Skip to main content
SpringerLink
Log in

Optimized quantum implementation of AES

  • Regular Article
  • Published:
Quantum Information Processing Aims and scope Submit manuscript

Abstract

This work researches the implementation of the AES family with Pauli-X gates, CNOT gates and Toffoli gates as the underlying quantum logic gate set. First, the properties of quantum circuits are investigated, as well as the influence of Pauli-X gates, CNOT gates and Toffoli gates on the performance of the circuits constructed with those gates. Based on these properties and the observations on the hardware circuits built by Boyar et al. and Zou et al., it is possible to construct quantum circuits for AES’s Substitution-box (S-box) and its inverse (S-box\(^{-1}\)) by rearranging the classical implementation to three parts. Since the second part is treated as a 4-bit S-box in this paper and can be dealt with by existing tools, a heuristic is proposed to search optimized quantum circuits for the first and the third parts. In addition, considering the number of parallelly executed S-boxes, the trade-offs between the qubit consumption and \(T\cdot M\) values for the round function and key schedule of AES are studied. As a result, quantum circuits of AES-128, AES-192 and AES-256 can be constructed with 269, 333 and 397 qubits, respectively. If more qubits are allowed, quantum circuits that outperform state-of-the-art schemes in the metric of \(T\cdot M\) value for the AES family can be reported, and it needs only 474, 538 and 602 qubits for AES-128, AES-192 and AES-256, respectively.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6

Similar content being viewed by others

Data availability

The datasets generated during and/or analyzed during the current study are available at https://github.com/hubu405/qip_supporting_materials.

Notes

  1. https://doi.org/10.6028/NIST.FIPS.197.

  2. https://doi.org/10.6028/NIST.FIPS.202.

  3. Applying m S-boxes in parallel when implementing the SubBytes of the current round also means that one can apply m S-box\(^{-1}\)es in parallel to remove the previous round, since the circuits designed in this work for AES S-box and its inverse can always be implemented with the same number of ancilla qubits.

  4. http://jeremy.jean.free.fr/pub/fse2018_layer_implementations.tar.gz.

  5. https://github.com/vdasu/lighter-r.

  6. https://github.com/xiangzejun/Optimizing_Implementations_of_Linear_Layers.

  7. Note that an NCT-based circuit that costs 6 ancilla qubits is also designed for AES S-box; however, in order to save qubits, only 5 ancilla qubits are allocated for each S-box in the very beginning.

References

  1. Almazrooie, M., Samsudin, A., Abdullah, R., Mutter, K.N.: Quantum reversible circuit of AES-128. Quantum Inf. Process. 17(5), 112 (2018)

    Article  ADS  MathSciNet  MATH  Google Scholar 

  2. Amy, M., Di Matteo, O., Gheorghiu, V., Mosca, M., Parent, A., Schanck, J.M.: Estimating the cost of generic quantum pre-image attacks on SHA-2 and SHA-3. In: Avanzi, R., Heys, H.M. (eds.) Selected Areas in Cryptography—SAC 2016—23rd International Conference, St. John’s, NL, Canada, August 10–12, 2016, Revised Selected Papers, vol. 10532 of Lecture Notes in Computer Science, pp. 317–337. Springer, Berlin (2016)

  3. Arute, F., Arya, K., Babbush, R., et al.: Quantum supremacy using a programmable superconducting processor. Nature 574(7779), 505–510 (2019)

    Article  ADS  Google Scholar 

  4. Bernstein, D.J., Biasse, J.F., Mosca, M.: A low-resource quantum factoring algorithm. In: Lange, T., Takagi, T. (eds.) Post-Quantum Cryptography—8th International Workshop, PQCrypto 2017, Utrecht, The Netherlands, June 26–28, 2017, Proceedings, vol 10346 of Lecture Notes in Computer Science, pp. 330–346. Springer (2017)

  5. Boyar, J., Peralta, R.: A new combinational logic minimization technique with applications to cryptology. In: Festa, P., (eds.) Experimental Algorithms, 9th International Symposium, SEA 2010, Ischia Island, Naples, Italy, May 20–22, 2010. Proceedings, vol. 6049 of Lecture Notes in Computer Science, pp. 178–189. Springer, Berlin (2010)

  6. Canright, D.: A very compact s-box for AES. In: Rao, J.R., Sunar, B. (eds.) Cryptographic Hardware and Embedded Systems—CHES 2005, 7th International Workshop, Edinburgh, UK, August 29–September 1, 2005, Proceedings, vol. 3659 of Lecture Notes in Computer Science, pp. 441–455. Springer, Berlin (2005)

  7. Chung, D., Lee, S., Choi, D., Lee, J.: Alternative tower field construction for quantum implementation of the AES S-box. IEEE Trans. Comput. 71(10), 2553–2564 (2021)

    Article  Google Scholar 

  8. Daemen, J., Rijmen, V.: The Design of Rijndael: AES—The Advanced Encryption Standard. Information Security and Cryptography. Springer, Berlin (2002)

  9. Dasu, V.A., Baksi, A., Sarkar, S., Chattopadhyay, A.: LIGHTER-R: optimized reversible circuit implementation for sboxes. In: Zhao, D. (eds.) SOCC 2019—32nd IEEE International System-on-Chip Conference, Singapore, September 3–6, pp. 260–265. IEEE (2019)

