A method for implementing the AES algorithm in a quantum storage-limited environment

Abstract

The present invention relates to an AES algorithm implementation method under a quantum storage-restricted environment, which optimizes the quantization implementation of the AES algorithm under a quantum storage-restricted environment from two perspectives: local and overall; locally, the nonlinear S-box transformation and its inverse transformation are optimized for the two situations of whether the output quantum bit is 0; overall, the recursion between the AES round states is realized with 160 quantum bits through a "sawtooth" round state update algorithm; for key expansion, the corresponding circuit is tailored for each round to realize the refined use of quantum bits, thereby realizing the entire process of the AES algorithm with as few quantum bits as possible. The method is conducive to saving the use of quantum bits.

Description

Technical Field

[0001] The present invention belongs to the field of symmetric cryptography, and in particular relates to a method for implementing an AES algorithm in a quantum storage-restricted environment. Background Art

[0002] In the post-quantum era, the security of traditional cryptography against quantum attacks seems to have decreased. In fact, many cryptographic protocols are no longer sufficient to resist attacks based on quantum computers. In 1994, Shor et al. proposed a quantum algorithm that can complete large factor decomposition in polynomial time, which is undoubtedly a very serious blow to those asymmetric cryptographic protocols based on the factorization problem. On the contrary, the impact of quantum computers on symmetric cryptography is not so serious. The quantum algorithms currently used to attack symmetric cryptographic protocols are mainly Grover's algorithm and Simon's algorithm: Grover's algorithm can quadratically accelerate the search for answers to one-way functions; Simon's algorithm can use polynomial-level quantum query times to find hidden cycles.

[0003] At present, the optimization and quantization of classical circuits have attracted widespread attention in the cryptography community, and AES is the most widely used in symmetric cryptography, so it naturally receives the most attention. In addition, different researchers use different indicators when optimizing quantum circuits, some consider T depth, and some consider circuit depth. The most important assumption in the application scenario of the present invention is that quantum storage is limited, so it is necessary to save the use of quantum bits as much as possible.

[0004] In order to complete a quantum attack on a cryptographic algorithm, the oracle of the target algorithm must be realized first. The quantum oracle of any classical vector Boolean function can be constructed using a set of Clifford+T gate circuits, including Hadamard gates, phase gates, CNOT gates, and T gates. Moreover, there may be multiple schemes to implement the same oracle, and the pros and cons of these schemes will also vary with different evaluation indicators. The present invention is a quantum implementation of the AES algorithm under a quantum storage-constrained environment, so the evaluation indicators are the number of quantum gates used and the number of quantum bits.

[0005] For the MDS matrix in AES column confusion, Markus Grassl et al. of Microsoft Research proposed in "Applying Grover's algorithm to AES: quantum resource estimates" to implement it through LUP decomposition using a circuit with 277 CNOT gates and a total depth of 39. The present invention directly applies the technology proposed in the paper in this step. Summary of the invention

[0006] The purpose of the present invention is to provide a method for implementing an AES algorithm in a quantum storage-constrained environment, which is conducive to saving the use of quantum bits.

[0007] To achieve the above purpose, the technical solution adopted by the present invention is: a method for implementing the AES algorithm in a quantum storage-constrained environment, wherein the AES single-round encryption includes the following steps:

[0008] Step A, byte replacement: replace each byte in the state matrix in parallel with an 8-bit S-box; assuming the input byte is b and the output byte is b', the byte replacement is represented by b'=S(b), and its structure is as follows:

[0009]

[0010] Step B, row shift: cyclically shift the bytes in the i-th row of the state matrix to the left by i bytes;

[0011] Step C, column confusion: Multiply each column in the state matrix by an MDS matrix in the finite field to achieve linear transformation:

[0012]

[0013] Step D, round key addition: XOR the state value with the previous round key.

[0014] Furthermore, in step A, the S-box circuit of AES is represented by S(x)=B S ·F S (U S ·x), where U S The input x 0 ,x 1 ,…,x 7 Transformed into output x 7 ,y 1 ,…,y 21 ,function The input is x 7 ,y 1 ,···,y 21 , the output is z 0 ,z 1 ,···,z 17 , matrix B S Enter z 0 ,z 1 ,···,z 17 Convert to output 0 ,s 1 ,···,s 7 ;

[0015] Converting the above calculation process into a quantum algorithm requires considering the following two cases: The first is when the output bit is 0, that is, |x>|0a >→|x>|S(x)>|0 a-8 >; The second is when the output bit is not 0, that is

[0016] For the first case, that is, the output qubit of the S-box is initially 0, the intermediate variable is calculated first, and then the output of the S-box is calculated using the output intermediate value;

[0017] For the second case, in the S-box calculation in the key expansion phase, if there are no new empty bits available, the output quantum bits can only use the bits used in the previous calculations. These bits are not guaranteed to be 0 initially. At this time, the linear relationship between different bits cannot be used to generate the final output bits, so the quantum algorithm is adjusted.

