prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the problem encountered when building the fuselage sides?

Read the following text and answer briefly.

Context 1: Probably one of the most frustrating things about building experimental aircraft, especially when starting with a minimum of pre-fabricated parts, is to start building and ending up with an unexpected result  Every builder starts a new project by wanting it to go "perfectly " So when things aren't going well, especially at the beginning, the frustration can lead to an unfinished airplane 
This is the first article in a series dedicated to helping builders of the Rand Robinson KR series planes build a straight and true fuselage -- the first part of the construction process  Borrowing from modern boatbuliding techniques, focus will be on the KR-2S, but the principles apply to the entire lineup of KR-1 & KR-2 series planes 
While building the KR-2(s) a common surprise is encountered by builders when the completed fuselage sides are laid into position to form the fuselage box section  With many hours spent building the sides flat, finding the once straight longerons that now bow up from the building surface, form a most dissatisfying "banana" shape  Especially when using the preformed fiberglass parts, this curve in the top longeron is not acceptable  The builder is left wondering what went wrong and no amount of clamping or brute force forming will solve the problem to any degree of satisfaction  The problem is not the builder's fault  The solution starts by understanding the three dimensional relationship of the assembled parts being built 
First understand that the plans show the finished form of the plane  They show the "projected" form as you would expect to see it if viewing an actual plane from the top, ends and from the side  Since the sides are sloped (flared) outward, looking from the side, the distances given by measuring the profile drawing are "foreshortened" and don't give the proper shape for building the fuselage with a flat top longeron  What needs to be done is to "develop" the "true" distances and shape of the flat panel so that when it is curved into position, the longerons lay flat 
Second, understand that the dimensions called for in the plans put a twist in the sides that tends to work the panel in two directions of curvature  This twist makes the panel "undevelopable" meaning that that shape cannot be unrolled into an equivalent flat shape  This is important when laying out the side and bottom panels onto flat plywood  To illustrate this, try forming a piece of paper around a soda can  The paper can be formed flat around the can either straight or at a diagonal to it's length  It has only one direction of curvature and is by definition "developable"  Now try to form the same piece of paper around a baseball  It won't lie flat on the surface without some deformation (folding, wrinkling or tearing) of the paper  The ball has curvature in more that one direction and is a "compounded" shape  Paper (or plywood) can only be readily formed in developable shapes as opposed to aluminum or other metal which can accept in plane deformation  A developable surface is needed to lay out a curved surface when the materials used can't be deformed with any degree of in-plane strain 
Initially, the fuselage sides are laid out flat with reference to the top longeron measured to a straight chalk line  The bowing problem starts when the side panels are bent and sloped to form the fuselage box section  If the sides were not sloped (tumbled home), the section formed would be cylindrical and the longerons would lie flat  Since the sides are tumbled home, the section formed is now conical  When a conical shape is cut with a plane (building surface) not perpendicular to it's axis, the shape formed is elliptical -- exactly what happens with the top longeron  When it's built flat, bent to form a cylindrical section, and sloped to form a conical section, it takes on an elliptical shape firewall to tailstock 
This method borrows heavily from proven techniques used in the marine trades  It should be stressed at this point that although the layout procedure is not complicated, it is important to take your time  If the layout is not going well initially, start over! Better to erase layout errors now than to have them built it and cause surprises later 
Layout to ensure a fair and true fuselage starts by drawing a reference line (baseline) on the building surface  Refer to figures 2 & 3 and use a wire guide to draw a very straight baseline  About 500 lbs  Of tension should be adequate  One could use a chalk line, but we're talking airplanes here, not house framing 
The main layout difference is that the baseline isn't used as a reference for the top longeron  The baseline references the mid point of the firewall for the developed (and true dimensioned) side panel  Although the baseline will still be the reference, the top and bottom longerons will be laid separately 
Layout differences don't end there  Each of the stations (vertical members) will be laid out with a calculated separation so that when the panels are formed into position, they land on the spacing called for in the plans  Another major difference is that the bottom & side panels are applied after forming the fuselage box section  This is mainly to obtain the ability to "fair" the side and bottom surfaces and insure a straight and true shape 
Refer to figure 1 for the layout of the new developed side panel  The firewall (station a) is layed out perpendicular to the baseline  Longitudinal (station) measurements are given along the length of the baseline from the firewall  Vertical dimensions are given to reference the angle and breadths of the station at the baseline 
Notice that the top longeron is bowed outward and that the stations are spaced slightly greater than called out in the plans  When the panels are formed into the box frame section ,they will work into the dimensions specified in the plans 
Strike a centerline, longer than is needed on the building surface using a wire guide  Draw off the firewall line perpendicular to the centerline at one end 
Using the distances listed in the balloons, mark them off on the centerline  Distances are measured to the nearest sixteenth of an inch  Take time to mark them off carefully  Don't mark off the distances in a cumulative fashion  Use the firewall as a common reference 
Using the angles listed at each station, mark off a station line longer than is needed  The angles are measured to the nearest hundredth of a degree  Take time to mark them off carefully 
At each station, start by marking off each short (bottom longeron) line distance from the centerline  Use your set of trammels or beam compass for doing this  Mark the intersection of the short line with the station line 
At each station, mark off each long (top longeron) line distance from the intersection of the short line distance and the station line  Again the trammels or beam compass is best for completing this step  Mark the intersection of the long line distance with the station line 
Using the longeron as a batten, trace out the inside and outside curves of the longeron  After the batten is secure, in between each station, fasten a keeper block inside and outside to preserve the shape of the longeron taking care to avoid potential future interference with the diagonal members to be installed later  The fairing blocks can be removed or left in place if they won't interfere with building  The vertical station members and their diagonals can now be measured and positioned  Remember to refer to the plans for the material thickness direction 
After vertical and diagonal members are cut and fitted, take time to draw their outlines on the building surface to cut down on time and confusion when laying out the opposite side 
Finishing the side panel is accomplished in a manner similar to that called for in the handbook with the exception that the side and bottom skin panels will be attached later 
The next article in the series will discuss jigging and building techniques to ensure alignment and straightness of the flat built side panels  Also covered will be building a "strongback" jig to assure alignment of the side panels when they are formed into their final shape 
Part 3 in the series will cover assembly of the side panels using the jigs  Some joint details will be discussed that will ensure a stronger and more fair fuselage assembly  Also covered will be the layout & attachment of the side and bottom ply skins 
U S  Mail: Densmore Associates, inc 
ANSI "D" size, computer generated plots of all the layout drawings in this series are available from the author for $30 plus postage & handling  Full (true size) scale plots may be made available depending on demand 
"Scarfing" is the practice of splicing plywood so that short pieces of plywood can be used to span long distances  On the KR, it is required on both the fuselage skins and spar webs  The angle of the splice should be 10 to 12 degrees to maintain strength across the joint  Also, joints should coincide with structural members, such as spar webs or fuselage truss members 
This scarfer is made by mating a regular plunge router (this one costs about $50) to a table saw  Obviously, you really only need a table saw to cut the chamfer, but it does make a nice heavy table for scarfing  You could just as easily use a large work table as the base First, set the table saw for a 5 5 degree cut (for a 1:12 joint, or 6 5 degree cut for a 10:1 joint), and run a 1 x 6 through on edge to chamfer a corner on the board  Then drill the board for three router mounting holes (two are countersunk) and connect the assembly to the table saw with two 1/4 inch bolts  Use a long (2-3 inch) straight cutting bit to do the cutting  Adjust the bit so it doesn't interfere with your table top, and go to town  Keep pressure on the plywood to ensure contact with the table while you're scarfing  Make sure you feed your material from the same end as you would if you were sawing, or the router will take your plywood away from you and put a big dent in your garage door 
In the late 60's Ken Rand and Stuart Robinson were working as flight system engineers for Douglas Avionics  Ken was working as an electrical engineer, having previously worked for Sperry as an autopilots project engineer, while Stu's degree was in aeronautical engineering from Northrop University  They were two of the guys at the end of the DC-8,9, and 10 assembly lines responsible for correcting some of the nits and picks in various systems before delivery to the customer 
They both wanted to build a fast, inexpensive airplane which was also economical to maintain  Several designs were considered, and plans were bought first for the Jeanie's Teenie and then the Taylor Monoplane  The Monoplane was more to their liking, but would require some modification to fit their needs  A cooperative redesign effort ensued, with virtually no dimensions left untouched  Only the basic fuselage structure, airfoil, and powerplant were retained  The tail shape was Stu's, and came directly from the big DC-8s parked on the ramp outside his office window  The landing gear was designed by Ken, after seeing the gear on a Dewey Bird at Santa Paula airport 
Ken was killed in his KR2 a short time later while flying over Cajon Pass in what was apparently a bad weather / low fuel accident  Ken's wife Jeanette became owner of RR overnight, and stepped up to keep the plans and parts coming  Much of the engineering needs are handled by Bill Marcy of Denver, who's been helping out since early '79 
To date, almost 6000 KR1, 9200 KR2, and 760 KR2S plan sets have been sold  1200 KR2s are estimated to be flying, with 5 KR2Ss now in the air  Much of the development work done on KR's is now done by the builders themselves  KR builders tend to be innovative, which leads to some interesting modifications  Some of the mods that work eventually creep into the plans  The KR2S is a case in point  Many builders who'd heard of the pitch sensitivity and tight cabin of the KR2 began to build an enlarged version, with the length determined by the most commonly available longeron material  The result is a KR2 that is stretched 2" between firewall and main spar, and 14" behind the main spar  Higher gross weights dictated more wing area, with the new standard becoming the Diehl wing skin  Those who plan to carry passengers commonly stretch the cabin width a few inches, although 1 5 inches is the limit if you still want to use RR's premolded parts 
Mike Stearns addresses the KR Forum crowd 
This year's KR Forum featured guest speakers Mike Stearns, Steve Trentman, and Bill Marcey  Mike Stearns spoke on several topics, including the many sources for KR and homebuilding information available on the Internet  He also mentioned KRNet, the list server devoted entirely to KR aircraft, as well as several notable World Wide Web home pages  He also brought a sample of the new Rand Robinson wing skins with him, and discussed their high temperature core prepreg construction  His KR2S will receive the first set, which is currently being installed at Hinson Composites 
Steve Trentman spoke on his turbine installation  It uses a turbine engine which saw duty as an A7 attack jet starter engine  Total weight is about 85 pounds, while putting out around 90 horsepower  There is a small stockpile of these engines available from government surplus  sources  This engine can only be throttled back to 52% power, which leads to some pretty interesting landings  One inflight failure has been logged so far, with very little damage to the aircraft  More on this exciting development in next month's issue of KROnline 
Les Palmer's KR2 N202LP won Best KR2, Best Engine Installation, and People's Choice awards at the 1995 KR Gathering at Columbia, TN  After researching the KR series, and reading Neil Bingham's "A Critical Analysis of the KR2" (Jan 88 Sport Aviation), Les decided to build his as a single seater, stretched 24" in the tail, while maintaining a stock width firewall  His fuselage is made from Douglas fir, which weighs in at 4 lbs heavier than if constructed from spruce  It is skinned with 1/8" birch plywood  Spars are covered with plywoood on both fore and aft sides, ala KR2S  Diehl wing skins provide the lift  Horizontal stabilizer and elevator were stretched 7" longer on each side, while the vertical stabilizer and rudder were stretched 8" taller    The fuselage to cowling junction was made more graceful by adding 1 5 inches to the height of the firewall end of the fuselage sides 
Les's canopy is a Dragonfly, using a four linkage system to swing forward when opening  The canopy frame fits snugly into a recess in the foward deck, providing an excellent wind and water seal  The fiberglass work is exemplary 
Seating is luxurious for one 
The cowling is also a work of art, and uses NACA ducts for efficiency  Female molds were made for all the fiberglass parts on Les's plane, so he could proabably be persuaded to make more, if demand dictates  Les also machines a multitude of KR aluminum and steel parts which he now offers for sale 
The firewall was reinforced with aluminum brackets and angles bolted between the longerons in anticipation of the 200 lb Subaru EA-81 engine installation  His 100 HP Asian version is outfitted with an American Holley 5200 caburetor and manifold  It uses a PSRU of Les's own design, featuring two spur gears with a 1 69:1 reduction ratio and a toothed belt  Other than tapping the crank for larger bolts to mount the redrive, no other engine modifications were required  Also, this is probably the only air conditioned KR2 on the planet  The prop is a 60/63 Hegy 
Originally built as a taildragger, the fixed gear is made from 4130 steel tubing  Custom cast 6 00x6 aluminum wheels and steel rotors are mated with 6" Cleveland calipers for braking  An early taxi test accident damaged the main gear, and prompted Les to change to tricycle gear  Again, he designed his own fiberglass main gear, and uses a Diehl nose wheel fork with a 4130 strut and 6" wheel up front 
Early tests revealed cooling problems, which prompted a radiator move from the firewall to a lower cowling location 
The first flight was almost a disaster, as test pilot Randy Smith lost power right after takeoff  He managed a 180 with a safe downwind landing with only minor nosewheel pant damage  The culprit proved to be a spark plug with too much reach, which was quickly remedied  Subsequent flights have shown water temp to be about 210 degrees, oil temp is 220-230, and airspeed is about 180 mph 
Shopping for the Partially Built KR 
This story starts about twenty years ago when I first started looking at the KR-2 as the plane I'd like to build  The only problem at that time was a lack of money, lack of knowledge, and a lack of job stability  I liked the design, except for the low ground clearance of the retractable gear and that a KR was going to be a tight fit for me to fly 