  10. Ekerå ,M., Håstad, J.: Quantum algorithms for computing short discrete logarithms and factoring RSA integers. In: Lange, T., Takagi, T. (eds.) Post-Quantum Cryptography—8th International Workshop, PQCrypto 2017, Utrecht, The Netherlands, June 26–28, 2017, Proceedings, vol. 10346 of Lecture Notes in Computer Science, pp. 347–363. Springer, Berlin (2017)

  11. Grassl, M., Langenberg, B., Roetteler, M., Steinwandt, R.: Applying Grover’s algorithm to AES: quantum resource estimates. In: Takagi, T., (eds.), Post-Quantum Cryptography—7th International Workshop, PQCrypto 2016, Fukuoka, Japan, February 24–26, 2016, Proceedings, vol. 9606 of Lecture Notes in Computer Science, pp. 29–43. Springer, Berlin (2016)

  12. Grover, L.K.: A fast quantum mechanical algorithm for database search. In: Miller, G.L. (ed.) Proceedings of the Twenty-Eighth Annual ACM Symposium on the Theory of Computing, Philadelphia, Pennsylvania, USA, May 22–24, 1996, pp. 212–219. ACM, New York (1996)

  13. Guajardo, J., Paar, C.: Itoh-Tsujii inversion in standard basis and its application in cryptography and codes. Des. Codes Cryptogr. 25(2), 207–216 (2002)

    Article  MathSciNet  MATH  Google Scholar 

  14. Huang, Z., Sun, S.: Synthesizing quantum circuits of AES with lower t-depth and less qubits. IACR Cryptol. ePrint Arch. 2022, 620 (2022)

    Google Scholar 

  15. Jang, K., Baksi, A., Song, G., Kim, H., Seo, H., Chattopadhyay, A.: Quantum analysis of AES. IACR Cryptol. ePrint Arch. 2022, 683 (2022)

    Google Scholar 

  16. Jaques, S., Naehrig, M., Roetteler, M., Virdia, F.: Implementing grover oracles for quantum key search on AES and Lowmc. In: Canteaut, A., Ishai, Y. (eds.) Advances in Cryptology—EUROCRYPT 2020—39th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10–14, 2020, Proceedings, Part II, volume 12106 of Lecture Notes in Computer Science, pp. 280–310. Springer, Berlin (2020)

  17. Jean, J., Peyrin, T., Sim, S.M., Tourteaux, J.: Optimizing implementations of lightweight building blocks. IACR Trans. Symmetric Cryptol. 2017(4), 130–168 (2017)

    Article  Google Scholar 

  18. Kim, P., Han, D., Jeong, K.C.: Time-space complexity of quantum search algorithms in symmetric cryptanalysis: applying to AES and SHA-2. Quantum Inf. Process. 17(12), 1–39 (2018)

    Article  MathSciNet  MATH  Google Scholar 

  19. Langenberg, B., Pham, H., Steinwandt, R.: Reducing the cost of implementing the advanced encryption standard as a quantum circuit. IEEE Trans. Quantum Eng. 2020(1), 1–12 (2020)

    Article  Google Scholar 

  20. Li, Z., Cai, B., Sun, H., Liu, H., Wan, L., Qin, S., Wen, Q., Gao, F.: Novel quantum circuit implementation of Advanced Encryption Standard with low costs. Sci. China Phys. Mech. Astron. 65(9), 290311 (2022)

    Article  ADS  Google Scholar 

  21. May, A., Schlieper, L.: Quantum period finding is compression robust. IACR Trans. Symmetric Cryptol. 2022(1), 183–211 (2022)

    Article  Google Scholar 

  22. Mentens, N., Batina, L., Preneel, B., Verbauwhede, I.: A systematic evaluation of compact hardware implementations for the Rijndael S-Box. In: Menezes, A. (eds.) Topics in Cryptology—CT-RSA 2005—The Cryptographers’ Track at the RSA Conference 2005, San Francisco, CA, USA, February 14–18, 2005, Proceedings, volume 3376 of Lecture Notes in Computer Science, pp. 323–333. Springer, Berlin (2005)

  23. Nielsen, M.A., Chuang, I.L.: Quantum Computation and Quantum Information (10th Anniversary edition). Cambridge University Press, Cambridge (2016)

    MATH  Google Scholar 

  24. NIST: Submission requirements and evaluation criteria for the post-quantum cryptography standardization process (2016)

  25. Seifert, J.: Using fewer qubits in shor’s factorization algorithm via simultaneous diophantine approximation. In: Naccache, D. (eds.) Topics in Cryptology—CT-RSA 2001—The Cryptographers’ Track at the RSA Conference 2001, San Francisco, CA, USA, April 8–12, 2001, Proceedings, volume 2020 of Lecture Notes in Computer Science, pp. 319–327. Springer, Berlin (2001)

  26. Shende, V.V., Prasad, A.K., Markov, I.L., Hayes, J.P.: Synthesis of reversible logic circuits. IEEE Trans. Comput. Aided Des. Integr. Circuits Syst. 22(6), 710–722 (2003)

  27. Shor, P.W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM J. Comput. 26(5), 1484–1509 (1997)

    Article  MathSciNet  MATH  Google Scholar 

  28. Simon, D.R.: On the power of quantum computation. SIAM J. Comput. 26(5), 1474–1483 (1997)

    Article  MathSciNet  MATH  Google Scholar 

  29. Trefethen, L.N., Bau, D.: Numerical Linear Algebra. SIAM, Philadelphia (1997)

    Book  MATH  Google Scholar 

  30. Wang, Z., Wei, S., Long, G.: A quantum circuit design of AES requiring fewer quantum qubits and gate operations. Front. Phys. 17(4), 1–7 (2022)

