Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Zhongguo kexue. Wulixue Lixue Tianwenxue

Optimized quantum implementations of SM3 with low T-depth and low width

YANG TingYu, Shasha Zhang, Zejun Xiang, Da Lin, GUO YunYu

Published Mar 24, 2025• 0 citations
Publisher

Abstract

SM3 is a hash algorithm independently developed by China. This work mainly studies the quantum circuit implementation of SM3 based on the Clifford+T gate set, and proposes two quantum implementation structures for optimizing the T-depth and width of the circuit, respectively. For the design of quantum circuits with lower T-depth, this paper implements multiple modulo adders applied in parallel, and designs an implementation of quantum circuits for nonlinear components with lower T-depth by utilizing the QAND gate and its conjugate transpose. Based on this, the paper proposes two quantum circuit implementations of the SM3 according to the out-of-place and in-place structures of the nonlinear component, with T-depths of 7040 and 7136, respectively. Compared with the existing circuit with the lowest T-depth, the proposed circuit reduces the T-depth by 72%. For the design of quantum circuits with lower width, this paper groups the constants and variables in the constant modulo addition step, leading to the implementation of the constant modulo operation based on 32 bits only consumes 11 ancilla qubits when the size of group is 4 or 8. Based on this, the paper proposes a quantum circuit implementation of the SM3 that consumes 779 qubits, including 11 ancilla qubits. Compared with the existing circuit with the least consumption of ancilla qubits, the proposed circuit reduces the consumption of ancilla qubits by 67%.

DOI
10.1360/sspma-2025-0077

Related papers

Low T-depth Quantum Circuit Implementation of SM3 Hash Function

Zou Jian, LI Junkang, GUO Nansheng +2 more

To address the high T-depth issue in SM3 hash function quantum circuits caused by in-place computation, a low T-depth architecture was proposed. By introducing Wallace tree-based quantum carry-save adders and low-depth full/half adders, the multi-operand modular addition path was compressed to a constant level. Furthermore, allocating extra qubits to store intermediate states eliminated the high T-depth operations required for uncomputing ancilla qubits. Experiments demonstrate that using 5 453 qubits reduced the circuit T-depth from 4 528 to 1 712 and decreased the total T-gate count from 965 632 to 314 112. The proposed scheme provides an efficient approach for evaluating the post-quantum security of symmetric cryptography.

•Jan 1, 2026•0 citations

Efficient quantum circuit implementations of SM3 and RIPEMD-160 Hash functions

邹健, GUO Nansheng, LI Junkang

The development of quantum computing technology poses potential threats to the security of existing cryptographic algorithms, making it urgent to develop efficient quantum circuit implementation schemes to support security assessments. To design low-T-depth and efficient quantum circuits for the SM3 and RIPEMD-160 Hash functions, the following methods were employed. For SM3, the overall circuit was optimized by applying low-T-depth quantum adders and reorganizing the quantum components. For RIPEMD-160, a low-T-depth quantum implementation of its Boolean functions was designed, the hierarchical parallel arrangement of its compression function was optimized, and its quantum circuit was constructed for the first time. The results show that the proposed SM3 quantum circuit significantly outperforms existing schemes in terms of T-depth and T-DW-cost, with a T-depth of 4 528. The first-time implemented RIPEMD-160 quantum circuit achieves a T-depth of 4 454. These provide efficient circuit implementation schemes for the security assessment of SM3 and RIPEMD-160 in quantum environments.

•Dec 1, 2025•0 citations

T-count and Qubit Optimized Quantum Circuit Designs of Carry Lookahead Adder

Himanshu Thapliyal, Edgard Muñoz‐Coreas, Vladislav Khalus

Quantum circuits of arithmetic operations such as addition are needed to implement quantum algorithms in hardware. Quantum circuits based on Clifford+T gates are used as they can be made tolerant to noise. The tradeoff of gaining fault tolerance from using Clifford+T gates and error correcting codes is the high implementation overhead of the T gate. As a result, the T-count performance measure has become important in quantum circuit design. Due to noise, the risk for errors in a quantum circuit computation increases as the number of gate layers (or depth) in the circuit increases. As a result, low depth circuits such as quantum carry lookahead adders (QCLA)s have caught the attention of researchers. This work presents two QCLA designs each optimized with emphasis on T-count or qubit cost respectively. In-place and out-of-place versions of each design are shown. The proposed QCLAs are compared against the existing works in terms of T-count. The proposed QCLAs for out-of-place addition achieve average T gate savings of $54.34 \%$ and $37.21 \%$, respectively. The proposed QCLAs for in-place addition achieve average T gate savings of $72.11 \%$ and $35.87 \%$

