Pith. sign in

REVIEW 6 minor 121 references

Resource-efficient quantum arithmetic circuits give a realistic basis for evaluating quantum attacks on RSA and ECC.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 03:40 UTC pith:32LB4RNF

load-bearing objection Clean, up-to-date survey chapter that organizes known quantum arithmetic circuits and estimation tricks for RSA/ECC cryptanalysis; useful reference, zero new results.

arxiv 2607.11713 v1 pith:32LB4RNF submitted 2026-07-13 quant-ph cs.ET

Quantum Arithmetic Circuits in Public-Key Cryptography

Siyi Wang , Kyungbae Jang , Hyunji Kim , Anik Basu Bhaumik , Anubhab Baksi , Hwajeong Seo , Anupam Chattopadhyay This is my paper
classification quant-ph cs.ET
keywords Quantum ComputingQuantum Arithmetic CircuitQuantum Error CorrectionQuantum CryptanalysisPublic-key CryptographyShor's AlgorithmMeasurement-based UncomputationWindowed Arithmetic
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Shor’s algorithm threatens RSA and elliptic-curve cryptography, but its cost is dominated by quantum modular arithmetic—addition, multiplication, exponentiation, and point addition. This review shows how those building blocks can be made far cheaper by measurement-based uncomputation, conditionally clean ancillae, and windowed look-up tables that replace long sequences of multiplications with classical pre-computation. The same optimizations are then mapped through surface-code error correction to obtain concrete estimates of logical depth, qubit count, and physical runtime. A sympathetic reader cares because these numbers, not asymptotic big-O statements, decide when today’s public-key systems must be replaced and how large a quantum computer is actually required.

Core claim

When quantum arithmetic circuits for modular exponentiation and elliptic-curve point addition are redesigned with measurement-based uncomputation, conditionally clean ancillae, and windowed look-up arithmetic, the resulting Toffoli depth, qubit count, and surface-code resource estimates become a practical yardstick for the cryptanalytic power of large-scale quantum computers against RSA and ECC.

What carries the argument

Measurement-based uncomputation together with conditionally clean ancillae: temporary workspace qubits are cleaned by mid-circuit measurement and classical feedback (or restored under known conditions) instead of full reverse computation, cutting Toffoli count and depth; windowed look-up tables further collapse many controlled multiplications into single table loads.

Load-bearing premise

The circuit costs quoted for the surveyed designs stay accurate once every circuit is fully compiled under one concrete surface-code lattice-surgery schedule and a realistic magic-state factory layout.

What would settle it

Take the lowest-cost modular-exponentiation circuit cited for RSA-2048, re-compile it end-to-end with an open lattice-surgery tool that includes magic-state distillation and routing, and check whether the resulting physical-qubit and cycle counts still match the order-of-magnitude claims in the paper.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Concrete physical-qubit and runtime numbers for factoring 2048-bit RSA and solving ECDLP become available under surface-code assumptions.
  • Post-quantum security parameters can be set against the best known quantum arithmetic costs rather than asymptotic lower bounds.
  • Any further reduction in magic-state distillation overhead translates directly into lower time-space volume for Shor’s algorithm.
  • Windowed classical–quantum trade-offs will continue to shrink quantum gate count at the price of classical pre-computation.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same MBU-plus-windowing toolkit is portable to other arithmetic-heavy quantum algorithms such as quantum chemistry simulation or lattice-based cryptanalysis.
  • A single unified lattice-surgery compiler applied to all surveyed circuits may shrink some of the reported asymptotic gains and reveal which designs remain dominant.
  • Conditionally clean ancillae that enable sub-linear-depth adders could change the asymptotic scaling of modular exponentiation itself.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 6 minor

Summary. This chapter surveys quantum arithmetic circuits for public-key cryptanalysis (RSA and ECC via Shor’s algorithm). It reviews Clifford+T designs for addition, subtraction, multiplication, division, modular exponentiation and elliptic-curve point addition, with emphasis on measurement-based uncomputation, conditionally clean ancillae and windowed LUT techniques. Tables 3–7 organize the literature by architecture and asymptotic cost; Sections 4–5 connect the circuits to concrete RSA/ECC resource estimates and surface-code runtime models (magic-state distillation, lattice surgery). The central claim is that these optimized building blocks plus standard fault-tolerant estimation pipelines supply a realistic basis for evaluating large-scale quantum cryptanalysis.

