Elliptic Curve Discrete Logarithm Problem (ECDLP) [wiki edition]

• Elliptic Curve Discrete Logarithm Problem (ECDLP) is the challenge of recovering a scalar 'd' from elliptic-curve points $P$ and $Q$ governed by the equation $Q=[d]P$, with implications for public-key cryptography and quantum computing.
• ECDLP underpins elliptic-curve cryptography, influencing systems like elliptic-curve Diffie–Hellman and elliptic-curve signatures, with potential breaks from both classical and quantum algorithms.
• Classical algorithms like Pollard rho tend to break $Q=[d]P$ as $O(2^{n/2})$ group operations
• but quantum computers threaten to solve ECDLP in polynomial time through quantum Fourier transforms and modular arithmetic, presenting resource estimation $9n+2 iglceil$ log₂ n and $iglcrceil+.When $@B)$$ circuit fountains speak $8192 $ batches $11 oxed {P500.20),

The elliptic curve discrete logarithm problem (ECDLP) is the problem of recovering a scalar $d$ from elliptic-curve points $P$ and $Q$ satisfying $Q=[d]P$, where $P$ generates a cyclic subgroup of known order and scalar multiplication denotes repeated elliptic-curve addition. In additive notation, it is the elliptic-curve analogue of the multiplicative-group problem $h=g^d$. ECDLP underlies the security of elliptic-curve public-key systems, including elliptic-curve Diffie–Hellman and elliptic-curve signatures. Its classical security derives from the absence of known efficient generic algorithms, whereas Shor’s algorithm solves it in quantum polynomial time. Research on ECDLP encompasses generic algorithms, field- and curve-structure-dependent attacks, algebraic-geometric reductions, isogeny methods, quantum circuit synthesis, resource estimation, and verification of implemented quantum oracles.

1. Mathematical formulation and elliptic-curve groups

Let $E$ be an elliptic curve over a finite field $\mathbb F_q$, with identity point $\mathcal O$. The rational points $E(\mathbb F_q)$ form an abelian group. Given a point $P$0 of order $P$1 and a point $P$2, the ECDLP is to determine the unique scalar

$P$3

For a short Weierstrass curve over a field of characteristic different from $P$4 and $P$5,

$P$6

affine addition of distinct non-inverse points uses

$P$7

followed by

$P$8

Doubling uses

$P$9

The point at infinity $Q$0 is the identity, and $Q$1 in the usual prime-field model. Binary-field curves use different formulas; a commonly studied nonsupersingular form is

$Q$2

over $Q$3, with $Q$4.

The cryptographic instance is normally restricted to a sufficiently large prime-order subgroup. If the full point group has order $Q$5, where $Q$6 is a large prime and $Q$7 is a small cofactor, the ECDLP is posed in $Q$8 of order $Q$9. Point validation and subgroup checks are essential when received points may be adversarial. Special curve classes, including anomalous and supersingular curves, can admit reductions that do not apply to ordinary cryptographic curves.

The hardness assumption is that, given $Q=[d]P$0 and $Q=[d]P$1, computing $Q=[d]P$2 is infeasible. The same assumption applies to recovering a scalar from $Q=[d]P$3 or from $Q=[d]P$4. A GOST-like blind-signature proposal uses these assumptions for private-key, nonce, and intermediate-signature recovery (Hosseini et al., 2013). However, ECDLP hardness alone does not establish security for an arbitrary protocol: its verification relation must itself prevent trivial constructions of valid-looking outputs.

2. Classical algorithms and structural attacks

For a prime-order subgroup of size approximately $Q=[d]P$5, generic algorithms require approximately $Q=[d]P$6 group operations. Pollard’s rho algorithm uses negligible or low memory and is the principal generic baseline; baby-step giant-step has comparable square-root time but requires $Q=[d]P$7 memory. Pohlig–Hellman is effective when the subgroup order has small factors, but it gives no nontrivial reduction for a prime-order subgroup.

