A low-dw-cost s-box quantum circuit implementation method

Abstract

This invention discloses a low-DW cost implementation method for S-box quantum circuits. It employs hierarchical optimization and modular design, dividing the S-box quantum circuit into a finite field inversion module and an affine transformation plus XOR module. Through combinatorial domain arithmetic, the computationally complex finite field inversion operation is transformed into a tower domain structure composed of lower-order domains. After completing the tower domain implementation of the finite field inversion module and the quantum implementation of the affine transformation plus XOR module, the finite field inversion module and the affine transformation plus XOR module are spliced ​​and integrated into quantum circuits according to the logical order of tower domain operations, ultimately obtaining a complete S-box quantum circuit. This invention takes DW cost as a direct, global optimization objective, significantly reducing the overall spatiotemporal resource overhead; the "hierarchical optimization + modular design" approach facilitates local improvements and yields global benefits; and the tower domain / combinatorial domain arithmetic decomposition of high-cost inversion operations reduces the computational difficulty of the nonlinear core.

Description

Technical Field

[0001] This invention belongs to the field of quantum AES circuit design, specifically relating to a method for implementing S-box quantum circuits with low DW cost. Background Technology

[0002] The development of quantum computing poses a threat to classical cryptography. Grover's algorithm, in particular, reduces the key search complexity of symmetric cryptography (such as AES) to the square root level, making the evaluation and optimization of quantum circuit implementations of AES a crucial topic in post-quantum cryptography research. In the context of fault-tolerant quantum computing, a comprehensive metric for measuring circuit implementation overhead, encompassing both spatial and temporal resources, is needed. DW cost (circuit depth × width), because it directly relates to the product of physical qubits and runtime, is widely considered a more critical resource metric than a single gate number, depth, or width.

[0003] In the field of quantum AES circuit design, existing research (such as the pioneering work of Grassl et al.) has systematically constructed basic circuits and analyzed resource consumption. Subsequent optimizations have mainly focused on reducing the gate count or depth of components such as S-cells. However, existing technologies generally face a fundamental trade-off: increasing parallelism (increasing width) to reduce depth, or adopting serial design (increasing depth) to save width. Currently, there is a lack of circuit construction schemes with the core objective of directly and systematically minimizing the DW product. Therefore, how to achieve a better global trade-off between depth and width, thereby significantly reducing synthesis time and space overhead, is a key technical problem that urgently needs to be solved in this field.

[0004] The main drawback of existing quantum AES circuits regarding S-box construction techniques lies in the one-sidedness of their optimization objectives and the locality of their trade-offs. Most existing schemes pursue the optimization of a single metric, such as minimizing the total number of quantum gates, circuit depth, or qubit width in isolation. However, in the physical realization of fault-tolerant quantum computing, the key factor truly determining resource consumption is the comprehensive spacetime overhead, i.e., the DW (depth × width) cost. Existing technologies fail to treat DW, this core comprehensive metric, as a direct, global optimization objective, resulting in inherent limitations in their optimization strategies: significantly increasing width to reduce depth, or significantly increasing depth to save width. This "one-sided" optimization pattern stems from the lack of a systematic reconstruction and synergistic minimization design of the coupling relationship between depth and width. Therefore, existing methods struggle to find a better global balance between depth and width, and the resulting circuit DW cost is often not optimal, failing to meet the stringent resource efficiency requirements of future fault-tolerant quantum computing.

[0005] References:

[0006] [1] Liao H, Luo Q. Quantum Circuit Synthesis for AES with Low DW-Cost[C] / / International Conference on the Theory and Application of Cryptology andInformation Security. Singapore: Springer Nature Singapore, 2025: 475-507.

[0007] [2] Chun M, Baksi A, Chattopadhyay A. DORCIS: depth optimized quantum implementation of substitution boxes[J]. Cryptology ePrint Archive, 2023.

[0008] [3] Huang Z, Zhang F, Lin D. Constructing quantum implementations with the minimal T-depth or minimal width and their applications[C] / / AnnualInternational Conference on the Theory and Applications of CryptographicTechniques. Cham: Springer Nature Switzerland, 2025: 155-185.

