Concrete quantum cryptanalysis of binary elliptic curves
Artikel i vetenskaplig tidskrift, 2021

This paper analyzes and optimizes quantum circuits for computing discrete logarithms on binary elliptic curves, including reversible circuits for fixed-base-point scalar multiplication and the full stack of relevant subroutines. The main optimization target is the size of the quantum computer, i.e., the number of logical qubits required, as this appears to be the main obstacle to implementing Shor’s polynomial-time discrete-logarithm algorithm. The secondary optimization target is the number of logical Toffoli gates. For an elliptic curve over a field of 2n elements, this paper reduces the number of qubits to 7n + ⌊log2 (n)⌋ + 9. At the same time this paper reduces the number of Toffoli gates to 48n3 + 8nlog2(3)+1 + 352n2 log2 (n) + 512n2 + O(nlog2(3)) with double-and-add scalar multiplication, and a logarithmic factor smaller with fixed-window scalar multiplication. The number of CNOT gates is also O(n3). Exact gate counts are given for various sizes of elliptic curves currently used for cryptography.

Quantum resource estimation

Quantum gates

Quantum cryptanalysis

Shor’s algorithm

Elliptic curves


Gustavo Souza Banegas

Chalmers, Data- och informationsteknik, Nätverk och system

Daniel J. Bernstein

University of Illinois

Ruhr-Universität Bochum

Iggy van Hoof

Technische Universiteit Eindhoven

Tanja Lange

Technische Universiteit Eindhoven

IACR Transactions on Cryptographic Hardware and Embedded Systems

25692925 (eISSN)

Vol. 2021 1 451-472



Diskret matematik

Annan elektroteknik och elektronik



Mer information

Senast uppdaterat