## 2 Methods  
Here, we describe two methods of transforming the cryptographic problem into the MILP or QUBO. We start our presentation with the approach introduced in Section 2.1. This approach is a novel method representing the Boolean function as one linear equation in terms of the original binary variables and, possibly, ancillary binary variables that become additional variables of the obtained MILP problem. The innovative feature of the approach is its increase in the number of binary variables of the ILP problems. Ordinarily, it is believed to even rise the computational complexity of the ILP problem, at least for the generic ILP solvers. However, the emerging quantum annealers (QA) have inspired an upsurge in the interest for constraints in the \"equation form\" because they may be directly converted to summands of the objective function of the QUBO problems, which suit the QA [4; 5]. For a given Boolean function, this method is based on solving the special CP programming problems with the quadratic objective function. On the contrary, the second method formulated in Section 2.2 provides a uniform approach to generating an irreducible system of linear inequalities for any Boolean function.  
In contrast to the past study [6], based on the Grover algorithm [7] allowing for quadratic improvement, where a pre-image attack on hash functions using gate-based approach on universal quantum computers was touched upon, we propose to solve the same problem using quantum annealing devices, which offers an advantage of the possibility of utilizing more qubits.  
For a Boolean function depending on the big number of binary variables, both methods may become rather time consuming. The approach enabling the speeding up both methods in the case where a given Boolean function is a composite of the set of Boolean functions defined on a smaller number of variables is described in Section 2.4. Computing the complexity of building the system of linear equations and inequalities for Boolean functions is not a crucial obstacle for the approach. The point is that every cryptography algorithm is based on a fixed set of Boolean functions and building the linear inequalities for them should be done only once. In other words, for creating the system of equations or inequalities, we use numerical approaches for every considered algorithm.  
Both proposed methods may be used for representing important cryptanalysis problems, such as the pre-imaging of hash functions or breaking symmetric ciphers, as the MILP problems, which are solved by the generic MILP solvers. For the case of the first method using emerging quantum solvers, more details will be given in Section 2.5. In Section 3, the first, \"equation and binary ancillas\", method is demonstrated for the MD5 and SHA-265 hash functions. Moreover, we consider the symmetric block cipher AES in Section 3.4.  
\begin{table}
\begin{tabular}{c c l l} \hline \hline  & **Formula** & **Systems of Linear Inequalities** & **Linear Equation** \\ \hline AND & \(x/y=z\) & \(\{z\leqslant x,\;z\leqslant y,\;z\geqslant x+y-1,\;z\geqslant 0\}\) & \(x+y-2z-a=0\) \\ OR & \(x\lor y=z\) & \(\{x\leqslant z,\;y\leqslant z,\;z\leqslant x+y,\;z\leqslant 1\}\) & \(x+y-2z+a=0\) \\ XOR & \(x\oplus y=z\) & \(\{z\leqslant x+y,\;z\geqslant x-y,\;z\geqslant y-x,\;z\leqslant 2-x-y\}\) & \(x+y-z-2a=0\) \\ NOR & \(\overline{x}\lor\overline{y}=z\) & \(\{x\leqslant 1-z,\;y\leqslant 1-z,\;1-2\leqslant x+y,-z\leqslant 0\}\) & \(x+y+2z-a=1\) \\ NAND & \(\overline{x}\lor\overline{y}=z\) & \(\{1-z\leqslant x,\;1-z\leqslant y,\;-z\geqslant x+y-2,\;1-z\geqslant 0\}\) & \(x+y+2z-a=2\) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Systems of linear inequalities and linear equations for basic Boolean functions.