Optimized quantum implementation of elliptic curve arithmetic over binary fields

Abstract

Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a ``quantum attack'' of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In \cite{PZ03}, Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field $\GF(p)$. They employ a number of optimizations to achieve a running time of $O(n^2)$, and a space-requirement of $O(n)$ qubits, where $n$ is the number of bits in the binary representation of $p$ (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).

Automatic synthesis of quantum circuits for point addition on ordinary binary elliptic curves

“…Quantum circuits for these tasks are available (cf. [6,14,16,2] Multiplication: Optimizing the field multiplier is outside the scope of this paper, and subsequently we will use a linear-depth construction by Maslov et al [16]. With this method one can multiply two elements a, b ∈ F 2 n with no more than n 2 Toffoli gates and n 2 − 1 CNOT gates.…”

“…Kaye and Zalka [14] argue that to implement Shor's algorithm it it sufficient to provide a quantum circuit that implements the "generic branch" P 1 = ±P 2 of Algorithm 1 for a fixed point P 2 , and we restrict to this situation. To avoid the (costly) inversion operation, one usually implements this point addition in a projective representation.…”

“…Approaches by Kaye and Zalka [14] and by Maslov et al [16] rely on the use of projective coordinates and efficient circuits for adding fixed (classically precomputed) points in a right-to-left variant of the doubleand-add algorithm. In fact, only a "generic" addition of a fixed point is implemented, avoiding a handling of special cases of the addition law (doubling a point, adding a point with its inverse, or with the identity element).…”

Quantum binary field inversion: improved circuit depth via choice of basis representation

“…Having good quantum circuits for arithmetic is indispensable for obtaining good resource estimates and efficient circuit implementations of more complex quantum algorithms. In view of the cryptographic significance, it is not surprising that a number of publications have already explored quantum circuits to implement finite field arithmetic, including [3,15,17,18]. Important special cases are arithmetic operations in finite prime fields and finite binary fields (cf., for instance, [22]).…”

Design and synthesis of efficient circuits for quantum computers

“…There are a few quantum dividers known, among them there are some [138,139] which are suitable for multiplicative inversion in the Galois field GF(2 m ) with depth of O(n 3 ) and O(nlog 2 n), respectively. Another divider suitable for integer division appears in [25], it is based in QFT and offers depth of O(n 3 ).…”