[0018] Furthermore, the four steps of AES single-round encryption are encapsulated into a component that operates on one column and four bytes each time. The component completes three operations: byte replacement, column confusion, and round key addition, while step B completes a row transformation operation of one row and four bytes. Therefore, step B is moved outside the component to complete. In order to reduce the number of quantum bits in the circuit, a part of the quantum bits needs to be reused, so some quantum bits are reset to 0. In order to clear the output bits of the S-box, an AES inverse S-box quantum circuit is designed.

[0019] Furthermore, multiple rounds of AES encryption are performed; on the premise that the row shift of the state matrix is ​​completed in advance, the state value of a column in the i-th round is pushed forward to the i+1-th round using the component and its implementation algorithm; and then the reversibility of the quantum circuit is used to clear the state value of a column in the i-th round to zero.

[0020] Furthermore, through the round state update algorithm, 160 quantum bits are used to realize the recursion of the AES round state; the round state update algorithm uses 32 auxiliary bits and 128 bits of round state information to complete the update from the first round to the last round; wherein the byte replacement of step A needs to divide the 32 bits into 4 8-bit bytes and complete them separately, while algorithms I and II require at most 6 auxiliary bits. In order not to add additional auxiliary bits, the update of the 32 bits is divided into 2 parts, and each part updates 16 bits respectively; the first 16 bits use 16 bits of the 32 bits that are originally set to 0 to save the result, and the other 16 bits are used as auxiliary bits. After obtaining the first 16-bit result, the position storing the first 16-bit input is first reset to 0; then the second 16-bit result is calculated, and the original first 16-bit input is used as auxiliary bits. After the calculation is completed, the second 16-bit input is restored.

[0021] Furthermore, in addition to the update between round functions, key expansion operations need to be implemented; AES key expansion uses the following three basic operations:

[0022] Operation A, RotWord, cyclically shift each byte in a word left by 1 byte;

[0023] Operation B, Rcon, XOR each byte in a word with a constant;

[0024] Operation C, SubWord, passes each byte in a word through the S-box operation.

[0025] Furthermore, based on the three basic operations, the key expansion algorithm of AES-128, the key expansion algorithm of AES-192 and the key expansion algorithm of AES-256 are implemented.

[0026] Compared with the prior art, the present invention has the following beneficial effects: the present invention optimizes the quantization implementation of the AES algorithm under the quantum storage-constrained environment from both local and overall perspectives, and reduces the quantum bits required as much as possible. Locally, the present invention optimizes the nonlinear S-box transformation and its inverse transformation respectively for the two cases of whether the output quantum bit is 0; overall, the present invention proposes a "sawtooth" round state update algorithm, which uses 160 quantum bits to realize the recursion between AES round states; for key expansion, the present invention tailors the corresponding circuits for each round to realize the refined use of quantum bits, so as to realize the entire process of the AES algorithm with as few quantum bits as possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 2 is a schematic diagram of a row shift in an embodiment of the present invention.

[0028] Figure 2 It is a schematic diagram of components for byte replacement, column obfuscation, and round key addition in an embodiment of the present invention.

[0029] Figure 3 It is a schematic diagram of clearing the status value in an embodiment of the present invention.

[0030] Figure 4 The QAND gate and Gate implementation schematic.

[0031] Figure 5 It is a schematic diagram of the implementation process of the "sawtooth" wheel state update algorithm in an embodiment of the present invention.

[0032] Figure 6 Schematic diagram of the second implementation process of the "sawtooth" wheel state update algorithm in an embodiment of the present invention.

[0033] Figure 7 Schematic diagram of the third implementation process of the "sawtooth" wheel state update algorithm in the embodiment of the present invention.

[0034] Figure 8 Schematic diagram of the fourth implementation process of the "sawtooth" wheel state update algorithm in an embodiment of the present invention.

[0035] Fig. 9 Schematic diagram of the fifth implementation process of the "sawtooth" wheel state update algorithm in an embodiment of the present invention.

[0036] Fig.10 It is a schematic diagram of the implementation principle of the "sawtooth" wheel state update algorithm in an embodiment of the present invention.

[0037] Fig.11 It is a principle block diagram of the method implementation of an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0039] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0040] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0041] This embodiment provides a method for implementing the AES algorithm in a quantum storage-constrained environment. AES single-round encryption includes the following steps:

[0042] Step A, byte replacement: replace each byte in the state matrix in parallel with an 8-bit S-box; assuming the input byte is b and the output byte is b', the byte replacement is represented by b'=S(b), and its structure is as follows:

[0043]

[0044] Step B, row shift: Circularly shift the bytes in the i-th row of the state matrix to the left by i bytes (0≤i≤3), such as Figure 1 shown.

