Optimal parallel pebbling strategy reduces gate count in cryptographic trees
Optimal (Parallel) Spooky Pebbling on Binary Trees
Computational Complexity
Summary
Pebble games help model how much memory and time a computation needs, especially when memory is limited. The authors study a special kind of pebbling called spooky pebbling, which models quantum computations that can reuse memory after measurement. They find the best strategies for computing on binary trees, managing memory and speed optimally. Their approach speeds up computations and reduces the number of quantum logic gates needed in cryptographic algorithms, improving existing methods by over 20%.
What this means in practice
- •For quantum circuit designers: Reduce quantum gate counts in arithmetic circuits by applying optimized pebbling schedules to binary-tree computations.
- •For cryptographic engineers: Optimize resource use and speed for public-key cryptography hardware implementing point-addition trees using spooky pebbling techniques.
Authors
Mingyu Lee, Sanghyun Lee, Kabgyun Jeong
Abstract
Pebble games model computations under a fixed space budget. Spooky pebbling allows quantum memory to be released by measurement, with the resulting phases corrected later. We study two-input computations with binary-tree dependencies and determine the optimal work and parallel depth for complete binary trees. Our key idea is to clean up the tree in blocks, reducing repeated recomputation of intermediate values. For the complete tree $B_h$ with $n=2^h-1$ vertices and every space budget $h+1\le s\le n$, we give an algorithm with asymptotically optimal work $Θ(nh/\log(s+1))$. At the minimum budget $s=h+1$, this improves the $O(n\log n)$ bound of Kornerup, Sadun, and Soloveichik to $Θ(n\log n/\log\log n)$, resolving their time-optimality question. We also construct a parallel schedule with optimal depth \[ Θ\!\left(h+\frac ns \max\!\left\{\frac{h}{\log(s+1)},\,1+\log^*h\right\}\right). \] Our lower bounds hold for every full binary tree. We also show that achieving optimal parallel depth can require asymptotically more work than minimizing work alone. Applying our schedule to the RNS point-addition trees in the public implementation of Chevignard, Fouque, and Schrottenloher reduces their Toffoli/AND gate count by $20.86\%$ for a P-224 instance and $22.66\%$ for a P-256 instance, using the same arithmetic circuits and peak workspace.