 Hello everyone, I'm Jianzhou. The title of this presentation is Quentin Circuit Implementation of AES with PhilQbit. The motivation of this work is to reduce the memory cost of our Quentin Circuit of AES. So, let's begin. In the first, we want to introduce some background knowledge. Different from the classical circuit, Quentin Circuit requires reversible gate. That is, we should not only to keep the input message X, but also need to copy the output value fx to the new qubit y. In this paper, we adopt the following four Quentin gates in our Quentin Circuit of AES. The first is the NOT gate. The NOT gate has one input and one output. If the input is zero, then the output is one, and vice-versa. The second is the CNOT gate. The CNOT gate is the reversible equivalent of an XOR gate. The third is the SWAP operation. The SWAP gate will swap the two qubits A and B. We see the cost of the SWAP gate is free in this paper. The last is the TOEFLY gate. The TOEFLY gate is the reversible equivalent of a classical AND gate. We adopt TOEFLY gate in our circuit because the following two reasons. First, TOEFLY gate requires only three qubits, and the value of C is not limited. It can be zero or one. We will make use of this property in our Quentin Circuit of AES. The above four Quentin gates are universe, so we can construct our Quentin Circuit of AES with these above four gates. There are several ways to measure the efficiency of a Quentin Circuit. First, we can compare the number of gates. However, due to the physical realization of a Quentin computer, the TOEFLY gates are much more expensive than the other Quentin gates. As a result, the number of TOEFLY gates is an important concern in this paper. The second measure is in the depth of a Quentin Circuit, since TOEFLY gates are important, so we focus on the TOEFLY depth in this paper. The third measure is the number of a qubit, which is relevant to implementations today. The lower the number of qubits, the sooner the Quentin algorithm can be implemented on a real Quentin computer. As a result, the number of qubits is a primary concern in this work. Quentin algorithm consists of operations on the qubit. We can divide the qubit into three types. First is the input qubit. Input qubits are written with the input message, such as the input key on the input plain text. The second is answer qubit. Answer qubit is written with some intermediate message. It can ensure that the whole Quentin circuit is reversible. We should clean up the answer qubit and end of a Quentin circuit. The third is the output qubit. Output qubit contains the output information of a Quentin circuit, and we do not need to clean up the output qubit. So, we can try to apply of a tophry gate to the output qubit instead of the answer qubit. In this way, we can reduce the number of tophry gates on a tophry depth. There are some previous work on minimizing the Quentin circuit of AS. In 2016, Gazzo et al. found out that the AS Xbox can be obtained by computing the inverse of the input. They found the inverse operation can be implemented with eight multiplications. While the left three linear operations can be implemented with the in-place way. In 2018, Gazzo et al. found out that the inverse operation can be computed with only seven multiplications which reduce the cost of the Xbox, and they can reduce the cost of the Quentin circuit of AS by using these. New property. One year later, Langenberg proposed an efficient Quentin circuit of AS Xbox by converting the previous classical circuit of AS Xbox into a Quentin circuit. Compared with the previous work such as the Gazzo's work on the Kim's attest work, Langenberg's circuit can reduce the number of qubit and the number of the tophry gates greatly. In 2020, Gazzo et al. showed a depth efficient Quentin circuit of AS by using previous depth efficient classical circuit of AS Xbox. The previous work shown that we can construct an optimal Quentin circuit of AS by constructing an input classical circuit of AS. We will construct our input Quentin circuit of AS by using a similar idea. In order to construct a low memory Quentin circuit of AS, we need to construct the Quentin circuit of four basic operations of AS which are the Xbox on the shift row, mixed column, and at long keys. Since only the Xbox is a long linear operation and only the Xbox contains a tophry gate, so we focus on how to implement Xbox efficiently. In the first, we need to construct an optimal classical circuit of AS Xbox which fills end gate. Since we cannot find a better circuit than Boyer's attest classical circuit of the AS Xbox, we just adopt this circuit in our paper. By using a tophry technique, Boyer attest find out AS Xbox can be divided into three parts, that is US, FX, and Bix. UX takes the input of the Xbox as input and output 22 bits. Well, each YI is a linear combination of the input. Now, FX is a long linear function. It will take the output of US as input and output 18 values from 0 to 17. The output of FX is the input of Bix. The output of Bix is the output of the FX, ASX. We summarise the previous classical circuits in these papers. So, as shown in the tables, Boyer's attest circuits contain the fields on the end gate. That is, there are classical circuits contained only 32 end gate and 81 XOR gate. In this paper, we propose an input classical of the inverse Xbox of AS, also by using a tophry technique. Since our classical circuit of the inverse Xbox is similar to Boyer's circuit, we just omit the details and give the results in these tables. That is, our classical circuit of the inverse Xbox also contains 32 end gate. So, in the following, we will show how to convert a classical circuit of the AS Xbox to a quantum circuit of the AS Xbox. And then the quantum circuit of the inverse Xbox can be constructed in a similar way. So, a naive conversion of Boyer's circuits to a quantum circuit is to introduce new ansi-lar qubit to stop each intermediate value, since because quantum circuits must be reversible. So, we take the US function as an example. That is, we should need to introduce 26 new ansi-lar qubit to stop all the intermediate values in US. We can also introduce some new ansi-lar qubit to stop all the intermediate values in FX and BX. Then we can compute, we can obtain the output of the Xbox with the same processions of the classical circuit. However, our quantum