[0009] [4] Li, Z., Gao, F., Qin, S., Wen, Q.: New record in the number ofqubits for a quantum implementation of aes. Frontiers in Physics 11, 1171753(2023). Summary of the Invention

[0010] To address the shortcomings of existing technologies, this invention provides a method for implementing S-box quantum circuits with low DW cost.

[0011] The core technical problem this invention aims to solve is: how to design a novel S-box quantum circuit with the direct and systematic goal of minimizing its depth-width product (DW cost), thereby achieving a better global trade-off between depth and width, and ultimately significantly reducing its overall spatiotemporal resource overhead in practical fault-tolerant quantum computing. Specifically, this invention aims to overcome the problems of existing methods having a single optimization objective and localized trade-offs, providing a construction scheme that can synergistically optimize circuit depth and width. This breaks through the bottleneck of further reducing DW cost in existing technologies, providing a benchmark implementation with significantly better resource efficiency for evaluating AES resistance to quantum attacks.

[0012] The present invention constructs a compact S-box quantum circuit with low DW cost, which can be used to construct a complete AES quantum circuit.

[0013] In a first aspect, embodiments of this application provide a method for implementing an S-box quantum circuit with low DW cost, comprising the following steps:

[0014] Step 1: Using the ideas of hierarchical optimization and modular design, the S-box quantum circuit is divided into a finite field inversion module and an affine transformation plus XOR module.

[0015] Step 2: Use combinatorial field arithmetic to transform finite fields with high computational complexity. The inversion operation is transformed into a tower field structure composed of lower-order fields, thereby decomposing complex operations into a series of simpler sub-operations with lower quantum implementation costs.

[0016] Step 3: Implementation of the tower domain in the finite field inversion module.

[0017] Step 4: Quantum implementation of affine transformation plus XOR module.

[0018] Step 5: The finite field inversion module and the affine transformation plus XOR module are spliced ​​and integrated into a quantum circuit according to the logical order of tower field operations, and finally a complete S-box quantum circuit is obtained.

[0019] In one possible implementation, the tower domain implementation of the finite field inversion module is as follows:

[0020] finite field The problem of finding the multiplicative inverse of any element a in the matrix can be transformed into the combinatorial field using a mapping matrix M. In the processing, the combined field consists of a quadratic extension field and its base field. Specifically, firstly, the element a is transferred from the base field to the base field using the mapping matrix M. Mapping to the combinatorial domain yields Then its multiplicative inverse is calculated in the combinatorial domain. Then through the inverse matrix Map it back to a finite field .

[0021] In one possible implementation, the finite field is transformed into a combinatorial field. Subsequently, the original finite field inversion module was divided into a linear constant transformation module, a multiplication module, and an inversion module.

[0022] Linear constant transformation module: Used to implement linear constant transformation, i.e., to calculate the basis domain. The result of multiplying the square of any element in by a constant (the formula is expressed as: ,in base field (any element in). Because yes The constant in the operation is essentially a fixed linear transformation, so the quantum implementation of the linear constant transformation module only requires the use of CNOT gates. CNOT gates are considered zero-cost or non-depth-contributing gates in DW cost metrics, therefore this module has a minimal impact on the overall DW metric.

[0023] Multiplication module: used to compute the base field The result of multiplying any two elements in the formula is: ,in and base field (Any two distinct elements in the equation). This invention directly utilizes existing optimization results, and the quantum implementation of the multiplication module is achieved using a low-DW-cost multiplication component. This component has been specifically optimized to achieve a good balance between Toffoli gate depth and the number of qubits.

[0024] Inversion Module: To minimize the depth of the inversion submodule, the base field is... The inverse operation is considered as a 4-bit S-box (lookup table) with 4 inputs and 4 outputs. For this 4-bit S-box, the following two-step optimization process is used to optimize the DW cost:

[0025] Automated deep optimization search: Input the quantum circuit synthesis problem of this 4-qubit S-box into the automated search model DORCIS to search for the initial optimized solution: a quantum circuit with a width of 5 qubits and a Toffoli gate depth of 7.

