Applying Grover’s Algorithm to AES: Quantum Resource Estimates

Block encoding severs as an important data input model in quantum algorithms, enabling quantum computers to simulate non-unitary operators effectively. In this paper, we propose an efficient block-encoding protocol for sparse matrices based on a novel data structure, called the dictionary data structure, which classifies all non-zero elements according to their values and indices. Non-zero elements with the same values, lacking common column and row indices, belong to the same classification in our block-encoding protocol's dictionary. When compiled into the {U(2), CNOT} gate set, the protocol queries a 2n×2n sparse matrix with s non-zero elements at a circuit depth of O(log⁡(ns)), utilizing O(n2s) ancillary qubits. This offers an exponential improvement in circuit depth relative to the number of system qubits, compared to existing methods \cite{clader2022quantum,zhang2024circuit} with a circuit depth of O(n). Moreover, in our protocol, the subnormalization, a scaled factor that influences the measurement probability of ancillary qubits, is minimized to ∑l=0s0|Al|, where s0 denotes the number of classifications in the dictionary and Al represents the value of the l-th classification. Furthermore, we show that our protocol connects to linear combinations of unitaries (LCU) and the sparse access input model (SAIM). To demonstrate the practical utility of our approach, we provide several applications, including Laplacian matrices in graph problems and discrete differential operators.

ABSTRACTQuantum computing environments make block ciphers susceptible to exhaustive key search attacks utilizing Grover's algorithm. However, such quantum‐based attacks remain impractical unless the targeted cipher is directly implemented on a quantum platform. Moreover, their efficiency significantly depends on the quantum circuit design and optimization of the block cipher in question. The cost of a quantum circuit implementation is typically measured by two main metrics: the number of qubits and the circuit depth (T‐depth). For most block ciphers, the S‐box is the principal factor contributing to increased T‐depth and additional qubit requirements. This paper presents a method for generating quantum circuits directly from lookup tables of S‐boxes applicable to arbitrary block ciphers. We illustrate our approach using quantum circuit implementations of the PRESENT and DES ciphers as practical examples. Our proposed method is expected to efficiently implement arbitrary S‐boxes by employing polynomial evaluation, thus balancing time–space complexity.

Low rank approximation in simulations of quantum algorithms

Erratum to “The computational power of Benenson automata” [Theoret. Comput. Sci. 344 (2005) 279–297

It is well known that among the three classes of the PRAM models, namely, CRCW, CREW, and EREW, the CRCW models are the weakest, in the sense that, they permit concurrent read/write by processors. Accordingly, algorithms on the CRCW model mainly concentrate on the core computations without much ado about data access. Consequently, this model, at least in principle, allows for the design of the fastest algorithm for a problem. It is intriguing to ask how fast prefixes can be computed on the CRCW models. Since CRCW models are equivalent to the unbounded fan-in circuits (refer to Chapter 2), the task of developing the fastest algorithms for the prefix problems is pursued in the context of the unbounded fan-in circuits. Recall from Chapter 2, that while the standard measures, such as, size and depth are still used to quantify the goodness of unbounded fanin circuits, the size of the circuit is measured by the total number of edges incident on all of its operation nodes, instead of by the number of operations nodes. It turns out that the size and depth of unbounded fanin circuits for computing prefixes, depends critically on the structure of the underlying semigroup from which the input elements are drawn. The principal result of this concluding Chapter may be stated as follows: There exists unbounded fan-in parallel prefix circuits of constant depth and polynomial size if, and only if, the underlying semigroup is group free. The proof of this result involves a very clever synthesis of a number of ideas drawn from different directions — structure of group free semigroups, their relations to a special class of regular sets, called non-counting regular sets, the relation of this latter class of regular sets to yet another class of regular sets defined by star-free regular expressions, and the design of a special class of finite state deterministic automata called RS machines that accept star-free regular expressions. In this context, it is convenient to define the notion of small circuits as the class of circuits with constant depth and polynomial size.

While Clifford operations are relatively easy to implement in fault-tolerant quantum computers, continuous rotation gates remain a significant bottleneck in typical quantum algorithms. In this work, we ask the question: “What is the most efficient approach for implementing continuous rotations in a surface code architecture?” Several techniques have been developed to reduce the T-count or T-depth of rotations, such as Hamming weight phasing and catalyst towers. However, these methods often require additional a number of ancilla qubits, and thus the ultimate cost function one needs to optimise against should rather be the total runtime or the total space required for performing a rotation. We explicitly construct surface code layouts for catalyst towers in two practical application examples in the context of option pricing: (a) implementing a phase oracle circuit, which is a ubiquitous subroutine in many quantum algorithms, and (b) state preparation using a variational quantum circuit. Our analysis shows that, at small and medium code distances, catalyst towers not only reduce the runtime but can also decrease the total spacetime volume of rotations. However, at large code distances, conventional Clifford+T synthesis may prove more efficient. Additionally, we note that our conclusions are sensitive to specific application scenarios and the choices of various parameters. Nevertheless, catalyst towers may be particularly advantageous for early fault-tolerant quantum applications, where low and medium code distances are assumed and a spacetime tradeoff is needed to reduce the runtime of individual circuit runs, such as in scenarios involving high circuit repetition counts.

