There have been comparisons between RSA and ECDH with regards to the number of qubits required to break the algorithm with a specific key size. But how many qubits are required to break "classical" Diffie-Hellman (DH) over a multiplicative (finite, cyclic) group?

This would for instance be interesting for stored DHE TLS sessions that used for key agreement. Would it do better or worse than RSA with a similar key size (and therefore, approximately the same classical cryptographic strength)?

  • 5
    $\begingroup$ Actually, it's $4 \cdot x + O(1)$, but I don't have a reference (and sorry for my incorrect comment earlier, I miscounted) $\endgroup$
    – poncho
    Commented Aug 15, 2018 at 18:53


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.