    Article  Google Scholar 

  31. Wei, Z., Sun, S., Hu, L., Wei, M., Boyar, J., Peralta, R.: Scrutinizing the tower field implementation of the \(\mathbb{F}_2^8\) inverter—with applications to AES, Camellia, and SM4. IACR Cryptol. ePrint Arch. (2019)

  32. Xiang, Z., Zeng, X., Lin, D., Bao, Z., Zhang, S.: Optimizing implementations of linear layers. IACR Trans. Symmetric Cryptol. 2020(2), 120–145 (2020)

    Article  Google Scholar 

  33. Zou, J., Li, L., Wei, Z., Luo, Y., Liu, Q., Wu, W.: New quantum circuit implementations of SM4 and SM3. Quantum Inf. Process. 21(5), 1–38 (2022)

    Article  ADS  MathSciNet  MATH  Google Scholar 

  34. Zou, J., Wei, Z., Sun, S., Liu, X., Wu, W.: Quantum circuit implementations of AES with fewer qubits. In: Advances in Cryptology—ASIACRYPT 2020—the 26th Annual International Conference on the Theory and Application of Cryptology and Information Security, Lecture Notes in Computer Science, pp. 697–726. Springer, Berlin (2020)

  35. Zou, J., Wei, Z., Sun, S., Luo, Y., Liu, Q., Wu, W.: Some efficient quantum circuit implementations of camellia. Quantum Inf. Process. 21(4), 1–27 (2022)

    Article  ADS  MathSciNet  MATH  Google Scholar 

Download references

Acknowledgements

We would like to thank the anonymous reviewers for their helpful comments and suggestions. This work was supported by the National Natural Science Foundation of China (Grant No. 62272147) and the Wuhan Science and Technology Bureau (Grant No. 2022010801020328).

Author information

Authors and Affiliations

  1. Faculty of Mathematics and Statistics, Hubei Key Laboratory of Applied Mathematics, Hubei University, Wuhan, 430062, China

    Da Lin & Xiangyong Zeng

  2. State Key Laboratory of Cryptology, P. O. Box 5159, Beijing, 100878, China

    Zejun Xiang

  3. School of Cyber Science and Technology, Hubei University, Wuhan, 430062, China

    Zejun Xiang, Runqing Xu & Shasha Zhang

Authors
  1. Da Lin
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Zejun Xiang
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Runqing Xu
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Shasha Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Xiangyong Zeng
    View author publications

    You can also search for this author in PubMed Google Scholar

Contributions

DL and ZX derived the methodology. RX simulated the theoretical results. SZ and XZ provided data and format analysis. All authors contributed to the preparation of the manuscript. All authors read and approved the final manuscript.

Corresponding author

Correspondence to Zejun Xiang.

Ethics declarations

Conflict of interest

The authors have no competing interests to declare that are relevant to the content of this article.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Appendices

The Proof of Fact 1

Proof

Based on the values of a and c, the proof proceeds in two cases:

Case 1: if \(a = c\), the two operations can be rewritten as \(t_a = t_a\oplus t_b\), \(t_a=t_a\oplus t_c\), after which the value of qubit \(t_a\) is \(t_a\oplus t_b\oplus t_c\). Assuming that the operations are changed to \(t_a = t_a\oplus t_c\), \(t_a=t_a\oplus t_b\), the final value of \(t_a\) is not changed. Thus, the order of these two operations can be exchanged.

Case 2: if \(a\ne c, d\) and \(b\ne c\), it follows that a, c, d are pairwise distinct since \(a\ne b\) and \(c\ne d\). In addition, the operations have no influence on the values of \(t_b\) and \(t_d\). Therefore, exchanging the order of these two operations does not result in any change of the values stored in \(t_a\) and \(t_c\). \(\square \)

Discussion on LIGHTER and LIGHTER-R

Before illustrating the method of using LIGHTER, the following definition is introduced.

Definition 3

(odd permutation [26]) A permutation is called odd if it can be written as the product of an odd number of transpositions.

The even permutation can be defined in the similar way.

It is obviously that the 4-bit S-box shown in Table 6 is odd (as well as the one derived from the inverse of AES S-box). The studies of [26] reveal that the NCT-based circuit for an even permutation can be constructed without temporary storage, but for an odd permutation, one wire of temporary storage is required. It means that one cannot construct a quantum circuit for an odd permutation by using the tool LIGHTER-R only based on NCT gate set. To this end, the following strategies are investigated to construct an NCT-based circuit for an odd permutation.

Strategy 1 First, expand a 4-bit odd permutation to be a 5-bit one by adding one bit in the most significant bit of the inputs, whose corresponding output bit is identical to the input. There is no doubt that the resulting 5-bit permutation is even. Then, modify the code to make the tool LIGHTER-R compatible with 5-bit permutation as its input and search the NCT-based circuit for the resulting 5-bit even permutation. Unfortunately, due to the large search space, none implementation for the S-box shown in Table 6 returned.