Over the past twenty years I've owned a number of planes, but still always wanted to build my own  I needed one that would fit me, my budget requirements, and have the speed and performance that I wanted  When "KITPLANES" published the article featuring Roy Marsh's new KR-2S, it was the first I had heard of any major modifications or improvements to the same old KR design  I believe that article and Roy Marsh's workmanship have probably been the greatest boon to Rand Robinson (RR) in the last twenty years  It certainly caught my eye! Here was the same design I had decided I wanted to build twenty years ago, with all of the improvements I wanted  It was sitting on fixed gear with some reasonable ground clearance  It had the capability to be built large enough to accommodate me  It has enough prefab parts available that it didn't have to be 100% scratch built if I decided to hurry the project along  And it had the speed I wanted  I knew that Roy's published speeds were probably not realistic expectations for the average KR, but after knocking around for the last three years in my Champ, anything over 90 mph seems pretty fast to me 
After purchasing the info kit and the sales video from Rand Robinson, the next step after deciding for sure to build this plane was to order the KR-2 plans and the KR-2S addendum  I finally got my plans and was putting together my first order to start the plane, when my partner in the Champ pointed out that there was a partially completed KR-2S for sale in Trade-a-plane  My initial answer was "No, I don't even want to look at it  I want to build my own from scratch " My partner insisted that for the advertised price and the fact that it wasn't too far away, I ought to at least give the guy a call and investigate it  "No, I don't think I want to buy someone else's problems," I persisted  That night I went home and crunched up some numbers on the calculator and finally came to the conclusion that for the sake of my budget for the next several years, I really should give this guy a call 
Three days later, I flew to his place about 400 miles away to take a look at his project  At this point I should probably mention that I consider myself to be fairly knowledgeable about airplane construction, although the vast majority of my experience is with tube and fabric  The rest of this article deals with what I looked for and more importantly what I missed and have had to repair in the last year since I purchased the project 
When we went to the seller's house, I found that the left wing was built using the Dan Diehl wing skins and the right wing skins were leaning against the wall inside the house  Also the canopy was in the house with the canopy covered with paper and tape  I wanted to inspect the fuselage first, so off we went to the shop 
There I found a fuselage sitting on it's gear painted in primer gray  The first step was to inspect the quality of workmanship of what could be seen as it sat  The interior of the fuselage looked as if it had been built with a great deal of care  The fit and finish of all of the interior wood was very nice  Even the gussets looked like they had been painstakingly perfectly fitted  The glass work on the turtle back also looked very precise and clean  It was evenly faired into the vertical and horizontal stabs  The tail also appeared to be well built with the exception of a depression directly over the front and rear spars in the horizontal stabs  He explained that when he moved recently, that he had shot the plane with gray primer to protect it from the weather since he wouldn't have ready access to a shop to put it in right away  It ended up sitting out in the hot south Texas summer sun for a few weeks before he got a shop rented to work in  That caused the glass (or possibly the foam inside the horizontal stab) to swell, except that it held onto the spar, so it was slightly ballooned in front of and behind the spars  His recommendation was to fill it back smooth with micro 
I also found a small linear crack in the lower left wing spar cap on the left wing stub  It appeared to be from over tightening the rear spar wing attach fitting bolts  His explanation was that the crack wasn't important because the rear spars only job is to keep the wings from folding back  I also noticed that the holes for attaching the outer wing to the wing stub were badly rounded out on the rear spar  He explained that the Diehl wing skins require the rear spar to be swept slightly more forward than the stock wings  This won't allow you to use the rear spar attach fittings from RR and that I would need to fabricate a new set of rear spar attach fittings 
I also found that the aileron bellcranks were not built or installed as per plans, but found that they looked professional  I couldn't check for function since the right bellcrank and sheeve wasn't installed, the left wing also wasn't installed, and the right wing didn't exist yet 
Next we pulled the inspection panels off of the fuselage and tail and looked at everything I could see with a good flashlight  I didn't find anything else that might be questionable about the fuselage except for a cracked elevator trim tab that was damaged when it fell off it's hanging place on the wall 
Next we spent some time going over his builders log and builders photo album  I still hadn't seen anything that would dissuade me from buying this project 
At this point it was starting to get late and my ride down needed to get airborne for the flight home  I needed to make a decision about whether I wanted this project or not, but I hadn't inspected the wings and canopy yet  I took a cursory look at the left wing and saw lots on micro built up on it and some bubbles in the leading edge, but nothing that looked seriously wrong to my amateur eye  The right wing was only a set of spars in the shop and the Diehl wing skins in the house, so there wasn't much to look at there  The canopy was wrapped in paper and tape, so there wasn't much to look at there either  I decided that even if there were serious problems in the wing that was built, I would be money ahead to go ahead and buy the project  For the advertised price, I could build a new set of wings and still be way ahead financially  We negotiated a final price, shook hands, took my ride to the airport, and started off in search of a U-haul to haul the project home 
Now, at this point, some of you are thinking about what I surely must have forgotten to inspect and why didn't I take a local A & P or EAA member along for the ride  First of all, I don't know any mechanics locally that have any experience with glass and our EAA chapter of which I am VP is woefully lacking in fiberglass knowledge  Secondly, as you will see, I missed plenty  Some by ignorance, some by just not looking close enough 
Now for a list of the problems that I found over the last year and a few of the fixes that I came up with 
I found that the lower set of rear spar attach fittings on the left rear spar were installed backwards with the longer spaced hole towards the fuselage  Since this is the same place that also had the cracked spar cap, it required a major change  Also in the same area he had drilled through the rear spar with a hole saw to create a place for the aileron cable to pass through and managed to cut out the second from the outside vertical brace in the spar  Then he chose to install the aileron bellcranks in front of the rear spar, and cut another hole through the rear spar for the aileron push rod  He also managed to cut out the outside vertical brace in the spar  Since the holes were already drilled through the spar, the choices were to either cut out that section of spar cap and scarf a new piece in, cut the whole rear spar carrythrough out of the fuselage including ruining the left lower wing skin, or do something else creative to reinforce the spar cap and install a custom built set of attach fittings 
I also found that after I built and installed the right side wing stub ribs and skin that the aileron bellcrank setup would not work as installed  The cable that crosses between the two bellcranks had a sharp uphill from the sheeve to the bellcrank in the last 12 inches on either side  This combined with the radius that the bellcranks turn caused the cross cable to pull up tight when the ailerons were pushed to either end of their travel, but allowed the cables to go very slack when the ailerons were centered  Also the Aileron pushrods needed to pass directly through the lower set of rear wing attach fittings to attach to the aileron  This whole rear spar and aileron bellcrank setup was going to either have to be redesigned or cut out and built to plans  The bottom line is that the problems I observed when I inspected this part were much more serious than expected when I had to fix it 
I decided that I had to remove the rear fittings from the left wing to be replaced with the new set that my neighborhood machinist was cutting out for me  When I put the wing on the work bench to start removing the rear fittings, I thought I had better take a closer look at the bubbles in the leading edge  I found that as I pushed on the leading edge, it delaminated between the glass lay-up on top and the upper and lower wing skin edges that were floxed together underneath  I concluded that that area had to come apart and took a belt sander to the leading edge  What I found was that the leading edge had been floxed together and glassed over, but the mold release had never been scrubbed off the leading edge of the wing  It peeled apart for rebuild quite easily 
When I got back to removing the rear spar attach fittings, I noticed that the woodwork inside the wing looked awfully dull  The reason was that the wing had been closed up without varnishing any of the woodwork  This was rectified with a small hole saw, a number of extensions and a modified undercoating sprayer 
I also found that the aluminum drain fitting in the bottom of the left wing tank had been glassed into place upside down  The tapered pipe threads were tapered the wrong way to install the draincock into the tank  Retapping the fitting the right direction seemed to be a good fix for that problem 
When I finally got around to attaching the wing to the fuselage, I found that the front spar attach fittings were badly misaligned  Although they could be forced into alignment, I didn't think I needed that kind of preload on the main spar fittings  This problem was fixed by calling on my local neighborhood machinist to build me an aligning fixture and reaming the attach holes to the next larger size and ordering the new sized bolts 
On the fuselage I found that although it had new Cleveland wheels and brakes on it, one of the brakes had a severe wobble to it  I must complement the manufacturers for taking care of that problem  One call to the Cleveland factory and they shipped me a new set of wheels and brakes even though the receipt for this set was over four years old and in the original builders name  Their only concern was that this set had never been placed in service yet 
I chose to sand the load of micro off the left wing to see what it was covering  When I got down to the glass, I found that there was no glass for the aft inch and a half of the underside of the wing in front of the aileron hinge  With the Diehl wing skins, you build the wings, then cut the ailerons out of trailing edge of the wing  He had mismeasured and cut too much material off the bottom side of the trailing edge in front of the aileron  It was filled by floxing a piece of spruce into the gap to fill the space between the back edge of the fiberglass and the aileron mount  I chose to wrap the trailing edge of that wing, and the other wing to match with a couple of lay-ups of glass 
When I sanded the primer off the aforementioned damaged trim tab, I found that the hinge was floxed to the leading edge of the foam insides of the tab, but not the glass  I also chose to wrap the front of the trim tab with a lay-up of glass 
I decided to pull the paper off the canopy and take a look at it before I'm ready to bolt it on and fly  The original builder had blown his own canopy and after some of the previous problems, I was beginning to have some concerns about not having looked it over closely enough  The canopy turned out to have been blow a little too large  It ended up with a little larger bubble for headroom, which I didn't object to  However, it had more headroom on the right side than the left  Yes, it was just a little bit lopsided  The main problem was that the canopy is stretched thin enough that it can be easily pushed in with one hand when the weather is warm   My fear was that this is just thin enough that it may decide to lay on my head or in my lap when flying on a warm day  It will have to be replaced 
I'm sure that many that are reading this could see several of the potential problems before I mentioned them, but some others may not have and I'm sure that there could have been many other problems that didn't but could have existed on this project  This is also not intended to be critical of the gentleman that started this project as many parts of it, especially the wood work are better than I could have done and much of his work is outstanding  I prefer to think that I'll end up with a better plane with his woodwork combined with my glasswork  This article is intended to feature some of the problems that you may run into in buying someone else's project 
The final question is, knowing what I have found over the past year, would I have still purchased this project  The answer is yes, but primarily because the price was right in that I am still money and work ahead of where I would be if I had started the project from scratch  There are a few things that I would have done differently, but nothing that I can't live with  Although I won't be able to say that I built it all from scratch, I have built and rebuild enough of the plane that I should have no problem qualifying under the 51% rule 
You can send comments directly to the author via e-mail at "jscott@LANL GOV" 
Here is an brief explanation of how I built my turtledecks  The jig was constructed from scrap plywood and a few 1x4s that I ripped into stringers  I made two temporary bulkheads from the plywood, one for each end  Remember the forward bulkhead needs to be shaped in a way that will closely match the aft end of your canopy frame  Make an aft bulkhead by placing a straight edge at the top of your forward bulkhead and the trailing edge of your horizontal stabilizer  This will give you an idea of how tall your aft bulkhead needs to be  As far as location, I placed my aft bulkhead just forward of the lower/front of my vertical fin  I constructed the jig on the fuselage, it is glued together with automotive bondo 
After the bulkheads were bondoed to the fuselage I used the stringers that I ripped from the 1x4s and bondoed them to the bulkheads  This gave me a male form to cover with thin plastic or posterboard  I stapled two layers of posterboard to the jig(thin plastic would work better)  The posterboard wraps down two inches onto the fuselage  After I was satisfied with the way it looked, I then covered the entire thing with duct tape (fiberglass will not stick to duct tape) On top of this I wetout one layer of tri-ply cloth (22oz) that I had left over from an earlier project, and one layer of 8oz  bid  Remember to mask off your fuselage so you don't get epoxy on it  If you are not familiar with composite lay-ups, you should plan on razor cutting your lay-ups 4 to 6 hours after wetout while the lay-up is still soft enough to cut with a razorblade 
After the lay-up cured (2 or 3 days) it was removed from the jig, and the jig was removed from the fuselage and discarded  (be careful, the bondo sticks very well to the spruce, you could splinter your wood during removal) I now have a fiberglass skin that tends to hold the shape of the jig but is still flexible enough to work with  I made two bulkheads out of 1/4 last-a-foam (AS&S) using the plywood formers from the jig as a guide  I covered these foam bulkheads with one 8oz layer of glass on each side, with a glass to glass edge on the bottom  After cure these bulkheads were bondoed into place (to the fuselage)and the fiberglass skin was pulled down tight and floxed to the bulkheads  When the flox cured the bondo joints were broken, again being careful not to harm the wood  The turtledeck was removed from the fuselage and 2 inch tapes added to the bulkheads inside and out 
At this point the turtledeck looked great and only weighed about 5lbs  but I noticed you could deform the skin by pushing hard on the outside  So I flipped the turtledeck over and from 1/4 inch last-a-foam, I cut two inch wide strips that would run the entire length, forward and aft inside the turtledeck  In effect these would act as composite stringers, I made enough of these two inch wide strips to make up three stringers  One down the center (sort of a backbone) and one on each side of the "backbone" half the distance to the edge of the turtledeck  I sanded the edge of the foam so that when covered with a layer of bid @ 45degrees there would be a nice transition from the turtledeck skin up onto the foam and then back onto the turtledeck I scuff sanded and glued the foam stringers in with micro  I covered the foam stringers with one layer of 8oz bid @ 45degrees 
Context 2: \section{Introduction\label{sct::intro}}
Symmetric, public-key (asymmetric) and hash-based cryptography constitute a fundamental pillar of modern cryptography  
Symmetric cryptography includes symmetric-key encryption, where a shared secret key is used for both encryption and decryption  Cryptographic hash functions map arbitrarily long strings to strings of a fixed finite length  Currently deployed public-key schemes are
used to establish a common secret key between two remote parties  They are based on factoring large numbers or solving the discrete logarithm problem over a finite group  For more details about modern cryptography the interested reader can consult one of the many excellent references on the topic, e g ~\cite{Katz:2007:IMC:1206501} 

