prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What are the three synthetic types of vitamin K?

Read the following text and answer briefly.

Context 1: Vitamin K - Wikipedia
(Redirected from Vitamin k)
This article needs more medical references for verification or relies too heavily on primary sources  Please review the contents of the article and add the appropriate references if you can  Unsourced or poorly sourced material may be challenged and removed  (November 2015)
This article is about the family of vitamers  For vitamin K1 the form usually used as a supplement, see Phytomenadione 
Vitamin K structures  MK-4 and MK-7 are both subtypes of K2 
Vitamin K deficiency, Warfarin overdose
Vitamin K is a group of structurally similar, fat-soluble vitamins the human body requires for complete synthesis of certain proteins that are prerequisites for blood coagulation and which the body also needs for controlling binding of calcium in bones and other tissues  The vitamin K-related modification of the proteins allows them to bind calcium ions, which they cannot do otherwise  Without vitamin K, blood coagulation is seriously impaired, and uncontrolled bleeding occurs  Low levels of vitamin K also weaken bones and promote calcification of arteries and other soft tissues[citation needed] 
Chemically, the vitamin K family comprises 2-methyl-1,4-naphthoquinone (3-) derivatives  Vitamin K includes two natural vitamers: vitamin K1 and vitamin K2 [1] Vitamin K2, in turn, consists of a number of related chemical subtypes, with differing lengths of carbon side chains made of isoprenoid groups of atoms 
Vitamin K1, also known as phylloquinone, is made by plants, and is found in highest amounts in green leafy vegetables because it is directly involved in photosynthesis  It may be thought of as the plant form of vitamin K  It is active as a vitamin in animals and performs the classic functions of vitamin K, including its activity in the production of blood-clotting proteins  Animals may also convert it to vitamin K2 
Bacteria in the gut flora can also convert K1 into vitamin K2  In addition, bacteria typically lengthen the isoprenoid side chain of vitamin K2 to produce a range of vitamin K2 forms, most notably the MK-7 to MK-11 homologues of vitamin K2  All forms of K2 other than MK-4 can only be produced by bacteria, which use these forms in anaerobic respiration  The MK-7 and other bacterially derived forms of vitamin K2 exhibit vitamin K activity in animals, but MK-7's extra utility over MK-4, if any, is unclear and is a matter of investigation 
Three synthetic types of vitamin K are known: vitamins K3, K4, and K5  Although the natural K1 and all K2 homologues and synthetic K4 and K5 have proven nontoxic, the synthetic form K3 (menadione) has shown toxicity [2]
1 2 Cardiovascular health
1 4 Coumarin poisoning
4 1 Conversion of vitamin K1 to vitamin K2
4 2 Vitamin K2
6 Absorption and dietary need
7 Dietary reference intake
10 Biochemistry
10 1 Function in animals
10 2 Gamma-carboxyglutamate proteins
10 3 Methods of assessment
10 4 Function in bacteria
11 Injection in newborns
11 3 Controversy
A review of 2014 concluded that there is positive evidence that monotherapy using MK-4, one of the forms of Vitamin K2, reduces fracture incidence in post-menopausal women with osteoporosis, and suggested further research on the combined use of MK-4 with bisphosphonates  In contrast, an earlier review article of 2013 concluded that there is no good evidence that vitamin K supplementation helps prevent osteoporosis or fractures in postmenopausal women [3]
A Cochrane systematic review of 2006 suggested that supplementation with Vitamin K1 and with MK4 reduces bone loss; in particular, a strong effect of MK-4 on incident fractures among Japanese patients was emphasized [4]
A review article of 2016 suggested to consider, as one of several measures for bone health, increasing the intake of foods rich in vitamins K1 and K2 [5]
Cardiovascular health[edit]
Adequate intake of vitamin K is associated with the inhibition of arterial calcification and stiffening,[6] but there have been few interventional studies and no good evidence that vitamin K supplementation is of any benefit in the primary prevention of cardiovascular disease [7]
One 10-year population study, the Rotterdam Study, did show a clear and significant inverse relationship between the highest intake levels of menaquinone (mainly MK-4 from eggs and meat, and MK-8 and MK-9 from cheese) and cardiovascular disease and all-cause mortality in older men and women [8]
Vitamin K has been promoted in supplement form with claims it can slow tumor growth; there is however no good medical evidence that supports such claims [9]
Coumarin poisoning[edit]
Vitamin K is part of the suggested treatment regime for poisoning by rodenticide (coumarin poisoning) [10]
Although allergic reaction from supplementation is possible, no known toxicity is associated with high doses of the phylloquinone (vitamin K1) or menaquinone (vitamin K2) forms of vitamin K, so no tolerable upper intake level (UL) has been set [11]
Blood clotting (coagulation) studies in humans using 45 mg per day of vitamin K2 (as MK-4)[12] and even up to 135 mg per day (45 mg three times daily) of K2 (as MK-4),[13] showed no increase in blood clot risk  Even doses in rats as high as 250 mg/kg, body weight did not alter the tendency for blood-clot formation to occur [14]
Unlike the safe natural forms of vitamin K1 and vitamin K2 and their various isomers, a synthetic form of vitamin K, vitamin K3 (menadione), is demonstrably toxic at high levels  The U S  FDA has banned this form from over-the-counter sale in the United States because large doses have been shown to cause allergic reactions, hemolytic anemia, and cytotoxicity in liver cells [2]
Phylloquinone (K1)[15][16] or menaquinone (K2) are capable of reversing the anticoagulant activity of the anticoagulant warfarin (tradename Coumadin)  Warfarin works by blocking recycling of vitamin K, so that the body and tissues have lower levels of active vitamin K, and thus a deficiency of vitamin K 
Supplemental vitamin K (for which oral dosing is often more active than injectable dosing in human adults) reverses the vitamin K deficiency caused by warfarin, and therefore reduces the intended anticoagulant action of warfarin and related drugs [17] Sometimes small amounts of vitamin K are given orally to patients taking warfarin so that the action of the drug is more predictable [17] The proper anticoagulant action of the drug is a function of vitamin K intake and drug dose, and due to differing absorption must be individualized for each patient [citation needed] The action of warfarin and vitamin K both require two to five days after dosing to have maximum effect, and neither warfarin or vitamin K shows much effect in the first 24 hours after they are given [18]
The newer anticoagulants dabigatran and rivaroxaban have different mechanisms of action that do not interact with vitamin K, and may be taken with supplemental vitamin K [19][20]
Vitamin K2 (menaquinone)  In menaquinone, the side chain is composed of a varying number of isoprenoid residues  The most common number of these residues is four, since animal enzymes normally produce menaquinone-4 from plant phylloquinone 
A sample of phytomenadione for injection, also called phylloquinone
The three synthetic forms of vitamin K are vitamins K3 (menadione), K4, and K5, which are used in many areas, including the pet food industry (vitamin K3) and to inhibit fungal growth (vitamin K5) [21]
Conversion of vitamin K1 to vitamin K2[edit]
Vitamin K1 (phylloquinone) – both forms of the vitamin contain a functional naphthoquinone ring and an aliphatic side chain  Phylloquinone has a phytyl side chain 
The MK-4 form of vitamin K2 is produced by conversion of vitamin K1 in the testes, pancreas, and arterial walls [22] While major questions still surround the biochemical pathway for this transformation, the conversion is not dependent on gut bacteria, as it occurs in germ-free rats[23][24] and in parenterally-administered K1 in rats [25][26] In fact, tissues that accumulate high amounts of MK-4 have a remarkable capacity to convert up to 90% of the available K1 into MK-4 [27][28] There is evidence that the conversion proceeds by removal of the phytyl tail of K1 to produce menadione as an intermediate, which is then condensed with an activated geranylgeranyl moiety (see also prenylation) to produce vitamin K2 in the MK-4 (menatetrione) form [29]
Vitamin K2[edit]
Main article: Vitamin K2
Vitamin K2 (menaquinone) includes several subtypes  The two subtypes most studied are menaquinone-4 (menatetrenone, MK-4) and menaquinone-7 (MK-7) 
Vitamin K1, the precursor of most vitamin K in nature, is a stereoisomer of phylloquinone, an important chemical in green plants, where it functions as an electron acceptor in photosystem I during photosynthesis  For this reason, vitamin K1 is found in large quantities in the photosynthetic tissues of plants (green leaves, and dark green leafy vegetables such as romaine lettuce, kale and spinach), but it occurs in far smaller quantities in other plant tissues (roots, fruits, etc )  Iceberg lettuce contains relatively little  The function of phylloquinone in plants appears to have no resemblance to its later metabolic and biochemical function (as "vitamin K") in animals, where it performs a completely different biochemical reaction 
Vitamin K (in animals) is involved in the carboxylation of certain glutamate residues in proteins to form gamma-carboxyglutamate (Gla) residues  The modified residues are often (but not always) situated within specific protein domains called Gla domains  Gla residues are usually involved in binding calcium, and are essential for the biological activity of all known Gla proteins [30]
At this time[update], 17 human proteins with Gla domains have been discovered, and they play key roles in the regulation of three physiological processes:
Blood coagulation: prothrombin (factor II), factors VII, IX, and X, and proteins C, S, and Z[31]
Bone metabolism: osteocalcin, also called bone Gla protein (BGP), matrix Gla protein (MGP),[32] periostin,[33] and the recently discovered Gla-rich protein (GRP) [34][35]
Vascular biology: growth arrest-specific protein 6 (Gas6)[36]
Unknown function: proline-rich γ-carboxyglutamyl proteins (PRGPs) 1 and 2, and transmembrane γ-carboxy glutamyl proteins (TMGs) 3 and 4 [37]
Like other lipid-soluble vitamins (A, D and E), vitamin K is stored in the fatty tissue of the human body 
Absorption and dietary need[edit]
Previous theory held that dietary deficiency is extremely rare unless the small intestine was heavily damaged, resulting in malabsorption of the molecule  Another at-risk group for deficiency were those subject to decreased production of K2 by normal intestinal microbiota, as seen in broad spectrum antibiotic use [38] Taking broad-spectrum antibiotics can reduce vitamin K production in the gut by nearly 74% in people compared with those not taking these antibiotics [39] Diets low in vitamin K also decrease the body's vitamin K concentration [40] Those with chronic kidney disease are at risk for vitamin K deficiency, as well as vitamin D deficiency, and particularly those with the apoE4 genotype [41] Additionally, in the elderly there is a reduction in vitamin K2 production [42]
The National Academy of Medicine (NAM) updated an estimate of what constitutes an adequate intake (AI) for vitamin K in 2001  The NAM does not distinguish between K1 and K2 – both are counted as vitamin K  At that time there was not sufficient evidence to set the more rigorous estimated average requirement (EAR) or recommended dietary allowance (RDA) given for most of the essential vitamins and minerals  The current daily AIs for vitamin K for adult women and men are 90 μg and 120 μg respectively  The AI for pregnancy and lactation is 90 μg  For infants up to 12 months the AI is 2–2 5 μg, and for children aged 1 to 18 years the AI increases with age from 30 to 75 μg  As for safety, the FNB also sets tolerable upper intake levels (known as ULs) for vitamins and minerals when evidence is sufficient  In the case of vitamin K no UL is set, as evidence for adverse effects is not sufficient  Collectively EARs, RDAs, AIs and ULs are referred to as dietary reference intakes [43] The European Food Safety Authority reviewed the same safety question and did not set an UL [44]
For U S  food and dietary supplement labeling purposes, the amount in a serving is expressed as a percentage of daily value (%DV)  For vitamin K labeling purposes the daily value was 80 μg, but as of May 2016 it has been revised upwards to 120 μg  A table of the pre-change adult daily values is provided at reference daily intake  Food and supplement companies have until 28 July 2018 to comply with the change 
See also: Vitamin K2 § Dietary sources
K1 (μg)[45]
Kale, cooked
Collards, cooked
Collards, raw
Swiss chard, cooked
Swiss chard, raw
Turnip greens, raw
Romaine lettuce, raw
Table from "Important information to know when you are taking: Warfarin (Coumadin) and Vitamin K", Clinical Center, National Institutes of Health Drug Nutrient Interaction Task Force [46]
Vitamin K1 is found chiefly in leafy green vegetables such as dandelion greens (which contain 778 4 μg per 100 g, or 741% of the recommended daily amount), spinach, swiss chard, lettuce and Brassica vegetables (such as cabbage, kale, cauliflower, broccoli, and brussels sprouts) and often the absorption is greater when accompanied by fats such as butter or oils; some fruits, such as avocados, kiwifruit and grapes, are also high in vitamin K  By way of reference, two tablespoons of parsley contains 153% of the recommended daily amount of vitamin K [47] Some vegetable oils, notably soybean oil, contain vitamin K, but at levels that would require relatively large calorie consumption to meet the USDA-recommended levels [48] colonic bacteria synthesize a significant portion of humans' vitamin K needs; newborns often receive a vitamin K shot at birth to tide them over until their colons become colonized at five to seven days of age from the consumption of breast milk 
The tight binding of vitamin K1 to thylakoid membranes in chloroplasts makes it less bioavailable  For example, cooked spinach has a 5% bioavailability of phylloquinone, however, fat added to it increases bioavailability to 13% due to the increased solubility of vitamin K in fat [49]
Main article: Vitamin K deficiency
Average diets are usually not lacking in vitamin K, and primary deficiency is rare in healthy adults  Newborn infants are at an increased risk of deficiency  Other populations with an increased prevalence of vitamin K deficiency include those who suffer from liver damage or disease (e g  alcoholics), cystic fibrosis, or inflammatory bowel diseases, or have recently had abdominal surgeries  Secondary vitamin K deficiency can occur in people with bulimia, those on stringent diets, and those taking anticoagulants  Other drugs associated with vitamin K deficiency include salicylates, barbiturates, and cefamandole, although the mechanisms are still unknown  Vitamin K1 deficiency can result in coagulopathy, a bleeding disorder [50]Symptoms of K1 deficiency include anemia, bruising, nosebleeds and bleeding of the gums in both sexes, and heavy menstrual bleeding in women 
Osteoporosis[51][52] and coronary heart disease[53][54] are strongly associated with lower levels of K2 (menaquinone)  Vitamin K2 (as menaquinones MK-4 through MK-10) intake level is inversely related to severe aortic calcification and all-cause mortality [8]
Function in animals[edit]
Mechanism of action of vitamin K1 
