The DOI matches its DataCite record; 1 of the 20 references it cites were found in a registry or an index, and 19 are not checked yet.
How to compute a 256-bit elliptic curve private key with only 50 million Toffoli gates
Open accessAbstract
We use Shor's algorithm for the computation of elliptic curve private keys as a case study for resource estimates in the silicon-photonics-inspired active-volume architecture. Here, a fault-tolerant surface-code quantum computer consists of modules with a logarithmic number of non-local inter-module connections, modifying the algorithmic cost function compared to 2D-local architectures. We find that the non-local connections reduce the cost per key by a factor of 300-700 depending on the operating regime. At 10% threshold, assuming a 10-$μ$s code cycle and non-local connections, one key can be generated every 10 minutes using 6000 modules with 1152 physical qubits each. By contrast, a device with strict 2D-local connectivity requires more qubits and produces one key every 38 hours. We also find simple architecture-independent algorithmic modifications that reduce the Toffoli count per key by up to a factor of 5. These modifications involve reusing the stored state for multiple keys and spreading the cost of the modular division operation over multiple parallel instances of the algorithm.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“At an error rate of 10−3, it can take 1000–2000 physical qubits per logical qubit for the surface code to reach error rates low enough to run classically intractable algorithms1–5.”
From Yoked surface codes (2025) · cites this paper as [5]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The publisher hasn’t deposited this paper’s reference list.
Research works printed but not linked: 14
- J. Proos and C. Zalka, Shor's discrete logarithm quantum algorithm for elliptic curves, arXiv:quant- ph/0301141 (2003).
- Élie Gouzien, D. Ruiz, F.-M. L. Régent, J. Guil- laud, and N. Sangouard, Computing 256-bit Ellip- tic Curve Logarithm in 9 Hours with 126133 Cat Qubits, arXiv:2302.06639 (2023). · arXiv
- S. B. Bravyi and A. Y. Kitaev, Quantum codes on a lattice with boundary, arXiv:quant-ph/9811052 (1998). · arXiv
- A. G. Fowler and C. Gidney, Low over- head quantum computation using lattice surgery, arXiv:1808.06709 (2018). · arXiv
- H. Bombin, I. H. Kim, D. Litinski, N. Nicker- son, M. Pant, F. Pastawski, S. Roberts, and T. Rudolph, Interleaving: Modular architectures for fault-tolerant photonic quantum computing, arXiv:2103.08612 (2021). · arXiv
- D. Litinski and N. Nickerson, Active volume: An architecture for efficient fault-tolerant quan- tum computers with limited non-local connections, arXiv:2211.15465 (2022). · arXiv
- R. P. Brent and P. Zimmermann, Modern computer arithmetic, Vol. 18 (Cambridge University Press, 2010) pp. 67-68. · DOI
- C. Gidney, Windowed quantum arithmetic, arXiv:1905.07682 (2019). · arXiv
- N. Courtois, G. Song, and R. Castellucci, Speed optimizations in bitcoin key recovery attacks, Tatra Mountains Mathematical Publications-The Jour- nal of Slovak Academy of Sciences 67, 55 (2016). · DOI
- A. G. Fowler, Time-optimal quantum computation, arXiv:1210.4626 (2012). · arXiv
- R. Rines and I. Chuang, High performance quan- tum modular multipliers, arXiv:1801.01081 (2018). · arXiv
- C. Gidney, Quantum block lookahead adders and the wait for magic states, arXiv:2012.01624 (2020). · arXiv
- C. Gidney, Approximate encoded permutations and piecewise quantum adders, arXiv:1905.08488 (2019). · arXiv
- C. Gidney and A. G. Fowler, Flexible layout of surface code computations using AutoCCZ states, arXiv:1905.08916 (2018). · arXiv
Cited by
Sorted by citations
Efficient realization of quantum algorithms with qudits
Nikolaeva, A. S., Kiktenko, E. O., & Fedorov, A. K. (2024) · EPJ Quantum Technology · doi:10.1140/epjqt/s40507-024-00250-0 · Cited by 64
Gidney, C., Newman, M., Brooks, P., & Jones, C. (2025) · Nature Communications · doi:10.1038/s41467-025-59714-1 · Cited by 85
Quantum resource estimation for large scale quantum algorithms
Gheorghiu, V., & Mosca, M. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.107480 · Cited by 19
Mascelli, J., & Rodden, M. (2025) · Finance and Economics Discussion Series · doi:10.17016/feds.2025.093 · Cited by 18
Rise of conditionally clean ancillae for efficient quantum circuit constructions
Khattar, T., & Gidney, C. (2025) · Quantum · doi:10.22331/q-2025-05-21-1752 · Cited by 17
Metadata
- Authors
- Litinski, D.
- Corresponding author
- Litinski, Daniel
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2023
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2306.08585
- OpenAlex
- W4380993703
- Cited by
- 5
- References
- 0
- Citations by year
- 2026: 1 · 2025: 2 · 2024: 1 · 2023: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Quantum Computing Algorithms and Architecture
- Physical Sciences › Physics and Astronomy › Atomic and Molecular Physics, and Optics › Quantum Information and Cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- Shor's algorithm, Toffoli gate, surface code, fault-tolerant quantum computing, silicon photonics, resource estimation, modular division, key generation time, qubit count
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: How to compute a 256-bit elliptic curve private key with only 50 million Toffoli gates. https://app.cochat.ai/papers/10.48550/arxiv.2306.08585
- The paper
- Litinski, D. (2023). How to compute a 256-bit elliptic curve private key with only 50 million Toffoli gates. arXiv. https://doi.org/10.48550/arxiv.2306.08585
