Applying Grover's algorithm to AES: quantum resource estimates

We present quantum circuits to implement an exhaustive key search for the Advanced Encryption Standard (AES) and analyze the quantum resources required to carry out such an attack. We consider the overall circuit size, the number of qubits, and the circuit depth as measures for the cost of the presented quantum algorithms. Throughout, we focus on Clifford$+T$ gates as the underlying fault-tolerant logical quantum gate set. In particular, for all three variants of AES (key size 128, 192, and 256 bit) that are standardized in FIPS-PUB 197, we establish precise bounds for the number of qubits and the number of elementary logical quantum gates that are needed to implement Grover's quantum algorithm to extract the key from a small number of AES plaintext-ciphertext pairs.Comment: 13 pages, 3 figures, 5 tables; to appear in: Proceedings of the 7th International Conference on Post-Quantum Cryptography (PQCrypto 2016

A (quasi-)polynomial time heuristic algorithm for synthesizing T-depth optimal circuits

We investigate the problem of synthesizing T-depth-optimal quantum circuits over the universal fault-tolerant Clifford+T gate set, where the implementation of the non-Clifford T-gate is the most expensive. We use nested meet-in-the-middle (MITM) technique to develop algorithms for synthesizing provably \emph{depth-optimal} and \emph{T-depth-optimal} circuits for exactly implementable unitaries. These algorithms improve space complexity. Specifically, for synthesizing T-depth-optimal circuits we define a special subset of T-depth-1 unitaries, which can generate the T-depth-optimal decomposition (up to a Clifford). This plays a crucial role in having better time complexity as well. We get an algorithm with space and time complexity $O\left(\left(n\cdot 2^{5.6n}\right)^{\lceil d/c\rceil}\right)$ and $O\left(\left(n\cdot 2^{5.6n}\right)^{(c-1)\lceil d/c\rceil}\right)$ respectively, where $d$ is the minimum T-depth and $c\geq 2$ is a constant. This is much better than the complexity of the algorithm by Amy~et~al.(2013), the previous best with a complexity much more than $O\left(\left(2^{kn^2}\right)^{\lceil d/2\rceil}\right)$, where $k$ is a constant. For example, our new methods took 2 seconds for a task that would have taken more than 4 days using the methods in Amy~et~al.(2013). We design an even more efficient algorithm for synthesizing T-depth-optimal circuits. The claimed efficiency and optimality depends on some conjectures, which have been inspired from the work of Mosca and Mukhopadhyay (2020). To the best of our knowledge, the conjectures are not related to the previous work. Our algorithm has space and time complexity \poly(n,2^{5.6n},d) (or \poly(n^{\log n},2^{5.6n},d) under some weaker assumptions).Comment: Compared to v2: Added explanations and clarification

Design Automation and Design Space Exploration for Quantum Computers

A major hurdle to the deployment of quantum linear systems algorithms and recent quantum simulation algorithms lies in the difficulty to find inexpensive reversible circuits for arithmetic using existing hand coded methods. Motivated by recent advances in reversible logic synthesis, we synthesize arithmetic circuits using classical design automation flows and tools. The combination of classical and reversible logic synthesis enables the automatic design of large components in reversible logic starting from well-known hardware description languages such as Verilog. As a prototype example for our approach we automatically generate high quality networks for the reciprocal $1/x$, which is necessary for quantum linear systems algorithms.Comment: 6 pages, 1 figure, in 2017 Design, Automation & Test in Europe Conference & Exhibition, DATE 2017, Lausanne, Switzerland, March 27-31, 201

Polynomial-time T-depth Optimization of Clifford+T circuits via Matroid Partitioning

Most work in quantum circuit optimization has been performed in isolation from the results of quantum fault-tolerance. Here we present a polynomial-time algorithm for optimizing quantum circuits that takes the actual implementation of fault-tolerant logical gates into consideration. Our algorithm re-synthesizes quantum circuits composed of Clifford group and T gates, the latter being typically the most costly gate in fault-tolerant models, e.g., those based on the Steane or surface codes, with the purpose of minimizing both T-count and T-depth. A major feature of the algorithm is the ability to re-synthesize circuits with additional ancillae to reduce T-depth at effectively no cost. The tested benchmarks show up to 65.7% reduction in T-count and up to 87.6% reduction in T-depth without ancillae, or 99.7% reduction in T-depth using ancillae.Comment: Version 2 contains substantial improvements and extensions to the previous version. We describe a new, more robust algorithm and achieve significantly improved experimental result