# Optimized Implementation and Analysis of CHAM in Quantum Computing
## 2 Background  
### Description of CHAM  
CHAM [25] is a Korean lightweight block cipher that uses a stateless-based round key that targets low-end IoT platforms. It was announced at ICISC'17 and uses a stateless-based round key. This cipher uses the ARX operations (Addition, Rotation, eXclusive-or) and has advantages in a variety of resource-constrained environments. The CHAM family includes three ciphers: CHAM-64/128, CHAM-128/128, and CHAM-128/256 (here, the first parameter indicates the block size \(n\), and the second parameter indicates the key size \(k\)). In 2019, a paper that revised CHAM [26] by increasing the number of rounds was proposed to secure a sufficient security margin for CHAM. The revised CHAM is identical to the original CHAM except for the number of rounds. The cipher is also added to the Cryptography libraries [[https://www.cryptopp.com/wiki/CHAM](https://www.cryptopp.com/wiki/CHAM)]([https://www.cryptopp.com/wiki/CHAM](https://www.cryptopp.com/wiki/CHAM)) (accessed on 10 April 2023). In Table 1, the CHAM parameters \((n,k,w,r)\) are shown. The branch(word)'s bit length and the number of rounds are denoted, respectively, by \(w\) and \(r\). The first value of \(r\) in Table 1 represents the number of rounds in the original CHAM, while the second value represents the number of rounds in the revised CHAM.  
The round key \(RK=\{RK_{0},RK_{1},\ldots,RK_{2k/w-1}\}\) used in the \(i\)-th round of the key schedule is generated using the initial keyword \(K_{i}\), where \((0\leq i<k/w)\). \(k/w\) is the key size \(k\) divided by word size \(w\). In 64/128 and 128/256, \((k,w)\) is (128, 16), (256, 32), respectively, so \(k/w\) is 8, and 128/128 has (128, 32), so \(k/w\) is 4. In order to generate the round key \(RK\) of the key schedule, the following equation is used:  
\[\begin{split} RK_{i}=K_{i}\oplus(K_{i}\lll 1)\oplus(K_{i} \lll 8),\\ RK_{(i+k/w)\oplus 1}=K_{i}\oplus(K_{i}\lll 1)\oplus(K_{i} \lll 1).\end{split} \tag{1}\]  
In Equation (1), \(\lll\) indicates a left-rotation operator. The expression \(\lll\) 8 performs an operation where bits are shifted to the left by 8 bits, and the bits that fall off at the left edge are put back on the right edge.  
The \(n\)-bit block plaintext \(P\) is divided into four \(w\)-bit words and encrypted by repeating the number of rounds corresponding to the parameters in the Table 1. In this case, the operation is different depending on whether \(r\) is odd or even. More precisely, the overall structure is the same, but the number of rotations varies depending on whether it is odd or even.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Cipher** & \(n\) & \(k\) & \(w\) & \(r\) \\ \hline CHAM-64/128 & 64 & 128 & 16 & 80, 88 \\ CHAM-128/128 & 128 & 128 & 32 & 80, 112 \\ CHAM-128/256 & 128 & 256 & 32 & 96, 120 \\ \hline \hline \end{tabular}
\end{table}
Table 1: CHAM’s parameters.  
\[X_{i+1}[j]=X_{i}[j+1],(0\leq j\leq 2), \tag{2}\] \[X_{i+1}[3]=((X_{i}[0]\oplus i)\boxplus((X_{i}[1]\llldot 1)\oplus RK_{i\,mod\,2m}))\llldot a.\]  
The round function is shown in Equation (2) for \(0\leq i<r\), and if \(i\) is even, \(a\) is \(8\); otherwise, \(a\) is \(1\). In Equation (2), \(x\boxplus y\) means addition of \(x,y\) modulo \(2^{w}\).  
[PERSON] et al. [24] optimized quantum circuits for the Korean lightweight block ciphers CHAM, LEA, and HIGHT. In that paper [24], an improved quantum adder [27] is applied, and parallel structure is used by allocating additional (ancilla) qubits in order to reduce in terms of circuit depth. Compared to the results of a previous paper [28], which first implemented CHAM as a quantum circuit, the performance improved by 70%. Although optimized by changing the structure of CHAM to a parallel structure, the round key generation part is the same as in the previous paper [28].