Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Cybersecurity

Constructing quantum circuits for Grover key search in MK-3 featuring 16-bit S-boxes

Haoyu Liao, Qing-bin Luo, Yuanmeng Zheng, Yi Lv, Lang Ding

Published Jun 17, 2026• 0 citations
Publisher

Abstract

Abstract Quantum computing poses a significant threat to modern cryptosystems, prompting nations to initiate the development of next-generation cryptographic algorithms where quantum security assessment constitutes a critical task. In this work, we present the first complete quantum attack circuit construction and security evaluation of quantum resistance for the authenticated encryption algorithm MK-3, which features 16-bit S-boxes. Firstly, we achieve breakthroughs in finite field arithmetic. The arrangement method of Toffoli gates in the subfield $$F_{2^4}$$ F 2 4 enables two types of optimized $$F_{2^8}$$ F 2 8 multiplication circuits to reduce DW-cost by at least 50%. For $$F_{2^8}$$ F 2 8 inversion, by proposing a new intermediate state uncomputing technique, the DW-cost of the inversion circuit is reduced by at least 40% compared with existing solutions. This can also be used to optimize the quantum circuits of block ciphers such as AES and SM4. Secondly, we propose three types of quantum circuits for MK-3’s 16-bit S-box. The basic circuit reduces multiplicative bit operations to 115, representing at least 20% reduction. We propose a more compact S-box structure, reducing the number of circuit qubits for two types of S-boxes from 52 to 40. Finally, we implement full-algorithm quantum attacks and conduct security evaluations for MK-3. Complete quantum circuits supporting 128-bit and 256-bit keys are constructed, enabling Grover key search attacks. Security assessments confirm the 128-bit version meets NIST Security Category 1 (with reasonable inference of achieving Category 2), while the 256-bit version satisfies the highest Category 5 standards, demonstrating resistance against large-scale quantum computing attacks. This work achieves the first quantum circuit implementation for 16-bit S-boxes and provides critical evaluation benchmarks for post-quantum cryptography standardization.

DOI
10.1186/s42400-025-00504-z

Related papers

Optimized Quantum Circuit Design and Grover Search Resource Estimation for the Camellia Block Cipher

Vandana B Patil

With the advancement of quantum computing, quantum circuit implementations of symmetric cryptographic algorithms are essential for evaluating their resistance to quantum attacks. As an ISO-standardized cipher, the efficient quantum circuit construction of Camellia is of great significance. Focusing on minimizing the DW-cost (qubits × Toffoli-depth) while balancing ancilla qubits and Toffoli-depth, this paper proposes an optimized quantum circuit design for Camellia. Specifically: (1) using a serial-multiplication and out-of-place inversion architecture under composite-field decomposition, combined with hierarchical screening for parallelizing bilinear multiplications, a compact in-place S-box quantum circuit is constructed with a DW-cost of 276, 28% lower than the state of the art; (2) a low-gate-count linear-layer circuit is obtained via heuristic search, and gate-sequence reordering then reduces the full depth from 9 to 7 without increasing the gate count; (3) Camellia-128/192/256 quantum circuits are constructed with DW-costs of 119,168, 257,664, and 257,664, achieving reductions of 48%, 52%, and 52% respectively over prior work. A pipelined Grover oracle is further designed and the total resources required for a full Grover search attacking Camellia are evaluated. For Camellia-128, the complete Grover search requires a T-depth of 2.10 × 2⁷⁶ and a total TDW-cost (qubits × T-depth) of 1.00 × 2⁸⁶, reducing T-depth by 75% and TDW-cost by 84% over prior work. The first full Grover search resource estimates for Camellia-192/256 are also presented, with T-depths of 7.20 × 2¹⁰⁸ and 8.11 × 2¹⁴⁰ and TDW-costs of 2.03 × 2¹²³ and 2.79 × 2¹⁵³, respectively. These results show that Grover's attack on Camellia requires fewer quantum resources than on AES at the 128-bit level, implying comparatively weaker post-quantum security at that key size, while the picture reverses at larger key sizes (Section 4).

