# Applying Grover's Algorithm to AES: Quantum Resource Estimates

@inproceedings{Grassl2016ApplyingGA,
title={Applying Grover's Algorithm to AES: Quantum Resource Estimates},
author={Markus Grassl and Brandon Langenberg and Martin R{\"o}tteler and Rainer Steinwandt},
booktitle={PQCrypto},
year={2016}
}
• Published in PQCrypto 15 December 2015
• Computer Science
We present quantum circuits to implement an exhaustive key search for the Advanced Encryption Standard AES and analyze the quantum resources required to carry out such an attack. We consider the overall circuit size, the number of qubits, and the circuit depth as measures for the cost of the presented quantum algorithms. Throughout, we focus on Clifford$$+T$$ gates as the underlying fault-tolerant logical quantum gate set. In particular, for all three variants of AES key size 128, 192, and 256i…
133 Citations
A quantum circuit design of AES requiring fewer quantum qubits and gate operations
• Education, Physics
Frontiers of Physics
• 2022
Advanced Encryption Standard (AES) is one of the most widely used block ciphers nowadays, and has been established as an encryption standard in 2001. Here we design AES-128 and the sample-AES (S-AES)
Alternative Tower Field Construction for Quantum Implementation of the AES S-box
• Computer Science, Mathematics
IEEE Transactions on Computers
• 2021
Four methods of trade-off between time and space for the quantum implementation of the AES S-box are proposed, one of which turns out to use the smallest number of qubits among the existing methods, significantly reducing its T -depth.
Towards Optimizing Quantum Implementation of AES S-box
• Computer Science
IACR Cryptol. ePrint Arch.
• 2020
Four methods of trade-off between time and space for the quantum implementation of the AES S-box are proposed, one of which turns out to use the smallest number of qubits among the existing methods, significantly reducing its T -depth.
Reducing the Cost of Implementing AES as a Quantum Circuit
• Computer Science, Physics
IEEE Transactions on Quantum Engineering
• 2020
This article presents a quantum circuit to implement the S-box of AES and identifies new quantum circuits for all three AES key lengths that can be used to simplify a Grover-based key search for AES.
Grover on SM3
• Computer Science
IACR Cryptol. ePrint Arch.
• 2021
This work proposes an optimal SM3 hash function (Chinese standard) in a quantum circuit that is focused on minimizing the use of qubits and reducing theUse of quantum gates and estimates the quantum resources required for the quantum pre-image attack.
Quantum Period Finding against Symmetric Primitives in Practice
• Computer Science, Mathematics
IACR Cryptol. ePrint Arch.
• 2020
An optimized quantum circuit for boolean linear algebra as well as complete reversible implementations of PRINCE, Chaskey, spongent and Keccak which are of independent interest for quantum cryptanalysis are proposed.
Quantum Analysis of AES
• Computer Science
IACR Cryptol. ePrint Arch.
• 2022
This work presents the least Toffoli depth and full depth implementations of AES, thereby improving from Zou et al.
Parallel Quantum Addition for Korean Block Cipher
• Computer Science, Mathematics
IACR Cryptol. ePrint Arch.
• 2021
This paper adopts the optimal quantum adder and design in parallel way with only a few trade-offs between quantum resources and provides a performance improvement of 78% in LEA, 85% in HIGHT, and 70% in CHAM in terms of circuit depth.
Grover on PIPO
• Computer Science, Mathematics
• 2021
The emergence of quantum computers is threatening the security of cryptography through various quantum algorithms. Among them, the Grover search algorithm is known to be efficient in accelerating
Quantum Implementation and Resource Estimates for RECTANGLE and KNOT
• Computer Science
IACR Cryptol. ePrint Arch.
• 2021
This work targets the lightweight block cipher RECTANGLE and the AuA, a generic attack against symmetric key cryptographic primitives, that can reduce the search complexity to square root and is among the first works to do this.

## References

SHOWING 1-10 OF 43 REFERENCES
Quantum Differential and Linear Cryptanalysis
• Computer Science, Mathematics
IACR Trans. Symmetric Cryptol.
• 2016
This work examines more closely the security of symmetric ciphers against quantum attacks, and investigates quantum versions of differential and linear cryptanalysis techniques, showing that it is usually possible to use quantum computations to obtain a quadratic speed-up for these attack techniques, but the situation must be nuanced.
A Meet-in-the-Middle Algorithm for Fast Synthesis of Depth-Optimal Quantum Circuits
• Computer Science
IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems
• 2013
We present an algorithm for computing depth-optimal decompositions of logical operations, leveraging a meet-in-the-middle technique to provide a significant speedup over simple brute force
A note on quantum related-key attacks
• Computer Science, Mathematics
Inf. Process. Lett.
• 2015
Quantum arithmetic and numerical analysis using Repeat-Until-Success circuits
• Computer Science, Physics
Quantum Inf. Comput.
• 2016
We develop a method for approximate synthesis of single--qubit rotations of the form $e^{-i f(\phi_1,\ldots,\phi_k)X}$ that is based on the Repeat-Until-Success (RUS) framework for quantum circuit
Elementary gates for quantum computation.
• Mathematics
Physical review. A, Atomic, molecular, and optical physics
• 1995
U(2) gates are derived, which derive upper and lower bounds on the exact number of elementary gates required to build up a variety of two- and three-bit quantum gates, the asymptotic number required for n-bit Deutsch-Toffoli gates, and make some observations about the number of unitary operations on arbitrarily many bits.
Efficient quantum circuits for binary elliptic curve arithmetic: reducing T-gate complexity
• Computer Science, Mathematics
Quantum Inf. Comput.
• 2013
This paper shows that changing the curve representation allows a substantial reduction in the number of T-gates needed to implement the curve arithmetic, and presents a quantum circuit for computing multiplicative inverses in F2n in depth O(n log2 n), which may be of independent interest.
Fixed-point quantum search with an optimal number of queries.
• Computer Science
Physical review letters
• 2014
This work provides the first version of amplitude amplification that achieves fixed-point behavior without sacrificing the quantum speedup and incorporates an adjustable bound on the failure probability and guarantees that this bound is satisfied over the broadest possible range of λ.
Surface codes: Towards practical large-scale quantum computation
• Physics, Computer Science
• 2012
The concept of the stabilizer, using two qubits, is introduced, and the single-qubit Hadamard, S and T operators are described, completing the set of required gates for a universal quantum computer.
Quantum Counting
• Physics
ICALP
• 1998
This work generalizes the Grover iteration in the light of a concept called amplitude amplification, and shows that the quadratic speedup obtained by the quantum searching algorithm over classical brute force can still be obtained for a large family of search problems for which good classical heuristics exist.
Tight bounds on quantum searching
• Computer Science
• 1996
A lower bound on the efficiency of any possible quantum database searching algorithm is provided and it is shown that Grover''s algorithm nearly comes within a factor 2 of being optimal in terms of the number of probes required in the table.