Quantum computers accelerate many algorithms based on the superposition principle of quantum mechanics. Shor’s algorithm [1] exponentially reduces the complexity of attacking public-key schemes on quantum computers. Since 2016, the National Institute of Standards and Technology (NIST) has been conducting the post-quantum cryptography standardization process [2]. For symmetric-key schemes, Grover’s and Simon’s algorithms [3,4] offer attackers significant performance to attack the schemes, but these algorithms do not entirely compromise the security such systems’. However, in a quantum computing environment, symmetric-key cryptography may have weak properties not yet studied for each algorithm. Most cryptanalysis, including attacks targeting these vulnerabilities and generic attacks, requires the implementation of cipher’s quantum circuits, and its performance depends on the efficiency of the circuit. For future security, research on the implementation of the quantum circuits must be conducted, and it is necessary to know what performance bounds there are.

The substitution box (S-box) is a crucial component that provides confusion in symmetric-key schemes. When implementing a cipher as a quantum circuit, the linear layer can be implemented with only NOT and controlled-NOT (CNOT) gates. However, highly structured nonlinear layers, such as the S-box, must employ relatively expensive Toffoli gates and numerous qubits. In quantum circuits for symmetric-key schemes, the S-box incurs the highest cost.

The complexity of a quantum circuit is evaluated by the number of qubits and the Toffoli-depth defined by the number of non-parallelizable Toffoli gates. Optimizing these two parameters increases the implementation efficiency of quantum computers. This approach improves the attackers’ ability to perform exhaustive search and dedicated attacks using Grover’s algorithm in quantum computer. Hence, optimizing the quantum circuits of S-boxes is critical to assess the security of symmetric-key schemes against quantum computer-based attacks.

Extensive recent research has been conducted on finding efficient quantum circuits for the Advanced Encryption Standard (AES). Grassl et al. [5] initially proposed a quantum circuit for the AES and introduced a zig-zag structure to reduce the number of qubits required for its implementation. Subsequently, several studies have been conducted to reduce the number of qubits to implement the AES [6–9]. However, in NIST’s post-quantum cryptography standardization process, the Toffoli-depth represents a critical parameter. In response, Jaques et al. [8] attempted to construct an AES quantum circuit with a shallow Toffoli-depth. Recently, Huang et al. [10] proposed an AES quantum circuit with the shallowest depth.

The terms and notations used in this paper are explained as follows:

CNOT, NOT, Toffoli gates: Gates used in quantum circuit

Contributions. This paper provides a new framework to construct quantum circuits 𝒞:|α⟩|0⟩→|S(α)⟩|0⟩ of S-boxes. We treat quantum circuits of S-boxes using only CNOT, NOT, and Toffoli gates, called CNT-circuits, using system modeling. Using the CNT-circuits, we provide a framework for finding quantum circuits of the S-boxes with low Toffoli-depths according to a limited number of qubits by matching elements of vector spaces generated from the inputs and outputs of the S-boxes. The framework employs a meet-in-the-middle strategy, in which the key is to analyze the vector spaces spanned by the values before and after the Toffoli layers. The framework provides a specialized search for the Toffoli-depth by ignoring the detailed implementations of the linear layers of S-boxes. To the best of our knowledge, no study has analyzed the Toffoli-depth and number of qubits using a vector space and basis analysis between Toffoli layers in the quantum circuits of S-boxes.

To verify the effectiveness of the framework, we propose a technique and tool for applying the framework to a 4-bit S-box. These components are currently used as essential elements in many Authenticated Encryption with Associated Data (AEAD) schemes and block ciphers [11–15]. In addition, LIGHTER-R [16] provides Toffoli-depth optimized quantum circuits of 4-bit S-boxes with a 4-qubit restriction. However, this approach fails if the target 4-bit S-boxes are odd permutations. This result occurs due to the theorem that odd permutations cannot be implemented with 4 qubits in CNT-circuits and requiress at least 5 qubits [17]. The algorithms offer a wider range of quantum circuits compared to LIGHTER-R in terms of the Toffoli-depth and number of qubits (up to 5). This improvement allows the algorithms to produce the quantum circuits of the 4-bit S-boxes of odd permutations. Given that half of 4-bit S-boxes are odd permutations, this result enables researchers to implement quantum circuits for all 4-bit S-boxes.

Paper Organization. Section 2 describes quantum computation and quantum circuits. Section 3 describes the properties of the CNT-circuit and the model in the quantum circuit. Section 4 describes the framework for finding quantum circuits of 4-bit S-boxes according to a limited number of qubits. Section 5 presents the results of the proposed algorithm in Section 4. Section 6 presents the conclusions and provides a discussion.

