Shor's algorithm

If a quantum computer with a sufficient number of qubits could operate without succumbing to quantum noise and other quantum-decoherence phenomena, then Shor's algorithm could be used to break public-key cryptography schemes, such as

• The RSA scheme
• The finite-field Diffie–Hellman key exchange
• The elliptic-curve Diffie–Hellman key exchange{{cite conference

| last1 = Roetteler | first1 = Martin

| last2 = Naehrig | first2 = Michael

| last3 = Svore | first3 = Krysta M. | author3-link = Krysta Svore

| last4 = Lauter | first4 = Kristin E. | author4-link = Kristin Lauter

| editor1-last = Takagi | editor1-first = Tsuyoshi

| editor2-last = Peyrin | editor2-first = Thomas

| arxiv = 1706.06752

| contribution = Quantum resource estimates for computing elliptic curve discrete logarithms

| doi = 10.1007/978-3-319-70697-9_9

| pages = 241–270

| publisher = Springer

| series = Lecture Notes in Computer Science

| title = Advances in Cryptology – ASIACRYPT 2017 – 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3–7, 2017, Proceedings, Part II

| volume = 10625

| year = 2017| isbn = 978-3-319-70696-2

}}

RSA can be broken if factoring large integers is computationally feasible. As far as is known, this is not possible using classical (non-quantum) computers; no classical algorithm is known that can factor integers in polynomial time. However, Shor's algorithm shows that factoring integers is efficient on an ideal quantum computer, so it may be feasible to defeat RSA by constructing a large quantum computer. It was also a powerful motivator for the design and construction of quantum computers, and for the study of new quantum-computer algorithms. It has also facilitated research on new cryptosystems that are secure from quantum computers, collectively called post-quantum cryptography.

Given the high error rates of contemporary quantum computers and too few qubits to use quantum error correction, laboratory demonstrations obtain correct results only in a fraction of attempts.