Journal of Intelligent Decision Making and Information Science•Sep 16, 2026•0 citations

A Quantum Circuit to Execute a Key-Recovery Attack Against the DES and 3DES Block Ciphers

Simone Perriello, Alessandro Barenghi, Gerardo Pelosi

Quantum computing enabled cryptanalytic techniques are able to concretely reduce the security margin of existing cryptographic primitives. While this reduction is only polynomial for symmetric cryptosystems, it still provides a reduction in their security margin. In this work, we propose a detailed quantum circuit designed to cryptanalyze both the Data Encryption Standard (DES) cryptosystem, and its successor Triple-DES (3DES), currently standardized in ISO/IEC 18033–3, and still widely employed in satellite data and bank card encryption. To do so, we introduce the first quantum circuit implementation of the 8 substitution tables (a.k.a. S-boxes), applying a bitslicing strategy, which is currently the most efficient classical combinatorial circuit design in terms of number of two inputs Boolean gates. Secondly, we present the complete quantum circuits required to attack both DES and 3DES leveraging Grover's algorithm. We provide finite regime, closed form equations, delineating the circuits complexities in terms of the number of qubits, gates, depth and number of qubits multiplied by depth. The complexity analysis is based on two distinct gate sets: a NOT-CNOT-Toffoli (NCT) extended with the Hadamard gate; and the fault-tolerant Clifford+T. Finally, akin to the classical attack to the 3DES, we introduce a meet-in-the-middle strategy relying on an exponential amount of Quantum Random Access Memory. Our findings show that the 3DES with keying option 2, the most widely employed variant of 3DES, can be attacked with a circuit depth of approximately$2^{67}$and less than a thousand qubits. This is close to the$2^{64}$value suggested by NIST for the depth achievable sequentially by a single quantum computer in a decade. Our technique can be further sped up parallelizing the approach onto multiple devices, pointing to the practicality of cryptanalyzing 3DES in such a scenario.

IEEE International Conference on Quantum Computing and Engineering (QCE)•Sep 15, 2024•1 citation

Depth-Optimized Quantum Circuits for ASCON: AEAD and HASH

Yujin Oh, Kyungbae Jang, Anubhab Baksi +1 more

Quantum computing advancements pose security challenges for cryptography. Specifically, Grover’s search algorithm affects the reduction in the search complexity of symmetric-key encryption and hash functions. Recent efforts have been made to estimate the complexity of Grover’s search and evaluate post-quantum security. In this paper, we propose a depth-optimized quantum circuit implementation for ASCON, including both symmetric-key encryption and hashing algorithms, as a part of the lightweight cryptography standardization by NIST (National Institute of Standards and Technology). As far as we know, this is the first implementation of a quantum circuit for the ASCON AEAD (Authenticated Encryption with Associated Data) scheme, which is a symmetric-key algorithm. Also, our quantum circuit implementation of the ASCON-HASH achieves a reduction of more than 88.9% in the Toffoli depth and more than 80.5% in the full depth compared to the previous work. As per our understanding, the most effective strategy against Grover’s search involves minimizing the depth of the quantum circuit for the target cipher. We showcase the optimal Grover’s search cost for ASCON and introduce a proposed quantum circuit optimized for depth. Furthermore, we utilize the estimated cost to evaluate post-quantum security strength of ASCON, employing the relevant evaluation criteria and the latest advancements in research.

Mathematics•Apr 27, 2024•7 citations

Quantum circuit implementation and security analysis of IVLBC

Lang Ding, Qing-bin Luo, Yi Lv +3 more

Abstract Grover’s algorithm reduces the security level of the target cipher from n-bit to n/2-bit. To implement Grover’s algorithm, a quantum circuit capable of performing the target cipher operations must be constructed. In this paper, we propose a quantum circuit implementation scheme for the involutive lightweight block cipher (IVLBC) block cipher. We utilized the DORCIS tool to implement the quantum circuit for the S-box and applied Gaussian elimination to construct the quantum circuit for matrix multiplication. Subsequently, we evaluated the overall quantum resource consumption required for the implementation. Based on this, we performed a quantum attack on IVLBC using Grover’s algorithm, calculating the attack cost using the NCT gate library, and further analyzed its security. Finally, we conducted a comparative analysis of the classical attack complexity and quantum attack complexity of IVLBC, highlighting the potential of using quantum complexity as a standard for future security assessments.

