Concrete quantum cryptanalysis of binary elliptic curves
Journal article, 2021

This paper analyzes and optimizes quantum circuits for computing discrete logarithms on binary elliptic curves, including reversible circuits for fixed-base-point scalar multiplication and the full stack of relevant subroutines. The main optimization target is the size of the quantum computer, i.e., the number of logical qubits required, as this appears to be the main obstacle to implementing Shor’s polynomial-time discrete-logarithm algorithm. The secondary optimization target is the number of logical Toffoli gates. For an elliptic curve over a field of 2n elements, this paper reduces the number of qubits to 7n + ⌊log2 (n)⌋ + 9. At the same time this paper reduces the number of Toffoli gates to 48n3 + 8nlog2(3)+1 + 352n2 log2 (n) + 512n2 + O(nlog2(3)) with double-and-add scalar multiplication, and a logarithmic factor smaller with fixed-window scalar multiplication. The number of CNOT gates is also O(n3). Exact gate counts are given for various sizes of elliptic curves currently used for cryptography.

Quantum resource estimation

Quantum gates

Quantum cryptanalysis

Shor’s algorithm

Elliptic curves


Gustavo Souza Banegas

Chalmers, Computer Science and Engineering (Chalmers), Networks and Systems (Chalmers)

Daniel J. Bernstein

University of Illinois

Ruhr-Universität Bochum

Iggy van Hoof

Eindhoven University of Technology

Tanja Lange

Eindhoven University of Technology

IACR Transactions on Cryptographic Hardware and Embedded Systems

25692925 (eISSN)

Vol. 2021 1 451-472

Subject Categories

Computational Mathematics

Discrete Mathematics

Other Electrical Engineering, Electronic Engineering, Information Engineering



More information

Latest update