New SAT-based Model for Quantum Circuit Decision Problem: Searching for Low-Cost Quantum Implementation

,


Introduction
Recently, the rapid development of quantum information technology has had a profound impact on the security of data and communication in cyberspace.To address the emerging challenges in the post-quantum era, the National Institute of Standards and Technology (NIST) initiated a public solicitation for post-quantum cryptography algorithms in 2016 and used the complexity of the quantum key search circuit of AES as the benchmark for the classification of post-quantum public key cryptography algorithms [CJL + 16].Regarding symmetric ciphers, Grover's algorithm [Gro96] offers a quadratic speedup in searching for the correct key given a pair of plaintext and ciphertext.Subsequently, the security analysis for symmetric ciphers has been actively explored, with many proposals requiring quantum circuit implementation for encryption algorithms.So the quantum circuit implementation of a cipher has attracted significant attention within the cryptography community.
The fundamental unit in optimizing the circuits of ciphers is the circuitry tailored to optimize cryptographic components, such as S-boxes and linear layers.In classical circuit design, we typically employ various optimization techniques to reduce metrics.The most popular one should be the gate equivalents (GE) required by the chip-level implementation of the ciphers.GE effectively approximates the complexity of digital electronic circuits.Generally, two components are relevant to the cost.On the other hand, as an important criterion, latency has been attracting more and more attention.Many of the applications require low latency, including automobiles, robots, or mission-critical computation applications.It impacts the throughput of encryption/decryption and plays an important role in the low-energy consideration of ciphers [BBI + 15].The S-box is one of the most popular confusion components of symmetric-key ciphers.Many tools are proposed to optimize the primitive, such as LIGHTER [JPST17] and PEIGEN [BGLS19].In addition, the diffusion components are essential matrices and are the most well-known diffusion components.Although it has been shown to be an NP-hard problem [BMP08], there is still a growing body of work solely concentrating on decreasing the GE.More and more concerns for heuristics searching for sub-optimal solutions have arisen (see [BMP13, KLSW17, TP20, XZL + 20, BDK + 21, LWF + 22, LWS + 22] for an incomplete list).
When implementing a quantum circuit for a certain boolean function, the gates under the classical circuit are usually converted into reversible quantum gates, as the quantum operation is reversible.However, it is not straightforward to directly translate optimized classical circuits into quantum circuits.Due to the unique characteristics of quantum circuits, employing such a direct conversion method may result in increased resource consumption.There are three common quantum gates called the NCT gate set, the Pauli-X gate, the CNOT gate, and the Toffoli gate, which can respectively replace the NOT gate, XOR gate, and AND gate under the classical circuit.Several factors influence the complexity of quantum circuits, including the number of quantum gates, qubits, circuit depth, and so on.Currently, the quantum circuit of the symmetric ciphers mainly takes AES as the research object [GLRS15, LPS20, ASAM18, JNRV20, ZWS + 20, HS22, JBS + 22, LPZW23].In 2016, Grassl et al. [GLRS15] presented a comprehensive quantum implementation scheme that utilized the Grover algorithm to exhaustively search for AES keys.They analyzed the quantum resource overhead, including the size of the quantum circuit, the number of qubits needed, and the depth of the quantum circuit.Subsequently, researchers have continuously proposed and optimized AES quantum circuits using different circuit structures and considering various quantum circuit metrics.
For the optimization of quantum circuits of symmetric primitives, it is very important to optimize the cryptographic components.As the only nonlinear part in block ciphers, the S-box has always been the main content of the research.Based on the public tool, LIGHTER [JPST17], which was proposed under the background of classical computing and generated in-place implementation, Dasu et al. proposed LIGHTER-R [DBSC19] which can give a reversible circuit implementation for a specific 4-bit S-box, along with the optimization for gate cost.Subsequently, Chun et al. proposed the DORCIS tool [CBC23] to find depth-optimized quantum circuit implementations for arbitrary 3-/4-bit S-boxes.For linear transformations, the heuristic algorithm proposed in [XZL + 20] can be used to find efficient implementations of binary matrices of size up to 32 under s-Xor metric, which is equivalent to the CNOT gate in the quantum circuit.In 2022, Huang et al. [HS22] presented a SAT-based method to generate the most compact CNOT circuit for invertible linear transformations over F n 2 .

