Quantum optimization implementation circuit of SM3 algorithm under low-width condition

Abstract

This invention relates to a quantum-optimized implementation circuit of the SM3 algorithm under low-width conditions, specifically including a circuit generated using a heuristic algorithm based on matrix factorization theory. in-place The linear sub-components of the structure are described, and the constant-modulus adder quantum circuit of the iterative compression part of the algorithm is optimized for low width, thus proposing a quantum circuit implementation scheme that effectively reduces the number of qubits. In the quantum implementation circuit of the SM3 algorithm of the present invention, the message expansion part does not need to reference additional auxiliary bits, and the iterative compression part utilizes dirty bits and therefore does not reference auxiliary bits. Therefore, the quantum optimization implementation scheme of the SM3 algorithm under low width conditions proposed in the present invention effectively reduces the width and implementation cost of the quantum implementation circuit of the SM3 algorithm, and its width of 768 is the smallest known value.

Description

Technical Field

[0001] This invention relates to a quantum-optimized implementation of the SM3 algorithm, specifically a quantum-optimized implementation circuit of the SM3 algorithm under low-width conditions. Background Technology

[0002] The parallelism of quantum computing endows quantum computers with the ability to process multiple pieces of information simultaneously, making them more efficient than classical computers in solving certain problems. However, this characteristic also poses a significant challenge to the security of classical cryptographic algorithms. Therefore, in-depth research on the quantum implementation of classical cryptographic algorithms is particularly important, as it helps to more comprehensively understand and evaluate the quantum-resistant security of these algorithms. The SM3 algorithm is a hash algorithm independently designed in my country and published in 2010. Its process is as follows: Figure 1 As shown, this algorithm is mainly used for digital signatures and message verification in commercial cryptography systems.

[0003] The National Institute of Standards and Technology (NIST) has developed a series of security levels for quantum cryptography algorithms based on the security strengths of AES and SHA3, in order to provide a clear security benchmark for post-quantum cryptography algorithms in new cryptographic standards. The security levels established by NIST are related to the quantum resources consumed by a brute-force attack on the algorithm, with these quantum resources primarily consumed in the quantum implementation of the encryption algorithm.

[0004] Implementing classical cryptographic algorithms with fewer quantum resources is a hot research topic today. The depth of quantum circuits, the number of quantum gates consumed, and the number of qubits are important indicators for evaluating quantum resources. Since the development of quantum computers is still immature and the number of qubits they can carry is limited, optimizing the circuit width (i.e., the number of qubits consumed) of quantum implementations of encryption algorithms is crucial. Therefore, implementing classical cryptographic algorithms with fewer qubits has always been a goal in researching the quantum optimization of classical cryptographic algorithms. Summary of the Invention

[0005] The technical problem to be solved by this invention is mainly aimed at the above-mentioned research objectives. It provides a low-width quantum optimization implementation scheme for the SM3 algorithm. This scheme reduces the number of auxiliary bits consumed in the constant modulus addition of the algorithm's iterative compression part, thereby reducing the overall quantum bit consumption of the circuit, and ultimately achieving a quantum optimization implementation of the SM3 algorithm with the aim of optimizing the circuit width.

[0006] To solve the above technical problems, the present invention adopts the following technical solution: S1. Design the linear transformation in the linear part. , The quantum implementation scheme is proposed, and the quantum circuit implementation of the message extension part is designed. S1.1, Based on the linear transformation in message expansion corresponding binary matrix generation of in-place Quantum realization; S1.2, Based on the linear transformation in iterative compression corresponding binary matrix generation of in-place Quantum realization; S1.3, Design and implement quantum circuits for the message extension part based on the message extension law;

[0007] S2. Design quantum implementation schemes for FF and GG in the nonlinear part, and design quantum implementation of constant modulus adder; S2.1, Design of FF and GG based on NCT gate set in-place Quantum realization; S2.2, Quantum implementation of constant modulus adders; S2.2.1 Calculate the highest carry when adding two binary numbers using dirty bits; S2.2.2 Implement the "+1" operation using a quantum incrementer; S2.2.3. Implement constant modulo addition operation using dirty bits without consuming auxiliary bits.

[0008] S3. Integrating linear and nonlinear components, a comprehensive quantum optimization implementation scheme for the SM3 algorithm is designed with low bandwidth as the goal.

[0009] The beneficial effects of this invention are as follows: It provides a low-width quantum optimization implementation scheme for the SM3 algorithm. This scheme reduces the number of auxiliary bits consumed in the constant modulus addition of the algorithm's iterative compression part, thereby reducing the overall quantum bit consumption of the circuit, and ultimately achieving a quantum optimization implementation of the SM3 algorithm with the aim of optimizing the circuit width.