The generic complexity estimate is not universal across all curves and fields. Binary-field curves have been targeted by summation-polynomial and Weil-descent techniques. Summation polynomials encode whether points with prescribed $Q=[d]P$8-coordinates can sum to $Q=[d]P$9. For binary curves, a chained system of $P$0 equations becomes a cubic Boolean system. Under a first-fall-degree assumption supported by experiments, Gröbner-basis computation may reach degree at most $P$1, while relation collection yields a heuristic complexity of the form

$P$2

The corresponding work reports an asymptotic constant of approximately $P$3 under its normalization and estimates that the method could outperform Pollard rho for binary extension degrees above approximately $P$4 (Semaev, 2015). Its claims concerning selected binary curves with $P$5 and $P$6 are heuristic and extrapolative rather than practical cryptanalytic breaks. Memory, relation collection, Gröbner-basis regularity, and the validity of the first-fall-degree model remain decisive limitations.

Other algebraic-geometric methods transform ECDLP into polynomial or linear-algebraic problems. One construction uses divisor theory and resultants to represent the relation $P$7 by

$P$8

with a prescribed factorization encoding the relevant point multiplicities. After normalization, the construction yields quadratic equations described geometrically as the intersection of quadric hypersurfaces in an affine space of dimension $P$9. F4 Gröbner-basis experiments were reported for primes below $h=g^d$0, but no competitive cryptographic-size attack or rigorous complexity bound was established (Tullio et al., 2019).

A related family of proposals constructs an evaluation matrix from degree-$h=g^d$1 homogeneous monomials evaluated at points of the forms

$h=g^d$2

A zero minor in a dense kernel submatrix is intended to produce a relation

$h=g^d$3

and hence

$h=g^d$4

Schur complements, initial minors, almost-principal minors, and hyperplane-arrangement signatures have been investigated as ways to find such zero minors. Experiments reached groups of order approximately $h=g^d$5, and almost-principal-minor searches showed favorable behavior at small binary-field sizes. The central initial-minor and defect-growth assertions remain conjectural; no polynomial-time algorithm or cryptographic-size break has been demonstrated (Abdullah et al., 2020, Abdullah et al., 2023, Mahalanobis, 10 Jul 2026).

The methods above are non-generic: they exploit the plane-cubic embedding, divisor theory, summation polynomials, finite-field representation, or special matrix structure. They therefore do not contradict generic-group security results unless their structural assumptions and complexity claims are established at relevant parameter sizes.

3. Isogenies, local fields, and transfer of ECDLP instances

Isogenies preserve scalar relations. If $h=g^d$6 is an explicitly known isogeny and $h=g^d$7, then

$h=g^d$8

Consequently, a discrete-logarithm instance can be transported between isogenous curves, provided the relevant subgroup is not destroyed by the isogeny kernel. For ordinary elliptic curves with a fixed endomorphism ring, horizontal isogenies form graphs described by ideal-class-group actions. Under GRH, suitable small-prime horizontal-isogeny graphs have expansion properties, enabling random self-reducibility: an algorithm that solves ECDLP on a non-negligible fraction of curves in a fixed ordinary class can be transferred to the entire class with polynomial overhead under the stated assumptions (Jetchev et al., 2015).

This result concerns uniformity of difficulty within an isogeny class, not an algorithm for solving ECDLP itself. It does not imply that an arbitrary elliptic curve can be efficiently connected to a weak curve, nor does it automatically apply to supersingular curves, varying endomorphism orders, or arbitrary higher-dimensional abelian varieties. In genus $h=g^d$9, the analogous framework requires principally polarizable ordinary abelian surfaces, Shimura class groups, maximal real multiplication, coprimality conditions, and explicit genus-2 isogeny algorithms.

A separate proposed attack applies to elliptic curves over characteristic-zero local fields rather than ordinary finite-field cryptographic instances. For a curve over $E$0 or $E$1 with good reduction, the reduction sequence contains a formal subgroup described by an elliptic exponential map,

$E$2

and a locally computed inverse $E$3. Reducing an ECDLP instance modulo $E$4 first gives the scalar modulo the order of the reduced point. The remaining scalar can, under suitable hypotheses, be recovered by $E$5-adic logarithms and successive lifting. The method depends on explicitly known characteristic-zero curves and rational or $E$6-adic lifts of the points. Given only a conventional finite-field curve and public points, such lifts and their relation to the desired finite-field scalar are generally unavailable (Filippone, 2023).

