© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

Zhongguo kexue. Wulixue Lixue Tianwenxue

An efficient quantum circuit implementation of ZUC-128 cipher with low T-depth

ZOU Jian, XIANG SiMing, ZOU ChangZhong, Wenling Wu

Published May 23, 2024• 3 citations

Abstract

祖冲之密码算法 (ZUC) 是我国推出的一种流密码算法, 本文主要研究如何以较低 T 深度实现ZUC-128 算法的完整量子线路. S 盒是 ZUC-128 算法非线性组件的重要组成部分, 首先本文通过穷搜剪枝策略和塔域分解技术分别获得了S0和S1的经典电路实现, 然后分两步设计S0和S1量子线路: 第一步是减小经典电路的与门深度, 第二步是实现量子线路的 T 深度等于经典电路的与门深度. 本文新型的S0和S1的量子线路的 T 深度都为 7. 同时本文还研究了加法器和 L 函数的量子线路实现, 以降低整体电路的T 深度. 最后本文探索出了 ZUC 算法整个流程的量子线路构造, 当工作步骤中的 L=32 轮时, 该量子线路需要 46008 个量子比特, 682340 个 T 门, 2008535 个 CNOT 门和 42680 个 NOT 门, T 深度为 11341, 其量子比特数与 T 深度的乘积为 5.22 × 10^8.

DOI: 10.1360/sspma-2024-0147

Related papers

Quantum Image Encryption Algorithm Based on ZUC

亚睛李

Computer Science and Application•Jan 1, 2023•0 citations

Quantum Cryptanalysis of ZUC and Related Resource Estimation

Suman Dutta, Anirban Ghatak, Anupam Chattopadhyay +1 more

Lecture notes in computer science•Dec 12, 2024•3 citations

Quantum circuit for implementing Camellia S-box with low costs

ZhenQiang Li, Gao Fei, Qin Su-Juan +1 more

Camellia, after AES, is one of the most competitive block cipher algorithms. It has been widely used in many fields of information security. Camellia's distinctive nonlinear component is the S-box. This paper studies how to build the quantum circuit of the Camellia S-box at lower costs. First, the multiplicative inversion in F_2^8can be obtained by the multiplicative inversion (and multiplication) in F_2^4via a mapping matrix, and the latter can be implemented by the automation tool LIGHTER-R. The affine transformation of the S-box is then implemented with CNOT and NOT gates using the PLU decomposition and elimination approach. Finally, the Camellia S-box quantum circuit is built with 20 qubits, 54 Toffoli gates, 196 CNOT gates, 13 NOT gates, and a Toffoli depth of 42. In comparison with the previous study, which required 23 qubits, 67 Toffoli, and 38 CNOT gates, and a Toffoli depth of 53, the S-box quantum circuit in this paper requires fewer resources. Furthermore, the S-box quantum circuit used in the study can reduce the quantum resources in implementing Camellia, reducing the quantum circuit scale required to attack Camellia by the Grover algorithm.

Zhongguo kexue. Wulixue Lixue Tianwenxue•Mar 2, 2023•5 citations

Analysis of Quantum Circuit Implementation for Cryptographic Algorithms Resistant to Quantum Computing

Seyoung Yoon, Gyeongju Song, Hwajeong Seo

양자컴퓨팅 환경에서 안전성을 보장하는 암호 알고리즘에 대한 연구는 최근 활발히 진행되고 있다. 본 논문에서는 비밀번호 기반 KDF(Key Derivation Function)인 Bcrypt와 이를 구성하는 Blowfish 블록 암호의 구조, P-array 및 S-box 테이블 업데이트 과정을 분석하고 이를 양자회로로 구현하는 방안을 제시한다. 또한, S-box를 반복적으로 참조하는 Bcrypt 특성상 대규모 qRAM이 필요함을 지적하였으며 다른 KDF인 Scrypt 및 Argon2와 비교함으로써 양자회로 구현의 실현 가능성을 검토하였다. 그 결과, 메모리 접근 방식과 연산 반복도 관점에서 Bcrypt가 상대적으로 많은 큐빗과 깊은 Depth를 요구함을 확인하였으며, 이는 양자컴퓨팅 환경에서도 Bcrypt가 강인한 암호화 알고리즘으로 평가될 수 있음을 시사한다.

The Journal of the Korean Institute of Information and Communication Engineering•Jun 30, 2025•0 citations

Alternative Tower Field Construction for Quantum Implementation of the AES S-Box

Doyoung Chung, Seungkwang Lee, Dooho Choi +1 more

Grover’s search algorithm allows a quantum adversary to find a$k$-bit secret key of a block cipher by making O($2^{k/2}$) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by the$\textit {T}$-depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requires$\textit {T}$-gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with low$\textit {T}$-depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing its$\textit {T}$-depth.

