellia can be implemented with lower ‐depth. First, a general framework is proposed for designing Substitution‐box (S‐box) circuits with optimized ‐depth. Based on the framework, quantum circuits are respectively designed for SM4 S‐box and Camellia S‐box with ‐depth 4. Compared with existing quantum circuits requiring a ‐depth of 4, our circuits consume fewer qubits and quantum gates, as well as lower full depth. Besides, S‐box quantum circuits are introduced with ‐depth 3 for SM4 and Camellia for the first time. As an application, the designed S‐box circuits can reduce the ‐depth requiring for the subroutine and stand‐alone circuits of SM4 from 132 and 260 in the previous work to 99 and 195. Additionally, the ‐depth requiring for the subroutine and stand‐alone circuits of Camellia‐128/‐192/‐256 can be reduced from 92/126/126 and 108/150/150 in the previous work to 70/96/96 and 82/114/114, respectively.
The security of commercial encryption algorithms has always been a focus of attention. The SM4 algorithm, a commercial cryptographic standard, has been recognized by ISO/IEC as an international standard and has shown excellent performance on classical computers. However, with the development of quantum computing, traditional encryption algorithms are facing new challenges. This paper investigates the quantum realization of SM4 algorithm. By applying the Grover algorithm to the SM4 algorithm, we conducted a quantum exhaustive attack and provided an estimation of the required quantum resources. This study offers a novel perspective on the application of quantum computing in breaking commercial encryption algorithms, which holds significant implications for the future development of quantum secure communication and cryptography.
With the continuous development of quantum technology and the gradual advancement of quantum computers, the challenges faced by modern cryptography are becoming increasingly diverse. When analyzing the security strength of cryptographic algorithms against quantum attacks, the construction of quantum implementation circuits is a crucial aspect. Symmetric-key cryptography is an important component of modern cryptography. This study reviews the research results of optimizing the quantum implementation of symmetric-key cryptography under quantum computing models. Specifically, this work summarizes the construction of reversible circuits for linear layers, Substitution-boxes (S-boxes), and various addition operations, as well as the quantum implementation of symmetric-key ciphers such as AES, SM4, and Camellia.
In recent years, quantum technology has been rapidly developed. As security analyses for symmetric ciphers continue to emerge, many require an evaluation of the resources needed for the quantum circuit implementation of the encryption algorithm. In this regard, we propose the quantum circuit decision problem, which requires us to determine whether there exists a quantum circuit for a given permutation f using M ancilla qubits and no more than K quantum gates within the circuit depth D. Firstly, we investigate heuristic algorithms and classical SAT-based models in previous works, revealing their limitations in solving the problem. Hence, we innovatively propose an improved SAT-based model incorporating three metrics of quantum circuits. The model enables us to find the optimal quantum circuit of an arbitrary 3 or 4-bit S-box under a given optimization goal based on SAT solvers, which has proved the optimality of circuits constructed by the tool, LIGHTER-R. Then, by combining different criteria in the model, we find more compact quantum circuit implementations of S-boxes such as RECTANGLE and GIFT. For GIFT S-box, our model provides the optimal quantum circuit that only requires 8 gates with a depth of 31. Furthermore, our model can be generalized to linear layers and improve the previous SAT-based model proposed by Huang et al. in ASIACRYPT 2022 by adding the criteria on the number of qubits and the circuit depth.