[0045] Step C, column confusion: Multiply each column in the state matrix by an MDS matrix in the finite field to achieve linear transformation:

[0046]

[0047] Step D, round key addition: XOR the state value with the previous round key.

[0048] In step A, the S-box circuit of AES is represented by S(x)=B S ·F S (U S ·x), where U S The input x 0 ,x 1 ,…,x 7 Transformed into output x 7 ,y 1 ,…,y 21 , the calculation process is as follows:

[0049]

[0050] function The input is x 7 ,y 1 ,···,y 21 , the output is z 0 ,z 1 ,···,z 17 , the calculation process is as follows:

[0051]

[0052] Matrix B S Enter z 0 ,z 1 ,···,z 17 Convert to output 0 ,s 1 ,···,s 7 , the calculation process is as follows:

[0053]

[0054]

[0055] Converting the above calculation process into a quantum algorithm requires considering the following two cases: The first is when the output bit is 0, that is, |x>|0 a >→|x>|S(x)>|0 a-8 >; The second is when the output bit is not 0, that is

[0056] For the first case, that is, the output qubit of the S-box is initially 0, we first use Algorithm 1 to calculate the intermediate variable t 29 ,t 33 ,t 37 ,t 40 , specifically:

[0057] Input U[i]=x[i], 0≤i≤7, T[j]=0, ​​0≤j≤5, U[i] is used to store the 8-bit input of the S-box, T[j] is used to store temporary variables, and then the following calculation is performed:

[0058]

[0059] Then output U[0]=y 19 ,U[1]=y 4 ,U[2]=y 2 ,U[3]=y 5 ,U[4]=y 14 ,U[5]=y 6 ,U[6]=y 21 ,U[7]=x 7 ,T[0]=t 24 ,T[1]=t 37 ,T[2]=t 29 ,T[3]=t 40 ,T[4]=t 27 ,T[5]=t 33 ; The values ​​stored in U[0]…U[7], T[0]…T[5] in Algorithm 1 are passed to Algorithm 2 to calculate the output of the S-box.

[0060] The T-depth of Algorithm 1 is 22, requiring 6 auxiliary qubits, 14 Toffoli gates, 3 QAND gates, and 93 CNOT gates.

[0061] Then, Algorithm 2 uses the intermediate value output by Algorithm 1 to calculate the output of the S-box. Algorithm 2 requires the inverse of Algorithm 1, where the Toffoli gate in step 47 can be replaced by The inverse calculation is done by using the gate, while the QAND gate is replaced by The inverse algorithm of Algorithm 1 requires 6 auxiliary qubits, 13 Toffoli gates, and 4 gates and 93 CNOT gates, with a T depth of 18. Specifically:

[0062] Input T[0] = t 29 ,T[1]=t 37 ,T[2]=t 40 ,T[3]=t 33 ,T[4]=t 24 ,T[5]=t 27 ,U[0]=y 5 ,U[1]=y 19 ,U[2]=y 14 ,U[3]=y 2 ,U[4]=y6 ,U[5]=y 21 ,U[6]=y 4 ,U[7]=x 7 , where U[0]…U[7], T[0]…T[5] store the output of Algorithm 1, and then perform the following calculation:

[0063]

[0064]

[0065] Then output S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], where S[0]…S[7] store the output of the S-box (must be initialized to 0).

[0066] The T depth of Algorithm 2 is 50, which requires 6 auxiliary qubits, 23 Toffoli gates, 4 NOT gates, 8 QAND gates, and 4 gates and 233 CNOT gates.

[0067] Therefore, the overall cost of the algorithm in the first case, namely Algorithm I, is: 6 auxiliary qubits, 37 Toffoli gates, 326 CNOT gates and 4 NOT gates, 11 QAND gates, 4 Door, T depth is 72;

[0068] For the second case, in the S-box calculation in the key expansion phase, if there are no new empty bits available, the output quantum bits can only use the bits used in the previous calculation. These bits are not guaranteed to be 0 initially. At this time, the linear relationship between different bits cannot be used to generate the final output bits. Therefore, the quantum algorithm is adjusted as follows:

[0069] Algorithm 3 uses the outputs U[0]…U[7], T[0]…T[5] of Algorithm 1 as input, and the output S[0]…S[7] is the result of the S-box, specifically:

[0070] Input T[0] = t 29 , T[1] = t 37 , T[2] = t 40 , T[3] = t 33 , T[4] = t 24 , T[5] = t 27 , U[0]=y 5 , U[1]=y 19 , U[2]=y 14 , U[3]=y 2 , U[4]=y 6 , U[5]=y 21, U[6]=y 4 , U[7]=x 7 , and then calculate as follows:

[0071]

[0072]

[0073] Then output S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7].

