Pith. sign in

REVIEW 3 major objections 3 minor 16 references

Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition

T0 review · 3 major / 3 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper presents a space-efficient quantum circuit for solving the elliptic-curve discrete logarithm problem, reducing the logical-qubit requirement for a 256-bit prime-field curve to 835 qubits by rebuilding modular inversion around a r

desk verdict The reversible EEA construction is real and worth studying, but the central step bound and active-window lower bounds rest on a false lemma, so the record qubit/Toffoli claims are unsupported as written. read the letter →

arxiv 2607.13816 v1 pith:YD4HUHIS submitted 2026-07-15 quant-ph cs.CRcs.DS

Han Luo , Ziyi Yang , Jingquan Luo , Ziruo Wang , Yuexin Su , Xiaoming Sun , Lvzhou Li , Tongyang Li This is my paper
classification quant-phcs.CRcs.DS MSC 81P6868Q12 PACS 03.67.Lx
keywords ellipticcurvediscretelogarithmquantumcryptanalysismodularinversionextendedEuclideanalgorithmspace-efficientcircuitsregistersharinglogicalqubitcountToffoligate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that Shor's algorithm for elliptic-curve discrete logarithms can be implemented with substantially fewer logical qubits than earlier estimates, by making modular inversion—the dominant space consumer—much cheaper in space. It claims a reversible modular inversion circuit using 2n+6log n+O(1) qubits and 195n^2 Toffoli gates, plus an affine point-addition circuit using 3n+O(log n) qubits. For a 256-bit curve, this yields 835 logical qubits and 2^30.63 Toffoli gates, below the previously reported low-space estimates of 1098 and 1175 qubits. The mechanism is a refined register-sharing EEA with length registers, location-controlled arithmetic, and mid-circuit measurement that recycles a register for inverse uncomputation.

What carries the argument

The workhorse is the four-phase extended Euclidean algorithm with register sharing: two work registers hold the variable pairs (t,q,r) and (t',r'), while length registers mark the logical boundaries so that superposed inputs of different sizes share the same physical qubits. Location-controlled arithmetic—arithmetic applied only to the physical positions selected by the length registers—and step-dependent active windows restrict each operation to a known index interval, keeping the per-step gate cost linear. Unary iteration implements the controlled indexed operations with only logarithmic temporary ancillas. The final piece is mid-circuit measurement with classical feed-forward: measuring t

What would settle it

For small n, enumerate all possible Euclidean-quotient sequences and, for each prefix step count N_j, compute the minimal achievable t_j; if any t_j falls below the Fibonacci bound F_{N_j/4 + 1}, Lemma A.1 fails and the gate-count asymptotics are unsupported. Alternatively, instantiate the modular-inversion circuit for n=64 and compare the resulting Toffoli and CNOT counts against the values in the paper's Table 6; a discrepancy beyond ordinary implementation slack would signal an error in the block-level accounting.

Watch

Extended reading notes

Core claim

The central discovery is a space-efficient, exact, reversible implementation of modular inversion via the extended Euclidean algorithm, using only two (n+3)-qubit work registers plus small length and control registers. By storing the triples (t, q, r) and (t', r') compactly, tracking logical boundaries with length registers, and applying arithmetic only at the active positions selected by those registers, the algorithm avoids the O(sqrt n) overhead of earlier worst-case allocations. This brings modular inversion down to 2n+6log n+O(1) logical qubits. Embedding that inversion in affine point addition, the paper shows that a mid-circuit measurement of the redundant y register creates clean wor

Load-bearing premise

The gate-count ceilings all rest on Lemma A.1, which lower-bounds the bit-length of t_j by the number of EEA steps; its proof is omitted, and if that bound (or the derived active-window bounds) is false, the reported Toffoli counts collapse even though the reversible EEA construction itself might still be correct.