In contrast to asymmetric schemes based on factoring or solving the discrete logarithm problem and which are completely broken by a quantum adversary via Shor's algorithm~\cite{SJC 26 1484}, symmetric schemes and hash functions are less vulnerable to quantum attacks  The best known quantum attacks against them are based on Grover's quantum search algorithm~\cite{PhysRevLett 79 325}, which offers a quadratic speedup compared to classical brute force searching  Given a search space of size $N$, Grover's algorithm finds, with high probability, an element $x$ for which a certain property such as $f(x)=1$ holds, for some function $f$ we know how to evaluate (assuming such a solution exists)  The algorithm evaluates $f$ a total of $\mathcal{O}(\sqrt{N})$ times  It applies a simple operation in between the evaluations of $f$, so the $\mathcal{O}(\sqrt{N})$ evaluations of $f$ account for most of the complexity  In contrast, any classical algorithm that evaluates $f$ in a similar ``black-box'' way requires on the order of $N$ evaluations of $f$ to find such an element 

Any quantum algorithm can be mapped to a quantum circuit, which can be implemented on a quantum computer  The quantum circuit represents what we call the ``logical layer"  Such a circuit can always be decomposed in a sequence of ``elementary 
gates", such as Clifford gates (CNOT, Hadamard etc ~\cite{NC00}) augmented by a non-Clifford gate such as the T gate 

Running a logical circuit on a full fault-tolerant quantum computer is highly non-trivial  The sequence of logical gates have to be mapped to 
sequences of surface code measurement cycles (see e g ~\cite{PhysRevA 86 032324} for extensive details)  By far, the most resource-consuming (in 
terms of number of qubits required and time) is the T gate\footnote{Clifford gates are ``cheap", i e  they require relatively small overhead for implementation in the surface code, but are not universals, hence a non-Clifford gate is required  One such gate is the T gate  There are other possible choices, however all of the non-Clifford gates require special techniques such as magic state distillation~\cite{1367-2630-14-12-123011,PhysRevA 86 052329} and significant overhead (order of magnitudes higher than Clifford gates) to be implemented in the surface code  In fact, to a first order approximation, for the purpose of resource estimation, one can simply ignore the overhead introduced by the Clifford gates and simply focus only on the T gates }  
In comparison with surface code defects and braiding techniques~\cite{PhysRevA 86 032324}, novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} reduce the spatial overhead required for implementing T gates via magic state distillation by approximately a factor of 5, while also modestly improving the running time  

In this paper we first analyze the security of symmetric schemes and hash functions against large-scale fault-tolerant quantum adversaries, using surface code defects and braiding techniques  We take into account the time-space trade-offs with parallelizing quantum search, down to the fault-tolerant layer  Naively, one might hope that $K$ quantum computers (or quantum ``processors'', as we will call them later in the paper) running in parallel reduce the number the circuit depth down to $\mathcal{O}(\sqrt{N})/K$ steps, similar to the classical case of distributing a search space across $K$ classical processors  However quantum searching does not parallelize so well, and the required number of steps
for parallel quantum searching is of the order $\mathcal{O}(\sqrt{N/K})$~\cite{quantph 9711070}  This is a factor of $\sqrt{K}$ larger than $\mathcal{O}(\sqrt{N})/K$   As shown in~\cite{quantph 9711070}, the optimal way of doing parallel quantum search is to partition the search space into $N/K$ parts, and to perform independent quantum searches on each part 

Secondly, we investigate the security of public-key cryptographic schemes such as RSA and ECC against 
quantum attacks, using the latest developments in theory of fault-tolerant quantum error correction, i e  novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} 

The remainder of this paper is organized as follows  In Sec ~\ref{sct::method}, we provide an overview of the methodology used in our analysis  In Sec ~\ref{sct::ciphers} we investigate the security of the AES family of modern symmetric ciphers  In Sec ~\ref{sct::hash} we analyze the security of the SHA family of hash functions  In Sec ~\ref{sct::bitcoin} we investigate the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work consensus mechanism  We conclude our investigation of symmetric and hash-based cryptographic schemes in Sec ~\ref{sct::intrinsic_parallel_grover}, where we evaluate the intrinsic cost of running the Grover algorithm with a trivial oracle (i e , an oracle with a unit cost of 1 for each invocation) 

In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  Finally we summarize our findings and conclude in Sec ~\ref{sct::conclusion} 
\section{Methodology\label{sct::method}}

\subsection{Symmetric cryptography and hash functions\label{sct::symmetric}}
The methodology, sketched in Fig ~\ref{fgr:flowchart_lite} and Fig ~\ref{fgr:full_algorithm}, follows the same lines as the one described in great detail in our earlier paper~\cite{10 1007/978-3-319-69453-5_18}, which we refer the interested reader to for more details 
\begin{figure}[htb]
	\centering
         \includegraphics[width=0 35\textwidth]{figures/flowchart_lite pdf}
         \caption{Analyzing an attack against a symmetric cryptographic function with a fault-tolerant quantum adversary  Our resource estimation methodology takes into account several of the layers between the high level description of an algorithm and the physical hardware required for its execution  Our approach is modular should assumptions about any of these layers change, and hence it allows one to calculate the impact of improvements in any particular layer }
         \label{fgr:flowchart_lite}
\end{figure}
\begin{figure}
	\centering
	 \includegraphics[width=0 46\textwidth]{figures/grover_vertical pdf}
          \caption{Grover searching with an oracle for $f : \{0,1\}^k \rightarrow \{0,1\}^k$  The algorithm makes $\lfloor \frac{\pi}{4} 2^{N/2}\rfloor$ calls to
$G$, the \emph{Grover iteration}, or, if parallelized on $K$ processors, $\lfloor \frac{\pi}{4} 2^{N/(2K)}\rfloor$ calls to $G$  The Grover iteration has two
subroutines  The first, $U_g$, implements the predicate $g : \{0,1\}^k
\rightarrow \{0,1\}$ that maps $x$ to $1$ if and only if $f(x) = y$  Each call to $U_g$ involves two calls to a reversible implementation of $f$ and one call to a comparison circuit that checks whether $f(x) = y$ }
          \label{fgr:full_algorithm}
\end{figure}