[0026] A secondary optimization strategy, "trading width for depth," involves actively transforming the architecture of the initial optimized solution to further compress the depth. Ancilla qubits are introduced into the quantum circuit to store intermediate computation results, replacing the previously sequential Tooffoli gate operations with parallelizable operations. This optimization ultimately yields a novel quantum circuit with a width of 11 qubits and a Tooffoli gate depth of only 2. Inverting quantum circuits. This design significantly reduces the delay of this critical path.

[0027] In one possible implementation, the quantum implementation of the affine transformation plus XOR module is as follows:

[0028] After completing the inversion of a finite field and mapping it back to a finite field Next, an affine transformation of the AES standard S-box needs to be performed. The affine transformation is implemented using a fixed 8×8 binary matrix A multiplication, and the result of the affine transformation is then XORed with an 8-bit constant vector c. Since matrix A and the constant vector c are fixed, the quantum implementation of this module is a deterministic linear operation. Matrix A multiplication is implemented using a pre-optimized CNOT gate network, with the optimization goal of reducing the number of CNOT gate layers (depth). The XOR operation with the constant vector c is implemented through an X-gate (Pauli-X gate) on a set of qubits.

[0029] Based on the constructed S-box quantum circuit described above, this invention can flexibly derive S-box variants to meet the requirements of different quantum algorithms. A typical and useful variant is the "in-situ XOR" type S-box, whose functional expression is: This variant can be achieved by making minor adjustments to the input / output interfaces of the basic S-box circuit. Specifically, instead of writing the output of the original S-box circuit to a zeroed auxiliary register, it is directly connected to the second quantum register. Perform a bitwise XOR operation (implemented using CNOT gates). This variant is very useful in quantum cryptography algorithms that require accumulating the S-box output with intermediate states, such as quantum circuits under Grover's search.

[0030] Secondly, embodiments of this application provide an electronic device, including a processor and a memory;

[0031] The memory is used to store computer programs.

[0032] When the processor executes the program stored in the memory, it implements any of the S-box quantum circuit implementation methods described in this application.

[0033] Thirdly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the S-box quantum circuit implementation methods described in this application.

[0034] Fourthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute any of the S-box quantum circuit implementation methods described in this application.

[0035] The beneficial effects of this invention are as follows:

[0036] 1. By taking DW cost as the direct and global optimization target, the overall spatiotemporal resource overhead is significantly reduced.

[0037] This invention no longer pursues a single indicator such as gate count, depth, or width, but uses the product of circuit depth and width (DW) as the core metric for design and optimization. From the perspective of construction goals, it avoids the local trade-off defect of existing technologies where "reducing depth inevitably increases width / saving width inevitably increases depth". This allows for a more effective reduction of the product of physical qubits and running time consumption in fault-tolerant quantum computing scenarios, thereby improving the resource efficiency benchmark.

[0038] 2. Employing a "layered optimization + modular design" approach facilitates local improvements while achieving overall benefits.

[0039] This invention divides the S-box quantum circuit into a finite field inversion module and an affine transformation plus XOR module, and employs the most suitable optimization strategies for each: DW co-optimization for the nonlinear critical path and CNOT network implementation for the linear part. This structure allows optimization to pinpoint the critical bottleneck module, reducing design complexity, and facilitates subsequent replacement of better sub-modules without disrupting the overall interface, exhibiting good scalability and engineering reuse value.

[0040] 3. Reduce the computational difficulty of the nonlinear core by using high-cost inversion operations through arithmetic decomposition of the tower domain / combinatorial domain.

[0041] This invention will Inverse mapping to combinatorial field The algorithm decomposes high-complexity operations into more easily implemented sub-operations such as linear constant transformation, base domain multiplication, and base domain inversion. This reduces the concentration of nonlinear gates in the algorithm structure, lowers the synthesis difficulty of quantum circuits, and creates more space for DW co-optimization.

