N-bit Integers Research Articles

Minimizing CNOT-count in quantum circuit of the extended Shor’s algorithm for ECDLP

The elliptic curve discrete logarithm problem (ECDLP) is a popular choice for cryptosystems due to its high level of security. However, with the advent of the extended Shor’s algorithm, there is concern that ECDLP may soon be vulnerable. While the algorithm does offer hope in solving ECDLP, it is still uncertain whether it can pose a real threat in practice. From the perspective of the quantum circuits of the algorithm, this paper analyzes the feasibility of cracking ECDLP using an ion trap quantum computer with improved quantum circuits for the extended Shor’s algorithm. We give precise quantum circuits for extended Shor’s algorithm to calculate discrete logarithms on elliptic curves over prime fields, including modular subtraction, three different modular multiplication, and modular inverse. Additionally, we incorporate and improve upon windowed arithmetic in the circuits to reduce the CNOT-counts. Whereas previous studies mostly focused on minimizing the number of qubits or the depth of the circuit, we focus on minimizing the number of CNOT gates in the circuit, which greatly affects the running time of the algorithm on an ion trap quantum computer. Specifically, we begin by presenting implementations of basic arithmetic operations with the lowest known CNOT-counts, along with improved constructions for modular inverse, point addition, and windowed arithmetic. Next, we precisely estimate that, to execute the extended Shor’s algorithm with the improved circuits to factor an n-bit integer, the CNOT-count required is 1237n3/logn+2n2+n\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$1237n^3/\\log n+2n^2+n$$\\end{document}. Finally, we analyze the running time and feasibility of the extended Shor’s algorithm on an ion trap quantum computer.

An Approach for Matrix Multiplication of 32-Bit Fixed Point Numbers by Means of 16-Bit SIMD Instructions on DSP

Matrix multiplication is an important operation for many engineering applications. Sometimes new features that include matrix multiplication should be added to existing and even out-of-date embedded platforms. In this paper, an unusual problem is considered: how to implement matrix multiplication of 32-bit signed integers and fixed-point numbers on DSP having SIMD instructions for 16-bit integers only. For examined tasks, matrix size may vary from several tens to two hundred. The proposed mathematical approach for dense rectangular matrix multiplication of 32-bit numbers comprises decomposition of 32-bit matrices to matrices of 16-bit numbers, four matrix multiplications of 16-bit unsigned integers via outer product, and correction of outcome for signed integers and fixed point numbers. Several tricks for performance optimization are analyzed. In addition, ways for block-wise and parallel implementations are described. An implementation of the proposed method by means of 16-bit vector instructions is faster than matrix multiplication using 32-bit scalar instructions and demonstrates performance close to a theoretically achievable limit. The described technique can be generalized for matrix multiplication of n-bit integers and fixed point numbers via handling with matrices of n/2-bit integers. In conclusion, recommendations for practitioners who work on implementation of matrix multiplication for various DSP are presented.

Factoring using 2n + 2 qubits with Toffoli based modular multiplication

We describe an implementation of Shor's quantum algorithm to factor n-bit integers using only 2n+2 qubits. In contrast to previous space-optimized implementations, ours features a purely Toffoli ba...

Faster integer multiplication using plain vanilla FFT primes

Assuming a conjectural upper bound for the least prime in an arithmetic progression, we show that n-bit integers may be multiplied in O(n log n 4^(log^* n)) bit operations.

On the complexity of integer matrix multiplication

Let M(n) denote the bit complexity of multiplying n-bit integers, let ω∈(2,3] be an exponent for matrix multiplication, and let lg⁎⁡n be the iterated logarithm. Assuming that log⁡d=O(n) and that M(n)/(nlog⁡n) is increasing, we prove that d×d matrices with n-bit integer entries may be multiplied inO(d2M(n)+dωn2O(lg⁎⁡n−lg⁎⁡d)M(lg⁡d)/lg⁡d) bit operations. In particular, if n is large compared to d, say d=O(log⁡n), then the complexity is only O(d2M(n)).

Factoring using 2n+2 qubits with Toffoli based modular multiplication

We describe an implementation of Shor’s quantum algorithm to factor n-bit integers using only 2n+2 qubits. In contrast to previous space-optimized implementations, ours features a purely Toffoli based modular multiplication circuit. The circuit depth and the overall gate count are in O(n 3 ) and O(n 3 log n), respectively. We thus achieve the same space and time costs as Takahashi et al. [1], while using a purely classical modular multiplication circuit. As a consequence, our approach evades most of the cost overheads originating from rotation synthesis and enables testing and localization of some faults in both, the logical level circuit and an actual quantum hardware implementation. Our new (in-place) constant-adder, which is used to construct the modular multiplication circuit, uses only dirty ancilla qubits and features a circuit size and depth in O(n log n) and O(n), respectively.