[0074] The T depth of Algorithm 3 is 69, which requires 6 auxiliary qubits, 31 Toffoli gates, 4 NOT gates, and 20 gates and 159 CNOT gates.

[0075] Therefore, the overall cost of the algorithm in the second case, namely Algorithm II, is: 6 auxiliary qubits, 45 Toffoli gates, 3 QAND gates, 20 gates, 252 CNOT gates and 4 NOT gates, and the T depth is 91.

[0076] For step B, since this step only exchanges the order of 16 bytes in the AES state matrix, it can be completed by a transposition operation, and this article assumes that the cost of the transposition operation is negligible, so step B can be completed without additional quantum implementation cost.

[0077] For step C, the column confusion is completed by left-multiplying a 32×32 matrix, and a circuit with 277 CNOT gates and a CNOT gate depth of 39 is obtained through the LUP decomposition proposed by Markus Grassl et al. in "Applying Grover's algorithm to AES: quantum resource estimates".

[0078] As for step D, this step completes the XOR operation between the state value and the round key, which can be completed in parallel through 128 CNOT gates, requiring 256 quantum bits, and the CNOT gate depth is 1.

[0079] The four steps of AES single-round encryption are now encapsulated into a component that operates on 1 column and 4 bytes each time. The component completes the three operations of byte replacement, column confusion, and round key addition (because step B completes the row transformation operation of 1 row and 4 bytes, step B is moved outside the component to complete), as shown in Figure 2 shown.

[0080] In order to reduce the number of quantum bits in the circuit, some quantum bits need to be reused, so some quantum bits need to be reset to 0. In order to clear the output bits of the S-box, the present invention designs an AES inverse S-box quantum circuit, and the inverse S-box is now expressed as follows:

[0081] S -1 (x) = B'·F'(U'·x)

[0082] in Input is x 0 ,x 1 ,…,x 7 , the output is y 0 ,y 1 ,…,y 21 , the calculation process is as follows:

[0083]

[0084] Nonlinear functions The input is y 0 ,y 1 ,…,y 21 , the output is z 0 ,z 1 ,…,z 17 , the calculation process is as follows:

[0085]

[0086] The input of matrix B' is z 0 ,z 1 ,…,z 17 , the output is s 0 ,s 1 ,…,s 7 , the calculation process is as follows:

[0087]

[0088] The circuits corresponding to the above three processes are implemented by Algorithms 4 and 5.

[0089] Algorithm 4 uses 6 auxiliary qubits, 12 Toffoli gates, 3 QAND gates, 114 CNOT gates, and 12 NOT gates, with a T depth of 29 and outputs the intermediate variable t 29 ,t 33 ,t 37 ,t 40 , where U[0]…U[7] is used to store the 8-bit input of the S-box in reverse order, and T[0]…T[5] is used to store temporary variables, specifically:

[0090] Input U[i]=x[7-i](0≤i≤7), T[j]=0(0≤j≤5), and then perform the following calculation:

[0091]

[0092] Output U[0]=y 7 , U[1]=y 5 , U[2]=y 4 , U[3]=y 6 , U[4]=y 1 , U[5]=y 2 , U[6]=y 0 , U[7]=y 3 , T[0] = t 29 , T[1] = t 40 , T[2] = t 33 , T[3] = t 34 , T[4] = t 37 , T[5] = t 35 ;

[0093] Then use the intermediate variables U[0]…U[7], T[0]…T[5] output by Algorithm 4 to calculate Sbox -1 , S[0]…S[7] are used to save the output.

[0094] Algorithm 5 uses the intermediate variables U[0]…U[7], T[0]…T[5] output by Algorithm 4 as input to calculate Sbox -1 , output S[0]…S[7], specifically:

[0095] Input T[0] = t 29 , T[1] = t 40 , T[2] = t 33 , T[3] = t 34 , T[4] = t 37 , T[5] = t 35 , U[0]=y 7 , U[1]=y 5 , U[2]=y 4 , U[3]=y 6 , U[4]=y 1 , U[5]=y 2 , U[6]=y 0 , U[7]=y 3 , and then calculate as follows:

[0096]

[0097]

[0098] Output S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7].

[0099] The cost of Algorithm 5 is: 6 auxiliary qubits, 30 Toffoli gates, 17 gates, 3 QAND gates, 229 CNOT gates and 12 NOT gates, and the T depth is 83.

[0100] Therefore, the total cost of the S-box inverse calculation (denoted as Algorithm III) is: 6 auxiliary qubits, 42 Toffoli gates, 17 gates, 6 QAND gates, 343 CNOT gates and 24 NOT gates, and the T depth is 112.