Editorial extensions

If this is right

  • A complete Shor ECDLP circuit for a 256-bit prime-field curve can be built with 835 logical qubits, more than 250 fewer than the previous best space-optimized estimate.
  • The full algorithm's Toffoli count is 919 n^3 / log n + O(n^2), with a numerical value of about 2^30.63 for secp256k1, roughly two orders of magnitude lower than the lowest-space prior estimate.
  • Modular inversion becomes an exact reversible primitive at 2n + 6 log n + O(1) qubits and 195n^2 + O(n log n) Toffoli gates, with no fidelity loss from truncating rare inputs.
  • Affine point addition with mid-circuit measurements uses only three n-qubit field registers plus O(log n) auxiliaries, matching the standard Shor-ECDLP structure without resorting to projective-coordinate compression.
  • The active-window technique turns worst-case register bounds into step-dependent bounds, which is what converts the asymptotic qubit savings into explicit gate-count ceilings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same measurement-based register recycling could be applied to other in-place modular arithmetic subroutines that need a clean workspace for uncomputation, potentially lowering qubit counts beyond ECDLP.
  • Because modular inversion is a general arithmetic primitive, the register-sharing EEA construction may reduce space in other quantum algorithms requiring division, such as decoded quantum interferometry—an extension the paper itself mentions as open.
  • The paper does not analyze circuit depth; a depth-optimized variant of these location-controlled blocks might trade some qubit savings for parallelism, so the reported space reduction does not directly imply a shorter wall-clock attack.
  • The exact Toffoli ceilings are the least independently verified part of the construction; a targeted search over small Euclid quotient sequences could either confirm Lemma A.1 or reveal a hidden bound violation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper proposes an explicit, space-efficient reversible circuit for modular inversion over prime fields, based on the extended Euclidean algorithm with register sharing and location-controlled arithmetic. This inversion circuit is embedded into affine point addition via mid-circuit measurements, and the authors derive resource estimates for Shor's ECDLP: 3n+6⌊log_2 n⌋+O(1) logical qubits and 919n^3/log_2 n+O(n^2) Toffoli gates, including a claimed 835 logical qubits and 2^30.63 Toffoli gates for secp256k1. The main technical device is a set of step-dependent active windows that restrict the qubit positions on which location-controlled operations act; the lower ends of these windows are derived from Lemma A.1 in Appendix A.2, whose proof is omitted.

Significance. The manuscript is unusually explicit and reproducible: it provides pseudocode, circuit diagrams, blockwise gate counts, and an open-source implementation. If the resource estimates were correct, the work would be a substantial advance in the logical-qubit cost of quantum ECDLP, improving on recent space-optimized estimates. The approach is promising, and the mid-circuit measurement recycling idea is interesting. However, the central active-window lemma is false, and the counterexample directly undermines both the correctness of the location-controlled circuit and the gate-count claims. The significance of the paper cannot be assessed until the lemma is replaced by a correct bound and the §6.2 computations are redone.

major comments (3)
  1. [Appendix A.2, Lemma A.1] Lemma A.1 is false. For p=47, x=20, the EEA quotients are (2,2,1,6), so before iteration 4, N_4 = 4(1+1)+4(1+1)+4(0+1) = 20 and t_4 = t_2 + q_3 t_3 = 2 + 1·5 = 7 < F_6 = 8, contradicting t_j ≥ F_{N_j/4+1}. The failure is asymptotic, not a small off-by-one: a prefix of m quotients equal to 2 has N/4 = 2m and t ≈ (1+√2)^m, giving log_2 t ≈ 0.636(N/4), whereas the lemma asserts ≈ 0.694(N/4). All §4.2 lower bounds k1(T), k2(T), k4(T), k5(T) are derived from this lemma; when it fails, the unary-iteration interval [k,K] omits the true active position, so the location-controlled operations act on the wrong qubits and the modular-inversion circuit can be incorrect on such inputs. The gate-count ceilings in §6.2 (195n^2, 914n^2, 919n^3/log n) and the numerical tables depend on these windows, so they are invalidated as well.
  2. [Appendix A.1 vs. A.2] The statement that Lemma A.1 "follows exactly the same adjustment argument as in Appendix A.1" is not credible. Appendix A.1 minimizes p for a fixed total step count, whereas Lemma A.1 needs to minimize t_j for fixed N_j; these are different functionals of the quotient sequence (t_{i+1} = t_{i-1} + q_i t_i versus r_{i-1} = q_i r_i + r_{i+1}). The Fibonacci extremal sequence for p does not minimize t_j for fixed N_j, and the counterexample above shows the claimed bound is not merely unproved but false.
  3. [§6.3 and Table 6] The numerical experiments cannot serve as an independent validation of the active-window analysis: the Qiskit circuit generation instantiates each step using the same k_i(T), K_i(T) windows that are derived from the false Lemma A.1, so the experiments reproduce the prescribed (possibly incorrect) circuit rather than test correctness against an independent reference. The test suites should include adversarial inputs such as p=47, x=20 and, at cryptographic sizes, inputs whose continued fraction begins with a long prefix of 2s.
minor comments (3)
  1. [§6.1] Typo: "nunmber" should be "number".
  2. [Table 3] The columns x1, x2, x3 are not defined in the caption; the reader has to infer that they are different example inputs. Please define them.
  3. [§6.4, Eq. (8)] The derivation of the concrete secp256k1 estimate 2^30.63 is terse. Please state explicitly how Q_A(256) from Table 6 is substituted and how the factor 28 arises from the signed-window schedule.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the resource claims are assembled from explicit register counts, per-block gate costs, and arithmetic sums; the unproved Lemma A.1 is a correctness gap, not a circular reduction.

