Abstract With the rapid development of quantum technology, modern cryptography is facing an increasing number of security threats. Given that the quantum circuit of symmetric‐key ciphers frequently serves as the core element of quantum attacks, it has attracted extensive attention. In this work, it is investigated that how the quantum circuit of SM4 and Camellia can be implemented with lower ‐depth. First, a general framework is proposed for designing Substitution‐box (S‐box) circuits with optimized ‐depth. Based on the framework, quantum circuits are respectively designed for SM4 S‐box and Camellia S‐box with ‐depth 4. Compared with existing quantum circuits requiring a ‐depth of 4, our circuits consume fewer qubits and quantum gates, as well as lower full depth. Besides, S‐box quantum circuits are introduced with ‐depth 3 for SM4 and Camellia for the first time. As an application, the designed S‐box circuits can reduce the ‐depth requiring for the subroutine and stand‐alone circuits of SM4 from 132 and 260 in the previous work to 99 and 195. Additionally, the ‐depth requiring for the subroutine and stand‐alone circuits of Camellia‐128/‐192/‐256 can be reduced from 92/126/126 and 108/150/150 in the previous work to 70/96/96 and 82/114/114, respectively.
Abstract With the rapid development of quantum technology, modern cryptography is facing an increasing number of security threats. Given that the quantum circuit of symmetric‐key ciphers frequently serves as the core element of quantum attacks, it has attracted extensive attention. In this work, it is investigated that how the quantum circuit of SM4 and Camellia can be implemented with lower ‐depth. First, a general framework is proposed for designing Substitution‐box (S‐box) circuits with optimized ‐depth. Based on the framework, quantum circuits are respectively designed for SM4 S‐box and Camellia S‐box with ‐depth 4. Compared with existing quantum circuits requiring a ‐depth of 4, our circuits consume fewer qubits and quantum gates, as well as lower full depth. Besides, S‐box quantum circuits are introduced with ‐depth 3 for SM4 and Camellia for the first time. As an application, the designed S‐box circuits can reduce the ‐depth requiring for the subroutine and stand‐alone circuits of SM4 from 132 and 260 in the previous work to 99 and 195. Additionally, the ‐depth requiring for the subroutine and stand‐alone circuits of Camellia‐128/‐192/‐256 can be reduced from 92/126/126 and 108/150/150 in the previous work to 70/96/96 and 82/114/114, respectively.
Camellia, after AES, is one of the most competitive block cipher algorithms. It has been widely used in many fields of information security. Camellia's distinctive nonlinear component is the S-box. This paper studies how to build the quantum circuit of the Camellia S-box at lower costs. First, the multiplicative inversion in F_2^8can be obtained by the multiplicative inversion (and multiplication) in F_2^4via a mapping matrix, and the latter can be implemented by the automation tool LIGHTER-R. The affine transformation of the S-box is then implemented with CNOT and NOT gates using the PLU decomposition and elimination approach. Finally, the Camellia S-box quantum circuit is built with 20 qubits, 54 Toffoli gates, 196 CNOT gates, 13 NOT gates, and a Toffoli depth of 42. In comparison with the previous study, which required 23 qubits, 67 Toffoli, and 38 CNOT gates, and a Toffoli depth of 53, the S-box quantum circuit in this paper requires fewer resources. Furthermore, the S-box quantum circuit used in the study can reduce the quantum resources in implementing Camellia, reducing the quantum circuit scale required to attack Camellia by the Grover algorithm.
In recent years, the quantum circuit implementation in symmetric cryptography has attracted widespread attention. The SM4 block cipher algorithm is China's first commercial cipher standard and was accepted as an ISO/IEC international standard in 2021. S-box is the most complex component in the SM4 block cipher algorithm. This study investigates the quantum circuit implementation of the SM4 S-box. Based on the algebraic structure, using tower filed decomposition technology, the quantum circuit of the SM4 S-box is built. Based on the number of NCT gate sets, our quantum circuit requires 20 qubits, 52 Toffoli gates, 196 CNOT gates, and 13 X gates. The Toffoli depth of our circuit is 36. Compared with previous literature, the quantum circuit proposed herein requires fewer quantum resources.
