New Paper Reduces ECC Attack to 1,098 Logical Qubits (EUROCRYPT 2026)

A paper by Chevignard, Fouque, and Schrottenloher accepted at EUROCRYPT 2026 (ePrint 2026/280) demonstrates a space-optimised Shor's algorithm requiring only 1,098 logical qubits for 256-bit elliptic curve discrete logarithm - down from the previous minimum of 2,124. The method uses a Residue Number System and Legendre symbol compression to avoid modular inversion, achieving 3.12n + o(n) total qubits for an n-bit curve.

Important trade-off: This qubit-minimised result requires 22 independent runs and approximately 2^38.10 Toffoli gates each - a massively higher gate count than depth-optimised approaches. For early fault-tolerant hardware where logical qubits are the bottleneck, this provides a path to attacking ECC on smaller systems. For hardware where gate count is the bottleneck, Google's ~1,200-1,450 qubit / 18-23 minute approach remains more practical.