A New Algorithm Shrinks the Quantum Attack Surface for ECC

Caute_cautim — Tue, 31 Mar 2026 05:19:12 GMT

Hi All

A new EUROCRYPT 2026 paper just proved both points.

Chevignard, Fouque, and Schrottenloher have cut the logical qubit count for breaking elliptic curve crypto nearly in half.

The numbers:

- P-256: 1,193 logical qubits. Down from 2,124. That's now 42% fewer qubits than breaking RSA-3072 at equivalent classical security.

- P-224: just 1,098 qubits - 21.5% less than RSA-2048.

- Asymptotically: 3.12n + o(n) qubits, down from 5n + o(n).

This is exactly the trajectory I flagged. When I wrote "How ECC Became the Easiest Quantum Target" (https://lnkd.in/dK2UhKqA

), the qubit counts for P-256 and RSA-3072 were roughly comparable. Now ECC is decisively easier - and the gap is widening.

When I wrote "Bitcoin's Quantum Risk Is Closer Than You Think" (https://lnkd.in/ea9_gTCT

), it was argued that using RSA qubit estimates as a proxy for Bitcoin's secp256k1 curve was dangerously misleading. This paper confirms it: the quantum threshold for 256-bit ECC is now well below RSA-2048's.

The tradeoff is a ~1,000× increase in gate count. But qubit count has consistently been the binding hardware constraint, and if the RSA optimization pipeline repeats - where Gidney compressed the gate count 100× within months - those numbers will shrink fast.

What security leaders should take from this:

If your quantum risk model benchmarks against RSA estimates, you're overestimating the time available for ECC-dependent systems. Which is most systems.

The HNDL calculus for ECDH-protected traffic just shifted - a lower qubit threshold means adversaries' expected quantum payoff arrives sooner.

ML-KEM is standardized Hybrid deployments work today. The migration window is finite and the target keeps moving.

Full analysis: https://lnkd.in/ew-4Dpru

https://postquantum.com/security-pqc/algorithm-quantum-ecc/

Thanks to Marin Ivezic

Regards

Caute_Cautim

topic A New Algorithm Shrinks the Quantum Attack Surface for ECC in Tech Talk

A New Algorithm Shrinks the Quantum Attack Surface for ECC