Shor's Quantum ECDLP Algorithm

• Shor's Quantum ECDLP Algorithm is a quantum method that recasts the elliptic curve discrete logarithm problem as a hidden subgroup problem, enabling polynomial-time solutions.
• It utilizes optimized circuit designs—especially in modular inversion and affine point addition—to reduce qubit counts and gate complexities in practical quantum attacks.
• Resource estimates reveal that quantum attacks on ECC could outperform RSA breaches, emphasizing the urgency of migrating cryptographic systems in the advent of scalable quantum computers.

Shor's Quantum ECDLP Algorithm is the category of quantum algorithms solving the elliptic curve discrete logarithm problem (ECDLP) in polynomial time, rendering classical elliptic curve cryptosystems (ECC) theoretically insecure in the presence of large-scale quantum computers. The core quantum algorithm, originally introduced by Peter Shor, adapts hidden subgroup problem techniques from finite fields to the more complex structure of elliptic curve groups over finite fields. Recent research emphasizes space- and gate-efficient circuit designs—especially modular inversion—and precise resource estimation for practical quantum attacks.

1. Mathematical Structure and Quantum Period-Finding

At its foundation, the ECDLP asks: given an elliptic curve $E/\mathbb{F}_p$ of large prime order $r$, a generator $P\in E(\mathbb{F}_p)$, and a target point $Q = [m]P$, recover $m$. Shor’s quantum approach reframes this as a hidden subgroup problem (HSP) in the abelian group $\mathbb{Z}_r \times \mathbb{Z}_r$ via the function

$f(k, \ell) = [k]P + [\ell]Q$

which is constant on cosets of the hidden subgroup $H = \{(k,\ell) : k+\ell m \equiv 0 \bmod r\}$. The quantum circuit proceeds as follows:

• Prepare two $(n+1)$-qubit exponent registers in the superposition $\sum_{k,\ell=0}^{2^{n+1}-1} |k, \ell\rangle$ and an accumulator register initialized to the group identity.
• Cohesively compute $r$0 via a sequence of controlled point additions and doublings in $r$1.
• Apply (semi-)classical or full quantum Fourier transforms (QFTs) to the exponent registers.
• Measure the outputs and post-process (e.g., via continued fractions) to recover $r$2 (Luo et al., 2 Apr 2026, Roetteler et al., 2017, Huang et al., 18 Feb 2025).

2. Quantum Circuit Architecture: Arithmetic and Group Action

The computational bottleneck is implementing the group-action oracle $r$3 efficiently and reversibly. Each double-scalar multiplication is realized by decomposing $r$4 into windows of size $r$5 and iteratively applying controlled point addition and doubling circuits. In affine Weierstrass form, point addition involves evaluating the slope $r$6 and updating coordinates via field operations:

$r$7

With each controlled addition requiring four inversions, four multiplications, one squaring, and several additions/negations, the underlying field arithmetic drives resource demands (Luo et al., 2 Apr 2026, Roetteler et al., 2017, Häner et al., 2020).

A significant advance in (Luo et al., 2 Apr 2026) is the introduction of a space-efficient, reversible modular inversion circuit via a refined extended Euclidean algorithm, utilizing register-sharing and dynamic bit-length tracking. The construction reduces the modular inversion circuit width from 7$r$8 to $r$9 logical qubits.

3. Resource Estimates and Scaling Laws

Resource estimates for Shor's ECDLP algorithm depend on both the elliptic curve arithmetic variant and the underlying field size $P\in E(\mathbb{F}_p)$0.

For affine Weierstrass coordinates (prime field):

• Modular inversion: $P\in E(\mathbb{F}_p)$1 qubits, $P\in E(\mathbb{F}_p)$2 Toffoli gates per inversion (Luo et al., 2 Apr 2026).
• Point addition: $P\in E(\mathbb{F}_p)$3 qubits per controlled addition, dominated by the modular inversion.
• Double-scalar multiplication: $P\in E(\mathbb{F}_p)$4 Toffoli gates per complete oracle query.
• For $P\in E(\mathbb{F}_p)$5, the total logical-qubit count is reduced to 1333 compared to 2124 in Häner et al., while maintaining $P\in E(\mathbb{F}_p)$6 Toffoli count (Luo et al., 2 Apr 2026, Häner et al., 2020, Roetteler et al., 2017).

The importance of modular inversion (vs. multiplication or addition) is highlighted by comparative qubit and gate counts. Prior low-width approaches required 7$P\in E(\mathbb{F}_p)$7 qubits for inversion; the refined approach in (Luo et al., 2 Apr 2026) lowers this to $P\in E(\mathbb{F}_p)$8, which, when substituted into the overall group operation, produces a $P\in E(\mathbb{F}_p)$9 total.

Windowed arithmetic further optimizes circuit depth and gate count. By decomposing scalars into windows and employing table look-ups for precomputed multiples, the number of point addition steps is reduced from $Q = [m]P$0 to $Q = [m]P$1, yielding leading Toffoli and CNOT count expressions of $Q = [m]P$2 (Häner et al., 2020, Liu et al., 2023).