The function of vitamin K2 in the animal cell is to add a carboxylic acid functional group to a glutamate (Glu) amino acid residue in a protein, to form a gamma-carboxyglutamate (Gla) residue  This is a somewhat uncommon posttranslational modification of the protein, which is then known as a "Gla protein"  The presence of two −COOH (carboxylic acid) groups on the same carbon in the gamma-carboxyglutamate residue allows it to chelate calcium ions  The binding of calcium ions in this way very often triggers the function or binding of Gla-protein enzymes, such as the so-called vitamin K-dependent clotting factors discussed below 
Within the cell, vitamin K undergoes electron reduction to a reduced form called vitamin K hydroquinone, catalyzed by the enzyme vitamin K epoxide reductase (VKOR) [55] Another enzyme then oxidizes vitamin K hydroquinone to allow carboxylation of Glu to Gla; this enzyme is called gamma-glutamyl carboxylase[56][57] or the vitamin K-dependent carboxylase  The carboxylation reaction only proceeds if the carboxylase enzyme is able to oxidize vitamin K hydroquinone to vitamin K epoxide at the same time  The carboxylation and epoxidation reactions are said to be coupled  Vitamin K epoxide is then reconverted to vitamin K by VKOR  The reduction and subsequent reoxidation of vitamin K coupled with carboxylation of Glu is called the vitamin K cycle [58] Humans are rarely deficient in vitamin K1 because, in part, vitamin K1 is continuously recycled in cells [59]
Warfarin and other 4-hydroxycoumarins block the action of VKOR [60] This results in decreased concentrations of vitamin K and vitamin K hydroquinone in tissues, such that the carboxylation reaction catalyzed by the glutamyl carboxylase is inefficient  This results in the production of clotting factors with inadequate Gla  Without Gla on the amino termini of these factors, they no longer bind stably to the blood vessel endothelium and cannot activate clotting to allow formation of a clot during tissue injury  As it is impossible to predict what dose of warfarin will give the desired degree of clotting suppression, warfarin treatment must be carefully monitored to avoid overdose 
Gamma-carboxyglutamate proteins[edit]
Main article: Gla domain
The following human Gla-containing proteins ("Gla proteins") have been characterized to the level of primary structure: blood coagulation factors II (prothrombin), VII, IX, and X, anticoagulant proteins C and S, and the factor X-targeting protein Z  The bone Gla protein osteocalcin, the calcification-inhibiting matrix Gla protein (MGP), the cell growth regulating growth arrest specific gene 6 protein (Gas6), and the four transmembrane Gla proteins (TMGPs), the function of which is at present unknown  Gas6 can function as a growth factor to activate the Axl receptor tyrosine kinase and stimulate cell proliferation or prevent apoptosis in some cells  In all cases in which their function was known, the presence of the Gla residues in these proteins turned out to be essential for functional activity 
Gla proteins are known to occur in a wide variety of vertebrates: mammals, birds, reptiles, and fish  The venom of a number of Australian snakes acts by activating the human blood-clotting system  In some cases, activation is accomplished by snake Gla-containing enzymes that bind to the endothelium of human blood vessels and catalyze the conversion of procoagulant clotting factors into activated ones, leading to unwanted and potentially deadly clotting 
Another interesting class of invertebrate Gla-containing proteins is synthesized by the fish-hunting snail Conus geographus [61] These snails produce a venom containing hundreds of neuroactive peptides, or conotoxins, which is sufficiently toxic to kill an adult human  Several of the conotoxins contain two to five Gla residues [62]
Methods of assessment[edit]
Vitamin K status can be assessed by:
The prothrombin time (PT) test measures the time required for blood to clot  A blood sample is mixed with citric acid and put in a fibrometer; delayed clot formation indicates a deficiency  This test is insensitive to mild deficiency, as the values do not change until the concentration of prothrombin in the blood has declined by at least 50% [63]
Undercarboxylated prothrombin (PIVKA-II); in a study of 53 newborns, found "PT (prothrombin time) is a less sensitive marker than PIVKA II",[64] and as indicated above, PT is unable to detect subclinical deficiencies that can be detected with PIVKA-II testing 
Plasma phylloquinone was found to be positively correlated with phylloquinone intake in elderly British women, but not men,[65] but an article by Schurgers et al  reported no correlation between FFQ[further explanation needed] and plasma phylloquinone [66]
Urinary γ-carboxyglutamic acid responds to changes in dietary vitamin K intake  Several days are required before any change can be observed  In a study by Booth et al , increases of phylloquinone intakes from 100 μg to between 377 and 417 μg for five days did not induce a significant change  Response may be age-specific [67]
Undercarboxylated osteocalcin (UcOc) levels have been inversely correlated with stores of vitamin K[68] and bone strength in developing rat tibiae  Another study following 78 post-menopausal Korean women found a supplement regimen of vitamins K and D, and calcium, but not a regimen of vitamin D and calcium, was inversely correlated with reduced UcOc levels [69]
Function in bacteria[edit]
Many bacteria, such as Escherichia coli found in the large intestine, can synthesize vitamin K2 (menaquinone-7 or MK-7, up to MK-11),[70] but not vitamin K1 (phylloquinone)  In these bacteria, menaquinone transfers two electrons between two different small molecules, during oxygen-independent metabolic energy production processes (anaerobic respiration) [71] For example, a small molecule with an excess of electrons (also called an electron donor) such as lactate, formate, or NADH, with the help of an enzyme, passes two electrons to menaquinone  The menaquinone, with the help of another enzyme, then transfers these two electrons to a suitable oxidant, such fumarate or nitrate (also called an electron acceptor)  Adding two electrons to fumarate or nitrate converts the molecule to succinate or nitrite plus water, respectively 
Some of these reactions generate a cellular energy source, ATP, in a manner similar to eukaryotic cell aerobic respiration, except the final electron acceptor is not molecular oxygen, but fumarate or nitrate  In aerobic respiration, the final oxidant is molecular oxygen (O2), which accepts four electrons from an electron donor such as NADH to be converted to water  E  coli, as facultative anaerobes, can carry out both aerobic respiration and menaquinone-mediated anaerobic respiration 
Injection in newborns[edit]
The blood clotting factors of newborn babies are roughly 30–60% that of adult values; this may be due to the reduced synthesis of precursor proteins and the sterility of their guts  Human milk contains 1–4 μg/L of vitamin K1, while formula-derived milk can contain up to 100 μg/L in supplemented formulas  Vitamin K2 concentrations in human milk appear to be much lower than those of vitamin K1  Occurrence of vitamin K deficiency bleeding in the first week of the infant's life is estimated at 0 25–1 7%, with a prevalence of 2–10 cases per 100,000 births [72] Premature babies have even lower levels of the vitamin, so they are at a higher risk from this deficiency 
Bleeding in infants due to vitamin K deficiency can be severe, leading to hospitalization, blood transfusions, brain damage, and death  Supplementation can prevent most cases of vitamin K deficiency bleeding in the newborn  Intramuscular administration is more effective in preventing late vitamin K deficiency bleeding than oral administration [73][74]
As a result of the occurrences of vitamin K deficiency bleeding, the Committee on Nutrition of the American Academy of Pediatrics has recommended 0 5–1 mg of vitamin K1 be administered to all newborns shortly after birth [74]
In the UK vitamin K supplementation is recommended for all newborns within the first 24 hours [75] This is usually given as a single intramuscular injection of 1 mg shortly after birth but as a second-line option can be given by three oral doses over the first month [76]
Controversy arose in the early 1990s regarding this practice, when two studies suggested a relationship between parenteral administration of vitamin K and childhood cancer,[77] however, poor methods and small sample sizes led to the discrediting of these studies, and a review of the evidence published in 2000 by Ross and Davies found no link between the two [78] Doctors reported emerging concerns in 2013,[79] after treating children for serious bleeding problems  They cited lack-of newborn vitamin K administration, as the reason that the problems occurred, and recommended that breastfed babies could have an increased risk unless they receive a preventative dose 
In the early 1930s, Danish scientist Henrik Dam investigated the role of cholesterol by feeding chickens a cholesterol-depleted diet [80] He initially replicated experiments reported by scientists at the Ontario Agricultural College (OAC) [81] McFarlane, Graham and Richardson, working on the chick feed program at OAC, had used chloroform to remove all fat from chick chow  They noticed that chicks fed only fat-depleted chow developed hemorrhages and started bleeding from tag sites [82] Dam found that these defects could not be restored by adding purified cholesterol to the diet  It appeared that – together with the cholesterol – a second compound had been extracted from the food, and this compound was called the coagulation vitamin  The new vitamin received the letter K because the initial discoveries were reported in a German journal, in which it was designated as Koagulationsvitamin  Edward Adelbert Doisy of Saint Louis University did much of the research that led to the discovery of the structure and chemical nature of vitamin K [83] Dam and Doisy shared the 1943 Nobel Prize for medicine for their work on vitamin K (K1 and K2) published in 1939  Several laboratories synthesized the compound(s) in 1939 [84]
For several decades, the vitamin K-deficient chick model was the only method of quantifying vitamin K in various foods: the chicks were made vitamin K-deficient and subsequently fed with known amounts of vitamin K-containing food  The extent to which blood coagulation was restored by the diet was taken as a measure for its vitamin K content  Three groups of physicians independently found this: Biochemical Institute, University of Copenhagen (Dam and Johannes Glavind), University of Iowa Department of Pathology (Emory Warner, Kenneth Brinkhous, and Harry Pratt Smith), and the Mayo Clinic (Hugh Butt, Albert Snell, and Arnold Osterberg) [85]
The first published report of successful treatment with vitamin K of life-threatening hemorrhage in a jaundiced patient with prothrombin deficiency was made in 1938 by Smith, Warner, and Brinkhous [86]
The precise function of vitamin K was not discovered until 1974, when three laboratories (Stenflo et al ,[87] Nelsestuen et al ,[88] and Magnusson et al [89]) isolated the vitamin K-dependent coagulation factor prothrombin (factor II) from cows that received a high dose of a vitamin K antagonist, warfarin  It was shown that, while warfarin-treated cows had a form of prothrombin that contained 10 glutamate (Glu) amino acid residues near the amino terminus of this protein, the normal (untreated) cows contained 10 unusual residues that were chemically identified as γ-carboxyglutamate (Gla)  The extra carboxyl group in Gla made clear that vitamin K plays a role in a carboxylation reaction during which Glu is converted into Gla 
The biochemistry of how vitamin K is used to convert Glu to Gla has been elucidated over the past thirty years in academic laboratories throughout the world 
^ "Vitamin K Overview"  University of Maryland Medical Center  ^ a b Higdon, Jane (Feb 2008)  "Vitamin K"  Linus Pauling Institute, Oregon State University  Retrieved 12 Apr 2008  ^ Hamidi, M  S ; Gajic-Veljanoski, O ; Cheung, A  M  (2013)  "Vitamin K and bone health"  Journal of Clinical Densitometry (Review)  16 (4): 409–413  doi:10 1016/j jocd 2013 08 017  PMID 24090644  ^ Cockayne, S ; Adamson, J ; Lanham-New, S ; Shearer, M  J ; Gilbody, S; Torgerson, D  J  (Jun 2006)  "Vitamin K and the prevention of fractures: systematic review and meta-analysis of randomized controlled trials"  Archives of Internal Medicine (Review)  166 (12): 1256–1261  doi:10 1001/archinte 166 12 1256  PMID 16801507  ^ O'Keefe, J  H ; Bergman, N ; Carrera Bastos, P ; Fontes Villalba, M ; Di Nicolantonio, J  J ; Cordain, L  (2016)  "Nutritional strategies for skeletal and cardiovascular health: hard bones, soft arteries, rather than vice versa"  Open Heart (Review)  3 (1): e000325  doi:10 1136/openhrt-2015-000325  PMC 4809188  PMID 27042317  ^ Maresz, K  (Feb 2015)  "Proper Calcium Use: Vitamin K2 as a Promoter of Bone and Cardiovascular Health"  Integrative Medicine (Review)  14 (1): 34–39  PMC 4566462  PMID 26770129  ^ Hartley, L ; Clar, C ; Ghannam, O ; Flowers, N ; Stranges, S ; Rees, K  (Sep 2015)  "Vitamin K for the primary prevention of cardiovascular disease"  The Cochrane Database of Systematic Reviews (Systematic review)  9 (9): CD011148  doi:10 1002/14651858 CD011148 pub2  PMID 26389791  ^ a b Geleijnse, J  M ; Vermeer, C ; Grobbee, D  E ; Schurgers, L  J ; Knapen, M  H ; van der Meer, I  M ; Hofman, A ; Witteman, J  C  (Nov 2004)  "Dietary intake of menaquinone is associated with a reduced risk of coronary heart disease: the Rotterdam Study"  Journal of Nutrition  134 (11): 3100–3105  PMID 15514282  ^ Ades, T  B , ed  (2009)  "Vitamin K"  American Cancer Society Complete Guide to Complementary and Alternative Cancer Therapies (2nd ed )  American Cancer Society  pp  558–563  ISBN 978-0-944235-71-3  ^ Lung, D  (Dec 2015)  Tarabar, A , ed  "Rodenticide Toxicity Treatment & Management"  Medscape  WebMD  ^ Rasmussen, S  E ; Andersen, N  L ; Dragsted, L  O ; Larsen, J  C  (Mar 2006)  "A safe strategy for addition of vitamins and minerals to foods"  European Journal of Nutrition  45 (3): 123–135  doi:10 1007/s00394-005-0580-9  PMID 16200467  ^ Ushiroyama, T ; Ikeda, A ; Ueki, M (Mar 2002)  "Effect of continuous combined therapy with vitamin K2 and vitamin D3 on bone mineral density and coagulofibrinolysis function in postmenopausal women"  Maturitas  41 (3): 211–221  doi:10 1016/S0378-5122(01)00275-4  PMID 11886767  ^ Asakura, H ; Myou, S ; Ontachi, Y ; Mizutani, T ; Kato, M ; Saito, M ; Morishita, E ; Yamazaki, M ; Nakao, S  (Dec 2001)  "Vitamin K administration to elderly patients with osteoporosis induces no hemostatic activation, even in those with suspected vitamin K deficiency"  Osteoporosis International  12 (12): 996–1000  doi:10 1007/s001980170007  PMID 11846334  ^ Ronden, J  E ; Groenen-van Dooren, M  M ; Hornstra, G ; Vermeer, C  (Jul 1997)  "Modulation of arterial thrombosis tendency in rats by vitamin K and its side chains"  Atherosclerosis  132 (1): 61–67  doi:10 1016/S0021-9150(97)00087-7  PMID 9247360  ^ Ansell, J ; Hirsh, J ; Poller, L ; Bussey, H ; Jacobson, A ; Hylek, E (Sep 2004)  "The pharmacology and management of the vitamin K antagonists: the Seventh ACCP Conference on Antithrombotic and Thrombolytic Therapy"  Chest  126 (3 Suppl ): 204S–233S  doi:10 1378/chest 126 3_suppl 204S  PMID 15383473  ^ Crowther, M  A ; Douketis, J  D ; Schnurr, T ; Steidl, L ; Mera, V ; Ultori, C ; Venco, A ; Ageno, W  (Aug 2002)  "Oral vitamin K lowers the international normalized ratio more rapidly than subcutaneous vitamin K in the treatment of warfarin-associated coagulopathy  A randomized, controlled trial"  Annals of Internal Medicine  137 (4): 251–254  doi:10 7326/0003-4819-137-4-200208200-00009  PMID 12186515  ^ a b "Important