Strategy 2 The underlying logic gate set of the tool LIGHTER can be customized as needed. Considering the relation between the NCT gate set and the classical And gate, Xor gate and Not gate, one can specify that the tool LIGHTER only uses And gates, Xor gates and Not gates to search an optimized in-place implementation for a 4-bit odd permutation. Certainly, this comes at the cost of an auxiliary variable, which means an ancilla qubit will be consumed by LIGHTER in this case.

The quantum style circuit of \(f_2\) of AES S-box

$$\begin{aligned} \begin{array}{llll} s_{6}= s_{6} \oplus t_{44} \cdot y_{15}, &{}s_{1}= s_{1} \oplus t_{37} \cdot y_{6}, &{}s_{0}= s_{0} \oplus t_{43} \cdot y_{16}, &{}s_{4}= s_{4} \oplus t_{40} \cdot y_{1},\\ \nonumber s_{3}= s_{3} \oplus t_{44} \cdot y_{12}, &{}s_{5}= s_{5} \oplus t_{37} \cdot y_{3}, &{}s_{2}= s_{2} \oplus t_{43} \cdot y_{13}, &{}s_{7}= s_{7} \oplus t_{40} \cdot y_{5},\\ \nonumber s_{0} = s_{0} \oplus s_{4}, &{}s_{6} = s_{6} \oplus s_{0}, &{}s_{2} = s_{2} \oplus t_{42} \cdot y_{9}, &{}s_{0} = s_{0} \oplus t_{42} \cdot y_{11},\\ \nonumber s_{5} = s_{5} \oplus t_{45} \cdot y_{14}, &{}s_{0} = s_{0} \oplus t_{45} \cdot y_{17}, &{}s_{7} = s_{7} \oplus s_{2}, &{}s_{1} = s_{1} \oplus s_{6},\\ \nonumber s_{2} = s_{2} \oplus t_{29} \cdot y_{2}, &{}s_{3} = s_{3} \oplus s_{5}, &{}s_{6} = s_{6} \oplus t_{33} \cdot y_{0}, &{}s_{4} = s_{4} \oplus s_{6},\\ \nonumber s_{4} = s_{4} \oplus t_{29} \cdot y_{7}, &{}s_{5} = s_{5} \oplus t_{33} \cdot y_{4}, &{}s_{3} = s_{3} \oplus t_{42} \cdot y_{9}, &{}s_{6} = s_{6} \oplus t_{45} \cdot y_{17}, \\ \nonumber s_{6} = s_{6} \oplus t_{41} \cdot y_{10}, &{}s_{7} = s_{7} \oplus t_{45} \cdot y_{14}, &{}s_{2} = s_{2} \oplus s_{6}, &{}s_{5} = s_{5} \oplus s_{2}, \\ \nonumber s_{2} = s_{2} \oplus s_{0}, &{}s_{0} = s_{0} \oplus s_{3}, &{}s_{3} = s_{3} \oplus s_{1}, &{}s_{7} = s_{7} \oplus s_{4}, \\ \nonumber s_{2} = s_{2} \oplus t_{41} \cdot y_{8}, &{}s_{6} = s_{6} \oplus s_{7}, &{}s_{4} = s_{4} \oplus s_{3}, &{}s_{1} = s_{1} \oplus s_{0}.\\ \nonumber \end{array} \end{aligned}$$

The reversible circuit of AES S-box

1.1 The reversible circuit for generating \(t_{21}, t_{22}, t_{23}, t_{24}\)

$$\begin{aligned} \begin{array}{lll} x_{6} = x_{6} \oplus x_{5} \oplus x_{3} \oplus x_{0}, &{}x_{4} = x_{6} \oplus x_{5} \oplus x_{4}, &{}x_{1} = x_{7} \oplus x_{3} \oplus x_{2} \oplus x_{1},\\ \nonumber x_{5} = x_{5} \oplus x_{3}, &{}x_{2} = x_{5} \oplus x_{2} \oplus x_{0}, &{}x_{3} = x_{3} \oplus x_{1} \oplus x_{0},\\ \nonumber x_{0} = x_{4} \oplus x_{3} \oplus x_{2} \oplus x_{0}, &{}t_{21} = t_{21} \oplus x_{6} \cdot x_{4}, &{}t_{22} = t_{22} \oplus x_{1} \cdot x_{7},\\ \nonumber t_{23} = t_{23} \oplus x_{5} \cdot x_{2}, &{}t_{24} = t_{24} \oplus x_{3} \cdot x_{0}, &{}t_{22} = t_{22} \oplus t_{21},\\ \nonumber t_{21} = t_{21} \oplus t_{23}, &{}x_{5} = x_{6} \oplus x_{5}, &{}x_{4} = x_{4} \oplus x_{2},\\ \nonumber x_{1} = x_{6} \oplus x_{1}, &{}x_{7} = x_{7} \oplus x_{4} \oplus x_{2}, &{}x_{3} = x_{5} \oplus x_{3} \oplus x_{1},\\ \nonumber x_{0} = x_{7} \oplus x_{4} \oplus x_{0}, &{}x_{6} = x_{6} \oplus x_{5} \oplus x_{3}, &{}x_{2} = x_{2} \oplus x_{0},\\ \nonumber t_{23} = t_{23} \oplus x_{5} \cdot x_{4}, &{}t_{21} = t_{21} \oplus x_{1} \cdot x_{7}, &{}t_{24} = t_{24} \oplus x_{3} \cdot x_{0},\\ \nonumber a = a \oplus x_{6} \cdot x_{2}, &{}t_{21} = t_{21} \oplus a, &{}t_{22} = t_{22} \oplus a,\\ \nonumber t_{23} = t_{23} \oplus a, &{}t_{24} = t_{24} \oplus a, &{}x_{1} = x_{3} \oplus x_{1},\\ \nonumber x_{7} = x_{7} \oplus x_{0}, &{}t_{22} = t_{22} \oplus x_{3} \cdot x_{0}, &{}t_{23} = t_{23} \oplus x_{1} \cdot x_{7},\\ \nonumber t_{24} = t_{24} \oplus x_{5} \cdot x_{4}, &{}a = a \oplus x_{6} \cdot x_{2}, &{}x_{6} = x_{6} \oplus x_{2},\\ \nonumber t_{21} = t_{21} \oplus x_{6}, &{}x_{3} = x_{3} \oplus x_{0}, &{}t_{22} = t_{22} \oplus x_{3},\\ \nonumber x_{5} = x_{5} \oplus x_{4}, &{}t_{23} = t_{23} \oplus x_{5}, &{}x_{5} = x_{7} \oplus x_{5} \oplus x_{1},\\ \nonumber t_{24} = t_{24} \oplus x_{5}.\\ \nonumber \end{array} \end{aligned}$$

