Utilizing Circulant Structure to Optimize the Implementations of Linear Layers
This work improves the efficiency of linear layer implementations in symmetric cryptography, benefiting cryptographers and hardware designers.
The paper proposes a method that exploits circulant structure in linear layers of symmetric ciphers to enable heuristic algorithms to find more efficient implementations. For Whirlwind M0, it achieves 159 XOR counts (8% better than prior work) and depth 17 (39% better), and for AES MixColumn, it produces a quantum circuit with depth 10, nearly matching the state-of-the-art with only 2 extra CNOTs.
In this paper, we propose a novel approach for optimizing the linear layer used in symmetric cryptography. It is observed that these matrices often have circulant structure. The basic idea of this work is to utilize the property to construct a sequence of transformation matrices, which allows subsequent heuristic algorithms to find more efficient implementations. Our results outperform previous works for various linear layers of block ciphers. For Whirlwind M0 , we obtain two implementations with 159 XOR counts (8% better than Yuan et al. at FSE 2025) and depth 17 (39% better than Shi et al. at AsiaCrypt 2024) respectively. For AES MixColumn, our automated method produces a quantum circuit with depth 10, which nearly matches the manually optimized state-of-the-art result by Zhang et al. at IEEE TC 2024, only with 2 extra CNOTs.