Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1209.6348

Efficient quantum circuits for binary elliptic curve arithmetic: reducing T-gate complexity

Brittanney Amento, Rainer Steinwandt, Martin Roetteler

Published Sep 27, 2012• 2 citations
arXivHTMLPDF

Abstract

Elliptic curves over finite fields GF(2^n) play a prominent role in modern cryptography. Published quantum algorithms dealing with such curves build on a short Weierstrass form in combination with affine or projective coordinates. In this paper we show that changing the curve representation allows a substantial reduction in the number of T-gates needed to implement the curve arithmetic. As a tool, we present a quantum circuit for computing multiplicative inverses in GF(2^n) in depth O(n log n) using a polynomial basis representation, which may be of independent interest.

DOI
10.48550/arxiv.1209.6348

Related papers

Efficient quantum circuits for binary elliptic curve arithmetic: reducing $T$-gate complexity

Brittanney Amento, Martin Rötteler, Rainer Steinwalds

Elliptic curves over finite fields ${\mathbb F}_{2^n}$ play a prominent role in modern cryptography. Published quantum algorithms dealing with such curves build on a short Weierstrass form in combination with affine or projective coordinates. In this paper we show that changing the curve representation allows a substantial reduction in the number of $T$-gates needed to implement the curve arithmetic. As a tool, we present a quantum circuit for computing multiplicative inverses in $\mathbb F_{2^n}$ in depth $\bigO(n\log_2 n)$ using a polynomial basis representation, which may be of independent interest.

Quantum Information and Computation•May 1, 2013•20 citations

Efficient quantum circuits for binary elliptic curve arithmetic

AmentoBrittanney, RöttelerMartin, SteinwandtRainer

Elliptic curves over finite fields F2n play a prominent role in modern cryptography. Published quantum algorithms dealing with such curves build on a short Weierstrass form in combination with affi...

Quantum Information and Computation•Jul 1, 2013•0 citations

A quantum circuit to find discrete logarithms on ordinary binary elliptic curves in depth O(log^2 n)

Martin Roetteler, Rainer Steinwandt

Improving over an earlier construction by Kaye and Zalka, Maslov et al. describe an implementation of Shor's algorithm which can solve the discrete logarithm problem on binary elliptic curves in quadratic depth O(n^2). In this paper we show that discrete logarithms on such curves can be found with a quantum circuit of depth O(log^2 n). As technical tools we introduce quantum circuits for GF(2^n) multiplication in depth O(log n) and for GF(2^n) inversion in depth O(log^2 n).

arXiv:1306.1161•Jun 5, 2013•0 citations

Optimized quantum implementation of elliptic curve arithmetic over binary fields

Phillip Kaye

Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a ``quantum attack'' of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In \cite{PZ03}, Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field $\GF(p)$. They employ a number of optimizations to achieve a running time of $O(n^2)$, and a space-requirement of $O(n)$ qubits, where $n$ is the number of bits in the binary representation of $p$ (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).

arXiv:quant-ph/0407095•Quantum Information and Computation•Sep 1, 2005•27 citations

Quantum binary field inversion: improved circuit depth via choice of basis representation

Brittanney Amento, Martin Rötteler, Rainer Steinwandt

Finite fields of the form ${\mathbb F}_{2^m}$ play an important role in coding theory and cryptography. We show that the choice of how to represent the elements of these fields can have a significant impact on the resource requirements for quantum arithmetic. In particular, we show how the use of Gaussian normal basis representations and of `ghost-bit basis' representations can be used to implement inverters with a quantum circuit of depth $\bigO(m\log(m))$. To the best of our knowledge, this is the first construction with subquadratic depth reported in the literature. Our quantum circuit for the computation of multiplicative inverses is based on the Itoh-Tsujii algorithm which exploits that in normal basis representation squaring corresponds to a permutation of the coefficients. We give resource estimates for the resulting quantum circuit for inversion over binary fields ${\mathbb F}_{2^m}$ based on an elementary gate set that is useful for fault-tolerant implementation.

arXiv:1209.5491•Quantum Information and Computation•Jan 1, 2013•13 citations

An O(m^2)-depth quantum algorithm for the elliptic curve discrete logarithm problem over GF(2^m)

D. Maslov, J. Mathew, D. Cheung +1 more

We consider a quantum polynomial-time algorithm which solves the discrete logarithm problem for points on elliptic curves over $GF(2^m)$. We improve over earlier algorithms by constructing an efficient circuit for multiplying elements of binary finite fields and by representing elliptic curve points using a technique based on projective coordinates. The depth of our proposed implementation, executable in the Linear Nearest Neighbor (LNN) architecture, is $O(m^2)$, which is an improvement over the previous bound of $O(m^3)$ derived assuming no architectural restrictions.

Quantum Information and Computation•Jul 1, 2009•18 citations
Elliptic curves over finite fields GF(2^n) play a prominent role in modern cryptography. Published quantum algorithms dealing with such curves build on a short Weierstrass form in combination with affine or projective coordinates. In this paper we show that changing the curve representation allows a substantial reduction in the number of T-gates needed to implement the curve arithmetic. As a tool, we present a quantum circuit for computing multiplicative inverses in GF(2^n) in depth O(n log n) using a polynomial basis representation, which may be of independent interest.
Efficient quantum circuits for binary elliptic curve arithmetic: reducing TTT-gate complexity
Elliptic curves over finite fields F2n{\mathbb F}_{2^n}F2n​ play a prominent role in modern cryptography. Published quantum algorithms dealing with such curves build on a short Weierstrass form in combination with affine or projective coordinates. In this paper we show that changing the curve representation allows a substantial reduction in the number of TTT-gates needed to implement the curve arithmetic. As a tool, we present a quantum circuit for computing multiplicative inverses in F2n\mathbb F_{2^n}F2n​ in depth $\bigO(n\log_2 n)$ using a polynomial basis representation, which may be of independent interest.
Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a ``quantum attack'' of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In \cite{PZ03}, Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field $\GF(p)$. They employ a number of optimizations to achieve a running time of O(n2)O(n^2)O(n2), and a space-requirement of O(n)O(n)O(n) qubits, where nnn is the number of bits in the binary representation of ppp (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).
Finite fields of the form F2m{\mathbb F}_{2^m}F2m​ play an important role in coding theory and cryptography. We show that the choice of how to represent the elements of these fields can have a significant impact on the resource requirements for quantum arithmetic. In particular, we show how the use of Gaussian normal basis representations and of `ghost-bit basis' representations can be used to implement inverters with a quantum circuit of depth $\bigO(m\log(m))$. To the best of our knowledge, this is the first construction with subquadratic depth reported in the literature. Our quantum circuit for the computation of multiplicative inverses is based on the Itoh-Tsujii algorithm which exploits that in normal basis representation squaring corresponds to a permutation of the coefficients. We give resource estimates for the resulting quantum circuit for inversion over binary fields F2m{\mathbb F}_{2^m}F2m​ based on an elementary gate set that is useful for fault-tolerant implementation.
We consider a quantum polynomial-time algorithm which solves the discrete logarithm problem for points on elliptic curves over GF(2m)GF(2^m)GF(2m). We improve over earlier algorithms by constructing an efficient circuit for multiplying elements of binary finite fields and by representing elliptic curve points using a technique based on projective coordinates. The depth of our proposed implementation, executable in the Linear Nearest Neighbor (LNN) architecture, is O(m2)O(m^2)O(m2), which is an improvement over the previous bound of O(m3)O(m^3)O(m3) derived assuming no architectural restrictions.