Optimized quantum implementation of elliptic curve arithmetic over binary fields

• Authors: Phillip Kaye
• Venue: Quantum Information & Computation
• Year: 2005

Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a "quantum attack" of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In [1], Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field GF(p). They employ a number of optimizations to achieve a running time of O(n2), and a space-requirement of O(n) qubits where n is the number of hits in the binary representation of p (there are some trade-off that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field GF(2m). In this paper, we show how to implement the extended Euclidean algorithm for polynomials to compute inverses in GF(2m). Working under the assumption that qubits will be an 'expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in [1] for GF(p), and we are able to take advantage of some properties of the binary field GF(2m). We also optimize the overall qubit space requirement for computing the group operation for elliptic curves over GF(2m) by decomposing the group operation to make it "piecewise reversible" (similar to what is done in [1] for curves over GF(p)).