D. Cheung – IQC/UWaterloo, Canada D. K. Pradhan – UBristol, UK On the Design and Optimization of a Quantum Polynomial-Time Attack on Elliptic Curve Cryptography D. Cheung – IQC/UWaterloo, Canada D. Maslov (spkr) – IQC/UWaterloo, Canada J. Mathew – UBristol, UK D. K. Pradhan – UBristol, UK

Outline What is and why Elliptic Curve Cryptography (ECC)? Quantum algorithm for additive logarithm over elliptic curves Analysis and conclusion page 1/16

What is ECC? ECC is an approach to public key cryptography based on the algebraic structure of elliptic curves over finite fields. Its security is based on the possibility of efficient additive exponentiation and absence of efficient (classical) algorithms for additive logarithm. ECC is typically considered over one of two fields: GF(2m) or Fp, where p is prime. page 2/16

What is ECC? Elliptic curves Elliptic curve is a set of points satisfying equation where It is possible to define a cyclic Abelian group structure over the points on an elliptic curve, but for that we need to define a special addition such that page 3/16

What is ECC? Define addition operation over the points on an elliptic curve as follows when where when then page 4/16

What is ECC? For is defined as Finally, point O at infinity is defined as to conform the additive identity properties. According to Hasse’s theorem there are enough points on an elliptic curve for cryptographic purposes: page 5/16

What is ECC? Geometric intuition page 6/16

Why ECC? RSA can be broken with an integer factorization algorithm that scales as To break ECC, the best known classical algorithm requires search. page 7/16

Why ECC? Security (bits) RSA key size ECC key size 80 1024 160 112 2048 224 128 3072 256 192 7680 384 15360 512 HW: Mode RSA-3072 ECC-283 Space-optimized 184ms, 50K gates 29ms, 6660 gates Time-optimized 110ms, 189K gates 1.3ms, 80K gates page 8/16

Quantum Algorithm Quantum algorithm consists of two distinct stages: modular (additive) exponentiation and quantum Fourier transform. Modular exponentiation is done by the square (double)-and-(add)multiply algorithm. We optimize the circuit implementation for multiplication over GF(2m). The best previously known such circuit has depth O(m2), unrestricted architecture. page 9/16

Quantum Algorithm The problem is to multiply and Define Then, where Q depends on the choice of the primitive polynomial. page 10/16

Quantum Algorithm Example Multiplication over GF(24) with page 11/16

Quantum Algorithm page 12/16

Projective representation Quantum Algorithm Projective representation To avoid division, we store a point (x,y) on an elliptic curve as (X,Y,Z): (x,y)=(X/Z,Y/Z). In such representation, division can be thought of as multiplication of Z coordinate by the appropriate quantity. The total depth of our DL algorithm over points on an elliptic curve is O(m2). page 13/16

Analysis Quantum attack RSA ECC depth, but depth (best previously “requires small controlled rotations that may prove expensive” (best previously known is ) Otherwise, depth gates, ancillae. page 14/16

Analysis Classical security RSA ECC Slower data processing larger circuit Faster data processing Smaller circuit page 15/16

Conclusion Quantum algorithm for ECC breaking is a stronger practical argument for quantum computing. The possible reason for the efficiency of the quantum attack on ECC is no necessity to carry over the digits during the addition and multiplication of GF field elements. page 16/16

Thank you for your attention! END Thank you for your attention!