Residue Number System (RNS) based Distributed Quantum Multiplication

Bhaskar Gaur; Himanshu Thapliyal

REVIEW 4 major objections 5 minor 19 references

Residue Number System (RNS) based Distributed Quantum Multiplication

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that quantum multiplication can be made cheaper by splitting the operands into residues modulo the pairwise coprime set (2^n−1, 2^n, 2^n+1) and running the three resulting modulo multiplications in parallel on separate…

desk verdict The new modulo 2^n+1 multiplier circuit is real and may be useful, but the RNS-distributed comparison as advertised does not hold up because the execution model ignores no-cloning and the resource accounting is per-device, not total-system. read the letter →

arxiv 2506.17588 v1 pith:T5YW2QOX submitted 2025-06-21 quant-ph cs.ARcs.DCmath.QA

Bhaskar Gaur , Himanshu Thapliyal This is my paper · ORCID

classification quant-phcs.ARcs.DCmath.QA

keywords quantumarithmeticmultiplierresiduenumbersystemdistributedcomputingmodulo(2^n+1)multiplicationToffolidepthTgatecountfault-tolerantcomputation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Quantum multipliers are expensive because they use many Toffoli gates and deep T-gate circuits, which hurts fault-tolerant scalability. This paper attempts to lower that cost by applying the Residue Number System to multiplication: the operands are split into residues modulo three pairwise coprime numbers, each residue is multiplied independently, and the product is recovered classically. The missing circuit for this scheme, a quantum modulo (2^n+1) multiplier, is designed here using a diminished-1 representation and quantum 3:2 compressors. Against a non-distributed T-count-optimized multiplier, the paper estimates up to 46.018% lower Toffoli depth and 34.483% to 86.25% fewer T gates for output sizes from 6 to 16 qubits. If the estimates hold, this offers a concrete way to reduce the fault-tolerant resource cost of quantum arithmetic.

What carries the argument

The load-bearing mechanism is the Residue Number System decomposition with the coprime modulus set (2^n−1, 2^n, 2^n+1), together with the newly supplied Quantum Diminished-1 Modulo (2^n+1) Multiplier. Diminished-1 representation, where a value x is stored as x−1 and zero is represented as 2^n, turns modulo-(2^n+1) multiplication into carry-save addition of complemented, cyclically shifted partial products. This machinery does two jobs: it makes multiplication closed under the same modular decomposition already used for RNS addition, and it replaces one deep multiplication with several shallower independent ones whose resource use is counted by the worst branch rather than the sum.

What would settle it

Run the complete distributed protocol for n=3 on a simulator, including delivery of an unknown input superposition to three parallel modulo multipliers and classical residue reconstruction, and compare the end-to-end Toffoli depth and T count with the non-distributed baseline; if the total is not below the baseline, the claimed improvement is an artifact of omitting distribution costs.

Watch

Extended reading notes

Core claim

The paper establishes that the Residue Number System can carry quantum multiplication as well as addition. Instead of one large multiplier, the product is recovered from three parallel modulo-(2^n−1), modulo-2^n, and modulo-(2^n+1) multipliers, which can run on separate quantum computers or jobs because the residue operations are independent. To complete this modulus set, the paper defines a Quantum Diminished-1 Modulo (2^n+1) Multiplier: operands are stored in diminished-1 form (value minus one, with zero mapped to 2^n), partial products are compressed with quantum 3:2 compressors, complemented carries are cyclically shifted, and the final sum and carry are combined with carry-propagate and half-carry-propagate adders. The quantitative claim is that this distributed RNS design lowers Toffoli depth by up to 46.018% and T-gate count by 34.483% to 86.25% relative to a non-distributed multiplier for output sizes between 6 and 16 qubits.

Load-bearing premise

The scheme assumes the same quantum input operands can simply be supplied to several separate modulo-multiplier circuits running in parallel, but quantum mechanics forbids copying an unknown state, and the paper does not explain how the inputs are delivered to each distributed circuit.