We assume a surface-code based fault-tolerant architecture~\cite{PhysRevA 86 032324}, using Reed-Muller distillation schemes~\cite{Fowler:2013aa}  For each scheme we vary the possible physical error rates per gate from $10^{-4}$ to $10^{-7}$  We believe that this range of physical error rates is wide enough to cover both first generation quantum computers as well as more advanced future machines 
In comparison to surface code defects and braiding methods~\cite{PhysRevA 86 032324}, lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} mostly impact the physical footprint of the fault-tolerant layer required to run a specific quantum algorithm, reducing the distillation overhead by approximately a factor of 5  The temporal overhead (i e  the number of surface code cycles) is reduced less drastically  For this reason, lattice surgery has less significant effects in estimating the security of symmetric schemes or hash functions, reducing the security parameter\footnote{The security parameter is defined as the logarithm base two of the number of fundamental operations (in our case surface code cycles) required to break the scheme } by at most 1 and decreasing the spatial overhead by at most a factor of 5  Therefore when estimating the security of symmetric and hash-based cryptographic schemes we use surface code defects and braiding techniques 

For each cryptographic primitive, we display four plots, in the following order:
\begin{enumerate}
\item We plot the total number of surface code cycles per CPU (where a CPU is a quantum computer capable of executing a single instance of Grover's quantum search algorithm) as a function of the number of CPUs  We directly tie the quantum security parameter to the total number of surface code cycles (see~\cite{10 1007/978-3-319-69453-5_18} for more details)  We also add to the plot the theoretical lower bound achievable by quantum search in the cases of: a) considering the oracle a black box of unit cost (lower line), and b) considering the oracle as composed of ideal quantum gates, each of unit cost (upper line)  Note that the difference between b) and a) represents the intrinsic cost of logical overhead (i e  the overhead introduced by treating the oracle as a logical circuit and not a blackbox), whereas the difference between the upper lines and b) represents the intrinsic cost introduced by the fault-tolerant layer 

\item We plot the total wall-time per CPU (i e  how long will the whole computation take on a parallel quantum architecture) as a function of the number of CPUs  The horizontal dashed line represents the one-year time line, i e  the $x$ coordinate of the intersection point between the ``Total time per CPU'' line and the one-year time line provides the number of processors required to break the system within one year (in $\log_2$ units) 

\item We plot the total physical footprint (number of qubits) per CPU, as a function of the number of CPUs 
\item Finally we plot the total physical footprint (number of qubits) of all quantum search machines (CPUs) running in parallel 
\end{enumerate}

In the following sections we proceed to analyze symmetric ciphers (AES, Sec ~\ref{sct::ciphers}), hash functions (SHA-256, SHA3-256, Sec ~\ref{sct::hash}, Bitcoin's hash function, Sec ~\ref{sct::bitcoin}), and finally the minimal resources required for running Grover's algorithm with a trivial oracle~\ref{sct::intrinsic_parallel_grover} (e g  the identity gate) on search spaces of various sizes 

Note that in some ranges of the plots from sections~\ref{sct::ciphers},~\ref{sct::hash},~\ref{sct::intrinsic_parallel_grover} and~\ref{sct::bitcoin} the total physical footprint increases slightly with the number of processors, which may seem counter-intuitive  This happens due to the fact that with more processors the required code distances decrease, and in some instances one can pipeline more magic states factories in parallel into the surface code, which in effect causes an increase in the overall physical footprint  Note that the total time per CPU is monotonically decreasing, as parallelizing distilleries does not increase the wall time  For more details see~\cite{10 1007/978-3-319-69453-5_18}  

\subsection{Public-key cryptography\label{sct::pk}}

Most of the recent progress in quantum cryptanalysis is related to the fault-tolerant layer in Fig ~\ref{fgr:flowchart_lite}  New methods and techniques
based on surface code lattice surgery~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} allow a significant decrease of the overall 
footprint (number of qubits, or space) taken by the quantum computation, and also a relatively modest decrease in time, in comparison with  methods based on surface code defects and braiding~\cite{PhysRevA 86 032324,Fowler:2013aa} 

We consider the best up-to-date optimized logical quantum circuits for attacking RSA and ECC public-key 
schemes~\cite{1706 06752,PhysRevA 52 3457,cuccaro04,Beauregard:2003:CSA:2011517 2011525} then perform a physical footprint resource estimation
analysis using lattice surgery techniques  We remark that the overall time required to run the algorithm depends on the level of parallelization 
for the magic state factories\footnote{Every T gate in the circuit must be implemented by a specialized magic state factory, each of which occupies a 
significant physical footprint  One can implement more magic states in parallel if one is willing to increase the physical footprint of the computation }  

For each public-key cryptogrpric scheme, we analyze the space/time tradeoffs and plot the results on a double logarithmic scale  We fit the data using a third degree 
polynomial\footnote{A third degree polynomial fits the data very precisely, providing a coefficient of determination $R^2$ greater than 0 997 } and obtain an analytical closed-form formula for the relation between the time and the number of qubits required to attack the scheme, in 
the form

\begin{equation}\label{eqn1}
y(x) = \alpha x^3 + \beta x^2 + \gamma x + \delta,
\end{equation}
where $y$ represents logarithm base 2 of the number of qubits and $x$ represents the logarithm base 2 of the time (in seconds)  For example,
the quantity 
\begin{equation}\label{eqn2}
y\left(\log_2(24\times 3600)\right) \approx y(16 3987)
\end{equation}
represents how many qubits are required to break the scheme in one day (24 hours) for a fixed physical error rate per gate $p_g$, assuming a 
surface code cycle time of 200ns  Note that the computation time scales linearly with the surface code cycle time, e g  a 1000ns surface code cycle 
time will result in a computation that is 5 times longer than a $200ns$ surface code cycle time  Therefore, for a specific cryptographic scheme for 
which we plotted the space/time tradeoffs using a surface code cycle time of $200ns$ and a fixed physical error rate per gate $p_g$, the number of 
qubits required to break a specific scheme in a time $t$ using an alternative surface code cycle time $t_c$ is given by

\begin{equation}\label{eqn3}
y\left(\log_2\left(\frac{200ns}{t_c}t\right)\right),
\end{equation}
where $t$ is expressed in seconds and $t_c$ is expressed in nanoseconds 

We assume a surface code cycle time of 200ns, in conformance with~\cite{PhysRevA 86 032324}  For each scheme we analyze, we compare its security using the more conservative (and realistic in the short term) $p_g=10^{-3}$ and also the more optimistic  $p_g=10^{-5}$  Note that assuming the more optimistic assumption from a quantum computing perspective is the more conservative assumption from a cybersecurity perspective 

Furthermore, in this analysis, we are reporting the full physical footprint, including the memory required for magic state distillation 
Using present-day techniques, the memory required for generating these generic input states accounts for a substantial fraction of the total memory cost and thus we are including these in the total cost estimate and will track the impact of improved methods 

\section{Symmetric ciphers\label{sct::ciphers}}
Below we analyze the security of AES family of symmetric ciphers against large-scale fault-tolerant quantum adversaries  We used the highly optimized logical circuits produced in
\cite{10 1007/978-3-319-29360-8_3}  

\subsection{AES-128}

        \includegraphics[width=0 429\textwidth]{figures/AES-128_cycles pdf}
      	\captionof{figure}{AES-128 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale)  The bottom brown line (theoretical lower bound, black box) represents the minimal number of queries required
	by Grover's algorithm, the cost function being the total number of queries to a black-box oracle, each query assumed to have unit cost, and a completely error-free circuit  The purple line (ideal grover, non-black-box) takes into consideration the structure of the oracle, the cost function being the total number of gates in the circuit, each gate having unit cost; the quantum circuit is assumed error-free as well  Both brown and magenta lines are displayed only for comparisons; for both of them, the $y$ axis should be interpreted as number of logical queries (operations, respectively) 	
The curves above the purple line show the overhead introduced by fault tolerance (in terms of required surface code cycles, each surface code cycle assumed to have unit cost)  More optimization at the logical layer will shift the purple line down, whereas more optimization at the fault-tolerant layer will move the upper curves closer to the purple line  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_cycles}
	
	For example, the plots in Fig ~\ref{fgr:aes_128_cycles} tells us that if we have $2^{50}$ quantum computers running Grover's algorithm in parallel, with no physical errors, then it would take about $2^{63}$ gate calls (where the purple line intersects the vertical line at $50$), where we assume each gate to have unit cost  Still with no errors, a trivial cost for implementing the cryptographic function (oracle) would bring the cost down to about $2^{38}$ oracle calls per quantum computer  Keeping the actual function implementation, but adding the fault-tolerant layer with a physical error rate of $10^{-7}$ (with appropriate assumptions and using state-of-the-art quantum error correction) pushes the cost up to around $2^{76}$ surface code cycles per quantum computer (where now each code cycle is assumed to have unit cost)  Similar remarks hold for the remaining plots in this manuscript 
        \includegraphics[width=0 429\textwidth]{figures/AES-128_time pdf}
      	\captionof{figure}{AES-128 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The horizontal dotted line indicates one year  The $x$-axis is deliberately extended to show the necessary number of CPUs for a total time of one year  Thus the figure shows that it would take, with the stated assumptions, over $2^{80}$ parallel quantum searches to break AES-128 in a year  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_time}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys pdf}
	\captionof{figure}{AES-128 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys_total pdf}
	\captionof{figure}{AES-128 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_128_phys_total}

\subsection{AES-192}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_cycles pdf}
      	\captionof{figure}{AES-192 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_time pdf}
      	\captionof{figure}{AES-192 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys pdf}
	\captionof{figure}{AES-192 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys_total pdf}
	\captionof{figure}{AES-192 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_192_phys_total}


\subsection{AES-256}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_cycles pdf}
      	\captionof{figure}{AES-256 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_time pdf}
      	\captionof{figure}{AES-256 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys pdf}
	\captionof{figure}{AES-256 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys_total pdf}
	\captionof{figure}{AES-256 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_256_phys_total}

\section{Hash functions\label{sct::hash}}
In this section we study the effect of parallelized Grover attacks on the SHA-256~\cite{SHA2} snd SHA3-256~\cite{SHA3} family of hash functions  We used the highly optimized logical circuits produced in~\cite{10 1007/978-3-319-69453-5_18} 

\subsection{SHA-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA-256_cycles pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_time pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys_total pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_phys_total}


\subsection{SHA3-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_cycles pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_time pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys_total pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha3_256_phys_total}
\section{Bitcoin~\label{sct::bitcoin}}
In this section we analyze the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work protocol, which is based on finding a hash\footnote{The hash function being used by the protocol is H($x$) := SHA-256(SHA-256($x$) } pre-image which that starts
with a certain number of zeros  The latter is dynamically adjusted by the protocol so that the problem is on average solved by
the whole network in 10 minutes  Currently, it takes around $2^{75}$ classical hashing operations~\cite{btc_difficulty} for finding a desired hash pre-image successfully via brute-force search with specialized hardware 
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_cycles pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_time pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys_total pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_bitcoin_phys_total}


\section{Intrinsic cost of parallelized Grover's algorithm\label{sct::intrinsic_parallel_grover}}

More efficient quantum implementations of AES and SHA imply more efficient cryptanalysis  In this section, we aim to bound how much further optimized implementations of these cryptographic functions could help  We do so by assuming a trivial cost of $1$ for each function evaluation 

\subsection{Searching space of size $2^{56}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The dotted horizontal line indicates one year  }
      	\label{fgr:minimal_grover_56_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_56_phys_total}

\subsection{Searching space of size $2^{64}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_64_phys_total}

\subsection{Searching space of size $2^{128}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_128_phys_total}