Classical and Quantum Gravity•Mar 28, 2025•1 citation

Investigating the Impact of Grover's Algorithm on AES S-Box

Nur Fahima Iwani binti Ahmad Irwan, Md Nabil Ahmad Zawawi, Reema Thabit

Quantum computing poses a significant threat to classical cryptographic algorithms, particularly the Advanced Encryption Standard (AES). This study investigates the impact of Grover's algorithm on the AES S-box, a fundamental component of the AES encryption process. By leveraging quantum mechanics, Grover's algorithm can potentially reduce the time required to break AES encryption from 2128operations to 264operations, thus presenting a substantial security risk. This research aims to evaluate the feasibility of such quantum attacks on AES S-box by conducting experiments using virtual quantum simulators. The study examines the resource requirements, including the number of gates and qubits, and assesses the scalability of Grover's algorithm across different data sizes and types. The findings indicate that, while theoretically effective, the practical implementation of Grover's algorithm is currently hindered by significant resource constraints on existing quantum hardware. These results underscore the need for continued advancements in quantum technology and the development of quantum-resistant cryptographic methods to ensure data security in the quantum era. This research contributes to the understanding of quantum vulnerabilities in classical cryptography and supports the development of robust encryption strategies that can withstand future quantum attacks.

International Conference on Knowledge and Systems Engineering/Proceedings•Nov 5, 2024•0 citations

Quantum circuit for implementing Camellia S-box with low costs

ZhenQiang Li, Gao Fei, Qin Su-Juan +1 more

Camellia, after AES, is one of the most competitive block cipher algorithms. It has been widely used in many fields of information security. Camellia's distinctive nonlinear component is the S-box. This paper studies how to build the quantum circuit of the Camellia S-box at lower costs. First, the multiplicative inversion in F_2^8can be obtained by the multiplicative inversion (and multiplication) in F_2^4via a mapping matrix, and the latter can be implemented by the automation tool LIGHTER-R. The affine transformation of the S-box is then implemented with CNOT and NOT gates using the PLU decomposition and elimination approach. Finally, the Camellia S-box quantum circuit is built with 20 qubits, 54 Toffoli gates, 196 CNOT gates, 13 NOT gates, and a Toffoli depth of 42. In comparison with the previous study, which required 23 qubits, 67 Toffoli, and 38 CNOT gates, and a Toffoli depth of 53, the S-box quantum circuit in this paper requires fewer resources. Furthermore, the S-box quantum circuit used in the study can reduce the quantum resources in implementing Camellia, reducing the quantum circuit scale required to attack Camellia by the Grover algorithm.