1.2 The reversible circuit for \(S_4\) with Toffoli Depth 6

$$\begin{aligned} \begin{array}{lll} t_{23} = t_{23} \oplus t_{22} \cdot t_{24}, &{}t_{24} = t_{24} \oplus t_{23}, &{}t_{22} = t_{22} \oplus t_{21} \cdot t_{24},\\ \nonumber t_{24} = t_{24} \oplus t_{22} \cdot t_{23}, &{}t_{23} = t_{23} \oplus t_{24}~(t_{33}), &{}t_{22} = t_{22} \oplus t_{21}~(t_{40}),\\ \nonumber t_{21} = t_{21} \oplus t_{22} \cdot t_{24}, &{}a = a \oplus t_{23} \cdot t_{22}, &{}t_{24} = t_{24} \oplus a \cdot t_{21}~(t_{37}),\\ \nonumber t_{21} = t_{21} \oplus t_{22}~(t_{29}).&{}&{}\\ \nonumber \end{array} \end{aligned}$$

1.3 The reversible circuit for \(S_4\) with Toffoli Depth 5

$$\begin{aligned} \begin{array}{lll} t_{23} = t_{23} \oplus t_{22} \cdot t_{24}, &{}t_{24} = t_{24} \oplus t_{23}, &{}t_{22} = t_{22} \oplus t_{21} \cdot t_{24},\\ \nonumber t_{24} = t_{24} \oplus t_{22} \cdot t_{23}, &{}t_{23} = t_{23} \oplus t_{24}~(t_{33}), &{}t_{22} = t_{22} \oplus t_{21}~(t_{40}),\\ \nonumber b = b \oplus t_{22}, &{}a = a \oplus t_{23} \cdot t_{22}, &{}t_{21} = t_{21} \oplus b \cdot t_{24},\\ \nonumber t_{24} = t_{24} \oplus a \cdot t_{21}~(t_{37}), &{}t_{21} = t_{21} \oplus t_{22}~(t_{29}).&{}\\ \nonumber \end{array} \end{aligned}$$