Our Contributions
In this paper, we investigate three metrics, the number of qubits, the number of gates, and the circuit depth, which are essential for quantum circuits.To assess the optimality of a quantum circuit of a permutation f , we present the quantum circuit decision problem, which requires us to determine whether there exists a quantum circuit for the permutation f using M ancilla qubits and no more than K quantum gates within the circuit depth D.

Analysis of previous related methods.
In order to answer the quantum circuit decision problem, we investigate and analyze a series of methods both in the classical and quantum circuits in the literature.[HS22].However, we observe that these tools are unable to comprehensively answer this question, namely, to prove the optimal quantum circuit for a permutation.DORCIS is a highly practical heuristic tool, effectively reducing the depth of quantum circuits.If we require whether a circuit is optimal, we will not receive an answer as it is a heuristic algorithm.Ancilla qubits are not allowed in the tool, which also renders it incapable of addressing the problem regarding the number of qubits.On the other hand, the SAT-based model can prove the optimality in the classical setting.However, in the quantum setting, the properties of non-fanout and reversibility render this model incapable of addressing the question.
Proposal of our new SAT model.Building upon the above discussion, we introduce the improved SAT-based quantum circuit optimization model based on the model in [Sto16, LWH + 21] and present the detailed coding schemes.For the convenience of using the model, we provide fully automated code generation.Our model incorporates three metrics M , K, and D, related to the number of qubits, the number of gates, and the circuit depth of the quantum circuit decision problem.
Applications on permutations.Firstly, we discuss the quantum circuit decision problem about S-box.By controlling the number of qubits, we can apply the model to find the smallest gate-count implementation of the S-box, proving the results in LIGHTER-R.We can also provide circuit implementations of S-box with odd permutation by adding qubits, which solves the situations that the original model couldn't handle.Finally, by combining three metrics, we have achieved the currently optimal circuit for quantum S-boxes.

Organization
In Section 2, notations used in this paper are defined, then we introduce the quantum circuit and SAT/SMT problem.In Section 3, we propose the new SAT-based model for the optimization of a given permutation.The application of our model is shown in Section 4. Finally, we conclude and propose future research directions in Section 5.

Notations
Let F 2 be the finite field with two elements 0 and 1, and F k 2 be the finite field with 2 k elements.An n-bit permutation f can be denoted by F n 2 → F n 2 .Consider a, b ∈ F 2 , we then use a = a ⊕ 1 to represent the inversion of a, and a ⊕ b, a • b and a|b denote the XOR, AND and OR operations of a and b.

Quantum Circuits
Similar to classical circuits, the quantum circuit is a model that manipulates qubits through several quantum gates, where qubits can exist in superposition states and become entangled with one another.We denote a qubit state by |u⟩, where the classical bit values 0 and 1 are denoted by |0⟩ and |1⟩, respectively.Leveraging the inherent reversibility of quantum computation, quantum gates are implemented as simple unitary transformations, which can be succinctly represented by matrices as follows.
To reduce the quantum resources, quantum circuits can be optimized according to various criteria.In this paper, We focus on the optimization criteria addressed in [DBSC19] and [CBC23].The definitions are as follows.

Quantum Gate Cost(GC).
The quantum gate cost of the target circuit is defined as the number of quantum gates in {Pauli-X, CNOT, Toffoli}.A Pauli-X gate maps |a⟩ to |a ⊕ 1⟩, and a CNOT gate can be regarded as a transformation that maps |a⟩ |b⟩ to |a⟩ |b ⊕ a⟩, where only the operand b is updated.A Toffoli gate maps |a⟩ |b⟩ |c⟩ to |a⟩ |b⟩ |c ⊕ a • b⟩, which can be seen as the classical AND gate when the operand c is 0. These gates are depicted in Figure 1.