[0010] The present invention will now be described in detail with reference to the accompanying drawings and examples. Attached Figure Description

[0011] Figure 1 SM3 algorithm flowchart Figure 2 Quantum implementation circuit diagram for the message extension part Figure 3 Circuit diagram of a quantum incrementer Figure 4 Quantum implementation circuit diagram of the CARRY module Figure 5 Quantum implementation circuit diagram of a constant modulus adder Figure 6 Quantum implementation circuit diagram of the ADD2 module Figure 7 Circuit diagram for low-width quantum implementation of the SM3 algorithm Detailed Implementation

[0012] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0013] like Figure 1 The flowchart shown is of the SM3 algorithm. The quantum implementation involved in this invention mainly includes the message expansion part and the iterative compression part of the algorithm.

[0014] The method for obtaining the quantum-optimized implementation circuit of the present invention is to design the linear transformation in the linear part. , The quantum implementation scheme of the SM3 algorithm is designed, including the quantum circuit implementation of the message extension part; the quantum implementation schemes of FF and GG in the nonlinear part are designed, and the quantum implementations of the modulus adder and the constant modulus adder are designed; the overall quantum-optimized implementation scheme of the SM3 algorithm is designed with low bandwidth by integrating linear and nonlinear components. The specific steps are as follows: S1. Design the linear transformation in the linear part. , The quantum implementation scheme is proposed, and the quantum circuit implementation of the message extension part is designed. S1.1, Based on the linear transformation in message expansion corresponding binary matrix generation of in-place Quantum implementation means that operations are performed directly on the existing qubits, without the need for additional qubits to store the results in the circuit structure. In the SM3 algorithm message extension, the linear transformation P0 = X⊕(X<<<9)⊕(X<<<17) is given. X This represents a 32-bit binary string; ⊕ is the XOR symbol, 1⊕1=0, 1⊕0=1, 0⊕0=0; X <<< a Represents binary string X Circular left shift a Bits, through this expression can be Represented as a binary matrix as follows: 10000000010000000100000000000000 01000000001000000010000000000000 00100000000100000001000000000000 00010000000010000000100000000000 00001000000001000000010000000000 00000100000000100000001000000000 00000010000000010000000100000000 00000001000000001000000010000000 00000000100000000100000001000000 00000000010000000010000000100000 00000000001000000001000000010000 00000000000100000000100000001000 00000000000010000000010000000100 00000000000001000000001000000010 00000000000000100000000100000001 10000000000000010000000010000000 01000000000000001000000001000000 00100000000000000100000000100000 00010000000000000010000000010000 00001000000000000001000000001000 00000100000000000000100000000100 00000010000000000000010000000010 00000001000000000000001000000001 10000000100000000000000100000000 01000000010000000000000010000000 00100000001000000000000001000000 00010000000100000000000000100000 00001000000010000000000000010000 00000100000001000000000000001000 00000010000000100000000000000100 00000001000000010000000000000010 00000000100000001000000000000001 Let linear transformation The input is ( The output is (). ),in ,and The self-updating XOR implementation can be obtained using a heuristic algorithm based on matrix factorization theory, as shown in Table 1.

[0015] Table 1: Linear Transformation Self-updating implementation of the corresponding matrix

[0016] By leveraging the characteristics of CNOT gates to simulate the classic XOR operation, this implementation can be directly converted to... in-place The structure is implemented using quantum circuits, so operations are performed directly on the existing qubits, without requiring additional qubits to store the circuit structure of the results. This method does not require additional auxiliary bits and only needs 68 CNOT gates to achieve linear transformations. .

[0017] S1.2, Based on the linear transformation in message expansion corresponding binary matrix generation of in-place Quantum realization; Linear Transformation in Message Extension of SM3 Algorithm The expression is X⊕(X<<<15)⊕(X<<<23), which can be used to... Represented as a binary matrix as follows: 1000000000000010000000100000000 0100000000000001000000010000000 0010000000000000100000001000000 0001000000000000010000000100000 00001000000000000001000000010000 00000100000000000000100000001000 00000010000000000000010000000100 00000001000000000000001000000010 00000000100000000000000100000001 10000000010000000000000010000000 01000000001000000000000001000000 00100000000100000000000000100000 00010000000010000000000000010000 00001000000001000000000000001000 00000100000000100000000000000100 00000010000000010000000000000010 00000001000000001000000000000001 10000000100000000100000000000000 01000000010000000010000000000000 00100000001000000001000000000000 00010000000100000000100000000000 00001000000010000000010000000000 00000100000001000000001000000000 00000010000000100000000100000000 00000001000000010000000010000000 00000000100000001000000001000000 00000000010000000100000001000000100000 000000000100000001000000010000 000000000010000000100000001000 000000000001000000010000000100 000000000000100000001000000010 000000000000010000000100000001 Let linear transformation The input is ( The output is (). ) ,in ,and The self-updating XOR implementation can be obtained using a heuristic algorithm based on matrix factorization theory, as shown in Table 2.