1.4 The reversible circuit for the outputs of AES S-box

$$\begin{aligned} \begin{array}{llll} x_{3} = x_{3} \oplus x_{1} \oplus x_{0}, &{}x_{0} = x_{4} \oplus x_{2} \oplus x_{0}, &{}x_{6} = x_{6} \oplus x_{2},\\ \nonumber t_{22} = t_{22} \oplus t_{21}, &{}t_{23} = t_{24} \oplus t_{23}, &{}t_{21} = t_{24} \oplus t_{23} \oplus t_{21},\\ \nonumber s_{0} = s_{0} \oplus t_{22} \cdot x_{4}, &{}s_{5} = s_{5} \oplus t_{24} \cdot x_{3}, &{}s_{6} = s_{6} \oplus t_{23} \cdot x_{0},\\ \nonumber s_{2} = s_{2} \oplus t_{21} \cdot x_{6}, &{}x_{5} = x_{7} \oplus x_{5} \oplus x_{4} \oplus x_{1}, &{}x_{3} = x_{6} \oplus x_{3} \oplus x_{1},\\ \nonumber t_{23} = t_{23} \oplus t_{22}, &{}t_{24} = t_{24} \oplus t_{23} \oplus t_{21}, &{}s_{2} = s_{2} \oplus t_{22} \cdot x_{5},\\ \nonumber s_{5} = s_{5} \oplus t_{23} \cdot x_{3}, &{}s_{4} = s_{4} \oplus t_{24} \cdot x_{7}, &{}s_{0} = s_{0} \oplus s_{4},\\ \nonumber s_{6} = s_{6} \oplus s_{0}, &{}s_{7} = s_{7} \oplus s_{2}, &{}s_{1} = s_{1} \oplus s_{6},\\ \nonumber s_{3} = s_{3} \oplus s_{5}, &{}x_{7} = x_{7} \oplus x_{4} \oplus x_{2}, &{}x_{4} = x_{4} \oplus x_{0},\\ \nonumber t_{22} = t_{24} \oplus t_{22} \oplus t_{21}, &{}s_{6} = s_{6} \oplus t_{22} \cdot x_{7}, &{}s_{3} = s_{3} \oplus t_{21} \cdot x_{6},\\ \nonumber s_{0} = s_{0} \oplus t_{23} \cdot x_{4}, &{}s_{4} = s_{4} \oplus s_{6}, &{}x_{5} = x_{5} \oplus x_{1},\\ \nonumber t_{22} = t_{22} \oplus t_{21}, &{}s_{6} = s_{6} \oplus t_{23} \cdot x_{4}, &{}s_{0} = s_{0} \oplus t_{21} \cdot x_{2},\\ \nonumber s_{7} = s_{7} \oplus t_{24} \cdot x_{1}, &{}s_{2} = s_{2} \oplus t_{22} \cdot x_{5}, &{}x_{4} = x_{4} \oplus x_{2},\\ \nonumber x_{0} = x_{7} \oplus x_{0}, &{}x_{7} = x_{7} \oplus x_{2}, &{}x_{1} = x_{5} \oplus x_{3} \oplus x_{1},\\ \nonumber t_{23} = t_{23} \oplus t_{21}, &{}t_{24} = t_{24} \oplus t_{23}, &{}t_{21} = t_{24} \oplus t_{22} \oplus t_{21},\\ \nonumber s_{6} = s_{6} \oplus t_{23} \cdot x_{4}, &{}s_{1} = s_{1} \oplus t_{24} \cdot x_{0}, &{}s_{4} = s_{4} \oplus t_{22} \cdot x_{7},\\ \nonumber s_{3} = s_{3} \oplus t_{21} \cdot x_{1}, &{}s_{2} = s_{2} \oplus s_{6}, &{}s_{5} = s_{5} \oplus s_{2},\\ \nonumber s_{2} = s_{2} \oplus s_{0}, &{}s_{0} = s_{0} \oplus s_{3}, &{}s_{3} = s_{3} \oplus s_{1},\\ \nonumber s_{7} = s_{7} \oplus s_{4}, &{}x_{6} = x_{6} \oplus x_{3}, &{}x_{5} = x_{6} \oplus x_{5} \oplus x_{3},\\ \nonumber t_{22} = t_{24} \oplus t_{23} \oplus t_{22} \oplus t_{21}, &{}t_{21} = t_{24} \oplus t_{21}, &{}s_{2} = s_{2} \oplus t_{23} \cdot x_{6},\\ \nonumber s_{7} = s_{7} \oplus t_{22} \cdot x_{3}, &{}s_{5} = s_{5} \oplus t_{21} \cdot x_{5}, &{}s_{6} = s_{6} \oplus s_{7}, \\ \nonumber s_{4} = s_{4} \oplus s_{3}, &{}s_{1} = s_{1} \oplus s_{0}, &{}s_{6} = s_{6} \oplus 1,\\ \nonumber s_{7} = s_{7} \oplus 1, &{}s_{1} = s_{1} \oplus 1, &{}s_{2} = s_{2} \oplus 1.\\ \nonumber \end{array} \end{aligned}$$

The reversible circuit of AES S-box\(^{-1}\)

1.1 The reversible circuit for generating \(t_{21}, t_{22}, t_{23}, t_{24}\)

$$\begin{aligned} \begin{array}{lll} x_{6} = x_{7} \oplus x_{6} \oplus x_{1} \oplus x_{0} \oplus 1, &{}x_{1} = x_{5} \oplus x_{3} \oplus x_{2} \oplus x_{1}, &{}x_{3} = x_{6} \oplus x_{3} \oplus x_{0},\\ \nonumber x_{0} = x_{5} \oplus x_{2} \oplus x_{0} \oplus 1, &{}x_{4} = x_{4} \oplus x_{1} \oplus x_{0}, &{}x_{5} = x_{7} \oplus x_{6} \oplus x_{5} \oplus x_{4} \oplus 1,\\ \nonumber x_{7} = x_{7} \oplus x_{5} \oplus x_{2} \oplus x_{1}, &{}x_{2} = x_{3} \oplus x_{2} \oplus 1, &{}t_{21} = t_{21} \oplus x_{6} \cdot x_{1},\\ \nonumber t_{22} = t_{22} \oplus x_{3} \cdot x_{0}, &{}t_{23} = t_{23} \oplus x_{4} \cdot x_{5}, &{}t_{24} = t_{24} \oplus x_{7} \cdot x_{2},\\ \nonumber x_{6} = x_{6} \oplus x_{4}, &{}x_{5} = x_{5} \oplus x_{1}, &{}x_{3} = x_{6} \oplus x_{4} \oplus x_{3},\\ \nonumber x_{0} = x_{1} \oplus x_{0}, &{}x_{7} = x_{7} \oplus x_{6} \oplus x_{3}, &{}x_{2} = x_{5} \oplus x_{2} \oplus x_{0},\\ \nonumber x_{4} = x_{7} \oplus x_{4}, &{}x_{1} = x_{5} \oplus x_{2} \oplus x_{1}, &{}t_{22} = t_{22} \oplus t_{21},\\ \nonumber t_{21} = t_{21} \oplus t_{23}, &{}t_{23} = t_{23} \oplus x_{6} \cdot x_{5}, &{}t_{21} = t_{21} \oplus x_{3} \cdot x_{0},\\ \nonumber t_{24} = t_{24} \oplus x_{7} \cdot x_{2}, &{}a = a \oplus x_{4} \cdot x_{1}, &{}t_{21} = t_{21} \oplus a,\\ \nonumber t_{22} = t_{22} \oplus a, &{}t_{23} = t_{23} \oplus a, &{}t_{24} = t_{24} \oplus a,\\ \nonumber x_{3} = x_{7} \oplus x_{3}, &{}x_{0} = x_{2} \oplus x_{0}, &{}a = a \oplus x_{4} \cdot x_{1},\\ \nonumber t_{22} = t_{22} \oplus x_{7} \cdot x_{2}, &{}t_{23} = t_{23} \oplus x_{3} \cdot x_{0}, &{}t_{24} = t_{24} \oplus x_{6} \cdot x_{5},\\ \nonumber x_{4} = x_{4} \oplus x_{1}, &{}t_{21} = t_{21} \oplus x_{4}, &{}x_{2} = x_{7} \oplus x_{2},\\ \nonumber t_{22} = t_{22} \oplus x_{2}, &{}x_{5} = x_{6} \oplus x_{5}, &{}t_{23} = t_{23} \oplus x_{5},\\ \nonumber x_{5} = x_{5} \oplus x_{3} \oplus x_{0}, &{}t_{24} = t_{24} \oplus x_{5}.\\ \nonumber \end{array} \end{aligned}$$

