Grover’s search algorithm allows a quantum adversary to find a $k$ -bit secret key of a block cipher by making O( $2^{k/2}$ ) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by the $\textit {T}$ -depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requires $\textit {T}$ -gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with low $\textit {T}$ -depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing its $\textit {T}$ -depth.Grover’s search algorithm allows a quantum adversary to find a$k$-bit secret key of a block cipher by making O($2^{k/2}$) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by the$\textit {T}$-depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requires$\textit {T}$-gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with low$\textit {T}$-depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing its$\textit {T}$-depth.

IEEE Transactions on ComputersDec 15, 202122 citations

Implementation and Analysis of Ciphers in Quantum Computing

Anubhab Baksi, Kyungbae Jang

Computer architecture and design methodologiesJan 1, 20243 citations

Blok Şifrelemelerin Kuantum Uygulamaları

Çıldıroğlu, Hasan Ozgur

The emergence of quantum computing demands rigorous reassessment of classical cryptographic primitives, particularly lightweight block ciphers (LBCs). This work addresses this critical need by presenting the first comprehensive quantum implementation and security analysis of the Feistel-based LBCs SLIM and MIBS against quantum cryptanalysis. Leveraging the inherent reversibility of the ciphers, we develop novel ancilla-free quantum circuits optimizing qubit utilization and depth. For SLIM-80, our design achieves 30,404 quantum cost with 112 qubits and depth of 4,066. For MIBS-64 and MIBS-80, we implement circuits with 23,371 and 24,363 quantum costs requiring 128 and 144 qubits, respectively, and a uniform depth of 4,768. We then quantify vulnerability to Grover’s key-search under the NIST PQC security constraint MAXDEPTH. By constructing Grover oracles under inner parallelization with multiple plaintext-ciphertext pairs to suppress false positives, we demonstrate total attack costs of 2^111 for SLIM-80 and MIBS-80, and 2^94 for MIBS-64. These costs fall below NIST’s Level-1 security threshold 2^170, confirming both ciphers’ susceptibility to quantum threats despite their lightweight efficiency. Our methodology establishes a quantum implementation framework for Feistel ciphers, revealing critical trade-offs among qubit efficiency, depth, and quantum resilience.The emergence of quantum computing demands rigorous reassessment of classical cryptographic primitives, particularly lightweight block ciphers (LBCs). This work addresses this critical need by presenting the first comprehensive quantum implementation and security analysis of the Feistel-based LBCs SLIM and MIBS against quantum cryptanalysis. Leveraging the inherent reversibility of the ciphers, we develop novel ancilla-free quantum circuits optimizing qubit utilization and depth. For SLIM-80, our design achieves 30,404 quantum cost with 112 qubits and depth of 4,066. For MIBS-64 and MIBS-80, we implement circuits with 23,371 and 24,363 quantum costs requiring 128 and 144 qubits, respectively, and a uniform depth of 4,768. We then quantify vulnerability to Grover’s key-search under the NIST PQC security constraint MAXDEPTH. By constructing Grover oracles under inner parallelization with multiple plaintext-ciphertext pairs to suppress false positives, we demonstrate total attack costs of 2^111 for SLIM-80 and MIBS-80, and 2^94 for MIBS-64. These costs fall below NIST’s Level-1 security threshold 2^170, confirming both ciphers’ susceptibility to quantum threats despite their lightweight efficiency. Our methodology establishes a quantum implementation framework for Feistel ciphers, revealing critical trade-offs among qubit efficiency, depth, and quantum resilience.

Sep 23, 20250 citations

Grover’s search algorithm allows a quantum adversary to find a

k

-bit secret key of a block cipher by making O(

2^{k/2}

) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by the

\textit {T}

-depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requires

\textit {T}

-gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with low

\textit {T}

-depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing its

\textit {T}

-depth.