How many [Toffoli gates][1] would be required to reversibly implement $(K,P)\mapsto(G,C)$ for the block cipher DES?

$P$ is the plaintext, $C$ the ciphertext, both 64-bit; $K$ is the 56-bit key; $G$ is any 56-bit "garbage".
___
For any block cipher with non trivial key width, the function $(K,P)\mapsto(G,C)$ with $G$ the same width as $K$ can be implemented reversibly using [Toffoli gates][1] (rigorous proof and/or straightening welcome). Given that key scheduling of DES is mere bit extraction, I guess $G$ can be $K$, or very close to that, with marginally less effort.

For AES, this seems quite realistic and studied:

- Kamalika Datta, Vishal Shrivastav, Indranil Sengupta, Hafizur Rahaman's [_Reversible Logic Implementation of AES Algorithm_][2], in [proceedings of DTIS 2013][3]. My reading is that it reports implementing $(K,P)\mapsto(G,C)$ using less than $2^{17}$ Toffoli gates.
- Markus Grassl, Brandon Langenberg, Martin Roetteler, Rainer Steinwandt's [_Applying Grover’s Algorithm to AES: Quantum Resource Estimates_][4], in [proceedings of PQCrypto 2016][5], seem just over $2^{20}$ Toffoli gates using a different approach.

  [1]: https://en.wikipedia.org/wiki/Toffoli_gate
  [2]: https://www.cs.cornell.edu/~vishal/papers/dtis_2013.pdf
  [3]: https://doi.org/10.1109/DTIS.2013.6527794
  [4]: https://arxiv.org/pdf/1512.04965.pdf#page=9
  [5]: https://doi.org/10.1007/978-3-319-29360-8_3