Zhongguo kexue. Wulixue Lixue Tianwenxue•Mar 2, 2023•5 citations
Abstract Quantum computing poses a significant threat to modern cryptosystems, prompting nations to initiate the development of next-generation cryptographic algorithms where quantum security assessment constitutes a critical task. In this work, we present the first complete quantum attack circuit construction and security evaluation of quantum resistance for the authenticated encryption algorithm MK-3, which features 16-bit S-boxes. Firstly, we achieve breakthroughs in finite field arithmetic. The arrangement method of Toffoli gates in the subfield F24F_{2^4}F24​ F 2 4 enables two types of optimized F28F_{2^8}F28​ F 2 8 multiplication circuits to reduce DW-cost by at least 50%. For F28F_{2^8}F28​ F 2 8 inversion, by proposing a new intermediate state uncomputing technique, the DW-cost of the inversion circuit is reduced by at least 40% compared with existing solutions. This can also be used to optimize the quantum circuits of block ciphers such as AES and SM4. Secondly, we propose three types of quantum circuits for MK-3’s 16-bit S-box. The basic circuit reduces multiplicative bit operations to 115, representing at least 20% reduction. We propose a more compact S-box structure, reducing the number of circuit qubits for two types of S-boxes from 52 to 40. Finally, we implement full-algorithm quantum attacks and conduct security evaluations for MK-3. Complete quantum circuits supporting 128-bit and 256-bit keys are constructed, enabling Grover key search attacks. Security assessments confirm the 128-bit version meets NIST Security Category 1 (with reasonable inference of achieving Category 2), while the 256-bit version satisfies the highest Category 5 standards, demonstrating resistance against large-scale quantum computing attacks. This work achieves the first quantum circuit implementation for 16-bit S-boxes and provides critical evaluation benchmarks for post-quantum cryptography standardization.
With the advancement of quantum computing, quantum circuit implementations of symmetric cryptographic algorithms are essential for evaluating their resistance to quantum attacks. As an ISO-standardized cipher, the efficient quantum circuit construction of Camellia is of great significance. Focusing on minimizing the DW-cost (qubits × Toffoli-depth) while balancing ancilla qubits and Toffoli-depth, this paper proposes an optimized quantum circuit design for Camellia. Specifically: (1) using a serial-multiplication and out-of-place inversion architecture under composite-field decomposition, combined with hierarchical screening for parallelizing bilinear multiplications, a compact in-place S-box quantum circuit is constructed with a DW-cost of 276, 28% lower than the state of the art; (2) a low-gate-count linear-layer circuit is obtained via heuristic search, and gate-sequence reordering then reduces the full depth from 9 to 7 without increasing the gate count; (3) Camellia-128/192/256 quantum circuits are constructed with DW-costs of 119,168, 257,664, and 257,664, achieving reductions of 48%, 52%, and 52% respectively over prior work. A pipelined Grover oracle is further designed and the total resources required for a full Grover search attacking Camellia are evaluated. For Camellia-128, the complete Grover search requires a T-depth of 2.10 × 2⁷⁶ and a total TDW-cost (qubits × T-depth) of 1.00 × 2⁸⁶, reducing T-depth by 75% and TDW-cost by 84% over prior work. The first full Grover search resource estimates for Camellia-192/256 are also presented, with T-depths of 7.20 × 2¹⁰⁸ and 8.11 × 2¹⁴⁰ and TDW-costs of 2.03 × 2¹²³ and 2.79 × 2¹⁵³, respectively. These results show that Grover's attack on Camellia requires fewer quantum resources than on AES at the 128-bit level, implying comparatively weaker post-quantum security at that key size, while the picture reverses at larger key sizes (Section 4).
Quantum computing enabled cryptanalytic techniques are able to concretely reduce the security margin of existing cryptographic primitives. While this reduction is only polynomial for symmetric cryptosystems, it still provides a reduction in their security margin. In this work, we propose a detailed quantum circuit designed to cryptanalyze both the Data Encryption Standard (DES) cryptosystem, and its successor Triple-DES (3DES), currently standardized in ISO/IEC 18033–3, and still widely employed in satellite data and bank card encryption. To do so, we introduce the first quantum circuit implementation of the 8 substitution tables (a.k.a. S-boxes), applying a bitslicing strategy, which is currently the most efficient classical combinatorial circuit design in terms of number of two inputs Boolean gates. Secondly, we present the complete quantum circuits required to attack both DES and 3DES leveraging Grover's algorithm. We provide finite regime, closed form equations, delineating the circuits complexities in terms of the number of qubits, gates, depth and number of qubits multiplied by depth. The complexity analysis is based on two distinct gate sets: a NOT-CNOT-Toffoli (NCT) extended with the Hadamard gate; and the fault-tolerant Clifford+T. Finally, akin to the classical attack to the 3DES, we introduce a meet-in-the-middle strategy relying on an exponential amount of Quantum Random Access Memory. Our findings show that the 3DES with keying option 2, the most widely employed variant of 3DES, can be attacked with a circuit depth of approximately2672^{67}267and less than a thousand qubits. This is close to the2642^{64}264value suggested by NIST for the depth achievable sequentially by a single quantum computer in a decade. Our technique can be further sped up parallelizing the approach onto multiple devices, pointing to the practicality of cryptanalyzing 3DES in such a scenario.
