An optimization method for reversible quantum circuits of SPECK symmetric cryptography

Abstract

The invention discloses an optimization method for a reversible quantum circuit of a SPECK symmetric cipher, comprising: constructing a SPECK algorithm quantum encryption circuit based on a SPECK algorithm key expansion function and a round encryption function; obtaining a SPECK algorithm quantum decryption circuit based on the SPECK algorithm quantum encryption circuit; constructing an Oracle quantum circuit for searching a SPECK key using a Grover algorithm based on the SPECK algorithm quantum encryption circuit and the SPECK algorithm quantum decryption circuit; optimizing the Oracle quantum circuit for searching a SPECK key using the Grover algorithm, comprising: n Optimization of addition and cyclic shift operations. The circuit optimization scheme provided by the invention reduces the total number of CNOT gates + NOT gates used while maintaining the same number of Toffoli gates, and the invention also uses one less quantum bit.

Description

Technical Field

[0001] The invention relates to the technical field of quantum circuit optimization, and in particular to an optimization method for a reversible quantum circuit of a SPECK symmetric cryptography. Background Art

[0002] The SPECK block cipher algorithm is a lightweight block cipher algorithm proposed by Ray Beaulieu et al. in 2013. The algorithm consists of simple basic operations. The block length of the SPECK lightweight block cipher is 32, 48, 64, 96 or 128 bits, and the key length is 64, 72, 96, 128, 144, 192 or 256 bits, that is, the block length and key length are not fixed. Therefore, the SPECK series of block cipher algorithms can select the appropriate block length and key length according to specific security requirements, performance requirements, application environment, etc., which has strong flexibility and a wide range of application prospects.

[0003] Grover proposed a typical quantum search algorithm in 1996. After continuous improvement and optimization, the current algorithm system can solve various search problems more perfectly, efficiently and extensively. In cryptography, the Grover algorithm can be used for key search, and the complexity of searching for keys by this quantum algorithm is significantly better than the corresponding classical complexity. In recent years, scholars have evaluated many types of symmetric encryption algorithm models in a quantum environment, and the specific circuit implementation and optimization design of quantum attacks have also attracted much attention. For lightweight cryptographic algorithms such as SPECK, there are few studies on related quantum attacks.

[0004] Since the SPECK series of algorithms were proposed, many researchers of block cipher algorithms have analyzed their security, mainly in the areas of differential analysis, linear analysis, and zero-correlation linear analysis. Typical analysis methods mainly include boomerang attack, rectangle attack, differential analysis, and improved differential attack.

[0005] In 2020, Jang K and Choi S et al. [Jang, K., Choi, S., Kwon, H., Seo, H.: Grover on SPECK: quantum resource estimates. Cryptology ePrint Archive, Report 2020 / 640.] analyzed the application of Grover algorithm on SPECK block cipher, including the modulo 2 n For addition, they used a ripple carry addition circuit, referring to the approach of Cuccaro et al., which requires (2n-2) Toffoli gates, (5n-4) CNOT gates, (2n-4) NOT gates, and an auxiliary bit. However, the required quantum resources need to be reduced. Summary of the invention

[0006] Aiming at the problem that quantum resources still need to be reduced in the application of the existing Grover algorithm on the SPECK block cipher, the present invention proposes an optimization method for a reversible quantum circuit of the SPECK symmetric cipher.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] A method for optimizing a reversible quantum circuit for SPECK symmetric cryptography, comprising:

[0009] Step 1: Based on the SPECK algorithm key expansion function and the SPECK algorithm round encryption function, construct the SPECK algorithm quantum encryption circuit;

[0010] Step 2: Obtain the SPECK algorithm quantum decryption circuit based on the SPECK algorithm quantum encryption circuit;

[0011] Step 3: Based on the SPECK algorithm quantum encryption circuit and the SPECK algorithm quantum decryption circuit, build the Grover algorithm to search for the SPECK key Oracle quantum circuit;

[0012] Step 4: Optimize the Oracle quantum circuit for searching the SPECK key using the Grover algorithm, including the optimization of modulo 2n addition and cyclic shift operations.

