⚛️ quantum physics

Qubit Optimized Quantum Implementation of SLIM

This paper presents a novel, qubit-optimized quantum implementation of the SLIM lightweight block cipher that achieves resource efficiency and robust cryptographic strength through a minimal qubit design, positioning it as a viable candidate for quantum-resistant encryption protocols.

Original authors: Hasan Ozgur Cildiroglu, Oguz Yayla

Published 2026-04-17

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hasan Ozgur Cildiroglu, Oguz Yayla

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

🛡️ The Quantum Locksmith: A New Way to Secure Data

Imagine you have a very special, lightweight padlock (called SLIM) used to secure your digital diary. For a long time, this padlock was considered safe because the math behind it was too hard for regular computers to break.

However, a new type of super-computer called a Quantum Computer is being built. Think of a quantum computer not as a faster calculator, but as a "magic key" that can try every possible combination of a lock simultaneously. If this magic key arrives, many of our current digital locks (like those used for banking or emails) will shatter instantly.

The authors of this paper asked a big question: "Can we build a quantum version of our lightweight padlock (SLIM) that is so efficient, it doesn't need a massive amount of resources to run, yet remains unbreakable?"

Here is how they did it, broken down into simple concepts:

1. The Problem: The "Copy-Paste" Trap

To make a quantum computer do a job, you usually need to copy data around. Imagine you are trying to solve a maze. In a normal computer, you can photocopy the map, try a path, and if it's wrong, throw the copy away.

In the quantum world, you can't just "photocopy" the data (a rule called the No-Cloning Theorem). To get around this, scientists usually use extra "helper" particles called Ancilla Qubits.

The Old Way: Imagine you are trying to walk through a maze, but you need to bring a new backpack for every single turn you take. If the maze has 32 turns, you need 32 backpacks. This is heavy, expensive, and hard to carry.
The Paper's Goal: They wanted to walk through the maze without any extra backpacks.

2. The Solution: The "Feistel" Magic Trick

The SLIM cipher uses a structure called Feistel. Think of this like a dance where two partners (let's call them Lefty and Righty) hold hands.

Lefty does a complicated dance move based on a secret key.
Righty swaps places with Lefty.
They repeat this 32 times.

The magic of this dance is that the steps are reversible. If you know the moves, you can dance backward to get back to the start.

The Authors' Innovation:
Instead of using extra "backpacks" (ancilla qubits) to remember the steps, they realized they could just dance backward to reset the system for the next round.

Analogy: Imagine you are painting a wall. Usually, you'd need a second bucket of paint to mix colors before you start the next section. The authors realized they could just wash the brush and reuse the same bucket by reversing the mixing process.
Result: They built the entire quantum circuit using 112 qubits (the quantum equivalent of bits) and zero extra helper qubits. This is the smallest number of qubits ever used for a cipher of this type.

3. The Three Layers of the Lock

To make the lock work, they had to translate three specific parts of the SLIM algorithm into quantum language:

The Key Layer (K): This is where the secret password is mixed in.
- Analogy: Like adding a secret spice to a soup. In the first few rounds, the spice is added directly. In later rounds, the spice is mixed, stirred, and chopped up in a specific pattern. The authors built a quantum machine that does this chopping perfectly.
The Substitution Layer (S): This scrambles the data to make it look like gibberish.
- Analogy: Like a secret codebook where the letter "A" is always replaced by "Z". They used a highly efficient "codebook" (S-box) that was already optimized to be small and fast, ensuring no extra space was wasted.
The Permutation Layer (P): This shuffles the data around.
- Analogy: Like taking a deck of cards and shuffling them. In the quantum world, this is done by swapping the positions of the qubits. The authors found a way to do this "shuffle" that costs zero energy (zero quantum cost) because it's just a swap, not a calculation.

4. The Results: A Lightweight Champion

The team calculated the "cost" of running this lock on a quantum computer.

Qubit Count: They used 112 qubits. Compare this to other famous locks (like SIMON or SM4) which need 192, 256, or even 260 qubits. SLIM is the "featherweight" champion.
Efficiency: By not using extra helper qubits, they saved a massive amount of resources, even though the math to reverse the steps was slightly more complex.
Depth: The "depth" is how many steps the computer has to take in a line. SLIM took about 4,066 steps. While that sounds like a lot, it is actually very efficient compared to other locks that require tens of thousands of steps.

🌟 The Big Picture

Why does this matter?

We are entering an era where quantum computers will exist. If we don't prepare, our current digital security will vanish. This paper shows that SLIM is a perfect candidate for the future. It is:

Lightweight: It doesn't need a massive quantum computer to run (it fits on smaller, current machines).
Secure: It is designed to resist the "magic key" attacks of quantum computers.
Efficient: It uses the least amount of "fuel" (qubits) to do the job.

In a nutshell: The authors took a small, efficient digital lock, figured out how to run it on a quantum computer without needing extra "spare parts," and proved that it's a strong, secure, and resource-friendly choice for protecting our data in the quantum future.

1. Problem Statement

The advent of quantum computing poses a severe threat to classical cryptographic systems, particularly public-key cryptosystems relying on prime factorization and discrete logarithms (vulnerable to Shor's algorithm). While symmetric block ciphers (BCs) are generally considered more resilient, their security against quantum attacks (e.g., Grover's algorithm) requires rigorous assessment.

