# [PERSON] on Korean Block Ciphers
## 3 Proposed Method
### Hight
#### 3.1.2 Round Function  
In HIGHT, before proceeding to the round function, the plaintext \(T\) is initially converted using the whitening key as shown in Equation (4). The quantum circuit design for this is in Algorithm 3. ```
0:\(T,K\)
0:\(X_{0}\)
1:\(X_{0}[i]\gets T[i],\quad i=1,3,5,7\)
2:\(X_{0}[0]\leftarrow\)ADD(\(K[12],T[0]\))
3:\(X_{0}[2]\leftarrow\)CNOT(\(K[13],T[2]\))
4:\(X_{0}[4]\leftarrow\)ADD(\(K[14],T[4]\))
5:\(X_{0}[6]\leftarrow\)CNOT(\(K[15],T[6]\))
6:return\(X=\{X_{0}[0],X_{0}[1],\ldots,X_{0}[7]\}\)
```  
**Algorithm 3** Initial conversion of HIGHT. We optimized the round function by properly specifying the operation target and order in the round function. The detailed process for this is described in Algorithm 4 and explained in detail. ```
0: Round \(i\), \(X_{i-1},RK\)
0:\(X_{i}\)
1:First, operation:
2:\(X_{i-1}[0]\gets F_{0}(X_{i-1}[0])\)
3:\(X_{i-1}[0]\leftarrow\)CNOT(\(RK[4i-4],X_{i-1}[0]\))
4:\(X_{i}[2]\leftarrow\)ADD(\(X_{i-1}[0],X_{i-1}[1]\))
5:\(X_{i-1}[0]\leftarrow\)CNOT(\(RK[4i-4],X_{i-1}[0]\)) (reverse)
6:\(X_{i-1}[0]\gets F_{0\_\_\_}\)reverse(\(X_{i-1}[0]\))
7:Second operation:
8:\(X_{i-1}[2]\gets F_{0}(X_{i-1}[2])\)
9:\(X_{i-1}[2]\leftarrow\)ADD(\(RK[4i-3],X_{i-1}[2]\))
10:\(X_{i}[4]\leftarrow\)CNOT(\(X_{i-1}[2],X_{i-1}[3]\))
11:\(X_{i-1}[2]\leftarrow\)ADD(\(RK[4i-3],X_{i-1}[2]\)) (reverse)
12:\(X_{i-1}[2]\gets F_{0\_\_}\)reverse(\(X_{i-1}[2]\))
13:Third operation:
14:\(X_{i-1}[4]\gets F_{0}(X_{i-1}[4])\)
15:\(X_{i-1}[4]\leftarrow\)CNOT(\(RK[4i-2],X_{i-1}[4]\))
16:\(X_{i}[6]\leftarrow\)ADD(\(X_{i-1}[4],X_{i-1}[5]\))
17:\(X_{i-1}[4]\leftarrow\)CNOT(\(RK[4i-2],X_{i-1}[4]\)) (reverse)
18:\(X_{i-1}[4]\gets F_{0\_\_}\)reverse(\(X_{i-1}[4]\))
19:Fourth operation:
20:\(X_{i-1}[6]\gets F_{0}(X_{i-1}[6])\)
21:\(X_{i-1}[6]\leftarrow\)ADD(\(RK[4i-1],X_{i-1}[6]\))
22:\(X_{i}[0]\leftarrow\)CNOT(\(X_{i-1}[6],X_{i-1}[7]\))
23:\(X_{i-1}[6]\leftarrow\)ADD(\(RK[4i-1],X_{i-1}[6]\)) (reverse)
24:\(X_{i-1}[6]\gets F_{0\_\_}\)reverse(\(X_{i-1}[6]\))
25:Last operation:
26:\(X_{i}[j]=X_{i-1}[j-1],\quad j=1,3,5,7\)
27:return\(X_{i}=\{X_{i}[0],X_{i}[1],\ldots,X_{i}[7]\}\)
```  
**Algorithm 4** Round function of HIGHT. In particular, through the optimization of the auxiliary function \(F_{0}\) and \(F_{1}\), no additional qubit was used, and the use of the CNOT gate was also reduced. First, since the \(RK\) must be used immediately after generation, and then returned to the initial \(K\) by a reverse operation, the operation of the round function proceeds in the order of generation of the \(RK\). Second, in order not to use additional qubits, the new \(X_{i}\) must operate on the existing \(X_{i-1}\). However, if you look at the first and third lines of Equation (6) and second line of Algorithm 4, you can see that the value of \(X_{(i-1)}[0]\), which is first calculated in the round function, is used again. Thus, \(X_{i-1}[0]\) value should not be changed. However, \(X_{i-1}[1]\) is no longer used after calculation. Therefore, by calculating the value of \(X_{i}[2]\) in \(X_{i-1}[1]\), no additional qubits were required. The rest of the round function follows the similar procedure. The specific process is presented in Algorithm 4. The auxiliary functions \(F_{0}\) and \(F_{1}\) rotate the input value and then XOR-ing them all. Since input value is 8-bit, if qubits for the generated value are allocated and then XOR-ing the rotation value of input, this requires \(8\times 3=24\) CNOT gates and 8 new qubits. We efficiently optimized this auxiliary function. The desired output was generated by mixing the input values without allocating the qubits for the outputs of \(F_{0}\) and \(F_{1}\). As a result, 21 CNOT gates in \(F_{0}\) and 24 CNOT gates in \(F_{1}\) were implemented without additional qubits. The detailed process for \(F_{0}\) and \(F_{1}\) functions is presented in Algorithms 5 and 6.