[0013] Furthermore, the SPECK algorithm key expansion function in step 1 is:

[0014]

[0015] Among them l i Indicates the array needed to generate the secret key for round i, k i represents the secret key of the i-th wheel, and Tian represents the modulo 2n addition. Indicates bitwise exclusive OR, S -α Indicates that the input vector is shifted right by α bits according to binary cycle, S β It means to shift the input vector left by β bits in binary cycle.

[0016] Furthermore, in step 1, the SPECK algorithm round encryption function is:

[0017]

[0018] Where R i Indicates the high-order grouping of the i-th round input, L i Indicates the low-order group of the i-th round input, k i represents the secret key of the i-th wheel, and Tian represents modulo 2n addition, Indicates bitwise exclusive OR, S -α Indicates that the input vector is shifted right by α bits according to binary cycle, S β It means to shift the input vector left by β bits in binary cycle.

[0019] Furthermore, in step 4, module 2 n The optimization of addition includes reducing the number of auxiliary quantum bits and lowering the T-gate depth.

[0020] Furthermore, the number of auxiliary qubits is reduced as follows:

[0021] From the second bit to the nth bit of the two addends a and b, the value in register a is XORed with the value in register b, and the result is stored in register b;

[0022] From the nth bit to the second bit of register a, each bit is XORed with the higher bit, and the result is stored in the higher bit register;

[0023] From the first bit to the nth bit of the two addends, the original bits of a and b are the inputs of the Toffoli gate, and the output acts on the high bit register of a;

[0024] From the nth bit to the second bit of register a, the value in register a is XORed with the value in register b, and the result is stored in register b. The lower 1 bits of a and b are the input of the Toffoli gate, and the output acts on the original bit of a.

[0025] From the 2nd bit to the n-1th bit of register a, the value in register a is XORed with the value in register b, and the result is stored in register b. The lower 1 bits of a and b are the input of the Toffoli gate, and the output acts on the original bit of a.

[0026] From the 1st bit to the nth bit of register a, the value in register a is XORed with the value in register b, and the result is stored in register b. The lower bit of a and b is the input of the Toffoli gate, and the output acts on the original bit of a.

[0027] Further, the T-gate depth is reduced as follows:

[0028] Construct a functional gate that ANDs two input qubits. A two-qubit AND gate requires two auxiliary qubits, one of which stores the result of ANDing the two control inputs, and the other auxiliary bit quantum is used to eliminate the influence of the AND gate on the input bit.

[0029] The constructed AND gate is applied to the adder: first, the two n-bit addends a and b are ANDed in order from low to high, and the results of the AND operation are stored in n auxiliary qubits. Then, the AND operation result is used to perform an XOR operation on the high bits of a and b. Finally, the effect of the AND operation is undone in order from high to low through an observation operation, and the resulting addition value is stored in the register of b.

[0030] Further, the optimization of the cyclic shift operation includes:

[0031] Before the quantum operation, the corresponding quantum index is pre-calculated using classical methods, and the encrypted offset of this round is stored in a classical register. Later, when using quantum bits for calculation, the corresponding offset is added to the array index.

[0032] Furthermore, after step 4, the method further includes:

[0033] Quantum resource analysis of Grover's algorithm for finding SPECK keys using multiple additions.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] Compared with the method of Jang K and Choi S et al., the circuit optimization scheme provided by the present invention reduces the total number of CNOT gates + NOT gates while keeping the number of Toffoli gates the same, and the present invention also uses one less quantum bit. Finally, the quantum resource analysis results of using multiple additions to implement the Grover algorithm to find the SPECK key are also given. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A basic flow chart of an optimization method for a reversible quantum circuit for SPECK symmetric cryptography according to an embodiment of the present invention;

[0037] Figure 2 The quantum circuit of the SPECK key expansion algorithm when m=2 in the embodiment of the present invention;