[0018] Table 2: Linear Transformation Self-updating implementation of the corresponding matrix

[0019] By leveraging the characteristics of CNOT gates to simulate the classic XOR operation, this implementation can be directly converted to... in-place The quantum circuit implementation of the structure requires only 68 CNOT gates to achieve linear transformations without the need for additional auxiliary bits. .

[0020] S1.3 Implementation of quantum circuit for message extension based on message extension rules.

[0021] Depend on Figure 1 From the formula in the extended part of the message, we can see that... j= 16:00 , j= 5 PM Observations show that The data used in the expression are all This explains the subsequent extended messages. In the calculation, It will no longer participate in the calculation. Therefore, the generated... Save to In this way, no additional qubits are introduced for storage. Furthermore, the newly generated Save to This continues until all messages are expanded. Therefore, the quantum implementation of the message expansion part can be achieved using only 32 × 16 = 512 qubits, as shown in the specific circuit diagram. Figure 2 As shown.

[0022] S2. Design quantum implementation schemes for FF and GG in the nonlinear part, and design quantum implementations of the modulus adder and the constant modulus adder; where FF and GG respectively represent the implementations. FF j (X,Y,Z) and GG j Quantum components with (X,Y,Z) functionality; FF j (X,Y,Z) and GG j (X,Y,Z) represents the first... j During round j, FF and GG output the values ​​of input X, Y, and Z. S2.1, Design of FF and GG based on NCT gate set in-place Quantum realization; The NCT gate set includes Toffoli gates, CNOT gates, and NOT(X) gates. These three gates respectively simulate the AND, OR, and NOT gates in classical circuits. Therefore, their quantum circuit implementation can be designed based on hash expressions. Hash expressions based on FF and GG:

[0023] Where X, Y, and Z are all 32-bit binary strings. FF j (X,Y,Z) and GG j (X,Y,Z) represents the first... j In each round, FF and GG represent the outputs generated by the inputs X, Y, and Z for that round. FF and GG represent the implementation. FF j (X,Y,Z) and GG j The term refers to a collective of quantum components with (X,Y,Z) functions, which can be derived from the above expression. At that time, in a 32-bit quantum circuit, both FF and GG consume 64 CNOT gates; In a 32-bit quantum circuit, a FF consumes 32 Toffoli gates and 32×2=64 CNOT gates, while a GG consumes 32 Toffoli gates and 32 CNOT gates.

[0024] S2.2 Quantum Realization of Constant Modulus Adders Constant modular addition refers to the modular addition of a constant with a variable. Existing quantum implementations of the SM3 algorithm all consume auxiliary bits in the constant modular addition part, with the minimum number of auxiliary bits consumed being 11. This invention utilizes dirty bits to achieve constant modular addition, thus avoiding the consumption of auxiliary bits. The specific process includes using dirty bits to calculate the highest carry of the addition of two binary digits, using a quantum incrementer to perform the "+1" operation, and using dirty bits to perform the constant modular addition operation without consuming auxiliary bits. Here, dirty bits refer to qubits in an unknown state, which must be restored to their initial state after use.

[0025] S2.2.1 Calculate the highest carry when adding a binary constant to a variable using dirty bits. Existing research indicates that the CARRY module can calculate the highest carry when adding a binary constant and a variable (both of the same length) using only one auxiliary bit, which is used to store the carry. The CARRY module performs the following function: ,in express a For length is n binary string, Similarly, express a+c The result of the n Position, and a, c, g These are, respectively, variable binary strings, constant binary strings, and dirty bits. n The value is a positive integer. Replacing the auxiliary bit with a dirty bit improves the CARRY module, thus reducing the consumption of auxiliary bits. The improved CARRY module outputs the XOR of the dirty bit and the highest carry, still storing the carry without consuming auxiliary bits. The improved CARRY module implements the following function: .

[0026] The resource consumption in the CARRY module is related to the number of operands involved in the computation. The Toffoli depth of the module and the number of Toffoli gates consumed are related to its binary length. If the binary length of the operands in the module is... n Then the Tofoli depth and the number of Tofoli gates consumed in this module are both 4. n -6. The number of CNOT gates and X gates in the module is related to the Hamming weight (the number of "1"s in binary) of the constants involved in the calculation. If the Hamming weight of the constants involved in the calculation is denoted as... w Then this module consumes 2 w CNOT gates and 2 w -2 X gates.