Significance. As a survey the work is useful: it consolidates a scattered literature on quantum adders, multipliers and modular arithmetic under a common set of metrics (Toffoli depth/count, qubit count) and correctly highlights the practical impact of MBU, conditionally clean ancillae and windowed arithmetic on RSA/ECC cost models. The explicit linkage of circuit-level optimizations to surface-code estimation tools (Qualtran, Azure estimator) and the tabulated asymptotic comparisons (especially Table 5 for Toom–Cook) give practitioners a convenient reference. No new theorems or machine-checked proofs are claimed; the contribution is organizational and pedagogical, which is appropriate for a handbook-style chapter.

minor comments (6)
  1. Figure 3 caption contains an editorial note (“Anubhab: We can redraw these diagrams in tikz”) that should be removed before publication.
  2. Table 1 gate drawings are incomplete or misaligned for several operators (Toffoli, CZ); a clean redraw would improve readability.
  3. Section 1.3, Step 4: the equality after applying Ug is written without intermediate algebra; a short expansion would help readers less familiar with measurement-based uncomputation.
  4. Inconsistent hyphenation and spacing appear throughout (e.g., “Inbrief,” “carry-lookahead” vs “Carry-Lookahead,” “Mu noz-Coreas”). A light copy-edit pass is needed.
  5. Section 5 cites external repositories and tools but does not give version numbers or commit hashes; adding them would improve reproducibility of the estimation pipeline description.
  6. A few self-citations of the authors’ own recent arXiv preprints (e.g., [117], [112]) are listed as 2025; ensure final bibliographic data are updated once DOIs appear.

Circularity Check

0 steps flagged

No significant circularity: pure survey/overview with no derivation chain, fitted predictions, or load-bearing self-citation reductions.

full rationale

The manuscript is an explicit review chapter (Abstract, Sections 1–6) that organizes previously published quantum arithmetic constructions (Tables 3–7), optimization techniques (MBU, conditionally clean ancilla, windowed LUTs), and surface-code estimation pipelines. It asserts no new asymptotic bounds, no parameter fits, and no uniqueness theorems. Self-citations (e.g., Wang et al. adders/multipliers, Jang et al. point addition) simply point to the authors’ earlier independent circuit papers that are externally published and falsifiable; they do not define or force the survey’s organizational claim that such circuits supply a realistic basis for RSA/ECC cryptanalysis. Section 5 sketches standard estimation methodology (code distance, magic-state factories, Qualtran/Azure tools) without re-deriving cited figures under a single closed model that would create circularity. Consequently the derivation chain is empty of circular steps; the paper is self-contained as a literature overview.

Axiom & Free-Parameter Ledger

0 free parameters · 3 axioms · 0 invented entities

As a literature review the paper inherits the standard axioms of the Clifford+T model, surface-code error correction and the hardness assumptions of RSA/ECC. It introduces no free parameters fitted to data and no new physical entities.

axioms (3)
  • domain assumption Clifford+T is a universal fault-tolerant gate set and T-gate cost is dominated by magic-state distillation.
    Used throughout Sections 1–5 as the cost model for all circuit comparisons.
  • domain assumption Surface-code distance and distillation rounds can be chosen to meet any target logical error rate below threshold.
    Underpins the runtime-estimation methodology of Section 5.
  • standard math Measurement-based uncomputation and conditionally-clean ancillae correctly restore ancilla states without violating unitarity or the no-cloning theorem.
    Taken as established by the cited works of Gidney, Luongo et al. and used as optimization primitives.

pith-pipeline@v1.1.0-grok45 · 27395 in / 2012 out tokens · 26276 ms · 2026-07-14T03:40:50.767955+00:00 · methodology

0 comments
read the original abstract

Quantum computing has advanced rapidly in recent decades, driven by developments across the technology stack, including quantum error-correcting codes and efficient quantum algorithms. Among these, quantum arithmetic circuits serve as fundamental building blocks for various promising algorithms. Despite their crucial role, the design of quantum arithmetic circuits faces challenges arising from the no-cloning theorem, qubit limitations, and circuit depth constraints, which significantly impact the efficiency of large-scale quantum computing. We provide an overview of quantum arithmetic circuits in the context of public-key cryptanalysis, with particular emphasis on optimization strategies such as measurement-based uncomputation and conditionally clean ancilla. We review state-of-the-art designs for essential arithmetic operations in public-key cryptanalysis such as addition, multiplication, and modular exponentiation. We also present an overview of the techniques used for fault-tolerant runtime and resource estimation in quantum cryptanalysis. In brief, this chapter emphasizes strategies for designing resource-efficient quantum arithmetic circuits, providing a basis for realistic evaluations of quantum cryptanalytic capabilities.

Figures

Figures reproduced from arXiv: 2607.11713 by Anik Basu Bhaumik, Anubhab Baksi, Anupam Chattopadhyay, Hwajeong Seo, Hyunji Kim, Kyungbae Jang, Siyi Wang.