\subsection{Searching space of size $2^{256}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_time pdf}
      	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys_total pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_256_phys_total}


\section{RSA schemes\label{sct::rsa}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on factoring large numbers, 
namely RSA-1024, RSA-2048, RSA-3072, RSA-4096, RSA-7680 and RSA-15360 
For each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively 

\subsection{RSA-1024}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 01\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $5 86\times 10^{13}$  The quantity $R^2$ represents the coefficient of determination (closer to 1, better the fitting)  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024a} 

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 14\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $2 93\times 10^{13}$  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024b}


\subsection{RSA-2048}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 72\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $4 69\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048a}



\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 9 78\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $2 35\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048b}


\subsection{RSA-3072}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 41\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $1 58\times 10^{15}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 55\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $7 91\times 10^{14}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072b}


\subsection{RSA-4096}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 18\times 10^9$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $3 75\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 5 70\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $1 88\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096b}


\subsection{RSA-7680}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 70\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 64\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 41\times 10^{9}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 47\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680b}


\subsection{RSA-15360}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 85\times 10^{12}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $2 24\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 64\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $1 98\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360b}


\section{Elliptic curve schemes\label{sct::ecc}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on solving the discrete logarithm 
problem in finite groups generated over elliptic curves, namely NIST P-160, NIST P-192, NIST P-224, NIST P-256, NIST P-384 and NIST P-521  For 
each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively  We 
used the logical circuits from~\cite{1706 06752} 

\subsection{NIST P-160}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 81\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $4 05\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 38\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $2 03\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160b}


\subsection{NIST P-192}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 37\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $7 23\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 18\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $3 62\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192b}


\subsection{NIST P-224}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 91\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $1 15\times 10^{14}$  The classical security parameter is 112 bits }
\label{fgr:p224a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 24\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $5 75\times 10^{13}$  The classical security parameter is 112 bits }
\label{fgr:p224b}


\subsection{NIST P-256}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 77\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $1 72\times 10^{14}$  The classical security parameter is 128 bits }
\label{fgr:p256a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 64\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $8 60\times 10^{13}$  The classical security parameter is 128 bits }
\label{fgr:p256b}


\subsection{NIST P-384}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 27\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $6 17\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 28\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $3 08\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384b}

\subsection{NIST P-521}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 06\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $1 56\times 10^{15}$  The classical security parameter is 256 bits }
\label{fgr:p521a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 30\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $7 78\times 10^{14}$  The classical security parameter is 256 bits }
\label{fgr:p521b}




\section{Summary and conclusions}\label{sct::conclusion}
We analyzed the security of several widely used symmetric ciphers and hash functions against parallelized quantum adversaries  We computed the security parameter, wall-time and physical footprint for each cryptographic primitive  Our attack model was based on a brute force searching via a parallelized version of Grover's algorithm, assuming a surface-code fault-tolerant architecture based on defects and braiding techniques 

It is worth noting that throughout we are assuming that brute-force search where we treat the cryptographic function as a black-box is essentially the optimal attack against SHA and AES, which is currently believed to be the case 

Some symmetric key algorithms are susceptible in a model that permits ``superposition attacks''~\cite{quantph 1602 05973}  In most realistic instances, these attacks are not practical, however they do shed light on the limitations of certain security proof methods in a quantum context, and remind us that we shouldn't take for granted that non-trivial attacks on symmetric key cryptography may be possible 
For example, very recently, there have been several cryptanalysis results~\cite{1712 06239} and~\cite{1802 03856} that attempt to reduce breaking some symmetric algorithms to solving a system of non-linear equations   Solving these non-linear equations is then attacked using a modified version of the quantum linear equation solver algorithm~\cite{PhysRevLett 103 150502}  The results are heavily dependent on the condition number of the non-linear system, which turns to be hard to compute (it is not known for most ciphers and hash functions such as AES or SHA)  Provided the condition number is relatively small, then one may get an  advantage compared to brute-force Grover search  However at this time it is not clear whether this is indeed the case, and we do not have large-scale quantum computers to experiment with 

The quantum security parameter (based on our assumptions of using state-of-the-art algorithms and fault-tolerance methods) for symmetric and hash-based cryptographic schemes is summarized in Table~\ref{tbl1}  For more details about space/time tradeoffs achievable via parallelization of Grover's algorithm please see the corresponding Sec ~\ref{sct::ciphers}, Sec ~\ref{sct::hash} and Sec ~\ref{sct::bitcoin}, respectively 
\begin{table}[h!]
\begin{tabular}{ll}
\hline
Name    & qs  \\
\hline
AES-128 & 106 \\
AES-192 & 139 \\
AES-256 & 172 \\
\hline
SHA-256 & 166 \\
SHA3-256	 &167 \\
Bitcoin's PoW & 75\\
\hline
\end{tabular}
\caption{Quantum security parameter ($qs$) for the AES family of ciphers, SHA family of hash functions, and Bitcoin, assuming a conservative physical error rate per gate $p_g=10^{-4}$ }
\label{tbl1}
\end{table}

We also analyzed the security of asymmetric (public-key) cryptography, in particular RSA and ECC, in the light of new improvements in fault-tolerant 
quantum error correction based on surface code lattice surgery techniques  We computed the space/time tradeoff required to attack 
every scheme, using physical error rates of $10^{-3}$ and $10^{-5}$, respectively  We fitted the data with a third degree polynomial, which resulted in an analytical formula of the number of qubits required to break the 
scheme as a function of time 

The total number of physical qubits required to break the RSA schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in Table~\ref{tbl2}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::rsa} of the manuscript 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name      & nq                    & Tc                    & scc           & s        \\
\hline
RSA-1024  & $3 01 \times 10^7$    & $3 01 \times 10^{11}$ & $5 86 \times 10^{13}$ & 80\\
RSA-2048  & $1 72 \times 10^8$    & $2 41 \times 10^{12}$ & $4 69 \times 10^{14}$ & 112\\
RSA-3072  & $6 41 \times 10^8$    & $8 12 \times 10^{12}$ & $1 58 \times 10^{15}$ & 128\\
RSA-4096  & $1 18 \times 10^9$    & $1 92 \times 10^{13}$ & $3 75 \times 10^{15}$ & 156\\
RSA-7680  & $7 70 \times 10^{10}$ & $1 27 \times 10^{14}$ & $2 64 \times 10^{16}$ & 192\\
RSA-15360 & $4 85 \times 10^{12}$ & $1 01 \times 10^{15}$ & $2 24 \times 10^{17}$ & 256\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the RSA schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$) 
We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl2}
\end{table}

The total number of physical qubits required to break the ECC schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in in Table~\ref{tbl3}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::ecc} of the manuscript  As observed before in~\cite{1706 06752}, breaking RSA schemes demands more quantum resources in comparison with elliptic curve-based schemes, for the same level of classical security 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name  & nq                 & Tc                    & scc          & s          \\
\hline
P-160 & $1 81 \times 10^7$ & $2 08 \times 10^{11}$ & $4 05 \times 10^{13}$ & 80\\
P-192 & $3 37 \times 10^7$ & $3 71 \times 10^{11}$ & $7 23 \times 10^{13}$ & 96\\
P-224 & $4 91 \times 10^7$ & $5 90 \times 10^{11}$ & $1 15 \times 10^{14}$ & 112\\
P-256 & $6 77 \times 10^7$ & $8 82 \times 10^{11}$ & $1 72 \times 10^{14}$ & 128\\
P-384 & $2 27 \times 10^8$ & $3 16 \times 10^{12}$ & $6 17 \times 10^{14}$ & 192\\
P-521 & $6 06 \times 10^8$ & $7 92 \times 10^{12}$ & $1 56 \times 10^{15}$ & 260\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the ECC schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$)  We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl3}
\end{table}

Recent developments in the theory of fault-tolerant quantum error correction have great impact on evaluating the effective strength of cryptographic
schemes against quantum attacks, as the fault-tolerant layer of a quantum computation is the most resource-intensive part of running a quantum  
algorithm  Therefore, monitoring the advances in the theory of quantum error correction is of crucial importance when estimating the strength (or 
weakness) of a cryptographic scheme against a quantum adversary  This work serves as a benchmark against which the impact of future advances can be compared 

\begin{acknowledgments} 
Most of this work is based on research supported by the Global Risk Institute for its members 
We also acknowledge support from NSERC and CIFAR  IQC and the Perimeter Institute are supported in part by the 
Government of Canada and the Province of Ontario   Vlad Gheorghiu thanks Austin Fowler for helpful discussions 
and clarifications regarding lattice surgery methods 
\end{acknowledgments}

\bibliographystyle{aipnum4-1}


Context 3: Paper Info

Title: Crossed Nonlinear Dynamical Hall Effect in Twisted Bilayers
Publish Date: 17 Mar 2023
Author List: 

Figure

FIG  1 (a) Schematics of experimental setup (b, c) Valence band structure and intrinsic Hall conductivity with respect to in-plane input for tMoTe2 at twist angles (b) θ = 1 2 • and (c) θ = 2 • in +K valley Color coding in (b) and (c) denotes the layer composition σ z n (k) 
FIG  2  (a) The interlayer BCP G, and (b) its vorticity [∂ k × G]z on the first valence band from +K valley of 1 2 • tMoTe2 Background color and arrows in (a) denote the magnitude and vector flow, respectively Grey curves in (b) show energy contours at 1/2 and 3/4 of the band width The black dashed arrow denotes direction of increasing hole doping level Black dashed hexagons in (a, b) denote the boundary of moiré Brillouin zone (mBZ) 
FIG  3  (a-c) Three high-symmetry stacking registries for tBG with a commensurate twist angle θ = 21 8 •  Lattice geometries with rotation center on an overlapping atomic site (a, b) and hexagonal center (c) (d) Schematic of the moiré pattern when the twist angle slightly deviates from 21 8 • , here θ = 21 •  Red squares marked by A, B and C are the local regions that resemble commensurate 21 8 • patterns in (a), (b) and (c), respectively (e, f) Low-energy band structures and intrinsic Hall conductivity of the two geometries [(a) and (b) are equivalent] The shaded areas highlight energy windows ∼ ω around band degeneracies where interband transitions, not considered here, may quantitatively affect the conductivity measured 
FIG  S4 Band structure and layer composition σ z n in +K valley of tBG (left panel) and the intrinsic Hall conductivity (right panel) at three different twist angle θ The shaded areas highlight energy windows ∼ ω around band degeneracies in which the conductivity results should not be considered Here σH should be multiplied by a factor of 2 accounting for spin degeneracy 