[0027] S2.2.2 Implementing the "+1" operation using a quantum incrementer Quantum incrementers can perform the function of incrementing the operand by 1, such as... Figure 3 As shown. Figure 3 middle, x The binary representation of the operand to be incremented by 1. g This indicates a dirty bit that is currently not in use and is borrowed from other locations in the circuit. Figure 3 The input of the medium incrementer is After passing through the quantum modulator, x Become xg ① Output at time ① .then, g After inverting the X gate, the output at time ② is... in, express The bitwise inversion of is such that, since the two's complement of a binary number is equal to its own inversion plus one, the state of the circuit at time ② is... , express The binary complement. Then, it passes through a quantum modulator again to... xg Become xg-(g'-1) Since the two's complement of any number plus the number itself always results in 0, the state of the circuit at time ③ is... .at last, g After being inverted again by the NOT gate, the state of the circuit at time ④ is... At this point, the circuit has completed the operation of incrementing the operand by 1. The control bit in the controlled incrementer determines whether the target bit is incremented by 1. When the control bit is "1", the target bit is incremented by 1; otherwise, the target bit remains unchanged.

[0028] The resource consumption of quantum incrementers and controlled incrementers is related to the length of the binary representation of the operands. Let the length of the operands be... n The controlled incrementer consumes 2 n -3 Tofoli gates, 5 n -7 CNOT gates, 2 n +1 X gate, the Toffoli depth of the circuit is 2. n -3.

[0029] S2.2.3 Utilize dirty bits to implement constant modulo addition without consuming auxiliary bits.

[0030] Combining the CARRY module and the controlled incrementer can achieve a constant modulus addition submodule that does not consume auxiliary bits and only borrows dirty bits, as shown in the structure. Figure 4 As shown. x L and x H Representing variables respectively x low n / 2 bits and high n / 2 bits, where at this timen binary string x The length, and n For positive integers, the same applies. c L and c H Represent constants respectively c low n / 2 bits and high n / 2 bits, at this time n binary string c The length, and n It is a positive integer. g This indicates the borrowed dirty bit. The circuit states for all cases are listed below. When g When the value is 0, after passing through the controlled incrementer, the circuit state at time ① is... Next, after passing through a set of CNOT gates, the circuit state at time ② is... Subsequently, the circuit passes through the CARRY module, which outputs... x L + c L Carry-over is denoted as carry There are two possibilities at this point: carry It is either 1 or 0. When carry When the value is 1, the circuit state at time ③ is: Following the controlled incrementer, the control bit is "1" and the target bit is "+1", therefore the circuit state at time ④ is... The second CARRY module is used to recover dirty bits. g Therefore, the circuit state at time ⑤ is... Finally, after passing through a set of CNOT gates, the circuit state at time ⑥ is... At this point, x L + c L The carry-over "1" has been added to x H Above, used for subsequent calculations x H + c H And dirty bits g It has been restored to 0. Similarly, when carry is 0, we can conclude that the circuit state at times ③, ④, ⑤, and ⑥ is all 0. ,and x L + c L The carry-over "0" has been added to x H Above, used for subsequent calculations x H + cH And dirty bits g It has been restored to 0.

[0031] when g When the value is 1, the circuit passes through the controlled incrementer, the control bit is "1", and the target bit is "+1", so the circuit state at time ① is Next, after passing through a set of CNOT gates, the circuit state at time ② is... Subsequently, the circuit passes through the CARRY module, which outputs... x L + c L Carry carry There are two possibilities at this point: carry It is either 1 or 0. When carry When the value is 1, the circuit state at time ③ is: Following the controlled incrementer, the circuit state at time ④ is... The second CARRY module is used to recover dirty bits. g The circuit state at time ⑤ is Finally, after passing through a set of CNOT gates, the circuit state at time ⑥ is... At this point, x L + c L The carry-over "1" has been added to x H Above, used for subsequent calculations x H + c H And dirty bits g It has been restored to 1. When carry When the value is 0, the circuit state at time ③ is Following this, the circuit passes through a controlled incrementer, with the control bit set to "1" and the target bit incremented by "+1". At time ④, the circuit state is... The second CARRY module is used to restore the state of the dirty bit g. At time ⑤, the circuit state is... Finally, after passing through a set of CNOT gates, the circuit state at time ⑥ is... ,according to = -X- 1. Simplify the expression to obtain At this point, x L + c H The carry-over "0" has been added to x H Above, used for subsequent calculations x H + c HAnd dirty bits g It has been restored to 1. Table 3 clearly presents the circuit state at each moment under the four conditions (for ease of representation, all parameters are omitted from the table). ), Observing Table 3, we can conclude that Figure 4 Achieved The function.