In recent years, quantum technology has been rapidly developed. As security analyses for symmetric ciphers continue to emerge, many require an evaluation of the resources needed for the quantum circuit implementation of the encryption algorithm. In this regard, we propose the quantum circuit decision problem, which requires us to determine whether there exists a quantum circuit for a given permutation f using M ancilla qubits and no more than K quantum gates within the circuit depth D. Firstly, we investigate heuristic algorithms and classical SAT-based models in previous works, revealing their limitations in solving the problem. Hence, we innovatively propose an improved SAT-based model incorporating three metrics of quantum circuits. The model enables us to find the optimal quantum circuit of an arbitrary 3 or 4-bit S-box under a given optimization goal based on SAT solvers, which has proved the optimality of circuits constructed by the tool, LIGHTER-R. Then, by combining different criteria in the model, we find more compact quantum circuit implementations of S-boxes such as RECTANGLE and GIFT. For GIFT S-box, our model provides the optimal quantum circuit that only requires 8 gates with a depth of 31. Furthermore, our model can be generalized to linear layers and improve the previous SAT-based model proposed by Huang et al. in ASIACRYPT 2022 by adding the criteria on the number of qubits and the circuit depth.

The Consultative Committee for Space Data Systems (CCSDS) recommends AES algorithm as a cryptographic algorithm to maintain confidentiality and data security between spacecraft and ground systems. In implementation, there are several AES algorithm operating modes including Cipher-Block Chaining (CBC), Electronic Codebook (EBC), Cipher Feedback (CFB), Output Feedback (OFB), and counter mode (CTR). One of the operating modes of AES algorithm recommended by CCSDS is CTR because it has advantages in terms of efficiency of implementation and offers a high level of data security. LAPAN-A4 as the next generation of LAPAN satellites also uses CCSDS standard in terms of data exchange between satellites and ground stations including telemetry and telecommand (TTC) data and satellite payload data. In order to protect LAPAN-A4 satellite data, especially TTC data, in this paper AES algorithm was implemented in CTR operating mode on the FPGA which will then be implemented on LAPAN-A4 satellite onboard data handling (OBDH) as one of LAPAN-A4 satellite data security systems. To overcome the limited resource of FPGA, optimization is also done using basic iterative AES hardware reused method, which is to reuse hardware that has been designed n times for same operation for AES algorithm. From the results of implementation and optimization, efficiency of logic gates used is increasing almost a quarter less than the previous research.

Differential fault analysis (DFA) finds the key of a block cipher using differential information between correct and faulty ciphertexts obtained by inducing faults during the computation of ciphertexts. Among many ciphers, advanced encryption standard (AES) has been the main target of DFA due to its popularity. The naive implementation of AES is known to be vulnerable to DFA, which can be split into two categories depending on the fault location: the DFA on the State and the DFA on the Key Schedule. For the first category, much research has been done and very efficient methods were devised. However, there is still a lack of research in the second category. The advantage of DFA on the Key Schedule is that it can even defeat some fault-protected AES implementations. Research on DFA has been diversified into several directions: reducing the number of required faults, changing fault models (from one-byte fault to multibyte fault and vise versa), extending to AES-192 and AES-256, and exploiting faults induced at an earlier round. This paper deals with all these directions together in DFA on AES Key Schedule. We introduce new attacks that find the AES-128 key with two faults in a one-byte fault model without exhaustive search and the AES-192 and the AES-256 keys with six and four faults, respectively.

Simulating physical systems with variational quantum algorithms is a well-studied approach, but it is challenging to implement in current devices due to demands in qubit number and circuit depth. However, limited knowledge of a system can reduce the cost of these algorithms. We demonstrate that the computational overhead in simulating many-body systems can be systematically decreased by leveraging the system’s symmetries, which guide the choice of iterative entanglement forging partitions aligned with the underlying entropy structure. To do so, we simulate a Fermi-Hubbard one-dimensional chain with a parametrized hopping term, as well as atomic nuclei $${}^{28}$$ 28 Ne and $${}^{60}$$ 60 Ti with the nuclear shell model. Within an adaptive variational quantum eigensolver setting, we propose an algorithm that employs partitions and subpartitions of the quantum circuit to reduce significantly the quantum resources compared to a fully-fledged simulation. Entropy-driven entanglement forging (EDEF) does not require access to the full statevector or exact entropies; in hardware it is implemented via standard EF expectation-reconstruction rules with crossed statistics, while statevector access is used here only as a classical simulation shortcut. We find that the maximum number of qubits can be reduced by up to a factor of four and we observe an order of magnitude decrease in the number of two-qubit gates compared to regular simulations. Our findings indicate that our method, entropy-driven entanglement forging, can be used to adjust quantum simulations to the limitations of noisy intermediate-scale quantum devices.

