# Optimized Implementation and Analysis of CHAM in Quantum Computing
## 3 Quantum Implementation of CHAM
### Fse'20
Comparing Tables 2 and 3, FSE'20 shows improvements in qubits by 7.9%, depth by 2.2%, and number of CNOT gates by 0.7%. When considering the maintenance of the number of #lgCliffod, #\(T\), and \(T\)-depth, it can be observed that the FSE'20 method significantly conserves quantum resources. Comparing the two methods, PLU factorization shows an increase in the values of the rest of the indicators except for qubits, while most of the values in FSE'20 decrease, and shows improvement. Based on these results, FSE'20 can be considered as the most optimal method. Since circuit depth is related to speed and time, the reduction in circuit depth in FSE'20 suggests an improvement in the execution speed of CHAM. In addition, considering a low-power environment with limited quantum computers and resources, reducing the number of gates and qubits through FSE 20 increases the feasibility of the circuit by correspondingly reducing the demand on resources. However, FSE'20 has a limitation that it cannot be used for linear layer matrices larger than 32 \(\times\) 32. For CHAM, the matrix for the largest instances (i.e., CHAM-128/256) is 32 \(\times\) 32, so we could have used this method, but we cannot use this method for ciphers with matrices larger than this. \(T\)-counts and \(T\)-depth are related to the Toffoli gate used in the quantum circuit of CHAM for the adder. The adder is not used in the key-schedule step that we optimized; therefore, all three methods have the same values for \(T\)-counts and \(T\)-depth in Table 4. Furthermore, #lgCliff also has the same value for all three methods as only the CNOT gate is utilized in the key-schedule phase. ## 5 Cost Estimate for Grover Key Search

The two components of [PERSON]'s algorithm are the oracle, which finds a solution, and the diffusion operator, which increases the amplitude of the solution. The diffusion operator has a very low overhead and doesn't require any special implementation methods. So, the cost for the [PERSON]'s algorithm is estimated using just the quantum resources needed for the oracle in the majority of cases [14; 16; 20; 22; 34]. The efficiency of the implemented quantum circuit determines the quantum resources of the oracle. The oracle operates encryption and reverse operations sequentially. Since the CHAM quantum circuit is applied to each operation, the cost of using the oracle once is (Table 4 \(\times\) 2) when \(R=\lceil k/n\rceil\) (key size/block size) is 1 except for qubits. If \(R\) is 2, since there are 2 encryption and reverse operation pairs, there are 4 operations in total, so it is multiplied by 4. The effectiveness of the quantum circuit determines the performance of the Grover key search. Although it is well known that the [PERSON]'s algorithm needs to be iterated \(\sqrt{2^{n}}\) times to recover the \(n\)-bit key, a detailed analysis of [35] suggests that it is optimal to repeat the [PERSON]'s algorithm \(\lfloor\frac{\pi}{4}\cdot\sqrt{2^{n}}\rfloor\) times. Thus, the cost of the Grover key search is calculated as (Table 4\(\times\) 2 \(\times\) \(\lfloor\frac{\pi}{4}\cdot\sqrt{2^{n}}\rfloor\)) without the number of qubits. This means repeating Oracle by \(\lfloor\frac{\pi}{4}\cdot\sqrt{2^{n}}\rfloor\). Table 5 shows the quantum resources required for Grover key search for CHAM with various methods applied. That is, the costs shown in Table 5 represent the resources needed for a [PERSON]'s key search attack, and this resource requirement depends on the complexity of the oracle. The costs in Table 5 are used to determine how secure a CHAM cipher is in a quantum computing environment. NIST security is based on the post-quantum security strength specified by NIST, and the Grover attack costs of AES-128, -192, and -256 are \(2^{170},2^{233}\), and \(2^{298}\), respectively. The lowest security level for encryption algorithms is 1 (corresponds to that of AES-128), and the level increases as the key size increases.