Editorial extensions

If this is right

For output sizes 6 to 16 qubits, the RNS approach is claimed to reduce Toffoli count by 34.483% to 86.25% and Toffoli depth by up to 46.018% relative to the QCLA-version non-distributed multiplier.
The proposed modulo (2^n+1) multiplier fills the missing component, making the full RNS modulus set usable for distributed quantum multiplication.
Since a fault-tolerant Toffoli gate is typically implemented with seven T gates, T-gate savings track the Toffoli-count savings, directly lowering fault-tolerant resource requirements.
The reported improvements grow with input size, so the method becomes more attractive for larger multipliers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The reported comparison counts only the quantum circuits inside each modulo multiplier; an end-to-end implementation still needs to distribute the input operands and reconstruct the product from residues, and those costs are not included in the claimed percentages.
If the input operands are unknown quantum states, the no-cloning theorem prevents a simple fan-out to three parallel circuits, so the scheme needs shared entanglement or teleportation; the paper does not specify this protocol.
The same RNS decomposition could be applied to other arithmetic subroutines, such as exponentiation, where parallel shallow modulo circuits might reduce total circuit depth beyond multiplication.
Since the modulo-2^n branch is the cheapest and sometimes dominates the worst-case resource, optimizing that branch or choosing moduli closer to the operand size could widen the reported improvements.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The one genuinely new thing here is the quantum diminished-1 modulo (2^n+1) multiplier. That circuit looks plausible: the partial-product arrangement, the 3:2 compressors, and the carry-save structure are standard classical ideas adapted to quantum, and the paper gives a clear algorithm and honest resource formulas. If you need a modulo (2^n+1) multiplier as a component, this is worth a look.

The distributed RNS comparison, however, is the soft spot, and it is load-bearing. The paper assumes you can run several modulo multipliers in parallel on different QPUs or jobs, each needing access to the same unknown input registers X and Y. For arbitrary quantum inputs, no-cloning prevents simply copying those registers. Computing the residues |X mod m_i> is itself a nontrivial quantum operation, and sending those registers to different QPUs requires teleportation or shared entanglement, none of which appears in the resource tables. If the inputs are classical known integers, then the 'quantum multiplication' is mostly classical precomputation, which is not the claimed scenario. So the headline 46% Toffoli depth reduction is not an end-to-end distributed protocol cost; it is a comparison of one component against a monolithic multiplier.

The resource accounting compounds this. Tables III and IV report per-device maxima for the RNS circuits rather than total system-wide qubits or T gates. For parallel execution, wall-clock depth might reasonably be the max, but total T count and total qubit count should be summed. Reporting 'T gate count improvement' from the maximum Toffoli count understates the true cost of running all the residue circuits. The choice of RNS set also varies with n (sometimes four moduli, sometimes five), so the max is not even a stable cost model.

A couple of the specific inconsistencies in the stress-test note do not hold up: the Table I formula for modulo (2^n+1) Toffoli depth gives 19 for n=2, matching Table II, and the zero Toffoli-depth improvement at output size 8 is not necessarily contradicted by the text. But there are enough small accounting gaps that the numbers need a careful re-derivation. The QCLA-version baseline is also self-constructed and hypothetical; it would be stronger to compare against at least one independently published multiplier.

The citation pattern is fine: self-citing their own RNS addition work is natural, since this is a direct extension. The core issue is conceptual, not a matter of missing references.

Overall: the QDMM circuit deserves a serious referee, but the distributed-resource claims need major revision before they are supportable. I would send this to review, not desk-reject, because the circuit contribution is real and the distributed model can potentially be fixed by either restricting to known classical inputs or providing an entanglement-assisted protocol with full resource accounting. As it stands, I would not cite the headline numbers, but I would cite the modulo (2^n+1) multiplier if I needed one.

Referee Report

4 major / 5 minor

Summary. The manuscript proposes a quantum diminished-1 modulo (2^n+1) multiplier (QDMM) built from partial products, 3:2 compressors, and carry-propagate adders, and combines it with existing modulo (2^n-1) and 2^n quantum multipliers to implement RNS-based distributed multiplication. The authors report resource estimates for the three modulo multipliers, compare a distributed RNS multiplier against a QCLA-modified version of the Muñoz-Coreas multiplier, and claim up to 46.018% lower Toffoli depth and T gate reductions between 34.483% and 86.25% for output sizes from 6 to 16 qubits.

