. 2024 Sep 10;14:21105. doi: 10.1038/s41598-024-69188-8

Table 13.

Cost estimates for Grover’s algorithm with $⌊ \frac{π}{4} 2^{k / 2} ⌋$ Grover oracle iterations for attacks with high success probability, without a depth restriction.

cipher	#CNOT	#1qCliff	#T	T-Depth	Full-Depth	Width	G-cost	DW-cost
AEGIS-128	$1.93 \cdot 2^{85}$	$1.52 \cdot 2^{82}$	$1.31 \cdot 2^{84}$	$1.85 \cdot 2^{72}$	$1.63 \cdot 2^{77}$	6496	$1.39 \cdot 2^{86}$	$1.30 \cdot 2^{90}$
Rocca-S	$1.89 \cdot 2^{150}$	$1.48 \cdot 2^{147}$	$1.29 \cdot 2^{149}$	$1.80 \cdot 2^{136}$	$1.60 \cdot 2^{141}$	9793	$1.36 \cdot 2^{151}$	$1.91 \cdot 2^{154}$
Tiaoxin-346	$1.74 \cdot 2^{86}$	$1.36 \cdot 2^{83}$	$1.18 \cdot 2^{85}$	$1.11 \cdot 2^{72}$	$1.95 \cdot 2^{76}$	14880	$1.25 \cdot 2^{87}$	$1.77 \cdot 2^{90}$