Figure 1
Figure 1. Figure 1: Example of Single-qubit Measurement-based Uncomputation 1.4 Conditionally Clean Ancilla In quantum circuit design, ancilla qubits can be used as temporary workspace to reduce the number of gates. Nevertheless, allocating clean ancilla is expen￾sive, since each clean ancilla requires a dedicated qubit. To address this problem, conditionally clean ancilla [75,57,24] has been introduced as a hybrid quantum re… view at source ↗
Figure 2
Figure 2. Figure 2: Quantum C 4X Gate Implementations 2 Computation-based Quantum Arithmetic In fault-tolerant quantum computing, the Clifford+T gate set serves as the stan￾dard universal basis for circuit design. Accordingly, this chapter focuses on the design of Clifford+T-based quantum arithmetic circuits. 2.1 Basic Arithmetic Operations Addition Addition is one of the most fundamental operations in quantum com￾puting. Sim… view at source ↗
Figure 3
Figure 3. Figure 3: Structures of n-bit Quantum Subtractor.Anubhab: We can redraw these dia￾grams in tikz 1. Ripple-Borrow Subtraction. Building upon the quantum half-subtractor and full-subtractor, the ripple-borrow approach offers a straightforward method for constructing an n-bit quantum subtractor. This approach has been widely adopted in existing designs [15,101,99]. As illustrated in [PITH_FULL_IMAGE:figures/full_fig_p… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

121 extracted references · 10 canonical work pages

  1. [1]

    Nature 614(7949), 676–681 (2023)

    Suppressing quantum errors by scaling a surface code logical qubit. Nature 614(7949), 676–681 (2023)

    2023

  2. [2]

    Nature638(8052), 920–926 (2025)

    Quantum error correction below the surface code threshold. Nature638(8052), 920–926 (2025)

    2025

  3. [3]

    arXiv preprint arXiv:1209.6348 (2012) 6 https://github.com/seokhyung-lee/msd-magic-state-prep-cycle-simulation Quantum Arithmetic Circuits in Public-Key Cryptography 21

    Amento, B., Steinwandt, R., Roetteler, M.: Efficient quantum circuits for binary elliptic curve arithmetic: reducing t-gate complexity. arXiv preprint arXiv:1209.6348 (2012) 6 https://github.com/seokhyung-lee/msd-magic-state-prep-cycle-simulation Quantum Arithmetic Circuits in Public-Key Cryptography 21

    Pith/arXiv arXiv 2012

  4. [4]

    In: International Conference on Selected Areas in Cryptography

    Amy, M., Di Matteo, O., Gheorghiu, V., Mosca, M., Parent, A., Schanck, J.: Estimating the cost of generic quantum pre-image attacks on sha-2 and sha-3. In: International Conference on Selected Areas in Cryptography. pp. 317–337. Springer (2016)

    2016

  5. [5]

    Microprocessors and Microsystems51, 366–385 (2017)

    AnanthaLakshmi, A., Sudha, G.F.: A novel power efficient 0.64-gflops fused 32-bit reversible floating point arithmetic unit architecture for digital signal processing applications. Microprocessors and Microsystems51, 366–385 (2017)

    2017

  6. [6]

    Cryptology ePrint Archive (2020)

    Banegas, G., Bernstein, D.J., Van Hoof, I., Lange, T.: Concrete quantum crypt- analysis of binary elliptic curves. Cryptology ePrint Archive (2020)

    2020

  7. [7]

    Physical Review A54(2), 1034 (1996)

    Beckman, D., Chari, A.N., Devabhaktuni, S., Preskill, J.: Efficient networks for quantum factoring. Physical Review A54(2), 1034 (1996)

    1996

  8. [8]

    Ibm Journal of Research and Development17, 525–532 (1973),https://api.semanticscholar.org/ CorpusID:14641793

    Bennett, C.H.: Logical reversibility of computation. Ibm Journal of Research and Development17, 525–532 (1973),https://api.semanticscholar.org/ CorpusID:14641793

    1973

  9. [9]

    Cryptology ePrint Archive, Paper 2025/1832 (2025), https://eprint.iacr.org/2025/1832

    Bhaumik, A.B., Dutta, S., Wang, S., Baksi, A., Jang, K., Saha, A., Seo, H., Chattopadhyay, A.: Can quantum break ZUC? only with a million qubits and a billion years to spare. Cryptology ePrint Archive, Paper 2025/1832 (2025), https://eprint.iacr.org/2025/1832

    2025

  10. [10]

