There have been comparisons between RSA and ECDH with regards to the number of qbits (qubits) required to break the algorithm with a specific key size. But how many qbits are required to break "classical" Diffie-Hellman (DH) over a multiplicative group?

This would for instance be interesting for stored DHE TLS sessions that used for key agreement, especially if a relatively small key size was used.

  • $\begingroup$ Actually, it's $4 \cdot x + O(1)$, but I don't have a reference (and sorry for my incorrect comment earlier, I miscounted) $\endgroup$ – poncho Aug 15 '18 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.