# How many qbits are required to break Diffie-Hellman over a multiplicative group

There have been comparisons between RSA and ECDH with regards to the number of qbits (qubits) required to break the algorithm with a specific key size. But how many qbits are required to break "classical" Diffie-Hellman (DH) over a multiplicative group?

This would for instance be interesting for stored DHE TLS sessions that used for key agreement, especially if a relatively small key size was used.

• Actually, it's $4 \cdot x + O(1)$, but I don't have a reference (and sorry for my incorrect comment earlier, I miscounted) – poncho Aug 15 '18 at 18:53