New Modified Euclidean and Binary Greatest Common Divisor Algorithm

ABSTRACTThe greatest common divisor (GCD) computation of non-negative integers are the open problem in arithmetic calculations such as cryptography, and factorization attacks. The integer GCD algorithm applies one or more different transformations to reduce the size of input integers a and b at each step performed. Such kinds of transformations are called as reduction. Based on the different reductions, we proposed an efficient implementation of Modified Euclid-Binary (ModEB) algorithm. The ModEB algorithm is based on modular reduction of Euclid's algorithm and the reduction based on the Binary GCD algorithm, where it reduces the integers by the largest powers of two and avoids multiplication and division, except by the powers of two, and hence it is potentially faster than the Euclid's and Binary algorithms. The worst case time complexity of the proposed algorithm is O(n2) with respect to the bit-time complexity for two n-bit integers. We also proposed the parallel version of GCD algorithm. The implementation results show that the iteration required to compute GCD using ModEB algorithm are substantially less as compared to different GCD algorithms.

On the best linear approximation of addition modulo 2 n

In this paper, the best linear approximations of addition modulo 2n are studied. Let x = (xnź1, xnź2,ź,x0) and y = (ynź1, ynź2,ź,y0) be any two n-bit integers, and let z = x + y (mod 2n). Firstly, all the correlations of a single bit zi approximated by xj's and yj's (0 ≤ i, j ≤ n ź 1) are characterized, and similar results are obtained for the linear approximation of the xoring of the neighboring bits of zi's. Then the maximum correlations and the best linear approximations are presented when these zj's (0 ≤ j ≤ n ź 1) are xored in any given means.

Even faster integer multiplication

We give a new algorithm for the multiplication of n-bit integers in the bit complexity model, which is asymptotically faster than all previously known algorithms. More precisely, we prove that two n-bit integers can be multiplied in time O(nlognKlog∗n), where K=8 and log∗n=min{k∈N:log…k×logn⩽1}. Assuming standard conjectures about the distribution of Mersenne primes, we give yet another algorithm that achieves K=4. The fastest previously known algorithm was due to Fürer, who proved the existence of a complexity bound of the above form for some finite K. We show that an optimised variant of Fürer’s algorithm achieves only K=16, suggesting that our new algorithm is faster than Fürer’s by a factor of 2log∗n.

Compact SD: a new encoding algorithm and its application in multiplication

ABSTRACTThis paper presents and evaluates a compact Signed-Digit (SD) encoding algorithm which is an efficient class of the large integer encoding algorithms. The compact SD algorithm results in a series of digits which show the number of consecutive zero bits. Using the proof-of-concept code, we proved that the optimal range for the limit on the number of consecutive zero bits in each digit and average Hamming weight of n-bit integers in the compact SD representation are to and n/3, respectively. In the modular multiplication algorithm, the compact SD is applied to the multiplier. The compact SD modular multiplication processes consecutive zero bits and followed nonzero digits in one clock cycle. Implementation results on Xilinx Virtex 5 FPGA show that the compact SD modular multiplication outperforms previous modified modular multiplication algorithms in terms of throughput and area × time complexity.

Some observations on HC-128

In this paper, we study HC-128 in detail from cryptanalytic point of view. First, we use linear approximation of the addition modulo 2 n of three n-bit integers to identify linear approximations of g 1, g 2, the feedback functions of HC-128. This, in turn, shows that the process of keystream output generation of HC-128 can be well approximated by linear functions. In this direction, we show that the "least significant bit" based distinguisher (presented by the designer himself) of HC-128 works for the complete 32-bit word. Using the above linear approximations of g 1, g 2, we present a new distinguisher for HC-128 which is slightly weaker than Wu's distinguisher. Finally, in the line of Dunkelman's observation, we also study how HC-128 keystream words leak secret state information of the cipher due to the properties of the functions h 1, h 2 and present improved results.

DNA modular subtraction algorithm based on linear self-assembly

This paper presents a DNA algorithm based on linear self-assembly which gives the result of the modular subtraction operation of two nonnegative integers. For two n-bit nonnegative integers A and B, the algorithm gives the result of A-B mod 2 n . An extended borrow tag which indicates the relation of the minuend and the subtrahend is included in the resulting strand so that the pre-classification based on A>B or B>A is not required before the experiment. From the resulting strand, we can draw the information of operation result, operands, borrow, and the tag of the relation between the minuend and the subtrahend. The algorithm takes advantage of the parallelism characteristic of DNA computing: while given two sets of operands (one the minuend set and the other subtrahend set), the modular subtraction operation of these two sets can be achieved by a parallel processing procedure. The feasibility of the algorithm is based on a known experiment. The algorithm is of spontaneous characteristic which prevents the scale of the experimental procedures from growing with the length of the operands. As for the length of the operands n, there are O(n) kinds of strands required in the experiment, and the biochemical experimental procedures can be accomplished in constant number of steps.