[0101] AES requires multiple rounds of encryption. On the premise that the row shift of the state matrix is ​​completed in advance, the state value of a column in the i-th round is pushed forward to the i+1th round using the components and their implementation algorithms; then the reversibility of the quantum circuit is used to clear the state value of a column in the i-th round to zero, such as Figure 3 shown.

[0102] like Fig.10 As shown, this embodiment provides a "sawtooth" round state update algorithm, which uses 160 quantum bits to implement the recursion of the AES round state. The round state update algorithm uses 32 auxiliary bits and 128 bits of round state information to complete the update from the first round to the last round; the byte replacement in step A needs to divide the 32 bits into 4 8-bit bytes and complete them separately, while algorithms I and II require a maximum of 6 auxiliary bits. If 32 bits are updated at one time, it means that additional auxiliary bits need to be added. In order not to add additional auxiliary bits, the measures taken by the present invention are to divide the update of these 32 bits into 2 parts, each part updates 16 bits respectively; the first 16 bits use 16 bits of the 32 bits that are originally set to 0 to save the result, and the other 16 bits are used as auxiliary bits. After obtaining the first 16-bit result, the position where the first 16-bit input is saved is first reset to 0; then the second 16-bit result is calculated, and the original first 16-bit input is used as an auxiliary bit (now set to 0). After the calculation is completed, the second 16-bit input is restored. For details, see Figures 5 to 9 .

[0103] In addition to the update between round functions, key expansion operations need to be implemented. In this embodiment, AES key expansion uses the following three basic operations:

[0104] Operation A, RotWord, cyclically shift each byte in a word left by 1 byte;

[0105] Operation B, Rcon, XOR each byte in a word with a constant;

[0106] Operation C, SubWord, passes each byte in a word through the S-box operation.

[0107] Based on the three basic operations, the key expansion algorithm of AES-128 is implemented as follows:

[0108] When i=4, perform the following operations: If i≡0 mod 4, calculate Otherwise calculate

[0109] Let i=i+1, and repeat the above operation until i exceeds 43.

[0110]

[0111] From Algorithm 6, the information required to generate each round of keys for AES-128 is shown in Table 1. 10 rounds of key expansion of AES-128 can be completed using 128 quantum bits.

[0112] Table 1 Information required to generate each round of AES-128 keys

[0113]

[0114]

[0115] Based on the three basic operations, the key expansion algorithm of AES-192 is implemented, specifically:

[0116] When i=6, perform the following operations: If i≡0 mod 6, calculate Otherwise calculate

[0117] Let i=i+1, and repeat the above operation until i exceeds 51.

[0118]

[0119] From Algorithm 7, we can obtain that the information required to generate the key for each round of AES-192 is shown in Table 2. 192 quantum bits can be used to complete 12 rounds of key expansion of AES-192.

[0120] Table 2 Information required to generate each round of AES-192 keys

[0121]

[0122]

[0123] Based on the three basic operations, the key expansion algorithm of AES-256 is implemented, specifically:

[0124] When i=8, perform the following operations: determine whether i≡0 mod 8, if so, calculate Otherwise, determine whether i≡4 mod 8, if so, calculate Otherwise calculate

[0125] Let i=i+1, and repeat the above operation until i exceeds 59.

[0126]

[0127] From Algorithm 8, the information required to generate each round of keys for AES-256 is shown in Table 3. 14 rounds of key expansion of AES-256 can be completed using 256 quantum bits.

[0128] Table 3 Information required to generate each round of AES-256 keys

[0129]

[0130]

[0131] Resource consumption

[0132] The resource consumption of the present invention can be divided into three stages according to the specific conditions of key expansion (taking AES-128 as an example):

[0133] Phase 1: This phase only includes the first round of calculations. Its characteristic is that there are the most 0 bits that can be used as auxiliary bits, a total of 160. For the specific update process, see Figure 5 .

[0134] First, complete the round key addition of the initial input and the initial key. At most, 128 NOT gates are required to XOR W0, W1, W2, and W3 with the input to achieve round key addition and obtain the state value of round 0. Next, complete the byte replacement, row shift, and column confusion of round 0. Among them, byte replacement requires 16 calls to algorithm I, and column confusion requires 277 CNOT gates. Then, use the NOT gate (at most 128) again to restore W0, W1, W2, and W3 to facilitate the subsequent calculation of W4. The third step is to calculate W4. First, perform the RotWord operation on W3, and then execute algorithm I 4 times on this basis to complete the byte replacement, and then use 1 NOT gate to complete the XOR with the constant array, and then use 32 CNOT gates to complete the XOR with W0 to calculate W4. W4 and W1 XOR to get W5, W5 and W2 XOR to get W6, and W6 and W3 XOR to get W7.

[0135] In summary, the cost of completing the first round of calculations is: 128+16×4+128+4×4+1=337 NOT gates; 16×37+4×37=740 Toffoli gates; 16×326+277+4×326+32×4=6925 CNOT gates; 16×11+11×4=220 QAND gates; 16×4+4×4+4×3=92 Door; T depth 72+72=144.

