Shor's discrete logarithm quantum algorithm for elliptic curves
Abstract
We show in some detail how to implement Shor's efficient quantum algorithm for discrete logarithms for the particular case of elliptic curve groups. It turns out that for this problem a smaller quantum computer can solve problems further beyond current computing than for integer factorisation. A 160 bit elliptic curve cryptographic key could be broken on a quantum computer using around 1000 qubits while factoring the securitywise equivalent 1024 bit RSA modulus would require about 2000 qubits. In this paper we only consider elliptic curves over GF($p$) and not yet the equally important ones over GF($2^n$) or other finite fields. The main technical difficulty is to implement Euclid's gcd algorithm to compute multiplicative inverses modulo $p$. As the runtime of Euclid's algorithm depends on the input, one difficulty encountered is the ``quantum halting problem''.
 Publication:

arXiv eprints
 Pub Date:
 January 2003
 arXiv:
 arXiv:quantph/0301141
 Bibcode:
 2003quant.ph..1141P
 Keywords:

 Quantum Physics
 EPrint:
 34 pages Latex, essentially published version, but not using Journal style file