Utilizing Circulant Structure to Optimize the Implementations of Linear Layers
Buji Xu, Xiaoming Sun
TL;DR
This work tackles the efficiency of linear layers in symmetric cryptography by exploiting circulant matrix structure. It develops a circulant-focused synthesis method over $GF(2)[x]$ that transforms circulant matrices toward upper-triangular form using ABBA-type decompositions, enabling deeper optimization of quantum circuits. The approach yields concrete improvements, including reducing Whirlwind $M_{0}$ depth to $17$ with $159$ XORs and achieving AES MixColumn depth of $10$ with $107$ CNOTs, approaching state-of-the-art manually optimized results. The method generally increases circuit size but provides meaningful gains in specific cases and demonstrates potential for automating manual optimizations and extending to other circulant-like linear layers.
Abstract
In this paper, we propose a novel approach for optimizing the linear layer used in symmetric cryptography. It is observed that these matrices often have circulant structure. The basic idea of this work is to utilize the property to construct a sequence of transformation matrices, which allows subsequent heuristic algorithms to find more efficient implementations. Our results outperform previous works for various linear layers of block ciphers. For Whirlwind M0 , we obtain two implementations with 159 XOR counts (8% better than Yuan et al. at FSE 2025) and depth 17 (39% better than Shi et al. at AsiaCrypt 2024) respectively. For AES MixColumn, our automated method produces a quantum circuit with depth 10, which nearly matches the manually optimized state-of-the-art result by Zhang et al. at IEEE TC 2024, only with 2 extra CNOTs.