Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2609.05625

Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits

Thomas Häner·Felix Tripier·Jacob Young·Michael Naehrig·Andrii Maksymov·Safwan Alam·Dmitri Maslov·Matthew Parrott·Yvette de Sereville·Jordan Sullivan·Mark Webster·Nicolas Delfosse·John Gamble·Martin Roetteler
View original source ↗Read source document ↗Export metadata ↓

Abstract

One of the strengths of our recently proposed Walking Cat Architecture for a trapped-ion quantum computer is that it is straightforward to extend and optimize for a specific application. As a proof-of-concept, here we present such optimizations for solving the $256$-bit elliptic curve discrete logarithm problem (ECDLP) on $\mathtt{secp256k1}$, which is the elliptic curve used by blockchain technologies such as Bitcoin, using Shor's algorithm. We optimize the circuits from Schrottenloher's recent work and arrive at a logical quantum circuit for solving the ECDLP using about $1450$ qubits and $40\cdot 10^6$ Toffoli gates, with a rigorous lower bound on the logical-level success probability that holds with confidence at least $1-2^{-128}$. Using our compilation toolchain with manual optimization of the logical layout and integrated routing, we produce estimates for the logical measurement depth and the required number of physical qubits by compiling all components to measurement schedules that obey the architectural constraints. A key ingredient is a fast CCZ magic-state factory and a depth-one CCZ state injection, reducing the execution time of CCZ gates by a factor of $31$. We increase the logical-measurement parallelism using non-overlapping cat-based measurements in parallel, and we leverage the recently proposed logical CliNR protocol to speed up Clifford operations. To reduce the qubit overhead, we introduce a more efficient loss correction protocol, design a layout that allows us to recycle the CliNR ancilla qubits, and provision reusable cat-state resources according to the circuit's peak measurement parallelism. All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture can solve the ECDLP on $\mathtt{secp256k1}$ in approximately 25.7 days using 19,397 physical qubits with an estimated success probability of $63\%$.

Explore related subjects

quant-ph

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Thomas Häner, Felix Tripier, Jacob Young, Michael Naehrig, Andrii Maksymov, Safwan Alam, Dmitri Maslov, Matthew Parrott, Yvette de Sereville, Jordan Sullivan, Mark Webster, Nicolas Delfosse, John Gamble, Martin Roetteler. 2026-09-04. Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits. https://arxiv.org/abs/2609.05625

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Iteratively decoded magic state distillation

We present numerical simulation results for the 7-to-1 and 15-to-1 state distillation circuits, constructed using transversal CNOTs acting on multiple surface code patches. The distillation circuits are decoded iteratively using the method outlined in [arXiv:2407.20976]. We show that, with a re-configurable qubit architecture, we can perform fast magic state distillation in $\sim\mathcal{O}(1)$ code cycles. We confirm that both circuits suppress an injected input logical error rate $p$ to $\mathcal{O}(p^3)$ in the presence of additional circuit-level noise. This is done with two types of stabiliser proxies, distilling logical $|-\rangle$ and $|Y\rangle$ states, the latter is the intended state of the 7-to-1 circuit while a stabiliser-proxy for the 15-to-1 circuit. We then also provide numerical evidences for actual $|T\rangle$ state distillation using the 15-to-1 circuit with a faulty-$T$ measurement, leveraging recent near-Clifford simulation tools. Finally, we outline how ZX-calculus and Pauli webs can be used to benchmark stabiliser proxies for these distillation circuits.

quant-ph↗
arXiv2026

Enhanced measurements on quantum computers via the simultaneous probing of non-commuting Pauli operators

Measuring the state of quantum computers is a highly non-trivial task, with implications for virtually all quantum algorithms. A promising avenue is multi-copy schemes, where identical copies of a quantum state are measured jointly so that all Pauli operators within the considered observable can be simultaneously assessed. Here, we present a first implementation of such a two-copy scheme in a measurement protocol. Based on Bayesian statistics, it accurately estimates not only the average of the desired observable but also the error en route. This enables an adaptive shot-allocation algorithm that preferentially samples the most uncertain Pauli terms. In regimes with many non-commuting Pauli operators, this ``double'' scheme can outperform the state-of-the-art measurement protocol in minimizing total shots for a given precision. We also numerically confirm the finding in previous theoretical works that the two-copy scheme incurs an overhead due to the square-root relationship between the variance of measured quantities and the number of measurement shots.

quant-ph↗
arXiv2026

Thermodynamics of a phaseonium-driven optomechanical Otto engine

We study an optomechanical Otto engine whose working medium is a single-mode cavity driven by beams of coherently prepared three-level phaseonium atoms. The atoms are not thermal reservoirs in the Gibbs sense; rather, their populations and ground-state coherence set the detailed-balance ratio of the cavity collision map, so that the field relaxes to a Gibbs state at an operational apparent temperature. We combine the finite-time collision-model dynamics with radiation-pressure work extraction and compare three reservoir preparations: a thermal reference at the same apparent temperatures, an incoherent atomic beam with the same populations, and the coherent phaseonium beam. We show that the phaseonium isochore charges the cavity passively: the cavity ergotropy and energy-basis coherence remain zero up to numerical precision, while the state converges to the Gibbs fixed point selected by the apparent detailed balance. We further estimate lower bounds on the cost of preparing the atomic populations and coherence, showing that the relevant advantage of phaseonium is a resource-preparation tradeoff rather than a cost-free enhancement over a thermal bath at the same temperature. Finally, we assess the finite-time performance of a two-cavity cascade with additive mechanical work accounting. Over the investigated coherence-phase range, the cascade produces approximately $47\%$--$52\%$ more power than the single-cavity engine while requiring only $65\%$--$68\%$ of the hot and cold phaseonium atoms needed by two independent engines, resulting in a $9\%$--$15\%$ enhancement of power per injected atom over a complete cycle.

quant-ph↗