[0032] Table 3: Circuit state at different times under four conditions

[0033] Based on different bits Figure 4 By recursively combining the structures, constant modulo addition based on 32 bits can be achieved, as shown in the structure below. Figure 5 As shown. The 32-bit variable... x With 32-bit constants c Addition, i.e., calculation x 0~31+ c 0~31 Calculate in advance x 0~15+ c 0~15 Carry and add to x 16~31 on; to calculate x 0~7+ c 0~7 Carry and add to x 8~15 on; to calculate x 0~3+ c 0~3 Carry and add to x 4~7 on; to calculate Carry and add to x 2~3 on; to calculate x 4~5+ c 4~5 Carry and add to x 6~7 on; to calculate x 8~11+ c 8~11 Carry and add to x 12~15 on; to calculate x 8~9+ c 8~9 Carry and add to x 10~11 on; to calculate x 12~13+ c12~13 Carry and add to x 14~15 on; to calculate x 16~23+ c 16~23 Carry and add to x 24~31 on; to calculate x 16~19+ c 16~19 Carry and add to x 20~23 on; to calculate x 16~17+ c 16~17 Carry and add to x 18~19 on; to calculate x 20~21+ c 20~21 Carry and add to x 22~23 on; to calculate x 24~27+ c 24~27 Carry and add to x 28~31 on; to calculate x 24~25+ c 24~25 Carry and add to on; to calculate x 28~29+ c 28~29 Carry and add to Above. Finally, only calculation is needed ( x i x i+1 ) + ( c i c i+1 ) ( , x i Represents a string x The i Bit, c i Represents a string c The i Bit, x i x i+1 and ci c i+1 All are 2-bit binary strings, and carry need not be considered. The above... x i~j Represents binary string x The i to j Bit, c i~j Represents binary string c The i to j Bit.

[0034] Figure 5 Resource consumption and constant c The specific values ​​depend on the specific values ​​used in the iterative compression part of the SM3 algorithm. Both constants are 32-bit binary strings, and their hexadecimal representations are as follows:

[0035] Figure 5 The resource consumption of controlled incrementers based on 16, 8, 4, and 2 bits is shown in Table 4. From this, we can conclude... Figure 5 All quantum incrementers consume a total of 29×2+13×4+5×8+16=166 Tooffoli gates, 73×2+33×4+13×8+3×16=430 CNOT gates, and 33×2+17×4+9×8+5×16=286 X gates, with a Tooffoli depth of 166. Figure 5 The invention includes 16 types of CARRY modules. Since the SM3 algorithm has two constants, a total of 32 types of CARRY modules are included. Their resource consumption is shown in Table 5. Therefore, all CARRY modules in the constant modulator based on constant 0x97cc4519 consume a total of 122×2 + 60×4 + 26×8 + 10×16 = 752 Toffoli gates, 30×2×4 = 240 CNOT gates, and (28 + 16 + 10 + 8 + ... (6+4+4+2+4+2+2+2+2)×2=180 NOT gates, the Tooffoli depth of the circuit is 752; all CARRY modules in the constant modulator based on the constant 0x79879d8a consume a total of 752 Tooffoli gates, 34×2×4=272 CNOT gates, (32+16+14+8+6+8+4+4+2+4+2+4+2)×2=212 X gates, the Tooffoli depth of the circuit is 752.

[0036] Table 4: Resource Consumption of Controlled Incrementers

[0037] Table 5: Resource Consumption of the CARRY Module

[0038] Note: Duplicate modules in the table have been omitted. For example, T=0x97cc4519 contains two 0xc modules, but only one 0xc module data is shown in the table.

[0039] Combination Figure 6 It can be concluded that the ADD2 module of the constant modulus adder based on the constant 0x97cc4519 consumes a total of 5 CNOT gates and 15 X gates; the ADD2 module of the constant modulus adder based on the constant 0x79879d8a consumes a total of 9 CNOT gates and 17 X gates.

[0040] In summary, the constant modulus adder based on the constant 0x97cc4519 consumes 166 + 752 = 918 Tooffoli gates, 430 + 240 + 5 + 32 × 4 = 803 CNOT gates, and 286 + 180 + 15 = 481 NOT gates, with a Tooffoli depth of 918. The constant modulus adder based on the constant 0x79879d8a consumes 918 Tooffoli gates, 430 + 272 + 9 + 32 × 4 = 839 CNOT gates, and 286 + 212 + 17 = 515 NOT gates, with a Tooffoli depth of 918. Since the Hamming weights of 0x97cc4519 and 0x79879d8a are fixed, the cyclic shift operation of the constant does not change its total resource consumption. After 64 rounds of iterative compression, the constant modulus addition part consumed a total of 918×64=58752 Tooffoli gates, 803×16+839×48=53120 CNOT gates, and 481×16+515×48=32416 X gates. The Tooffoli depth of the circuit is 58752.