abstract

We propose an unconventional nonlinear dynamical Hall effect characteristic of twisted bilayers  The joint action of in-plane and out-of-plane ac electric fields generates Hall currents j ∼ Ė⊥ × E in both sum and difference frequencies, and when the two orthogonal fields have common frequency their phase difference controls the on/off, direction and magnitude of the rectified dc Hall current 
This novel intrinsic Hall response has a band geometric origin in the momentum space curl of interlayer Berry connection polarizability, arising from layer hybridization of electrons by the twisted interlayer coupling  The effect allows a unique rectification functionality and a transport probe of chiral symmetry in bilayer systems 
We show sizable effects in twisted homobilayer transition metal dichalcogenides and twisted bilayer graphene over broad range of twist angles  Nonlinear Hall-type response to an in-plane electric field in a two dimensional (2D) system with time reversal symmetry has attracted marked interests   Intensive studies have been devoted to uncovering new types of nonlinear Hall transport induced by quantum geometry and their applications such as terahertz rectification and magnetic information readout  
Restricted by symmetry , the known mechanisms of nonlinear Hall response in quasi-2D nonmagnetic materials are all of extrinsic nature, sensitive to fine details of disorders , which have limited their utilization for practical applications  Moreover, having a single driving field only, the effect has not unleashed the full potential of nonlinearity for enabling controlled gate in logic operation, where separable inputs (i e , in orthogonal directions) are desirable 
The latter, in the context of Hall effect, calls for control by both out-of-plane and in-plane electric fields  A strategy to introduce quantum geometric response to out-of-plane field in quasi-2D geometry is made possible in van der Waals (vdW) layered structures with twisted stacking   Taking homobilayer as an example, electrons have an active layer degree of freedom that is associated with an out-of-plane electric dipole , whereas interlayer quantum tunneling rotates this pseudospin about in-plane axes that are of topologically nontrivial textures in the twisted landscapes  
Such layer pseudospin structures can underlie novel quantum geometric properties when coupled with out-ofplane field  Recent studies have found layer circular photogalvanic effect and layer-contrasted time-reversaleven Hall effect , arising from band geometric quantities  In this work we unveil a new type of nonlinear Hall effect in time-reversal symmetric twisted bilayers, where an intrinsic Hall current emerges under the combined action of an in-plane electric field E and an out-of-plane ac field E ⊥ (t): j ∼ Ė⊥ × E [see Fig  ] 
Having the two driving fields (inputs) and the current response (output) all orthogonal to each other, the effect is dubbed as the crossed nonlinear dynamical Hall effect  This is also the first nonlinear Hall contribution of an intrinsic nature in nonmagnetic materials without external magnetic field, determined solely by the band structures, not relying on extrinsic factors such as disorders and relaxation times 
The effect arises from the interlayer hybridization of electronic states under the chiral crystal symmetry characteristic of twisted bilayers, and has a novel band geometric origin in the momentum space curl of interlayer Berry connection polarizability (BCP)  Having two driving fields of the same frequency, a dc Hall current develops, whose on/off, direction and magnitude can all be controlled by the phase difference of the two fields, which does not affect the magnitude of the double-frequency component 
Such a characteristic tunability renders this effect a unique approach to rectification and transport probe of chiral bilayers  As examples, we show sizable effects in small angle twisted transition metal dichalcogenides (tTMDs) and twisted bilayer graphene (tBG), as well as tBG of large angles where Umklapp interlayer tunneling dominates 
Geometric origin of the effect  A bilayer system couples to in-plane and out-of-plane driving electric fields in completely different ways  The in-plane field couples to the 2D crystal momentum, leading to Berry-phase effects in the 2D momentum space   In comparison, the outof-plane field is coupled to the interlayer dipole moment p in the form of −E ⊥ p, where p = ed 0 σz with σz as the Pauli matrix in the layer index subspace and d 0 the interlayer distance 
When the system has a more than twofold rotational axis in the z direction, as in tBG and tTMDs, any in-plane current driven by the out-of-plane field alone is forbidden  It also prohibits the off-diagonal components of the symmetric part of the conductivity tensor σ ab = ∂j a /∂E ||,b with respect to the in-plane input and output 
Since the antisymmetric part of σ ab is not allowed by the Onsager reciprocity in nonmagnetic systems, all the off-diagonal components of σ ab is forbidden, irrespective of the order of out-of-plane field  On the other hand, as we will show, an in-plane Hall conductivity σ xy = −σ yx can still be driven by the product of an in-plane field and the time variation rate of an outof-plane ac field, which is a characteristic effect of chiral bilayers 
To account for the effect, we make use of the semiclassical theory   The velocity of an electron in a bilayer system is given by where k is the 2D crystal momentum  Here and hereafter we suppress the band index for simplicity, unless otherwise noted  The three contributions in this equation come from the band velocity, the anomalous velocities induced by the k -space Berry curvature Ω k and by the hybrid Berry curvature Ω kE ⊥ in the (k, E ⊥ ) space 
For the velocity at the order of interest, the k-space Berry curvature is corrected to the first order of the variation rate of out-of-plane field Ė⊥ as Here A = u k |i∂ k |u k is the unperturbed k-space Berry connection, with |u k being the cell-periodic part of the Bloch wave, whereas is its gauge invariant correction , which can be identified physically as an in-plane positional shift of an electron induced by the time evolution of the out-of-plane field 
For a band with index n, we have whose numerator involves the interband matrix elements of the interlayer dipole and velocity operators, and ε n is the unperturbed band energy  Meanwhile, up to the first order of in-plane field, the hybrid Berry curvature reads Here A E || is the k-space Berry connection induced by E || field , which represents an intralayer positional shift and whose detailed expression is not needed for our purpose 
and is its first order correction induced by the in-plane field  In addition, ε = ε + δε, where δε = eE • G Ė⊥ is the field-induced electron energy   Given that A E || is the E ⊥ -space counterpart of intralayer shift A E || , and that E ⊥ is conjugate to the interlayer dipole moment, we can pictorially interpret A E || as the interlayer shift induced by in-plane field 
It indeed has the desired property of flipping sign under the horizontal mirror-plane reflection, hence is analogous to the so-called interlayer coordinate shift introduced in the study of layer circular photogalvanic effect , which is nothing but the E ⊥ -space counterpart of the shift vector well known in the nonlinear optical phenomenon of shift current 
Therefore, the E ⊥ -space BCP eG/ can be understood as the interlayer BCP  This picture is further augmented by the connotation that the interlayer BCP is featured exclusively by interlayer-hybridized electronic states: According to Eq  ( ), if the state |u n is fully polarized in a specific layer around some momentum k, then G (k) is suppressed 
With the velocity of individual electrons, the charge current density contributed by the electron system can be obtained from where [dk] is shorthand for n d 2 k/(2π) 2 , and the distribution function is taken to be the Fermi function f 0 as we focus on the intrinsic response  The band geometric contributions to ṙ lead to a Hall current
where is intrinsic to the band structure  This band geometric quantity measures the k-space curl of the interlayer BCP over the occupied states, and hence is also a characteristic of layer-hybridized electronic states  Via an integration by parts, it becomes clear that χ int is a Fermi surface property 
Since χ int is a time-reversal even pseudoscalar, it is invariant under rotation, but flips sign under space inversion, mirror reflection and rotoreflection symmetries  As such, χ int is allowed if and only if the system possesses a chiral crystal structure, which is the very case of twisted bilayers  
Moreover, since twisted structures with opposite twist angles are mirror images of each other, whereas the mirror reflection flips the sign of χ int , the direction of Hall current can be reversed by reversing twist direction  Hall rectification and frequency doubling  This effect can be utilized for the rectification and frequency doubling of an in-plane ac input E = E 0 cos ωt, provided that the out-of-plane field has the same frequency, namely E ⊥ = E 0 ⊥ cos (ωt + ϕ) 
The phase difference ϕ between the two fields plays an important role in determining the Hall current, which takes the form of j = j 0 sin ϕ + j 2ω sin(2ωt + ϕ)  ( Here ω is required to be below the threshold for direct interband transition in order to validate the semiclassical treatment, and σ H has the dimension of conductance and quantifies the Hall response with respect to the in-plane input 
In experiment, the Hall output by the crossed nonlinear dynamic Hall effect can be distinguished readily from the conventional nonlinear Hall effect driven by in-plane field alone, as they are odd and even, respectively, in the inplane field  One notes that while the double-frequency component appears for any ϕ, the rectified output is allowed only if the two crossed driving fields are not in-phase or antiphase 
Its on/off, chirality (right or left), and magnitude are all controlled by the phase difference of the two fields  Such a unique tunability provides not only a prominent experimental hallmark of this effect, but also a controllable route to Hall rectification  In addition, reversing the direction of the out-of-plane field switches that of the Hall current, which also serves as a control knob 
Application to tTMDs  We now study the effect quantitatively in tTMDs, using tMoTe 2 as an example (see details of the continuum model in )  For illustrative purposes, we take ω/2π = 0 1 THz and E 0 ⊥ d 0 = 10 mV in what follows  Figures ) and (c) present the electronic band structures along with the layer composition σ z n (k) at twist angles θ = 1 2 • and θ = 2 •  
In both cases, the energy spectra exhibit isolated narrow bands with strong layer hybridization  At θ = 1 2 • , the conductivity shows two peaks ∼ 0 1e 2 /h at low energies associated with the first two valence bands  The third band does not host any sizable conductivity signal  At higher hole-doping levels, a remarkable conductivity peak ∼ e 2 /h appears near the gap separating the fourth and fifth bands 
At θ = 2 • , the conductivity shows smaller values, but the overall trends are similar: A peak ∼ O(0 01)e 2 /h appears at low energies, while larger responses ∼ O(0 1)e 2 /h can be spotted as the Fermi level decreases  One can understand the behaviors of σ H from the interlayer BCP in Eq  ( )  It favors band near-degeneracy regions in k -space made up of strongly layer hybridized electronic states 
As such, the conductivity is most pro- nounced when the Fermi level is located around such regions, which directly accounts for the peaks of response in Fig  that [∂ k × G] z is negligible at lower energies, and it is dominated by positive values as the doping increases, thus the conductivity rises initially 
When the doping level is higher, regions with [∂ k × G] z < 0 start to contribute, thus the conductivity decreases after reaching a maximum  Application to tBG  The second example is tBG  We focus on commensurate twist angles in the large angle limit in the main text , which possess moiré-lattice assisted strong interlayer tunneling via Umklapp processes  
This case is appealing because the Umklapp interlayer tunneling is a manifestation of discrete translational symmetry of moiré superlattice, which is irrelevant at small twist angles and not captured by the continuum model but plays important roles in physical contexts such as higher order topological insulator and moiré excitons  
The Umklapp tunneling is strongest for the commensurate twist angles of θ = 21 8 • and θ = 38 2 • , whose corresponding periodic moiré superlattices have the smallest lattice constant ( √ 7 of the monolayer counterpart)  Such a small moiré scale implies that the exact crystalline symmetry, which depends sensitively on fine details of rotation center, has critical influence on lowenergy response properties 
To capture the Umklapp tunneling, we employ the tight-binding model   Figures ) and (c) show two distinct commensurate structures of tBG at θ = 21 8 • belonging to chiral point groups D 3 and D 6 , respectively  The atomic configurations in Figs  ) are equivalent, which are constructed by twisting AA-stacked bilayer graphene around an overlapping atom site, and that in Fig  ) is obtained by rotating around a hexagonal center 
Band structures of these two configurations are drastically different within a low-energy window of ∼ 10 meV around the κ point   Remarkably, despite large θ, we still get σ H ∼ O(0 001) e 2 /h (D 3 ) and ∼ O(0 1) e 2 /h (D 6 ), which are comparable to those at small angles (cf  Fig  in the Supplemental Material ) 
Such sizable responses can be attributed to the strong interlayer coupling enabled by Umklapp processes   Apart from different intensities, the Hall conductivities in the two stacking configurations have distinct energy dependence: In Fig  , σ H shows a single peak centered at zero energy; In Fig  (f), it exhibits two antisymmetric peaks around zero 
The peaks are centered around band degeneracies, and their profiles can be understood from the distribution of [∂ k × G] z   Figure (d) illustrates the atomic structure of tBG with a twist angle slightly deviating from θ = 21 8 • , forming a supermoiré pattern  In short range, the local stacking geometries resemble the commensurate configurations at θ = 21 8 • , while the stacking registries at different locales differ by a translation 
Similar to the moiré landscapes in the small-angle limit, there also exist high-symmetry locales: Regions A and B enclose the D 3 structure, and region C contains the D 6 configuration  Position-dependent Hall response is therefore expected in such a supermoiré  As the intrinsic Hall signal from the D 6 configuration dominates [see Figs 
3(e) vs (f)], the net response mimics that in Fig    Discussion  We have uncovered the crossed nonlinear dynamical intrinsic Hall effect characteristic of layer hybridized electronic states in twisted bilayers, and elucidated its geometric origin in the k -space curl of interlayer BCP  It offers a new tool for rectification and frequency doubling in chiral vdW bilayers, and is sizable in tTMD and tBG 
Here our focus is on the intrinsic effect, which can be evaluated quantitatively for each material and provides a benchmark for experiments  There may also be extrinsic contributions, similar to the side jump and skew scattering ones in anomalous Hall effect  They typically have distinct scaling behavior with the relaxation time τ from the intrinsic effect, hence can be distinguished from the latter in experiments  
Moreover, they are suppressed in the clean limit ωτ 1 [(ωτ ) 2 1, more precisely]   In high-quality tBG samples, τ ∼ ps at room temperature   Much longer τ can be obtained at lower temperatures  In fact, a recent theory explaining well the resistivity of tBG predicted τ ∼ 10 −8 s at 10 K   As such, high-quality tBG under low temperatures and sub-terahertz input (ω/2π = 0 1 THz) is located in the clean limit, rendering an ideal platform for isolating the intrinsic effect 
This work paves a new route to driving in-plane response by out-of-plane dynamical control of layered vdW structures   The study can be generalized to other observables such as spin current and spin polarization, and the in-plane driving can be statistical forces, like temperature gradient  Such orthogonal controls rely critically on the nonconservation of layer pseudospin degree of freedom endowed by interlayer coupling, and constitute an emerging research field at the crossing of 2D vdW materials, layertronics, twistronics and nonlinear electronics 
This work is supported by the Research Grant Council of Hong Kong (AoE/P-701/20, HKU SRFS2122-7S05), and the Croucher Foundation  W Y  also acknowledges support by Tencent Foundation  Cong Chen, 1, 2, * Dawei Zhai, 1, 2, * Cong Xiao, 1, 2, † and Wang Yao 1, 2, ‡ 1 Department of Physics, The University of Hong Kong, Hong Kong, China 2 HKU-UCAS Joint Institute of Theoretical and Computational Physics at Hong Kong, China Extra figures for tBG at small twist angles Figure (a) shows the band structure of tBG with θ = 1 47 • obtained from the continuum model  
The central bands are well separated from higher ones, and show Dirac points at κ/κ points protected by valley U (1) symmetry and a composite operation of twofold rotation and time reversal C 2z T   Degeneracies at higher energies can also be identified, for example, around ±75 meV at the γ point  As the two Dirac cones from the two layers intersect around the same area, such degeneracies are usually accompanied by strong layer hybridization [see the color in the left panel of Fig  ] 
Additionally, it is well-known that the two layers are strongly coupled when θ is around the magic angle (∼ 1 08 • ), rendering narrow bandwidths for the central bands  As discussed in the main text, coexistence of strong interlayer hybridization and small energy separations is expected to contribute sharp conductivity peaks near band degeneracies, as shown in Fig   
In this case, the conductivity peak near the Dirac point can reach ∼ 0 1e 2 /h, while the responses around ±0 08 eV are smaller at ∼ 0 01e 2 /h  The above features are maintained when θ is enlarged, as illustrated in Figs  ) and (c) using θ = 2 65 • and θ = 6 01 •   Since interlayer coupling becomes weaker and the bands are more separated at low energies when θ increases, intensity of the conductivity drops significantly 
We stress that G is not defined at degenerate points, and interband transitions may occur when energy separation satisfies |ε n − ε m | ∼ ω, the effects of which are not included in the current formulations  Consequently, the results around band degeneracies within energy ∼ ω [shaded areas in Fig  ] should be excluded 



