Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Using the Quantum Computer to Break Elliptic Curve Cryptosystems

Jodie Eicher, Yaw Opoku

Published Jan 1, 1997• 9 citations
OpenAlex

Abstract

This article gives an introduction to Elliptic Curve Cryptography and Quantum Computing. It includes an analysis of Peter Shor's algorithm for the quantum computer breakdown of Discrete Log Cryptosystems and an analog to Shor's algorithm for Elliptic Curve Cryptosystems. An extended example is included which illustrates how this modified Shor's algorithm will work. # Thanks to Hewlett-Packard for their generous support 1 1. Introduction The goa of this study is to developa nunderstaGW]] of howa qua tum computer, when creaW5( will bea]X tobrea the present da y elliptic curve cryptosystems. Elliptic curvesa re di#cult to work witha nd very di#cult ot understaN5 According to Dr.RonaN L. Rivest, founder of RSA Da ta Security, ... the security of crypotosystemsbaos on elliptic curves is not well understood, due inla]] pa] to thea7M5MX[ naM5M of elliptic curves. Few cryptograWX)( understaW elliptic curves, so there is not the sa( widesprea understaX)( an consensus concerning the security...

Related papers

Introduction

Alexei Petrenko, Sergei Petrenko

In quantum cryptanalysis, Shor's algorithm provides exponential acceleration of solving factorization problems, discrete logarithm problem, and elliptic curve discrete logarithm problems, widely used in cryptographic applications in cyberspace. Shor's quantum algorithm can potentially crack most protocols and schemes of asymmetric encryption (public key cryptography). In general, all known quantum algorithms can be divided into two groups: providing exponential gain (for example, Shor's algorithm) and providing quadratic gain (for example, Grover's algorithm). Particular attention is paid to the Shor quantum algorithm and other polynomial algorithms capable of solving cryptanalysis problems with the required reliability and complexity in polynomial time. For quantum computing, all cryptographies are divided into quantum-secure and quantum-insecure. Algorithms and cryptosystems of symmetric encryption are attributed to quantum-secure but with at least twice the key length increased. This chapter presents an overview of the concepts discussed in the subsequent chapters of this book.

River Publishers eBooks•Feb 7, 2023•0 citations

Security of elliptic curve cryptosystems over Z_n

Ruoxi Hu, Weihong Wu

Elliptic curves over Galois fields are widely used in modern cryptography. Cryptosystems based on elliptic curves are commonly deemed more secure than RSA for a given key size. However, with the rapid progress of quantum computing, the security of this traditional systems faces unprecedented challenge. To address this concern, this paper explores the resilience of a generalization of traditional elliptic curve cryptography. That is, we explore elliptic curves over non-prime rings (Zn), instead of fields. Elliptic curves over Zn for a composite integer n has been considered by researchers on information security. However, it is unclear how they stand against the unparalleled power of quantum computers. This article investigates quantum attacks on cryptosystems based on this new paradigm. The conclusion sheds light on the pressing and important task of searching for post-quantum cryptographic systems. In particular, the effectiveness of Shor’s algorithm (or its variation) on such systems is analyzed.

Theoretical and Natural Science•Nov 16, 2023•0 citations

Shor's discrete logarithm quantum algorithm for elliptic curves

John Proos, Christof Zalka

We show in some detail how to implement Shor's efficient quantum algorithm for discrete logarithms for the particular case of elliptic curve groups. It turns out that for this problem a smaller quantum computer can solve problems further beyond current computing than for integer factorisation. A 160 bit elliptic curve cryptographic key could be broken on a quantum computer using around 1000 qubits while factoring the security-wise equivalent 1024 bit RSA modulus would require about 2000 qubits. In this paper we only consider elliptic curves over GF(p) and not yet the equally important ones over GF(2^n) or other finite fields. The main technical difficulty is to implement Euclid's gcd algorithm to compute multiplicative inverses modulo p. As the runtime of Euclid's algorithm depends on the input, one difficulty encountered is the ``quantum halting problem''.

arXiv:quant-ph/0301141•Quantum Information and Computation•Jul 1, 2003•340 citations

Optimized quantum implementation of elliptic curve arithmetic over binary fields

Phillip Kaye

Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a ``quantum attack'' of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In \cite{PZ03}, Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field $\GF(p)$. They employ a number of optimizations to achieve a running time of $O(n^2)$, and a space-requirement of $O(n)$ qubits, where $n$ is the number of bits in the binary representation of $p$ (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).

arXiv:quant-ph/0407095•Quantum Information and Computation•Sep 1, 2005•27 citations

Shor's discrete logarithm quantum algorithm for elliptic curves

ProosJohn, ZalkaChristof

We show in some detail how to implement Shor's efficient quantum algorithm for discrete logarithms for the particular case of elliptic curve groups. It turns out that for this problem a smaller qua...