arXiv:2004.01826•Apr 4, 2020•6 citations

Grover on Scrypt

Gyeongju Song, Hwajeong Seo

This paper presents an optimized quantum circuit for the scrypt cryptographic algorithm. We applied various optimization techniques to reduce the DW cost, which is the product of the time and space complexity of quantum circuits. In our proposed method, the number of ancilla qubits was significantly reduced through the use of optimized inverse operations, while the depth was minimized by implementing parallel structures. For the SHA-256, we devised a structure that achieves a substantial reduction in the number of ancilla qubits with only a slight increase in quantum circuit depth. By cleaning the dirty ancilla qubits used in the previous round through inverse operations, we enabled their reuse in each subsequent round. Specifically, we reduced the number of 8128 ancilla qubits, achieving this with an increase of only 6 in the full depth of the quantum circuit. Additionally, within Salsa20/8 in SMix, we reused qubits through inverse operations and performed some operations in parallel to reduce both the number of qubits and the overall quantum circuit depth. Finally, our quantum circuit for scrypt demonstrates a significant reduction in the width (the number of qubits) with only a minimal increase in the full quantum circuit depth.

Electronics•Aug 10, 2024•1 citation

Optimized Quantum Circuit of AES With Interlacing-Uncompute Structure

Mengyuan Zhang, Tairong Shi, Wenling Wu +1 more

In the post-quantum era, the security level of encryption algorithms is often evaluated based on the quantum resources required to attack AES. In this work, we make thoroughly estimations on various performance metrics of the quantum circuit of AES-128/192/256. Firstly, we introduce a generic round structure for in-place implementation of the AES algorithm, maximizing the parallelism between nonlinear components. Specifically, when employed as an encryption oracle, our structure reduces the$T$-depth from$2rd$to$(r+1)d$. Furthermore, by leveraging the properties of block-cyclic matrices, we present an in-place implementation circuit for MixColumn with depth 10, utilizing 105 CNOT gates. In relation to the S-box, we have assessed its minimum circuit width at different$T$-depths and provide multiple versions of circuit implementations for a depth-width trade-off. Finally, based on our optimized S-box circuit, we conduct a comprehensive analysis of the implementation complexity of different round structures, where our structure exhibits significant advantages in terms of low$T$-depth.

IEEE Transactions on Computers•Aug 23, 2024•11 citations

RESOURCE EFFICIENT DESIGN OF QUANTUM CIRCUITS FOR CRYPTANALYSIS AND SCIENTIFIC COMPUTING APPLICATIONS

Edgard Muñoz‐Coreas

Quantum computers offer the potential to extend our abilities to tackle computational problems in fields such as number theory, encryption, search and scientific computation. Up to a superpolynomial speedup has been reported for quantum algorithms in these areas. Motivated by the promise of faster computations, the development of quantum machines has caught the attention of both academics and industry researchers. Quantum machines are now at sizes where implementations of quantum algorithms or their components are now becoming possible. In order to implement quantum algorithms on quantum machines, resource efficient circuits and functional blocks must be designed. In this work, we propose quantum circuits for Galois and integer arithmetic. These quantum circuits are necessary building blocks to realize quantum algorithms. The design of resource efficient quantum circuits requires the designer takes into account the gate cost, quantum bit (qubit) cost, depth and garbage outputs of a quantum circuit. Existing quantum machines do not have many qubits meaning that circuits with high qubit cost cannot be implemented. In addition, quantum circuits are more prone to errors and garbage output removal adds to overall cost. As more gates are used, a quantum circuit sees an increased rate of failure. Failures and error rates can be countered by using quantum error correcting codes and fault tolerant implementations of universal gate sets (such as Clifford+T gates). However, Clifford+T gates are costly to implement with the T gate being significantly more costly than the Clifford gates. As a result, designers working with Clifford+T gates seek to minimize the number of T gates (T-count) and the depth of T gates (T-depth). In this work, we propose quantum circuits for Galois and integer arithmetic with lower T-count, T-depth and qubit cost than existing work. This work presents novel quantum circuits for squaring and exponentiation over binary extension fields (Galois fields of form GF(2 m )). The proposed circuits are shown to have lower depth, qubit and gate cost to existing work. We also present quantum circuits for the core operations of multiplication and division which enjoy lower T-count, T-depth and qubit costs compared to existing work. This work also illustrates the design of a T-count and qubit cost efficient design for the square root. This work concludes with an illustration of how the arithmetic circuits can be combined into a functional block to implement quantum image processing algorithms.

