npj Quantum Information

Reducing quantum resources for attacking S-AES on quantum devices

Zeguo Wang, Muxi Zheng, Jiawei Wu, Kai Wen, Shijie Wei, Gui‐Lu Long

Published Oct 3, 2025• 3 citations

Abstract

The Advanced Encryption Standard (AES) is one of the most widely used symmetric block cipher cryptography algorithms. Simplified-AES (S-AES) retains the structural framework of AES, making it an ideal model for elucidating the mechanism of symmetric cryptography. In this paper, we investigate potential quantum attacks on S-AES, utilizing both Grover-based algorithms and variational quantum algorithms (VQAs). For Grover-based attacks, we introduce an optimized oracle for implementing S-AES, reducing the complexity from 160 Toffoli gates to 120 by refining the SubNibble operation. Additionally, we propose a general Variational Quantum Attack Algorithm (VQAA) for any type of symmetric encryption that does not require the quantum implementation of the encryption procedure, which reduces the gate complexity substantially. These improvements enable the implementation of both Grover-based attacks and VQAA on superconducting quantum computers. The results demonstrate the feasibility of cryptographic analysis on currently available quantum hardware. Our findings also underscore the challenges of parameter optimization for S-AES, attributing the difficulty to the design of efficient parameterized quantum circuits, which constrain the effectiveness of variational algorithms. Despite these advancements, significant challenges remain in achieving quantum attacks on AES.

DOI: 10.1038/s41534-025-01106-w

Related papers

Investigating the Impact of Grover's Algorithm on AES S-Box

Nur Fahima Iwani binti Ahmad Irwan, Md Nabil Ahmad Zawawi, Reema Thabit

Quantum computing poses a significant threat to classical cryptographic algorithms, particularly the Advanced Encryption Standard (AES). This study investigates the impact of Grover's algorithm on the AES S-box, a fundamental component of the AES encryption process. By leveraging quantum mechanics, Grover's algorithm can potentially reduce the time required to break AES encryption from 2128operations to 264operations, thus presenting a substantial security risk. This research aims to evaluate the feasibility of such quantum attacks on AES S-box by conducting experiments using virtual quantum simulators. The study examines the resource requirements, including the number of gates and qubits, and assesses the scalability of Grover's algorithm across different data sizes and types. The findings indicate that, while theoretically effective, the practical implementation of Grover's algorithm is currently hindered by significant resource constraints on existing quantum hardware. These results underscore the need for continued advancements in quantum technology and the development of quantum-resistant cryptographic methods to ensure data security in the quantum era. This research contributes to the understanding of quantum vulnerabilities in classical cryptography and supports the development of robust encryption strategies that can withstand future quantum attacks.

International Conference on Knowledge and Systems Engineering/ProceedingsNov 5, 20240 citations

Quantum-enhanced symmetric cryptanalysis for S-AES

Alexey Moiseevskiy

Advanced Encryption Standard is one of the most widely used and important symmetric ciphers for today. It well known, that it can be subjected to the quantum Grover's attack that twice reduces its key strength. But full AES attack requires hundreds of qubits and circuit depth of thousands, that makes impossible not only experimental research but also numerical simulations of this algorithm. Here we present an algorithm for optimized Grover's attack on downscaled Simplifed-AES cipher. Besides full attack we present several approaches that allows to reduce number of required qubits if some nibbles of the key are known as a result of side-channel attack. For 16-bit S-AES the proposed attack requires 23 qubits in general case and 19, 15 or 11 if 4, 8 or 12 bits were leaked in specifc confguration. Comparing to previously known 32-qubits algorithm this approach potentially allows to run the attack on today's NISQ-devices and perform numerical simulations with GPU, that may be useful for further research of problem-specifc error mitigation and error correction techniques.

arXiv:2304.05380Apr 11, 20231 citation

Quantum cryptanalysis of SPN ciphers with known plaintext

Uroosa Kiran, Aneela Safdar, Saif Ullah Khalid +2 more

Key recovery attack on SPN ciphers such as AES is NP hard in complexity. Previous studies have estimated the quantum resources required for implementing Grover’s key search for AES, but these are largely theoretical in nature. The key challenges to implement Grover’s algorithm on current quantum hardware include the number of available qubits, noise, and decoherence. However, the rapid advancement of hardware has brought us closer to practical realization for the cryptanalysis of light-weight SPN ciphers. This study presents an efficient quantum circuit implementation of Mini-AES, a 16-bit variant of AES, employing standard CNOT and Toffoli gates. To the best of our knowledge, our work provides the first complete quantum implementations of all core Mini-AES components for the quantum oracle. The effects of noise are emulated for each module of the quantum oracle and quantified. Furthermore, Grover’s algorithm is applied to Mini-AES to perform successful key recovery through a known-plaintext attack, demonstrating significant amplitude amplification while using near-optimal Grover’s iterations, thereby reducing the total quantum volume. The optimal Grover’s iterations have been obtained empirically as well as validated with finite-shot analysis. Notably, the application of Grover’s algorithm reveals key clustering behavior in Mini-AES, which has been corroborated through classical simulation.