Information to Know When You Are Taking: Warfarin (Coumadin) and Vitamin K" (PDF)  National Institute of Health Clinical Center Drug-Nutrient Interaction Task Force  Retrieved 17 Apr 2015  ^ "Guidelines For Warfarin Reversal With Vitamin K" (PDF)  American Society of Health-System Pharmacists  Retrieved 17 Apr 2015  ^ "Pradaxa Drug Interactions"  Pradaxapro com  19 Mar 2012  Retrieved 21 Apr 2013  ^ Bauersachs, R ; Berkowitz, S  D ; Brenner, B ; Buller, H  R ; Decousus, H ; Gallus, A  S ; Lensing, A  W ; Misselwitz, F ; Prins, M  H ; Raskob, G  E ; Segers, A ; Verhamme, P ; Wells, P ; Agnelli, G ; Bounameaux, H ; Cohen, A ; Davidson, B  L ; Piovella, F ; Schellong, S  (Dec 2010)  "Oral rivaroxaban for symptomatic venous thromboembolism"  New England Journal of Medicine  363 (26): 2499–2510  doi:10 1056/NEJMoa1007903  PMID 21128814  ^ McGee, W  (1 Feb 2007)  "Vitamin K"  MedlinePlus  Retrieved 2 Apr 2009  ^ Shearer, M  J ; Newman, P  (Oct 2008)  "Metabolism and cell biology of vitamin K"  Thrombosis and Haemostasis  100 (4): 530–547  doi:10 1160/TH08-03-0147  PMID 18841274  ^ Davidson, R  T ; Foley, A  L ; Engelke, J  A ; Suttie, J  W  (Feb 1998)  "Conversion of dietary phylloquinone to tissue menaquinone-4 in rats is not dependent on gut bacteria"  Journal of Nutrition  128 (2): 220–223  PMID 9446847  ^ Ronden, J  E ; Drittij-Reijnders, M  J ; Vermeer, C ; Thijssen, H  H  (Jan 1998)  "Intestinal flora is not an intermediate in the phylloquinone–menaquinone-4 conversion in the rat"  Biochimica et Biophysica Acta  1379 (1): 69–75  doi:10 1016/S0304-4165(97)00089-5  PMID 9468334  ^ Thijssen, H   H ; Drittij-Reijnders, M  J  (Sep 1994)  "Vitamin K distribution in rat tissues: dietary phylloquinone is a source of tissue menaquinone-4"  The British Journal of Nutrition  72 (3): 415–425  doi:10 1079/BJN19940043  PMID 7947656  ^ Will, B  H ; Usui, Y ; Suttie, J  W  (Dec 1992)  "Comparative metabolism and requirement of vitamin K in chicks and rats"  Journal of Nutrition  122 (12): 2354–2360  PMID 1453219  ^ Davidson, R  T ; Foley, A  L ; Engelke, J  A ; Suttie, J  W  (Feb 1998)  "Conversion of dietary phylloquinone to tissue menaquinone-4 in rats is not dependent on gut bacteria"  Journal of Nutrition  128 (2): 220–223  PMID 9446847  ^ Ronden, J  E ; Drittij-Reijnders, M  J ; Vermeer, C ; Thijssen, H  H  (Jan 1998)  "Intestinal flora is not an intermediate in the phylloquinone-menaquinone-4 conversion in the rat"  Biochimica et Biophysica Acta  1379 (1): 69–75  doi:10 1016/S0304-4165(97)00089-5  PMID 9468334  ^ Al Rajabi, Ala (2011)  The Enzymatic Conversion of Phylloquinone to Menaquinone-4 (PhD thesis)  Tufts University, Friedman School of Nutrition Science and Policy  ^ Furie, B ; Bouchard, B  A ; Furie, B  C  (Mar 1999)  "Vitamin K-dependent biosynthesis of gamma-carboxyglutamic acid"  Blood  93 (6): 1798–1808  PMID 10068650  ^ Mann, K  G  (Aug 1999)  "Biochemistry and physiology of blood coagulation"  Thrombosis and Haemostasis  82 (2): 165–174  PMID 10605701  ^ Price, P  A  (1988)  "Role of vitamin-K-dependent proteins in bone metabolism"  Annual Review of Nutrition  8: 565–583  doi:10 1146/annurev nu 08 070188 003025  PMID 3060178  ^ Coutu, D  L ; Wu, J  H ; Monette, A ; Rivard, G  E ; Blostein, M  D ; Galipeau, J (Jun 2008)  "Periostin, a member of a novel family of vitamin K-dependent proteins, is expressed by mesenchymal stromal cells"  Journal of Biological Chemistry  283 (26): 17991–18001  doi:10 1074/jbc M708029200  PMID 18450759  ^ Viegas, C  S ; Simes, D  C ; Laizé, V ; Williamson, M  K ; Price, P  A ; Cancela, M  L  (Dec 2008)  "Gla-rich protein (GRP), a new vitamin K-dependent protein identified from sturgeon cartilage and highly conserved in vertebrates"  Journal of Biological Chemistry  283 (52): 36655–36664  doi:10 1074/jbc M802761200  PMC 2605998  PMID 18836183  ^ Viegas, C  S ; Cavaco, S ; Neves, P  L ; Ferreira, A ; João, A ; Williamson, M  K ; Price, P  A ; Cancela, M  L ; Simes, D  C  (Dec 2009)  "Gla-rich protein is a novel vitamin K-dependent protein present in serum that accumulates at sites of pathological calcifications"  American Journal of Pathology  175 (6): 2288–2298  doi:10 2353/ajpath 2009 090474  PMC 2789615  PMID 19893032  ^ Hafizi, S ; Dahlbäck, B  (Dec 2006)  "Gas6 and protein S  Vitamin K-dependent ligands for the Axl receptor tyrosine kinase subfamily"  The FEBS Journal  273 (23): 5231–5244  doi:10 1111/j 1742-4658 2006 05529 x  PMID 17064312  ^ Kulman, J  D ; Harris, J  E ; Xie, L ; Davie, E  W  (May 2007)  "Proline-rich Gla protein 2 is a cell-surface vitamin K-dependent protein that binds to the transcriptional coactivator Yes-associated protein"  Proceedings of the National Academy of Sciences of the United States of America  104 (21): 8767–8772  doi:10 1073/pnas 0703195104  PMC 1885577  PMID 17502622  ^ "Vitamin K"  MedlinePlus  US National Library of Medicine, National Institutes of Health  Sep 2016  Retrieved 26 May 2009  ^ Conly, J; Stein, K  (Dec 1994)  "Reduction of vitamin K2 concentrations in human liver associated with the use of broad spectrum antimicrobials"  Clinical and Investigative Medicine  17 (6): 531–539  PMID 7895417  ^ Ferland, G ; Sadowski, J  A ; O'Brien, M  E  (Apr 1993)  "Dietary induced subclinical vitamin K deficiency in normal human subjects"  Journal of Clinical Investigation  91 (4): 1761–1768  doi:10 1172/JCI116386  PMC 288156  PMID 8473516  ^ Holden, R  M ; Morton, A  R ; Garland, J  S ; Pavlov, A ; Day, A  G ; Booth, S  L  (Apr 2010)  "Vitamins K and D status in stages 3-5 chronic kidney disease"  Clinical Journal of the American Society of Nephrology  5 (4): 590–597  doi:10 2215/CJN 06420909  PMC 2849681  PMID 20167683  ^ Hodges, S  J ; Pilkington, M  J ; Shearer, M  J ; Bitensky, L ; Chayen, J (Jan 1990)  "Age-related changes in the circulating levels of congeners of vitamin K2, menaquinone-7 and menaquinone-8"  Clinical Science  78 (1): 63–66  PMID 2153497  ^ "Vitamin K"  Dietary Reference Intakes for Vitamin A, Vitamin K, Arsenic, Boron, Chromium, Copper, Iodine, Iron, Manganese, Molybdenum, Nickel, Silicon, Vanadium, and Zinc (PDF)  National Academy Press  2001  p  162–196  ^ Tolerable Upper Intake Levels For Vitamins And Minerals (PDF), European Food Safety Authority, 2006 ^ a b Rhéaume-Bleue, p  42
^ "Important information to know when you are taking: Warfarin (Coumadin) and Vitamin K" (PDF)  National Institutes of Health Clinical Center  ^ "Nutrition Facts and Information for Parsley, raw"  Nutritiondata com  Retrieved 21 Apr 2013  ^ "Nutrition facts, calories in food, labels, nutritional information and analysis"  Nutritiondata com  13 Feb 2008  Retrieved 21 Apr 2013  ^ "Vitamin K"  Vivo colostate edu  2 Jul 1999  Retrieved 21 Apr 2013  ^ "Vitamin K"  Micronutrient Data Centre  ^ Ikeda, Y ; Iki, M ; Morita, A ; Kajita, E ; Kagamimori, S ; Kagawa, Y ; Yoneshima, H  (May 2006)  "Intake of fermented soybeans, natto, is associated with reduced bone loss in postmenopausal women: Japanese Population-Based Osteoporosis (JPOS) Study"  Journal of Nutrition  136 (5): 1323–1328  PMID 16614424  ^ Katsuyama, H ; Ideguchi, S ; Fukunaga, M ; Saijoh, K ; Sunami, S  (Jun 2002)  "Usual dietary intake of fermented soybeans (Natto) is associated with bone mineral density in premenopausal women"  Journal of Nutritional Science and Vitaminology  48 (3): 207–215  doi:10 3177/jnsv 48 207  PMID 12350079  ^ Sano, M ; Fujita, H ; Morita, I ; Uematsu, H ; Murota, S  (Dec 1999)  "Vitamin K2 (menatetrenone) induces iNOS in bovine vascular smooth muscle cells: no relationship between nitric oxide production and gamma-carboxylation"  Journal of Nutritional Science and Vitaminology  45 (6): 711–723  doi:10 3177/jnsv 45 711  PMID 10737225  ^ Gast, G  C ; de Roos, N  M ; Sluijs, I ; Bots, M  L ; Beulens, J  W ; Geleijnse, J  M ; Witteman, J  C ; Grobbee, D  E ; Peeters, P  H ; van der Schouw, Y  T  (Sep 2009)  "A high menaquinone intake reduces the incidence of coronary heart disease"  Nutrition, Metabolism, and Cardiovascular Diseases  19 (7): 504–510  doi:10 1016/j numecd 2008 10 004  PMID 19179058  ^ Oldenburg, J ; Bevans, C  G ; Müller, C  R ; Watzka, M  (2006)  "Vitamin K epoxide reductase complex subunit 1 (VKORC1): the key protein of the vitamin K cycle"  Antioxidants & Redox Signaling  8 (3–4): 347–353  doi:10 1089/ars 2006 8 347  PMID 16677080  ^ Suttie, J  W  (1985)  "Vitamin K-dependent carboxylase"  Annual Review of Biochemistry  54: 459–477  doi:10 1146/annurev bi 54 070185 002331  PMID 3896125  ^ Presnell, S  R ; Stafford, D  W  (Jun 2002)  "The vitamin K-dependent carboxylase"  Thrombosis and Haemostasis  87 (6): 937–946  PMID 12083499  ^ Stafford, D  W  (Aug 2005)  "The vitamin K cycle"  Journal of Thrombosis and Haemostasis  3 (8): 1873–1878  doi:10 1111/j 1538-7836 2005 01419 x  PMID 16102054  ^ Rhéaume-Bleue, p  79 
^ Whitlon, D  S ; Sadowski, J  A ; Suttie, J  W  (Apr 1978)  "Mechanism of coumarin action: significance of vitamin K epoxide reductase inhibition"  Biochemistry  17 (8): 1371–1377  doi:10 1021/bi00601a003  PMID 646989  ^ Terlau, H ; Olivera, B  M  (Jan 2004)  "Conus venoms: a rich source of novel ion channel-targeted peptides"  Physiological Reviews  84 (1): 41–68  doi:10 1152/physrev 00020 2003  PMID 14715910  ^ Buczek, O ; Bulaj, G ; Olivera, BM (Dec 2005)  "Conotoxins and the posttranslational modification of secreted gene products"  Cellular and Molecular Life Sciences  62 (24): 3067–3079  doi:10 1007/s00018-005-5283-0  PMID 16314929  ^ "Prothrombin Time"  WebMD  ^ Dituri, F ; Buonocore, G ; Pietravalle, A ; Naddeo, F ; Cortesi, M; Pasqualetti, P; Tataranno M  L ; R , Agostino (Sep 2012)  "PIVKA-II plasma levels as markers of subclinical vitamin K deficiency in term infants"  Journal of Maternal, Fetal & Neonatal Medicine  25 (9): 1660–1663  doi:10 3109/14767058 2012 657273  PMID 22280352  ^ Thane, C  W ; Bates, C  J ; Shearer, M  J ; Unadkat, N; Harrington, D  J ; Paul, A  A ; Prentice, A ; Bolton-Smith, C  (Jun 2002)  "Plasma phylloquinone (vitamin K1) concentration and its relationship to intake in a national sample of British elderly people"  British Journal of Nutrition  87 (6): 615–622  doi:10 1079/BJNBJN2002582  PMID 12067432  ^ McKeown, N  M ; Jacques, P  F ; Gundberg, C  M ; Peterson, J  W ; Tucker, K  L ; Kiel, D  P ; Wilson, P  W ; Booth, SL (Jun 2002)  "Dietary and nondietary determinants of vitamin K biochemical measures in men and women" (PDF)  Journal of Nutrition  132 (6): 1329–1334  PMID 12042454  ^ Yamano, M ; Yamanaka, Y ; Yasunaga, K ; Uchida, K  (Sep 1989)  "Effect of vitamin K deficiency on urinary gamma-carboxyglutamic acid excretion in rats"  Nihon Ketsueki Gakkai Zasshi  52 (6): 1078–1086  PMID 2588957  ^ Matsumoto, T ; Miyakawa, T ; Yamamoto, D  (Mar 2012)  "Effects of vitamin K on the morphometric and material properties of bone in the tibiae of growing rats"  Metabolism  61 (3): 407–414  doi:10 1016/j metabol 2011 07 018  PMID 21944271  ^ Je, S -H ; Joo, N -S ; Choi, B -H ; Kim, K -M ; Kim, B -T ; Park, S -B ; Cho, D -Y ; Kim, K -N ; Lee, D -J  (Aug 2011)  "Vitamin K supplement along with vitamin D and calcium reduced serum concentration of undercarboxylated osteocalcin while increasing bone mineral density in Korean postmenopausal women over sixty-years-old"  Journal of Korean Medical Science  26 (8): 1093–1098  doi:10 3346/jkms 2011 26 8 1093  PMC 3154347  PMID 21860562  ^ Bentley, R ; Meganathan, R  (Sep 1982)  "Biosynthesis of vitamin K (menaquinone) in bacteria" (PDF)  Microbiological Reviews  46 (3): 241–280  PMC 281544  PMID 6127606  ^ Haddock, B  A ; Jones, C  W  (Mar 1977)  "Bacterial respiration" (PDF)  Bacteriological Reviews  41 (1): 47–99  PMC 413996  PMID 140652  ^ Shearer, M  J  (Jan 1995)  "Vitamin K"  Lancet  345 (8944): 229–234  doi:10 1016/S0140-6736(95)90227-9  PMID 7823718  ^ Greer, J  P ; Foerster, J ; Lukens, J  N ; Rodgers, G  M ; Paraskevas, F ; Glader, B  (eds )  Wintrobe's Clinical Hematology (11th ed )  Philadelphia, Pennsylvania: Lippincott, Williams and Wilkens  ^ a b American Academy of Pediatrics Committee on Fetus Newborn  (Jul 2003)  "Controversies concerning vitamin K and the newborn  American Academy of Pediatrics Committee on Fetus and Newborn" (PDF)  Pediatrics  112 (1 1): 191–192  doi:10 1542/peds 112 1 191  PMID 12837888  ^ Logan, S ; Gilbert, R  (1998)  "Vitamin K For Newborn Babies" (PDF)  Department of Health  Retrieved 12 Oct 2014  ^ "Postnatal care: Routine postnatal care of women and their babies [CG37]"  www nice org uk  NICE  Jul 2006  Retrieved 12 Oct 2014  ^ Parker, L ; Cole, M ; Craft, A  W ; Hey, E  N  (1998)  "Neonatal vitamin K administration and childhood cancer in the north of England: retrospective case-control study"  BMJ (Clinical Research Edition)  316 (7126): 189–193  doi:10 1136/bmj 316 7126 189  PMC 2665412  PMID 9468683  ^ McMillan, D  D  (1997)  "Routine administration of vitamin K to newborns"  Paediatric Child Health  2 (6): 429–431  ^ "Newborns get rare disorder after parents refused shots"  Having four cases since February just at Vanderbilt was a little bit concerning to me ^ Dam, C  P  H  (1935)  "The Antihaemorrhagic Vitamin of the Chick: Occurrence And Chemical Nature"  Nature  135 (3417): 652–653  doi:10 1038/135652b0  ^ Dam, C  P  H  (1941)  "The discovery of vitamin K, its biological functions and therapeutical application" (PDF)  Nobel Prize Laureate Lecture  ^ McAlister, V  C  (2006)  "Control of coagulation: a gift of Canadian agriculture" (PDF)  Clinical and Investigative Medicine  29 (6): 373–377  ^ MacCorquodale, D  W ; Binkley, S  B ; Thayer, S  A ; Doisy, E  A  (1939)  "On the constitution of Vitamin K1"  Journal of the American Chemical Society  61 (7): 1928–1929  doi:10 1021/ja01876a510  ^ Fieser, L  F  (1939)  "Synthesis of Vitamin K1"  Journal of the American Chemical Society  61 (12): 3467–3475  doi:10 1021/ja01267a072  ^ Dam, C  P  H  (12 Dec 1946)  "The discovery of vitamin K, its biological functions and therapeutical application" (PDF)  Nobel Prize lecture  ^ Warner, E  D ; Brinkhous, K  M ; Smith, H  P  (1938)  "Bleeding Tendency of Obstructive Jaundice"  Proceedings of the Society of Experimental Biology and Medicine  37 (4): 628–630  doi:10 3181/00379727-37-9668P  ^ Stenflo, J; Fernlund, P ; Egan, W ; Roepstorff, P  (Jul 1974)  "Vitamin K dependent modifications of glutamic acid residues in prothrombin"  Proceedings of the National Academy of Sciences of the United States of America  71 (7): 2730–2733  doi:10 1073/pnas 71 7 2730  PMC 388542  PMID 4528109  ^ Nelsestuen, G  L ; Zytkovicz, T  H ; Howard, J  B  (Oct 1974)  "The mode of action of vitamin K  Identification of gamma-carboxyglutamic acid as a component of prothrombin" (PDF)  Journal of Biological Chemistry  249 (19): 6347–6350  PMID 4214105  ^ Magnusson, S ; Sottrup-Jensen, L ; Petersen, T  E ; Morris, H  R ; Dell, A  (Aug 1974)  "Primary structure of the vitamin K-dependent part of prothrombin"  FEBS Letters  44 (2): 189–193  doi:10 1016/0014-5793(74)80723-4  PMID 4472513  Bibliography[edit]
Rhéaume-Bleue, Kate (2012)  Vitamin K2 and the Calcium Paradox  John Wiley & Sons, Canada  ISBN 1-118-06572-7  External links[edit]
"Vitamin K: Another Reason to Eat Your Greens"  v
TPP / ThDP (B1)
FMN, FAD (B2)
NAD+, NADH, NADP+, NADPH (B3)
Coenzyme A (B5)
PLP / P5P (B6)
THFA / H4FA, DHFA / H2FA, MTHF (B9)
AdoCbl, MeCbl (B12)
Phylloquinone (K1), Menaquinone (K2)
non-vitamins
Coenzyme B
Heme / Haem (A, B, C, O)
Molybdopterin/Molybdenum cofactor
THMPT / H4MPT
Fe2+, Fe3+
vitamins: see vitamins
Antihemorrhagics (B02)
(coagulation)
Phytomenadione (K1)
Menadione (K3)
intrinsic: IX/Nonacog alfa
VIII/Moroctocog alfa/Turoctocog alfa
extrinsic: VII/Eptacog alfa
common: X
II/Thrombin
I/Fibrinogen
XIII/Catridecacog
combinations: Prothrombin complex concentrate (II, VII, IX, X, protein C and S)
Carbazochrome
thrombopoietin receptor agonist (Romiplostim
