## 4 Discussion and Conclusions  
We developed the methods for representing any Boolean function as a set of constraints in the mixed-integer linear programming and quadratic unconstrained binary optimization problem with the binary and continuous auxiliary variables. In particular, we investigated the possibility of applications of the developed method for the solution of the cryptographic problems known as a pre-image attack on the hash function, such as the MD5 and SHA256. The first method represents the Boolean function as one linear equation in the original binary variables and, possibly, ancillary binary variables, which become additional variables of the obtained MILP problem. The method is based on the successive solving of a set of special integer CP problems until the coefficients of the desired linear equation are obtained. Any standard ICP solver may be used; we used the CPLEX solver. The second method represents the Boolean function as a set of linear inequalities in the original binary variables and one additional continuous variable (representing the value of the function). The method is based on identifying the Boolean function (on \(n\) binary variables) with the kind of graphical representation, i.e., the set of \(2^{n}\) points of the unit cube in \(\mathbb{R}^{n+1}\). Then, these points are treated as vertices of a convex polyhedron in \(\mathbb{R}^{n+1}\). To obtain the desired system of linear inequalities, the \(V\)-representation of this polyhedron should be \begin{table}
\begin{tabular}{c c c} \hline \hline  & **MD5** & **SHA-256** \\ \hline Original & 224 & 415 \\ Chimera & 943.2 & - \\ Pegasus & 461.1 & 1205.9 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Average number of qubits after embedding for different graphs at D-Wave for one round of hash functions. In the SHA-256 case, D-Wave did not find embedding on the Chimera graph. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**MDS5** & **SHA-256** & **AES-128** & **AES-192** & **AES-256** \\ \hline
17,280 & 47,808 & \(\approx\)90,000 & \(\approx\)2 \(\cdot\) 100,000 & \(\approx\)2 \(\cdot\) 125,000 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparing table of problems size. converted into \(H\)-representation, a set of affine half-spaces of polyhedron facets, i.e., a set of the affine inequalities (one inequality per each affine half-space). For this conversion, we used the LRS application [13], which is a general purpose tool for polyhedron handling. Note that the first method gives fewer constraints (only one equation per Boolean function) but more ancillary binary variables, while the second method does not require any additional binary variables but instead requires a number of additional linear inequalities. The final decision on the choice between the either first or second method is a trade-off between the number of binary variables and the number of linear constraints in the obtained MILP problem. Both methods can be used for reformulating the important cryptanalysis problems (pre-imaging of hash functions or breaking symmetric ciphers) based on the Boolean expressions for the MILP problems. Moreover, these methods are applied for formulating the QUBO, deriving it from the given Boolean function (see also [4; 5]) and can be used as alternative methods for generating the QUBO with a low number of bits. Note that for the quantum annealers, the first method is preferable, because most promising quantum annealers proceed along the special type of optimization problems, namely the quadratic unconstrained binary optimization one. The straightforward approach to transform the MILP problem into the QUBO is to convert the linear constraints into the quadratic penalties known as summands of the QUBO problem criterion. Conceptualization, A.I.P., V.V.V., V.M.V. and G.B.L. ; methodology, A.I.P. and V.V.V. ; software, A.I.P. ; validation, A.I.P. and V.V.V. ; formal analysis, A.I.P. and V.V.V. ; investigation, A.I.P. and V.V.V. ; resources, A.I.P. and V.V.V. ; data curation, A.I.P., V.V.V.