4. Quantum formulation and reversible arithmetic

Shor’s algorithm solves ECDLP by evaluating a hidden linear relation. For $E$7, the relevant quantum state has the form

$E$8

Since

$E$9

the point register is constant on cosets determined by $\mathbb F_q$0. Quantum Fourier transforms on the scalar registers produce samples from which $\mathbb F_q$1 is recovered by classical post-processing. The reversible core is a sequence of controlled additions of classically precomputed points

$\mathbb F_q$2

and

$\mathbb F_q$3

The engineering problem is therefore not the asymptotic quantum algorithm but the reversible implementation of elliptic-curve arithmetic, including modular addition, multiplication, inversion, point addition, uncomputation, control synthesis, and representation management.

For binary-field curves, a polynomial-basis multiplier based on a Mastrovito construction can be made compatible with a Linear Nearest Neighbor architecture. The reported multiplier has gate count at most

$\mathbb F_q$4

improving to $\mathbb F_q$5 for a trinomial primitive polynomial or the all-one polynomial. Its LNN depth is bounded by $\mathbb F_q$6, and the complete ECDLP circuit is assigned depth $\mathbb F_q$7, improving a previous $\mathbb F_q$8 bound under the cited circuit models (0710.1093).

For prime-field curves, affine coordinates require modular divisions or inversions, whereas projective coordinates replace divisions with multiplications. Classical intuition therefore favors projective coordinates. Quantumly, projective representations are non-unique:

$\mathbb F_q$9

for nonzero $\mathcal O$0. A reversible oracle must control this representation ambiguity, preserve coherent interference, and uncompute temporary values. Resource comparisons indicate that the additional coordinates and reversible cleanup can outweigh the savings from eliminating divisions. Under the assumptions studied, affine Weierstrass coordinates required fewer gates, lower depth, and fewer qubits than the examined projective Weierstrass and projective Edwards constructions (Huang et al., 18 Feb 2025).

Recent work has focused on reversible modular inversion based on the extended Euclidean algorithm. Register sharing, variable-length storage, location-controlled arithmetic, and mid-circuit measurement reduce the inversion workspace. One construction gives an ECDLP implementation using

$\mathcal O$1

logical qubits and $\mathcal O$2 Toffoli gates, with a detailed 256-bit estimate of $\mathcal O$3 logical qubits (Luo et al., 2 Apr 2026). A subsequent construction reports

$\mathcal O$4

logical qubits and

$\mathcal O$5

Toffoli gates, giving an estimate of $\mathcal O$6 logical qubits and $\mathcal O$7 Toffoli gates for a 256-bit prime-field curve (Luo et al., 15 Jul 2026).

Other explicit point-addition circuits exploit the pseudo-Mersenne modulus and specialized squaring for secp256k1. One architecture estimates approximately $\mathcal O$8 logical qubits and $\mathcal O$9 million Toffoli-type gates for a complete secp256k1 ECDLP computation (Schrottenloher, 1 Jun 2026). These logical estimates exclude error-correction, routing, magic-state production, physical qubits, and execution latency.

5. Quantum resource estimates and cryptanalytic benchmarks

The first detailed prime-field resource estimates gave, for an $E(\mathbb F_q)$0-bit field, at most

$E(\mathbb F_q)$1

logical qubits and

$E(\mathbb F_q)$2

Toffoli gates. The circuits were simulated through the NIST curves P-192, P-224, P-256, P-384, and P-521 using LIQUi$E(\mathbb F_q)$3. For P-256, the reported estimate was $E(\mathbb F_q)$4 logical qubits and approximately $E(\mathbb F_q)$5 Toffoli gates (Roetteler et al., 2017).

Resource estimates depend strongly on the arithmetic architecture and the optimization objective. Low-width, low-Toffoli, low-depth, and measurement-assisted designs produce different tradeoffs. Physical estimates require a fault-tolerant model specifying logical error rates, code distances, non-Clifford factories, routing, measurement latency, and architecture. For secp256k1, one study considered surface codes, repetition cat codes, and LDPC cat codes. Its modeled 256-bit resource estimates ranged from approximately $E(\mathbb F_q)$6 cat qubits under aggressive LDPC-cat assumptions to several million surface-code physical qubits under conservative assumptions. The corresponding runtime estimates ranged from hours to days or weeks, depending on the architecture (Dallaire-Demers et al., 19 Aug 2025).