1.2 The reversible circuit for the outputs of AES S-box\(^{-1}\)

$$\begin{aligned} \begin{array}{llll} t_{22} = t_{22} \oplus t_{21}, &{}t_{21} = t_{23} \oplus t_{21}, &{}t_{23} = t_{24} \oplus t_{23},\\ \nonumber x_{5} = x_{6} \oplus x_{5} \oplus x_{3} \oplus x_{0}, &{}x_{4} = x_{4} \oplus x_{1}, &{}x_{2} = x_{7} \oplus x_{5} \oplus x_{2} \oplus x_{1},\\ \nonumber x_{7} = x_{7} \oplus x_{3}, &{}s_{2} = s_{2} \oplus t_{22} \cdot x_{5}, &{}s_{4} = s_{4} \oplus t_{21} \cdot x_{4},\\ \nonumber s_{3} = s_{3} \oplus t_{23} \cdot x_{2}, &{}s_{7} = s_{7} \oplus t_{24} \cdot x_{7}, &{}t_{24} = t_{24} \oplus t_{23} \oplus t_{22} \oplus t_{21},\\ \nonumber t_{23} = t_{23} \oplus t_{22}, &{}x_{7} = x_{7} \oplus x_{4} \oplus x_{3}, &{}s_{4} = s_{4} \oplus t_{22} \cdot x_{6},\\ \nonumber s_{1} = s_{1} \oplus t_{21} \cdot x_{4}, &{}s_{0} = s_{0} \oplus t_{24} \cdot x_{0}, &{}s_{7} = s_{7} \oplus t_{23} \cdot x_{7},\\ \nonumber s_{2} = s_{2} \oplus s_{0}, &{}s_{3} = s_{3} \oplus s_{2}, &{}s_{6} = s_{6} \oplus s_{4},\\ \nonumber s_{5} = s_{5} \oplus s_{3}, &{}s_{1} = s_{1} \oplus s_{7}, &{}t_{24} = t_{24} \oplus t_{22} \oplus t_{21},\\ \nonumber t_{22} = t_{23} \oplus t_{22}, &{}t_{21} = t_{24} \oplus t_{21}, &{}x_{0} = x_{5} \oplus x_{1} \oplus x_{0},\\ \nonumber x_{7} = x_{7} \oplus x_{6}, &{}x_{5} = x_{5} \oplus x_{2}, &{}x_{6} = x_{6} \oplus x_{3},\\ \nonumber s_{3} = s_{3} \oplus t_{24} \cdot x_{0}, &{}s_{1} = s_{1} \oplus t_{22} \cdot x_{7}, &{}s_{2} = s_{2} \oplus t_{23} \cdot x_{5},\\ \nonumber s_{4} = s_{4} \oplus t_{21} \cdot x_{6}, &{}s_{0} = s_{0} \oplus s_{3}, &{}t_{22} = t_{24} \oplus t_{22},\\ \nonumber t_{24} = t_{24} \oplus t_{21}, &{}x_{0} = x_{1} \oplus x_{0}, &{}x_{2} = x_{2} \oplus x_{1} \oplus x_{0},\\ \nonumber s_{3} = s_{3} \oplus t_{23} \cdot x_{5}, &{}s_{0} = s_{0} \oplus t_{21} \cdot x_{0}, &{}s_{5} = s_{5} \oplus t_{22} \cdot x_{2},\\ \nonumber s_{2} = s_{2} \oplus t_{24} \cdot x_{1}, &{}t_{24} = t_{24} \oplus t_{23}, &{}x_{1} = x_{5} \oplus x_{1},\\ \nonumber x_{7} = x_{7} \oplus x_{6} \oplus x_{3}, &{}s_{3} = s_{3} \oplus t_{24} \cdot x_{1}, &{}s_{6} = s_{6} \oplus t_{23} \cdot x_{7},\\ \nonumber s_{4} = s_{4} \oplus s_{3}, &{}s_{7} = s_{7} \oplus s_{4}, &{}t_{22} = t_{24} \oplus t_{22},\\ \nonumber t_{21} = t_{24} \oplus t_{23} \oplus t_{21}, &{}x_{7} = x_{7} \oplus x_{4}, &{}x_{6} = x_{6} \oplus x_{4},\\ \nonumber \end{array} \end{aligned}$$
$$\begin{aligned} \begin{array}{llll} s_{4} = s_{4} \oplus t_{24} \cdot x_{7}, &{}s_{6} = s_{6} \oplus t_{22} \cdot x_{3}, &{}s_{7} = s_{7} \oplus t_{21} \cdot x_{6},\\ \nonumber s_{6} = s_{6} \oplus s_{2}, &{}s_{0} = s_{0} \oplus s_{6}, &{}s_{1} = s_{1} \oplus s_{4},\\ \nonumber s_{4} = s_{4} \oplus s_{0}, &{}s_{2} = s_{2} \oplus s_{5}, &{}s_{0} = s_{0} \oplus s_{3},\\ \nonumber s_{4} = s_{4} \oplus s_{7}, &{}s_{2} = s_{2} \oplus s_{7}, &{}s_{7} = s_{7} \oplus s_{1},\\ \nonumber s_{1} = s_{1} \oplus s_{6}, &{}s_{1} = s_{1} \oplus s_{5}, &{}s_{3} = s_{3} \oplus s_{6},\\ \nonumber s_{5} = s_{5} \oplus s_{0}.\\ \nonumber \end{array} \end{aligned}$$