Eltrombopag)
Tetragalacturonic acid hydroxymethylester
Epinephrine/Adrenalone
amino acids (Aminocaproic acid
Aminomethylbenzoic acid)
serpins (Aprotinin
Alfa1 antitrypsin
Camostat) 
Context 2: Time to clean house in Paso Robles Home
Front Page » Time to clean house in Paso Robles
September 5, 2010 Opinion By JIM REED
I’d like to give you an update on the issue of our civil servants cramming hundreds of millions of dollars in spending down our throats after the people of Paso Robles voted down the water rate increase last November  The rate increase is being hung up in the courts by the City Attorney  What was supposed to be a quick issue to get in front of a judge, has been drug out as long as possible by the City Attorney 
Even if the courts throw out the current rate increase, I expect that our civil servants will just change a couple of words in the rate increase notice and force the same old plan on us again 
There is a real problem with the people we have hired to work for us in Paso Robles  It seems that decisions are made based on some agenda, even if it is contrary to citizens’ wishes 
City Councilmen Ed Steinbeck, Nick Gilman and Mayor Duane Picanco, on August 19th, voted unanimously to hire the same law firm employed by the City of Bell  You may have heard the recent news story about the City of Bell’s corrupt city representatives 
This law firm allowed the elected officials and City employees to pillage the General Fund for their own benefit, contrary to the rights and interests of the citizens  We are already paying several City employees $12,000 per month with equally ridiculous benefits and pensions  What does this say about our elected representatives?
I believe most residents are like me  We elect people we believe have our best interest in mind  Over the last few years I have seen that nothing is farther from the truth  The people we have elected have lost track of the fact that “the City” exists to protect and deliver services to the citizens  To them it is some all-important ideal they strive to cultivate and improve according to their agenda  They have forgotten that they are elected to represent the citizens 
We have an election coming up in November  We have the opportunity to elect some responsible, principled people to represent us  If we elect more people from within this system, we will get more of the same type of government  We need to look at where the new candidates stand  Will they lawfully represent the citizens of the city? Or, are they happy with the way things are being run?
We have stood together in the past and have made real significant changes in important matters that are going to affect our lives for years to come  There are several thousand citizens that made their voice heard on the water issue, more than enough votes to make a change in our city government 
Please come out and vote for a democratic representative governing body for Paso Robles instead of the tyrannical leadership that exists now 
Jim Reed is a longtime resident of Paso Robles 
Subjects: Opinion Paso Robles Paso Robles City Council Vote	Related:
<- Previous Next ->	Endless Summer Nights at Edna Valley, event photos Trial postponed for Paso Robles woman accused of forgery The comments below represent the opinion of the writer and do not represent the views or policies of CalCoastNews com  (moderator@calcoastnews com Comment Guidelines )
2 whatisup says:	09/13/2010 at 9:27 pm
pasoobserver – Here is something to observe and get you going in the right direction:
California Government Code Section 65584
(a) (1) For the fourth and subsequent revisions of the
housing element pursuant to Section 65588, the department shall
determine the existing and projected need for housing for each region
pursuant to this article  For purposes of subdivision (a) of Section
65583, the share of a city or county of the regional housing need
shall include that share of the housing need of persons at all income
levels within the area significantly affected by the general plan of
(2) While it is the intent of the Legislature that cities,
counties, and cities and counties should undertake all necessary
actions to encourage, promote, and facilitate the development of
housing to accommodate the entire regional housing need, it is
recognized, however, that future housing production may not equal the
regional housing need established for planning purposes 
(b) The department, in consultation with each council of
governments, shall determine each region’s existing and projected
housing need pursuant to Section 65584 01 at least two years prior to
the scheduled revision required pursuant to Section 65588  The
appropriate council of governments, or for cities and counties
without a council of governments, the department, shall adopt a final
regional housing need plan that allocates a share of the regional
housing need to each city, county, or city and county at least one
year prior to the scheduled revision for the region required by
Section 65588  The allocation plan prepared by a council of
governments shall be prepared pursuant to Sections 65584 04 and
65584 05 with the advice of the department 
(c) Notwithstanding any other provision of law, the due dates for
the determinations of the department or for the council of
governments, respectively, regarding the regional housing need may be
extended by the department by not more than 60 days if the extension
will enable access to more recent critical population or housing
data from a pending or recent release of the United States Census
Bureau or the Department of Finance  If the due date for the
determination of the department or the council of governments is
extended for this reason, the department shall extend the
corresponding housing element revision deadline pursuant to Section
65588 by not more than 60 days 
(d) The regional housing needs allocation plan shall be consistent
with all of the following objectives:
(1) Increasing the housing supply and the mix of housing types,
tenure, and affordability in all cities and counties within the
region in an equitable manner, which shall result in each
jurisdiction receiving an allocation of units for low- and very low
(2) Promoting infill development and socioeconomic equity, the
protection of environmental and agricultural resources, and the
encouragement of efficient development patterns 
(3) Promoting an improved intraregional relationship between jobs
(4) Allocating a lower proportion of housing need to an income
category when a jurisdiction already has a disproportionately high
share of households in that income category, as compared to the
countywide distribution of households in that category from the most
recent decennial United States census 
(e) For purposes of this section, “household income levels” are as
determined by the department as of the most recent decennial census
pursuant to the following code sections:
(1) Very low incomes as defined by Section 50105 of the Health and
(2) Lower incomes, as defined by Section 50079 5 of the Health and
(3) Moderate incomes, as defined by Section 50093 of the Health
and Safety Code 
(4) Above moderate incomes are those exceeding the moderate-income
level of Section 50093 of the Health and Safety Code 
(f) Notwithstanding any other provision of law, determinations
made by the department, a council of governments, or a city or county
pursuant to this section or Section 65584 01, 65584 02, 65584 03,
65584 04, 65584 05, 65584 06, 65584 07, or 65584 08 are exempt from
the California Environmental Quality Act (Division 13 (commencing
with Section 21000) of the Public Resources Code) 
pasoobserver says:	09/13/2010 at 6:52 pm
To whatisup —- First of all, I reviewed AB 602 Assembly Bill  Thanks  I am sorry to inform you but AB 602 is not the LAW as you so stated in your blog  I contacted the Deputy Chief Council’s office in Sacramento handling AB 602 to confirm your misstatement of facts  You know,in the English language, It shouldn’t be so difficult to answer some simple questions with a “YES” or “NO” answer  Yet, you are reluctant to do so, but you go on and on with a thesis along with some rhetoric  I never talked about a court suit over the “water issue”, I asked YOU, not about waiting for a court decision  Maybe, you did with some other people  Also, I was not ranting about the wineries usage of water  My response to you on your vague question about “there are people not paying their fair share for their use of water”  I related, are you talking about the wineries? I am well aware that most of the wineries are outside the city limits using the same aquifer  You took my question out of context , nice try! You are just being a popinjay and rhetorical  Also, you didn’t answer another question about “what is the unit cost of water” in Templeton? as compared to Paso Robles 
whatisup says:	09/13/2010 at 8:54 pm
I am on a well  I am sure you are capable of doing your own homework  I also am quite sure if you really contacted the Deputy Chief Counsel’s Office you have been set straight  What I gave you is a proposed small adjustment in the wide range of laws that make up the California Housing element  I assumed you could stumble onto the facts based on what I gave you  By the way, I believe you can review the Paso Robles Housing element plan on the City’s website or at the Library  The California Housing Element Laws that all cities and counties have to follow have been in place for almost 25 years  I realize you don’t actually have a clue how to look the laws up  Either educate yourself or keep making a fool of yourself, your choice  A simple Google search of California Housing Element Laws will get you going  Good Luck!
TO WHATISUP — I WOULD LIKE TO KNOW WHAT LAW YOU ARE REFERRING TO THAT SAYS “WE” THE PEOPLE HAVE TO SUBSIDIZE NEW DEVELOPMENT? AGAIN, FOR THE THIRD TIME, YOU FAILED TO ANSWER MY QUESTIONS POSED TO YOU IN MY PRIOR RESPONSES TO YOU ON SEPT 10TH &11TH  IS THERE A REASON WHY YOU DON’T WANT TO ANSWER THEM? YOU DO WHAT OUR ELECTED OFFICIALS DO SO WELL, AND THAT IS “IN ONE EAR AND OUT OF THE OTHER EAR” IT SEEMS TO ME THAT YOU ARE EITHER EMPLOYED BY THE CITY OR YOU HAVE OTHER DEALING WITH THE CITY, SO BE IT  IT APPEARS TO ME THAT YOU THINK THE CITY DOES EVERYTHING RIGHT  APPARENTLY, YOU PRESENT YOURSELF AS BEING VERY BIAS ON CITY DECISIONS  IT LIKE THEY CAN’T DO ANYTHING WRONG ACCORDING TO YOUR LOGIC  THEY KNOW WHAT IS BEST FOR THE CITIZENS OF PASO,THAT IS A GOOD EXAMPLE OF ARROGANCE ALONG WITH NARCISSISM 
WHAT PEOPLE ARE YOU TALKING ABOUT THAT DOESN’T PAY THEIR FAIR SHARE OF WATER? ARE YOU REFERRING TO THE WINERIES USING THE SAME AQUIFER?
I BELIEVE YOU RELATED THAT YOU RESIDE IN TEMPLETON, BUT YOU OWN PROPERTY IN PASO  BY THE WAY, WHAT IS THE COST PER UNIT OF WATER USAGE IN TEMPLETON COMPARED TO PASO? OF COURSE, TEMPLETON IS IN AN UNINCORPORATED AREA (COUNTY JURISDICTION) 
WELL, I GAVE YOU SOME SUGGESTIONS ON HOW TO PAY FOR THE NACIMIENTO WATER PIPELINE AND SEWER TREATMENT PLANT  ALSO, REMEMBER IT’S THE CITIZENS’ MONEY THAT IS BEING SPENT  WHAT IS MOST IMPORTANT OF ALL, IS LET THE CITIZENS OF PASO DECIDE WITH THEIR VOTE ON HOW TO FINANCE THIS HUGE CAPITAL IMPROVEMENT PROJECT EXPENDITURE  JUST BE IN COMPLIANCE WITH STATE PROPOSITION 218 AND STOP CIRCUMVENTING THE LAW 
WOULD YOU OBJECT TO HAVING TO FINANCE SOME NEW BONDS ON YOUR PROPERTY TAX BILL AS A ” SPECIAL TAX” OR AN ASSESSMENT TAX” TO PAY FOR THE NACIMIENTO WATER PIPELINE AND SEWER TREATMENT PLANT? A PERCENTAGE OF PASO CITIZENS FINANCE LOCAL SCHOOL BONDS ON THEIR PROPERTY TAX BILL AND DON’T HAVE ANY KIDS GOING TO SCHOOL  HOW ABOUT THAT COMPARISON FOR YOU TO THINK ABOUT? WHAT SAY YOU?
I say less CapsLock, please 
whatisup says:	09/12/2010 at 11:41 pm
I have answered your questions  I have been quite detailed in my answers and I am sorry if you can’t deal with the detail  I guess it is your inconvenient truth  You do seem to like to deflect and go around in circles  Another example, now you are ranting about the wineries using the same aquaifier as the City  Let me be clear for you, I don’t like the amount of water the wineries are using  However, the wineries are in the County, not in the City and the City can’t do anything about it  They wineries are allowed to take the water they are taking even if it drops the City’s water levels in their wells  You need to complain to Sacramento  It sounds like you just don’t want to pay anything for the infrastructure because you really just don’t want it built 
Several of your observations of my opinions are bizarre considering I have stated several times I believe the Courts need to decide if Paso Robles has, or has not followed the rules as to funding the infrastucture  Obviously, as I have stated before, if the City loses the lawsuit the infrastructure will have to be paid out of the City’s General Fund until a new method of payment is voted on by the Citizens of Paso Robles  Pretty clear 
Your idea of charging based on a special assesment rather than the amount of water a property uses means that people who use little water, but live on a more expensive property will pay more than their share, based on their water usage  In addition, how do you deal with a rental unit where the renter is supposed to pay the water bill? Your idea is inherantly unfair, but my guess is it will favor you, so you don’t care if it is unfair and other people would pay part of your share  You also have decided that since I have alternative ideas to yours I must work for, or have business with the City of Paso Robles, another attempt to deflect from the issue  However, once again, I have never worked for the City or have ever done business with the City and don’t expect to ever do business with the City  I do own property in the City which is why I pay attention  Finally, it turns out there needs to be a fix to the housing element laws, the existance of which you are questioning  As I understand it the fix to the housing elemnt laws is because of some lawsuit  This should give you all the information you need to educate yourself on the California Housing Element laws that every city and county in California has to follow:
BILL ANALYSIS ————————————————————
|SENATE RULES COMMITTEE | AB 602|
|Office of Senate Floor Analyses | |
|1020 N Street, Suite 524 | |
|(916) 651-1520 Fax: (916) | |
|327-4478 | |
———————————————————— THIRD READING
Bill No: AB 602
Author: Feuer (D), et al
Amended: 8/20/10 in Senate
SENATE TRANSPORTATION & HOUSING COMM : 6-3, 6/29/10
AYES: Lowenthal, DeSaulnier, Kehoe, Pavley, Simitian, Wolk
NOES: Huff, Ashburn, Harman
ASSEMBLY FLOOR : Not relevant
SUBJECT : Statute of limitations on housing element
SOURCE : California Rural Legal Assistance Foundation
Housing California DIGEST : This bill states the intent of the Legislature
in enacting this bill to modify the courts opinion in Urban
Habitat Program v  City of Pleasanton (2008) 164
Cal App 4th 1561, with respect to the interpretation of
Section 65009 of the Government Code, and revises and
clarifies statute of limitations and remedies for specified
housing related challenges
Context 3: \section{Introduction\label{sct::intro}}
Symmetric, public-key (asymmetric) and hash-based cryptography constitute a fundamental pillar of modern cryptography  
Symmetric cryptography includes symmetric-key encryption, where a shared secret key is used for both encryption and decryption  Cryptographic hash functions map arbitrarily long strings to strings of a fixed finite length  Currently deployed public-key schemes are
used to establish a common secret key between two remote parties  They are based on factoring large numbers or solving the discrete logarithm problem over a finite group  For more details about modern cryptography the interested reader can consult one of the many excellent references on the topic, e g ~\cite{Katz:2007:IMC:1206501} 