[0136] The second stage: This stage includes the 2nd, 3rd, and 4th rounds of calculation. The characteristic of this stage is that the calculated round keys W7, W11, W15, and W19 need to be saved, and the auxiliary bits are reduced by 32 per round. Let's discuss each round:

[0137] Round 2: There are 128 auxiliary bits. First, call Algorithm I 8 times to complete the byte replacement of half of the state value (bits 256 to 319), and save it on bits 160 to 223. Then call Algorithm III 8 times to clear bits 256 to 319 that have just completed byte replacement, as auxiliary bits for subsequent calculations. At this time, there are still 128 zero bits. Call Algorithm I 8 times again to complete the byte replacement of the other half of the state value (bits 320 to 383), and call Algorithm III 8 times to clear it. After a series of exchange operations, adjust the location where the new state value is saved, and use 277 CNOT gates to complete the column confusion. The subsequent calculation process of W8, W9, W10, and W11 is similar to the first round. See for details. Figure 6 .

[0138] In summary, the cost of completing the second round of calculations is: 16×4+16×24+4×4+1=465 NOT gates; 16×37+16×42+4×37=1412 Toffoli gates; 16×326+16×343+4×326+4×32+277=12413 CNOT gates; 16×11+16×6+11×4=316 QAND gates; 16×4+16×17+4×4=352 Door; T depth 72+112+72+112+72=440.

[0139] Round 3: There are 96 auxiliary bits. First, call Algorithm I 6 times to complete the byte replacement of the 48-bit state value (bits 256 to 303) and save it to bits 192 to 239. Then call Algorithm III 6 times to clear the state values ​​of bits 256 to 303 that have just completed the byte replacement. Call Algorithm I 6 more times to complete the byte replacement of another 48-bit state value (bits 304 to 351), and call Algorithm III 6 times to clear it. Finally, call Algorithm I and Algorithm III 4 more times to complete the byte replacement of all state values. The following operations are the same as those in Round 2. See for details. Figure 7 In terms of overhead, the total number of times the three algorithms are called in the third round of calculation is the same as in the second round, so the number of gates required is the same, and only the T depth is different. This is due to the decrease in parallel computing capability due to the decrease in auxiliary bits (the fourth round of calculation also has a similar situation, which will not be repeated later). The T depth of the third round of calculation is (72+112)×3+72=624.

[0140] Round 4: There are 64 auxiliary bits. From this round onwards, all subsequent calculations need to use the zigzag structure mentioned above to achieve maximum bit reuse, which results in a further increase in circuit depth. Figure 8 The depth of T is (72+112+72+112)×4+72=1544.

[0141] Phase 3: The calculations of the remaining rounds belong to the third phase. At this time, there are only 32 auxiliary bits left, and the circuit depth of this phase is the deepest. At this time, there is no free space to store the new round key value, so it is necessary to call Algorithm II to update based on the old round key. For details, see Fig. 9 , the overhead is as follows: 924×2+4×2+24×2+4×2)×4+1+4×4=465 NOT gates; (42×2+37×2+42×2+37×2)×4+45×4=1444 Toffoli gates; (343+326+343+326)×4+252×4+32×4+277=6765 CNOT gates; (11×2+6×2+11×2+6×2)×4+3×4=284 QAND gates; 94×2+17×2+4×2+17×2)×4+20×4=416 Door; T depth (72+112+72+112)×4+91=1563.

[0142] The resource consumption of AES128 is discussed above. AES192 and AES256 are calculated in a similar way. The overall consumption is summarized as follows:

[0143] NOT Toffoli CNOT QAND <![CDATA[QAND T ]]> T Depth AES128 4522 13640 84754 2872 3644 12130 AES192 5452 16528 98284 3440 4476 15256 AES256 6382 19416 111814 4008 5308 18383