Quantum Bit Cost(BC).
The qubit cost is defined as the circuit width.It reflects the limited number of qubits available in contemporary quantum computers.We can categorize the qubits in a quantum circuit into three distinct types.
1. Data qubit is the input variable of a quantum circuit.
2. Ancilla qubit is the variable initialized to |0⟩, used in the process of generating output values.Note that we shall clean up the ancilla qubits at the end of the quantum circuit.
3. Output qubit contains the information about output value.
Specifically, a quantum circuit in which the values of output qubits are directly stored within the data qubits is termed an "in-place" circuit.In this paper, we construct in-place circuits to conserve qubit resources.

Quantum Full Depth(FD).
Quantum full depth cost [SM13] is defined as the largest number of elementary gates on any path from inputs to outputs in a circuit.In particular, as a non-Clifford gate, the Toffoli gate is required to be decomposed with Clifford+T gate set in different ways.We present the cost metrics in Table 3 for the NCT gate set.
To reduce the T-depth, we adopt the decomposition method of the Toffoli gate mentioned in [NC01] with #F D = 7.

Cryptographic Permutation
In this paper, we mainly focus on optimizing quantum circuits for the n-bit S-boxes and matrices.Both can be regarded as permutations and play an important role in symmetric cipher.To facilitate understanding of the encoding scheme in our model, we present three representation methods of these two permutations, namely the LUT, ANF, and bit-sliced representation.

S-box. S-box is a function
which ensures the property of confusion for a symmetric cipher as the only non-linear component.In the quantum circuit, we must have f be bijective since information loss is irreversible in the reversible computing paradigm.Thus, for this paper, we refer to an n-bit bijective S-box: Example 1.We take the S-box of GIFT [BPP + 17] as an example.
The LUT representation of the S-box of GIFT is shown in Table 4.
The ANF representation of the S-box of GIFT is given by the set of equations 1, the variables x i and y i denote the inputs and outputs of S-box. (1) The bit-sliced representation of the S-box of GIFT is shown in Table 5.
Linear matrix.As the linear layer of a symmetric-key primitive can be represented as a binary matrix, the implementation of a linear layer is a sequence of XOR gates.In this paper, due to the reversibility of quantum computing, we focus on the n-bit invertible matrix which also can be regarded as a permutation: [0, Example 2. We take a toy 4-bit invertible matrix M as an example.
The LUT representation of M is shown in Table 6.
The ANF representation of M is given by the set of equations 2, the variables x i and y i denote the inputs and outputs of the invertible matrix. (2) The bit-sliced representation is shown in Table 7.

Table 7:
The bit-sliced representation of a given 4-bit invertible matrix.

SAT/SMT Problem
In recent years, the application of automated search tools in cryptography has become more and more extensive.The SAT problem belongs to the deterministic problem, and it is also the first problem to be proved to be NP-complete.To solve it, boolean expressions are usually encoded in Conjunctive Normal Form (CNF) as the inputs of a SAT solver.
Extending SAT to satisfy the modulus theory (satisfiability modulo theories, abbreviated as SMT) can enrich the form of CNF expression, which includes linear constraints, arrays, and so on.Compared with the method based on SAT problems, the method based on SMT is more flexible and applicable to a wider range, which is very suitable for application in the field of cryptography.

A Constraint Solver: STP
This paper mainly uses the solver of the SMT problem, STP1 , to automatically solve our new proposed quantum circuit decision problems.When STP successfully finds a circuit for some value k but outputs UNSAT for k − 1, it is proven that k is the minimum value.CVC formats are one of the commonly used file-based input languages in STP.We list some CVC language references and two examples as follows.