In contrast to asymmetric schemes based on factoring or solving the discrete logarithm problem and which are completely broken by a quantum adversary via Shor's algorithm~\cite{SJC 26 1484}, symmetric schemes and hash functions are less vulnerable to quantum attacks  The best known quantum attacks against them are based on Grover's quantum search algorithm~\cite{PhysRevLett 79 325}, which offers a quadratic speedup compared to classical brute force searching  Given a search space of size $N$, Grover's algorithm finds, with high probability, an element $x$ for which a certain property such as $f(x)=1$ holds, for some function $f$ we know how to evaluate (assuming such a solution exists)  The algorithm evaluates $f$ a total of $\mathcal{O}(\sqrt{N})$ times  It applies a simple operation in between the evaluations of $f$, so the $\mathcal{O}(\sqrt{N})$ evaluations of $f$ account for most of the complexity  In contrast, any classical algorithm that evaluates $f$ in a similar ``black-box'' way requires on the order of $N$ evaluations of $f$ to find such an element 

Any quantum algorithm can be mapped to a quantum circuit, which can be implemented on a quantum computer  The quantum circuit represents what we call the ``logical layer"  Such a circuit can always be decomposed in a sequence of ``elementary 
gates", such as Clifford gates (CNOT, Hadamard etc ~\cite{NC00}) augmented by a non-Clifford gate such as the T gate 

