Implementation and Analysis of Ciphers in Quantum Computing by Anubhab Baksi & Kyungbae Jang

Author:Anubhab Baksi & Kyungbae Jang
Language: eng
Format: epub
ISBN: 9789819700257
Publisher: Springer Nature Singapore

6.3.2 Shallow Version and Shallow/Low Depth Version

We propose a shallow version in which all possible parts of AES quantum circuits operate, simultaneously. When S-box with Toffoli depth 4 is used, this can be achieved by using 2 sets of ancilla qubits. In the shallow version, the first SubBytes in Fig. 6.4b uses the first ancilla qubits. The second SubBytes uses the second ancilla qubits, and at the same time SubBytes cleans the first ancilla qubits. That is, SubBytes operates simultaneously with the SubBytes of the next round. Conceptually, this can be thought as all SubBytes in Fig. 6.4a are pushed one space to the right. This is possible because SubBytes and SubBytes do not share any ancilla qubit. Thanks to this parallel structure (using 2 alternative ancilla sets), the shallow version counts the depth for one round as SubBytes (72) + MixColumns (28), which is the ideal depth. The circuit depth of AES–128 is 960 (about 9 rounds 100 72), that of AES–192 is 1152 (about 11 rounds 100 72), and the same for AES–256 is 1351 (about 13 rounds 100 72). In the shallow version, up to SubBytes operates concurrently within one round, providing maximum parallelism. Finally, the shallow version (◎) offer the least Toffoli depth (✦) of the S-box ’s Toffoli depth rounds, Toffoli depth qubit count (✦ ❂), and Toffoli depth qubit count (✦ ❂).

The shallow/low depth version replaces only the MixColumn implementation from the shallow version to a MixColumn which is a courtesy of [92]. As described in Sect. 6.​2.​7, by sharing ancilla qubits of SubBytes, only output qubits are required for any MixColumn implementation in Table 6.3. For this reason, in the shallow/low-depth version (using out-of-place MixColumn), implementing the lowest-depth MixColumn is optimal regardless of the required number of qubits. The low depth version counts the depth for one round as SubBytes (72) + MixColumns (11). The low depth version of AES (⟡) offers the least Toffoli depth (✦), full depth (❈), full depth total gates (metric to estimate quantum attack cost, ❈ ❋), and full depth qubit count (❈ ❂).

Fig. 6.3Zig-zag architecture for AES–128 quantum circuit

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.