The Mixed Binary Euclid Algorithm

We present a new GCD algorithm for two integers that combines both the Euclidean and the binary gcd approaches. We give its worst case time analysis and we prove that its bit-time complexity is still O(n 2 ) for two n-bit integers in the worst case. Our preliminar experiments show a potential speedup for small integers. A parallel version matches the best presently known time complexity, namely O(n/ log n )t ime with O(n 1+� ) processors, for any constant �> 0.

DNA addition using linear self-assembly

This paper presents a DNA algorithm which adds two nonnegative binary integers using self-assembly in constant steps. The approach has the benefit of greater experimental simplicity when compared with previous DNA addition algorithms. For the addition of two binary n-bit integers, O(n) is different from DNA strands and only O(1) biochemical experimental procedures are required.

Better upper bounds on the QOBDD size of integer multiplication

We show that the middle bit of the multiplication of two n-bit integers can be computed by an ordered binary decision diagram (OBDD) of size less than 2.8 · 2 6 n / 5 . This improves the previously known upper bound of ( 7 3 ) · 2 4 n / 3 by Woelfel (New Bounds on the OBDD-size of integer multiplication via Universal Hashing, J. Comput. System Sci. 71(4) (2005) 520–534). The experimental results suggest that our exponent of 6 n / 5 is optimal or at least very close to optimal. A general upper bound of O ( 2 3 n / 2 ) on the OBDD size of each output bit of the multiplication is also presented.

Powering requires threshold depth 3

We study the circuit complexity of the powering function, defined as POW m ( Z ) = Z m for an n-bit integer input Z and an integer exponent m ⩽ poly ( n ) . Let LT ˆ d denote the class of functions computable by a depth- d polynomial-size circuit of majority gates. We give a simple proof that POW m ∉ LT ˆ 2 for any m ⩾ 2 . Specifically, we prove a 2 Ω ( n / log n ) lower bound on the size of any depth-2 majority circuit that computes POW m . This work generalizes Wegener's earlier result that the squaring function (i.e., POW m for the special case m = 2 ) is not in LT ˆ 2 . Our depth lower bound is optimal due to Siu and Roychowdhury's matching upper bound: POW m ∈ LT ˆ 3 . The second part of this research note presents several counterintuitive findings about the membership of arithmetic functions in the circuit classes LT ˆ 1 and LT ˆ 2 . For example, we construct a function f ( Z ) such that f ∉ LT ˆ 1 but 5 f ∈ LT ˆ 1 . We obtain similar findings for LT ˆ 2 . This apparent brittleness of LT ˆ 1 and LT ˆ 2 highlights a difficulty in proving lower bounds for arithmetic functions.

A modular integer GCD algorithm

This paper describes the first algorithm to compute the greatest common divisor (GCD) of two n-bit integers using a modular representation for intermediate values U, V and also for the result. It i...

A modular integer GCD algorithm

This paper describes the first algorithm to compute the greatest common divisor (GCD) of two n-bit integers using a modular representation for intermediate values U, V and also for the result. It is based on a reduction step, similar to one used in the accelerated algorithm [T. Jebelean, A generalization of the binary GCD algorithm, in: ISSAC '93: International Symposium on Symbolic and Algebraic Computation, Kiev, Ukraine, 1993, pp. 111–116; K. Weber, The accelerated integer GCD algorithm, ACM Trans. Math. Softw. 21 (1995) 111–122] when U and V are close to the same size, that replaces U by ( U − b V ) / p , where p is one of the prime moduli and b is the unique integer in the interval ( − p / 2 , p / 2 ) such that b ≡ U V −1 ( mod p ) . When the algorithm is executed on a bit common CRCW PRAM with O ( n log n log log log n ) processors, it takes O ( n ) time in the worst case. A heuristic model of the average case yields O ( n / log n ) time on the same number of processors.

On the Distribution of Diffie--Hellman Triples with Sparse Exponents

Let g be a primitive root modulo a (n+1)-bit prime p. In this paper we prove the uniformity of distribution of the Diffie--Hellman triples (gx, gy, gxy) as the exponents x and y run through the set of n-bit integers with precisely k nonzero bits in their bit representation provided that $k \ge 0.35 n$. Such "sparse" exponents are of interest because for these the computation of gx, gy, gxy is faster than for arbitrary x and y. In the latter case, that is, for arbitrary exponents, similar (albeit stronger) uniformity of distribution results have recently been obtained by R. Canetti, M. Larsen, D. Lieman, S. Konyagin [ Israel J. Math, 120 (2000), pp. 23--46], and the authors.

Integer multiplication with overflow detection or saturation

High-speed multiplication is frequently used in general-purpose and application-specific computer systems. These systems often support integer multiplication, where two n-bit integers are multiplied to produce a 2n-bit product. To prevent growth in word length, processors typically return the n least significant bits of the product and a flag that indicates whether or not overflow has occurred. Alternatively, some processors saturate results that overflow to the most positive or most negative representable number. This paper presents efficient methods for performing unsigned or two's complement integer multiplication with overflow detection or saturation. These methods have significantly less area and delay than conventional methods for integer multiplication with overflow detection or saturation.