Paper 2017/598
Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms
Martin Roetteler, Michael Naehrig, Krysta M. Svore, and Kristin Lauter
Abstract
We give precise quantum resource estimates for Shor's algorithm to compute discrete logarithms on elliptic curves over prime fields. The estimates are derived from a simulation of a Toffoli gate network for controlled elliptic curve point addition, implemented within the framework of the quantum computing software tool suite LIQ$Ui\rangle$. We determine circuit implementations for reversible modular arithmetic, including modular addition, multiplication and inversion, as well as reversible elliptic curve point addition. We conclude that elliptic curve discrete logarithms on an elliptic curve defined over an $n$bit prime field can be computed on a quantum computer with at most $9n + 2\lceil\log_2(n)\rceil+10$ qubits using a quantum circuit of at most $448 n^3 \log_2(n) + 4090 n^3$ Toffoli gates. We are able to classically simulate the Toffoli networks corresponding to the controlled elliptic curve point addition as the core piece of Shor's algorithm for the NIST standard curves P192, P224, P256, P384 and P521. Our approach allows gatelevel comparisons to recent resource estimates for Shor's factoring algorithm. The results also support estimates given earlier by Proos and Zalka and indicate that, for current parameters at comparable classical security levels, the number of qubits required to tackle elliptic curves is less than for attacking RSA, suggesting that indeed ECC is an easier target than RSA.
Metadata
 Available format(s)
 Category
 Publickey cryptography
 Publication info
 Published by the IACR in ASIACRYPT 2017
 Keywords
 Quantum cryptanalysiselliptic curve cryptographyelliptic curve discrete logarithm problem.
 Contact author(s)
 mnaehrig @ microsoft com
 History
 20171031: last of 4 revisions
 20170621: received
 See all versions
 Short URL
 https://ia.cr/2017/598
 License

CC BY
BibTeX
@misc{cryptoeprint:2017/598, author = {Martin Roetteler and Michael Naehrig and Krysta M. Svore and Kristin Lauter}, title = {Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms}, howpublished = {Cryptology ePrint Archive, Paper 2017/598}, year = {2017}, note = {\url{https://eprint.iacr.org/2017/598}}, url = {https://eprint.iacr.org/2017/598} }