•Aug 26, 2020•1 citation
SM3 is a hash algorithm independently developed by China. This work mainly studies the quantum circuit implementation of SM3 based on the Clifford+T gate set, and proposes two quantum implementation structures for optimizing the T-depth and width of the circuit, respectively. For the design of quantum circuits with lower T-depth, this paper implements multiple modulo adders applied in parallel, and designs an implementation of quantum circuits for nonlinear components with lower T-depth by utilizing the QAND gate and its conjugate transpose. Based on this, the paper proposes two quantum circuit implementations of the SM3 according to the out-of-place and in-place structures of the nonlinear component, with T-depths of 7040 and 7136, respectively. Compared with the existing circuit with the lowest T-depth, the proposed circuit reduces the T-depth by 72%. For the design of quantum circuits with lower width, this paper groups the constants and variables in the constant modulo addition step, leading to the implementation of the constant modulo operation based on 32 bits only consumes 11 ancilla qubits when the size of group is 4 or 8. Based on this, the paper proposes a quantum circuit implementation of the SM3 that consumes 779 qubits, including 11 ancilla qubits. Compared with the existing circuit with the least consumption of ancilla qubits, the proposed circuit reduces the consumption of ancilla qubits by 67%.
To address the high T-depth issue in SM3 hash function quantum circuits caused by in-place computation, a low T-depth architecture was proposed. By introducing Wallace tree-based quantum carry-save adders and low-depth full/half adders, the multi-operand modular addition path was compressed to a constant level. Furthermore, allocating extra qubits to store intermediate states eliminated the high T-depth operations required for uncomputing ancilla qubits. Experiments demonstrate that using 5 453 qubits reduced the circuit T-depth from 4 528 to 1 712 and decreased the total T-gate count from 965 632 to 314 112. The proposed scheme provides an efficient approach for evaluating the post-quantum security of symmetric cryptography.
The development of quantum computing technology poses potential threats to the security of existing cryptographic algorithms, making it urgent to develop efficient quantum circuit implementation schemes to support security assessments. To design low-T-depth and efficient quantum circuits for the SM3 and RIPEMD-160 Hash functions, the following methods were employed. For SM3, the overall circuit was optimized by applying low-T-depth quantum adders and reorganizing the quantum components. For RIPEMD-160, a low-T-depth quantum implementation of its Boolean functions was designed, the hierarchical parallel arrangement of its compression function was optimized, and its quantum circuit was constructed for the first time. The results show that the proposed SM3 quantum circuit significantly outperforms existing schemes in terms of T-depth and T-DW-cost, with a T-depth of 4 528. The first-time implemented RIPEMD-160 quantum circuit achieves a T-depth of 4 454. These provide efficient circuit implementation schemes for the security assessment of SM3 and RIPEMD-160 in quantum environments.
Quantum circuits of arithmetic operations such as addition are needed to implement quantum algorithms in hardware. Quantum circuits based on Clifford+T gates are used as they can be made tolerant to noise. The tradeoff of gaining fault tolerance from using Clifford+T gates and error correcting codes is the high implementation overhead of the T gate. As a result, the T-count performance measure has become important in quantum circuit design. Due to noise, the risk for errors in a quantum circuit computation increases as the number of gate layers (or depth) in the circuit increases. As a result, low depth circuits such as quantum carry lookahead adders (QCLA)s have caught the attention of researchers. This work presents two QCLA designs each optimized with emphasis on T-count or qubit cost respectively. In-place and out-of-place versions of each design are shown. The proposed QCLAs are compared against the existing works in terms of T-count. The proposed QCLAs for out-of-place addition achieve average T gate savings of 54.34%54.34 \%54.34% and 37.21%37.21 \%37.21%, respectively. The proposed QCLAs for in-place addition achieve average T gate savings of 72.11%72.11 \%72.11% and 35.87%35.87 \%35.87%