Running a logical circuit on a full fault-tolerant quantum computer is highly non-trivial  The sequence of logical gates have to be mapped to 
sequences of surface code measurement cycles (see e g ~\cite{PhysRevA 86 032324} for extensive details)  By far, the most resource-consuming (in 
terms of number of qubits required and time) is the T gate\footnote{Clifford gates are ``cheap", i e  they require relatively small overhead for implementation in the surface code, but are not universals, hence a non-Clifford gate is required  One such gate is the T gate  There are other possible choices, however all of the non-Clifford gates require special techniques such as magic state distillation~\cite{1367-2630-14-12-123011,PhysRevA 86 052329} and significant overhead (order of magnitudes higher than Clifford gates) to be implemented in the surface code  In fact, to a first order approximation, for the purpose of resource estimation, one can simply ignore the overhead introduced by the Clifford gates and simply focus only on the T gates }  
In comparison with surface code defects and braiding techniques~\cite{PhysRevA 86 032324}, novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} reduce the spatial overhead required for implementing T gates via magic state distillation by approximately a factor of 5, while also modestly improving the running time  

In this paper we first analyze the security of symmetric schemes and hash functions against large-scale fault-tolerant quantum adversaries, using surface code defects and braiding techniques  We take into account the time-space trade-offs with parallelizing quantum search, down to the fault-tolerant layer  Naively, one might hope that $K$ quantum computers (or quantum ``processors'', as we will call them later in the paper) running in parallel reduce the number the circuit depth down to $\mathcal{O}(\sqrt{N})/K$ steps, similar to the classical case of distributing a search space across $K$ classical processors  However quantum searching does not parallelize so well, and the required number of steps
for parallel quantum searching is of the order $\mathcal{O}(\sqrt{N/K})$~\cite{quantph 9711070}  This is a factor of $\sqrt{K}$ larger than $\mathcal{O}(\sqrt{N})/K$   As shown in~\cite{quantph 9711070}, the optimal way of doing parallel quantum search is to partition the search space into $N/K$ parts, and to perform independent quantum searches on each part 

Secondly, we investigate the security of public-key cryptographic schemes such as RSA and ECC against 
quantum attacks, using the latest developments in theory of fault-tolerant quantum error correction, i e  novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} 

The remainder of this paper is organized as follows  In Sec ~\ref{sct::method}, we provide an overview of the methodology used in our analysis  In Sec ~\ref{sct::ciphers} we investigate the security of the AES family of modern symmetric ciphers  In Sec ~\ref{sct::hash} we analyze the security of the SHA family of hash functions  In Sec ~\ref{sct::bitcoin} we investigate the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work consensus mechanism  We conclude our investigation of symmetric and hash-based cryptographic schemes in Sec ~\ref{sct::intrinsic_parallel_grover}, where we evaluate the intrinsic cost of running the Grover algorithm with a trivial oracle (i e , an oracle with a unit cost of 1 for each invocation) 

In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  Finally we summarize our findings and conclude in Sec ~\ref{sct::conclusion} 
\section{Methodology\label{sct::method}}

\subsection{Symmetric cryptography and hash functions\label{sct::symmetric}}
The methodology, sketched in Fig ~\ref{fgr:flowchart_lite} and Fig ~\ref{fgr:full_algorithm}, follows the same lines as the one described in great detail in our earlier paper~\cite{10 1007/978-3-319-69453-5_18}, which we refer the interested reader to for more details 
\begin{figure}[htb]
	\centering
         \includegraphics[width=0 35\textwidth]{figures/flowchart_lite pdf}
         \caption{Analyzing an attack against a symmetric cryptographic function with a fault-tolerant quantum adversary  Our resource estimation methodology takes into account several of the layers between the high level description of an algorithm and the physical hardware required for its execution  Our approach is modular should assumptions about any of these layers change, and hence it allows one to calculate the impact of improvements in any particular layer }
         \label{fgr:flowchart_lite}
\end{figure}
\begin{figure}
	\centering
	 \includegraphics[width=0 46\textwidth]{figures/grover_vertical pdf}
          \caption{Grover searching with an oracle for $f : \{0,1\}^k \rightarrow \{0,1\}^k$  The algorithm makes $\lfloor \frac{\pi}{4} 2^{N/2}\rfloor$ calls to
$G$, the \emph{Grover iteration}, or, if parallelized on $K$ processors, $\lfloor \frac{\pi}{4} 2^{N/(2K)}\rfloor$ calls to $G$  The Grover iteration has two
subroutines  The first, $U_g$, implements the predicate $g : \{0,1\}^k
\rightarrow \{0,1\}$ that maps $x$ to $1$ if and only if $f(x) = y$  Each call to $U_g$ involves two calls to a reversible implementation of $f$ and one call to a comparison circuit that checks whether $f(x) = y$ }
          \label{fgr:full_algorithm}
\end{figure}

We assume a surface-code based fault-tolerant architecture~\cite{PhysRevA 86 032324}, using Reed-Muller distillation schemes~\cite{Fowler:2013aa}  For each scheme we vary the possible physical error rates per gate from $10^{-4}$ to $10^{-7}$  We believe that this range of physical error rates is wide enough to cover both first generation quantum computers as well as more advanced future machines 
In comparison to surface code defects and braiding methods~\cite{PhysRevA 86 032324}, lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} mostly impact the physical footprint of the fault-tolerant layer required to run a specific quantum algorithm, reducing the distillation overhead by approximately a factor of 5  The temporal overhead (i e  the number of surface code cycles) is reduced less drastically  For this reason, lattice surgery has less significant effects in estimating the security of symmetric schemes or hash functions, reducing the security parameter\footnote{The security parameter is defined as the logarithm base two of the number of fundamental operations (in our case surface code cycles) required to break the scheme } by at most 1 and decreasing the spatial overhead by at most a factor of 5  Therefore when estimating the security of symmetric and hash-based cryptographic schemes we use surface code defects and braiding techniques 

For each cryptographic primitive, we display four plots, in the following order:
\begin{enumerate}
\item We plot the total number of surface code cycles per CPU (where a CPU is a quantum computer capable of executing a single instance of Grover's quantum search algorithm) as a function of the number of CPUs  We directly tie the quantum security parameter to the total number of surface code cycles (see~\cite{10 1007/978-3-319-69453-5_18} for more details)  We also add to the plot the theoretical lower bound achievable by quantum search in the cases of: a) considering the oracle a black box of unit cost (lower line), and b) considering the oracle as composed of ideal quantum gates, each of unit cost (upper line)  Note that the difference between b) and a) represents the intrinsic cost of logical overhead (i e  the overhead introduced by treating the oracle as a logical circuit and not a blackbox), whereas the difference between the upper lines and b) represents the intrinsic cost introduced by the fault-tolerant layer 

\item We plot the total wall-time per CPU (i e  how long will the whole computation take on a parallel quantum architecture) as a function of the number of CPUs  The horizontal dashed line represents the one-year time line, i e  the $x$ coordinate of the intersection point between the ``Total time per CPU'' line and the one-year time line provides the number of processors required to break the system within one year (in $\log_2$ units) 

\item We plot the total physical footprint (number of qubits) per CPU, as a function of the number of CPUs 
\item Finally we plot the total physical footprint (number of qubits) of all quantum search machines (CPUs) running in parallel 
\end{enumerate}

In the following sections we proceed to analyze symmetric ciphers (AES, Sec ~\ref{sct::ciphers}), hash functions (SHA-256, SHA3-256, Sec ~\ref{sct::hash}, Bitcoin's hash function, Sec ~\ref{sct::bitcoin}), and finally the minimal resources required for running Grover's algorithm with a trivial oracle~\ref{sct::intrinsic_parallel_grover} (e g  the identity gate) on search spaces of various sizes 

Note that in some ranges of the plots from sections~\ref{sct::ciphers},~\ref{sct::hash},~\ref{sct::intrinsic_parallel_grover} and~\ref{sct::bitcoin} the total physical footprint increases slightly with the number of processors, which may seem counter-intuitive  This happens due to the fact that with more processors the required code distances decrease, and in some instances one can pipeline more magic states factories in parallel into the surface code, which in effect causes an increase in the overall physical footprint  Note that the total time per CPU is monotonically decreasing, as parallelizing distilleries does not increase the wall time  For more details see~\cite{10 1007/978-3-319-69453-5_18}  

\subsection{Public-key cryptography\label{sct::pk}}

Most of the recent progress in quantum cryptanalysis is related to the fault-tolerant layer in Fig ~\ref{fgr:flowchart_lite}  New methods and techniques
based on surface code lattice surgery~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} allow a significant decrease of the overall 
footprint (number of qubits, or space) taken by the quantum computation, and also a relatively modest decrease in time, in comparison with  methods based on surface code defects and braiding~\cite{PhysRevA 86 032324,Fowler:2013aa} 

We consider the best up-to-date optimized logical quantum circuits for attacking RSA and ECC public-key 
schemes~\cite{1706 06752,PhysRevA 52 3457,cuccaro04,Beauregard:2003:CSA:2011517 2011525} then perform a physical footprint resource estimation
analysis using lattice surgery techniques  We remark that the overall time required to run the algorithm depends on the level of parallelization 
for the magic state factories\footnote{Every T gate in the circuit must be implemented by a specialized magic state factory, each of which occupies a 
significant physical footprint  One can implement more magic states in parallel if one is willing to increase the physical footprint of the computation }  

For each public-key cryptogrpric scheme, we analyze the space/time tradeoffs and plot the results on a double logarithmic scale  We fit the data using a third degree 
polynomial\footnote{A third degree polynomial fits the data very precisely, providing a coefficient of determination $R^2$ greater than 0 997 } and obtain an analytical closed-form formula for the relation between the time and the number of qubits required to attack the scheme, in 
the form

\begin{equation}\label{eqn1}
y(x) = \alpha x^3 + \beta x^2 + \gamma x + \delta,
\end{equation}
where $y$ represents logarithm base 2 of the number of qubits and $x$ represents the logarithm base 2 of the time (in seconds)  For example,
the quantity 
\begin{equation}\label{eqn2}
y\left(\log_2(24\times 3600)\right) \approx y(16 3987)
\end{equation}
represents how many qubits are required to break the scheme in one day (24 hours) for a fixed physical error rate per gate $p_g$, assuming a 
surface code cycle time of 200ns  Note that the computation time scales linearly with the surface code cycle time, e g  a 1000ns surface code cycle 
time will result in a computation that is 5 times longer than a $200ns$ surface code cycle time  Therefore, for a specific cryptographic scheme for 
which we plotted the space/time tradeoffs using a surface code cycle time of $200ns$ and a fixed physical error rate per gate $p_g$, the number of 
qubits required to break a specific scheme in a time $t$ using an alternative surface code cycle time $t_c$ is given by

\begin{equation}\label{eqn3}
y\left(\log_2\left(\frac{200ns}{t_c}t\right)\right),
\end{equation}
where $t$ is expressed in seconds and $t_c$ is expressed in nanoseconds 

We assume a surface code cycle time of 200ns, in conformance with~\cite{PhysRevA 86 032324}  For each scheme we analyze, we compare its security using the more conservative (and realistic in the short term) $p_g=10^{-3}$ and also the more optimistic  $p_g=10^{-5}$  Note that assuming the more optimistic assumption from a quantum computing perspective is the more conservative assumption from a cybersecurity perspective 

Furthermore, in this analysis, we are reporting the full physical footprint, including the memory required for magic state distillation 
Using present-day techniques, the memory required for generating these generic input states accounts for a substantial fraction of the total memory cost and thus we are including these in the total cost estimate and will track the impact of improved methods 

\section{Symmetric ciphers\label{sct::ciphers}}
Below we analyze the security of AES family of symmetric ciphers against large-scale fault-tolerant quantum adversaries  We used the highly optimized logical circuits produced in
\cite{10 1007/978-3-319-29360-8_3}  

\subsection{AES-128}

        \includegraphics[width=0 429\textwidth]{figures/AES-128_cycles pdf}
      	\captionof{figure}{AES-128 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale)  The bottom brown line (theoretical lower bound, black box) represents the minimal number of queries required
	by Grover's algorithm, the cost function being the total number of queries to a black-box oracle, each query assumed to have unit cost, and a completely error-free circuit  The purple line (ideal grover, non-black-box) takes into consideration the structure of the oracle, the cost function being the total number of gates in the circuit, each gate having unit cost; the quantum circuit is assumed error-free as well  Both brown and magenta lines are displayed only for comparisons; for both of them, the $y$ axis should be interpreted as number of logical queries (operations, respectively) 	
The curves above the purple line show the overhead introduced by fault tolerance (in terms of required surface code cycles, each surface code cycle assumed to have unit cost)  More optimization at the logical layer will shift the purple line down, whereas more optimization at the fault-tolerant layer will move the upper curves closer to the purple line  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_cycles}
	
	For example, the plots in Fig ~\ref{fgr:aes_128_cycles} tells us that if we have $2^{50}$ quantum computers running Grover's algorithm in parallel, with no physical errors, then it would take about $2^{63}$ gate calls (where the purple line intersects the vertical line at $50$), where we assume each gate to have unit cost  Still with no errors, a trivial cost for implementing the cryptographic function (oracle) would bring the cost down to about $2^{38}$ oracle calls per quantum computer  Keeping the actual function implementation, but adding the fault-tolerant layer with a physical error rate of $10^{-7}$ (with appropriate assumptions and using state-of-the-art quantum error correction) pushes the cost up to around $2^{76}$ surface code cycles per quantum computer (where now each code cycle is assumed to have unit cost)  Similar remarks hold for the remaining plots in this manuscript 
        \includegraphics[width=0 429\textwidth]{figures/AES-128_time pdf}
      	\captionof{figure}{AES-128 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The horizontal dotted line indicates one year  The $x$-axis is deliberately extended to show the necessary number of CPUs for a total time of one year  Thus the figure shows that it would take, with the stated assumptions, over $2^{80}$ parallel quantum searches to break AES-128 in a year  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_time}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys pdf}
	\captionof{figure}{AES-128 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys_total pdf}
	\captionof{figure}{AES-128 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_128_phys_total}

\subsection{AES-192}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_cycles pdf}
      	\captionof{figure}{AES-192 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_time pdf}
      	\captionof{figure}{AES-192 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys pdf}
	\captionof{figure}{AES-192 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys_total pdf}
	\captionof{figure}{AES-192 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_192_phys_total}


\subsection{AES-256}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_cycles pdf}
      	\captionof{figure}{AES-256 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_time pdf}
      	\captionof{figure}{AES-256 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys pdf}
	\captionof{figure}{AES-256 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys_total pdf}
	\captionof{figure}{AES-256 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_256_phys_total}

\section{Hash functions\label{sct::hash}}
In this section we study the effect of parallelized Grover attacks on the SHA-256~\cite{SHA2} snd SHA3-256~\cite{SHA3} family of hash functions  We used the highly optimized logical circuits produced in~\cite{10 1007/978-3-319-69453-5_18} 

\subsection{SHA-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA-256_cycles



ground_truth: Vitamins K3, K4, and K5.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What did the decision to base the water rates on usage reflect?

