Applying Grover’s Algorithm to AES: Quantum Resource Estimates

Abstract

Abstract. We present quantum circuits to implement an exhaustive key search for the Advanced Encryption Standard (AES) and analyze the quantum resources required to carry out such an attack. We consider the overall circuit size, the number of qubits, and the circuit depth as measures for the cost of the presented quantum algorithms. Throughout, we focus on Clifford+T gates as the underlying fault-tolerant logical quantum gate set. In particular, for all three variants of AES (key size 128, 192, and 256 bit) that are standardized in FIPS-PUB 197, we establish precise bounds for the number of qubits and the number of elementary logical quantum gates that are needed to implement Grover's quantum algorithm to extract the key from a small number of AES plaintext-ciphertext pairs.

Quantum Attacks Without Superposition Queries: The Offline Simon’s Algorithm

“…Although it is difficult to estimate the cost of a physical implementation which does not yet exist, we can compare security levels as quantum operation counts in this model. For example, Grover search of the secret key for AES-128 is known to require approximately 2 64 quantum evaluations of the cipher, and 2 84 quantum operations [21].…”

Time–space complexity of quantum search algorithms in symmetric cryptanalysis: applying to AES and SHA-2

“…Random statistics of the target function are carefully handled which lead to increase in iteration number compared with the case of unique target. Surprisingly, however, the cost of dealing with random statistics in this paper is not expensive compared with the previous work [27] under single processor assumption. Furthermore, when processor parallelization is considered, we observed that this extra cost gets even more negligible.…”

“…AES Key Search. Grassl et al reported the quantum costs of AES-k key search for k ∈ {128, 192, 256} in the units of logical qubit and gate [27]. In estimating the time cost, the author's focus was put on a specific gate called 'T' gate and its depth, although the overall gate count was also provided.…”

Universal Optimality of Apollonian Cell Encoders

“…Note however that such complexity results are currently unproven, and may be weakened by technological progress. For instance, Shor's algorithm and quantum computing are effective for integer factorization [1], Grover's algorithm and quantum computing can be used against AES [2], and memcomputing has been proved to be effective to solve subset sum [3].…”