[Paper Review] Quantum resource estimates for computing elliptic curve discrete logarithms

Martin Roetteler, Michael Naehrig+2 more|arXiv (Cornell University)|Jun 21, 2017

Quantum Computing Algorithms and Architecture4 citations

TL;DR

This paper provides precise quantum resource estimates for Shor’s algorithm to compute elliptic curve discrete logarithms using reversible quantum circuits. It implements and simulates controlled elliptic curve point addition in LIQUi|⟩, showing that solving ECDLP on an n-bit prime field requires at most 9n + 2⌈log₂(n)⌉ + 10 qubits and 448n³ log₂(n) + 4090n³ Toffoli gates, confirming that ECC is a more feasible target for quantum attacks than RSA at equivalent classical security levels.

ABSTRACT

We give precise quantum resource estimates for Shor's algorithm to compute discrete logarithms on elliptic curves over prime fields. The estimates are derived from a simulation of a Toffoli gate network for controlled elliptic curve point addition, implemented within the framework of the quantum computing software tool suite LIQ$Ui|\ angle$. We determine circuit implementations for reversible modular arithmetic, including modular addition, multiplication and inversion, as well as reversible elliptic curve point addition. We conclude that elliptic curve discrete logarithms on an elliptic curve defined over an $n$-bit prime field can be computed on a quantum computer with at most $9n + 2\\lceil\\log_2(n)\ ceil+10$ qubits using a quantum circuit of at most $448 n^3 \\log_2(n) + 4090 n^3$ Toffoli gates. We are able to classically simulate the Toffoli networks corresponding to the controlled elliptic curve point addition as the core piece of Shor's algorithm for the NIST standard curves P-192, P-224, P-256, P-384 and P-521. Our approach allows gate-level comparisons to recent resource estimates for Shor's factoring algorithm. The results also support estimates given earlier by Proos and Zalka and indicate that, for current parameters at comparable classical security levels, the number of qubits required to tackle elliptic curves is less than for attacking RSA, suggesting that indeed ECC is an easier target than RSA.

Motivation & Objective

• To provide accurate, gate-level quantum resource estimates for solving the elliptic curve discrete logarithm problem (ECDLP) using Shor’s algorithm.
• To implement and simulate reversible quantum circuits for modular arithmetic and elliptic curve point addition within the LIQUi|⟩ framework.
• To compare the quantum resource requirements for ECDLP with those for RSA factoring at equivalent classical security levels.
• To validate the feasibility of simulating core components of Shor’s algorithm for ECDLP on classical machines for standard NIST curves.

Proposed method

• The authors developed reversible quantum circuits for modular addition, multiplication, and inversion using the binary GCD algorithm to minimize qubit usage.
• They implemented controlled elliptic curve point addition as the core component of Shor’s algorithm, using Toffoli and CNOT gates within the LIQUi|⟩ quantum software stack.
• The circuits were compiled and simulated classically, enabling verification of correctness and resource estimation for up to 521-bit curves.
• The simulation leveraged classical reversible circuit simulation to validate the correctness of the Toffoli networks for P-192, P-224, P-256, P-384, and P-521 curves.
• Resource counts were derived from the Toffoli gate count and qubit allocation across all arithmetic and point addition components.
• The analysis included a comparison with Proos and Zalka’s theoretical estimates, highlighting differences due to implementation choices and lack of register sharing optimization.

Experimental results

Research questions

• RQ1 What is the exact number of qubits and Toffoli gates required to implement Shor’s algorithm for solving the ECDLP on elliptic curves over prime fields?
• RQ2 How do the quantum resource requirements for ECDLP compare to those for RSA factoring at equivalent classical security levels?
• RQ3 Can the core reversible circuits for elliptic curve point addition be classically simulated for standard NIST curves?
• RQ4 To what extent do implementation choices, such as using binary GCD instead of Euclidean algorithm, affect qubit and gate count?
• RQ5 Can register sharing optimizations reduce qubit overhead in reversible modular inversion, and why is it not fully realized in this implementation?

Key findings

• The quantum circuit for ECDLP requires at most 9n + 2⌈log₂(n)⌉ + 10 qubits and 448n³ log₂(n) + 4090n³ Toffoli gates for an n-bit prime field.
• The authors successfully classically simulated the Toffoli networks for controlled elliptic curve point addition on all NIST standard curves, including P-521.
• The resource estimates confirm that breaking ECC is more feasible on a quantum computer than breaking RSA at comparable classical security levels.
• The qubit count exceeds Proos and Zalka’s theoretical estimates due to the lack of register sharing optimization in the modular inversion implementation.
• The implementation generates one garbage bit per round in the extended binary GCD, requiring additional qubits for uncomputation, which limits qubit efficiency.
• The results support the conclusion that ECC is a more practical target for quantum cryptanalysis than RSA, even for relatively small key sizes.