[0042] 4. Linearization of linear constant transformation and affine transformation is achieved with almost no increase in DW burden.

[0043] This invention unifies the implementation of fixed linear operations such as square multiplication by a constant and 8×8 affine matrix multiplication using a CNOT network, and implements the XOR operation with a constant vector c using an X gate. Since linear networks can be highly parallelized and contribute little to critical resource consumption in DW metrics, the overall DW overhead is mainly concentrated in the necessary nonlinear parts, avoiding wasting time and space resources in linear stages, thereby improving overall efficiency.

[0044] 5. The bit inversion submodule implements "depth-width collaborative reconstruction," significantly shortening the critical path.

[0045] This invention will The inversion module is regarded as a 4-bit S-box with 4 inputs and 4 outputs. It first obtains the initial optimization solution by using automated depth optimization search, and then introduces auxiliary qubits to store intermediate results, thus parallelizing the originally serial Tooffoli gate sequence. This achieves a secondary optimization that "trades width for depth", significantly compresses the critical Tooffoli depth, reduces critical path delay, and effectively reduces the consumption of the most sensitive time-series resources under the fault-tolerant model, and achieves a better global balance at the DW level. Attached Figure Description

[0046] Figure 1 : Overall structural diagram of box S in embodiment of the present invention.

[0047] Figure 2 : Tower domain decomposition diagram of an embodiment of the present invention.

[0048] Figure 3 Embodiments of the present invention Find the inverse quantum circuit diagram.

[0049] Figure 4 Embodiments of the present invention Find the inverse quantum circuit diagram. Detailed Implementation

[0050] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0051] Overall structure and definition of quantum register:

[0052] like Figure 1 As shown, this invention provides a low-DW-cost S-box quantum circuit, whose function is to process the input byte quantum state. Calculate AES S-box output The S-box quantum circuit adopts a modular, hierarchical structure, which includes the following components in sequence according to the data flow:

[0053] Finite field inversion module (will) Elements are mapped to a combinatorial domain / tower domain representation, in the combinatorial domain The reversible quantum realization of inversion is completed above, mapping the combinatorial field result back to... );

[0054] Affine transformation plus XOR module (completes the affine transformation and constant XOR of the AES standard S-box).

[0055] For ease of explanation, the following quantum register is defined:

[0056] Input register: 8 qubits, carrying an input byte ;

[0057] Output register: Eight qubits, the initial state can be all zeros or any value. (For in situ XOR variants);

[0058] Combinatorial field working register: used to carry combinational field components (e.g., 4-bit component pairs) );

[0059] Ancilla registers are used to store intermediate variables to enable gate-level parallelism and deep compression. The number of ancilla registers can be configured according to the implementation.

[0060] The S-box quantum circuit is implemented using a reversible set of basic gates: Toffoli gates are used as the core gates for nonlinear algebraic operations, while CNOT gates and X gates are used to implement linear transformations and constant XOR operations. At the linear level (fixed matrix multiplication, constant linear mapping), only the CNOT / X gate network is needed; at the nonlinear level (multiplication, inversion), the critical path is mainly composed of Toffoli gates.

[0061] This application provides a method for implementing S-box quantum circuits with low DW cost, including the following steps:

[0062] Step 1: Employing the principles of hierarchical optimization and modular design, the S-box quantum circuit is divided into a finite field inversion module and an affine transformation plus XOR module. The processing flow is as follows:

[0063]

[0064] in, It represents the quantum state of the input byte. It represents the quantum state of the output byte.

[0065] Step 2: Use combinatorial field arithmetic to transform finite fields with high computational complexity. The inversion operation is transformed into a tower field structure composed of lower-order fields, thereby decomposing complex operations into a series of simpler sub-operations with lower quantum implementation costs.