full rationale

The derivation chain is not circular. The qubit counts 2n+6⌊log2 n⌋+19 and 3n+6⌊log2 n⌋+19 are obtained by directly counting allocated registers and unary-iteration temporaries (§6.1), not by solving for a target qubit count. The Toffoli/CNOT ceilings (195n², 914n², 919n³/log n) are obtained by composing per-block costs (§4.4: 11(K−k), 2(K−k), 24(K−k), etc.) with the active-window sums in §4.2/§6.2; these sums are evaluated arithmetically from the stated k_i, K_i formulas, and no parameter is fitted to the claimed outcomes. Table 6 comes from an independent Qiskit compilation and is reported as numerical evidence; the asymptotic constants are derived from the formulas, not extracted from the table. The comparison values (1098, 1175, etc.) are external and are not used as inputs. The only in-scope concern is Lemma A.1 in Appendix A.2: 'The proof follows exactly the same adjustment argument as in Appendix A.1, and is therefore omitted.' This lemma is load-bearing for all active-window lower bounds and hence for the gate-count upper bounds, and it appears numerically false (e.g., p=47, x=20 gives t_4=7 < F_6=8). That is a serious correctness/verification gap, but it is not circular: the paper does not define ℓ_t in terms of the window bounds, does not use the claimed totals as premises, and does not rely on a self-citation chain to establish the lemma. The central construction is anchored to independently cited prior work (PZ03, RNSL17, HJN+20, BBG+18).

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

No physical entities are invented. The paper's central quantities are circuit constructions and resource bounds; the only hand-tuned knob is the window size w. The key math input is the Euclidean step-count bound and the register-packing identity. Lemma A.1 is stated without proof and is the main unverified load-bearing assumption.

free parameters (1)
  • signed-window size w = w = 2 log2 n (≈16 for n=256)
    Chosen in §6.4 to balance the 914n^2 point-addition cost against the 5·2^w table-lookup cost. For n=256 it is set to 16 following the BZG+26-style analysis. This is a hand-tuned design knob, not a fit to experimental data.
assumptions (4)
  • standard math Hasse bound: #E(F_p) ≤ p + 1 + 2√p
    Used in §2.3 to size the accumulator point register as n+1 qubits.
  • domain assumption Reversible circuit model with Toffoli/CNOT gates and logical-qubit accounting; physical cost of measurements/feed-forward is ignored
    The resource claims assume a fault-tolerant architecture where mid-circuit measurement and classical feed-forward are cheap compared to Toffoli gates. This is standard in the cited literature but is a modeling choice.
  • ad hoc to paper Lemma A.1: lower bound on bit-length of t_j as a function of N_j
    Proof omitted in Appendix A.2; all active-window bounds and hence the Toffoli/CNOT ceilings depend on it.
  • domain assumption The register-sharing packing exactly represents every intermediate EEA state for all x ∈ F_p^×
    §3.2 and Figure 4 assert the packing; correctness is supported by execution traces (Table 4) and Qiskit tests, not by a formal proof.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition." pith.science (2026). https://pith.science/paper/YD4HUHIS