Stoffelen's Model Based on SAT Solvers
To find more compact implementations of small S-box circuits, Stoffelen proposed a search model [Sto16] based on SAT solvers to achieve multiple optimization criteria, including nonlinear gate count, gate count, and circuit depth, etc.The main idea is to convert the problem of solving the target circuit into a satisfiability problem and use the off-the-shelf SAT solvers to solve it.For example, when optimizing the gate number of an n-bit S-box, Stoffelen proposed a binary model to solve the following decision problem: Is there a circuit implementing F n 2 → F n 2 and that uses at most K logic operations?
This model encodes each gate as an ANF equation and can judge the existence of solutions when given the number of gates.To get the smallest number of gates, it should exhaust K until it finds the smallest one that there exists an implementation of the target S-box.

New SAT Model for Quantum Circuit Decision Problem
In this section, we discuss the optimized implementations of quantum circuits for a given permutation f .To begin with, we propose the quantum circuit decision problem for the optimization goals.Within this problem, these criteria mentioned in Section 2.2 for quantum circuits are taken into account.Then we analyze the limitations of the existing optimization techniques for circuits in effectively solving this problem.Hence, we introduce a novel quantum circuit model based on SAT solvers, followed by a comprehensive exposition of encoding schemes.

Quantum Circuit Decision Problem
In the research of quantum circuits, many related works have proposed various optimization methods for the criteria mentioned in Section 2.2.For example, Huang et al. [HS22] in ASIACRYPT 2022 proposed a model that aims to search for an in-place quantum circuit with the minimum number of CNOT gates of a linear permutation, which can be regarded as a decision problem solved by SAT solvers.To implement a more compact quantum circuit covering the three optimization goals of quantum gate cost(GC), quantum bit cost(BC), and quantum full depth cost(FD), we present the quantum circuit decision problem (cf.Definition 1).

Definition 1 (Quantum circuit decision problem). Given an n-bit permutation
, the quantum circuit decision problem requires us to determine whether there exists a quantum circuit implementation of f that uses no more than M ancilla qubits, K quantum gates with the full depth at most D.

Limitations in the Previous Methods
Currently, there exist two types of potential methods for solving the quantum circuit decision problem.
• Local optimization method.This approach focuses on the comprehensive consideration of multiple heuristic algorithms [CBC23,DBSC19] to directly optimize different criteria of quantum circuits.
• Exhaustive search method.This approach can achieve an exhaustive search [Sto16, LWH + 21] for small-scale classical circuits based on SAT solvers, obtaining the optimal circuit under the target goal.
However, these methods cannot directly solve the quantum circuit decision problem.We clarify the limitations inherent in these methods, thereby presenting our proposed solution, which entails a novel SAT model.

Analysis of Chun et al. 's Quantum Heuristic Algorithm
Chun et al. proposed a tool, DORCIS, that found depth-optimized quantum circuit implementations for arbitrary 3-and 4-bit S-boxes in 2023.However, DORCIS has two limitations in solving the quantum circuit decision problem.
Optimality of the quantum circuit cannot be proven.DORCIS is an algorithm with highly effective optimization results, constructing circuits of very low depth for multiple permutations.However, it relies on some heuristics and is infeasible to prove that their results are optimal.If we inquire DORCIS whether this circuit is optimal or if there exist circuits with lower depth, we won't obtain an answer.
The issue of unresolved ancilla qubits remains unaddressed.DORCIS does not provide ancilla qubits.It means that if we try to generate a circuit with an ancilla qubit, the tool will not return a result.Note that not all S-boxes can be implemented with in-place circuits without ancilla qubits.In [LXX + 23], Lin et al. studied the permutation and proposed a definition of the odd permutation.

Definition 2 (Odd permutation). A permutation is called odd if it can be written as the product of an odd number of transpositions.
No quantum circuit can be given for S-boxes with odd permutations without ancilla qubits.In this case, DORCIS will be unable to provide the optimal circuit or even a solution.