ground_truth: The longerons bow up from the building surface, forming a "banana" shape.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the security parameter for the AES-256 block cipher?

Read the following text and answer briefly.

Context 4: Sir Simon William English  (born 30 December 1961) is a New Zealand former National Party politician who served as the 39th prime minister of New Zealand from 2016 to 2017  He had previously served as the 17th deputy prime minister of New Zealand and minister of finance from 2008 to 2016 under John Key and the Fifth National Government 

A farmer and public servant before entering politics, English was elected to the New Zealand Parliament in  as the National Party's candidate in the Wallace electorate  He was elevated to Cabinet in 1996 and in 1999 was made minister of finance, although he served for less than a year due to his party's loss at the 1999 general election  In October 2001, English replaced Jenny Shipley as the leader of the National Party (and consequently as Leader of the Opposition)  He led the party to its worst defeat at the 2002 general election, and as a consequence, in October 2003 he was replaced as leader by Don Brash 

In November 2006, after Brash's resignation, English became deputy leader under John Key  After National's victory at the 2008 general election, he became deputy prime minister and was also made minister of finance for the second time  Under English's direction New Zealand's economy maintained steady growth during National's three terms of government  He became a list-only MP after stepping down as an electorate MP at the 2014 general election 

John Key resigned as leader of the National Party and prime minister in December 2016  English won the resulting leadership election unopposed and was sworn in as prime minister on 12 December 2016  His tenure was only ten months, and included a three-month election campaign  In the 2017 general election, National won the largest number of seats but fell short of a majority  The parties holding the balance of power declined to support the existing government, and English was subsequently replaced as prime minister by Jacinda Ardern, leader of the Labour Party  English initially continued on as Leader of the Opposition, but resigned as leader of the National Party on 27 February 2018 and left parliament two weeks later 

Early life
English was born on 30 December 1961 at Lumsden Maternity Centre in Lumsden  He is the eleventh of twelve children of Mervyn English and Norah (née O'Brien) English  His parents purchased Rosedale, a mixed sheep and cropping farm in Dipton, Southland from Mervyn's uncle, Vincent English, a bachelor, in 1944  English was born in the maternity unit at Lumsden 

English attended St Thomas's School in Winton, then boarded at St  Patrick's College in Upper Hutt, where he became head boy  He played in the first XV of the school's rugby team  English went on to study commerce at the University of Otago, where he was a resident at Selwyn College, and then completed an honours degree in English literature at Victoria University of Wellington 

After finishing his studies, English returned to Dipton and farmed for a few years  From 1987 to 1989, he worked in Wellington as a policy analyst for the New Zealand Treasury, at a time when the free market policies favoured by Labour's finance minister Roger Douglas (known collectively as "Rogernomics") were being implemented 

English joined the National Party in 1980, while at Victoria University  He served for a period as chairman of the Southland branch of the Young Nationals, and became a member of the Wallace electorate committee  After moving to Wellington, he served for periods on the Island Bay and Miramar electorate committees, respectively 

Fourth National Government (1990–1999)

At the 1990 general election, English stood as the National candidate in Wallace, replacing the retiring Derek Angus, and was elected with a large majority  He would hold this seat, renamed Clutha-Southland in 1996, until 2014  He and three other newly elected National MPs (Tony Ryall, Nick Smith, and Roger Sowry) were soon identified as rising stars in New Zealand politics, and at various points were dubbed the "brat pack", the "gang of four", and the "young Turks"  In his first term in parliament, English chaired a select committee into social services  He was made a parliamentary under-secretary in 1993, serving under the Minister of Health 

First period in cabinet (1996–1999)
In early 1996, English was elevated to cabinet by Prime Minister Jim Bolger, becoming the Minister for Crown Health Enterprises and Associate Minister of Education (to Wyatt Creech)  He was 34 at the time, becoming the cabinet's youngest member  After the 1996 general election, the National Party was forced into a coalition with New Zealand First to retain government  In the resulting cabinet reshuffle, English emerged as Minister of Health  However, as a condition of the coalition agreement, NZ First's Neil Kirton (a first-term MP) was made Associate Minister of Health, effectively becoming English's deputy  This arrangement was described in the press as a "shotgun marriage", and there were frequent differences of opinion between the two ministers  After their relationship became unworkable, Kirton was sacked from the role in August 1997, with the agreement of NZ First leader Winston Peters 

As Minister of Health, English was responsible for continuing the reforms to the public health system that National had begun after the 1990 general election  The reforms were unpopular, and health was perceived as one of the government's weaknesses, with the health portfolio consequently being viewed as a challenge  English believed that the unpopularity of the reforms was in part due to a failure in messaging, and encouraged his National colleagues to avoid bureaucratic and money-focused language (such as references to "balance sheets" and "user charges") and instead talk about the improvements to services the government's reforms would bring  He also rejected the idea that public hospitals could be run as commercial enterprises, a view which some of his colleagues had previously promoted 

By early 1997, as dissatisfaction with Bolger's leadership began to grow, English was being touted as a potential successor, along with Jenny Shipley and Doug Graham  His age (35) was viewed as the main impediment to a successful leadership run  National's leadership troubles were resolved in December 1997, when Bolger resigned and Shipley was elected to the leadership unopposed  English had been a supporter of Bolger as leader, but Shipley reappointed him Minister of Health in her new cabinet 

English was promoted to Minister of Finance in a reshuffle in January 1999, a position which was at the time subordinate to the Treasurer, Bill Birch  After a few months, the pair switched positions as part of Birch's transition to retirement, with English assuming the senior portfolio  In early interviews, he emphasised his wish to be seen as a pragmatist rather than an ideologue, and said that the initiatives of some of his predecessors (Roger Douglas's "Rogernomics" and Ruth Richardson's "Ruthanasia") had focused on "fruitless, theoretical debates" when "people just want to see problems solved" 

Opposition (1999–2008)

After the National Party lost the 1999 election to Helen Clark's Labour Party, English continued on in the shadow cabinet as National's spokesperson for finance  He was elected deputy leader of the party in February 2001, following the resignation of Wyatt Creech, with Gerry Brownlee being his unsuccessful opponent 

Leader of the Opposition
In October 2001, after months of speculation, Jenny Shipley resigned as leader of the National Party after being told she no longer had the support of the party caucus  English was elected as her replacement unopposed (with Roger Sowry as his deputy), and consequently became Leader of the Opposition  However, he did not openly organise against Shipley, and according to The Southland Times "there was almost an element of 'aw, shucks, I'll do it then' about Mr English's ascension" 

Aged 39 when he was elected, English became the second-youngest leader in the National Party's history, after Jim McLay (who was 38 when elected in 1984)  He also became only the third Southlander to lead a major New Zealand political party, after Joseph Ward and Adam Hamilton  However, English failed to improve the party's performance  In the 2002 election, National suffered its worst electoral defeat ever, gaining barely more than twenty percent of the vote  English described it as "the worst day of my political life"  Both party insiders and the general public were split as to how much to blame him for the loss, but most of the party believed that English would be able to rebuild National's support 