Existing quantum implementations of lightweight block ciphers often suffer from high resource overhead, specifically regarding the number of qubits and quantum gates required. Many implementations rely on ancilla qubits (auxiliary qubits initialized to $|0\rangle$ ) to store intermediate states during encryption rounds. As current quantum hardware is limited by qubit count and coherence times, these resource-heavy implementations are impractical for near-term deployment. There is a critical need for quantum implementations of lightweight ciphers that minimize qubit usage while maintaining cryptographic robustness.

2. Methodology

The authors propose a novel, resource-optimized quantum circuit implementation of SLIM, a lightweight Feistel-based block cipher designed for 32-bit plaintext blocks and an 80-bit key. The methodology focuses on minimizing qubit requirements through a specific architectural strategy:

Feistel Structure Exploitation: Instead of duplicating data states using ancilla qubits for subsequent rounds (a common but costly approach), the authors leverage the reversible nature of the Feistel structure.
Reverse KSP Strategy: To prepare the system for the next round without duplicating qubits, the authors implement the inverse of the Key-Addition-Substitution-Permutation (KSP) layers ( $KSP^{-1}$ ). This allows the system to "uncompute" or revert the state of the lower branch, effectively reusing the same physical qubits for the next round's input.
Component Implementation:
- Key Schedule (K): Implemented using CNOT, NOT, and CCNOT (Toffoli) gates. For rounds $i > 5$ , the key schedule involves bit shifts and XOR operations. The authors note that the inverse key addition ( $K^{-1}$ ) is identical to the forward operation ( $K$ ) due to the reversibility of these specific operations.
- Substitution (S): The 4-bit S-box (identical to PRESENT) and its inverse ( $S^{-1}$ ) are synthesized using the LIGHTER-R framework. This tool optimizes reversible circuits to minimize gate count and eliminate the need for ancilla qubits.
- Permutation (P): The P-box and $P^{-1}$ are implemented using SWAP gates, which incur zero quantum cost in terms of gate complexity.
Circuit Construction: The 32-bit input is split into two 16-bit halves (Upper $U$ and Lower $D$ ). The algorithm proceeds through 32 rounds where the $D$ branch undergoes KSP, interacts with $U$ via CNOT, and then the system applies $KSP^{-1}$ to reset the state for the next iteration.

3. Key Contributions

First Quantum Implementation of SLIM: This work presents the inaugural quantum circuit design for the SLIM cipher.
Minimal Qubit Footprint: The implementation achieves a total requirement of 112 qubits. This is the lowest qubit count reported for block ciphers in the 64–128 bit class (SLIM uses a 32-bit block but is compared against 64/128-bit ciphers in literature).
Ancilla-Free Design: A major contribution is the elimination of ancilla qubits. By using the $KSP^{-1}$ strategy to reverse the state, the authors avoid the exponential qubit cost associated with storing intermediate states for multiple rounds.
Optimized Gate Synthesis: The use of the LIGHTER-R framework for S-box synthesis ensures a highly optimized gate count and depth, balancing non-linearity with resource efficiency.

4. Results

The authors provide a comprehensive cost analysis comparing their SLIM implementation against other prominent lightweight block ciphers (SIMON, RECTANGLE, LBLOCK, LiCi, PUFFIN, PRINT, SM4).

Qubit Count: SLIM requires 112 qubits, significantly lower than competitors like SIMON (192–256 qubits) and SM4 (260 qubits).
Quantum Cost (Gate Count):
- Total Quantum Cost: 27,220 units.
- Breakdown: The cost is calculated based on standard metrics (NOT=1, CNOT=1, CCNOT=5).
- Note on Trade-off: The paper acknowledges that if ancilla qubits were used to eliminate the need for $KSP^{-1}$ (reversing the process), the total cost would drop to ~14,426. However, the authors prioritize the 112-qubit constraint over gate count reduction, as qubit availability is the current bottleneck in quantum hardware.
Circuit Depth: The total circuit depth is 4,066. While deeper than some ancilla-heavy implementations, it remains competitive given the strict qubit constraints.
Comparative Performance: As shown in Table 2 of the paper, SLIM offers the best balance between qubit efficiency and computational cost among the analyzed ciphers. For instance, while SM4 has a massive cost of 276,782 and requires 260 qubits, SLIM achieves its goal with 112 qubits and a cost of 27,220.

5. Significance

This research is significant for the development of Post-Quantum Cryptography (PQC) and Lightweight Cryptography:

Feasibility for NISQ Era: By drastically reducing the qubit count, this implementation makes the analysis and potential deployment of lightweight encryption on Near-Term Intermediate Scale Quantum (NISQ) devices more feasible.
Resource Efficiency: It demonstrates that high security (80-bit key, 32-bit block) can be maintained without the prohibitive resource overhead typically associated with quantum circuit synthesis.
Strategic Design Pattern: The "reverse KSP" methodology offers a blueprint for implementing other Feistel-based ciphers where qubit conservation is prioritized over gate minimization.
Security Assessment: The study provides a baseline for assessing SLIM's resilience against quantum attacks, confirming its viability as a candidate for quantum-resistant encryption protocols in IoT and RFID applications.

In conclusion, the paper successfully bridges the gap between lightweight classical cryptography and quantum implementation constraints, proving that SLIM is a highly efficient candidate for the quantum era due to its minimal qubit footprint and ancilla-free architecture.