# SPEEDY Quantum Circuit for Grover's Algorithm
###### Abstract  
In this paper, we propose a quantum circuit for the SPEEDY block cipher for the first time and estimate its security strength based on the post-quantum security strength presented by NIST. The strength of post-quantum security for symmetric key cryptography is estimated at the cost of the [PERSON] key retrieval algorithm. [PERSON]'s algorithm in quantum computers reduces the \(n\)-bit security of block ciphers to \(\frac{n}{2}\) bits. The implementation of a quantum circuit is required to estimate the [PERSON]'s algorithm cost for the target cipher. We estimate the quantum resource required for [PERSON]'s algorithm by implementing a quantum circuit for SPEEDY in an optimized way and show that SPEEDY provides either 128-bit security (i.e., NIST security level 1) or 192-bit security (i.e., NIST security level 3) depending on the number of rounds. Based on our estimated cost, increasing the number of rounds is insufficient to satisfy the security against quantum attacks on quantum computers. G 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 2022 20222 2022 22022 22022 2022 20222 20222 2022 20222 22022 20222 20222 2022 20222 2022 22022 20222 202 SPEEDY provides 128 bits of security when \(r=6\) and achieves full security of 192 bits at \(r=7\). In this paper, we implement the SPEEDY block cipher as a quantum circuit and check the post-quantum security strength by estimating the resources to be applied to [PERSON]'s algorithm. To the best of our knowledge, this is the first implementation of SPEEDY in quantum circuits. [PERSON]'s algorithm operates by repeating oracle and diffusion operations, and the quantum circuit of the target cipher is essential in oracle. We used the proposed quantum circuit to estimate the quantum resources needed for [PERSON]'s algorithm. Furthermore, we decomposed the estimated resource into the lower-level \(Clifford+T\) gate to check the post-quantum security strength. We estimated the quantum resource by increasing \(r\) to see how the number of rounds affects the post-quantum security strength. SPEEDY-7-192 provided 192-bit security on classic computers, but showed a security strength of level 1 (i.e., the AES-128 level) on quantum computers. The post-quantum security strength did not increase even after a larger increase in rounds. In other words, estimating the quantum cost according to various rounds, it was confirmed that SPEEDY provided level 1 (AES-128) post-quantum security, and that the increase in rounds did not significantly affect the quantum security strength. Our results show that increasing the number of rounds can improve security for classical computers, but it is not enough for quantum computers. Finally, it was confirmed through comparison with other lightweight ciphers (i.e., LEA, CHAM, HIGHT, and PIPO) that the increase in rounds did not significantly affect the post-quantum security strength and that increasing the key length affects the security strength. We used IBM's ProjectQ platform to implement and simulate quantum circuits. Contributions of This Paper
* Implementation of the first quantum circuit for SPEEDY block cipher: To the best of our knowledge, this is the first quantum circuit implementation of SPEEDY. In the S-box implementation, an efficient Algebraic Normal Form (ANF) S-box was adopted in terms of quantum resources to reduce quantum resources, and separate quantum resources were not used through logical swap in ShiftColumns and Key Schedule. * Estimating the cost of Grover key search for SPEEDY: We estimated the Grover algorithm's quantum resource for the SPEEDY block cipher. Estimated quantum resources are decomposed into a lower-level \(Clifford+T\) gate to lay the foundation for quantum security level analysis. Finally, we confirmed the post-quantum security strength through quantum cost calculation. * Post-quantum security evaluation and analysis of SPEEDY block cipher: We evaluated post-quantum security for SPEEDY based on the Grover key retrieval cost presented by NIST.