[0038] Figure 3 The quantum circuit of the SPECK key expansion algorithm when m=3 in the embodiment of the present invention;

[0039] Figure 4 The quantum circuit of the SPECK key expansion algorithm when m=4 in the embodiment of the present invention;

[0040] Figure 5 A quantum circuit for a round of SPECK encryption in an embodiment of the present invention;

[0041] Figure 6 It is the quantum circuit of the SPECK algorithm of the embodiment of the present invention;

[0042] Figure 7 An Oracle quantum circuit for searching the SPECK key using the Grover algorithm according to an embodiment of the present invention;

[0043] Figure 8 A schematic diagram of a Grover algorithm search according to an embodiment of the present invention;

[0044] Fig. 9 The result of running Grover to search for the SPECK key in the embodiment of the present invention;

[0045] Fig.10 It is a 5-qubits quantum traveling wave carry addition circuit according to an embodiment of the present invention;

[0046] Fig.11 The implementation and cancellation of the quantum AND gate of the embodiment of the present invention;

[0047] Fig.12 This is a 5-qbits quantum traveling-wave carry addition circuit (T gate number optimization) according to an embodiment of the present invention;

[0048] Fig.13 The number of T gates required for the five addition circuits in the embodiment of the present invention varies with the number of addition bits n;

[0049] Fig.14 The number of Clifford gates required for the five addition circuits in the embodiment of the present invention varies with the number of addition bits n;

[0050] Fig.15 The T gate depths of five addition circuits in the embodiment of the present invention vary with the number of addition bits n;

[0051] Fig.16 The total depth of five addition circuits in the embodiment of the present invention varies with the number of addition bits n;

[0052] Fig.17 The embodiment of the present invention utilizes a swap operation constructed using three CNOT gates;

[0053] Fig.18 This is the 4-qbits cyclic left shift / right shift circuit of the embodiment of the present invention;

[0054] Fig.19 The embodiment of the present invention optimizes the cyclic shift part code by calculating the index. DETAILED DESCRIPTION

[0055] For ease of understanding, some of the terms that appear in the specific embodiments of the present invention are explained as follows:

[0056] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0057] The present invention provides an optimization scheme for modulo 2n addition and cyclic shift operations in a SPECK reversible quantum circuit, and analyzes the quantum resources required after optimization, such as the number of quantum bits, the number of Clifford gates, the number of T gates, the T gate depth, and the overall circuit depth required for the quantum circuit.

[0058] like Figure 1 As shown, a method for optimizing a reversible quantum circuit for SPECK symmetric cryptography includes:

[0059] Step 1: Based on the SPECK algorithm key expansion function and the SPECK algorithm round encryption function, construct the SPECK algorithm quantum encryption circuit;

[0060] Step 2: Obtain the SPECK algorithm quantum decryption circuit based on the SPECK algorithm quantum encryption circuit;

[0061] Step 3: Based on the SPECK algorithm quantum encryption circuit and the SPECK algorithm quantum decryption circuit, build the Grover algorithm to search for the SPECK key Oracle quantum circuit;

[0062] Step 4: Optimize the Oracle quantum circuit for searching the SPECK key using the Grover algorithm, including the modulo 2 n Optimization of addition and circular shift operations.

[0063] Specifically include:

[0064] 1. SPECK quantum key search process

[0065] This section will introduce the complete process of quantum circuit implementation of SPECK algorithm, which mainly includes two modules: key expansion and round update. The quantum operations required are: modulo 2 n Addition, circular shift, bitwise XOR, etc. The following describes the construction steps of the Oracle circuit applied to the SPECK key by Grover search, and explains the process of experimental verification.

[0066] 1.1 Explanation of symbols

[0067] Table 1 lists some basic quantum gates that will be used in building quantum circuits later.

[0068] Table 1 Functions and graphical representations of some basic quantum gates

[0069]

[0070] Among them, S α Operation, when α is a positive integer, it means that the input vector is shifted left by α bits in binary cycle; then S -αIn the formula, -α is a negative integer, which means that the input vector is shifted right by α bits in binary cycle.