By late 2003, however, National's performance in opinion polls remained poor  The party had briefly increased its popularity in the year following the election, but by October its support had fallen to levels only slightly better than what it achieved in the last ballot  English also appeared in a boxing match for a charity against entertainer Ted Clarke  This did not boost his polling or that of the National party either, with suggestions that it devalued his image as a serious politician  Don Brash, former governor of the Reserve Bank and a relative newcomer to politics, began to build up support to replace English  On 28 October, Brash gained sufficient backing in Caucus to defeat English in a leadership contest 

Shadow cabinet roles and deputy leader
On 2 November 2003, when Brash changed responsibilities for certain MPs, English became National's spokesman for education, ranked at fifth place in the party's parliamentary hierarchy  He remained in parliament after the 2005 election  In his new shadow education portfolio, English performed strongly, and remained a party favourite despite his election defeat as leader in 2002, eventually being returned to the finance portfolio in August 2004 as deputy spokesman (while still retaining responsibility for education) 

In November 2006, Brash resigned as leader  English was considered as a potential replacement leader (running against John Key) or deputy leader (against incumbent Gerry Brownlee) in the ensuing leadership election  However, a contest was avoided when the MPs agreed a Key/English ticket would run unopposed in a display of party unity  English took over the deputy leadership and the finance portfolio in the Key shadow cabinet 

Fifth National Government (2008–2017)

Deputy Prime Minister and Minister of Finance (2008–2016)

At the 2008 election, English was re-elected by his electorate, winning by a margin of about 15,500 votes  He became Deputy Prime Minister of New Zealand and Minister of Finance in the fifth National Government, being sworn into office on 19 November 2008 and continued to serve in those roles until becoming Prime Minister on 12 December 2014  He was also made Minister of Infrastructure in National's first term of government and Minister responsible for Housing New Zealand Corporation and minister responsible for the New Zealand flag consideration process in its third 

He was comfortably re-elected in Clutha-Southland in the 2011 election but opted to run as a party-list candidate in 2014  

The pairing of John Key as leader of the National Party and English as his deputy has been compared to that of Bob Hawke and Paul Keating (in Australia) and Tony Blair and Gordon Brown (in the UK)



ground_truth: 172.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the significance of the interlayer Berry connection polarizability?

Read the following text and answer briefly.

Context 4: 

English acceded to the role of Finance Minister in the continuing wake of the financial crisis  In response to New Zealand's rising debt, English made budget deficit-reduction his main priority  His first budget outlined three focuses in New Zealand's financial recovery: "improving the business environment and removing roadblocks to growth; investment in productive infrastructure; and improving the way government works"  One of his first acts was creating the National Infrastructure Unit, charged with formulating a plan for infrastructure projects and investments  He commissioned a government-wide spending review, with an aim to reducing government expenditure—with the exceptions of a two-year stimulus package and long-term increases on infrastructure spending 

In April 2011, the Opposition criticised English for suggesting that New Zealand businesses could use New Zealand's low wages to help it compete with Australia  The National Government campaigned for re-election in 2011 on its economic record  The Government boasted growth for five consecutive quarters up to mid-2010, totalling 1 6% of real GDP 

Strong growth resulted in a surplus of $473 million for the 2015/16 financial year, projected to rise to $8 5 billion by 2020/21  In his 2016 Economic and Fiscal Update address, English stated that reducing debt and tackling the costs of the 2016 Kaikōura earthquake were higher priorities than reducing rates of tax 

Allowances issue
In 2009, the media, including TVNZ and TV3 revealed that English was receiving about NZ$900 a week as part of a living allowance for ministers, to live in his own NZ$1 2 million Wellington home  At the time, English also received $276,200 in his annual salary as Deputy Prime Minister  It was also revealed other ministers with homes in the capital city were also claiming accommodation allowances  On 3 August 2009, Prime Minister John Key started a review of the housing allowances claimed by cabinet ministers  English subsequently paid back $12,000 and only claimed about $24,000 a year in living allowances  The Auditor-General's office said in September 2009 that they were making "preliminary enquiries" into parliamentary housing expenses in response to a letter of complaint from Progressive party leader Jim Anderton  Two days later English stated that he would no longer take up any housing allowance and had paid back all the allowance he had received since the November 2008 election 

Prime Minister (2016–2017)

John Key resigned on 12 December, and endorsed English as his successor in the resulting leadership election  Following the drop-out of both Judith Collins and Jonathan Coleman from the leadership election, English was sworn in as the 39th Prime Minister of New Zealand on 12 December 2016 

English appointed his first cabinet on 18 December  In a reshuffle, he appointed Steven Joyce to succeed him as Finance Minister, while most ministerial portfolios remained the same 

In February 2017, English did not attend Waitangi Day commemorations at the historic treaty grounds, reportedly in response to the Ngāpuhi iwi's decision to stop the Prime Minister from speaking at the marae  Ngāpuhi have protested the Government's negotiation of the Trans Pacific Partnership Agreement (TPPA), which the iwi believe infringes upon Māori sovereignty, and thus does not adhere to the Treaty of Waitangi  English had been invited to attend in an official capacity; his non-attendance was criticised by a Ngāpuhi elder and Opposition leader Andrew Little 

In his first overseas trip as Prime Minister, English travelled to Europe to discuss trade ties, including a prospective New Zealand–European Union free trade agreement  He first travelled to London on 13 January 2017 to meet British Prime Minister Theresa May  Discussing trade relations, English said the two nations were "natural partners" and would "continue to forge ties" after the UK's withdrawal from the EU  He also arranged to meet with London Mayor Sadiq Khan, Belgian Prime Minister Charles Michel and German Chancellor Angela Merkel   In a meeting with Merkel, English received crucial backing from Germany for a trade deal with the EU  On 16 January, English stated that his government would continue to promote TPPA, despite the United States' decision to withdraw from the agreement  He explained that Southeast Asian countries would now be treated as a priority in negotiations—he also asserted that the United States was ceding influence to China by its rejection of the trade pact 

At a press conference at the Beehive on 1 February 2017, English announced that the 2017 general election would be held on 23 September  The Prime Minister later confirmed that his party would approach ACT, United Future and the Māori Party if confidence and supply agreements were required to form a government following the election  In his second cabinet reshuffle on 24 April, English appointed Gerry Brownlee as his new Foreign Affairs Minister; he also promoted Nikki Kaye to the portfolio of Education Minister, and moved Mark Mitchell into the cabinet to become Defence Minister  The reshuffle was perceived as an election preparation 

On 13 February 2017, English welcomed Australian Prime Minister Malcolm Turnbull to Wellington  The two leaders reaffirmed their shared trade agenda, and discussed changes to the Australian citizenship pathway which will affect permanent residents originating from New Zealand 

On 19 June, it was reported that Todd Barclay, who succeeded English as MP for Clutha-Southland, had clandestinely recorded one of his employee's conversations the previous year, and that John Key's leaders' budget was used to pay a confidential settlement after the employee resigned  English admitted that he had been aware of the illegal recording and the settlement, and thus implicated in the scandal 

During the 2017 National campaign launch, English introduced a $379 million social investment package including digital learning academies for high school students, more resources for mathematics, and boosting support for teaching second languages in schools, and maintaining National Standards in the school curriculum  Prime Minister English also sought to defend National's financial management and economic track record and claimed that the opposition Labour Party would raise taxes  Early opinion polling had forecast a poor showing in the election for the Labour Party, but in early August 37-year-old Jacinda Ardern took over as Labour leader and seemingly energised younger voters 

At the 2017 general election, National won the largest share of the party vote (44 4%) and the largest number of seats (56) in the House Representatives  However, National lacked enough seats to govern alone due to two of the party's support partners, the Māori Party and United Future, losing their parliamentary seats  In response, English stated that the party would be entering into talks to form a coalition with New Zealand First  Following talks with the two largest parties, New Zealand First entered a coalition arrangement with the Labour Party  English was succeeded as prime minister by Jacinda Ardern on 26 October 

Opposition (2017–2018)

Leader of the Opposition
English was re-elected as National Party leader on 24 October 2017  At the time of his re-election, English announced his intention to stay on as leader until the next general election  On 13 February 2018, however, he stood down as National Party leader due to personal reasons, and instructed the party to put into motion the processes to elect a new leader  He also retired from Parliament  English's resignation followed weeks of speculation that he would step aside for a new leader  On 27 February, he was succeeded as party leader by Simon Bridges as the result of the leadership election held that day 

Post-premiership 
In 2018, English joined the board of Australian conglomerate, Wesfarmers  English serves in Chairmanships of Mount Cook Alpine Salmon, Impact Lab Ltd and Manawanui Support Ltd  He is also a director of The Instillery, Centre for Independent Studies and The Todd Corporation Limited, and is a member of the Impact Advisory Group of Macquarie Infrastructure and Real Assets 

Political and social views

English is regarded as more socially conservative than his predecessor, John Key  He has stated his opposition to voluntary euthanasia and physician-assisted suicide, same-sex civil unions, and the decriminalisation of prostitution  As Prime Minister he opposed any "liberalisation" of abortion law 

In 2004, English voted against a bill to establish civil unions for both same-sex and opposite-sex couples  In 2005, he voted for the Marriage (Gender Clarification) Amendment Bill, which would have amended the Marriage Act to define marriage as only between a man and a woman  English voted against the Marriage (Definition of Marriage) Amendment Bill, a bill that legalised same-sex marriage in New Zealand  However, in December 2016 he stated, "I'd probably vote differently now on the gay marriage issue  I don't think that gay marriage is a threat to anyone else's marriage" 

In 2009, English voted against the Misuse of Drugs (Medicinal Cannabis) Amendment Bill, a bill aimed at amending the Misuse of Drugs Act so that cannabis could be used for medical purposes 

Personal life 
English met his future wife, Mary Scanlon, at university  She was studying medicine at the time, and became a general practitioner  Both her parents were immigrants, her father being Samoan and her mother Italian, born on the island of Stromboli  They have six children: a daughter and five sons 

English is a practising Roman Catholic, but has stated that he considers his religious beliefs personal and thus separate from politics 

In June 2002, English took part in TV3's Fight For Life, a celebrity boxing fundraiser to raise money for the Yellow Ribbon anti-youth-suicide campaign, influenced by the death of a teenage nephew in 1997  He lost a split decision to former university colleague Ted Clarke 

Honours
In the 2018 Queen's Birthday Honours, English was appointed a Knight Companion of the New Zealand Order of Merit, for services of over 27 years to the State 

See also

List of New Zealand governments
Politics of New Zealand

References

External links

Profile at National Party 
Profile on Parliament nz
Releases and speeches at Beehive govt nz

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

|-

1961 births
21st-century New Zealand politicians
Candidates in the 2017 New Zealand general election
Deputy Prime Ministers of New Zealand
Leaders of the Opposition (New Zealand)
Living people
Members of the Cabinet of New Zealand
Members of the New Zealand House of Representatives
New Zealand farmers
New Zealand finance ministers
New Zealand list MPs
New Zealand MPs for South Island electorates
New Zealand National Party MPs
New Zealand National Party leaders
New Zealand Roman Catholics
New Zealand people of Irish descent
People educated at St  Patrick's College, Silverstream
People from Dipton, New Zealand
People from Lumsden, New Zealand
Prime Ministers of New Zealand
University of Otago alumni
Victoria University of Wellington alumni
Knights Companion of the New Zealand Order of Merit
New Zealand politicians awarded knighthoods



ground_truth: The momentum space curl of the interlayer Berry connection polarizability generates the crossed nonlinear dynamical Hall effect.