Quantum circuit for implementing AES S-box with low costs

The Advanced Encryption Standard (AES) is widely used and well-studied for its efficiency and strong security. This paper presents quantum circuit designs for the AES S-box by introducing the composite field $F((2^4)^2)$ to replace the traditional field $F(2^8)$, enabling the inversion to be decomposed into operations over $F(2^4)$. This work reduces the quantum resource overhead required for implementing the S-box by decreasing the number of $CNOT$ gates in the matrix multiplication, lowering the depth of $T$ gates in both the inversion circuit and the multiplication circuit. Besides, the widths for the S-box quantum circuits are also optimized during the inversion circuit and multiplication circuit. With a linear key schedule, the resulting AES-128 quantum circuit reduce the product of the circuit width and $T$ depth to 102800, which is the lowest known to date.