[0071] rc i The operation is to convert i into binary expression and then XOR it with the corresponding qubit. In the implementation process, if a bit in the binary representation of i is 1, it is necessary to invert the corresponding bit of the quantum circuit by using the X gate to achieve the XOR effect. For example, when n=4 and i=5, the binary representation of i is 0101, so it is necessary to use an X gate on a0 and a2 of the input qubits a0~a3 respectively.

[0072] In order to draw the circuit clearly and concisely, the simplified representation of some quantum modules is listed in Table 2, where (a) represents the quantum circuit of a round of key expansion, (c) represents the quantum circuit of a round of SPECK encryption, (c) and (d) represent the encryption and decryption circuits of the complete SPECK algorithm, and these modules will be introduced and used in turn. i Indicates the high-order grouping of the i-th round input, L i Represents the low-order grouping of the i-th round input.

[0073] Table 2 Simplified representation of quantum circuit module

[0074]

[0075] 1.2 Key expansion quantum circuit

[0076] The algorithm of the SPECK algorithm key expansion function is as follows:

[0077]

[0078] Among them l i Indicates the array needed to generate the secret key for round i, k i represents the secret key of the i-th wheel, and Tian represents modulo 2 n addition, Represents bitwise exclusive OR.

[0079] Figure 2 , Figure 3 , Figure 4 The quantum circuits implementing part of the key expansion function of the SPECK algorithm when m=2, 3, and 4 are shown respectively.

[0080] 1.3-round encrypted quantum circuit

[0081] The specific algorithm of the SPECK algorithm round encryption function is:

[0082]

[0083] Figure 5This is the implementation of the round encryption function in the quantum circuit, where the KE module represents the quantum circuit of a round of key expansion.

[0084] 1.4 Complete SPECK algorithm quantum circuit

[0085] Using the key expansion function and round encryption function constructed above, we can give the complete SPECK algorithm quantum encryption circuit. Figure 6 , where the U module represents a round of encryption function circuit, and the KE module represents a round of key expansion quantum circuit.

[0086] You can Figure 6 The complete SPECK quantum encryption circuit is represented as the ENC encryption function. The inverse function of this function is to perform the inverse operations of all operations in the function in a backward order. This function is represented as DEC, and its function is the inverse process of encryption, that is, the decryption process. See (c) and (d) in Table 2 for examples.

[0087] 1.5 Oracle quantum circuit of Grover algorithm

[0088] Assuming that we have known plaintext attack conditions, in the process of brute force key enumeration, the key obtained by a set of plaintext and ciphertext pairs may not be unique. In order to combine multiple sets of name-ciphertext pairs to obtain a unique key, we need to construct an Oracle circuit that can encrypt multiple sets of plaintexts under the same key. Only after all plaintexts are encrypted, the corresponding ciphertexts are obtained, and the output is |+>. Figure 7 shown.

[0089] 1.6 Grover search for quantum circuits

[0090] The Grover algorithm consists of two parts: Oracle and inversion symmetry. The Oracle quantum circuit implementation of SPECK key search has been introduced in detail above. This paper uses two functions in the Our_Qiskit_Functions library to implement the Grover algorithm. The Grover_Oracle() function is used to compare whether the state of the input quantum circuit and the target vector |ω> is consistent. If they are consistent, the phase of the vector is inverted. The corresponding operator is U ω ; The Grover_Diffusion() function is used to transform the superposition state vector about the initial superposition state Symmetric, the corresponding operator is U s =2|s> <s|-1。

[0091] Using Oracle once can mark the phase of the correct key by negating it, and then amplify the probability of the correct key by reversing the initial superposition state. The process is as follows Figure 8After multiple iterations of the Oracle search process, the probability of the correct key is much greater than the probability of the wrong key. After that, the correct key can be obtained through observation, realizing the complete process of Grover search.