In 2001, Shor's algorithm was demonstrated by a group at IBM, who factored $15$ into $3\; \backslash times\; 5$, using an NMR implementation of a quantum computer with seven qubits.{{cite journal |last1=Vandersypen |first1=Lieven M. K. |last2=Steffen |first2=Matthias |last3=Breyta |first3=Gregory |last4=Yannoni |first4=Costantino S. |last5=Sherwood |first5=Mark H. |last6=Chuang |first6=Isaac L. |title=Experimental realization of Shor's quantum factoring algorithm using nuclear magnetic resonance |journal=Nature |date=December 2001 |volume=414 |issue=6866 |pages=883–887 |doi=10.1038/414883a |pmid=11780055 |arxiv=quant-ph/0112176 |bibcode=2001Natur.414..883V }} After IBM's implementation, two independent groups implemented Shor's algorithm using photonic qubits, emphasizing that multi-qubit entanglement was observed when running the Shor's algorithm circuits.{{cite journal |last1=Lu |first1=Chao-Yang |last2=Browne |first2=Daniel E. |last3=Yang |first3=Tao |last4=Pan |first4=Jian-Wei |title=Demonstration of a Compiled Version of Shor's Quantum Factoring Algorithm Using Photonic Qubits |journal=Physical Review Letters |date=19 December 2007 |volume=99 |issue=25 |page=250504 |doi=10.1103/PhysRevLett.99.250504 |pmid=18233508 |arxiv=0705.1684 |bibcode=2007PhRvL..99y0504L }}{{cite journal |last1=Lanyon |first1=B. P. |last2=Weinhold |first2=T. J. |last3=Langford |first3=N. K. |last4=Barbieri |first4=M. |last5=James |first5=D. F. V. |last6=Gilchrist |first6=A. |last7=White |first7=A. G. |title=Experimental Demonstration of a Compiled Version of Shor's Algorithm with Quantum Entanglement |journal=Physical Review Letters |date=19 December 2007 |volume=99 |issue=25 |page=250505 |doi=10.1103/PhysRevLett.99.250505 |pmid=18233509 |arxiv=0705.1398 |bibcode=2007PhRvL..99y0505L }} In 2012, the factorization of $15$ was performed with solid-state qubits.{{Cite journal|last1 = Lucero|first1 = Erik|last2 = Barends|first2 = Rami|last3 = Chen|first3 = Yu|last4 = Kelly|first4 = Julian|last5 = Mariantoni|first5 = Matteo|last6 = Megrant|first6 = Anthony|last7 = O'Malley|first7 = Peter|last8 = Sank|first8 = Daniel|last9 = Vainsencher|first9 = Amit|last10 = Wenner|first10 = James|last11 = White|first11 = Ted|last12 = Yin|first12 = Yi|last13 = Cleland|first13 = Andrew N.|last14 = Martinis|first14 = John M.|title = Computing prime factors with a Josephson phase qubit quantum processor|journal = Nature Physics|volume = 8|issue = 10|pages = 719|year = 2012|doi = 10.1038/nphys2385|bibcode = 2012NatPh...8..719L|arxiv = 1202.5707|s2cid = 44055700}} Later, in 2012, the factorization of $21$ was achieved.{{cite journal|last1 = Martín-López|first1 = Enrique|last2 = Martín-López|first2 = Enrique|last3 = Laing|first3 = Anthony|last4 = Lawson|first4 = Thomas|last5 = Alvarez|first5 = Roberto|last6 = Zhou|first6 = Xiao-Qi|last7 = O'Brien|first7 = Jeremy L.|title = Experimental realization of Shor's quantum factoring algorithm using qubit recycling|journal = Nature Photonics|volume =6|issue = 11|pages = 773–776|date = 12 October 2012|doi = 10.1038/nphoton.2012.259|arxiv = 1111.4147|bibcode = 2012NaPho...6..773M|s2cid = 46546101}} In 2016, the factorization of $15$ was performed again using trapped-ion qubits with a recycling technique.{{cite journal|last1 = Monz|first1 = Thomas |last2 = Nigg|first2 = Daniel|last3 = Martinez|first3 = Esteban A.|last4 = Brandl|first4 = Matthias F.|last5 = Schindler|first5 = Philipp|last6 = Rines|first6 = Richard|last7 = Wang|first7 = Shannon X.|last8 = Chuang|first8 = Isaac L.|last9 = Blatt|first9 = Rainer|title = Realization of a scalable Shor algorithm|journal = Science|volume =351|issue = 6277|pages = 1068–1070|date = 4 March 2016|doi = 10.1126/science.aad9480|pmid = 26941315 |arxiv = 1507.08852|bibcode = 2016Sci...351.1068M|s2cid = 17426142}} In 2019, an attempt was made to factor the number $35$ using Shor's algorithm on an IBM Q System One, but the algorithm failed because of accumulating errors.{{cite journal |last1=Amico |first1=Mirko |last2=Saleem |first2=Zain H. |last3=Kumph |first3=Muir |title=Experimental study of Shor's factoring algorithm using the IBM Q Experience |journal=Physical Review A |date=8 July 2019 |volume=100 |issue=1 |page=012305 |doi=10.1103/PhysRevA.100.012305 |arxiv=1903.00768 |bibcode=2019PhRvA.100a2305A |s2cid=92987546 }} However, all these demonstrations have compiled the algorithm by making use of prior knowledge of the answer, and some have even oversimplified the algorithm in a way that makes it equivalent to coin flipping.{{cite journal |last1=Smolin |first1=John A. |last2=Smith |first2=Graeme |last3=Vargo |first3=Alexander |title=Oversimplifying quantum factoring |journal=Nature |date=July 2013 |volume=499 |issue=7457 |pages=163–165 |doi=10.1038/nature12290 |pmid=23846653 |arxiv=1301.7007 |bibcode=2013Natur.499..163S }} Furthermore, attempts using quantum computers with other algorithms have been made.{{cite journal |last1=Karamlou |first1=Amir H. |last2=Simon |first2=William A. |last3=Katabarwa |first3=Amara |last4=Scholten |first4=Travis L. |last5=Peropadre |first5=Borja |last6=Cao |first6=Yudong |title=Analyzing the performance of variational quantum factoring on a superconducting quantum processor |journal=npj Quantum Information |date=28 October 2021 |volume=7 |issue=1 |page=156 |doi=10.1038/s41534-021-00478-z |arxiv=2012.07825 |bibcode=2021npjQI...7..156K }} However, these algorithms are similar to classical brute-force checking of factors, so unlike Shor's algorithm, they are not expected to ever perform better than classical factoring algorithms.{{Cite web |date=2019-12-28 |title=Quantum computing motte-and-baileys |url=https://scottaaronson.blog/?p=4447 |access-date=2021-11-15 |website=Shtetl-Optimized |language=en-US}}