npj Quantum InformationApr 1, 20260 citations

Resource-Constrained Quantum Implementation and Analysis of Mini-AES Cipher

Syed Shahmir, Ghulam Murtaza, Elmahdi Bentafat +4 more

Quantum search algorithms, such as Grover's algorithm, will soon pose a threat to current encryption standards as quantum computing advances toward practical implementation. These algorithms rely on quantum circuits that map cryptographic algorithms into appropriate Hilbert spaces, thus linking algorithmic inputs and outputs through quantum superposition. However, implementing and testing such circuits on existing quantum simulators, such as Qiskit, encounters significant memory and computational bottlenecks that limit research progress. To address these simulation constraints, we present a resource-optimized quantum circuit implementation of a complete two-round Mini-AES encryption algorithm. Our approach systematically converts the cipher's algebraic structure using algebraic normal form (ANF) equations, mapping XOR operations to CNOT gates and AND operations to Toffoli gates. To reduce memory overhead, we implement an ancilla-reuse strategy utilizing mid-circuit measurements and resets. Additionally, we introduce an automated procedure that generates Qiskitcompatible quantum circuits for arbitrary S-boxes and cryptographic primitives, streamlining the development of quantum cryptanalysis implementations. Our implementation achieves full encryption and decryption in a quantum circuit with modest gate requirements that can be achieved by the current or near-future state of the art quantum computers. In addition, we provide system utilization metrics to validate our resource-constrained implementation. This compact and pedagogically accessible implementation establishes a practical foundation for quantum cryptanalysis research and post-quantum cryptographic analysis.

arXiv:2503.06566International Conference on Quantum Communications, Networking, and Computing (QCNC)Apr 6, 20260 citations

Quantum Grover Attack on the Simplified-AES

Mishal Almazrooie, Rosni Abdullah, Azman Samsudin +1 more

In this work, a quantum design for the Simplified-Advanced Encryption Standard (S-AES) algorithm is presented. Also, a quantum Grover attack is modeled on the proposed quantum S-AES. First, quantum circuits for the main components of S-AES in the finite field F2[x]/(x4 + x + 1), are constructed. Then, the constructed circuits are put together to form a quantum version of S-AES. A C-NOT synthesis is used to decompose some of the functions to reduce the number of the needed qubits. The quantum S-AES is integrated into a black-box queried by Grover's algorithm. A new approach is proposed to uniquely recover the secret key when Grover attack is applied. The entire work is simulated and tested on a quantum mechanics simulator. The complexity analysis shows that a block cipher can be designed as a quantum circuit with a polynomial cost. In addition, the secret key is recovered in quadratic speedup as promised by Grover's algorithm.

International Conference on Software and Computer Applications (ICSCA)Feb 8, 201815 citations

QUANTUM-ENHANCED SYMMETRICAL CRYPTOANALYSIS OF S-AES

InfoTeCS JSC, A. D. Moiseevskiy, Sofya Manko +1 more

Objective of the study: to study the possibility of reducing quantum resource requirements for Grover's algorithm attack on block ciphers. Simplified-AES is considered as an example. To investigate the possibilities of using a partial key leakage. To estimate the required resources and to simulate a quantum attack on S-AES with reduced requirements. Research methods: algebraic analysis, numerical simulation. Research results: we have demonstrated the possibility of significantly reducing the number of qubits required to attack Simplified-AES by optimizing Grover's oracle. The resource requirements are reduced sufficiently, allowing to study quantum attack on Simplified-AES using numerical simulation on a PC with 400 MB of RAM in about 30 minutes (depending on the CPU configuration). A numerical simulation of a quantum attack on S-AES has been carried out for the case of an ideal leakage configuration, taking into account the elementary quantum noises. Scientific novelty: a new quantum attack algorithm for Simplified-AES cipher with significantly reduced requirements for the qubits number is proposed. Numerical simulation of the attack using this algorithm is carried out, which was practically impossible for previously known approaches. The results illustrate that our ideas about the resource requirements for a quantum attack and, as a consequence, the possible time of its practical implementation can be significantly incorrect if an alternative method for implementing even an already known asymptotically unimprovable quantum attack algorithm is found.

Voprosy kiberbezopasnostiJan 1, 20250 citations