IEEE Transactions on Computers•Dec 15, 2021•22 citations

Utilizing Circulant Structure to Optimize the Implementations of Linear Layers

Buji Xu, Xiaoming Sun

In this paper, we propose a novel approach for optimizing the linear layer used in symmetric cryptography. It is observed that these matrices often have circulant structure. The basic idea of this work is to utilize the property to construct a sequence of transformation matrices, which allows subsequent heuristic algorithms to find more efficient implementations. Our results outperform previous works for various linear layers of block ciphers. For Whirlwind M0 , we obtain two implementations with 159 XOR counts (8% better than Yuan et al. at FSE 2025) and depth 17 (39% better than Shi et al. at AsiaCrypt 2024) respectively. For AES MixColumn, our automated method produces a quantum circuit with depth 10, which nearly matches the manually optimized state-of-the-art result by Zhang et al. at IEEE TC 2024, only with 2 extra CNOTs.

cs.CRCross-listedarXiv:2511.18226•Nov 25, 2025

祖冲之密码算法 (ZUC) 是我国推出的一种流密码算法, 本文主要研究如何以较低 T 深度实现ZUC-128 算法的完整量子线路. S 盒是 ZUC-128 算法非线性组件的重要组成部分, 首先本文通过穷搜剪枝策略和塔域分解技术分别获得了S0和S1的经典电路实现, 然后分两步设计S0和S1量子线路: 第一步是减小经典电路的与门深度, 第二步是实现量子线路的 T 深度等于经典电路的与门深度. 本文新型的S0和S1的量子线路的 T 深度都为 7. 同时本文还研究了加法器和 L 函数的量子线路实现, 以降低整体电路的T 深度. 最后本文探索出了 ZUC 算法整个流程的量子线路构造, 当工作步骤中的 L=32 轮时, 该量子线路需要 46008 个量子比特, 682340 个 T 门, 2008535 个 CNOT 门和 42680 个 NOT 门, T 深度为 11341, 其量子比特数与 T 深度的乘积为 5.22 × 10^8.

Camellia, after AES, is one of the most competitive block cipher algorithms. It has been widely used in many fields of information security. Camellia's distinctive nonlinear component is the S-box. This paper studies how to build the quantum circuit of the Camellia S-box at lower costs. First, the multiplicative inversion in F_2^8can be obtained by the multiplicative inversion (and multiplication) in F_2^4via a mapping matrix, and the latter can be implemented by the automation tool LIGHTER-R. The affine transformation of the S-box is then implemented with CNOT and NOT gates using the PLU decomposition and elimination approach. Finally, the Camellia S-box quantum circuit is built with 20 qubits, 54 Toffoli gates, 196 CNOT gates, 13 NOT gates, and a Toffoli depth of 42. In comparison with the previous study, which required 23 qubits, 67 Toffoli, and 38 CNOT gates, and a Toffoli depth of 53, the S-box quantum circuit in this paper requires fewer resources. Furthermore, the S-box quantum circuit used in the study can reduce the quantum resources in implementing Camellia, reducing the quantum circuit scale required to attack Camellia by the Grover algorithm.

양자컴퓨팅 환경에서 안전성을 보장하는 암호 알고리즘에 대한 연구는 최근 활발히 진행되고 있다. 본 논문에서는 비밀번호 기반 KDF(Key Derivation Function)인 Bcrypt와 이를 구성하는 Blowfish 블록 암호의 구조, P-array 및 S-box 테이블 업데이트 과정을 분석하고 이를 양자회로로 구현하는 방안을 제시한다. 또한, S-box를 반복적으로 참조하는 Bcrypt 특성상 대규모 qRAM이 필요함을 지적하였으며 다른 KDF인 Scrypt 및 Argon2와 비교함으로써 양자회로 구현의 실현 가능성을 검토하였다. 그 결과, 메모리 접근 방식과 연산 반복도 관점에서 Bcrypt가 상대적으로 많은 큐빗과 깊은 Depth를 요구함을 확인하였으며, 이는 양자컴퓨팅 환경에서도 Bcrypt가 강인한 암호화 알고리즘으로 평가될 수 있음을 시사한다.

Grover’s search algorithm allows a quantum adversary to find a

k

-bit secret key of a block cipher by making O(

2^{k/2}

) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by the

\textit {T}

-depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requires

\textit {T}

-gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with low

\textit {T}

-depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing its

\textit {T}

-depth.

In this paper, we propose a novel approach for optimizing the linear layer used in symmetric cryptography. It is observed that these matrices often have circulant structure. The basic idea of this work is to utilize the property to construct a sequence of transformation matrices, which allows subsequent heuristic algorithms to find more efficient implementations. Our results outperform previous works for various linear layers of block ciphers. For Whirlwind M0 , we obtain two implementations with 159 XOR counts (8% better than Yuan et al. at FSE 2025) and depth 17 (39% better than Shi et al. at AsiaCrypt 2024) respectively. For AES MixColumn, our automated method produces a quantum circuit with depth 10, which nearly matches the manually optimized state-of-the-art result by Zhang et al. at IEEE TC 2024, only with 2 extra CNOTs.