circuit of the AS Xbox should adopt some reverse operation to clean up all the ansi-lar qubit. This is different from the classical circuit. So, to sum up the naive conversion of Boyer's attires circuits, we can construct this naive quantum circuit of AS Xbox with 126 qubit, 32 toffrey gate, 166 CNOT gate, and a four-node gate. In this paper, we also find out we can reduce the number of qubit with following two observations. According to the expressions of computing, we can compute the 18 values from 0 to 17, only with the four intermediate values, that is, t29, t33, and t37, and t40. That means we do not need to all the intermediate values to store this 18 values of zi. We summarize this conclusion in our observation one. Since the quantum circuits should be reversible, we have found the four intermediate values cannot be obtained with only four qubits. In fact, we require at least six ansi-lar qubits to obtain the four intermediate values t29, t33, and t37, and t40. In other words, we can obtain the 18 values from z0 to z17, only with six ansi-lar qubits. After computing the 18 values from z0 to z17, we can obtain the output of Xbox with linear function bx. We summarize the property in observation two. So, based on our two observations, we can construct a quantum circuit of AS Xbox with at least six ansi-lar qubits. In this paper, we will design two quantum circuits of AS Xbox. Case one, when the output qubits are zero, then we find out we can construct our quantum circuit of AS by using the in-place ways. That is, after computing the 18 values from z0 to z17 with six ansi-lar qubits, we do not need to introduce the new ansi-lar qubits in linear function bx to compute the output of Xbox. So, in this case, we can obtain the output of AS Xbox with only six ansi-lar qubits. Case two, when the output qubits are not zero, then in this case, we cannot use the in-place way implementation to compute the output of the AS Xbox. In this case, we should adopt a new ansi-lar qubit big z to store each zi. Then after filling big z with a new zi, we can xor big z to each xi with the linear expressions in observation two. In this case, in this case two, we require seven ansi-lar qubits to compute the output of the AS Xbox. We can obtain a similar observation of our quantum circuit of the inverse Xbox. We just give the result and omit the details. And we summarize our result of our quantum circuit of the AS Xbox and the inverse Xbox. The details of our quantum circuit implementation of the AS Xbox on the inverse Xbox are available at the following websites. The left three linear operations such as the stricter rows, mixed column, and add-long keys can be implemented with the CNOT gate and we just adopt the quantum circuit proposed by Grasso and Langenberg for the three linear operations in this paper. So we just omit the details. After designing a low-memory quantum implement quantum circuit of the Xbox and the three linear operations, we also need to consider whether we can reduce the number of qubits between each wrong function. The previous memory quantum circuit of AS adopted the following zig-zag method to reduce the qubit. The idea is to reuse some qubits, which can be summarized as follows. They denote each wrong i as r i. So since they only have 512 qubits, then after computing the first value of the wrong 1, wrong 2, wrong 3, and wrong 4, they are no longer to start the following wrong function. So they have to remove some previous wrong function values, so to start the value of the following wrong function. In this, they can adopt the following idea to remove the wrong i. They can recompute the value of wrong i minus 1, so to append the value of wrong i again. Then they XOR the value together, so to remove the value of wrong i. So they can use the wrong 2 to remove wrong 3, and use wrong 1 to remove the value of wrong 2, and use the value of wrong 0 to remove the value of wrong 1. No net, they can remove the value of wrong 4 now because they need the value of wrong 4 to compute the value of wrong 5. So they can base a similar idea several times to compute the output of the wrong 10, which is the output of the AS. In this paper, we propose an input zigzag method. The core idea of our paper is to find out every operation in AS is invertible, which allows to uncompute a state from a later state, while in general this can only be done from a earlier state. So as shown in the figures, our input zigzag only requires 256 qubit. After computing the wrong 1 and wrong 2, we use the message on the value of wrong 2 to remove wrong 1 with the very initially qubit. We can start on the wrong 3 in this new qubit. The wrong 3 can be obtained by the value of wrong 2. Then we can use the value of wrong 3 to remove the wrong 2 and computing the wrong 4 in the initially qubit. So we can compute this operation several times to compute the output of the wrong 10. So based on our quantum circuit of the xbox and the 3 linear operations and our input zigzag methods, we can construct our quantum circuit of AS as follow. Seeing the quantum circuit of each wrong is similar, we just show how to obtain the wrong 5 and remove wrong 4 as follow. So in the beginning, we have 128 zero qubit. Since we require some answer qubit in our quantum circuit of the xbox, we cannot compute all the xbox of wrong 5 in one time. So we use the last 16 for 16 for qubit as an answer qubit. And we can compute the first 8 xbox of wrong 5 and the first 2 xbox of sub key W20. So after these xbox operations, we have only 64 zero qubit left. In order to obtain the more zero qubit for the following answer to use to assign the following answer qubit, so we should remove the qubit in wrong 4. We can do this by using our quantum circuit of the inverse xbox, as shown in the expression in the left. According to the expression in the left, we can use our quantum circuit of the inverse xbox to the first 8 xbox value of the wrong 5 to remove first 8 byte value of the wrong 4. Then after this operation, we can obtain 128 zero qubit again. Then we can repeat the previous operation several times to obtain wrong 5 and remove wrong 4. We just give the whole procession in this figure. We can summarize the cost of our quantum resource of AES in this table. As shown in this table, we can reduce the number of qubits by more than 30 percent. So that's all. Thank you. Bye bye.