Quantum computing advancements pose security challenges for cryptography. Specifically, Grover’s search algorithm affects the reduction in the search complexity of symmetric-key encryption and hash functions. Recent efforts have been made to estimate the complexity of Grover’s search and evaluate post-quantum security. In this paper, we propose a depth-optimized quantum circuit implementation for ASCON, including both symmetric-key encryption and hashing algorithms, as a part of the lightweight cryptography standardization by NIST (National Institute of Standards and Technology). As far as we know, this is the first implementation of a quantum circuit for the ASCON AEAD (Authenticated Encryption with Associated Data) scheme, which is a symmetric-key algorithm. Also, our quantum circuit implementation of the ASCON-HASH achieves a reduction of more than 88.9% in the Toffoli depth and more than 80.5% in the full depth compared to the previous work. As per our understanding, the most effective strategy against Grover’s search involves minimizing the depth of the quantum circuit for the target cipher. We showcase the optimal Grover’s search cost for ASCON and introduce a proposed quantum circuit optimized for depth. Furthermore, we utilize the estimated cost to evaluate post-quantum security strength of ASCON, employing the relevant evaluation criteria and the latest advancements in research.
Abstract Grover’s algorithm reduces the security level of the target cipher from n-bit to n/2-bit. To implement Grover’s algorithm, a quantum circuit capable of performing the target cipher operations must be constructed. In this paper, we propose a quantum circuit implementation scheme for the involutive lightweight block cipher (IVLBC) block cipher. We utilized the DORCIS tool to implement the quantum circuit for the S-box and applied Gaussian elimination to construct the quantum circuit for matrix multiplication. Subsequently, we evaluated the overall quantum resource consumption required for the implementation. Based on this, we performed a quantum attack on IVLBC using Grover’s algorithm, calculating the attack cost using the NCT gate library, and further analyzed its security. Finally, we conducted a comparative analysis of the classical attack complexity and quantum attack complexity of IVLBC, highlighting the potential of using quantum complexity as a standard for future security assessments.
Quantum computing poses a significant threat to classical cryptographic algorithms, particularly the Advanced Encryption Standard (AES). This study investigates the impact of Grover's algorithm on the AES S-box, a fundamental component of the AES encryption process. By leveraging quantum mechanics, Grover's algorithm can potentially reduce the time required to break AES encryption from 2128operations to 264operations, thus presenting a substantial security risk. This research aims to evaluate the feasibility of such quantum attacks on AES S-box by conducting experiments using virtual quantum simulators. The study examines the resource requirements, including the number of gates and qubits, and assesses the scalability of Grover's algorithm across different data sizes and types. The findings indicate that, while theoretically effective, the practical implementation of Grover's algorithm is currently hindered by significant resource constraints on existing quantum hardware. These results underscore the need for continued advancements in quantum technology and the development of quantum-resistant cryptographic methods to ensure data security in the quantum era. This research contributes to the understanding of quantum vulnerabilities in classical cryptography and supports the development of robust encryption strategies that can withstand future quantum attacks.
Camellia, after AES, is one of the most competitive block cipher algorithms. It has been widely used in many fields of information security. Camellia's distinctive nonlinear component is the S-box. This paper studies how to build the quantum circuit of the Camellia S-box at lower costs. First, the multiplicative inversion in F_2^8can be obtained by the multiplicative inversion (and multiplication) in F_2^4via a mapping matrix, and the latter can be implemented by the automation tool LIGHTER-R. The affine transformation of the S-box is then implemented with CNOT and NOT gates using the PLU decomposition and elimination approach. Finally, the Camellia S-box quantum circuit is built with 20 qubits, 54 Toffoli gates, 196 CNOT gates, 13 NOT gates, and a Toffoli depth of 42. In comparison with the previous study, which required 23 qubits, 67 Toffoli, and 38 CNOT gates, and a Toffoli depth of 53, the S-box quantum circuit in this paper requires fewer resources. Furthermore, the S-box quantum circuit used in the study can reduce the quantum resources in implementing Camellia, reducing the quantum circuit scale required to attack Camellia by the Grover algorithm.