二进制域上椭圆曲线算法的量子优化实现
Optimized quantum implementation of elliptic curve arithmetic over binary fields
摘要：
Shor的离散椭圆曲线群量子算法构成了对椭圆曲线密码系统的“量子攻击”的基础。为了在量子计算机上实现该算法，需要高效地实现椭圆曲线群运算。这样的实现要求我们能够计算基础域中的逆。在[PZ03]中，Proos和Zalka展示了如何实现扩展的欧几里德算法来计算素域GF（p）中的逆。它们采用了许多优化来实现O（n^2）的运行时间和O（n）量子位的空间需求（它们做出了一些权衡，牺牲了一些额外的量子位来减少运行时间）。在实践中，椭圆曲线密码系统通常使用二元域GF（2^m）上的曲线。在本文中，我们展示了如何实现扩展的欧几里德算法的多项式计算逆GF（2^m）。假设量子位在现实的实现中将是一个“昂贵的”资源，我们进行了专门的优化，以减少量子位空间的要求，同时保持运行时间多项式。我们在这里的实现不同于[PZ03]中对GF（p）的实现，并且我们能够利用二元域GF（2^m）的一些性质。我们还优化了计算GF（2^m）上椭圆曲线群运算的总体量子位空间要求，方法是分解群运算，使其“分段可逆”（类似于[PZ03]中对GF（p）上曲线所做的）。
英文摘要：
Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a "quantum attack" of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In [PZ03], Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field GF(p). They employ a number of optimizations to achieve a running time of O(n^2), and a space-requirement of O(n) qubits (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field GF(2^m). In this paper, we show how to implement the extended Euclidean algorithm for polynomials to compute inverses in GF(2^m). Working under the assumption that qubits will be an `expensive' resource in realistic implementations, we optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. Our implementation here differs from that in [PZ03] for GF(p), and we are able to take advantage of some properties of the binary field GF(2^m). We also optimize the overall qubit space requirement for computing the group operation for elliptic curves over GF(2^m) by decomposing the group operation to make it "piecewise reversible" (similar to what is done in [PZ03] for curves over GF(p)).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