Theoretical analyses of Shor's algorithm assume a quantum computer free of noise and errors. However, near-term practical implementations will have to deal with such undesired phenomena (when more qubits are available, quantum error correction can help). In 2023, Jin-Yi Cai showed that in the presence of noise, Shor's algorithm fails asymptotically almost surely for large semiprimes that are products of two primes in {{OEIS el|A073024}}.{{cite journal |arxiv=2306.10072 |last1=Cai |first1=Jin-Yi |date=2024 |title=Shor's algorithm does not factor large integers in the presence of noise |journal=Science China Information Sciences |volume=67 |issue=7 |doi=10.1007/s11432-023-3961-3 }} These primes $p$ have the property that $p-1$ has a prime factor larger than $p^\{2/3\}$, and have a positive density in the set of all primes. Hence error correction will be needed to be able to factor all numbers with Shor's algorithm.

The problem that we are trying to solve is: given an odd composite number $N$, find its integer factors.

To achieve this, Shor's algorithm consists of two parts:

1. A classical reduction of the factoring problem to the problem of order-finding. This reduction is similar to that used for other factoring algorithms, such as the quadratic sieve.
2. A quantum algorithm to solve the order-finding problem.

A complete factoring algorithm is possible if we're able to efficiently factor arbitrary $N$ into just two integers $p$ and $q$ greater than 1, since if either $p$ or $q$ are not prime, then the factoring algorithm can in turn be run on those until only primes remain.

A basic observation is that, using Euclid's algorithm, we can always compute the GCD between two integers efficiently. In particular, this means we can check efficiently whether $N$ is even, in which case 2 is trivially a factor. Let us thus assume that $N$ is odd for the remainder of this discussion. Afterwards, we can use efficient classical algorithms to check whether $N$ is a prime power.{{cite journal |last1=Bernstein |first1=Daniel |title=Detecting perfect powers in essentially linear time |journal=Mathematics of Computation |date=1998 |volume=67 |issue=223 |pages=1253–1283 |doi=10.1090/S0025-5718-98-00952-1 }} For prime powers, efficient classical factorization algorithms exist,For example, computing the first $\backslash log\_2(N)$ roots of $N$, e.g., with the Newton method and checking each integer result for primality (AKS primality test). hence the rest of the quantum algorithm may assume that $N$ is not a prime power.

If those easy cases do not produce a nontrivial factor of $N$, the algorithm proceeds to handle the remaining case. We pick a random integer . A possible nontrivial divisor of $N$ can be found by computing $\backslash gcd(a,\; N)$, which can be done classically and efficiently using the Euclidean algorithm. If this produces a nontrivial factor (meaning $\backslash gcd(a,\; N)\; \backslash ne\; 1$), the algorithm is finished, and the other nontrivial factor is $N/\backslash gcd(a,\; N)$. If a nontrivial factor was not identified, then this means that $N$ and the choice of $a$ are coprime, so $a$ is contained in the multiplicative group of integers modulo $N$, having a multiplicative inverse modulo $N$. Thus, $a$ has a multiplicative order $r$ modulo $N$, meaning

: $a^r\; \backslash equiv\; 1\; \backslash bmod\; N,$

and $r$ is the smallest positive integer satisfying this congruence.

The quantum subroutine finds $r$. It can be seen from the congruence that $N$ divides $a^r\; -\; 1$, written $N\; \backslash mid\; a^r\; -\; 1$. This can be factored using difference of squares:

N \mid (a^{r/2} - 1)(a^{r/2} + 1).

Since we have factored the expression in this way, the algorithm doesn't work for odd $r$ (because $a^\{r/2\}$ must be an integer), meaning that the algorithm would have to restart with a new $a$. Hereafter we can therefore assume that $r$ is even. It cannot be the case that $N\; \backslash mid\; a^\{r/2\}\; -\; 1$, since this would imply $a^\{r/2\}\; \backslash equiv\; 1\; \backslash bmod\; N$, which would contradictorily imply that $r/2$ would be the order of $a$, which was already $r$. At this point, it may or may not be the case that $N\; \backslash mid\; a^\{r/2\}\; +\; 1$. If $N$ does not divide $a^\{r/2\}\; +\; 1$, then this means that we are able to find a nontrivial factor of $N$. We compute

d = \gcd(N, a^{r/2} - 1).