[0041] S3. Integrating linear and nonlinear components, a comprehensive quantum optimization implementation scheme for the SM3 algorithm is designed with low bandwidth as the goal. Combining the linear and nonlinear components, this invention designs a low-width quantum circuit implementation scheme for the SM3 algorithm, as shown in the specific circuit diagram. Figure 7 As shown, Figure 7 The eight registers in the iterative compression section are called registers A through H from bottom to top; Figure 7 The subscript mentioned in j This refers to the number of iteration rounds. Each message group in the SM3 algorithm iterates 64 times. The specific circuit analysis is as follows: 1. Variables E j and T j<<<j The constant is added using the structure described in S2.3. The 8 dirty bits consumed can be taken from the idle qubits in the message extension part. The result of the addition is... E j +( T j <<<j Stored in register E. The contents of register A... A j Left-shift 12 bits and add the modulo to register E. Register E stores ( A j <<< 12) +E j +( T j <<<j Meanwhile, the message extension section W j The modulus is added to register H, and register H stores the data. H j +W j The two non-constant modulo addition operations above are executed in parallel. Then, the data in the E register is shifted left by 7 bits and output (( A j <<< 12) +E j +( T j <<<j ))<<<7, denoted as SS1. (The rest of the text appears to be a series of characters and symbols, possibly representing a corrupted or incomplete sentence.) A j <<< 12 XORed into register E, register E stores SS1⊕( A j <<< 12), denoted as SS2. A j <<< 12 right-shifted by 12 bits restores to A j Thus, the depth of the circuit is now one non-constant modulus plus depth plus one constant modulus plus depth.

[0042] 2. The contents of registers A, B, and C A j , B j , C j Output via FF FF j ( A j , B j , Cj The data is stored in register C, then modulo-added to register D, and register D stores the data. D j + FF j ( A j , B j , C j Next, the data in registers A, B, and C are transferred via FF. † This will restore MAJ in the C register to C j Subsequently, the modulo SS2 in register E is added to register D. This modulo addition operation is related to FF. † Parallel execution, D register storage D j + FF j ( A j , B j , C j )+SS2. At this point, the circuit depth is 3 non-constant modulus addition depths, 1 constant modulus addition depth, and 1 FF depth.

[0043] 3. Transfer the contents of register A A j Left-shift 12 bits and XOR into register E; register E stores SS1. (Message extension section) W j ’ The modulus is added to the D register, and the D register stores the data. D j + FF j ( A j , B j , C j )+SS2+ W j ’ This is denoted as TT1. Simultaneously, the modulo SS1 in register E is added to register H, and register H stores SS1+. H j +W j The two non-constant modulo addition operations above are executed in parallel. Next, SS1 in register E is shifted right by 7 bits, and then... A j <<< The 12-digit modulus is reduced to the E register, and the E register stores...E j +( T j <<<j The circuit depth is now 5 non-constant modulus addition depths, 1 constant modulus addition depth, and 1 FF depth.

[0044] 4. In the E register E j +( T j <<<j ) and constants T j <<<j Performing a constant modulo subtraction operation (i.e., the inverse process of constant modulo addition), the data in the E register is restored to its original value. The E, F, and G registers output through GG. GG j ( E j , F j , G j The value is stored in register G, and then modulo-added to register H. Register H stores SS1+. H j +W j +GG j ( E j , F j , G j This is denoted as TT2. Then, the E, F, and G registers are passed through GG... † This, in turn, restores CH in the G register to G j Finally, TT2 in register H is output as P0(TT2) through P0, i.e. E j+1 In the G register G j The output is H j+1 In the F register F j Left-shifted by 19 bits, the output is G j+1 In the E register E j The output is F j+1 The output of TT1 in register D is A j+1 In C registers C jThe output is D j+1 In register B B j Left-shifted by 9 bits, the output is C j+1 In register A A j <<< 12 right-shifted by 12 bits restores to A j The output is B j+1 The circuit depth at this point is 6 non-constant modulo sums, 2 constant modulo sums, 1 FF, and 2 GG depths. The output... ABCDEFGH (j+1) The result is used as input for the next round of iterative compression after a SWAP operation.

[0045] Figure 7 The non-constant modulo adder consumes 2 × 32 - 3 = 61 Tofoli gates and 5 × 32 - 7 = 153 CNOT gates, with a Tofoli depth of 61. The calculation can be performed using... Figure 7 The resource consumption of the SM3 low-width quantum realization scheme is as follows: the circuit consumes 24×32=768 qubits; the modulator part consumes 61×8×64+58752=89948 Tooffoli gates; FF, GG and their inverse circuits consume a total of 3×48=144 Tooffoli gates, for a total of 90128 Tooffoli gates. Figure 7 The CNOT gates visible in the diagram consume a total of 8 × 32 × 64 = 16384. , exist The time-varying part is linear, and its corresponding FF and GG modules consume 64 × 4 × 16 = 4096 CNOT gates. The nonlinear part, including FF, GG, and their inverse circuits, consumes a total of (64 + 32) × 2 × 48 = 9216 CNOT gates. , A total of 68 × 2 × 64 = 8704 CNOT gates are consumed, and the module adder section consumes (153 × 8) × 64 + 53120 = 131456 CNOT gates, for a total consumption of 169856 CNOT gates. X gates are only used in the constant module adder, consuming a total of 32416. The Toffoli depth of the circuit is 61 × 6 × 64 + 3 × 48 + 58752 = 82320. The resource consumption of the low-width quantum implementation scheme of the SM3 algorithm is shown in Table 6, where the number of qubits has reached the lowest level in existing research.