This paper presents an optimized quantum circuit for the scrypt cryptographic algorithm. We applied various optimization techniques to reduce the DW cost, which is the product of the time and space complexity of quantum circuits. In our proposed method, the number of ancilla qubits was significantly reduced through the use of optimized inverse operations, while the depth was minimized by implementing parallel structures. For the SHA-256, we devised a structure that achieves a substantial reduction in the number of ancilla qubits with only a slight increase in quantum circuit depth. By cleaning the dirty ancilla qubits used in the previous round through inverse operations, we enabled their reuse in each subsequent round. Specifically, we reduced the number of 8128 ancilla qubits, achieving this with an increase of only 6 in the full depth of the quantum circuit. Additionally, within Salsa20/8 in SMix, we reused qubits through inverse operations and performed some operations in parallel to reduce both the number of qubits and the overall quantum circuit depth. Finally, our quantum circuit for scrypt demonstrates a significant reduction in the width (the number of qubits) with only a minimal increase in the full quantum circuit depth.
In the post-quantum era, the security level of encryption algorithms is often evaluated based on the quantum resources required to attack AES. In this work, we make thoroughly estimations on various performance metrics of the quantum circuit of AES-128/192/256. Firstly, we introduce a generic round structure for in-place implementation of the AES algorithm, maximizing the parallelism between nonlinear components. Specifically, when employed as an encryption oracle, our structure reduces theTTT-depth from2rd2rd2rdto(r+1)d(r+1)d(r+1)d. Furthermore, by leveraging the properties of block-cyclic matrices, we present an in-place implementation circuit for MixColumn with depth 10, utilizing 105 CNOT gates. In relation to the S-box, we have assessed its minimum circuit width at differentTTT-depths and provide multiple versions of circuit implementations for a depth-width trade-off. Finally, based on our optimized S-box circuit, we conduct a comprehensive analysis of the implementation complexity of different round structures, where our structure exhibits significant advantages in terms of lowTTT-depth.
Quantum computers offer the potential to extend our abilities to tackle computational problems in fields such as number theory, encryption, search and scientific computation. Up to a superpolynomial speedup has been reported for quantum algorithms in these areas. Motivated by the promise of faster computations, the development of quantum machines has caught the attention of both academics and industry researchers. Quantum machines are now at sizes where implementations of quantum algorithms or their components are now becoming possible. In order to implement quantum algorithms on quantum machines, resource efficient circuits and functional blocks must be designed. In this work, we propose quantum circuits for Galois and integer arithmetic. These quantum circuits are necessary building blocks to realize quantum algorithms. The design of resource efficient quantum circuits requires the designer takes into account the gate cost, quantum bit (qubit) cost, depth and garbage outputs of a quantum circuit. Existing quantum machines do not have many qubits meaning that circuits with high qubit cost cannot be implemented. In addition, quantum circuits are more prone to errors and garbage output removal adds to overall cost. As more gates are used, a quantum circuit sees an increased rate of failure. Failures and error rates can be countered by using quantum error correcting codes and fault tolerant implementations of universal gate sets (such as Clifford+T gates). However, Clifford+T gates are costly to implement with the T gate being significantly more costly than the Clifford gates. As a result, designers working with Clifford+T gates seek to minimize the number of T gates (T-count) and the depth of T gates (T-depth). In this work, we propose quantum circuits for Galois and integer arithmetic with lower T-count, T-depth and qubit cost than existing work. This work presents novel quantum circuits for squaring and exponentiation over binary extension fields (Galois fields of form GF(2 m )). The proposed circuits are shown to have lower depth, qubit and gate cost to existing work. We also present quantum circuits for the core operations of multiplication and division which enjoy lower T-count, T-depth and qubit costs compared to existing work. This work also illustrates the design of a T-count and qubit cost efficient design for the square root. This work concludes with an illustration of how the arithmetic circuits can be combined into a functional block to implement quantum image processing algorithms.