If $d\; =\; 1$, then $N\; \backslash mid\; a^\{r/2\}\; +\; 1$ was true, and a nontrivial factor of $N$ cannot be achieved from $a$, and the algorithm must restart with a new $a$. Otherwise, we have found a nontrivial factor of $N$, with the other being $N/d$, and the algorithm is finished. For this step, it is also equivalent to compute $\backslash gcd(N,\; a^\{r/2\}\; +\; 1)$; it will produce a nontrivial factor if $\backslash gcd(N,\; a^\{r/2\}\; -\; 1)$ is nontrivial, and will not if it's trivial (where $N\; \backslash mid\; a^\{r/2\}\; +\; 1$).

The algorithm restated shortly follows: let $N$ be odd, and not a prime power. We want to output two nontrivial factors of $N$.

1. Pick a random number .
2. Compute $K\; =\; \backslash gcd(a,\; N)$, the greatest common divisor of $a$ and $N$.
3. If $K\; \backslash neq\; 1$, then $K$ is a nontrivial factor of $N$, with the other factor being $N/K$, and we are done.
4. Otherwise, use the quantum subroutine to find the order $r$ of $a$.
5. If $r$ is odd, then go back to step 1.
6. Compute $g\; =\; \backslash gcd(N,\; a^\{r/2\}\; +\; 1)$. If $g$ is nontrivial, the other factor is $N/g$, and we're done. Otherwise, go back to step 1.

It has been shown that this will be likely to succeed after a few runs. In practice, a single call to the quantum order-finding subroutine is enough to completely factor $N$ with very high probability of success if one uses a more advanced reduction.{{cite journal |last1=Ekerå |first1=Martin |title=On completely factoring any integer efficiently in a single run of an order-finding algorithm |journal=Quantum Information Processing |date=June 2021 |volume=20 |issue=6 |page=205 |doi=10.1007/s11128-021-03069-1 |arxiv=2007.10044 |bibcode=2021QuIP...20..205E |doi-access=free }}

The goal of the quantum subroutine of Shor's algorithm is, given coprime integers $N$ and

The algorithm consists of two main steps:

1. Use quantum phase estimation with unitary $U$ representing the operation of multiplying by $a$ (modulo $N$), and input state $|0\backslash rangle^\{\backslash otimes\; 2\; n\}\backslash otimes|1\backslash rangle$ (where the second register is $|1\backslash rangle$ made from $n$ qubits). The eigenvalues of this $U$ encode information about the period, and $|1\backslash rangle$ can be seen to be writable as a sum of its eigenvectors. Thanks to these properties, the quantum phase estimation stage gives as output a random integer of the form $\backslash frac\{j\}\{r\}\; 2^\{2n\}$ for random $j=0,1,...,r-1$.
2. Use the continued fractions algorithm to extract the period $r$ from the measurement outcomes obtained in the previous stage. This is a procedure to post-process (with a classical computer) the measurement data obtained from measuring the output quantum states, and retrieve the period.

The connection with quantum phase estimation was not discussed in the original formulation of Shor's algorithm, but was later proposed by Kitaev.{{cite arXiv |eprint=quant-ph/9511026 |last1=Kitaev |first1=A. Yu |date=1995 |title=Quantum measurements and the Abelian Stabilizer Problem }}

File:Shor's algorithm.svg

In general the quantum phase estimation algorithm, for any unitary $U$ and eigenstate $|\backslash psi\backslash rangle$ such that $U|\backslash psi\backslash rangle=e^\{2\backslash pi\; i\backslash theta\}\; |\backslash psi\backslash rangle$, sends input states $|0\backslash rangle|\backslash psi\backslash rangle$ to output states close to $|\backslash phi\backslash rangle|\backslash psi\backslash rangle$, where $\backslash phi$ is a superposition of integers close to $2^\{2n\}\; \backslash theta$. In other words, it sends each eigenstate $|\backslash psi\_j\backslash rangle$ of $U$ to a state containing information close to the associated eigenvalue. For the purposes of quantum order-finding, we employ this strategy using the unitary defined by the action

U|k\rangle = \begin{cases}

|ak \pmod N\rangle & 0 \le k < N, \\

|k\rangle & N \le k < 2^n.