4. Coordinate Systems: Affine vs. Projective Representations

While projective coordinates eliminate explicit inversions by representing points as $Q = [m]P$3 and using only multiplications/additions for point operations, they introduce substantial uncomputation and reversibility overhead. Each addition involves 32–62 multiplications instead of two inversions and two multiplications in the affine case, and the need to canonicalize superpositions or uncompute intermediates inhibits resource savings. As shown in (Huang et al., 18 Feb 2025), affine coordinates remain superior in resource efficiency due to lower depth, T-count, and qubit requirements per operation:

• Affine: $Q = [m]P$4 qubits, $Q = [m]P$5 depth, $Q = [m]P$6 T-gates
• Projective: $Q = [m]P$7 qubits, $Q = [m]P$8–$Q = [m]P$9 depth, $m$0–$m$1 T-gates

5. Success Probability and Algorithmic Optimizations

Baseline implementations of Shor’s ECDLP algorithm achieve a single-run success probability of $m$2–$m$3 when using the semiclassical Fourier transform. By introducing small amounts of register padding (increasing control qubit length by $m$4), and conducting limited 1D or 2D classical searches in the post-processing stage, the probability can be boosted to $m$5 in one run, with only linear quantum overhead (Ekerå, 2019). The cost to further increase the success probability to near-unity decreases rapidly as $m$6 and search window sizes grow. The computational burden remains polynomial in $m$7 with these enhancements, and the number of required algorithm runs to reach high confidence is bounded independently of $m$8.

6. Impact of Modular Inversion and Recent Advances

Modular inversion is the dominant operation in quantum resource requirements for ECDLP circuits. In (Luo et al., 2 Apr 2026), the presented modular inversion quantum circuit achieves both correctness and space efficiency by sharing registers, tracking the bit-length of intermediates, and location-controlled swaps based on the status of the extended Euclidean update. The inversion cost is quantified as $m$9 Toffoli gates, a marked improvement over previous 448 $\mathbb{Z}_r \times \mathbb{Z}_r$0-level designs.

Integrating this inversion block into the overall affine addition circuit reduces circuit width to $\mathbb{Z}_r \times \mathbb{Z}_r$1 logical qubits and maintains $\mathbb{Z}_r \times \mathbb{Z}_r$2 Toffoli scaling, facilitating an end-to-end attack on ECDLP with minimized logical-qubit overhead.

7. Practical Feasibility, Cost Metrics, and Cryptanalytic Outlook

Recent resource estimates across multiple hardware paradigms (surface code, repetition cat, and LDPC cat codes), for the 256-bit secp256k1 curve, forecast logical resource requirements in the $\mathbb{Z}_r \times \mathbb{Z}_r$3–$\mathbb{Z}_r \times \mathbb{Z}_r$4 qubit regime with $\mathbb{Z}_r \times \mathbb{Z}_r$5–$\mathbb{Z}_r \times \mathbb{Z}_r$6 Toffoli gates. Total physical qubits (with fault tolerance) typically range between $\mathbb{Z}_r \times \mathbb{Z}_r$7 to $\mathbb{Z}_r \times \mathbb{Z}_r$8 and runtimes from hours (aggressive error rates, photonic codes) to weeks (conservative surface codes) (Dallaire-Demers et al., 19 Aug 2025).

In terms of classical-to-quantum cryptanalytic comparison, ECC offers an easier quantum target than RSA due to smaller parameter sizes and lower total gate counts. For example, attacking P-256 requires $\mathbb{Z}_r \times \mathbb{Z}_r$9 fewer qubits and $f(k, \ell) = [k]P + [\ell]Q$0 fewer Toffolis than RSA-3072 (Roetteler et al., 2017). A plausible implication is that quantum attacks on ECC will become practical before equivalent threats to RSA reach feasibility.

Current trends project that end-to-end breaks of 256-bit ECC by large-scale, fault-tolerant quantum computers could be realized in the late 2020s or early 2030s, motivating proactive cryptographic migration strategies (Dallaire-Demers et al., 19 Aug 2025).

---

References:

• "Space-Efficient Quantum Algorithm for Elliptic Curve Discrete Logarithms with Resource Estimation" (Luo et al., 2 Apr 2026)
• "Quantum resource estimates for computing elliptic curve discrete logarithms" (Roetteler et al., 2017)
• "Revisiting Shor's quantum algorithm for computing general discrete logarithms" (Ekerå, 2019)
• "Minimizing CNOT-count in quantum circuit of the extended Shor's algorithm for ECDLP" (Liu et al., 2023)
• "Choosing Coordinate Forms for Solving ECDLP Using Shor's Algorithm" (Huang et al., 18 Feb 2025)
• "Quantum resource estimates for computing binary elliptic curve discrete logarithms" (Garn et al., 4 Mar 2025)
• "Brace for impact: ECDLP challenges for quantum cryptanalysis" (Dallaire-Demers et al., 19 Aug 2025)
• "Improved quantum circuits for elliptic curve discrete logarithms" (Häner et al., 2020)