The same work introduced a deterministic challenge ladder using the curve family

$E(\mathbb F_q)$7

with field sizes from 6 to 256 bits. It supplies primes, group orders, base points, and example public keys, enabling comparison between Pollard-rho classical costs and Shor resource estimates. The ladder distinguishes full-group ECDLP from interval-restricted puzzles: Pollard’s kangaroo is appropriate for a known scalar interval, whereas Shor’s algorithm addresses the complete hidden-subgroup problem.

A trapped-ion architecture study compiled an optimized secp256k1 circuit using approximately $E(\mathbb F_q)$8 logical qubits and $E(\mathbb F_q)$9 million Toffoli gates. Under its Walking Cat architecture, Q102 memory blocks, CCZ factories, integrated routing, and specified physical error assumptions, it estimated $P$00 physical qubits, approximately $P$01 days per attempt, and an estimated single-attempt success probability of $P$02. These figures are architecture-dependent projections, not experimental demonstrations (Häner et al., 4 Sep 2026).

Quantum annealing represents a different approach. ECDLP can be encoded as a Quadratic Unconstrained Binary Optimization problem by expressing the scalar in binary, introducing intermediate point coordinates, cross-multiplying coordinate relations, quadratizing higher-degree terms, and penalizing constraint violations. The generalized construction removes an earlier requirement for complete affine arithmetic and was demonstrated on very small fields, including a fully quantum solution over $P$03 and hybrid solutions over $P$04, $P$05, and $P$06. It does not establish a scalable attack on cryptographic-size curves or a polynomial-time quantum-annealing algorithm (Dzierzkowski, 2024).

6. Verification, security implications, and open problems

The correctness of a Shor ECDLP implementation depends on the exact semantics of its group-operation oracle. A mathematically valid point-addition formula is insufficient if controlled execution fails to implement the identity branch, ancillas are not restored, exceptional inputs are mishandled, or the compiler changes the intended operation. A semantics-based audit of a Qrisp implementation found that the standalone point-update primitive agreed with a classical reference on a well-formed input, while controlled execution changed the accumulator even when the control was zero. The result demonstrates that a passing controlled-$P$07 sanity check does not validate a controlled composite arithmetic gadget (Zhang et al., 1 May 2026).

The relevant refinement obligation is

$P$08

with the disabled-control branch satisfying

$P$09

Exceptional affine cases, invalid encodings, zero denominators, inverse-point addition, and the point at infinity must either be handled by complete formulas or excluded by a formally maintained well-formedness invariant. Final verification of the recovered scalar by checking $P$10 remains necessary.

ECDLP hardness has distinct implications for classical cryptography and quantum cryptanalysis. Classically, increasing subgroup size raises the cost of generic attacks approximately as the square root of the group order. Against Shor’s algorithm, however, the problem is polynomial-time, so larger elliptic-curve keys do not preserve security in the same asymptotic manner. A sufficiently capable fault-tolerant quantum computer could recover private scalars from public points and compromise ECDH, elliptic-curve signatures, and systems such as Bitcoin that rely on secp256k1.

Several proposed classical attacks do not currently alter this conclusion for standard curves. The binary-field summation-polynomial method is heuristic and memory-intensive; geometric and minor-based methods lack cryptographic-size scaling evidence; local-field lifting requires special characteristic-zero structure; and isogeny graphs transfer instances rather than solve them. Blind-signature constructions based on ECDLP require independent formal security proofs, because algebraic correctness, transcript mappings, and ECDLP hardness do not by themselves establish blindness or unforgeability (Hosseini et al., 2013).

Open problems include establishing or refuting subexponential attacks on binary curves, determining whether zero-minor families have provable structure, quantifying Gröbner-basis regularity and relation-collection costs, constructing canonical reversible projective representations, reducing the width and non-Clifford cost of modular inversion, and verifying complete Shor oracles under realistic compiler and fault-tolerant semantics. The most immediate cryptographic implication is not that current ECC is practically broken, but that ECDLP-based systems lack post-quantum security and should be evaluated against both the continuing development of quantum resource estimates and the uncertainty of fault-tolerant hardware projections.