Read the following text and answer briefly.

Context 2: 
Senate Floor Amendments of 8/20/10 revise the statute of
limitations and remedies for specified housing-related
ANALYSIS : The Planning and Zoning Law requires cities
and counties to prepare and adopt a general plan, including
a housing element, to guide the future growth of a
community  Following a staggered statutory schedule,
cities and counties located within the territory of a
metropolitan planning organization (MPO) must revise their
housing elements every eight years, and cities and counties
in rural non-MPO regions must revise their housing elements
every five years  These five- and eight-year periods are
known as the housing element planning period 
Before each revision, each community is assigned its fair
share of housing for each income category through the
regional housing needs assessment (RHNA) process  A
housing element must identify and analyze existing and
projected housing needs, identify adequate sites with
appropriate zoning to meet its share of the RHNA, and
ensure that regulatory systems provide opportunities for,
and do not unduly constrain, housing development  The
reviews both draft and adopted housing elements to
determine whether or not they are in substantial compliance
with the law  The Planning and Zoning Law and the Subdivision Map Act
also includes a number of sections governing zoning and
entitlements specifically related to housing, including:
? The Housing Accountability Act, which requires a city or
county to make one or more specified findings in order to
disapprove a particular housing development 
? A provision requiring cities and counties, when adopting
an ordinance which limits the number of housing units
which may be constructed on an annual basis, to make
findings as to the public health, safety, and welfare
benefits that justify reducing the housing opportunities
of the region  ? Density bonus law, which requires cities and counties to
grant a developer a density bonus, incentives, and
concessions when the developer proposes to include
specified percentages of affordable housing within a
development  ? The Least Cost Zoning Law, which requires cities and AB 602
counties to designate and zone sufficient vacant land for
residential use with appropriate standards to meet
housing needs for all income categories and to contribute
to producing housing at the lowest possible cost 
? A requirement that, when determining whether to approve a
tentative subdivision map, a city or county shall apply
only those ordinances, policies, and standards in effect
as of the date the developer’s application is deemed
Prior to a recent court decision, it was understood that
current law allowed a party to challenge the adequacy of a
city’s or county’s housing element at any time during a
planning period, provided that the challenger brought the
action “in support of or to encourage or facilitate the
development of housing that would increase the community’s
supply of [affordable] housing ” The challenging party was
required first to serve the city or county with a notice
identifying the deficiencies in the housing element  After
60 days or the date on which the city or county took final
action in response to the notice, whichever occurred first,
the challenging party had one year to file the action in
court  This process and statute of limitations also
applied to actions brought pursuant to the housing-related
statutes listed above  In 2006 Urban Habitat Program brought suit to challenge the
City of Pleasanton’s housing policies, including the city’s
annual cap on housing permits and the city’s cap on the
aggregate number of permissible housing units, both of
which Urban Habitat claimed were insufficient to allow the
city to meet its RHNA obligation  In 2008, the First
District California Court of Appeals issued an unpublished
decision in the case of Urban Habitat Program v  City of
Pleasanton allowing the case to proceed with respect to
some causes of action, but ruling that the challenge to the
housing element itself was time-barred  The court stated:
Although the statute does not specify the time within
which [a deficiency] notice must be given, it is our
conclusion that the statute must be interpreted as
containing a time limit within which this requirement
must be met? In sum, a party bringing a challenge AB 602
governed by section 65009, subdivision (d), has 90
days from the date a legislative action is taken or
approval is given to notify the local land use
authority of any claimed deficiencies in such an
action or approval  Its claim then accrues 60 days
after it gives this notice 
In other words, instead of being able to initiate a
challenge to a deficient housing element at any time during
the planning period, housing advocates and other interested
parties may now only initiate such a challenge by
submitting a deficiency notice within 90 days of the
housing element’s adoption 
1 Removes from the current list of city or county actions
which may be challenged pursuant to Government Code 65009
notice and accrual provisions those actions related to
the Housing Accountability Act, the Subdivision Map Act,
and the application of a Density Bonus ordinance to a
particular project, all of which are project-specific
actions  The bill maintains the ability to use these
notice and accrual provisions to challenge the adequacy
of a city’s or county’s density bonus ordinance
2 Extends lengthening the time in which a deficiency notice
may be served to cover all remaining city or county
actions described in this section of law, as opposed to
just housing element challenges  In other words, the
amendments apply the longer timeframe to serve the
deficiency notice to actions relating to the Least Cost
Zoning Law, annual limits on housing permits, and the
adequacy of a density bonus ordinance, in addition to
housing element law  3 Provides that an entity challenging such an action in
support of affordable housing may serve the deficiency
notice up to five years after the city’s or county’s
action  After 60 days or the date on which the city or
county takes final action in response to the notice,
whichever occurs first, the challenging party has one
year to file an action in court, except that the lawsuit AB 602
may not be filed more than five years after the city’s or
county’s action  In other words, the entity must file
the lawsuit within one year of the expiration of the
deficiency notice or within five years of the city’s or
county’s action, whichever occurs first 
4 Provides that a housing element from a prior planning
period may not be challenged if the city or county has
adopted a revised housing element for the new planning
Government Code 65755   Current law requires a court, if it
finds any portion of a general plan, including a housing
element, out of compliance with the law, to include within
its order or judgment one or more of the following remedies
for any or all types of developments or any or all
geographic segments of the city or county until the city or
county has complied with the law:
? Suspend the authority of the city or county to
issue building permits 
grant zoning changes and/or variances 
grant subdivision map approvals 
? Mandate the approval of building permits for
residential housing that meet specified criteria 
? Mandate the approval of final subdivision maps for
housing projects that meet specified criteria 
? Mandate the approval of tentative subdivision maps
for residential housing projects that meet specified
This bill clarifies that in any action or proceeding
brought pursuant to the notice and accrual provisions of
Government Code Section 65009 described above, neither the
court remedies described above nor any injunction against
the development of a housing project shall abrogate,
impair, or otherwise interfere with the full exercise of
the rights and protections granted to an applicant for a
tentative map or a vesting tentative map under specified
provisions of the Subdivision Map Act or to a developer
under a specified provision relating to development AB 602
Under current law, HCD operates a number of grant programs
to which cities and counties may apply  In many cases, the
law requires a city or county to have an HCD-approved
housing element in order to be eligible for funding  This bill provides that if a third-party challenges the
adequacy of a housing element in court and the court finds
that the housing element substantially complies with all of
the requirements of housing element law, the element shall
be deemed to be in compliance for purposes of state housing
The statutory language interpreted by the court and at
issue in this bill was added to statute by AB 998 (Waters),
Chapter 1138, Statutes of 1983, a bill sponsored by the
League of California Cities and the California Building
Industry Association  AB 998 created a short statute of
limitations period for land use decisions generally but
provided a specific exception to protect the ability to
challenge deficient housing elements  The Senate Housing
and Land Use Committee and the Senate Third Reading
analysis of the bill stated that the bill:
Specifies that for challenges in support of low- and
moderate-income housing requirements, the petitioner
shall notice local government 60 days prior to filing
action  The [one-year] statute of limitations then
begins on the first day the legislative body fails to
In the intervening 25 years prior to the Urban Habitat
ruling, housing advocates filed and successfully settled at
least ten cases in which the 60-day deficiency notice was
sent more than 90 days after adoption of the city’s or
county’s housing element  In none of these cases was the
timeliness on the advocates’ suit contested  Likewise, six
bills amended other portions of this statute during those
intervening years, and there was never any controversy
surrounding the lack of a deadline for housing advocates to
serve a deficiency notice nor any attempt to change the AB 602
statute in this regard  Current level of housing element compliance   According to
HCD’s website as of June 7, 2010, only 46 percent of cities
and counties have adopted an HCD-approved housing element
for the current planning period that began in 2005 for the
San Diego region, 2008 for the Southern California, Fresno,
Kern, and Sacramento regions, and the summer of 2009 for
the remaining areas of the state  Unlocking the private market   The purpose of housing
element law is to create opportunities for the private
housing market to function  Builders cannot build without
access to appropriately zoned land, and current land use
plans in many cities and counties in California fail to
provide sufficient opportunities to accommodate projected
population growth  The San Diego Association of
Governments’ Regional Comprehensive Plan describes this
typical California paradox in the following way:
Under current plans and policies, more than 90 percent
of [the San Diego region’s] remaining vacant land
designated for housing is planned for densities of
less than one home per acre, and most is in the rural
back country areas dependent upon scarce groundwater
supplies  And of the remaining vacant land planned for
housing in the 18 incorporated cities, only about
seven percent is planned for multifamily housing  When
taken together, the current land use plans of the 19
local jurisdictions do not accommodate the amount of
growth anticipated in our region  SANDAG’s population
forecast, which reflects the current adopted local
land use plans in the region, projects that while
population will increase by 37 percent by 2030,
housing will grow by just 30 percent  The forecast
shows that if local plans are not changed, demand for
housing will continue to outpace the supply, just as
Housing element law addresses this problem directly by
requiring cities and counties to zone land at appropriate
densities to accommodate the projected housing needs of all
income groups and to remove constraints that prevent such
sites from being developed at the allowed densities  AB 602
Cities and counties, however, are not required to build
housing because that is the role of private developers 
The law holds cities and counties accountable only for that
which they control: zoning and land use entitlements 
Without the ability to enforce housing element law, the
market’s ability to meet housing demand may well remain
locked up 
FISCAL EFFECT : Appropriation: No Fiscal Com : No
SUPPORT : (Verified 8/23/10)
California Rural Legal Assistance Foundation (co-source)
Housing California (co-source)
Advocates for Affordable Homes in Fremont
California Coalition for Rural Housing
Community Housing Improvement Program
Community Housing Works
Eden Housing
Fair Housing of Marin
Grassroots Leadership Network of Marin
Kennedy Commission
Public Advocates, Inc
San Diego Housing Federation
Self-Help Enterprises
Sierra Club of California
American Planning Association, California Chapter
JA:nl 8/23/10 Senate Floor Analyses SUPPORT/OPPOSITION: SEE ABOVE
pasoobserver says:	09/11/2010 at 11:17 pm
To whatisup — Thank you for your response to my comments  However, you failed to answer some of my questions that I mentioned to you  It’s almost like dealing with some City officials  They just let the public vent at their bimonthly council meetings  In my opinion, it’s difficult to deal with narcissism and arrogance  Over the years, there has been some very good input to our elected officials on how to proceed on the Nacimiento water pipeline,but it fell on deaf ears  You wanted me to answer some of your questions,but you did not answer some of my questions  Again, are you willing to subsidize new development?,Yes?or No?, are you willing to pay for a commodity that you are not receiving? Yes?or No? and another question for you  Are you willing to pay over 300% on your water bills within the five (5) year plan that the City has proposed? Also, the water rates will be subject to later increases too  By the way, I do concur with the city’s plan of “you pay for the amount of water units you use”  (748 gal=one unit)  However, the higher water rates are not good for our senior citizens on fixed incomes and other struggling families in our community  My first suggestion years ago was desalination  The response was it was too expensive  Of course, now it is more expensive  I would suggest that our elected officials recall the existing bonds (The bonds can be recalled early)  The City council can explain to the citizens in detail with financing of new bonds at a lower interest rate as of now for the sewer plant and Nacimiento water pipeline and present their new proposal in compliance with Proposition 218  Let the citizens of Paso VOTE on the financing bonds for their approval  Most of the citizens,that I had spoken to were not happy with the way our City Council handled the Nacimiento water pipeline project  The citizens of Paso didn’t give our City Council a “BLANK CHECK” for $176 million to spend without voter approval  I would suggest that it be a “special tax” or “an assessment” be levied on our property taxes  A percentage of those bonds can be deducted on Federal Income taxes  As it is now, a” fee” on a capital funding project is not deductible  Of course, there are homeowners would not go for this suggestion due to our poor economy  My analogy mentioned above would be, you would get something back on a “special tax” or an “assessment” verses nothing on a “fee”  What say you?
whatisup says:	09/12/2010 at 9:02 am
Unfortunately the law says we have to subsidize new development in California  I don’t like it, but it is the law  I know paying using the property taxes was bandied about  The argument against it was it would mean some would be paying for water they aren’t using and others could be big water users, but pay a small special assessment on their property taxes  I think the decision that was made to base it on usage was out of fairness  It seems to me if people are using water and not paying their share of the costs it is not fair  The Senior issue is very difficult  If someone is retired for twenty years is it realistic to think prices don’t go up during the 20 years of retirement  Think what prices were in 1990 compared to today  Should Seniors never have to pay for capital improvements? Paso Robles also had very low water rates  Rates that are no longer possible given the circumstances  Desalination will happen eventually  California is out of water  If you want to pay $1,000,000 a gallon there is no more allotable water of any consequence in California  The expense will be tremendous — still have to build a desalination plant, still have to build a pipeline  I don’t know if the plant has to be built along the ocean or if the salt water could be piped over to Paso Robles  If it has to be built along the ocean, Paso Robles doesn’t own land on the ocean and, in any case, the environmentalists will keep it in courts for years as they have done so for other proposed desalination plants in Southern California  Eventually necessity will force desalination past the environmentalists, but not yet 
pasojim says:	09/13/2010 at 7:46 am
Whatisup – On one of your previous post you made the comment you haven’t heard any of the legal suggestions for the water issue, But you obviously have  That is a good thing  So we can move the discussion ahead 
Once, again this was handled incorrectly by our city custodians from the beginning  And now here we are  The public is not supporting this very expensive, very limited benefit project  As you said, until a plan is developed that the public can support, things don’t look good 
All this discussion about the water issue has only reinforced my opinion the issue hasn’t been about water, only how the plan should be paid for  Or more specifically, to what extent do we allow our elected custodians and our un-elected GOD tzar decide which laws they will follow and which laws they will ignore  When the City GOD tzar tell citizens at a council meeting if we don’t agree with the City’s plan, then we should just sue him, and when the City Attorney explains to a citizen at a City Council meeting that she does have to respond to their questions because she does NOT work for them  When the project is voted down by the citizens and the council brings it right back up, it is clear that our elected representatives are not doing their job providing direction to their employees and listening to and representing the CITIZENS 
The subject of the original post was the need to elect different representation  I think with all the conversation made on this post, as well as the post on Cal Coast about the hiring of the new legal firm you were involved in, Supports my original opinion 
Context 3: pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_time pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys_total pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_phys_total}