[0092] During the experimental verification process, the Grover search for the SPECK key quantum circuit is run. When the encryption key K = [0, 1, 0, 0, 1, 1] is input, the plaintext M = [0, 0, 0, 0, 1, 1] is randomly generated. After encryption using the classical method, the ciphertext C = [1, 0, 0, 1, 0, 1] is obtained.

[0093] Take the plaintext-ciphertext pair (M, C) as the input of Grover search and get the correct key after running it. The result is as follows Fig. 9 shown.

[0094] 2. Addition circuit optimization

[0095] 2.1 Wave Carry Adder - Optimization 1: Reducing the number of auxiliary qubits

[0096] In a quantum circuit, |a>=|a0a1…a n-1 > and |b> = |b0b1…b n-1 >stores two addends respectively. The initial state of |z> is ​​|0>, which is used to store the carry generated by the highest bit. This method will store the final calculated addition result in |b>. Fig.10 A traveling-wave carry addition circuit for 5 qubits is given.

[0097] (1) Steps and state transitions

[0098] The first step is to XOR the value in register a with the value in register b from the second to the nth bit of the two addends, and store the result in register b; the second step is to XOR each bit with the higher bit from the nth to the second bit of a, and store the result in the higher bit register; the third step is to XOR the bits of a and b as the input of the Toffoli gate from the first to the nth bit of the two addends, and the output acts on the higher bit register of a; the fourth step is to XOR the value in register a with the value in register b from the nth to the second bit of register a, and store the result in register b, and the lower bit of a and b is the output of the Toffoli gate Input, the output acts on the original position of a; the fifth step, from the 2nd bit of register a to the n-1th bit, use the value in register a and the value in register b to perform XOR, and the result is stored in register b. The lower 1 bit of a and b is the input of the Toffoli gate, and the output acts on the original position of a; the sixth step, from the 1st bit of register a to the nth bit, use the value in register a and the value in register b to perform XOR, and the result is stored in register b. The lower 1 bit of a and b is the input of the Toffoli gate, and the output acts on the original position of a. It is expressed in pseudocode as follows, and the status of the values ​​in the registers after each step is also listed here.

[0099]

[0100] Quantum resource analysis

[0101] The quantum resources required for the above addition are analyzed. Each row in Table 3 lists the quantum resources required for each step in the addition process. In combination with the actual research status, a Toffoli gate can be regarded as a quantum gate with 7 T gates, 8 Clifford gates, 4 T gate depth, and a total depth of 8. Table 4 summarizes the total resources required for the complete addition circuit.

[0102] Table 3 Analysis of quantum resources required for each step

[0103]

[0104] Table 4 Total amount of sub-resources required by the algorithm

[0105]

[0106] 2.2 Ripple Carry Adder - Optimization 2: Reducing T Gate Depth

[0107] This patent uses AND gates to construct an addition circuit and analyzes the quantum resources required for such an adder.

[0108] (1) Optimization of AND gate implementation

[0109] In Cody Iones' 2013 work, he introduced a method to achieve one Toffoli gate by using four T gates, which is nearly half the number of seven T gates required by the traditional method. The principle is to cancel the Toffoli gate and no longer use the T gate, but to change it to one observation operation. Although this will increase the observation depth achieved by the Toffoli gate by 1, there have been related literature analyses and conclusions that the cost of one T gate is much greater than the cost of one observation, so this improvement is worthwhile.

[0110] Before the auxiliary bit in the Toffoli gate is cancelled, it actually stores the result xy of the AND of the two control inputs x and y. Therefore, we can refer to some circuits of the Toffoli gate operation mentioned above to realize the function gate of the AND of two input qubits, such as Fig.11 It should be noted that a two-qubit AND gate requires two auxiliary qubits, where z stores the value of x·y and the other auxiliary bit is used to eliminate the effect of the AND gate on the input bit.

[0111] (2) Steps and state transitions

[0112] The constructed AND gate is applied to the adder. The AND_start(a, b, c, d) operation represents storing the result of ANDing a and b in the c quantum bit; d is another auxiliary bit, which is used to cancel the influence of the AND operation on the two quantum bits a and b in the AND_end(a, b, d) function later; anc_and and anc2 represent the storage locations of the two groups of auxiliary quantum bits respectively. Fig.12 An optimized traveling-wave carry addition circuit for 5 qubits using T-gates is given.

