How it works
The whole competition comes down to one small operation, built out of the simplest logic steps a quantum computer can run. This page explains what those steps are, which ones are expensive and why, and where almost all of the cost turns out to hide. No background needed beyond the threat primer.
The one operation
Shor's attack on a signature spends nearly all of its time doing a single thing: adding two points on the secp256k1 curve. That step is a fixed recipe that combines two points into a third, and the attack repeats it thousands of times. So the size of the whole attack is basically the size of that one step, multiplied out.
That is why the competition ignores the rest of the attack and scores only this one operation. Make it leaner, and every copy of it gets leaner, and the machine that could run the attack gets smaller. The entire project is about shaving cost off this single step.
So what does “adding two points” mean? secp256k1 is an elliptic curve, the smooth shape one short equation draws: y² = x³ + 7. “Adding” two points on it is a geometry rule, draw a straight line through them and reflect where that line next crosses the curve. Drag P and Q below and watch the third point move.
Interactivey² = x³ + 7 · drag P and Q
P
(-1.00, 2.45)
Q
(2.00, 3.87)
P + Q
(-0.77, -2.56)
Draw the straight line through P and Q (orange). It hits the curve at exactly one more point, then reflect that point down across the x-axis (dashed) to get P+Q. That reflection is the whole rule, and it is the one operation the circuit optimization is built around.
Here is the surprising part, and the reason the whole scheme works: no matter which two points you pick, the answer always lands back on the curve. Nothing ever falls off. That property is called closure, and it turns the points on the curve into a self-contained number system you can do arithmetic inside, which is exactly what a cryptosystem needs.
This is the part I love, and it is what drew me to the project. A rule simple enough to sketch by hand, a line and a reflection, turns out to be what keeps real money safe for millions of people. A small piece of geometry carrying that much weight is the kind of thing I find hard to put down.
The keys come from repeating this one move, but on a single point. In the picture above, P and Q were two separate sample points, added once to show the rule. Key-making instead starts from one fixed, public point called the generator G, and adds it to itself over and over (press “Double P” above to watch a point add to itself, the doubling step that makes this fast). Sum d copies of G and you land on a point Q = dG. The secret number d is the private key; the point Q you reach is the public key. Going forward is quick, but recovering d, the number of copies, from just G and Q is the hard problem that keeps a wallet locked. The threat primer walks through that lock in full.
The real curve lives over a finite field of about 2²⁵⁶ whole numbers, so it is really a scatter of points, not a smooth line. The picture uses ordinary numbers to make the rule visible, but the finite-field version the attack runs on follows exactly the same rule.
The strange rule
A quantum computer has a rule an ordinary one does not: every operation has to be reversible. Given the output, you must always be able to recover the input. Think of a recipe you could run backward to get your exact ingredients out of the finished dish.
Ordinary logic breaks that rule constantly. An AND gate answers “are both inputs on?” with a single yes or no, and once you see a “no” you cannot tell which input was off. Information was thrown away, so the step cannot be undone.
A quantum circuit is not allowed to do that, so all of the arithmetic has to be rebuilt out of reversible steps, and any scratch work has to be wiped clean at the end. Those scratch qubits are called ancilla, and the competition does not accept any circuit that leaves them dirty. This is why so much of the work is bookkeeping: not just computing the answer, but undoing everything else you touched to get it.
The parts
A circuit is just qubits (the wires) and gates (the steps applied to them). Most gates are cheap. One is not, and it is the one that does the real work: the Toffoli gate. It flips a bit only when two other bits are both on, which is the reversible way to do an AND, and it is the building block every piece of arithmetic is assembled from.
Here is why it dominates the score. On a real error-corrected machine, a Toffoli cannot be run directly. It has to be fed a specially prepared, expensive resource called a magic state, and manufacturing those magic states is one of the most costly things such a machine does. Simple gates are close to free by comparison. So counting Toffoli gates is a good stand-in for counting how hard the whole circuit is to run, which is exactly what the competition does.
The score
A submission is graded on one number: average Toffoli count times peak qubit width. Lower wins.
~1.3 million
Toffoli gates
the expensive operations, counted per run
1,152
qubits
how wide a machine the circuit needs
The Toffoli count stands in for how much expensive work the circuit does. The qubit count stands in for how big a machine it needs. Multiplying them gives one number for the total difficulty of the attack, so a smaller product means a leaner, sooner-to-arrive threat. For the community circuit those two numbers are about 1.3 million and 1,152, which multiply to roughly 1.5 billion (1.5 × 10⁹).
The bottleneck
Adding two points on the curve is really a sequence of arithmetic on enormous 256-bit numbers, all done in clock arithmetic (every result wraps around a fixed prime). Adding, subtracting, and multiplying those numbers is manageable. Dividing them is not.
Division in clock arithmetic has a name: modular inversion, finding the number that undoes a multiplication. It is far more work than the other operations, and a single point addition needs two of them. When I profiled where the Toffoli gates actually go, those two divisions accounted for about 95 percent of the entire budget. The circuit performs each one with a method called a binary GCD engine, an old algorithm for greatest common divisors run in a reversible form. So the competition, stripped all the way down, is really one question: can anyone divide, reversibly, for fewer Toffoli gates?
The floor
Two facts pin the cost in place. First, this kind of point addition genuinely requires those two divisions; there is no version that skips them. Second, when I went through the published methods for doing reversible division, none of them used fewer Toffoli gates than the one already in the circuit. Every other lever I could reach, register sizes, leftover gates, the order of operations, was already at its limit too.
So the cost bottoms out at roughly “two divisions' worth,” and that bottom is what the project notes call the floor or the frontier. Getting underneath it is not a matter of tightening the existing circuit. It would take a genuinely different division algorithm, which is an open research problem, not an afternoon of tuning. Establishing that, that the circuit sits at its floor and knowing why, was the real result of the work.
Quick reference
Where this leads
With the vocabulary in hand, the project notes on the main page read as a running log: reproducing the circuit, profiling it, and then checking whether its floor is the circuit's or the whole problem's.
Now the notes make sense