\subsection{SHA3-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_cycles pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_time pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys_total pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha3_256_phys_total}
\section{Bitcoin~\label{sct::bitcoin}}
In this section we analyze the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work protocol, which is based on finding a hash\footnote{The hash function being used by the protocol is H($x$) := SHA-256(SHA-256($x$) } pre-image which that starts
with a certain number of zeros  The latter is dynamically adjusted by the protocol so that the problem is on average solved by
the whole network in 10 minutes  Currently, it takes around $2^{75}$ classical hashing operations~\cite{btc_difficulty} for finding a desired hash pre-image successfully via brute-force search with specialized hardware 
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_cycles pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_time pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys_total pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_bitcoin_phys_total}


\section{Intrinsic cost of parallelized Grover's algorithm\label{sct::intrinsic_parallel_grover}}

More efficient quantum implementations of AES and SHA imply more efficient cryptanalysis  In this section, we aim to bound how much further optimized implementations of these cryptographic functions could help  We do so by assuming a trivial cost of $1$ for each function evaluation 

\subsection{Searching space of size $2^{56}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The dotted horizontal line indicates one year  }
      	\label{fgr:minimal_grover_56_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_56_phys_total}

\subsection{Searching space of size $2^{64}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_64_phys_total}

\subsection{Searching space of size $2^{128}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_128_phys_total}


\subsection{Searching space of size $2^{256}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_time pdf}
      	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys_total pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_256_phys_total}


\section{RSA schemes\label{sct::rsa}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on factoring large numbers, 
namely RSA-1024, RSA-2048, RSA-3072, RSA-4096, RSA-7680 and RSA-15360 
For each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively 

\subsection{RSA-1024}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 01\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $5 86\times 10^{13}$  The quantity $R^2$ represents the coefficient of determination (closer to 1, better the fitting)  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024a} 

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 14\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $2 93\times 10^{13}$  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024b}


\subsection{RSA-2048}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 72\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $4 69\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048a}



\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 9 78\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $2 35\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048b}


\subsection{RSA-3072}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 41\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $1 58\times 10^{15}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 55\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $7 91\times 10^{14}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072b}


\subsection{RSA-4096}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 18\times 10^9$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $3 75\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 5 70\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $1 88\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096b}


\subsection{RSA-7680}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 70\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 64\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 41\times 10^{9}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 47\times 10^{16}$  The classical security parameter is approximately 192 bits



ground_truth: Fairness.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the security parameter for the AES-256 block cipher?

Read the following text and answer briefly.

Context 3: }
\label{fgr:rsa7680b}


\subsection{RSA-15360}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 85\times 10^{12}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $2 24\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 64\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $1 98\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360b}


\section{Elliptic curve schemes\label{sct::ecc}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on solving the discrete logarithm 
problem in finite groups generated over elliptic curves, namely NIST P-160, NIST P-192, NIST P-224, NIST P-256, NIST P-384 and NIST P-521  For 
each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively  We 
used the logical circuits from~\cite{1706 06752} 

\subsection{NIST P-160}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 81\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $4 05\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 38\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $2 03\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160b}


\subsection{NIST P-192}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 37\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $7 23\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 18\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $3 62\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192b}


\subsection{NIST P-224}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 91\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $1 15\times 10^{14}$  The classical security parameter is 112 bits }
\label{fgr:p224a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 24\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $5 75\times 10^{13}$  The classical security parameter is 112 bits }
\label{fgr:p224b}


\subsection{NIST P-256}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 77\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $1 72\times 10^{14}$  The classical security parameter is 128 bits }
\label{fgr:p256a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 64\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $8 60\times 10^{13}$  The classical security parameter is 128 bits }
\label{fgr:p256b}


\subsection{NIST P-384}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 27\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $6 17\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 28\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $3 08\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384b}

\subsection{NIST P-521}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 06\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $1 56\times 10^{15}$  The classical security parameter is 256 bits }
\label{fgr:p521a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 30\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $7 78\times 10^{14}$  The classical security parameter is 256 bits }
\label{fgr:p521b}




\section{Summary and conclusions}\label{sct::conclusion}
We analyzed the security of several widely used symmetric ciphers and hash functions against parallelized quantum adversaries  We computed the security parameter, wall-time and physical footprint for each cryptographic primitive  Our attack model was based on a brute force searching via a parallelized version of Grover's algorithm, assuming a surface-code fault-tolerant architecture based on defects and braiding techniques 

It is worth noting that throughout we are assuming that brute-force search where we treat the cryptographic function as a black-box is essentially the optimal attack against SHA and AES, which is currently believed to be the case 

Some symmetric key algorithms are susceptible in a model that permits ``superposition attacks''~\cite{quantph 1602 05973}  In most realistic instances, these attacks are not practical, however they do shed light on the limitations of certain security proof methods in a quantum context, and remind us that we shouldn't take for granted that non-trivial attacks on symmetric key cryptography may be possible 
For example, very recently, there have been several cryptanalysis results~\cite{1712 06239} and~\cite{1802 03856} that attempt to reduce breaking some symmetric algorithms to solving a system of non-linear equations   Solving these non-linear equations is then attacked using a modified version of the quantum linear equation solver algorithm~\cite{PhysRevLett 103 150502}  The results are heavily dependent on the condition number of the non-linear system, which turns to be hard to compute (it is not known for most ciphers and hash functions such as AES or SHA)  Provided the condition number is relatively small, then one may get an  advantage compared to brute-force Grover search  However at this time it is not clear whether this is indeed the case, and we do not have large-scale quantum computers to experiment with 

The quantum security parameter (based on our assumptions of using state-of-the-art algorithms and fault-tolerance methods) for symmetric and hash-based cryptographic schemes is summarized in Table~\ref{tbl1}  For more details about space/time tradeoffs achievable via parallelization of Grover's algorithm please see the corresponding Sec ~\ref{sct::ciphers}, Sec ~\ref{sct::hash} and Sec ~\ref{sct::bitcoin}, respectively 
\begin{table}[h!]
\begin{tabular}{ll}
\hline
Name    & qs  \\
\hline
AES-128 & 106 \\
AES-192 & 139 \\
AES-256 & 172 \\
\hline
SHA-256 & 166 \\
SHA3-256	 &167 \\
Bitcoin's PoW & 75\\
\hline
\end{tabular}
\caption{Quantum security parameter ($qs$) for the AES family of ciphers, SHA family of hash functions, and Bitcoin, assuming a conservative physical error rate per gate $p_g=10^{-4}$ }
\label{tbl1}
\end{table}

We also analyzed the security of asymmetric (public-key) cryptography, in particular RSA and ECC, in the light of new improvements in fault-tolerant 
quantum error correction based on surface code lattice surgery techniques  We computed the space/time tradeoff required to attack 
every scheme, using physical error rates of $10^{-3}$ and $10^{-5}$, respectively  We fitted the data with a third degree polynomial, which resulted in an analytical formula of the number of qubits required to break the 
scheme as a function of time 

The total number of physical qubits required to break the RSA schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in Table~\ref{tbl2}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::rsa} of the manuscript 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name      & nq                    & Tc                    & scc           & s        \\
\hline
RSA-1024  & $3 01 \times 10^7$    & $3 01 \times 10^{11}$ & $5 86 \times 10^{13}$ & 80\\
RSA-2048  & $1 72 \times 10^8$    & $2 41 \times 10^{12}$ & $4 69 \times 10^{14}$ & 112\\
RSA-3072  & $6 41 \times 10^8$    & $8 12 \times 10^{12}$ & $1 58 \times 10^{15}$ & 128\\
RSA-4096  & $1 18 \times 10^9$    & $1 92 \times 10^{13}$ & $3 75 \times 10^{15}$ & 156\\
RSA-7680  & $7 70 \times 10^{10}$ & $1 27 \times 10^{14}$ & $2 64 \times 10^{16}$ & 192\\
RSA-15360 & $4 85 \times 10^{12}$ & $1 01 \times 10^{15}$ & $2 24 \times 10^{17}$ & 256\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the RSA schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$) 
We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl2}
\end{table}

The total number of physical qubits required to break the ECC schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in in Table~\ref{tbl3}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::ecc} of the manuscript  As observed before in~\cite{1706 06752}, breaking RSA schemes demands more quantum resources in comparison with elliptic curve-based schemes, for the same level of classical security 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name  & nq                 & Tc                    & scc          & s          \\
\hline
P-160 & $1 81 \times 10^7$ & $2 08 \times 10^{11}$ & $4 05 \times 10^{13}$ & 80\\
P-192 & $3 37 \times 10^7$ & $3 71 \times 10^{11}$ & $7 23 \times 10^{13}$ & 96\\
P-224 & $4 91 \times 10^7$ & $5 90 \times 10^{11}$ & $1 15 \times 10^{14}$ & 112\\
P-256 & $6 77 \times 10^7$ & $8 82 \times 10^{11}$ & $1 72 \times 10^{14}$ & 128\\
P-384 & $2 27 \times 10^8$ & $3 16 \times 10^{12}$ & $6 17 \times 10^{14}$ & 192\\
P-521 & $6 06 \times 10^8$ & $7 92 \times 10^{12}$ & $1 56 \times 10^{15}$ & 260\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the ECC schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$)  We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl3}
\end{table}

Recent developments in the theory of fault-tolerant quantum error correction have great impact on evaluating the effective strength of cryptographic
schemes against quantum attacks, as the fault-tolerant layer of a quantum computation is the most resource-intensive part of running a quantum  
algorithm  Therefore, monitoring the advances in the theory of quantum error correction is of crucial importance when estimating the strength (or 
weakness) of a cryptographic scheme against a quantum adversary  This work serves as a benchmark against which the impact of future advances can be compared 

\begin{acknowledgments} 
Most of this work is based on research supported by the Global Risk Institute for its members 
We also acknowledge support from NSERC and CIFAR  IQC and the Perimeter Institute are supported in part by the 
Government of Canada and the Province of Ontario   Vlad Gheorghiu thanks Austin Fowler for helpful discussions 
and clarifications regarding lattice surgery methods 
\end{acknowledgments}

\bibliographystyle{aipnum4-1}





ground_truth: 172.