With the continuous development of quantum technology and the gradual advancement of quantum computers, the challenges faced by modern cryptography are becoming increasingly diverse. When analyzing the security strength of cryptographic algorithms against quantum attacks, the construction of quantum implementation circuits is a crucial aspect. Symmetric-key cryptography is an important component of modern cryptography. This study reviews the research results of optimizing the quantum implementation of symmetric-key cryptography under quantum computing models. Specifically, this work summarizes the construction of reversible circuits for linear layers, Substitution-boxes (S-boxes), and various addition operations, as well as the quantum implementation of symmetric-key ciphers such as AES, SM4, and Camellia.
Abstract SM4 cryptographic algorithm is a block cipher algorithm issued by China's state cryptographic administration and has become an international standard. we implement the quantum circuits of SM4 Block cipher by optimizing the number of qubits and the value of depth-times-width. When the S-box is implemented, four kind of improved quantum circuits of S-box are presented for different phases in SM4 based on composite field arithmetic. When optimizing the number of qubits, we implement the quantum circuit of SM4 by connecting the quantum subcircuits in series. The implemented quantum circuit of SM4 only uses 260 qubits, which is the least number of qubits used not only in implementing the SM4 quantum circuit, but also in implementing the block cipher algorithms with 8-bit S-box, 128-bit plaintext and 128-bit secret key. When optimizing the value of depth-times-width, we achieve it through parallel implementation. The trade-off quantum circuit uses a total of 288 quantum bits and the Toffoli depth is 1716. The depth-times-width is 494208, which is less than the existing best value 825792.
With the advancement of quantum computing, quantum circuit implementations of symmetric cryptographic algorithms are essential for evaluating their resistance to quantum attacks. As an ISO-standardized cipher, the efficient quantum circuit construction of Camellia is of great significance. Focusing on minimizing the DW-cost (qubits × Toffoli-depth) while balancing ancilla qubits and Toffoli-depth, this paper proposes an optimized quantum circuit design for Camellia. Specifically: (1) using a serial-multiplication and out-of-place inversion architecture under composite-field decomposition, combined with hierarchical screening for parallelizing bilinear multiplications, a compact in-place S-box quantum circuit is constructed with a DW-cost of 276, 28% lower than the state of the art; (2) a low-gate-count linear-layer circuit is obtained via heuristic search, and gate-sequence reordering then reduces the full depth from 9 to 7 without increasing the gate count; (3) Camellia-128/192/256 quantum circuits are constructed with DW-costs of 119,168, 257,664, and 257,664, achieving reductions of 48%, 52%, and 52% respectively over prior work. A pipelined Grover oracle is further designed and the total resources required for a full Grover search attacking Camellia are evaluated. For Camellia-128, the complete Grover search requires a T-depth of 2.10 × 2⁷⁶ and a total TDW-cost (qubits × T-depth) of 1.00 × 2⁸⁶, reducing T-depth by 75% and TDW-cost by 84% over prior work. The first full Grover search resource estimates for Camellia-192/256 are also presented, with T-depths of 7.20 × 2¹⁰⁸ and 8.11 × 2¹⁴⁰ and TDW-costs of 2.03 × 2¹²³ and 2.79 × 2¹⁵³, respectively. These results show that Grover's attack on Camellia requires fewer quantum resources than on AES at the 128-bit level, implying comparatively weaker post-quantum security at that key size, while the picture reverses at larger key sizes (Section 4).
Substitution boxes (S-boxes) serve as fundamental non-linear components in symmetric cryptography, and their quantum circuit implementation is critical for quantum security. This work addresses the dual challenges of quantum circuit depth optimization and computational intractability in S-box synthesis. We introduce memory-optimized data structures, a pointer-efficient RandomAccessSet and a dynamic devector, that reduce memory overhead by 12 times per element, thereby mitigating the computational complexity associated with Pauli representation. Our enhanced Meet-in-the-Middle framework achieves exhaustive depth optimization for standardized S-boxes, demonstrating up to 8.5% depth reduction over DORCIS baselines at equivalent T-depth. The approach scales to 5-8-bit primitives, establishing memory efficiency as an independent resource dimension in quantum circuit synthesis. Comparative analysis under varied cost parameters provides new insights for resource-efficient cryptographic implementations on quantum hardware.