    Blunt, N.S., Gehér, G.P., Moylett, A.E.: Compilation of a simple chemistry ap- plication to quantum error correction primitives. Phys. Rev. Res.6, 013325 (Mar 2024).https://doi.org/10.1103/PhysRevResearch.6.013325,https:// link.aps.org/doi/10.1103/PhysRevResearch.6.013325

    work page doi:10.1103/physrevresearch.6.013325 2024

  11. [11]

    Bombin, H., Martin-Delgado, M.A.: Topological quantum distillation. Phys. Rev. Lett.97, 180501 (Oct 2006).https://doi.org/10.1103/PhysRevLett.97. 180501,https://link.aps.org/doi/10.1103/PhysRevLett.97.180501

    doi:10.1103/physrevlett.97 2006

  12. [12]

    Physical Review A86(5) (Nov 2012).https://doi.org/10.1103/physreva.86.052329,http:// dx.doi.org/10.1103/PhysRevA.86.052329

    Bravyi, S., Haah, J.: Magic-state distillation with low overhead. Physical Review A86(5) (Nov 2012).https://doi.org/10.1103/physreva.86.052329,http:// dx.doi.org/10.1103/PhysRevA.86.052329

    doi:10.1103/physreva.86.052329 2012

  13. [13]

    Physical Review A—Atomic, Molecular, and Optical Physics 71(2), 022316 (2005)

    Bravyi, S., Kitaev, A.: Universal quantum computation with ideal clifford gates and noisy ancillas. Physical Review A—Atomic, Molecular, and Optical Physics 71(2), 022316 (2005)

    2005

  14. [14]

    Nature 584(7821), 368–372 (2020)

    Campagne-Ibarcq, P., Eickbusch, A., Touzard, S., Zalys-Geller, E., Frattini, N.E., Sivak, V.V., Reinhold, P., Puri, S., Shankar, S., Schoelkopf, R.J., et al.: Quan- tum error correction of a qubit encoded in grid states of an oscillator. Nature 584(7821), 368–372 (2020)

    2020

  15. [15]

    Electronics Let- ters38(22), 1343–1344 (2002)

    Cheng, K.W., Tseng, C.C.: Quantum full adder and subtractor. Electronics Let- ters38(22), 1343–1344 (2002)

    2002

  16. [16]

    Transactions of the American Mathematical Society142, 291–314 (1969)

    Cook, S.A., Aanderaa, S.O.: On the minimum computation time of functions. Transactions of the American Mathematical Society142, 291–314 (1969)

    1969

  17. [17]

    Physical Review A100(3), 032328 (2019)

    Cross, A.W., Bishop, L.S., Sheldon, S., Nation, P.D., Gambetta, J.M.: Validating quantum computers using randomized model circuits. Physical Review A100(3), 032328 (2019)

    2019

  18. [18]

    Cuccaro, S.A., Draper, T.G., Kutin, S.A., Moulton, D.P.: A new quantum ripple- carry addition circuit (2004)

    2004

  19. [19]

    In: Proceedings of the SC ’23 Workshops of The International Confer- ence on High Performance Computing, Network, Storage, and Analysis

    van Dam, W., Mykhailova, M., Soeken, M.: Using Azure Quantum Resource Estimator for Assessing Performance of Fault Tolerant Quantum Computa- tion. In: Proceedings of the SC ’23 Workshops of The International Confer- ence on High Performance Computing, Network, Storage, and Analysis. p. 1414–1419. SC-W ’23, Association for Computing Machinery, New York, NY...

    doi:10.1145/3624062.3624211 2023

  20. [20]

    In: 2019 32nd International Conference on VLSI Design and 2019 18th International Conference on Embedded Systems (VLSID)

    Das, R., Chattopadhyay, A., Rahaman, H.: Optimizing quantum circuits for mod- ular exponentiation. In: 2019 32nd International Conference on VLSI Design and 2019 18th International Conference on Embedded Systems (VLSID). pp. 407–412. IEEE (2019)

    2019

  21. [21]

    IEEE Transactions on Quantum Engineering 1, 1–13 (2020)

    Di Matteo, O., Gheorghiu, V., Mosca, M.: Fault-tolerant resource estimation of quantum random-access memories. IEEE Transactions on Quantum Engineering 1, 1–13 (2020)

    2020

  22. [22]

    Quantum Information and Computation6(07 2004).https: //doi.org/10.26421/QIC6.4-5-4

    Draper, T., Kutin, S., Rains, E., Svore, K.: A logarithmic-depth quantum carry- lookahead adder. Quantum Information and Computation6(07 2004).https: //doi.org/10.26421/QIC6.4-5-4

    work page doi:10.26421/qic6.4-5-4 2004

  23. [23]