Quantum Information and Computation•Jul 1, 2003•26 citations

The Impact of Quantum Computing on Modern Cryptography: Challenges, Threats, and Migration Strategies

Nitin Bodade, 10.48047/jocaaa.2024.33.08.581

Quantum computing threatens to render obsolete the public-key cryptography that securesvirtually all modern digital communication, financial transactions, and data storage. Shor's algorithm, when executed on a sufficiently large fault-tolerant quantum computer, would breakthe RSA, Diffie-Hellman, and elliptic curve cryptosystems

Journal of Computational Analysis and Applications•Nov 1, 2024•0 citations
This article gives an introduction to Elliptic Curve Cryptography and Quantum Computing. It includes an analysis of Peter Shor's algorithm for the quantum computer breakdown of Discrete Log Cryptosystems and an analog to Shor's algorithm for Elliptic Curve Cryptosystems. An extended example is included which illustrates how this modified Shor's algorithm will work. # Thanks to Hewlett-Packard for their generous support 1 1. Introduction The goa of this study is to developa nunderstaGW]] of howa qua tum computer, when creaW5( will bea]X tobrea the present da y elliptic curve cryptosystems. Elliptic curvesa re di#cult to work witha nd very di#cult ot understaN5 According to Dr.RonaN L. Rivest, founder of RSA Da ta Security, ... the security of crypotosystemsbaos on elliptic curves is not well understood, due inla]] pa] to thea7M5MX[ naM5M of elliptic curves. Few cryptograWX)( understaW elliptic curves, so there is not the sa( widesprea understaX)( an consensus concerning the security...
In quantum cryptanalysis, Shor's algorithm provides exponential acceleration of solving factorization problems, discrete logarithm problem, and elliptic curve discrete logarithm problems, widely used in cryptographic applications in cyberspace. Shor's quantum algorithm can potentially crack most protocols and schemes of asymmetric encryption (public key cryptography). In general, all known quantum algorithms can be divided into two groups: providing exponential gain (for example, Shor's algorithm) and providing quadratic gain (for example, Grover's algorithm). Particular attention is paid to the Shor quantum algorithm and other polynomial algorithms capable of solving cryptanalysis problems with the required reliability and complexity in polynomial time. For quantum computing, all cryptographies are divided into quantum-secure and quantum-insecure. Algorithms and cryptosystems of symmetric encryption are attributed to quantum-secure but with at least twice the key length increased. This chapter presents an overview of the concepts discussed in the subsequent chapters of this book.
Elliptic curves over Galois fields are widely used in modern cryptography. Cryptosystems based on elliptic curves are commonly deemed more secure than RSA for a given key size. However, with the rapid progress of quantum computing, the security of this traditional systems faces unprecedented challenge. To address this concern, this paper explores the resilience of a generalization of traditional elliptic curve cryptography. That is, we explore elliptic curves over non-prime rings (Zn), instead of fields. Elliptic curves over Zn for a composite integer n has been considered by researchers on information security. However, it is unclear how they stand against the unparalleled power of quantum computers. This article investigates quantum attacks on cryptosystems based on this new paradigm. The conclusion sheds light on the pressing and important task of searching for post-quantum cryptographic systems. In particular, the effectiveness of Shor’s algorithm (or its variation) on such systems is analyzed.
We show in some detail how to implement Shor's efficient quantum algorithm for discrete logarithms for the particular case of elliptic curve groups. It turns out that for this problem a smaller quantum computer can solve problems further beyond current computing than for integer factorisation. A 160 bit elliptic curve cryptographic key could be broken on a quantum computer using around 1000 qubits while factoring the security-wise equivalent 1024 bit RSA modulus would require about 2000 qubits. In this paper we only consider elliptic curves over GF(p) and not yet the equally important ones over GF(2^n) or other finite fields. The main technical difficulty is to implement Euclid's gcd algorithm to compute multiplicative inverses modulo p. As the runtime of Euclid's algorithm depends on the input, one difficulty encountered is the ``quantum halting problem''.
Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a ``quantum attack'' of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In \cite{PZ03}, Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field $\GF(p)$. They employ a number of optimizations to achieve a running time of O(n2)O(n^2)O(n2), and a space-requirement of O(n)O(n)O(n) qubits, where nnn is the number of bits in the binary representation of ppp (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).