[Paper Review] Applying Grover's algorithm to AES: quantum resource estimates

Markus Grassl, Brandon Langenberg+2 more|arXiv (Cornell University)|Dec 15, 2015

Quantum Computing Algorithms and Architecture23 references4 citations

TL;DR

This paper provides detailed quantum resource estimates for applying Grover's algorithm to break the Advanced Encryption Standard (AES) using fault-tolerant Clifford+T quantum gates. It presents reversible quantum circuits for AES-128, AES-192, and AES-256, estimating that breaking AES-128 would require approximately 2.95k logical qubits and 1.19×2⁸⁶ T-gates, with exponentially increasing costs for longer keys, highlighting the challenge of depth despite moderate qubit requirements.

ABSTRACT

We present quantum circuits to implement an exhaustive key search for the Advanced Encryption Standard (AES) and analyze the quantum resources required to carry out such an attack. We consider the overall circuit size, the number of qubits, and the circuit depth as measures for the cost of the presented quantum algorithms. Throughout, we focus on Clifford$+T$ gates as the underlying fault-tolerant logical quantum gate set. In particular, for all three variants of AES (key size 128, 192, and 256 bit) that are standardized in FIPS-PUB 197, we establish precise bounds for the number of qubits and the number of elementary logical quantum gates that are needed to implement Grover's quantum algorithm to extract the key from a small number of AES plaintext-ciphertext pairs.

Motivation & Objective

• To provide precise fault-tolerant quantum resource estimates for breaking AES using Grover’s algorithm.
• To design reversible quantum circuits for all three AES key sizes (128, 192, 256 bits) that support fault-tolerant implementation.
• To decompose these circuits into Clifford+T gate sets and minimize T-count and T-depth for practical fault-tolerant quantum computation.
• To analyze the trade-offs between space (qubits) and time (circuit depth) in Grover’s search for AES key recovery.
• To establish that AES-256 may be quantum-safe due to prohibitive resource costs, even with quantum speedup.

Proposed method

• Constructing reversible classical circuits for AES encryption, ensuring all operations are unitary and reversible for quantum implementation.
• Decomposing the reversible circuits into Clifford+T gate sets, with Toffoli gates realized using 7 T-gates and ancilla qubits.
• Optimizing T-count by leveraging known Toffoli decompositions and minimizing T-gate usage in SubBytes and key expansion components.
• Estimating the cost of the oracle function U_f for Grover’s algorithm, including multiply-controlled NOT gates for comparing ciphertexts.
• Calculating the total number of Grover iterations as ⌊π/4 × 2^(k/2)⌋ for key size k, and scaling T-gate and depth costs accordingly.
• Using circuit depth and qubit count as primary metrics, with detailed breakdowns for each AES variant.

Experimental results

Research questions

• RQ1 What is the exact number of logical qubits required to implement Grover’s algorithm for breaking AES-128, AES-192, and AES-256 using fault-tolerant Clifford+T gates?
• RQ2 How many T-gates and Clifford gates are needed to implement the AES encryption function and the full Grover oracle for each key size?
• RQ3 What is the circuit depth of the full Grover iteration, and how does it scale with key size?
• RQ4 Can the key expansion process be optimized to reduce T-gate count in the overall quantum circuit?
• RQ5 To what extent does the exponential increase in T-gate count make AES-256 practically secure against quantum key search?

Key findings

• Breaking AES-128 using Grover’s algorithm requires approximately 2,953 logical qubits and 1.19×2⁸⁶ T-gates, with a total circuit depth of about 1.16×2⁸¹ T-gate operations.
• For AES-192, the resource cost increases to 4,449 logical qubits and 1.81×2¹¹⁸ T-gates, reflecting the exponential scaling of Grover’s search.
• AES-256 requires 6,681 logical qubits and an estimated 1.41×2¹⁵¹ T-gates, making it infeasible with current or near-future quantum hardware.
• The majority of the T-gate cost arises from the key expansion process, which is called 296 to 420 times depending on the key size.
• Despite moderate qubit requirements, the extreme circuit depth makes implementation on physical quantum computers impractical, even without error correction.
• The results suggest that AES-256 remains quantum-safe under Grover’s algorithm due to the prohibitive T-gate and depth requirements.