Resource analysis of Shor's elliptic curve algorithm with an improved quantum adder on a two-dimensional lattice

TL;DR

The paper addresses the practical resource analysis of Shor's elliptic-curve algorithm under two-dimensional lattice constraints. It introduces a carry-lookahead quantum adder with Toffoli depth $\log n + \log\log n + O(1)$ using $O(n)$ ancillas, and integrates windowing, Montgomery representation, and quantum tables within dynamic circuits to achieve substantial depth reductions. The authors provide explicit 2D-layout-based resource estimates for qubits, Toffoli depth/count, and CNOT counts, showing that breaking NIST P-256 requires about $4300$ logical qubits with Toffoli fidelity around $10^{-9}$. They also identify modular division as the dominant cost and discuss avenues to further improve hardware efficiency and error-correction considerations, establishing concrete baselines for experimental attacks on elliptic-curve cryptography. These results offer a practical blueprint for implementing quantum elliptic-curve cryptanalysis on near- to mid-term quantum architectures.

Abstract

Quantum computers have the potential to break classical cryptographic systems by efficiently solving problems such as the elliptic curve discrete logarithm problem using Shor's algorithm. While resource estimates for factoring-based cryptanalysis are well established, comparable evaluations for Shor's elliptic curve algorithm under realistic architectural constraints remain limited. In this work, we propose a carry-lookahead quantum adder that achieves Toffoli depth $\log n + \log\log n + O(1)$ with only $O(n)$ ancillas, matching state-of-the-art performance in depth while avoiding the prohibitive $O(n\log n)$ space overhead of existing approaches. Importantly, our design is naturally compatible with the two-dimensional nearest-neighbor architectures and introduce only a constant-factor overhead. Further, we perform a comprehensive resource analysis of Shor's elliptic curve algorithm on two-dimensional lattices using the improved adder. By leveraging dynamic circuit techniques with mid-circuit measurements and classically controlled operations, our construction incorporates the windowed method, Montgomery representation, and quantum tables, and substantially reduces the overhead of long-range gates. For cryptographically relevant parameters, we provide precise resource estimates. In particular, breaking the NIST P-256 curve, which underlies most modern public-key infrastructures and the security of Bitcoin, requires about $4300$ logical qubits and logical Toffoli fidelity about $10^{-9}$. These results establish new benchmarks for efficient quantum arithmetic and provide concrete guidance toward the experimental realization of Shor's elliptic curve algorithm.

Figures (28)

• Figure 1: The relationship between the Toffoli depth, Toffoli number, and the input size $n$ (i.e., the bit length of the elliptic curve). These metrics are evaluated by simulating our circuit for $n$ values from $2$ to $2048$. Minor fluctuations in the Toffoli number appear when the window size increases by one.
• Figure 2: Two diagrams illustrating the qubit layout. (a) The diagram for the single-layer layout, each ball representing a qubit, and each line consists of $n$ qubits. (b) The diagram for the bi-layer layout, each ball representing a qubit, and each line consists of $n$ qubits. Blue balls stand for the qubits in the upper layer, red balls stand for those in the lower layer.
• Figure 3: Implementation of the long-range Toffoli gate using dynamic circuits. (a) An example of the circuit for implementing a long-range Toffoli gate with the output qubit in the middle. (b) The layout of ancillary qubits for the circuit in (a). We use red circles to represent the data qubits to implement Toffoli, black circles to represent the unused data qubits, white circles to represent the ancillary qubits initialized in $\ket{0}$, and blue circles to represent ancillas storing intermediate data. (c) An example of the circuit for implementing the long-range Toffoli gate with the output qubit on the edge. Notably, the second Toffoli gate is used for uncomputing the ancillary qubit, which can be designed with zero $T$-depth, as explained in Appendix \ref{['sec:toffoli-gate']}. Therefore, the two circuits shown by (a) and (c) have the same $T$-depth. (d) An example of implementing a long-range CNOT using dynamic circuit with a depth of 6.
• Figure 4: Implementation of GHZ state generation. (a) Two equivalent circuits for implementing GHZ state generation. (b) Implement parallel controlled gates using GHZ state generation. We use red circles to represent the data qubits to implement controlled gates, green circles to represent the control qubit, and blue circles to represent ancillas storing intermediate data.
• Figure 5: Demonstration of carry bit computing by solving the prefix sum problem. Each column corresponds to a group of qubits that store the values of $p$ and $g$, while each row represents a layer of Toffoli gates. If the $j$-th column is labeled $i$, it indicates that the values of $p[i,j]$ and $g[i,j]$ are stored in the qubits. Since $p[i,k]$ and $g[i,k]$ can be derived from $p[i,j]$, $g[i,j]$ together with $p[j,k]$, $g[j,k]$, the label of the $k$-th column can be updated from $j$ to $i$ whenever the $j$-th column is already labeled $i$. Proceeding in this way, the process eventually labels every column with $0$, meaning that $g[0,i]$ has been obtained for all $i$. These values correspond exactly to the carry bits. (a) Method based on the Brent-Kung tree draper2004logarithmic. (b) Method based on the Sklansky tree wang2024optimal. (c) Our method combining both approaches.

Theorems & Definitions (1)

• Lemma 1