Improved Quantum Circuits for Elliptic Curve Discrete Logarithms

Abstract

We present improved quantum circuits for elliptic curve scalar multiplication, the most costly component in Shor's algorithm to compute discrete logarithms in elliptic curve groups. We optimize low-level components such as reversible integer and modular arithmetic through windowing techniques and more adaptive placement of uncomputing steps, and improve over previous quantum circuits for modular inversion by reformulating the binary Euclidean algorithm. Overall, we obtain an affine Weierstrass point addition circuit that has lower depth and uses fewer T gates than previous circuits. While previous work mostly focuses on minimizing the total number of qubits, we present various trade-offs between different cost metrics including the number of qubits, circuit depth and T -gate count. Finally, we provide a full implementation of point addition in the Q# quantum programming language that allows unit tests and automatic quantum resource estimation for all components.curve. Under plausible assumptions about physical error rates, this could translate into 6.77 · 10 7 physical qubits [11]. But the number of logical qubits is not the only important cost metric, and one might prioritize others such as circuit depth, the total number of gates, or the total number of likely expensive gates such as the Toffoli gate or the T gate.Our goal in this work is not only to improve the circuits proposed by RNSL [27], but also to explore different trade-offs favoring different cost metrics. To this end, we provide resource estimates for point addition circuits optimized for depth, T gate count, and width, respectively. We also report on initial experiments with automatic optimization for T -depth and T gate count. By using the automatic compilation techniques presented in [19], we find low T -depth and low T -count circuits for a modular multiplication component and show significant improvements compared to their manually designed counterparts, however, at a very high cost to the number of qubits.Beyond alternative choices for low-level arithmetic components, we also improve the higherlevel structure of RNSL's circuit. While many components stay the same, the most dramatic improvements come from windowing techniques similar to those proposed by Gidney and Ekerå in [14] and a better memory management via pebbling. For example, instead of copying out the result in an out-of-place circuit that uses Bennett's method for embedding an irreversible function in a reversible computation, the result can be used for the next operation before it is uncomputed. This technique does not treat modular operations merely as black boxes, but can adaptively reduce the cost of the higher-level circuit they are used in. Along with a reformulation of the binary extended Euclidean algorithm, it significantly reduces costs for the modular inversion circuit.One of our main contributions is a modular, testable library 4 of functions for elliptic curve arithmetic in the Q# programming language for quantum computing [31]. These incorporate different possible choic...

Quantum Circuit Design of Toom 3-Way Multiplication

“…Later, the design is explicitly constructed by Roetteler et al [27], who also proposed their own multiplication method based on Montgomery multiplication. In [28], Haner et al improved the work of [27] to use a windowing approach and adaptive uncomputation placement to lower the overall depth of the elliptic curve scalar multiplication circuit. However, note that the multiplications for Shor's algorithm employ a modular arithmetic approach, which has slightly different characteristics compared to the nonmodular one.…”

Leveraging State Sparsity for More Efficient Quantum Simulations

“…Approximate arithmetic adds k qubits and fails with probability Ω(2 −k ), requiring many qubits to simulate modestly accurate results. The lowest number of qubits for computing elliptic curve discrete logarithms [21] is estimated at 8n + O (lg n). We ind the smallest possible n = 3 uses 40 qubits.…”

“…Setup. We used a mix of łlow-widthž and łlow-Tž elliptic curve operations from the Q# implementation by Häner et al [21], with a set of prime-order curves deined over primes of 5 to 10 bits. We also used the signed windowed quantum Fourier transform, with a window size equal to ⌊lg n⌋ for n-bit primes.…”

The SQALE of CSIDH: sublinear Vélu quantum-resistant isogeny action with low exponents

“…We propose that the cost of the oracle is the most likely factor for future algorithmic improvements to reduce CSIDH quantum security. Any improvement in basic quantum arithmetic will apply to computing the CSIDH group action in superposition; thus, using estimates from current quantum arithmetic techniques like [12], will almost certainly overestimate costs (indeed, the costs they reference have since been reduced [24]). The alternative approach of [7] was to produce a classical constant-time implementation to give a lower bound on cost, since latency, reversibility, and fault tolerance will add significant overheads.…”