[0066] Step 3: Implementation of the tower domain for the finite field inversion module

[0067] In combinatorial arithmetic, elements in higher-order fields can be represented by linear combinations of elements in lower-order fields, where operations in lower-order fields are simpler and less costly. Therefore, the finite field inversion module is implemented using a tower field, transforming the finite field... The problem of finding the multiplicative inverse of any element a in the matrix can be transformed into the combinatorial field using a mapping matrix M. In the middle processing, specifically, firstly, the element a is transferred from the mapping matrix M to the... Mapping to the combinatorial domain yields Then its multiplicative inverse is calculated in the combinatorial domain. Then through the inverse matrix Map it back to a finite field .

[0068] In one possible implementation, the combinatorial domain structure is derived from a quadratic extension domain. With base domain Composition, where constants , For generators of the base field, Let be the generator of the quadratic extension field. The primitive polynomials of the base field and the quadratic extension field are defined according to a predetermined combinatorial arithmetic, and a constant is introduced. The mapping is accomplished by a fixed 8×8 binary matrix M. Since M is a constant matrix, its quantum realization is a deterministic linear invertible transformation: it can be achieved by applying several CNOT gates to the input register and the combinatorial field working register.

[0069] The mapped output is preferably written to the two 4-bit components of the combinational field working register:

[0070] Representing components , Representing components ,in

[0071] After the mapping transformation is completed, the combinatorial field working register carries the quantum state. ,in correspond , correspond This prepares for subsequent inversion of the combinatorial field. The mapping transformation only contains CNOT gates, so it has minimal impact on the Toffoli depth and critical path.

[0072] In one possible implementation, mapping to a composite domain Post-calculation Combinatorial field arithmetic is used to decompose the inversion of higher-order fields into several low-cost suboperations: linear constant transformation + finite number of multiplications + one-time multiplication. Inverse calculations are performed to achieve a global tradeoff of lower DW costs, such as quantum realization circuits. Figure 4 As shown, Figure 4 middle Mul represents the linear constant transformation module, and Mul represents the multiplication module. express Inverse module, This represents the inverse process of the constant transformation module and the first multiplication module. Indicates the input quantum state, This indicates the output quantum state.

[0073] The finite field inversion module is decomposed into the following sub-modules (such as...) Figure 2As shown):

[0074] Module (Linear Constant Transformation)

[0075] This module is used for calculation and Related fixed linear transformation terms (e.g., squaring a component and then multiplying it by a constant) (Equivalent linear transformation). Because for Constants, such operations are represented as fixed linear mappings in binary vector space, therefore The quantum implementation of the module is achieved using a pure CNOT gate network. This module does not introduce Toffoli gate critical paths, facilitating parallel scheduling with other modules.

[0076] Multiplication module ( multiplication)

[0077] This module is used to compute the base field multiplication terms required during the inverse decomposition of the combinatorial domain (e.g., product of components, product of intermediate quantities, etc.). The multiplication module implements reversible multiplication using Toffoli gates as its core. The output is written to a specified intermediate register, while the input register remains unchanged. The auxiliary bits are then "uncomputed" at the end according to reversible logic to restore them to zero, thus facilitating the reuse of auxiliary resources in larger circuits and reducing noise accumulation. The quantum implementation of the multiplication module uses reference [reference needed]. [1] The low-DW-cost multiplication component implementation verified in (Quantum Circuit Synthesis for AES with Low DW-cost) emphasizes the coordinated optimization between Tooffoli depth and qubit width: parallelizable multiplication sub-items are executed as parallel as possible to reduce the overall Tooffoli depth; shared intermediate quantities are buffered with auxiliary bits to reduce serial gate chains.

[0078] Inversion module (critical path deep compression)

[0079] In the inverse decomposition of a combinatorial field, one step is required. The inversion operation is performed on the top. To minimize the overall DW cost, this inversion operation is treated as a 4-input, 4-output Boolean permutation (4-bit S-box) and optimized using depth-guided quantum synthesis. The following two-step optimization process is used to optimize the DW cost:

[0080] Automated Deep Optimization Search: Input the quantum circuit synthesis problem of this 4-qubit S-box into the automated search model DORCIS. [2]The DORCIS model can systematically search for different circuit topologies that implement a given Boolean function using basic quantum gates (such as Tofoli gates and CNOT gates). Using this model, an initial optimal solution is found: a quantum circuit with a width of 5 qubits and a Tofoli gate depth of 7.