\end{cases}

The action of $U$ on states $|k\backslash rangle$ with is not crucial to the functioning of the algorithm, but needs to be included to ensure that the overall transformation is a well-defined quantum gate. Implementing the circuit for quantum phase estimation with $U$ requires being able to efficiently implement the gates $U^\{2^j\}$. This can be accomplished via modular exponentiation, which is the slowest part of the algorithm.

The gate thus defined satisfies $U^r\; =\; I$, which immediately implies that its eigenvalues are the $r$-th roots of unity $\backslash omega\_r^k\; =\; e^\{2\backslash pi\; ik/r\}$. Furthermore, each eigenvalue $\backslash omega\_r^j$ has an eigenvector of the form $|\backslash psi\_j\backslash rangle=r^\{-1/2\}\backslash sum\_\{k=0\}^\{r-1\}\backslash omega\_r^\{-kj\}|a^k\backslash rangle$, and these eigenvectors are such that

$$\backslash begin\{align\}$$

\frac{1}{\sqrt{r}} \sum_{j = 0}^{r - 1} |\psi_j\rangle &= \frac{1}{r} \sum_{j = 0}^{r - 1} \sum_{k = 0}^{r - 1} \omega_r^{jk}|a^k\rangle \\

&= |1\rangle + \frac{1}{r} \sum_{k = 1}^{r - 1} \left(\sum_{j = 0}^{r - 1} \omega_r^{jk} \right) |a^k\rangle =|1\rangle,

\end{align}

where the last identity follows from the geometric series formula, which implies $\backslash sum\_\{j\; =\; 0\}^\{r\; -\; 1\}\; \backslash omega\_r^\{jk\}\; =\; 0$.

Using quantum phase estimation on an input state $|0\backslash rangle^\{\backslash otimes\; 2\; n\}|\backslash psi\_j\backslash rangle$ would then return the integer $2^\{2n\}\; j/r$ with high probability. More precisely, the quantum phase estimation circuit sends $|0\backslash rangle^\{\backslash otimes\; 2\; n\}|\backslash psi\_j\backslash rangle$ to $|\backslash phi\_j\backslash rangle|\backslash psi\_j\backslash rangle$ such that the resulting probability distribution $p\_k\; \backslash equiv|\backslash langle\; k|\backslash phi\_j\backslash rangle|^2$ is peaked around $k=2^\{2n\}\; j/r$, with $p\_\{2^\{2n\}j/r\}\; \backslash ge\; 4/\backslash pi^2\; \backslash approx\; 0.4053$. This probability can be made arbitrarily close to 1 using extra qubits.

Applying the above reasoning to the input $|0\backslash rangle^\{\backslash otimes\; 2\; n\}|1\backslash rangle$, quantum phase estimation thus results in the evolution

|0\rangle^{\otimes 2 n}|1\rangle =

\frac{1}{\sqrt{r}} \sum_{j = 0}^{r - 1} |0\rangle^{\otimes 2 n} |\psi_j\rangle \to

\frac{1}{\sqrt{r}} \sum_{j = 0}^{r - 1} |\phi_j\rangle|\psi_j\rangle.

Measuring the first register, we now have a balanced probability $1/r$ to find each $|\backslash phi\_j\backslash rangle$, each one giving an integer approximation to $2^\{2\; n\}\; j/r$, which can be divided by $2^\{2n\}$ to get a decimal approximation for $j/r$.

Then, we apply the continued-fraction algorithm to find integers $b$ and $c$, where $b/c$ gives the best fraction approximation for the approximation measured from the circuit, for and coprime $b$ and $c$. The number of qubits in the first register, $2n$, which determines the accuracy of the approximation, guarantees that

\frac{b}{c} = \frac{j}{r},

given the best approximation from the superposition of $|\backslash phi\_j\backslash rangle$ was measured (which can be made arbitrarily likely by using extra bits and truncating the output). However, while $b$ and $c$ are coprime, it may be the case that $j$ and $r$ are not coprime. Because of that, $b$ and $c$ may have lost some factors that were in $j$ and $r$. This can be remedied by rerunning the quantum order-finding subroutine an arbitrary number of times, to produce a list of fraction approximations

\frac{b_1}{c_1}, \frac{b_2}{c_2}, \ldots, \frac{b_s}{c_s},

where $s$ is the number of times the subroutine was run. Each $c\_k$ will have different factors taken out of it because the circuit will (likely) have measured multiple different possible values of $j$. To recover the actual $r$ value, we can take the least common multiple of each $c\_k$:

\operatorname{lcm}(c_1, c_2, \ldots, c_s).