[0144] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. A method for implementing the AES algorithm in a quantum storage-constrained environment, characterized in that: AES single-round encryption includes the following steps: Step A, byte replacement: replace each byte in the state matrix in parallel with an 8-bit S-box; assuming the input byte is b and the output byte is b', the byte replacement is represented by b'=S(b), and its structure is as follows: Step B, row shift: cyclically shift the bytes in the i-th row of the state matrix to the left by i bytes; Step C, column confusion: Multiply each column in the state matrix by an MDS matrix in the finite field to achieve linear transformation: Step D, round key addition: XOR the state value with the previous round key; In step A, the S-box circuit of AES is represented by S(x)=B S ·F S (U S ·x), where U S Convert input x0,x1,…,x7 to output x7,y1,…,y 21 , the calculation process is as follows: Function F S : The input is x7,y1,···,y 21 , the output is z0,z1,···,z 17 , the calculation process is as follows: Matrix B S Input z0,z1,···,z 17 Converted into output s0, s1, ···, s7, the calculation process is as follows: Converting the above calculation process into a quantum algorithm requires considering the following two cases: The first is when the output bit is 0, that is, |x>|0 a >→|x>|S(x)>|0 a-8 >; The second is when the output bit is not 0, that is, |x>|b>|0 a-8 >→|x>|S(x)⊕b>|0 a-8 > For the first case, that is, the output qubit of the S-box is initially 0, we first use Algorithm 1 to calculate the intermediate variable t 29 ,t 33 ,t 37 ,t 40 , specifically: Input U[i]=x[i], 0≤i≤7, T[j]=0, ​​0≤j≤5, U[i] is used to store the 8-bit input of the S-box, T[j] is used to store temporary variables, and then the following calculation is performed: Then output U[0]=y 19 ,U[1]=y4,U[2]=y2,U[3]=y5,U[4]=y 14 ,U[5]=y6,U[6]=y 21 ,U[7]=x7,T[0]=t 24 ,T[1]=t 37 ,T[2]=t 29 ,T[3]=t 40 ,T[4]=t 27 ,T[5]=t 33 ; The values ​​stored in U[0]…U[7], T[0]…T[5] in Algorithm 1 are passed to Algorithm 2 to calculate the output of the S-box; Then, Algorithm 2 uses the intermediate value output by Algorithm 1 to calculate the output of the S-box, specifically: Input T[0] = t 29 ,T[1]=t 37 ,T[2]=t 40 ,T[3]=t 33 ,T[4]=t 24 ,T[5]=t 27 ,U[0]=y5,U[1]=y 19 ,U[2]=y 14 ,U[3]=y2,U[4]=y6,U[5]=y 21 ,U[6]=y4,U[7]=x7, where U[0]…U[7],T[0]…T[5] store the output of Algorithm 1, and then perform the following calculation: Then output S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], where S[0]…S[7] stores the output of the S-box; The overall cost of the algorithm in the first case, namely Algorithm I, is: 6 auxiliary qubits, 37 Toffoli gates, 326 CNOT gates and 4 NOT gates, 11 QAND gates, 4 Door, T depth is 72; For the second case, in the S-box calculation in the key expansion phase, if there are no new empty bits available, the output quantum bits can only use the bits used in the previous calculation. These bits are not guaranteed to be 0 initially. At this time, the linear relationship between different bits cannot be used to generate the final output bits. Therefore, the quantum algorithm is adjusted as follows: Algorithm 3 uses the outputs U[0]…U[7], T[0]…T[5] of Algorithm 1 as input, and the output S[0]…s[7] is the result of the S-box, which is: Input T[0] = t 29 ,T[1]=t 37 ,T[2, =t 40 ,T[3]=t 33 ,T[4]=t 24 ,T[5]=t 27 ,U[0]=y5,U[1]=y 19 ,U[2]=y 14 ,U[3]=y2,U[4]=y6,U[5]=y 21 ,U[6]=y4,U[7]=x7, and then perform the following calculations: Then output S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7]; The overall cost of the algorithm in the second case, namely Algorithm II, is: 6 auxiliary qubits, 45 Toffoli gates, 3 QAND gates, 20 gates, 252 CNOT gates and 4 NOT gates, with a T depth of 91; The step B only exchanges the order of 16 bytes in the AES state matrix, which is completed by a transposition operation, and the cost of the transposition operation is negligible, so step B can be completed without additional quantum implementation cost; the column confusion in the step C is completed by left multiplication of a 32×32 matrix, and a circuit with 277 CNOT gates and a CNOT gate depth of 39 is obtained through LUP decomposition; the step D is used to complete the XOR operation between the state value and the round key, which is completed in parallel through 128 CNOT gates, requires 256 quantum bits, and the CNOT gate depth is 1.