@misc{pith2026260713816,
  author       = {Pith},
  title        = {Pith review of: Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YD4HUHIS}},
  note         = {Machine review of arXiv:2607.13816}
}
abstract

The Elliptic Curve Discrete Logarithm Problem (ECDLP) is a fundamental problem in cryptography, and reducing the resource requirements of quantum algorithms for solving ECDLP is an important goal. In this work, we present a space-efficient quantum algorithm for solving the ECDLP over prime fields, achieving an implementation with only $3n+6\lfloor \log_2 n \rfloor+O(1)$ logical qubits and $919n^3/\log_2 n+O(n^2)$ Toffoli gates, where $n$ is the bit-length of the prime. For a 256-bit prime-field curve, our construction requires only 835 logical qubits, reducing the previous best estimates of 1098 and 1175 logical qubits by Chevignard et al. [EUROCRYPT 2026] and Babbush et al. [ArXiv Preprint 2026], respectively. The key to our improvement is a new space-efficient reversible modular inversion circuit, which addresses the dominant space bottleneck in affine-coordinate point addition. Starting from the extended Euclidean algorithm (EEA), we refine the register-sharing technique of Proos and Zalka by introducing length registers and location-controlled arithmetic to compactly store and update intermediate variables. We further optimize the reversible update procedures and construct the corresponding controlled arithmetic circuits, resulting in a modular inversion circuit implemented by only $2n+6\lfloor \log_2 n \rfloor+O(1)$ logical qubits and $195n^2+O(n\log_2 n)$ Toffoli gates. This modular inversion circuit together with mid-circuit measurements and classical feed-forward operations provides a space-efficient controlled affine point-addition circuit and a complete implementation of Shor's algorithm for ECDLP.

Figures

Figures reproduced from arXiv: 2607.13816 by the authors.

Figure 1
Figure 1. Toffoli gate count and CNOT gate count for modular inversion and point addition. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. The overall quantum circuit of Shor’s algorithm for solving ECDLP using QFT. The qubits, [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. The overall quantum circuit of Shor’s algorithm for solving ECDLP using semiclassical QFT. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: An illustration of how the two Work registers are allocated for temporary variables within a single iteration of the EEA. The upper and lower stripes represent the Work1 and Work2 registers, respectively. The symbols (h) and (l) indicate that the value t ′ is split int…
Figure 5
Figure 5. Figure 5: Overall circuit implementation (first half) of a single iteration of our space-efficient EEA. [PITH_FULL_IMAGE:figures/full_fig_p020_5.png]
Figure 6
Figure 6. Figure 6: Overall circuit implementation (second half) of a single iteration of our space-efficient EEA, [PITH_FULL_IMAGE:figures/full_fig_p021_6.png]
Figure 7
Figure 7. Figure 7: Compute and uncompute forms of the reversible AND primitive, reproduced from [ [PITH_FULL_IMAGE:figures/full_fig_p022_7.png]
Figure 8
Figure 8. Figure 8: Pruned unary iteration on the promised interval [PITH_FULL_IMAGE:figures/full_fig_p023_8.png]
Figure 9
Figure 9. Figure 9: Location-controlled swap circuit for k = 5 and K = 8. After computing J = ℓt +ℓq + 1, pruned unary iteration over the labels 5, 6, 7, 8 selects the work qubit to be swapped with Sign. The unary iterator contributes K − k + O(1) Toffoli gates and 2(K − k) + O(1) CNOT ga…
Figure 10
Figure 10. Figure 10: Location-controlled subtraction circuit for [PITH_FULL_IMAGE:figures/full_fig_p025_10.png]
Figure 11
Figure 11. Figure 11: Controlled arithmetic cells used in the location-controlled add/sub circuits. [PITH_FULL_IMAGE:figures/full_fig_p026_11.png]
Figure 12
Figure 12. Figure 12: Writing Lnew using borrowed qubits for k = 5 and K = 7. The boxes labeled gj ⊕ zj denote the transformation gj ← gj ⊕ zj for all j in the window. reverse order, for j = K − 1, K − 2, . . . , k. For a fixed j < K, the two Toffoli gates acting on gj are separated by the…
Figure 13
Figure 13. Figure 13: shows this transformation for the example k = 5 and K = 7. The boundary value is computed in place on the ℓr ′ register, and the temporary bit a is created only when the corresponding update gate is applied. |Ctrl⟩ |ℓr ′ ,>1⟩ |ℓr ′ ,1⟩ |ℓr ′ ,0⟩ |b = 0⟩ |u7⟩ |u6⟩ |u5⟩…
Figure 14
Figure 14. Figure 14: Affine point-addition circuit with mid-circuit measurements using three [PITH_FULL_IMAGE:figures/full_fig_p030_14.png]
Figure 15
Figure 15. Figure 15: In-place division with mid-circuit measurement and classical feed-forward operations. [PITH_FULL_IMAGE:figures/full_fig_p031_15.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