The least common multiple will be the order $r$ of the original integer $a$ with high probability. In practice, a single run of the quantum order-finding subroutine is in general enough if more advanced post-processing is used.{{cite journal |last1=Ekerå |first1=Martin |title=On the Success Probability of Quantum Order Finding |journal=ACM Transactions on Quantum Computing |date=May 2024 |volume=5 |issue=2 |pages=1–40 |doi=10.1145/3655026 |doi-access=free |arxiv=2201.07791 }}

Phase estimation requires choosing the size of the first register to determine the accuracy of the algorithm, and for the quantum subroutine of Shor's algorithm, $2n$ qubits is sufficient to guarantee that the optimal bitstring measured from phase estimation (meaning the $|k\backslash rangle$ where $k\; /\; 2^\{2n\}$ is the most accurate approximation of the phase from phase estimation) will allow the actual value of $r$ to be recovered.

Each $|\backslash phi\_j\backslash rangle$ before measurement in Shor's algorithm represents a superposition of integers approximating $2^\{2\; n\}\; j/r$. Let $|k\backslash rangle$ represent the most optimal integer in $|\backslash phi\_j\backslash rangle$. The following theorem guarantees that the continued fractions algorithm will recover $j/r$ from $k/2^\{2\; \{n\}\}$:

{{Math theorem

| math_statement = If $j$ and $r$ are $n$ bit integers, and

$$\backslash left\backslash vert\; \backslash frac\{j\}\{r\}\; -\; \backslash phi\backslash right\backslash vert\; \backslash leq\; \backslash frac\{1\}\{2\; r^2\}$$

then the continued fractions algorithm run on $\backslash phi$ will recover both $\backslash frac\{j\}\{\backslash gcd(j,\backslash ;\; r)\}$ and $\backslash frac\{r\}\{\backslash gcd(j,\backslash ;\; r)\}$.

}}

As $k$ is the optimal bitstring from phase estimation, $k/2^\{2\; \{n\}\}$ is accurate to $j/r$ by $2n$ bits. Thus,$$\backslash left\backslash vert\backslash frac\{j\}\{r\}\; -\; \backslash frac\{k\}\{2^\{2n\}\}\backslash right\backslash vert\; \backslash leq\; \backslash frac\{1\}\{2^\{2\; \{n\}\; +\; 1\}\}\; \backslash leq\; \backslash frac\{1\}\{2N^2\}\; \backslash leq\; \backslash frac\{1\}\{2r^2\}$$which implies that the continued fractions algorithm will recover $j$ and $r$ (or with their greatest common divisor taken out).

The runtime bottleneck of Shor's algorithm is quantum modular exponentiation, which is by far slower than the quantum Fourier transform and classical pre-/post-processing. There are several approaches to constructing and optimizing circuits for modular exponentiation. The simplest and (currently) most practical approach is to mimic conventional arithmetic circuits with reversible gates, starting with ripple-carry adders. Knowing the base and the modulus of exponentiation facilitates further optimizations.{{cite journal |first1=Igor L. |last1=Markov |first2=Mehdi |last2=Saeedi |title=Constant-Optimized Quantum Circuits for Modular Multiplication and Exponentiation |journal=Quantum Information and Computation |volume=12 |issue=5–6 |pages=361–394 |year=2012 |doi=10.26421/QIC12.5-6-1 |arxiv=1202.6614 |bibcode = 2012arXiv1202.6614M |s2cid=16595181 }}{{cite journal |first1=Igor L. |last1=Markov |first2=Mehdi |last2=Saeedi |title=Faster Quantum Number Factoring via Circuit Synthesis |journal=Phys. Rev. A |volume=87 |issue= 1|pages=012310 |year=2013 |arxiv=1301.3210 |bibcode = 2013PhRvA..87a2310M |doi = 10.1103/PhysRevA.87.012310 |s2cid=2246117 }} Reversible circuits typically use on the order of $n^3$ gates for $n$ qubits. Alternative techniques asymptotically improve gate counts by using quantum Fourier transforms, but are not competitive with fewer than 600 qubits owing to high constants.