Analysis of Stoffelen and Lu et al. 's SAT Model
In 2016, Stoffelen [Sto16] presented a SAT-based model for optimizing S-box circuits.Subsequently, Lu et al. [LWH + 21] improved Stoffelen's model by adding the criteria for optimizing area to find the circuit implementation of the minimum area of the S-box.
In classical computing, the SAT-based model effectively addresses the optimization challenge of circuit hardware area and latency.However, there exist some problems if the model is employed directly for the optimization of quantum circuits due to the properties of quantum computing.We briefly outline the issues encountered by the model.

Reversible operations can not be guaranteed.
We summarized the SAT model used in [LWH + 21].It is shown in Figure 2. The variables x i and y i denote the inputs and outputs of a circuit.
The set of equations ( 3) is encoding the decision of choosing a type of gate.
The variable q i denotes the input of a gate, and b i determines what kind of gate the t i will represent.When the value of the pattern b 3i ||b 3i+1 ||b 3i+2 is different, t i represents different kinds of gate.The above method can encode different classical gates, such as when b 0 ||b 1 ||b 2 = 010, it represents an XOR gate, which can be denoted by t 0 = q 0 ⊕ q 1 .In the quantum circuit, to achieve the operation of XOR, it requires three qubits and needs to be split into two operations t 0 = t 0 ⊕ q 0 and t 0 = t 0 ⊕ q 1 , which contradicts the principle of optimal gate count.No fan-out property in the quantum setting.In Lu et al. 's SAT-based model, the fan-out operation is allowed because the model considers that the output of the previous gates can be used as the input of any subsequent gates, described by Figure 2.But quantum gates do not allow fan-out, which means that the output of the previous gate can only be used as the input of the next gate.Besides, if a variable x i is used twice in the same depth, the quantum depth has to be increased, different from classical circuits.

Main Idea of Our Model
As discussed above, in light of the issues, there currently exists no model capable of solving the quantum circuit decision problem.Since the SAT problem can be solved by existing solvers, we employ an enhanced SAT model to solve it.For the permutation f , if our model successfully finds a circuit for the metric k and the solver proves that there is no solution for k − 1, it is proven that k is the minimum value.Thus, our model is proper for the decision problem.
From a higher-level perspective, the new SAT model needs to answer the following three questions.
• Question 1: How to incorporate the parameter of qubit number(BC) into the model.
This question can enable the model to find quantum circuits that implement odd permutations, which need ancilla qubits.Besides, by introducing extra variables into the model beforehand, there is a potential to discover quantum circuits with lower full depth.
• Question 2: How to represent reversible gates in the enhanced model.For the Toffoli gate, the model only allows the operation like c = c ⊕ a • b.For the CNOT gate, the model only allows the operation like b = b ⊕ a.Given these constraints, the circuits we obtain always adhere to the quantum setting.
• Question 3: How to constrain quantum depth without assuming fan-out.This requires us to constrain a variable to appear only once at the same depth, which is attributed to the novel model scheme that we have introduced.
As an outline, we introduce our new gate-level structure search model (cf. Figure 3).The variables used in the encoding scheme are shown in Table 9.We first encode the problem in logical formulas in Conjunctive Normal Form (CNF).Then, the constraints are used to describe quantum circuits in SAT problems.

Table 9:
Variables used in the encoding process.

Notations Definitions x i [j]
The i-th data wire in front of the j-th gate anc i [j] The i-th ancilla wire in front of the j-th gate depth i [j] The depth of the i-th wire in front of the j-th gate y i Permutation outputs q i Gate inputs t i

Gate outputs a i
Wiring between gates b i Wiring 'inside' gates The structure contains the input and output of the circuit, consisting of gates as internal subcircuits.The reason for using this serial framework is that quantum gates cannot fan out, the output of each gate can only be used as the input of the next gate.In Figure 3, the circuit of the 0-th gate can be denoted by ( ).If an ancilla qubit is required, we just set it as the input variable.

Encoding Scheme
In this section, we use the SAT solver to solve this decision problem, which requires the problem to be encoded.Hence, we present the encoding process of the model to a set of equations in ANF, and finally use STP to return the target circuit.To better understand the encoding scheme, we give a model of the quantum decision problem whether there is a quantum circuit that implements GIFT S-box with 1 ancilla qubit, and 9 quantum gates with #F D at most 31.The bit-sliced representation of GIFT S-box has been given in Table 5.