    Dutta, S., Bhattacharjee, D., Chattopadhyay, A.: Quantum circuits for toom-cook multiplication. Phys. Rev. A98, 012311 (Jul 2018).https:// doi.org/10.1103/PhysRevA.98.012311,https://link.aps.org/doi/10.1103/ PhysRevA.98.012311

    work page doi:10.1103/physreva.98.012311 2018

  24. [24]

    Dutta, S., Wang, S., Baksi, A., Chattopadhyay, A., Maitra, S.: Exact space- depth trade-offs in multicontrolled toffoli decomposition. Phys. Rev. A111, 052611 (May 2025).https://doi.org/10.1103/PhysRevA.111.052611,https: //link-aps-org.remotexs.ntu.edu.sg/doi/10.1103/PhysRevA.111.052611

    work page doi:10.1103/physreva.111.052611 2025

  25. [25]

    Earle, J.G.: Latched carry save adder circuit for multipliers (Sep 5 1967), uS Patent 3,340,388

    1967

  26. [26]

    Nature566(7745), 513–517 (2019)

    Flühmann, C., Nguyen, T.L., Marinelli, M., Negnevitsky, V., Mehta, K., Home, J.: Encoding a qubit in a trapped-ion mechanical oscillator. Nature566(7745), 513–517 (2019)

    2019

  27. [27]

    Fowler, A.G., Mariantoni, M., Martinis, J.M., Cleland, A.N.: Surface codes: Towards practical large-scale quantum computation. Phys. Rev. A86, 032324 (Sep 2012).https://doi.org/10.1103/PhysRevA.86.032324,https://link. aps.org/doi/10.1103/PhysRevA.86.032324

    doi:10.1103/physreva.86.032324 2012

  28. [28]

    In: Journal of Physics: Conference Series

    Gayathri, S., Kumar, R., Dhanalakshmi, S.: Efficient floating-point division quan- tum circuit using newton-raphson division. In: Journal of Physics: Conference Series. vol. 2335, p. 012058. IOP Publishing (2022)

    2022

  29. [29]

    Electronics10(6), 703 (2021)

    Gayathri, S., Kumar, R., Dhanalakshmi, S., Dooly, G., Duraibabu, D.B.: T-count optimized quantum circuit designs for single-precision floating-point division. Electronics10(6), 703 (2021)

    2021

  30. [30]

    Gheorghiu, V., Mosca, M.: Quantum resource estimation for large scale quantum algorithms. Future Generation Computer Systems162, 107480 (2025).https://doi.org/https://doi.org/10.1016/j.future.2024.107480, https://www.sciencedirect.com/science/article/pii/S0167739X24004308

    work page doi:10.1016/j.future.2024.107480 2025

  31. [31]

    Quantum2, 74 (Jun 2018).https://doi.org/10.22331/q-2018-06-18-74,https://doi.org/ 10.22331/q-2018-06-18-74

    Gidney, C.: Halving the cost of quantum addition. Quantum2, 74 (Jun 2018).https://doi.org/10.22331/q-2018-06-18-74,https://doi.org/ 10.22331/q-2018-06-18-74

    doi:10.22331/q-2018-06-18-74 2018

  32. [32]

    arXiv preprint arXiv:1905.08488 (2019)

    Gidney, C.: Approximate encoded permutations and piecewise quantum adders. arXiv preprint arXiv:1905.08488 (2019)

    Pith/arXiv arXiv 1905

  33. [33]

    arXiv preprint arXiv:1904.07356 (2019)

    Gidney, C.: Asymptotically efficient quantum karatsuba multiplication. arXiv preprint arXiv:1904.07356 (2019)

    Pith/arXiv arXiv 1904

  34. [34]

    arXiv preprint arXiv:1905.07682 (2019)

    Gidney, C.: Windowed quantum arithmetic. arXiv preprint arXiv:1905.07682 (2019)

    Pith/arXiv arXiv 1905

  35. [35]

    arXiv preprint arXiv:2507.23079 (2025)

    Gidney, C.: A classical-quantum adder with constant workspace and linear gates. arXiv preprint arXiv:2507.23079 (2025)

    Pith/arXiv arXiv 2025

  36. [36]

    arXiv preprint arXiv:2505.15917 (2025) Quantum Arithmetic Circuits in Public-Key Cryptography 23

    Gidney, C.: How to factor 2048 bit rsa integers with less than a million noisy qubits. arXiv preprint arXiv:2505.15917 (2025) Quantum Arithmetic Circuits in Public-Key Cryptography 23

    Pith/arXiv arXiv 2048

  37. [37]

    Gidney, C.: Constructing large increment gates.https://algassert.com/ circuits/2015/06/12/Constructing-Large-Increment-Gates.html(June 2015), blog: Algorithmic Assertions

    2015

  38. [38]

    Quantum5, 433 (2021)

