# Efficient Implementation of PRESENT and GIFT on Quantum Computers
###### Abstract  
Grover search algorithm is the most representative quantum attack method that threatens the security of symmetric key cryptography. If the Grover search algorithm is applied to symmetric key cryptography, the security level of target symmetric key cryptography can be lowered from \(n\)-bit to \(\frac{n}{2}\)-bit. When applying [PERSON]'s search algorithm to the block cipher that is the target of potential quantum attacks, the target block cipher must be implemented as quantum circuits. Starting with the AES block cipher, a number of works have been conducted to optimize and implement target block ciphers into quantum circuits. Recently, many studies have been published to implement lightweight block ciphers as quantum circuits. In this paper, we present optimal quantum circuit designs of symmetric key cryptography, including PRESENT and GIFT block ciphers. The proposed method optimized PRESENT and GIFT block ciphers by minimizing qubits, quantum gates, and circuit depth. We compare proposed PRESENT and GIFT quantum circuits with other results of lightweight block cipher implementations in quantum circuits. Finally, quantum resources of PRESENT and GIFT block ciphers required for the oracle of the [PERSON] search algorithm were estimated.  
Grover search algorithm; quantum circuits; PRESENT block cipher; GIFT block cipher 22 February 2021 May 2021 23 May 2021 2  
implemented the AES block cipher as a quantum circuit to evaluate the quantum resources required by the [PERSON]'s search algorithm [6]. Later, [PERSON] et al. and [PERSON] et al. implemented more compact quantum circuits than the [PERSON]'s implementation result [7; 8]. This is the result obtained by optimizing the Sbox operation that previously used a large amount of quantum resources. In addition to the AES block cipher, many studies on lightweight block ciphers have been conducted. [PERSON] et al. implemented the SIMON block cipher and evaluated quantum resources required by the Grover search algorithm [9; 10]. [PERSON] et al. implemented the SPECK block cipher as a quantum circuit to evaluated quantum gates for applying the [PERSON] search algorithm. In [11], the author implemented the Gimli cipher, as a quantum circuit to estimate the required quantum resources. In [12], [PERSON] et al. implemented the Korean lightweight block ciphers, including CAHM, LEA, and HIGHT as quantum circuits and estimated quantum resources.  
In this paper, we efficiently implemented PRESSINT and GIFT block ciphers as quantum circuits. Both PRESENT and GIFT block ciphers use Sbox to convert input values to other values. Classical computers can use a predefined Sbox that directly matches the output value depending on the input value. In quantum computers, all input values should coexist and it is impossible to use a predefined Sbox. Therefore, the operation of Sbox should be designed as quantum gates. In order to optimize the quantum circuit, it is important to optimize the Sbox operation. In order to implement the Sbox operation of PRESENT block cipher, the LIGHTER-R tool [13] was used to optimize the operation. The LIGHTER-R tool is described in Section 2. For GIFT block cipher, we chose the hardware-friendly Sbox to optimize the Sbox operation that requires a number of quantum resources. As a result of comparing the quantum circuit of SIMON (i.e., hardware friendly block cipher) and SPECK (i.e., software friendly block cipher) [9; 10], we confirmed that the hardware-friendly operation is also optimal for quantum computers. We saved a lot of qubits by implementing a hardware-friendly Sbox. In addition to the Sbox operation of PRESENT and GIFT block ciphers, AddRoundkey and Keyschedule were also optimized.  
Finally, we compare proposed PRESNET and GIFT quantum circuit implementations with other lightweight block cipher quantum circuit implementations with similar parameters and security levels. We estimated resources for applying the oracle of Grover's algorithm to PRESENT and GIFT symmetric key cryptography based on the proposed method.