Significance. If the proposed QDMM is correct and the distributed execution model were valid, the work could be a useful step toward RNS-based quantum arithmetic. The QDMM design itself and its resource estimates are potentially of interest. However, the central distributed-resource claim is not supported: the manuscript provides no mechanism for supplying unknown quantum operands to multiple independent circuits, and the reported T gate reduction is obtained by comparing per-device maxima rather than total system resources. Because the headline advantage depends on these two unsupported choices, the significance of the paper as a distributed quantum multiplication protocol is currently low.

major comments (4)

[Section II, Figure 1, and Section IV] The distributed scheme assumes that the same unknown quantum input registers X and Y can be made available to each of several independent modulo-multiplier circuits. For arbitrary quantum states this is not possible by copying, and the paper does not provide a quantum circuit that maps |x> to the residue registers |x mod (2^n-1)>, |x mod 2^n>, and |x mod (2^n+1)> while preserving superposition. The statement in Section II that the approach 'does not require dependencies between distributed circuits' is therefore unsupported unless the inputs are known classical integers, in which case the protocol is not a general quantum multiplier. A concrete input-distribution mechanism, such as entanglement-assisted teleportation with its cost included, is needed before the resource comparison is meaningful.
[Section IV.A, Tables III and IV] The comparison uses the maximum resource count among the constituent modulo multipliers rather than the total over the distributed circuits. For Toffoli count and T gate count, the total system cost is the sum, not the maximum. Using the authors' own Table II, for output size 6 the three component multipliers have Toffoli counts 15, 6, and 19, giving a total of 40, whereas the non-distributed multiplier has 29. Thus the reported 34.483% Toffoli count reduction is an artifact of the accounting. For output size 16, the sum of the component Toffoli counts is 208 versus the non-distributed 400, a 48% reduction, not the reported 86.25%. The headline T gate reduction range is therefore not a valid system-level resource estimate.
[Section IV.A and Table I] The baseline 'Muñoz-Coreas et al (QCLA version)' is not an existing published circuit; it is an estimate produced by the authors by replacing a ripple-carry adder with a QCLA adder. No circuit-level construction or independent verification is provided. Since the central improvement claims are expressed relative to this hypothetical baseline, the comparison should either implement and verify the QCLA-modified multiplier or be made against the original published Muñoz-Coreas multiplier.
[Section IV, Sections II and V] The paper does not account for the end-to-end cost of an RNS multiplication protocol: converting the input operands into residues and, if the final product is needed as a conventional binary integer, performing Chinese Remainder Theorem reconstruction. These steps add gates, depth, and communication that are not included in Tables III and IV. Without this accounting, the reported resource figures describe only the parallel multiplication step, not a complete distributed multiplication protocol.

minor comments (5)

[Table III, row for output size 6] The RNS set (3,4,5) has range 60, but the 'Range' column lists 59; this appears to be an off-by-one error that should be corrected.
[Table I, formulas for modulo (2^n-1) and modulo 2^n] The expressions contain floor(log((n-1)/3)) terms that are negative for n < 4, which would produce nonsensical depth values if evaluated literally. The intended meaning of these terms should be clarified.
[Table I versus Table II for the proposed modulo (2^n+1) multiplier] I do not find an inconsistency between Table I and Table II for the proposed multiplier: with the columns interpreted as Toffoli count followed by Toffoli depth, the n=2 entry (19,18) matches the formulas in Table I.
[General presentation] The notation for partial products in Algorithm 1 (Step 1: i in [0,2]) is confusing on first reading; a comment explaining that the initial three partial-product rows are handled separately before the loop in Step 4 would improve clarity.
[Conclusion] The conclusion repeats the headline T gate reduction percentages without noting that they are based on per-device maxima rather than total resource counts; this should be corrected if the paper is revised.

Circularity Check

1 steps flagged · score 6.0 of 10

The advertised resource improvement is definitional to the 'max over parallel components' metric; the headline comparison is a metric artifact rather than an end-to-end resource estimate.

self definitional [Section IV, Table III and accompanying paragraph]
"For RNS based distributed quantum multiplication, we display the maximum quantities among the constituent quantum modulo multipliers across the various quantum resources. This helps in making an objective comparison across the multiple quantum circuits that will be executed in parallel."