    Gidney, C., Ekerå, M.: How to factor 2048 bit rsa integers in 8 hours using 20 million noisy qubits. Quantum5, 433 (2021)

    2048

  39. [39]

    Goldschmidt, R.E.: Applications of division by convergence. Ph.D. thesis, Mas- sachusetts Institute of Technology (1964)

    1964

  40. [40]

    Gossett, P.: Quantum carry-save arithmetic (1998)

    1998

  41. [41]

    Gottesman, D., Kitaev, A., Preskill, J.: Encoding a qubit in an oscillator. Phys. Rev. A64, 012310 (Jun 2001).https://doi.org/10.1103/PhysRevA.64.012310, https://link.aps.org/doi/10.1103/PhysRevA.64.012310

    doi:10.1103/physreva.64.012310 2001

  42. [42]

    In: Pro- ceedings of the twenty-eighth annual ACM symposium on Theory of computing

    Grover, L.K.: A fast quantum mechanical algorithm for database search. In: Pro- ceedings of the twenty-eighth annual ACM symposium on Theory of computing. pp. 212–219 (1996)

    1996

  43. [43]

    arXiv preprint arXiv:2510.23212 (2025)

    Gu, Q., Ye, H., Chen, J., Ma, X.: Resource analysis of shor’s elliptic curve al- gorithm with an improved quantum adder on a two-dimensional lattice. arXiv preprint arXiv:2510.23212 (2025)

    arXiv 2025

  44. [44]

    In: International conference on post- quantum cryptography

    Häner, T., Jaques, S., Naehrig, M., Roetteler, M., Soeken, M.: Improved quantum circuits for elliptic curve discrete logarithms. In: International conference on post- quantum cryptography. pp. 425–444. Springer (2020)

    2020

  45. [45]

    arXiv preprint arXiv:1611.07995 (2016)

    Häner, T., Roetteler, M., Svore, K.M.: Factoring using 2n+ 2 qubits with toffoli based modular multiplication. arXiv preprint arXiv:1611.07995 (2016)

    Pith/arXiv arXiv 2016

  46. [46]

    arXiv preprint arXiv:1805.12445 (2018)

    Häner, T., Roetteler, M., Svore, K.M.: Optimizing quantum circuits for arith- metic. arXiv preprint arXiv:1805.12445 (2018)

    Pith/arXiv arXiv 2018

  47. [47]

    org/abs/2409.04643

    Harrigan, M.P., Khattar, T., Yuan, C., Peduri, A., Yosri, N., Malone, F.D., Bab- bush, R., Rubin, N.C.: Expressing and analyzing quantum algorithms with qual- tran (2024).https://doi.org/10.48550/arXiv.2409.04643,https://arxiv. org/abs/2409.04643

    Pith/arXiv arXiv doi:10.48550/arxiv.2409.04643 2024

  48. [48]

    Computer Systems Library, Standard University, Tech

    Harris, D., Oberman, S., Horowitz, M.: Srt division: Architectures, models, and implementations. Computer Systems Library, Standard University, Tech. Rep (1998)

    1998

  49. [49]

    In: Proceedings of the 40th ACM/SIGAPP Symposium on Applied Computing

    Hwang, S., Seo, H., Kim, Y.: Can less accurate be more accurate? surpass- ing exact multiplier with approximate design on nisq quantum computers. In: Proceedings of the 40th ACM/SIGAPP Symposium on Applied Computing. p. 590–591. SAC ’25, Association for Computing Machinery, New York, NY, USA (2025).https://doi.org/10.1145/3672608.3707921,https://doi.org/ ...

    doi:10.1145/3672608.3707921 2025

  50. [50]

    Jang, K., Kim, W., Lim, S., Kang, Y., Yang, Y., Seo, H.: Optimized implementa- tionofquantumbinaryfieldmultiplicationwithtoffolidepthone.In:International Conference on Information Security Applications. pp. 251–264. Springer (2022)

    2022

  51. [51]

    Sensors23(6), 3156 (2023)

    Jang, K., Kim, W., Lim, S., Kang, Y., Yang, Y., Seo, H.: Quantum binary field multiplication with optimized toffoli depth and extension to quantum inversion. Sensors23(6), 3156 (2023)

    2023

  52. [52]

    IACR Transactions on Cryptographic Hardware and Embedded Systems2025(2), 781–804 (2025)

    Jang,K.,Srivastava,V.,Baksi,A.,Sarkar,S.,Seo,H.:Newquantumcryptanalysis of binary elliptic curves. IACR Transactions on Cryptographic Hardware and Embedded Systems2025(2), 781–804 (2025)

    2025

  53. [53]

