Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition

Abstract: The Elliptic Curve Discrete Logarithm Problem (ECDLP) is a fundamental problem in cryptography, and reducing the resource requirements of quantum algorithms for solving ECDLP is an important goal. In this work, we present a space-efficient quantum algorithm for solving the ECDLP over prime fields, achieving an implementation with only $3n+6\lfloor \log_2 n \rfloor+O(1)$ logical qubits and $919n^3/\log_2 n+O(n^2)$ Toffoli gates, where $n$ is the bit-length of the prime. For a 256-bit prime-field curve, our construction requires only 835 logical qubits, reducing the previous best estimates of 1098 and 1175 logical qubits by Chevignard et al. [EUROCRYPT 2026] and Babbush et al. [ArXiv Preprint 2026], respectively. The key to our improvement is a new space-efficient reversible modular inversion circuit, which addresses the dominant space bottleneck in affine-coordinate point addition. Starting from the extended Euclidean algorithm (EEA), we refine the register-sharing technique of Proos and Zalka by introducing length registers and location-controlled arithmetic to compactly store and update intermediate variables. We further optimize the reversible update procedures and construct the corresponding controlled arithmetic circuits, resulting in a modular inversion circuit implemented by only $2n+6\lfloor \log_2 n \rfloor+O(1)$ logical qubits and $195n^2+O(n\log_2 n)$ Toffoli gates. This modular inversion circuit together with mid-circuit measurements and classical feed-forward operations provides a space-efficient controlled affine point-addition circuit and a complete implementation of Shor's algorithm for ECDLP.

• The paper presents a refined modular inversion circuit with precise register sharing, achieving exact computations and reducing logical qubit overhead from O(√n) to O(log n).
• It details a comprehensive resource analysis showing a marked reduction in Toffoli gate counts and logical qubits compared to previous quantum circuit designs for ECDLP.
• The work implements affine point addition via mid-circuit measurements and classical feed-forward, further optimizing space efficiency for solving the ECDLP over prime fields.

Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition

Introduction and Motivation

Solving the Elliptic Curve Discrete Logarithm Problem (ECDLP) underpins the security of elliptic curve cryptography (ECC). While Shor's algorithm enables polynomial-time attacks on ECDLP with quantum hardware, the practical quantum resource requirements—predominantly logical qubits and Toffoli gate counts—have motivated ongoing research into reducing these costs, making large-scale cryptanalytic attacks more tractable on future fault-tolerant quantum machines.

This work provides a rigorous and explicit construction of a space-efficient quantum algorithm for ECDLP over prime fields. The central innovation is a refined modular inversion circuit, which is the principal bottleneck for space and performance in affine-coordinate group operations on elliptic curves. The design improves both logical qubit requirements and gate complexity, surpassing previous explicit and implicit constructions.

Modular Inversion: Algorithmic and Circuit Innovations

A main contribution lies in exact, circuit-level realization of a register-sharing technique for reversible modular inversion via the extended Euclidean algorithm (EEA), originally proposed at an abstract level by Proos and Zalka. Compared to earlier high-level or approximate approaches, this design achieves:

• Exactness for all superpositions: No fidelity loss in the quantum EEA for all $x \in \mathbb{F}_p^\times$, unlike the $O(n^{-1})$ infidelity from truncation in earlier works.
• Improved register allocation: Introduction of length registers and location-controlled arithmetic to enable precise, input-length-adaptive storage, reducing overheads from $O(\sqrt{n})$ to $O(\log n)$.
• Explicit gate-efficient implementation: Systematic decomposition of modular inversion into location-controlled arithmetic and swap operations with explicit cost analysis and optimized gate scheduling.

The modular inversion subroutine is realized with only $2n + 6\lfloor \log_2 n \rfloor + O(1)$ logical qubits and $(195 n^2 + O(n \log n))$ Toffoli gates, significantly reducing footprint versus previous explicit approaches.

Figure 1: Modular inversion circuit Toffoli and CNOT gate count as a function of prime field size $n$.

Register Sharing and Resource Bound Analysis

The core resource savings stem from aggressive register sharing exploiting the monotonic behaviors of variable updates in EEA. The (reversible) workspace jointly holds $r, t, q$ and $r', t'$ in intricately managed segments, with dynamic boundary tracking via short length registers, as elucidated in the text and illustrative register diagrams.