Encode Input, Ancilla Qubits, and Output
For an F n 2 → F n 2 permutation f , due to the bit-sliced technique, the input variable 2 , and the output variable y i is a 2 ndimensional variable over F n 2 .Note that distinct from the conventional encoding schemes, we innovatively employ arrays to represent input variables, avoiding the generation of intermediary variables and facilitating the construction of in-place circuits.Note that the size of arrays can be adjusted according to the gate count.
For GIFT S-box, assume that the number of gates is 0bin001001 (9 gates) and the number of ancilla qubits is 1.The input X_i, the ancilla qubit Anc_k, and the output Y_j can be encoded as follows.
Anc_0: ARRAY BITVECTOR(6) OF BITVECTOR(16); ASSERT( Anc_0[0bin000000] = 0bin0000000000000000 ); Considering that we construct in-place circuits, it is necessary to store the output value within the data qubit.Consequently, we establish a direct correspondence between the input and output of the S-box at the end of this model.That is to say, the output variable Y_j corresponds to the output wire X_i according to Figure 3.For the decision problem of GIFT S-box, upon traversing a sequence of nine gates from input to output, the data qubits can be succinctly represented by

Encode K Quantum Gates
Encode the decision of choosing inputs of a gate.This paper uses the NCT gate set, including the single-input NOT gate, the two-input CNOT gate, and the three-input Toffoli gate, so at least three-input gates need to be encoded.For ∀i ∈ {0, . . ., K − 1}, q 3i , q 3i+1 , q 3i+2 are the three inputs of the i-th gate t i .We have simplified the statements in CVC format and expressed them by the set of equations in ANF for convenience.
We then can encode the input of the second gate in the same form as follows.This enables us to describe the inputs of all gates.
Encode the decision of choosing a type of gate.The variable b i determines what kind of gate the circuit will choose, the encoding of different types of gates is shown in Table 10.The choices of the first two gates are presented as follows.
More constraints in the quantum setting.In order to ensure that each gate conforms to be reversible, we use the three-step operation in Figure 4 to complete the self-renewal of the input wire. • Step 1: The model chooses one, two, or three inputs of a quantum gate.Then, we add two constraints.Firstly, for the first gate in Equation (4), ∀i, j ∈ {0, . . ., to encode that only one of the variables a t in an equation can be equal to 1. Secondly, we add the following constraints on the gate inputs to ensure that each input of a gate is different. • Step 2: Our model limits that the output of a gate must be one of the input wires.
In Equation (6), t 0 must be one of q 0 , q 1 , and q 2 .We list four possible values of q 3i : x 3 [i] for the i-th gate, and constrain the value to be equal to t i .For example, if q 3i = x 0 [i], then the solver will constraint x 0 [i + 1] = t i .
• Step 3: For the wires that have not been updated, we simply constrain the input to be equal to the output for the next gate operation.For example, The following simplified CVC language can be used to control this conditional statement. (

Encode D Quantum Depth
The search model in Figure 3 is layered according to gates.We can consider it a serial search structure, so it is better to combine circuit depth with gates.Different from the classical depth, due to the non-replication of qubits, gates acting on the same qubit will increase the quantum depth.Besides, we have the following observations.
Observation 1.The depth of a quantum circuit is determined by the wire (or path) with the highest depth.
Observation 2. After applying the same quantum gate, the output wires have the same depth.If the input wires have different depths, the depth is determined by the higher one.
Based on the above observations, in order to encode the circuit depth to D, we can control the depth of each wire at the same time and use the SAT solver to search the circuit.If there is a circuit implementation when the depth is less than D + 1, and no solution when the depth is less than D, it means that the minimum circuit depth is D. The encoding and constraint process are as follows.
• Firstly, for an n-bit S-box, similar to the input variables, we define n array variables for the input wires to denote depth: depth 0 [], depth 1 [], . . ., depth n−1 [].Take the PRINCE S-box as an example, we have the following constraints: depth_0,depth_1,depth_2,depth_3:ARRAY BITVECTOR(6) OF BITVECTOR(16); • Then, it is necessary to restrict the depth relationship between the input and output circuits of a quantum gate.We need to enumerate all possibilities of quantum gates by constraint encoding, and we take a subcircuit composed of CNOT gates as an example in Figure 5. Use the CVC language to constrain the following if-condition statement: Figure 5: The subcircuit of the j-th gate.
• Finally, our model constrains the circuit depth of each wire to be no more than D.
For GIFT S-box, the encoding is as follows.