[0113] The following introduces the steps and state transitions of the adder (the front is the operation register state, and the back is the auxiliary register state).

[0114] First, the two n-bit addends a and b are placed in order from low to high, so the result of the AND operation is stored in n auxiliary qubits. Then, the AND operation result is used to perform an XOR operation on the high bits of a and b. Finally, the effect of the AND operation is undone once in order from high to low through the observation operation, and the resulting addition value is stored in the register of b.

[0115]

[0116] (3) Quantum resource analysis

[0117] Each group of AND gates includes 1 AND_start gate and 1 AND_end gate, requiring a total of 12.5 Clifford gates and 4 T gates. The T gate depth is 1, and the total depth is 9.5; each AND_end gate increases the measurement depth by 1; in step ②, since the two CNOT gates can be run in parallel, other operations need to be run in series, so the calculation depth is reduced by n-2 layers compared to full serial operation. Table 5 shows the quantum resources required for each step of the addition circuit, and Table 6 shows the total quantum resources.

[0118] Table 5 Analysis of quantum resources required for each step

[0119]

[0120] Table 6 Total amount of sub-resources required by the algorithm

[0121]

[0122] 2.3 Resource comparison with other quantum adders

[0123] By comparing the traveling-wave carry adder (reducing the number of auxiliary quantum bits), the traveling-wave carry adder (reducing the T-gate depth) with the Fourier adder, the carry-lookahead adder, and the hybrid adder, Table 7 summarizes the resources required for these five quantum addition circuits, and Table 8 shows the corresponding order of quantum resource growth.

[0124] Table 7 Resources required to implement various types of adders in quantum circuits

[0125]

[0126] Note: d(n)=Ω(log n), kl≈n,

[0127] Table 8 Analysis of quantum resources required for various adders

[0128]

[0129] The results in Table 7 are visualized as follows: Fig.13 , Fig.14 , Fig.15 , Fig.16 Two comparison graphs are drawn for the consumption of each quantum resource. The left graph is a graph of the quantum resources required for various addition circuits when the number of addition bits n ranges from 2 to 70; the right graph is a graph of the quantum resources required when the number of addition bits n ranges from 2 to 20.

[0130] 3. Circular shift line optimization

[0131] 3.1 Method principle and resource analysis

[0132] In the work of Anand R and Maitra A, they first used three CNOT gates to construct an operation that can exchange the values ​​of two lines, which is recorded as a SWAP module, such as Fig.17 shown.

[0133] On a circuit of n qubits, two adjacent bit values ​​are exchanged. If the exchange is in the order from low to high, the function of cyclic left shift by 1 bit can be realized; if the exchange order is from high to low, the function of cyclic right shift by 1 bit can be realized, such as Fig.18 shown.

[0134] Table 9 analyzes the quantum resources required for cyclic left (right) shift of 1 bit in an n-bit quantum circuit. Since cyclic left shift α times is equivalent to cyclic right shift n-α times, the quantum resources required for cyclic left (right) shift of α bits in this method are min(α, n-α) multiplied by the value of the corresponding item in Table 3.

[0135] Table 9 Total amount of sub-resources required for cyclic left (right) shift by 1 bit

[0136]

[0137] 3.2 Optimization plan

[0138] Before the quantum operation, the corresponding quantum index needs to be pre-calculated using classical methods, and the offset of the encryption round is stored in the classical register, such as Fig.19 The part circled in the rectangle is shown in the figure. When using qubits for calculation, add the corresponding offset to the array index, such as Fig.19 The part marked with a medium grey horizontal line is shown.

[0139] This method saves the quantum resources consumed by the circular shift operation through classical operations, so the optimization effect is obvious. We noticed that the plaintext obtained after encryption using this method has not undergone a real shift operation. Therefore, when comparing whether the encrypted plaintext is the corresponding ciphertext, it is necessary to reverse the circular shift processing of the ciphertext and then compare it with the encryption result.

