Add ECAdd() Bloq

qualtran/_infra/data_types.py

@@ -810,6 +810,18 @@ def assert_valid_classical_val_array(
         if np.any(val_array >= 2**self.bitsize):
             raise ValueError(f"Too-large classical values encountered in {debug_str}")
 
+    def montgomery_inverse(self, xm, n, p):
+        return ((pow(xm, p - 2, p)) * pow(2, 2 * n, p)) % p
+
+    def montgomery_product(self, xm, ym, n, p):
+        return (xm * ym * pow(2, n * (p - 2), p)) % p
+
+    def montgomery_to_uint(self, xm, n, p):
+        return (xm * pow(2, n * (p - 2), p)) % p
+
+    def uint_to_montgomery(self, x, n, p):
+        return (x * pow(2, n, p)) % p
+
 
 @attrs.frozen
 class QGF(QDType):

qualtran/bloqs/arithmetic/_shims.py

@@ -22,8 +22,11 @@
 
 from attrs import frozen
 
-from qualtran import Bloq, QBit, QUInt, Register, Signature
+from qualtran import Bloq, QBit, QMontgomeryUInt, QUInt, Register, Signature
+from qualtran.bloqs.arithmetic.bitwise import BitwiseNot
+from qualtran.bloqs.arithmetic.controlled_addition import CAdd
 from qualtran.bloqs.basic_gates import Toffoli
+from qualtran.bloqs.basic_gates.swap import TwoBitCSwap
 from qualtran.resource_counting import BloqCountDictT, SympySymbolAllocator
 
 
@@ -39,6 +42,20 @@ def build_call_graph(self, ssa: SympySymbolAllocator) -> BloqCountDictT:
         return {Toffoli(): self.n - 2}
 
 
+@frozen
+class CSub(Bloq):
+    n: int
+
+    @cached_property
+    def signature(self) -> 'Signature':
+        return Signature(
+            [Register('ctrl', QBit()), Register('x', QUInt(self.n)), Register('y', QUInt(self.n))]
+        )
+
+    def build_call_graph(self, ssa: SympySymbolAllocator) -> BloqCountDictT:
+        return {CAdd(QMontgomeryUInt(self.n)): 1, BitwiseNot(QMontgomeryUInt(self.n)): 3}
+
+
 @frozen
 class Lt(Bloq):
     n: int
@@ -62,3 +79,6 @@ class CHalf(Bloq):
     @cached_property
     def signature(self) -> 'Signature':
         return Signature([Register('ctrl', QBit()), Register('x', QUInt(self.n))])
+
+    def build_call_graph(self, ssa: SympySymbolAllocator) -> BloqCountDictT:
+        return {TwoBitCSwap(): self.n}

qualtran/bloqs/factoring/ecc/ec_add.ipynb

@@ -41,17 +41,22 @@
     "This takes elliptic curve points given by (a, b) and (x, y)\n",
     "and outputs the sum (x_r, y_r) in the second pair of registers.\n",
     "\n",
+    "Because the decomposition of this Bloq is complex, we split it into six separate parts\n",
+    "corresponding to the parts described in figure 10 of the Litinski paper cited below. We follow\n",
+    "the signature from figure 5 and break down the further decompositions based on the steps in\n",
+    "figure 10.\n",
+    "\n",
     "#### Parameters\n",
     " - `n`: The bitsize of the two registers storing the elliptic curve point\n",
     " - `mod`: The modulus of the field in which we do the addition.\n",
-    " - `window_size`: The number of bits in the window. \n",
+    " - `window_size`: The number of bits in the ModMult window. \n",
     "\n",
     "#### Registers\n",
-    " - `a`: The x component of the first input elliptic curve point of bitsize `n`.\n",
-    " - `b`: The y component of the first input elliptic curve point of bitsize `n`.\n",
-    " - `x`: The x component of the second input elliptic curve point of bitsize `n`, which will contain the x component of the resultant curve point.\n",
-    " - `y`: The y component of the second input elliptic curve point of bitsize `n`, which will contain the y component of the resultant curve point.\n",
-    " - `lam_r`: The precomputed lambda slope used in the addition operation if (a, b) = (x, y). \n",
+    " - `a`: The x component of the first input elliptic curve point of bitsize `n` in montgomery form.\n",
+    " - `b`: The y component of the first input elliptic curve point of bitsize `n` in montgomery form.\n",
+    " - `x`: The x component of the second input elliptic curve point of bitsize `n` in montgomery form, which will contain the x component of the resultant curve point.\n",
+    " - `y`: The y component of the second input elliptic curve point of bitsize `n` in montgomery form, which will contain the y component of the resultant curve point.\n",
+    " - `lam_r`: The precomputed lambda slope used in the addition operation if (a, b) = (x, y) in montgomery form. \n",
     "\n",
     "#### References\n",
     " - [How to compute a 256-bit elliptic curve private key with only 50 million Toffoli gates](https://arxiv.org/abs/2306.08585). Litinski. 2023. Fig 5.\n"