We describe an implementation of Shor’s quantum algorithm to factor n-bit integers using only 2n+2 qubits. In contrast to previous space-optimized implementations, ours features a purely Toffoli based modular multiplication circuit. The circuit depth and the overall gate count are in O(n 3 ) and O(n 3 log n), respectively. We thus achieve the same space and time costs as Takahashi et al. [1], while using a purely classical modular multiplication circuit. As a consequence, our approach evades most of the cost overheads originating from rotation synthesis and enables testing and localization of some faults in both, the logical level circuit and an actual quantum hardware implementation. Our new (in-place) constant-adder, which is used to construct the modular multiplication circuit, uses only dirty ancilla qubits and features a circuit size and depth in O(n log n) and O(n), respectively.

Traditional methods for handling (inequality) constraints in the quantum approximate optimization (QAOA) typically rely on penalty terms and slack variables, which increase problem complexity and expand the search space. More sophisticated mixer-based QAOA variants restrict the search within the feasible assignments but often suffer from prohibitive circuit complexity. This paper presents a penalty-free formalism for incorporating inequality constraints into the cost function of QAOA using an oracle-based subroutine that evaluates constraint satisfaction in an additional register, subsequently called indicator function QAOA (IF-QAOA). Applied to the knapsack problem, we demonstrate in numerical simulations the superior performance of IF-QAOA over conventional penalty-based approaches. Using advanced QAOA simulation techniques, we find that IF-QAOA achieves significantly higher solution quality and a faster time to solution in 82% of our benchmark cases, even though circuit depth is approximately three times larger. Analysis of the scaling behavior shows favorable scaling of IF-QAOA compared to penalty-based methods. Also, benchmarks against the recently developed quantum tree generator QAOA for knapsack problems (P. Christiansen , ) demonstrated higher solution quality for circuits of similar depth. Additionally, this paper introduces a method for approximating the indicator function when the number of ancillary qubits is limited or the constraint function is noninteger. With a specialized simulation algorithm based on projective measurements, we empirically demonstrate that this formalism can encode general inequality constraints using a fixed number of ancillary qubits.

The advection-diffusion equation is simulated via several quantum algorithms. Three formulations are considered: (1) Trotterization, (2) variational quantum time evolution (VarQTE), and (3) adaptive variational quantum dynamics simulation (AVQDS). These schemes were originally developed for the Hamiltonian simulation of many-body quantum systems. The finite-difference discretized operator of the transport equation is formulated as a Hamiltonian and solved without the need for ancillary qubits. Computations are conducted on a quantum simulator (IBM Qiskit Aer) and a superconducting quantum hardware (IBM Fez). The former emulates the latter without the noise. The actual hardware implementation experiences significant noise. The results of the quantum simulator are compared with data from direct numerical simulation (DNS) with infidelities of the order 10 − 5 . In the quantum simulator, Trotterization is observed to have the lowest infidelity and is suitable for fault-tolerant computation. The AVQDS algorithm requires the lowest gate count and circuit depth. The VarQTE algorithm is the next best in terms of gate counts, but the number of its optimization variables is directly proportional to the number of qubits. Due to current hardware limitations, Trotterization cannot be implemented, as it has an overwhelmingly large number of operations. Meanwhile, AVQDS and VarQTE can be executed at the hardware level. These algorithms present a new paradigm for computational transport phenomena on quantum computers.

This study proposes a method for parallelising quantum algorithms in the circuit model based on the technique of quantum gate teleportation. The resulting parallel representation of the algorithm has reduced circuit depth and, consequently, a higher probability of correct execution under conditions of increasing quantum state decoherence over time. The reduction in circuit depth is achieved by increasing circuit width, i.e. the number of qubits simultaneously used in the computation.

We develop randomized quantum algorithms to simulate quantum collision models, also known as repeated interaction schemes, which provide a rich framework to model various open-system dynamics. The underlying technique involves composing time evolutions of the total (system, bath, and interaction) Hamiltonian and intermittent tracing out the environment degrees of freedom. This results in a unified framework where any near-term Hamiltonian simulation algorithm can be incorporated to implement an arbitrary number of such collisions on early fault-tolerant quantum computers: we do not assume access to specialized oracles such as block encodings and minimize the number of ancilla qubits needed. In particular, using the correspondence between Lindbladian evolution and completely positive trace-preserving maps arising out of memoryless collisions, we provide an end-to-end quantum algorithm for simulating Lindbladian dynamics. For a system of $n$-qubits, we exhaustively compare the circuit depth needed to estimate the expectation value of an observable with respect to the reduced state of the system after time $t$ while employing different near-term Hamiltonian simulation techniques, requiring at most $n+2$ qubits in all. We compare the cnot gate counts of the various approaches for estimating the transverse field magnetization of a 10-qubit XX-Heisenberg spin chain under amplitude damping. Finally, we also develop a framework to efficiently simulate an arbitrary number of memory-retaining collisions, i.e., where environments interact, leading to non-Markovian dynamics. Overall, our methods can leverage quantum collision models for both Markovian and non-Markovian dynamics on early fault-tolerant quantum computers, shedding light on the advantages and limitations of simulating open systems dynamics using this framework.