Careful analysis establishes that all cases can be handled without input-dependent truncation, yielding the following resource profiles:

• Affine point addition: $3n + 6\lfloor \log_2 n \rfloor + O(1)$ logical qubits.
• Complete Shor-ECDLP circuit (affine coordinates): For $O(n^{-1})$0 (secp256k1, e.g.), only 835 logical qubits are required, compared to 1098–1192 in recent best prior designs.

Quantum Circuit Construction

The realization of modular inversion is decomposed into subcircuits leveraging location-controlled arithmetic, enabled by pruned unary iteration and efficient reversible logic primitives. Key innovations include:

• Location-controlled swap and arithmetic: Circuits acting selectively across register positions, indexed via dynamic windowing and operated via unary iteration (see Figures 7 and 11).
• Optimized length-update circuits: Efficient encoding and update of register boundaries, using telescoping XOR and dirty ancilla borrowing, minimizing additional clean qubit demands.

  Figure 2: Compute and uncompute forms of the reversible AND gate, required for unary iteration in location-controlled primitives.

  

Figure 3: Controlled $O(n^{-1})$1 and related primitives used in reversible addition/subtraction blocks.

The resulting modular inversion circuit, including all boundary selection, active windowing, and arithmetic, attains a Toffoli cost of $O(n^{-1})$2 ($O(n^{-1})$3 = field bit length), with explicit per-block and per-step analysis.

Affine Point Addition with Mid-Circuit Measurements

Affine point addition is realized within the same space budget by leveraging mid-circuit measurement and classical feed-forward techniques. The crucial insight is that, after modular division or multiplication, the now-redundant input register can be measured and reset to enable continued reversible computation with minimal ancillae, while preserving overall coherence (up to correctable phase factors).

Figure 4: Affine point-addition circuit leveraging mid-circuit measurements for register reuse and space efficiency.

Figure 5: In-place modular division circuit, with mid-circuit measurement and classical feed-forward phase correction.

This circuit architecture matches the best known space asymptotics for ECDLP with fully explicit, correct circuits, contrasting with implicit matrix arithmetic or non-affine representations referenced in other works.

Resource Estimates and Comparative Evaluation

The algorithm is benchmarked in both asymptotic and concrete terms. Notably:

• For secp256k1 ($O(n^{-1})$4): 835 logical qubits, $O(n^{-1})$5 Toffoli gates, a two-order-of-magnitude Toffoli reduction relative to prior low-space techniques that trade space for $O(n^{-1})$6 gate complexity.
• Asymptotic performance: $O(n^{-1})$7 Toffoli gates are achieved for the full signed-window variant of Shor's algorithm, improving prior $O(n^{-1})$8 explicit point addition circuits.

The circuit is implemented, synthesized, and resource-counted in Qiskit, confirming analytic cost bounds (see Figure 1 and associated numerical tables).

Implications and Future Directions

This work demonstrates that, even under the strictest logical-qubit budgets and with explicit arithmetic, quantum ECDLP remains feasible at cryptographic bitlengths given future fault-tolerant hardware. Practically, this result tightens estimates for the critical quantum threshold of ECDLP-based cryptosystem security.

Theoretically, key directions for further development include:

• Reduction of Toffoli and CNOT counts: Exploiting improved location-controlled logic, register-encoding optimization, and parallelism.
• Space-depth tradeoff exploration: Quantitative analysis and possibly hardware-aware compilation for hybrid depth/qubit constraint scenarios.
• Transfer to other arithmetic quantum algorithms: Applying these register-sharing and measurement techniques to modular inversion and division in broader algebraic contexts, e.g., cryptanalysis of RSA, LWE, or extensions to alternative coordinate representations.
• AI-aided quantum circuit discovery: Encoding these composable, modular blocks as primitive policies for evolutionary or RL-based automated quantum compiler agents (e.g., inspired by AlphaEvolve).

Conclusion

By transforming high-level conceptual space-reduction ideas into explicit, exact, and optimized quantum circuits, this paper sets a new standard for space-efficiency in the quantum solution of the ECDLP over prime fields. These tools underpin tighter, more realistic resource requirements for post-quantum cryptanalysis and inform the design of next-generation fault-tolerant quantum architectures as cryptography faces the quantum era.

• "Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition" (2607.13816)