“…For each cryptographic function and floating-point operation, we report the two quantum circuits with the fewest number of qubits (first row) and the lowest T -depth (second row). The corresponding 10 4 Grassl, Langenberg, Roetteler, Steinwandt [18] Langenberg, Pham, Steindwandt [25] Jaques, Naehrig, Roetteler, Virdia [22] Amy, Matteo, Gheorghiu, Mosca, Parent, Schanck [3] Haener, Soeken, Roetteler, Svore [19] This work…”