Some efficient quantum circuit implementations of Camellia

In this paper, we propose some new methods to reduce the time and memory cost in our quantum circuit implementations of Camellia block cipher. Firstly, we present some new quantum circuits of Camellia’s S-box, which are based on our improved classical circuit of Camellia’s S-box. That is, we not only propose an improved classical circuit of Camellia’s S-box by using the tower field architecture, but also explore the linear relationship between different parameters in Camellia’s S-box. Based on our improved classical circuit of Camellia’s S-box, we can reduce the number of qubits and the T -depth in the quantum circuit of Camellia’s S-box. Secondly, we propose a new in-place implementation of the inverse linear layer of Camellia, which can be used to construct an efficient quantum circuit of the Feistel–SPN structure in Camellia. To sum up, our quantum circuit implementations of Camellia-128/-192/-256 with fewer qubits only require 391/647/647 qubits, while the T -depth of our depth-efficient quantum circuits of Camellia-128/-192/-256 are 114/156/156.