Applications
In this section, we apply the new model to some permutations.Firstly, for 3-bit and 4-bit S-boxes, we first prove that the gate count from LIGHTER-R is optimal due to the exhaustive search by using the SAT solver.Then, by combining different criteria in the model, we find more compact quantum circuit implementations of S-boxes such as RECTANGLE and GIFT than using LIGHTER-R and DORCIS.Furthermore, we can streamline the model to optimize the quantum circuit for reversible linear permutations, which offers enhanced efficiency compared to the optimization of S-boxes.

Optimizing the Quantum Implementation of S-box
Using our model, we can see an improvement in quantum gate cost(GC), quantum bit cost(BC), and quantum full depth(FC) on the currently known best quantum circuits for 3-bit and 4-bit S-boxes.We have undertaken efforts in three aspects.
• Firstly, we apply our model to validate the circuits produced by current heuristic methodologies, addressing the critical inquiry of whether these methods achieve optimality in quantum circuit optimization.
• Secondly, we answer the question of optimizing quantum circuits for odd permutations that require ancilla qubits by introducing additional variables.
• Ultimately, we refine the quantum circuits for S-boxes by leveraging Algorithm 1 and Algorithm 2, enhancing their performance through targeted optimization strategies.
Optimize for GC.Setting M to 0 in the model and D to a larger value (the depth limit can be ignored temporarily), the quantum circuit decision problem can be transformed into a sub-problem: whether there exists a quantum circuit implementing using no more than K quantum gates.We apply the model to solve this problem for 3-bit and 4-bit S-boxes and obtain the same gate count as LIGHTER-R.When we reduce the constraint of the number of gates M , the solver returns "NO SOLUTION", which can prove that the quantum s-box given by the meet-in-the-middle algorithm LIGHTER-R regarding quantum gate complexity is optimal.Add ancilla qubits to implement quantum S-boxes.By controlling the number of ancilla qubits, our model can provide the quantum circuit of some specific S-boxes with odd permutations.It is worth noting that in the construction of quantum circuits for AES, Lin et al. [LXX + 23] implemented a low-qubit S-box circuit based on Tower Field, where the S-box is decomposed into three layers.The middle layer can be viewed as a 4-bit odd permutation (062493D51EC78ABF).We apply LIGHTER-R to this permutation.However, no circuit can be returned as they require more qubits.By adding more constraints and using two strategies, Lin et al. obtained the quantum circuit for this permutation using 10 gates with a full depth of 45.Directly utilizing our model, we obtained the optimized circuit with depth 44, which is more compact.The comparison is illustrated in Figure 6.This novel quantum circuit for the permutation can be seamlessly integrated into the circuits detailed in [LXX + 23], subsequently improving the quantum circuit of AES.
Combine criteria to solve the quantum decision problem.Three parameters M, K, and D are considered in the model.To better weigh the corresponding optimization goals, we decompose the optimization process into the following two steps.
• Firstly, solve the sub-problem: whether a circuit can implement a permutation using at most K logic operations and M ancilla qubits with the circuit depth less than D, which is a given larger value (DC can be ignored).
• Secondly, after finding the smallest gate count, further optimize for the full depth of circuit.
We propose Algorithm 1 to solve the first sub-problem for a given n-bit permutation f .By setting the depth D larger, Algorithm 1 finds the circuit implementation with the smallest number of gates and qubits.
Algorithm 1 Solve the first sub-problem Input: Number of gates K, ancilla qubits M , Depth D Output: If the sub-problem has a solution, the solver returns "1" and the implementation of this S-box or other case returns "0" for m from 0 to M − 1 do for k from 0 to K − 1 do Input to the model for encoding, using STP to solve it if STP returns the implementations of f then Finish and return m and k end if end for end for We then further optimize the quantum depth.Algorithm 1 can be used to get the circuit C for f and the returned results K low , M low , denote the circuit depth of C by D up as the upper bound, and then determine the lower bound of the circuit depth.We have the following observation.
Observation 3. The lower bound on the depth of an n-bit quantum circuit with k gates composed of NCT gate sets is ⌈ k n ⌉.Obviously, the highest degree of parallelism can only be achieved when all gates are NOT gates, resulting in the lowest circuit depth.So the lower depth of S is ⌈ K low n+M low ⌉.Finally, use Algorithm 2 to get the depth-optimal circuit.
Running Algorithm 1 and Algorithm 2, we show the improvement of our new model.Table 1 and Table 2 show the comparison results with LIGHTER-R and DORCIS respectively.Notably, in Table 2, for optimizing GIFT S-box, DORCIS uses 13 gates with depth 31.Our model can find a new quantum circuit with the same depth using only 8 gates.Furthermore, if we allow an ancilla qubit in the circuit, our model can reduce the depth to 30.The three different quantum circuits (proposed by LIGHTER-R, DORCIS and our model) of GIFT S-box are shown in Figure 7.
It is worth noting that if the number of ancilla qubits is increased, it is likely to continue to reduce the circuit depth, but due to the difficulty of solving large scale SAT models in practice, we only give examples of a single ancilla qubit in this paper.