[0046] Table 6 Resource Consumption of Low-Width Quantum Implementation Schemes for the SM3 Algorithm

[0047] Note: The resource consumption data shown in Table 6 represents the resources consumed by message expansion and iterative compression of a single message packet (512 bits), with each message packet undergoing 64 rounds of iterative compression. The resources consumed by the SWAP module are negligible.

[0048] In summary, the quantum implementation circuit of the SM3 algorithm designed in this invention will be as follows: Figure 1 As shown, the SM3 algorithm encryption flowchart is discussed in two parts: linear and nonlinear. In the linear part, firstly, this invention generates the linear transformation of the cryptographic algorithm as shown in Tables 1 and 2 based on matrix factorization technology. , A self-updating implementation that does not require the introduction of additional auxiliary qubits. Next, existing research has designed, based on message expansion rules, methods such as... Figure 2 The quantum circuit implementation for the message extension section is shown and used for the implementation of the overall algorithm structure. In the nonlinear part, firstly, existing research designs FF and GG based on NCT gate sets. in- place Quantum implementation is used for the subsequent implementation of the overall algorithm structure. Next, in the iterative compression part of the algorithm, the following... Figure 5 The constant modulus adder shown does not consume auxiliary bits, and its sub-components include, for example: Figure 3 The CARR module shown uses dirty bits to calculate the highest carry of the addition of two binary numbers, as follows: Figure 4 The quantum incrementer shown implements the "+1" operation, and as shown in the figure. Figure 6 The ADD2 module is shown to implement two-bit binary addition. Finally, this invention integrates linear and nonlinear components to design an overall quantum-optimized implementation scheme for the SM3 algorithm with the aim of low bandwidth. The bandwidth of this scheme reaches the theoretical minimum of 768.

Claims

1. A quantum-optimized implementation circuit for the SM3 algorithm under low-width conditions, characterized in that: S1. Design the linear transformation in the linear part. , The quantum implementation scheme is proposed, and the quantum circuit implementation of the message extension part is designed. S1.1, Based on the linear transformation in message expansion corresponding binary matrix generation In-place quantum realization; S1.2, Based on the linear transformation in iterative compression corresponding binary matrix generation In-place quantum realization; S1.3, Design and implement quantum circuits for the message extension part based on the message extension law; S2. Design quantum implementation schemes for FF and GG in the nonlinear part, and design a quantum implementation of a constant modulus adder, where FF and GG respectively represent the implementation of FF. j (X,Y,Z) and GG j Quantum components with (X,Y,Z) functionality; FF j (X,Y,Z) and GG j (X,Y,Z) represents the output of FF and GG to inputs X, Y, and Z in round j at round j; S2.1 Design of in-place quantum realizations of FF and GG based on NCT gate set; S2.2, Quantum Realization of Constant Modulus Adders; S2.2.1 Calculating the highest carry of adding two binary numbers using dirty bits. Specifically, this includes: replacing auxiliary bits with dirty bits to improve the CARRY module; the improved CARRY module outputs the XOR of the dirty bit and the highest carry; and the improved CARRY module performs the following function: ,in This indicates that 'a' is a binary string of length 'n'. Similarly, This represents the nth bit of the result of a+c, where a, c, and g are the binary string of the variable, the binary string of the constant, and the dirty bit, respectively, and n is a positive integer. S2.2.2 Implement the +1 operation using a quantum incrementer; S2.2.

3. Implement constant modulo addition operation using dirty bits without consuming auxiliary bits; S3. Integrating linear and nonlinear components, a comprehensive quantum optimization implementation scheme for the SM3 algorithm is designed with low bandwidth as the goal.