    The Journal of Supercomputing72, 1477–1493 (2016)

    Jayashree, H., Thapliyal, H., Arabnia, H.R., Agrawal, V.K.: Ancilla-input and garbage-output optimized design of a reversible quantum integer multiplier. The Journal of Supercomputing72, 1477–1493 (2016)

    2016

  54. [54]

    IEEE transactions on computers44(8), 1064–1065 (2002) 24 Wang et al

    Kaliski, B.S.: The montgomery inverse and its applications. IEEE transactions on computers44(8), 1064–1065 (2002) 24 Wang et al

    2002

  55. [55]

    In: Doklady Akademii Nauk

    Karatsuba, A.A., Ofman, Y.P.: Multiplication of many-digital numbers by au- tomatic computers. In: Doklady Akademii Nauk. vol. 145, pp. 293–294. Russian Academy of Sciences (1962)

    1962

  56. [56]

    Quantum Information Processing14, 2373–2386 (2015)

    Kepley, S., Steinwandt, R.: Quantum circuits for f _ 2ˆ n f 2 n-multiplication with subquadratic gate count. Quantum Information Processing14, 2373–2386 (2015)

    2015

  57. [57]

    arXiv preprint arXiv:2407.17966 (2024)

    Khattar, T., Gidney, C.: Rise of conditionally clean ancillae for optimizing quan- tum circuits. arXiv preprint arXiv:2407.17966 (2024)

    Pith/arXiv arXiv 2024

  58. [58]

    Cryptology ePrint Archive (2025)

    Kim, H., Lim, S., Jang, K., Wang, S., Baksi, A., Chattopadhyay, A., Seo, H.: Tree-based quantum carry-save adder. Cryptology ePrint Archive (2025)

    2025

  59. [59]

    Quantum Information Processing 23(10), 330 (2024)

    Kim, S., Kim, I., Kim, S., Hong, S.: Toffoli gate count optimized space-efficient quantum circuit for binary field multiplication. Quantum Information Processing 23(10), 330 (2024)

    2024

  60. [60]

    arXiv preprint arXiv:2110.08973 (2021)

    Kornerup, N., Sadun, J., Soloveichik, D.: Tight bounds on the spooky peb- ble game: Recycling qubits with measurements. arXiv preprint arXiv:2110.08973 (2021)

    Pith/arXiv arXiv 2021

  61. [61]

    Nature pp

    Lacroix, N., Bourassa, A., Heras, F.J., Zhang, L.M., Bausch, J., Senior, A.W., Edlich, T., Shutty, N., Sivak, V., Bengtsson, A., et al.: Scaling and logic in the color code on a superconducting quantum processor. Nature pp. 1–3 (2025)

    2025

  62. [62]

    Laflamme, R., Miquel, C., Paz, J.P., Zurek, W.H.: Perfect quantum er- ror correcting code. Phys. Rev. Lett.77, 198–201 (Jul 1996).https:// doi.org/10.1103/PhysRevLett.77.198,https://link.aps.org/doi/10.1103/ PhysRevLett.77.198

    doi:10.1103/physrevlett.77.198 1996

  63. [63]

    Applied Sciences11(9), 3752 (2021)

    Larasati, H.T., Awaludin, A.M., Ji, J., Kim, H.: Quantum circuit design of toom 3-way multiplication. Applied Sciences11(9), 3752 (2021)

    2021

  64. [64]

    ACM Transactions on Quantum Computing5(4) (Oct 2024).https://doi.org/10

    Leblond, T., Dean, C., Watkins, G., Bennink, R.: Realistic cost to execute prac- tical quantum circuits using direct clifford+t lattice surgery compilation. ACM Transactions on Quantum Computing5(4) (Oct 2024).https://doi.org/10. 1145/3689826,https://doi-org.remotexs.ntu.edu.sg/10.1145/3689826

    doi:10.1145/3689826 2024

  65. [65]

    PRX Quantum6, 030317 (Jul 2025).https://doi.org/10.1103/ch5r-cnfq,https://link.aps.org/doi/10

    Lee, S.H., Thomsen, F., Fazio, N., Brown, B.J., Bartlett, S.D.: Low-overhead magic state distillation with color codes. PRX Quantum6, 030317 (Jul 2025).https://doi.org/10.1103/ch5r-cnfq,https://link.aps.org/doi/10. 1103/ch5r-cnfq

    work page doi:10.1103/ch5r-cnfq 2025

  66. [66]

    Nature Physics16(5), 509–513 (2020)

    Lescanne, R., Villiers, M., Peronnin, T., Sarlette, A., Delbecq, M., Huard, B., Kontos, T., Mirrahimi, M., Leghtas, Z.: Exponential suppression of bit-flips in a qubit encoded in an oscillator. Nature Physics16(5), 509–513 (2020)