[0140] 4. Analysis of quantum resources required after optimization

[0141] In the key expansion function, the quantum circuit needs to be XORed according to the initial input, so this part of the NOT gate is not included in the required quantum resources; since the cyclic left and right shifts have been implemented by classical methods, no quantum resources are required, so they are no longer considered; modulo 2 n The implementation of the addition part can refer to the five methods provided above; the two XOR parts are counted into the number of CNOT gates required according to half of the number of bits. The following is an analysis of the quantum resources required for the quantum function circuit according to the above processing method.

[0142] In the round update function, the quantum circuit needs to be XORed according to the input plaintext, which is not included in the required quantum resources; cyclic left and right shifts do not require quantum resources; modulo 2 n The addition part is considered the same as above; the two XOR parts are directly counted into the CNOT gate according to half the value of the bit number.

[0143] For the implementation of some Oracle lines, it is assumed that A known plaintext attack of rounds can obtain the unique correct key. Note that when r is an integer, r+1 rounds of known plaintext attacks are required. In Table 10, 2n represents the block size of the SPECK algorithm, and mn represents the key size of the SPECK encryption.

[0144] Table 10 Parameter settings for SEPCK algorithm implementation

[0145]

[0146] Let the number of rounds required for encryption be t, the number of auxiliary quantum bits required for addition be a(n), the number of quantum gates required for an n-bit addition operation be g(n), and the depth required for an n-bit addition operation be d(n). Then the required quantum resources are:

[0147] Number of qubits = 2nr + mn + a(n)

[0148] Number of quantum gates = g(n)rt+g(n)(t-1)

[0149] Serial depth = d(n)rt + d(n)(t-1)

[0150] Parallel Depth = d(n)t

[0151] It should be noted that the encryption process of different plaintext and ciphertext pairs can be performed in parallel. Figure 7 As shown in the figure, one round of encryption process of r groups of plaintext and ciphertext pairs and one round of round key update process can occur in parallel. Assuming k is the number of parallel encryption processes, k satisfies 0≤k≤r+1. This can reduce the depth of the quantum circuit to (r+2-k) / (r+1) times the original, but it requires a certain price, that is, it is necessary to add a(n)×k auxiliary quantum bits.

[0152] In the process of quantum resource analysis, the table only lists the quantum resources of r groups of plaintext and ciphertext for encryption and key expansion process in completely serial or parallel lines. The resources required for partially parallel quantum lines can be calculated as needed.

[0153] According to the resources required for one round of Oracle quantum circuits in the above table, considering the complete process of SPECK key search, the Oracle circuit needs to run Then, five additions are applied to the total amount of sub-resources required for Grover to search for the SPECK key as follows.

[0154] Table 11 SPECK algorithm Grover using ripple carry addition (qbits optimization) to find the required quantum resources

[0155]

[0156] Table 12 SPECK algorithm Grover using ripple carry addition (T gate optimization) to find the required quantum resources

[0157]

[0158]

[0159] Table 13 SPECK algorithm Grover using Fourier addition to find the required quantum resources

[0160]

[0161] Table 14 SPECK algorithm Grover using carry-lookahead addition to find the required quantum resources

[0162]

[0163]

[0164] Table 15 SPECK algorithm Grover using mixed addition to find the required quantum resources

[0165]

[0166] In summary, compared with the method of Jang K and Choi S et al., the circuit optimization scheme provided by the present invention reduces the total number of CNOT gates + NOT gates while keeping the number of Toffoli gates the same, and the present invention also uses one less quantum bit. Finally, the quantum resource analysis results of using multiple additions to implement the Grover algorithm to find the SPECK key are also given.