A fundamental concept in classical computing involves a bit, characterized as either 0 or 1. Conversely, the qubit plays a role as a bit in quantum computing, holding 0 and 1 at the same time according to the superposition principle of quantum mechanics. The values |0⟩ and |1⟩ are orthonormal bases of the two-dimensional Hilbert space, also called the computational basis. The superposition state of a qubit can be represented as α|0⟩+β|1⟩ (α,β∈C), and α and β are called the complex probability amplitude. The state of the qubit is destroyed by measurement, after which one can observe |0⟩ or |1⟩, with the respective probabilities of |α|2 and |β|2 (thus, |α|2+|β|2=1 holds). To describe n qubits, we need a 2n dimensional Hilbert space for which the orthonormal bases are |00⋯0⟩, |00⋯1⟩, …, |11⋯1⟩, and total 2n.

This work primarily concerns with quantum circuits consisting of CNOT, NOT, and Toffoli gates. A CNOT gate is the two-qubit gate defined by CNOT:|a⟩|b⟩↦|a⟩|b⊕a⟩, and a NOT gate is the single-qubit gate defined by NOT:|a⟩↦|a⊕1⟩. A Toffoli gate is the three-qubit gate defined by Toffoli:|a⟩|b⟩|c⟩↦|a⟩|b⟩|c⊕ab⟩. A Toffoli gate can handle the XOR and AND of classical gates at once. Fig. 1 presents these quantum gates.

A quantum circuit using only CNOT, NOT, and Toffoli gates is defined as a CNT-circuit. In the CNT-circuit, the NOT gates can be moved to the circuit’s last operation without changing the Toffoli-depth, using the properties in Fig. 2. The NOT gates gathered in the last operation are equivalent to using an XORing on a constant value in the S-box. All S-boxes can be implemented with CNT-circuits; thus CT-circuits (without NOT gates) can implement all S-boxes satisfying 0↦0 [17]. Therefore, only CT-circuits are considered in this paper.

We considered the n-bit S-box defined by the vectorial Boolean function Fn→Fn. In the circuit of the S-box, n Boolean coordinate functions are represented by wires. Each wire connects to n input bits, and additional wires may be required depending on the circuit. All these wires become qubits in a quantum circuit.

We modeled CT-circuits for 𝒞:|α⟩|0⟩→|S(α)⟩|0⟩ of S-boxes satisfying 0↦0. Let 𝒞 use q qubits with a Toffoli-depth of t. We defined the layers with only Toffoli gates as Toffoli layers and treated the layers between them as linear layers (including empty layers). In addition, 𝒞 has t+1 linear layers, including the outermost two linear layers. We denote the i-th Toffoli layer as Ti and the i-th linear layer as Li. We established the indices of the layers as represented in Eq. (1). The CNOT gates can be implemented without additional qubits [18], and their cost is exempted from the analysis model. Therefore, we omitted the detailed implementation of CNOT gates in the linear layer. (1)𝒞:Lt∘Tt∘Lt−1∘Tt−1∘⋯∘L1∘T1∘L0.

To facilitate finding the circuit, we arranged the Toffoli gates in order within the Toffoli layers. We assumed that the control and target qubit positions of the Toffoli gates are fixed, and the exchange of wires that occurs while fixing them is absorbed by the linear layers. In detail, the control qubits of the i-th Toffoli gate use the (3i−2)-th and (3i−1)-th qubits, and the 3i-th qubit serves as the target qubit. Afterward, Toffoli gates are arranged consecutively in the Toffoli layers. Fig. 3 depicts a Toffoli layer using k Toffoli gates.

Implementing linear layers is equivalent to knowing their input and output values. When Toffoli layers are implemented, the input value of the following linear layer can be determined through the output values of the previous linear layer. If the output values of t linear layers are determined, the entire circuit can be implemented.

The qubit values at each point represent the input and output of the linear layer. We treated the qubit values as Boolean functions, and considered the vector space spanned by them. The vector spaces spanned at the input and output points of the linear layer are identical. We defined the vector space generated by Li as 𝒳i, and each 𝒳i is transformed into 𝒳i+1 by Ti+1 corresponding to the (i+1)-th Toffoli layer. In addition, we defined the input and output of the S-box as (x0,⋯,xn−1) and (y0,⋯,yn−1), respectively, as follows: span(x0,⋯,xn−1)=𝒳0⟶T1𝒳1⟶T2⋯⟶Tt𝒳t=span(y0,⋯,yn−1).