The reversible circuit added if not all output qubits are 0s

$$\begin{aligned} \begin{array}{lllll} s_{5} = s_{5} \oplus s_{0}, &{}s_{3} = s_{3} \oplus s_{6}, &{}s_{1} = s_{1} \oplus s_{5}, &{}s_{1} = s_{1} \oplus s_{6}, &{}s_{7} = s_{7} \oplus s_{1},\\ \nonumber s_{2} = s_{2} \oplus s_{7}, &{}s_{4} = s_{4} \oplus s_{7}, &{}s_{0} = s_{0} \oplus s_{3}, &{}s_{2} = s_{2} \oplus s_{5}, &{}s_{4} = s_{4} \oplus s_{0},\\ \nonumber s_{1} = s_{1} \oplus s_{4}, &{}s_{0} = s_{0} \oplus s_{6}, &{}s_{6} = s_{6} \oplus s_{2}, &{}s_{7} = s_{7} \oplus s_{4}, &{}s_{4} = s_{4} \oplus s_{3},\\ \nonumber s_{0} = s_{0} \oplus s_{3}, &{}s_{1} = s_{1} \oplus s_{7}, &{}s_{5} = s_{5} \oplus s_{3}, &{}s_{6} = s_{6} \oplus s_{4}, &{}s_{3} = s_{3} \oplus s_{2},\\ \nonumber s_{2} = s_{2} \oplus s_{0}.\\ \nonumber \end{array} \end{aligned}$$

An example of calculating the CNOT gate consumption of AES-128

For the NCT-based circuit of AES-128, the number of CNOT gates consumed by the AddRoundKey and the MixColumns is \(128\times r\) and \(4\times 92\times (r-1)\), respectively, where r is the round number. Supposing that 5 ancilla qubits are allocated for each of the m parallel S-boxes in the round function, one can also use the S-box\(^{-1}\) circuit that consumes 5 ancilla qubits to remove the previous round, after which there are \(8\times m + 5\times m\) qubits with value zero available for the S-boxes in the key schedule. For the case that \(\frac{16}{m}\in \mathbb {Z}_{+}\), \(8\times m+5\times m > 6\) always hold. It follows that the S-boxes in the key schedule can be implemented with the circuit that consumes 6 ancilla qubits. In each round of AES-128, it requires 16 S-boxes to implement the SubBytes in the round function, 16 S-box\(^{-1}\)es to remove the previous round and 4 S-boxes for the key schedule. Denote by \(Cnot_{S_5^{*}}\), \(Cnot_{S_{5}^{-1*}}\), \(Cnot_{S_6^{*}}\) the CNOT gate count of the S-box circuit that consumes 5 ancilla qubits, the CNOT gate count of the S-box\(^{-1}\) circuit that consumes 5 ancilla qubits and the CNOT gate count of the S-box circuit that consumes 6 ancilla qubits, respectively. The CNOT consumption of the nonlinear components except the first round can be calculated as \((16\times Cnot_{S_5{^*}}+16\times Cnot_{S_5^{-1*}})\times (r-1)+4\times Cnot_{S_6^{*}}\times w{'}\), where \(w^{'}\) is the number of SubWord operations used in the key schedule except the first round and equals 9 for AES-128. In addition, word-wise Xor is applied in the key schedule to implement \(W_{i} = W_{i-4}\oplus W_{i-1}\), which means \(3\times 32\times w\) CNOT gates are required, where w is the number of SubWord operations used in the key schedule and equals 10 for AES-128.

Rights and permissions

Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Lin, D., Xiang, Z., Xu, R. et al. Optimized quantum implementation of AES. Quantum Inf Process 22, 352 (2023). https://doi.org/10.1007/s11128-023-04043-9

Download citation

  • Received:

  • Accepted:

  • Published:

  • DOI: https://doi.org/10.1007/s11128-023-04043-9

Keywords

Search

Navigation