[0081] A secondary optimization strategy, "trading width for depth," involves actively transforming the architecture of the initial optimized solution to further compress the depth. Ancilla qubits are introduced into the quantum circuit to store intermediate computation results, replacing the previously sequential Tooffoli gate operations with parallelizable operations. This optimization ultimately yields a novel quantum circuit with a width of 11 qubits and a Tooffoli gate depth of only 2. Inverting quantum circuit. This design significantly reduces the number of critical Toffoli gate layers, thereby compressing the critical path delay for inversion. The quantum circuit diagram is shown below. Figure 3 As shown.

[0082] Combinatorial field inversion result synthesis and register arrangement

[0083] After completing the above linear constant transformation, multiplication, and... After inverting, the intermediate quantities obtained from the operation are combined according to the algebraic relation of inversion of the combinatorial field to obtain the final result. The result of the combinatorial field inversion is written to the combinatorial field working register. Then, the auxiliary registers, which only serve intermediate calculations, are inverted to restore them to their original state. This reduces residual entanglement in the circuit and facilitates the splicing of subsequent modules.

[0084] In one possible implementation, a fixed matrix is ​​used. Map the result of the combinatorial field inversion back to The byte representation, also a fixed linear reversible transformation, is implemented using a CNOT gate network. The output of the inverse mapping is written to the output register (when the output register is initially zero).

[0085] Step 4: Quantum Implementation of Affine Transformation with XOR Module

[0086] After completing the inversion of a finite field and mapping it back to a finite field Then, the affine transformation of the AES standard S-box is performed. The affine transformation is implemented using a fixed 8×8 binary matrix A multiplication. The result of the affine transformation is then XORed with an 8-bit constant vector c. The formula is expressed as follows:

[0087]

[0088] in, This is the byte bit vector after inverse mapping. This represents the XOR operation. Since matrix A and the constant vector c are fixed, the quantum implementation of the affine transformation plus the XOR module is a deterministic linear operation.

[0089] The quantum realization of matrix A is achieved through a pre-optimized CNOT gate network, with the optimization goal of reducing the number of CNOT gate layers (depth); the XOR operation with the constant vector c is achieved through an X gate (Pauli-X gate) on a set of qubits.

[0090] Step 5: Assemble and integrate the finite field inversion module and the affine transformation plus XOR module into a quantum circuit according to the logical order of tower field operations. The final result is a complete S-box quantum circuit, which can be written as: .

[0091] The S-box quantum circuit finally realized in this invention has the core specifications of a width of 23 qubits and a Toffoli gate depth of 10 layers. This specification is superior to the depth (usually exceeding 20 layers) and width of many existing publicly available S-box schemes. DW cost (depth × width) is a key comprehensive indicator for measuring the execution efficiency and resource overhead of a quantum circuit in the era of fault-tolerant quantum computing. Lower DW cost means that when the circuit runs on real hardware limited by quantum coherence time, it can effectively reduce the probability of computational failures due to quantum noise and decoherence, thereby improving the overall success rate and feasibility of algorithms (such as Grover's search attack). The results are compared in Table 1.

[0092] This invention constructs an F(2) gate with a width of 11 and a Toffoli gate depth of only 2. 4 The inverse quantum circuit is derived. In known public schemes, circuits achieving the same function typically have greater depth. This sub-circuit depth optimization provides a new, reusable, high-performance building block for deep compression of the entire S-box and even larger-scale cryptographic components. Results are compared in Table 2.

[0093] Table 1: Comparison of S-box quantum circuit implementations

[0094]

[0095] Table 2: F(2) 4 Comparison table of inverse quantum circuit implementations

[0096]

[0097] This application also provides an electronic device, including a processor and a memory.

[0098] The memory is used to store computer programs.

[0099] When the processor executes a program stored in the memory, it implements any of the methods described in this application.

[0100] In one possible implementation, the electronic device of this application embodiment further includes a communication interface and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus.

[0101] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc.