16 extracted references · 7 linked inside Pith

  1. [1]

    [DH76] Whitfield Diffle and Martin E. Hellman. New directions in cryptography.IEEE Transac- tions on Information Theory, 22(6), 1976.https://doi.org/10.1145/3549993.3550007. [Eke19] Martin Eker ˚ a. Revisiting Shor’s quantum algorithm for computing general discrete loga- rithms,

    arXiv 1976

  2. [7]

    Zur theorie der abstrakten elliptischen Funktionenk¨ orper II

    [Has36] Helmut Hasse. Zur theorie der abstrakten elliptischen Funktionenk¨ orper II. Automorphis- men und Meromorphismen. Das Additionstheorem.Journal f¨ ur die reine und angewandte Mathematik, 1936.https://doi.org/10.1515/crll.1936.175.69. [HJN+20] Thomas H¨ aner, Samuel Jaques, Michael Naehrig, Martin Roetteler, and Mathias Soeken. Improved quantum circ...

    arXiv 1936

  3. [9]

    arXiv:2510.10967 [Mil85] Victor S. Miller. Use of elliptic curves in cryptography. InConference on the Theory and Application of Cryptographic Techniques, pages 417–426. Springer, 1985.https://doi. org/10.1007/3-540-39799-X_31. [NB08] Satoshi Nakamoto and A. Bitcoin. A peer-to-peer electronic cash system.Bitcoin.–URL: https://bitcoin. org/bitcoin. pdf, 4(2):15,

    arXiv 1985

  4. [12]

    Measurement-based uncomputation applied to controlled modular multiplication

    [KH21] Panjin Kim and Daewan Han. Measurement-based uncomputation applied to controlled modular multiplication. 2102.01453,

    arXiv

  5. [14]

    Optimized point addition circuits for elliptic curve discrete loga- rithms.arXiv preprint,

    arXiv:2507.23079 [Sch26] Andr´ e Schrottenloher. Optimized point addition circuits for elliptic curve discrete loga- rithms.arXiv preprint,

    arXiv

  6. [15]

    arXiv:2606.02235 [NV+25] Alexander Novikov, Ngˆ an V˜ u, Marvin Eisenberger, Emilien Dupont, Po-Sen Huang, Adam Zsolt Wagner, Sergey Shirobokov, Borislav Kozlovskii, Francisco J. R. Ruiz, Ab- bas Mehrabian, M. Pawan Kumar, Abigail See, Swarat Chaudhuri, George Holland, Alex Davies, Sebastian Nowozin, Pushmeet Kohli, and Matej Balog. AlphaEvolve: A cod- in...

    arXiv

  7. [16]

    , qk−1, whereq i =⌊r i−1/ri⌋fori= 1,2,

    arXiv:2506.13131 40 A Proof Details A.1 Bounds on the total number of steps Suppose that afterkiterations of the Extended Euclidean Algorithm, we obtainr k−1 = 1 andr k = 0, with intermediate quotientsq 1, q2, . . . , qk−1, whereq i =⌊r i−1/ri⌋fori= 1,2, . . . , k−1. Then the total number of steps required in our four-phase algorithm can be expressed as N...

    arXiv

  8. [2001]