Shor's algorithms for the discrete log and the order finding problems are instances of an algorithm solving the period finding problem.{{Citation needed|date=August 2023}} All three are instances of the hidden subgroup problem.

Given a group $G$ with order $p$ and generator $g\; \backslash in\; G$, suppose we know that $x\; =\; g^\{r\}\; \backslash in\; G$, for some $r\; \backslash in\; \backslash mathbb\{Z\}\_p$, and we wish to compute $r$, which is the discrete logarithm: $r\; =\; \{\backslash log\_\{g\}\}(x)$. Consider the abelian group $\backslash mathbb\{Z\}\_\{p\}\; \backslash times\; \backslash mathbb\{Z\}\_\{p\}$, where each factor corresponds to modular addition of values. Now, consider the function

:$$

f \colon \mathbb{Z}_{p} \times \mathbb{Z}_{p} \to G \;;\; f(a,b) = g^{a} x^{- b} .

This gives us an abelian hidden subgroup problem, where $f$ corresponds to a group homomorphism. The kernel corresponds to the multiples of $(r,1)$. So, if we can find the kernel, we can find $r$. A quantum algorithm for solving this problem exists. This algorithm is, like the factor-finding algorithm, due to Peter Shor and both are implemented by creating a superposition through using Hadamard gates, followed by implementing $f$ as a quantum transform, followed finally by a quantum Fourier transform. Due to this, the quantum algorithm for computing the discrete logarithm is also occasionally referred to as "Shor's Algorithm."

The order-finding problem can also be viewed as a hidden subgroup problem.{{cite book |last1=Nielsen |first1=Michael A. |url=http://mmrc.amss.cas.cn/tlb/201702/W020170224608149940643.pdf |archive-url=https://web.archive.org/web/20190711070716/http://mmrc.amss.cas.cn/tlb/201702/W020170224608149940643.pdf |archive-date=2019-07-11 |url-status=live |title=Quantum Computation and Quantum Information |last2=Chuang |first2=Isaac L. |date=9 December 2010 |publisher=Cambridge University Press |isbn=978-1-107-00217-3 |edition=7th |access-date=24 April 2022}} To see this, consider the group of integers under addition, and for a given $a\backslash in\backslash mathbb\{Z\}$ such that: $a^\{r\}=1$, the function

:$$

f \colon \mathbb{Z}\to \mathbb{Z} \;;\; f(x) = a^{x},\; f(x+r) = f(x) .

For any finite abelian group $G$, a quantum algorithm exists for solving the hidden subgroup for $G$ in polynomial time.

• GEECM, a factorization algorithm said to be "often much faster than Shor's"{{cite book |doi=10.1007/978-3-319-59879-6_18 |chapter=Post-quantum RSA |title=Post-Quantum Cryptography |series=Lecture Notes in Computer Science |date=2017 |last1=Bernstein |first1=Daniel J. |last2=Heninger |first2=Nadia |last3=Lou |first3=Paul |last4=Valenta |first4=Luke |volume=10346 |pages=311–329 |isbn=978-3-319-59878-9 }}
• Grover's algorithm