    2020

  67. [67]

    Science China Physics, Mechanics & Astronomy 65(6), 260311 (2022)

    Li, H.S., Fan, P., Xia, H., Long, G.L.: The circuit design and optimization of quantum multiplier and divider. Science China Physics, Mechanics & Astronomy 65(6), 260311 (2022)

    2022

  68. [68]

    ACM Jour- nal on Emerging Technologies in Computing Systems (JETC)11(1), 1–20 (2014)

    Lin, C.C., Chakrabarti, A., Jha, N.K.: Qlib: Quantum module library. ACM Jour- nal on Emerging Technologies in Computing Systems (JETC)11(1), 1–20 (2014)

    2014

  69. [69]

    Quantum 3, 205 (Dec 2019).https://doi.org/10.22331/q-2019-12-02-205,http://dx

    Litinski, D.: Magic state distillation: Not as costly as you think. Quantum 3, 205 (Dec 2019).https://doi.org/10.22331/q-2019-12-02-205,http://dx. doi.org/10.22331/q-2019-12-02-205

    doi:10.22331/q-2019-12-02-205 2019

  70. [70]

    In: 2025 62nd ACM/IEEE Design Automation Conference (DAC)

    Luongo, A., Miti, A.M., Narasimhachar, V., Sireesh, A.: Measurement-based uncomputation of quantum circuits for modular arithmetic. In: 2025 62nd ACM/IEEE Design Automation Conference (DAC). pp. 1–7. IEEE (2025)

    2025

  71. [71]

    In: 2025 62nd ACM/IEEE Design Automation Conference (DAC)

    Luongo, A., Narasimhachar, V., Sireesh, A.: Optimizing windowed arithmetic for quantum attacks against rsa-2048. In: 2025 62nd ACM/IEEE Design Automation Conference (DAC). pp. 1–7. IEEE (2025) Quantum Arithmetic Circuits in Public-Key Cryptography 25

    2048

  72. [72]

    arXiv preprint arXiv:1202.6614 (2012)

    Markov, I.L., Saeedi, M.: Constant-optimized quantum circuits for modular mul- tiplication and exponentiation. arXiv preprint arXiv:1202.6614 (2012)

    Pith/arXiv arXiv 2012

  73. [73]

    IEEE Transactions on Computers68(5), 729–739 (2018)

    Muñoz-Coreas, E., Thapliyal, H.: Quantum circuit design of a t-count optimized integer multiplier. IEEE Transactions on Computers68(5), 729–739 (2018)

    2018

  74. [74]

    IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems (2023)

    Nie, J., Zhu, Q., Li, M., Sun, X.: Quantum circuit design for integer multiplication based on schönhage-strassen algorithm. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems (2023)

    2023

  75. [75]

    arXiv preprint arXiv:2402.05053 (2024)

    Nie, J., Zi, W., Sun, X.: Quantum circuit for multi-qubit toffoli gate with optimal resource. arXiv preprint arXiv:2402.05053 (2024)

    Pith/arXiv arXiv 2024

  76. [76]

    Nature536(7617), 441–445 (2016)

    Ofek, N., Petrenko, A., Heeres, R., Reinhold, P., Leghtas, Z., Vlastakis, B., Liu, Y., Frunzio, L., Girvin, S.M., Jiang, L., et al.: Extending the lifetime of a quantum bit with error correction in superconducting circuits. Nature536(7617), 441–445 (2016)

    2016

  77. [77]

    Physical Review A107(4), 042621 (2023)

    Orts, F., Filatovas, E., Ortega, G., SanJuan-Estrada, J., Garzón, E.: Improving the number of t gates and their spread in integer multipliers on quantum com- puting. Physical Review A107(4), 042621 (2023)

    2023

  78. [78]

    Journal of Systems and Software p

    Orts,F.,Paulavičius,R.,Filatovas,E.:Quantumcircuitoptimizationofaninteger divider. Journal of Systems and Software p. 112091 (2024)

    2024

  79. [79]

    arXiv preprint arXiv:1706.03419 (2017)

    Parent, A., Roetteler, M., Mosca, M.: Improved reversible and quantum cir- cuits for karatsuba-based integer multiplication. arXiv preprint arXiv:1706.03419 (2017)

    Pith/arXiv arXiv 2017

  80. [80]

    IEEE Access11, 21848–21862 (2023)

    Putranto, D.S.C., Wardhani, R.W., Larasati, H.T., Kim, H.: Space and time- efficient quantum multiplier in post quantum cryptography era. IEEE Access11, 21848–21862 (2023)

    2023

Showing first 80 references.