    [JSB+25] Kyungbae Jang, Vikas Srivastava, Anubhab Baksi, Santanu Sarkar, and Hwajeong Seo

    https://doi.org/10.1007/s102070100002. [JSB+25] Kyungbae Jang, Vikas Srivastava, Anubhab Baksi, Santanu Sarkar, and Hwajeong Seo. New quantum cryptanalysis of binary elliptic curves (extended version).Cryptology ePrint Archive, 2025.https://eprint.iacr.org/2025/017. [KJW+26] Hyunji Kim, Kyungbae Jang, Siyi Wang, Anubhab Baksi, Gyeongju Song, Hwajeong Seo,...

    arXiv 2025

Show all 16 references
  1. [2004]

    Reducing the number of qubits in quantum factoring

    arXiv:quant-ph/0410184 [CFS25] Cl´ emence Chevignard, Pierre-Alain Fouque, and Andr´ e Schrottenloher. Reducing the number of qubits in quantum factoring. InAnnual International Cryptology Conference, pages 384–415. Springer, 2025.https://doi.org/10.1007/978-3-032-01878-6_13. ...

    2025 arXiv

  2. [2010]

    Another concrete quantum cryptanalysis of binary elliptic curves.Cryptology ePrint Archive, 2022.https://eprint.iacr.org/2022/501

    [PWLK22] Dedy Septono Catur Putranto, Rini Wisnu Wardhani, Harashta Tatimma Larasati, and Howon Kim. Another concrete quantum cryptanalysis of binary elliptic curves.Cryptology ePrint Archive, 2022.https://eprint.iacr.org/2022/501. [PZ03] John Proos and Christof Zalka. Shor’s ...

    2022

  3. [2013]

    3The circuit first queries (x 2, y2), thenx 2, and finally (x 2, y2)

    https://doi.org/10.1109/TCAD.2013.2244643. 3The circuit first queries (x 2, y2), thenx 2, and finally (x 2, y2). If two freen-qubit registers were available, the two coordinates in each (x 2, y2) query could be loaded together. Since only one freen-qubit register is available ...

    2013

  4. [2019]

    A public key cryptosystem and a signature scheme based on discrete logarithms.IEEE Transactions on Information Theory, 31(4):469–472, 1985.https: //doi.org/10.1109/TIT.1985.1057074

    arXiv:1905.09084 [ElG85] Taher ElGamal. A public key cryptosystem and a signature scheme based on discrete logarithms.IEEE Transactions on Information Theory, 31(4):469–472, 1985.https: //doi.org/10.1109/TIT.1985.1057074. [FMMC12] Austin G. Fowler, Matteo Mariantoni, John M. M...

  5. [2021]

    Tight bounds on the spooky pebble game: Recycling qubits with measurements.Quantum, 9:1636, 2025.https: //doi.org/10.22331/q-2025-02-18-1636

    [KSS25] Niels Kornerup, Jonathan Sadun, and David Soloveichik. Tight bounds on the spooky pebble game: Recycling qubits with measurements.Quantum, 9:1636, 2025.https: //doi.org/10.22331/q-2025-02-18-1636. [LMNS25] Alessandro Luongo, Antonio Michele Miti, Varun Narasimhachar, a...

    2025

  6. [2024]

    39 [SG09] Douglas Stebila and Jon Green

    https://doi.org/10.1007/978-3-031-68391-6_4. 39 [SG09] Douglas Stebila and Jon Green. Elliptic curve algorithm integration in the secure shell transport layer, 2009.https://www.rfc-editor.org/rfc/rfc5656. [Sho94] Peter W. Shor. Algorithms for quantum computation: discrete loga...

    2009

  7. [2025]

    Griffiths and Chi-Sheng Niu

    arXiv:2505.15917 [GN96] Robert B. Griffiths and Chi-Sheng Niu. Semiclassical Fourier transform for quantum computation.Physical Review Letters, 76(17):3228, 1996.https://doi.org/10.1103/ PhysRevLett.76.3228. [GYCM25] Quan Gu, Han Ye, Junjie Chen, and Xiongfeng Ma. Resource ana...

    1996 arXiv

  8. [2026]

    Cuccaro, Thomas G

    arXiv:2603.28846 [CDKM04] Steven A. Cuccaro, Thomas G. Draper, Samuel A. Kutin, and David Petrie Moulton. A new quantum ripple-carry addition circuit.arXiv preprint,

    arXiv

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.