The distributed Toffoli depth and T count in Tables III-IV are defined as the maximum over the parallel modulo multipliers, and the claimed reductions (up to 46.018% depth, 34.483-86.25% T count) are computed against a monolithic multiplier using that max value. By construction, a max over smaller component circuits will frequently beat a single larger circuit, so the reported 'prediction' follows from the metric definition, not from an end-to-end protocol estimate. Costs for producing residue copies of the input, distributing them to separate QPUs (no-cloning forbids copying arbitrary quantum states), and CRT recombination are never included. The central quantitative claim is thus forced by the definition of the distributed resource metric.

full rationale

The derivation of the Quantum Diminished-1 Modulo (2^n+1) Multiplier itself (Algorithm 1, Figures 2-4) is self-contained and not circular: its resource formulas follow from the proposed carry-save partial-product construction, and no parameter is fitted. The self-citations to prior RNS addition work [13], [14] are background and do not supply the multiplier derivation. However, the paper's central comparative claim is circular in a different sense: the distributed resource usage is defined as the maximum over the constituent modulo multipliers, and the improvement percentages in Table IV are computed from that definitional maximum rather than from a complete protocol that also accounts for input distribution, communication, and CRT recombination. For arbitrary quantum input states, simply copying the input registers to each modulo multiplier is forbidden by no-cloning, and the paper provides no teleportation or entanglement budget; this unsupported premise further undermines the resource comparison. The QCLA-modified Muñoz-Coreas baseline [4] is a transparent self-estimate, but because the central reductions are determined by the max metric, the self-citation is a secondary concern. Overall, one predicted quantity (the resource reduction) reduces by construction, so the circularity score is 6.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central resource comparison rests on the hand-picked RNS modulus sets, the unverified QCLA-baseline estimates, and the assumption that identical quantum inputs can be distributed to independent circuits. The QDMM circuit itself adds no new physical entities. The arithmetic identities and CRT are standard, but the distributed-input premise is the most fragile.

free parameters (1)

RNS modulus set selection per input size = See Table III; e.g. n=3 uses (3,4,5), n=8 uses (5,7,9,16,17)
Chosen by hand in Table III to cover the product range while minimizing the maximum resource use across parallel circuits. The choice affects which circuit sets the maxima and therefore the reported improvement percentages.

assumptions (5)

ad hoc to paper Quantum inputs X and Y can be supplied to multiple independent modulo circuits.
Section II and Figure 1 assume parallel independent circuits without addressing no-cloning for superposition inputs.
domain assumption Resource counts and correctness of Cho et al. modulo 2^n and 2^n-1 multipliers.
Table I and Table II use these published designs and the authors' recalculated QCLA-based counts without independent verification.
ad hoc to paper Resource counts of the QCLA-modified Munoz-Coreas baseline.
The baseline is a hypothetical modified version of the authors' own prior multiplier; its counts are estimated in this paper, not taken from a published circuit.
standard math Diminished-1 modulo (2^n+1) arithmetic identities used in Algorithm 1.
Complement and circular-shift rules for diminished-1 representation are asserted without proof.
standard math CRT reconstruction from residues is valid when the RNS range exceeds the product range.
Used to justify that a small set of moduli determines the full product.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Residue Number System (RNS) based Distributed Quantum Multiplication." pith.science (2026). https://pith.science/paper/T5YW2QOX

@misc{pith2026250617588,
  author       = {Pith},
  title        = {Pith review of: Residue Number System (RNS) based Distributed Quantum Multiplication},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T5YW2QOX}},
  note         = {Machine review of arXiv:2506.17588}
}

abstract

Multiplication of quantum states is a frequently used function or subroutine in quantum algorithms and applications, making quantum multipliers an essential component of quantum arithmetic. However, quantum multiplier circuits suffer from high Toffoli depth and T gate usage, which ultimately affects their scalability and applicability on quantum computers. To address these issues, we propose utilizing the Residue Number System (RNS) based distributed quantum multiplication, which executes multiple quantum modulo multiplication circuits across quantum computers or jobs with lower Toffoli depth and T gate usage. Towards this end, we propose a design of Quantum Diminished-1 Modulo $(2^n+1)$ Multiplier, an essential component of RNS based distributed quantum multiplication. We provide estimates of quantum resource usage and compare them with those of an existing non-distributed quantum multiplier for 6 to 16 qubit sized output. Our comparative analysis estimates up to 46.018% lower Toffoli depth, and reduction in T gates of 34.483% to 86.25%.