[0102] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0103] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0104] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0105] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements any of the methods described in this application.

[0106] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform any of the methods described in this application.

[0107] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0108] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0109] The various embodiments in this specification are described in a related manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other.

[0110] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A method for implementing an S-box quantum circuit with low DW cost, characterized in that, Includes the following steps: Step 1: Employing the principles of hierarchical optimization and modular design, the S-box quantum circuit is divided into a finite field inversion module and an affine transformation plus XOR module. Step 2: Use combinatorial field arithmetic to transform finite fields with high computational complexity. The inverse operation is performed in a tower domain structure composed of lower-order domains; Step 3: Implementation of the tower domain in the finite field inversion module; Step 4: Quantum implementation of affine transformation plus XOR module; Step 5: The finite field inversion module and the affine transformation plus XOR module are spliced ​​and integrated into a quantum circuit according to the logical order of tower field operations, and finally a complete S-box quantum circuit is obtained.

2. The method for implementing an S-cell quantum circuit with low DW cost according to claim 1, characterized in that, The tower domain implementation of the finite field inversion module is as follows: finite field The problem of finding the multiplicative inverse of any element a in the matrix can be transformed into the combinatorial field using a mapping matrix M. In the middle processing, the combined field consists of a quadratic extension field and its base field; specifically, firstly, the element a is transferred from the base field to the base field using the mapping matrix M. Mapping to the combinatorial domain yields Then its multiplicative inverse is calculated in the combinatorial domain. Then through the inverse matrix Map it back to a finite field .

3. The method for implementing an S-cell quantum circuit with low DW cost according to claim 2, characterized in that, Transforming a finite field into a combinatorial field Subsequently, the original finite field inversion module was divided into a linear constant transformation module, a multiplication module, and an inversion module. Linear constant transformation module: Used to implement linear constant transformation, i.e., to calculate the basis domain. The result of multiplying the square of any element in the constant; The quantum implementation of the linear constant transformation module only requires the use of CNOT gates; Multiplication module: used to compute the base field The result of multiplying any two elements in the array; the quantum implementation of the multiplication module is implemented using low-DW cost multiplication components; Inversion module: converts the base field The inverse operation is considered as a 4-bit S-box with 4 inputs and 4 outputs; for this 4-bit S-box, the following two-step optimization process is used to optimize the DW cost: Automated deep optimization search: Input the quantum circuit synthesis problem of this 4-qubit S-box into the automated search model DORCIS to search for the initial optimization solution: a quantum circuit with a width of 5 qubits and a Toffoli gate depth of 7. Secondary optimization that trades width for depth: actively transforming the architecture of the initial optimization solution; By introducing auxiliary qubits to store intermediate calculation results by using the original number of Tooffoli gates in the quantum circuit, the Tooffoli gate operations that originally had to be executed sequentially are transformed into operations that can be executed in parallel. Through this optimization, a novel quantum gate with a width of 11 qubits and a Tofoli gate depth of 2 was finally obtained. Find the inverse quantum circuit.

4. The method for implementing an S-cell quantum circuit with low DW cost according to claim 2, characterized in that, The quantum implementation of affine transformation plus XOR module is as follows: After completing the inversion of a finite field and mapping it back to a finite field Then, the affine transformation of the AES standard S-box is performed; the affine transformation is implemented using a fixed 8×8 binary matrix A multiplication, and the result of the affine transformation is then XORed with an 8-bit constant vector c; the matrix A multiplication is implemented using a pre-optimized CNOT gate network, the optimization goal of which is to reduce the number of CNOT gate layers; the XOR operation with the constant vector c is implemented through an X gate on a set of qubits.

5. An electronic device, characterized in that, Including processor and memory; The memory is used to store computer programs; When the processor executes the program stored in the memory, it implements the S-box quantum circuit implementation method according to any one of claims 1-4.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the S-box quantum circuit implementation method according to any one of claims 1-4.

7. A computer program product containing instructions, characterized in that, When it is run on a computer, it causes the computer to perform the S-box quantum circuit implementation method according to any one of claims 1-4.

Images