2. The method for implementing the AES algorithm in a quantum storage-limited environment according to claim 1, characterized in that: The four steps of AES single-round encryption are encapsulated into a component that operates on 1 column and 4 bytes each time. The component completes the three operations of byte replacement, column obfuscation, and round key addition, while step B completes the row transformation operation of 1 row and 4 bytes. Therefore, step B is moved outside the component for completion; In order to reduce the number of quantum bits in the circuit, some quantum bits need to be reused, so some quantum bits are reset to 0; in order to clear the output bits of the S-box, the AES inverse S-box quantum circuit is designed. The inverse S-box is now expressed in the following form: S -1 (x)=B'·F'(U'·x) in The input is x0,x1,…,x7, and the output is y0,y1,…,y 21 , the calculation process is as follows: Nonlinear function F': The input is y0,y1,…,y 21 , the output is z0,z1,…,z 17 , the calculation process is as follows: The input of matrix B' is z0,z1,…,z 17 , the output is s0, s1, ..., s7, and the calculation process is as follows: The circuits corresponding to the above three processes are implemented by Algorithms 4 and 5; Algorithm 4 uses 6 auxiliary qubits, 12 Toffoli gates, 3 QAND gates, 114 CNOT gates and 12 NOT gates, T depth is 29, and outputs the intermediate variable t 29 ,t 33 ,t 37 ,t 40 , where U[0]…U[7] is used to store the 8-bit input of the S-box in reverse order, and T[0]…T[5] is used to store temporary variables, specifically: Input U[i]=x[7-i](0≤i≤7),T[j]=0(0≤j≤5), and then perform the following calculation: Output U[0]=y7, U[1]=y5, U[2]=y4, U[3]=y6, U[4]=y1, U[5]=y2, U[6]=y0, U[7]=y3, T[0]=t 29 , T[1]=t 40 , T[2]=t 33 , T[3]=t 34 , T[4]=t 37 , T[5]=t 35 ; Then use the intermediate variables U[0]…U[7], T[0]…T[5] output by Algorithm 4 to calculate Sbox -1 , S[0]…S[7] are used to save the output; Algorithm 5 uses the intermediate variables U[0]…U[7], T[0]…T[5] output by Algorithm 4 as input to calculate Sbox -1 , output S[0]…S[7], specifically: Input T[0] = t 29 ,T[1]=t 40 ,T[2]=t 33 ,T[3]=t 34 ,T[4]=t 37 ,T[5]=t 35 ,U[0]=y7,U[1]=y5,U[2]=y4,U[3]=y6,U[4]=y1,U[5]=y2,U[6]=y0,U[7]=y3, and then perform the following calculation: Output S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7]; Therefore, the total cost of the S-box inverse calculation is: 6 auxiliary qubits, 42 Toffoli gates, 17 gates, 6 QAND gates, 343 CNOT gates and 24 NOT gates, and the T depth is 112.

3. The method for implementing the AES algorithm in a quantum storage-limited environment according to claim 2, characterized in that: Perform multiple rounds of encryption on AES; on the premise of completing the row shift of the state matrix in advance, use the component and its implementation algorithm to push forward from a column of the state value of the i-th round to the i+1-th round; Then, using the reversibility of quantum circuits, the state values ​​of a column in the i-th round are cleared to zero.

4. The method for implementing the AES algorithm in a quantum storage-limited environment according to claim 3, characterized in that: Through the round state update algorithm, 160 quantum bits are used to realize the recursion of the AES round state; the round state update algorithm uses 32 auxiliary bits and 128 bits of round state information to complete the update from the first round to the last round; the byte replacement in step A needs to divide the 32 bits into 4 8-bit bytes and complete them separately, while algorithms I and II require at most 6 auxiliary bits. In order not to add additional auxiliary bits, the update of the 32 bits is divided into 2 parts, and each part updates 16 bits respectively; the first 16 bits use 16 bits of the 32 bits that are originally set to 0 to save the result, and the other 16 bits are used as auxiliary bits. After obtaining the first 16-bit result, the position where the first 16-bit input is saved is first reset to 0; then the second 16-bit result is calculated, and the original first 16-bit input is used as an auxiliary bit. After the calculation is completed, the second 16-bit input is restored.

5. The method for implementing the AES algorithm in a quantum storage-limited environment according to claim 4, characterized in that: In addition to the updates between round functions, key expansion operations must also be implemented; AES key expansion uses the following three basic operations: Operation A, RotWord, cyclically shift each byte in a word left by 1 byte; Operation B, Rcon, XOR each byte in a word with a constant; Operation C, SubWord, passes each byte in a word through the S-box operation.

6. The method for implementing the AES algorithm in a quantum storage-limited environment according to claim 5, characterized in that: Based on the three basic operations, the key expansion algorithm of AES-128 is implemented as follows: When i=4, perform the following operations: If i≡0 mod 4, calculate Otherwise calculate Let i=i+1, and repeat the above operation until i exceeds 43.

7. The method for implementing the AES algorithm in a quantum storage-limited environment according to claim 5, characterized in that: Based on the three basic operations, the key expansion algorithm of AES-192 is implemented, specifically: When i=6, perform the following operations: If i≡0 mod 6, calculate Otherwise calculate Let i=i+1, and repeat the above operation until i exceeds 51.

8. The method for implementing the AES algorithm in a quantum storage-limited environment according to claim 5, characterized in that: Based on the three basic operations, the key expansion algorithm of AES-256 is implemented as follows: When i=8, perform the following operations: determine whether i≡0 mod 8, if so, calculate Otherwise, determine whether i≡4 mod 8, if so, calculate Otherwise calculate Let i=i+1, and repeat the above operation until i exceeds 59.

Images