[0167] The above is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for optimizing a reversible quantum circuit for SPECK symmetric cryptography, characterized in that: include: Step 1: Based on the SPECK algorithm key expansion function and the SPECK algorithm round encryption function, construct the SPECK algorithm quantum encryption circuit; Step 2: Obtain the SPECK algorithm quantum decryption circuit based on the SPECK algorithm quantum encryption circuit; Step 3: Based on the SPECK algorithm quantum encryption circuit and the SPECK algorithm quantum decryption circuit, build the Grover algorithm to search for the SPECK key Oracle quantum circuit; Step 4: Optimize the Oracle quantum circuit for searching the SPECK key using the Grover algorithm, including the modulo 2 n Optimization of addition and circular shift operations; In step 4, module 2 n The optimization of addition includes reducing the number of auxiliary qubits and lowering the T-gate depth; Reduce the number of auxiliary qubits as follows: From the second bit to the nth bit of the two addends a and b, the value in register a is XORed with the value in register b, and the result is stored in register b; From the nth bit to the second bit of register a, each bit is XORed with the higher bit, and the result is stored in the higher bit register; From the first bit to the nth bit of the two addends, the original bits of a and b are the inputs of the Toffoli gate, and the output acts on the high bit register of a; From the nth bit to the second bit of register a, the value in register a is XORed with the value in register b, and the result is stored in register b. The lower 1 bits of a and b are the input of the Toffoli gate, and the output acts on the original bit of a. From the 2nd bit to the n-1th bit of register a, the value in register a is XORed with the value in register b, and the result is stored in register b. The lower 1 bits of a and b are the input of the Toffoli gate, and the output acts on the original bit of a. From the 1st bit to the nth bit of register a, the value in register a is XORed with the value in register b, and the result is stored in register b. The lower bit of a and b is the input of the Toffoli gate, and the output acts on the original bit of a.

2. The method for optimizing a reversible quantum circuit for SPECK symmetric cryptography according to claim 1, characterized in that: The SPECK algorithm key expansion function in step 1 is: Among them l i Indicates the array needed to generate the secret key for round i, k i represents the secret key of the i-th round, Represents modulo 2 n addition, Indicates bitwise exclusive OR, S -α Indicates that the input vector is shifted right by α bits according to binary cycle, S β It means to shift the input vector left by β bits in binary cycle.

3. The method for optimizing a reversible quantum circuit for SPECK symmetric cryptography according to claim 1, characterized in that: In step 1, the SPECK algorithm round encryption function is: Where R i Indicates the high-order grouping of the i-th round input, L i Indicates the low-order group of the i-th round input, k i represents the secret key of the i-th round, Represents modulo 2 n addition, Indicates bitwise exclusive OR, S -α Indicates that the input vector is shifted right by α bits according to binary cycle, S β It means to shift the input vector left by β bits in binary cycle.

4. The method for optimizing a reversible quantum circuit for SPECK symmetric cryptography according to claim 1, characterized in that: Reduce the T-gate depth as follows: Construct a functional gate that ANDs two input qubits. A two-qubit AND gate requires two auxiliary qubits, one of which stores the result of ANDing the two control inputs, and the other auxiliary bit quantum is used to eliminate the influence of the AND gate on the input bit. The constructed AND gate is applied to the adder: first, the two n-bit addends a and b are ANDed in order from low to high, and the results of the AND operation are stored in n auxiliary qubits. Then, the AND operation result is used to perform an XOR operation on the high bits of a and b. Finally, the effect of the AND operation is undone in order from high to low through an observation operation, and the resulting addition value is stored in the register of b.

5. The method for optimizing a reversible quantum circuit for SPECK symmetric cryptography according to claim 1, characterized in that: The optimization of the cyclic shift operation includes: Before the quantum operation, the corresponding quantum index is pre-calculated using classical methods, and the encrypted offset of this round is stored in a classical register. Later, when using quantum bits for calculation, the corresponding offset is added to the array index.

6. The method for optimizing a reversible quantum circuit for SPECK symmetric cryptography according to claim 1, characterized in that: After step 4, the method further includes: Quantum resource analysis of Grover's algorithm for finding SPECK keys using multiple additions.

Images