Figures

Figures reproduced from arXiv: 2506.17588 by the authors.

**Figure 3.** Quantum 3:2 compressor that conducts a single bit full [PITH_FULL_IMAGE:figures/full_fig_p002_3.png] view at source ↗

**Figure 4.** Architecture of proposed Quantum Diminished-1 Mod [PITH_FULL_IMAGE:figures/full_fig_p002_4.png] view at source ↗

Figures from the paper (1 more)

**Figure 2.** Figure 2: Partial product arrangement for proposed Quantum [PITH_FULL_IMAGE:figures/full_fig_p002_2.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

19 extracted references · 12 canonical work pages

[1]

Algorithms for quantum computation: discrete logarithms and factoring,

P. W. Shor, “Algorithms for quantum computation: discrete logarithms and factoring,” in Proceedings 35th annual symposium on foundations of computer science . Ieee, 1994, pp. 124–134

1994
[2]

A survey on hhl algorithm: From theory to application in quantum machine learning,

B. Duan, J. Yuan, C.-H. Yu, J. Huang, and C.-Y . Hsieh, “A survey on hhl algorithm: From theory to application in quantum machine learning,” Physics Letters A , vol. 384, no. 24, p. 126595, 2020

work page 2020
[3]

Fast simulation of high-depth qaoa circuits,

D. Lykov, R. Shaydulin, Y . Sun, Y . Alexeev, and M. Pistoia, “Fast simulation of high-depth qaoa circuits,” in Proceedings of the SC’23 Workshops of The International Conference on High Performance Com- puting, Network, Storage, and Analysis , 2023, pp. 1443–1451

2023
[4]

Quantum circuit design of a t- count optimized integer multiplier,

E. Mu ˜noz-Coreas and H. Thapliyal, “Quantum circuit design of a t- count optimized integer multiplier,” IEEE Transactions on Computers , vol. 68, no. 5, pp. 729–739, 2018

work page 2018
[5]

P. A. Mohan, Residue Number Systems . Springer, 2016

work page 2016
[6]

Quantum resource estimates for computing elliptic curve discrete logarithms,

M. Roetteler, M. Naehrig, K. M. Svore, and K. Lauter, “Quantum resource estimates for computing elliptic curve discrete logarithms,” in Advances in Cryptology–ASIACRYPT 2017

work page 2017
[7]

Another concrete quantum cryptanalysis of binary elliptic curves,

D. S. C. Putranto, R. W. Wardhani, H. T. Larasati, and H. Kim, “Another concrete quantum cryptanalysis of binary elliptic curves,” Cryptology ePrint Archive, 2022

work page 2022
[8]

Mapping ncv circuits to optimized clifford+ t circuits,

D. M. Miller, M. Soeken, and R. Drechsler, “Mapping ncv circuits to optimized clifford+ t circuits,” in Reversible Computation: 6th International Conference, RC 2014, Kyoto, Japan, July 10-11, 2014. Proceedings 6. Springer, 2014, pp. 163–175

work page 2014

Show all 19 references

[9]

An algorithm for the t-count,

D. Gosset, V . Kliuchnikov, M. Mosca, and V . Russo, “An algorithm for the t-count,” arXiv preprint arXiv:1308.4134 , 2013

2013 arXiv
[10]

An algorithm for the t-count,

——, “An algorithm for the t-count,” Quantum Information & Compu- tation, vol. 14, no. 15-16, pp. 1261–1276, 2014

2014
[11]

Distributed quantum computing via inte- grating quantum and classical computing,

W. Tang and M. Martonosi, “Distributed quantum computing via inte- grating quantum and classical computing,” Computer, vol. 57, no. 4, pp. 131–136, 2024

2024
[12]

Review of distributed quantum computing. from single qpu to high performance quantum computing,

D. Barral, F. J. Cardama, G. D ´ıaz, D. Fa ´ılde, I. F. Llovo, M. M. Juane, J. V ´azquez-P´erez, J. Villasuso, C. Pi ˜neiro, N. Costas et al. , “Review of distributed quantum computing. from single qpu to high performance quantum computing,” arXiv preprint arXiv:2404.01265 , 2024

2024 arXiv
[13]

