ABSTRACT Quantum computing environments make block ciphers susceptible to exhaustive key search attacks utilizing Grover's algorithm. However, such quantum‐based attacks remain impractical unless the targeted cipher is directly implemented on a quantum platform. Moreover, their efficiency significantly depends on the quantum circuit design and optimization of the block cipher in question. The cost of a quantum circuit implementation is typically measured by two main metrics: the number of qubits and the circuit depth ( T ‐depth). For most block ciphers, the S‐box is the principal factor contributing to increased T ‐depth and additional qubit requirements. This paper presents a method for generating quantum circuits directly from lookup tables of S‐boxes applicable to arbitrary block ciphers. We illustrate our approach using quantum circuit implementations of the PRESENT and DES ciphers as practical examples. Our proposed method is expected to efficiently implement arbitrary S‐boxes by employing polynomial evaluation, thus balancing time–space complexity.
ABSTRACT Quantum computing environments make block ciphers susceptible to exhaustive key search attacks utilizing Grover's algorithm. However, such quantum‐based attacks remain impractical unless the targeted cipher is directly implemented on a quantum platform. Moreover, their efficiency significantly depends on the quantum circuit design and optimization of the block cipher in question. The cost of a quantum circuit implementation is typically measured by two main metrics: the number of qubits and the circuit depth ( T ‐depth). For most block ciphers, the S‐box is the principal factor contributing to increased T ‐depth and additional qubit requirements. This paper presents a method for generating quantum circuits directly from lookup tables of S‐boxes applicable to arbitrary block ciphers. We illustrate our approach using quantum circuit implementations of the PRESENT and DES ciphers as practical examples. Our proposed method is expected to efficiently implement arbitrary S‐boxes by employing polynomial evaluation, thus balancing time–space complexity.
Grover search algorithm is the most representative quantum attack method that threatens the security of symmetric key cryptography. If the Grover search algorithm is applied to symmetric key cryptography, the security level of target symmetric key cryptography can be lowered from n-bit to n2-bit. When applying Grover’s search algorithm to the block cipher that is the target of potential quantum attacks, the target block cipher must be implemented as quantum circuits. Starting with the AES block cipher, a number of works have been conducted to optimize and implement target block ciphers into quantum circuits. Recently, many studies have been published to implement lightweight block ciphers as quantum circuits. In this paper, we present optimal quantum circuit designs of symmetric key cryptography, including PRESENT and GIFT block ciphers. The proposed method optimized PRESENT and GIFT block ciphers by minimizing qubits, quantum gates, and circuit depth. We compare proposed PRESENT and GIFT quantum circuits with other results of lightweight block cipher implementations in quantum circuits. Finally, quantum resources of PRESENT and GIFT block ciphers required for the oracle of the Grover search algorithm were estimated.
Abstract Grover’s algorithm reduces the security level of the target cipher from n-bit to n/2-bit. To implement Grover’s algorithm, a quantum circuit capable of performing the target cipher operations must be constructed. In this paper, we propose a quantum circuit implementation scheme for the involutive lightweight block cipher (IVLBC) block cipher. We utilized the DORCIS tool to implement the quantum circuit for the S-box and applied Gaussian elimination to construct the quantum circuit for matrix multiplication. Subsequently, we evaluated the overall quantum resource consumption required for the implementation. Based on this, we performed a quantum attack on IVLBC using Grover’s algorithm, calculating the attack cost using the NCT gate library, and further analyzed its security. Finally, we conducted a comparative analysis of the classical attack complexity and quantum attack complexity of IVLBC, highlighting the potential of using quantum complexity as a standard for future security assessments.
In this paper, various types of quantum circuits for DES components are proposed to analyze the trade-offs in quantum resources for both DES and TDES block ciphers. Specifically, multiple optimized structures within the DES framework are devised, and by integrating different elements from each type, 34 possible configurations for the DES block cipher are generated. The required quantum resources for these configurations are then estimated, identifying not only qubit-optimized and depth-optimized circuits but also those achieving a balanced trade-off between qubit and circuit depth. Building on these optimized DES designs, TDES circuits are constructed, and the corresponding cost of a Grover-based attack on the TDES is estimated.
Grover’s search algorithm allows a quantum adversary to find ak-bit secret key of a block cipher by making O(2k/2) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by theT-depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requiresT-gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with lowT-depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing itsT-depth.
In this paper, we consider the problem of quantum implementation of the symmetric-key ciphers. The typical ciphers in this category have two main components, the linear and the non-linear layers, we consider both. The linear layer can be described as a non-singular matrix over binary operations. The in-place implementation is one of the main considerations for implementing such layer to minimize the number of qubits. We discuss the research works that have been done to this point on this subject matter and report the improved implementation of some of the matrices. Lists of our modifications include; making it more efficient (specially for the larger matrices), consideration for quantum depth (along with a randomized algorithm for optimization), etc. We report benchmarks for the ASCON and SHA-2 linear matrices. As for the non-linear layer, the constituent block is called an substitution box (an S-box, for short). Our “DORCIS” tool presented in this paper, finds a quantum circuit with an optimized depth for given S-boxes of size 3- and 4-bit. It is a follow-up work on LIGHTER-R (which is applicable for 4-bit S-boxes only) with multiple extensions. Unlike LIGHTER-R, our DORCIS takes a quantum decomposition based on Clifford and T gates. Also, both the full quantum depth and the T depth can be optimized by DORCIS. We compare our implementation with other optimized quantum circuits shown in the other research works and show that we find an implementation with the same cost metric, or find an implementation with lower cost metric, compared other tools proposed in the literature, apart from being simpler and more efficient.
Quantum computing enabled cryptanalytic techniques are able to concretely reduce the security margin of existing cryptographic primitives. While this reduction is only polynomial for symmetric cryptosystems, it still provides a reduction in their security margin. In this work, we propose a detailed quantum circuit designed to cryptanalyze both the Data Encryption Standard (DES) cryptosystem, and its successor Triple-DES (3DES), currently standardized in ISO/IEC 18033–3, and still widely employed in satellite data and bank card encryption. To do so, we introduce the first quantum circuit implementation of the 8 substitution tables (a.k.a. S-boxes), applying a bitslicing strategy, which is currently the most efficient classical combinatorial circuit design in terms of number of two inputs Boolean gates. Secondly, we present the complete quantum circuits required to attack both DES and 3DES leveraging Grover's algorithm. We provide finite regime, closed form equations, delineating the circuits complexities in terms of the number of qubits, gates, depth and number of qubits multiplied by depth. The complexity analysis is based on two distinct gate sets: a NOT-CNOT-Toffoli (NCT) extended with the Hadamard gate; and the fault-tolerant Clifford+T. Finally, akin to the classical attack to the 3DES, we introduce a meet-in-the-middle strategy relying on an exponential amount of Quantum Random Access Memory. Our findings show that the 3DES with keying option 2, the most widely employed variant of 3DES, can be attacked with a circuit depth of approximately267and less than a thousand qubits. This is close to the264value suggested by NIST for the depth achievable sequentially by a single quantum computer in a decade. Our technique can be further sped up parallelizing the approach onto multiple devices, pointing to the practicality of cryptanalyzing 3DES in such a scenario.