Optimizing the Implementation of Quantum Linear Matrix.
In Section 3.4, we provide a comprehensive description of the model's encoding process for S-boxes, which can be extended to the linear matrix with the constraint of the coding type of the gate.In Table 10, we provide the encoding of each gate.If we set b i = 0 for each i , then the SAT-based model can solve the decision problem for the linear permutation.

Conclusion
In this paper, we introduced the quantum circuit decision problem for optimizing the quantum circuits of permutations.In order to solve it, we investigate existing tools while highlighting the challenges encountered.Subsequently, we innovatively proposed a new SAT model based on STP to solve this problem and algorithms to employ the model to solve many sub-problems.By applying this model, we can prove the optimality for certain original quantum circuits constructed by LIGHTER-R and further optimize the quantum circuits of some permutations from the demonstrated examples.
This is a general model that can implement quantum circuits of S-box and linear matrix.However, because the search space is far too large, the model is challenging for circuit realization of permutation of large states.We look forward to follow-up work to solve such quantum circuit decision problems.

Figure 1 :
Figure 1: The description of the quantum gates.

Figure 3 :
Figure 3: A new gate-level structure search model for a 4-bit S-box.

Figure 4 :
Figure 4: The updating process of the i-th gate for a 4-bit S-box.

( a )Figure 6 :
Figure 6: Different implementations of 4-bit quantum S-box in AES.

Figure 8 :
Figure 8: Different quantum implementation of A.
They predominantly fall into two categories: the heuristic algorithm employed to search for reversible quantum circuits, such as LIGHTER-R [DBSC19] and DORCIS [CBC23], and the SAT-based classical circuit optimization model, such as Lu et al.'s model [LWH + 21] and Huang et al.'s model

Table 1 :
Result summary of LIGHTER-R and our model.
* These circuits use an ancilla qubit.

Table 2 :
Result summary of DORCIS and our model.
* These circuits use an ancilla qubit.

Table 3 :
Cost metrics for the NCT gate set.

Table 8 :
Usage of the STP solver.

Table 10 :
Encoding of different types of gates.