The advanced encryption standard (AES) is widely used and well studied for its efficiency and strong security. This paper presents well-balanced quantum circuit designs for the AES S-box by introducing the composite field <InlineEquation ID="IEq1"> <EquationSource Format="TEX">$ F((2^4)^2) $</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi>F</mi> <mo stretchy="false">(</mo> <msup> <mrow> <mo stretchy="false">(</mo> <msup> <mn>2</mn> <mn>4</mn> </msup> <mo stretchy="false">)</mo> </mrow> <mn>2</mn> </msup> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation> to replace the traditional field <InlineEquation ID="IEq2"> <EquationSource Format="TEX">$ F(2^8) $</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi>F</mi> <mo stretchy="false">(</mo> <msup> <mn>2</mn> <mn>8</mn> </msup> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation>, enabling the inversion to be decomposed into operations over <InlineEquation ID="IEq3"> <EquationSource Format="TEX">$ F(2^4) $</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi>F</mi> <mo stretchy="false">(</mo> <msup> <mn>2</mn> <mn>4</mn> </msup> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation>. This work reduces the quantum resource overhead required for implementing the S-box by decreasing the number of CNOT gates in the matrix multiplication, lowering the depth of T gates in both the inversion circuit and the multiplication circuit. Besides, the width for the S-box quantum circuits is also optimized in the inversion circuit and multiplication circuit. With the nonlinear key schedule, the resulting quantum circuit AES-128 reduces the product of the circuit width and T depth to 102,800, which is the lowest known to date.

Quantum circuit for implementing AES S-box with low costs

期刊论文
发表日期：

2026年2月11日

查看全文

Hui-Nan Chen,
Bin-Bin Cai,
Fei Gao,
Song Lin

摘要

The advanced encryption standard (AES) is widely used and well studied for its efficiency and strong security. This paper presents well-balanced quantum circuit designs for the AES S-box by introducing the composite field $ F((2^4)^2) $ $F ({(2^{4})}^{2})$ to replace the traditional field $ F(2^8) $ $F (2^{8})$ , enabling the inversion to be decomposed into operations over $ F(2^4) $ $F (2^{4})$ . This work reduces the quantum resource overhead required for implementing the S-box by decreasing the number of CNOT gates in the matrix multiplication, lowering the depth of T gates in both the inversion circuit and the multiplication circuit. Besides, the width for the S-box quantum circuits is also optimized in the inversion circuit and multiplication circuit. With the nonlinear key schedule, the resulting quantum circuit AES-128 reduces the product of the circuit width and T depth to 102,800, which is the lowest known to date.