Residue number system (rns) based distributed quantum addition,

B. Gaur, T. S. Humble, and H. Thapliyal, “Residue number system (rns) based distributed quantum addition,” in 2024 IEEE Computer Society Annual Symposium on VLSI (ISVLSI) , 2024, pp. 595–600

2024
[14]

Crosstalk attack resilient rns quantum addition,

B. Gaur and H. Thapliyal, “Crosstalk attack resilient rns quantum addition,” arXiv preprint arXiv:2410.23217 , 2024

2024 arXiv
[15]

A logarithmic-depth quantum carry-lookahead adder,

T. G. Draper, S. A. Kutin, E. M. Rains, and K. M. Svore, “A logarithmic-depth quantum carry-lookahead adder,” arXiv preprint quant-ph/0406142, 2004

2004 arXiv
[16]

Reducing the number of qubits in quantum factoring,

C. Chevignard, P.-A. Fouque, and A. Schrottenloher, “Reducing the number of qubits in quantum factoring,” Cryptology ePrint Archive , 2024

2024
[17]

How to factor 2048 bit rsa integers with less than a million noisy qubits,

C. Gidney, “How to factor 2048 bit rsa integers with less than a million noisy qubits,” arXiv preprint arXiv:2505.15917 , 2025

arXiv
[18]

Error-correction coding using polynomial residue number system,

I. A. Kalmykov, V . P. Pashintsev, K. T. Tyncherov, A. A. Olenev, and N. K. Chistousov, “Error-correction coding using polynomial residue number system,” Applied Sciences , vol. 12, no. 7, p. 3365, 2022

2022
[19]

Quantum modular multiplication,

S.-M. Cho, A. Kim, D. Choi, B.-S. Choi, and S.-H. Seo, “Quantum modular multiplication,” Ieee Access, vol. 8, pp. 213 244–213 252, 2020

2020

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Algorithms for quantum computation: discrete logarithms and factoring,

P. W. Shor, “Algorithms for quantum computation: discrete logarithms and factoring,” in Proceedings 35th annual symposium on foundations of computer science . Ieee, 1994, pp. 124–134

1994

[2] [2]

A survey on hhl algorithm: From theory to application in quantum machine learning,

B. Duan, J. Yuan, C.-H. Yu, J. Huang, and C.-Y . Hsieh, “A survey on hhl algorithm: From theory to application in quantum machine learning,” Physics Letters A , vol. 384, no. 24, p. 126595, 2020

work page 2020

[3] [3]

Fast simulation of high-depth qaoa circuits,

D. Lykov, R. Shaydulin, Y . Sun, Y . Alexeev, and M. Pistoia, “Fast simulation of high-depth qaoa circuits,” in Proceedings of the SC’23 Workshops of The International Conference on High Performance Com- puting, Network, Storage, and Analysis , 2023, pp. 1443–1451

2023

[4] [4]

Quantum circuit design of a t- count optimized integer multiplier,

E. Mu ˜noz-Coreas and H. Thapliyal, “Quantum circuit design of a t- count optimized integer multiplier,” IEEE Transactions on Computers , vol. 68, no. 5, pp. 729–739, 2018

work page 2018

[5] [5]

P. A. Mohan, Residue Number Systems . Springer, 2016

work page 2016

[6] [6]

Quantum resource estimates for computing elliptic curve discrete logarithms,

M. Roetteler, M. Naehrig, K. M. Svore, and K. Lauter, “Quantum resource estimates for computing elliptic curve discrete logarithms,” in Advances in Cryptology–ASIACRYPT 2017

work page 2017

[7] [7]

Another concrete quantum cryptanalysis of binary elliptic curves,

D. S. C. Putranto, R. W. Wardhani, H. T. Larasati, and H. Kim, “Another concrete quantum cryptanalysis of binary elliptic curves,” Cryptology ePrint Archive, 2022

work page 2022

[8] [8]

Mapping ncv circuits to optimized clifford+ t circuits,

D. M. Miller, M. Soeken, and R. Drechsler, “Mapping ncv circuits to optimized clifford+ t circuits,” in Reversible Computation: 6th International Conference, RC 2014, Kyoto, Japan, July 10-11, 2014. Proceedings 6. Springer, 2014, pp. 163–175

work page 2014