2. The quantum-optimized implementation circuit of the SM3 algorithm according to claim 1, characterized in that, The linear transformation based on message extension corresponding binary matrix generation The in-place quantum implementation specifically includes: representing the linear transformation P0 in the message extension of the SM3 algorithm as the following binary matrix: 10000000010000000100000000000000 01000000001000000010000000000000 00100000000100000001000000000000 00010000000010000000100000000000 00001000000001000000010000000000 00000100000000100000001000000000 00000010000000010000000100000000 00000001000000001000000010000000 00000000100000000100000001000000 00000000010000000010000000100000 00000000001000000001000000010000 00000000000100000000100000001000 00000000000010000000010000000100 00000000000001000000001000000010 00000000000000100000000100000001 10000000000000010000000010000000 01000000000000001000000001000000 00100000000000000100000000100000 00010000000000000010000000010000 00001000000000000001000000001000 00000100000000000000100000000100 00000010000000000000010000000010 00000001000000000000001000000001 10000000100000000000000100000000 01000000010000000000000010000000 00100000001000000000000001000000 00010000000100000000000000100000 00001000000010000000000000010000 00000100000001000000000000001000 00000010000000100000000000000100 00000001000000010000000000000010 00000000100000001000000000000001 And assume a linear transformation The input is ( The output is () ) ,in ,and Linear transformations are obtained using heuristic algorithms based on matrix factorization theory. The self-updating XOR implementation of the corresponding matrix is ​​described; by utilizing the characteristics of CNOT gates to simulate classical XOR operations, the implementation is directly converted into an in-place quantum circuit implementation.

3. The quantum-optimized implementation circuit of the SM3 algorithm according to claim 1, characterized in that, The linear transformation based on message extension corresponding binary matrix generation The in-place quantum implementation specifically includes: the linear transformation in the message extension of the SM3 algorithm. Represented as a binary matrix as follows: 10000000000000010000000100000000 01000000000000001000000010000000 00100000000000000100000001000000 00010000000000000010000000100000 00001000000000000001000000010000 00000100000000000000100000001000 00000010000000000000010000000100 00000001000000000000001000000010 00000000100000000000000100000001 10000000010000000000000010000000 01000000001000000000000001000000 00100000000100000000000000100000 00010000000010000000000000010000 00001000000001000000000000001000 00000100000000100000000000000100 00000010000000010000000000000010 00000001000000001000000000000001 10000000100000000100000000000000 01000000010000000010000000000000 00100000001000000001000000000000 00010000000100000000100000000000 00001000000010000000010000000000 00000100000001000000001000000000 00000010000000100000000100000000 00000001000000010000000010000000 00000000100000001000000001000000 00000000010000000100000000100000 00000000001000000010000000010000 00000000000100000001000000001000 00000000000010000000100000000100 00000000000001000000010000000010 00000000000000100000001000000001 And assume a linear transformation The input is ( The output is () ) ,in ,and Linear transformations can be obtained using heuristic algorithms based on matrix factorization theory. The self-updating XOR implementation of the corresponding matrix is ​​presented. By utilizing the characteristics of CNOT gates to simulate classical XOR operations, this implementation is directly converted into an in-place quantum circuit implementation.

4. The quantum-optimized implementation circuit of the SM3 algorithm according to claim 1, characterized in that, The quantum circuit implementation for the message expansion part, designed based on the message expansion law, specifically includes: generating the quantum circuit according to the formula of the message expansion part. Save to In the middle, the newly generated W j Save to In, until all messages are expanded, where W j It is a 32-bit data block obtained after the message is grouped, and .

5. The quantum-optimized implementation circuit of the SM3 algorithm according to claim 1, characterized in that, The method of using dirty bits to perform constant modulo addition without consuming auxiliary bits specifically includes: adding a 32-bit variable x to a 32-bit constant c, i.e., calculating x. 0~31+ c 0~31 Calculate x in advance. 0~15+ c 0~15 Carry and add to x 16~31 Above; calculate x 0~7+ c 0~7 Carry and add to x 8~15 Above; calculate x 0~3+ c 0~3 Carry and add to x 4~7 on; to calculate Carry and add to x 2~3 Above; calculate x 4~5+ c 4~5 Carry and add to x 6~7 Above; calculate x 8~11+ c 8~11 Carry and add to x 12~15 Above; calculate x 8~9+ c 8~9 Carry and add to x 10~11 Above; calculate x 12~13+ c 12~13 Carry and add to x 14~15 Above; calculate x 16~23+ c 16~23 Carry and add to x 24~31 Above; calculate x 16~19+ c 16~19 Carry and add to x 20~23 Above; calculate x 16~17+ c 16~17 Carry and add to x 18~19 Above; calculate x 20~21+ c 20~21 Carry and add to x 22~23 Above; calculate x 24~27+ c 24~27 Carry and add to x 28~31 Above; calculate x 24~25+ c 24~25 Carry and add to Above; calculate x 28~29+ c 28~29 Carry and add to Finally, only (x) needs to be calculated. i x i+1 ) + (c) i c i+1 ),in , x i c represents the i-th position of string x. i x represents the i-th position of string c. i x i+1 With c i c i+1 Both are 2-bit binary strings, and carry is not considered. x i~j c represents the i-th to j-th bits of the binary string x. i~j This represents the i-th to j-th bits of the binary string c.

Images