We applied the proposed algorithms to various 4-bit S-boxes. First, we considered all 4-bit optimal S-boxes classified by Leander and Poschmann [19,20] to demonstrate the validity of the proposed algorithms (see Table 1). Moreover, LIGHTER-R could not find the circuits of odd permutations (i.e., G3,G6,G9,G10,G11, G12,G14, and G15), whereas the proposed algorithm could.

Second, we consider the 4-bit S-boxes of GIFT [15], SKINNY [14] and Saturnin [21] (see Table 2). The proposed algorithms and LIGHTER-R output identical Toffoli-depths in the circuit implementation when using 4 qubits. We executed the proposed algorithm using 5 qubits but outputted the same Toffoli-depths. To compare the results of this study with those of existing circuits, we checked the AND-depth, which relates closely to the Toffoli-depth. Quantum circuits with the Toffoli-depth at the same value as the AND-depth always exist, so comparison is possible [10]. These values represented the same AND-depths of the classical implementation, as claimed by the designers of GIFT and SKINNY. The GIFT quantum circuit with 4 qubits was written in Algorithm 3. In the algorithm, x0 and y0 are least significant bits, and x3 and y3 are most significant bits.

In the case of Saturnin, we found a more efficient circuit with an AND-depth of 5, rather than a circuit with an AND-depth of 6 that the designers found. Fig. 6 is the circuit of Saturnin’s S-box σ0 that we found. We omitted the expression of CNOT gates in Li. The values of the wires leading to the same output on Li are XORed.

Discussion of the Results Based on the Algorithms. For each i, the proposed algorithms take a pair (𝒳i,𝒳t−j) as input and select the closer pair (𝒳i+1,𝒴), where 𝒴 can be either 𝒳t−j or 𝒳t−j−1. The value of j is determined by the number of times Algorithm 2 is repeated. In the process, a pair that is not closer to any i and j is never selected. This fact incurs a weakness in that the algorithms sometimes fail to find circuits with the minimum Toffoli-depth. However, we can determine the whole circuit’s lower bound of Toffoli-depth using Theorem 2. If the algorithms find a circuit with this lower bound, that implies the minimum Toffoli-depth. Furthermore, the algorithms offer the advantage of being able to find all circuits with such a lower bound. This result occurs because, a forward finding can discover a circuit if one with that lower bound exists (see Algorithm 1). If the output circuit does not have the lower bound, then the Toffoli-depth of the S-box is greater than the lower bound. We can confirm that the results of G3,G6,G9,G10,G11,G12,G14,G15, Saturnin, SKINNY, and GIFT are the minimum Toffoli-depth.

Discussion on 6 Qubits. In this case, the method of this paper can be applied as is, and only the number of available Toffoli gates in a Toffoli layer increases. The proposed algorithm uses only one Toffoli gate in a Toffoli layer, so the algorithm selects three qubits. When using 6 qubits, two Toffoli gates must be found; therefore all 6 qubits are selected. Accordingly, the computational cost for the forward direction becomes 26dim, and the computational cost for the meet-in-the-middle strategy becomes under 212dim.

Discussion on Other Methods. There are tools for creating quantum circuits, including LIGHTER-R and DORCIS [22]. The LIGHTER-R tool is based on the breadth-frist search algorithm and evaluates paths based on the cost entered by the user. In addition, DORCIS is based on LIGHTER-R, but the difference is that it evaluates the path based on the depth of the circuit. In the proposed framework, the vector space pairs corresponding to the forward and backward linear layers become the nodes, and the patterns for selecting the vector space pairs become the paths. In addition, the proposed method evaluates the path based on the intersection of a vector space pair. In the breadth-frist search based algorithm, all CNOT gates become nodes, but this proposed method ignores the CNOT gates, so the search is reduced.

The authors of DORCIS used GIFT’s S-box to compare its performance with LIGHTER-R. Both algorithms achieved Toffoli-depth 4 using 4 qubits, and we obtained the same result using the same number of qubits. This implies that our tool can handle all the tasks that existing tools are capable of.

This paper presents a new framework to construct quantum circuits of S-boxes according to a limited number of qubits. To construct such circuits, we analyzed the dimension and basis before and after the Toffoli layer to find qubits for which the equations match based on the forward search or the meet-in-the-middle strategy. We employed the proposed tool to find the circuits of 4-bit S-boxes and verified its effectiveness in practice. Through the proposed framework, we discovered all quantum circuits of odd permutations among all 4-bit optimal S-boxes classified by Leander and Poschmann. We also implemented quantum circuits of S-boxes for several well-known block ciphers, in which a more efficient quantum circuit of Saturnin’s S-box was found. The proposed technique can be applied to find circuits for S-boxes larger than 4 bits, which is left for future work. This technique contributes to the research field regarding finding optimized quantum circuits of S-boxes.