Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a ``quantum attack'' of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In \cite{PZ03}, Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field $\GF(p)$. They employ a number of optimizations to achieve a running time of $O(n^2)$ , and a space-requirement of $O(n)$ qubits, where $n$ is the number of bits in the binary representation of $p$ (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a ``quantum attack'' of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In \cite{PZ03}, Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field $\GF(p)$. They employ a number of optimizations to achieve a running time of $O(n^2)$, and a space-requirement of $O(n)$ qubits, where $n$ is the number of bits in the binary representation of $p$ (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).

arXiv:quant-ph/0407095Quantum Information and ComputationSep 1, 200527 citations

Using the Quantum Computer to Break Elliptic Curve Cryptosystems

Jodie Eicher, Yaw Opoku

This article gives an introduction to Elliptic Curve Cryptography and Quantum Computing. It includes an analysis of Peter Shor's algorithm for the quantum computer breakdown of Discrete Log Cryptosystems and an analog to Shor's algorithm for Elliptic Curve Cryptosystems. An extended example is included which illustrates how this modified Shor's algorithm will work. # Thanks to Hewlett-Packard for their generous support 1 1. Introduction The goa of this study is to developa nunderstaGW]] of howa qua tum computer, when creaW5( will bea]X tobrea the present da y elliptic curve cryptosystems. Elliptic curvesa re di#cult to work witha nd very di#cult ot understaN5 According to Dr.RonaN L. Rivest, founder of RSA Da ta Security, ... the security of crypotosystemsbaos on elliptic curves is not well understood, due inla]] pa] to thea7M5MX[ naM5M of elliptic curves. Few cryptograWX)( understaW elliptic curves, so there is not the sa( widesprea understaX)( an consensus concerning the security...This article gives an introduction to Elliptic Curve Cryptography and Quantum Computing. It includes an analysis of Peter Shor's algorithm for the quantum computer breakdown of Discrete Log Cryptosystems and an analog to Shor's algorithm for Elliptic Curve Cryptosystems. An extended example is included which illustrates how this modified Shor's algorithm will work. # Thanks to Hewlett-Packard for their generous support 1 1. Introduction The goa of this study is to developa nunderstaGW]] of howa qua tum computer, when creaW5( will bea]X tobrea the present da y elliptic curve cryptosystems. Elliptic curvesa re di#cult to work witha nd very di#cult ot understaN5 According to Dr.RonaN L. Rivest, founder of RSA Da ta Security, ... the security of crypotosystemsbaos on elliptic curves is not well understood, due inla]] pa] to thea7M5MX[ naM5M of elliptic curves. Few cryptograWX)( understaW elliptic curves, so there is not the sa( widesprea understaX)( an consensus concerning the security...

Jan 1, 19979 citations

O(n^2)

, and a space-requirement of

O(n)

qubits, where

n

is the number of bits in the binary representation of

p

(there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).