{{reflist}}

• {{cite book |last1=Nielsen |first1=Michael A. |last2=Chuang |first2=Isaac L. |title=Quantum Computation and Quantum Information: 10th Anniversary Edition |date=2010 |publisher=Cambridge University Press |isbn=978-1-107-00217-3 }}
• {{cite book |doi=10.1093/oso/9780198570004.001.0001 |title=An Introduction to Quantum Computing |date=2006 |last1=Kaye |first1=Phillip |last2=Laflamme |first2=Raymond |last3=Mosca |first3=Michele |isbn=978-0-19-857000-4 }}
• [http://scottaaronson.com/blog/?p=208 "Explanation for the man in the street"] by Scott Aaronson, "[http://scottaaronson.com/blog/?p=208#comment-9958 approved]" by Peter Shor. (Shor wrote "Great article, Scott! That’s the best job of explaining quantum computing to the man on the street that I’ve seen."). An alternate metaphor for the QFT was presented in [http://www.scottaaronson.com/blog/?p=208#comment-5187 one of the comments]. Scott Aaronson suggests the following 12 references as further reading (out of "the 10¹⁰⁵⁰⁰⁰ quantum algorithm tutorials that are already on the web."):
• {{Citation |last=Shor |first=Peter W. |year=1997 |title=Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer |journal=SIAM J. Comput. |volume=26 |issue=5 |pages=1484–1509 |doi=10.1137/S0036144598347011 |arxiv=quant-ph/9508027v2|bibcode = 1999SIAMR..41..303S }}. Revised version of the original paper by Peter Shor ("28 pages, LaTeX. This is an expanded version of a paper that appeared in the Proceedings of the 35th Annual Symposium on Foundations of Computer Science, Santa Fe, NM, Nov. 20--22, 1994. Minor revisions made January, 1996").
• [https://quantum-algorithms.herokuapp.com/299/paper/index.html Quantum Computing and Shor's Algorithm], Matthew Hayward's [https://quantum-algorithms.herokuapp.com/ Quantum Algorithms Page], 2005-02-17, imsa.edu, LaTeX2HTML version of the original [https://quantum-algorithms.herokuapp.com/299/paper.tex LaTeX document], also available as [https://quantum-algorithms.herokuapp.com/299/paper.pdf PDF] or [https://quantum-algorithms.herokuapp.com/299/paper.ps postscript] document.
• [http://homepages.cwi.nl/~rdewolf/publ/qc/survey.ps Quantum Computation and Shor's Factoring Algorithm], Ronald de Wolf, CWI and University of Amsterdam, January 12, 1999, 9 page postscript document.
• [http://www.cs.berkeley.edu/~vazirani/f04quantum/notes/lec9.ps Shor's Factoring Algorithm], Notes from Lecture 9 of Berkeley CS 294–2, dated 4 Oct 2004, 7 page postscript document.
• [http://www.theory.caltech.edu/people/preskill/ph229/notes/chap6.ps Chapter 6 Quantum Computation] {{Webarchive|url=https://web.archive.org/web/20200430110523/http://www.theory.caltech.edu/people/preskill/ph229/notes/chap6.ps |date=2020-04-30 }}, 91 page postscript document, Caltech, Preskill, PH229.
• [http://www-users.cs.york.ac.uk/~schmuel/comp/comp.html Quantum computation: a tutorial] by [http://www.cs.york.ac.uk/~schmuel/ Samuel L. Braunstein].
• [http://www.cs.ucr.edu/~neal/1996/cosc185-S96/shor/high-level.html The Quantum States of Shor's Algorithm], by Neal Young, Last modified: Tue May 21 11:47:38 1996.
• [https://web.archive.org/web/20121115112940/http://people.ccmr.cornell.edu/~mermin/qcomp/chap3.pdf III. Breaking RSA Encryption with a Quantum Computer: Shor's Factoring Algorithm], Lecture notes on Quantum computation, Cornell University, Physics 481–681, CS 483; Spring, 2006 by N. David Mermin. Last revised 2006-03-28, 30 page PDF document.
• {{Cite arXiv|eprint=quant-ph/0303175|last1= Lavor|first1= C.|title= Shor's Algorithm for Factoring Large Integers|last2= Manssur|first2= L. R. U.|last3= Portugal|first3= R.|year= 2003}}
• {{Cite arXiv|eprint=quant-ph/0010034|last1=Lomonaco|first1=Jr|title=Shor's Quantum Factoring Algorithm|year=2000}} This paper is a written version of a one-hour lecture given on Peter Shor's quantum factoring algorithm. 22 pages.
• [http://www.cs.princeton.edu/theory/complexity/quantumchap.pdf Chapter 20 Quantum Computation], from Computational Complexity: A Modern Approach, Draft of a book: Dated January 2007, Sanjeev Arora and Boaz Barak, Princeton University. Published as Chapter 10 Quantum Computation of Sanjeev Arora, Boaz Barak, "Computational Complexity: A Modern Approach", Cambridge University Press, 2009, {{isbn|978-0-521-42426-4}}
• [http://blogs.discovermagazine.com/80beats/2011/01/19/a-step-towards-quantum-computing-entangling-10-billion-particles/ A Step Toward Quantum Computing: Entangling 10 Billion Particles] {{Webarchive|url=https://web.archive.org/web/20110120103006/http://blogs.discovermagazine.com/80beats/2011/01/19/a-step-towards-quantum-computing-entangling-10-billion-particles/ |date=2011-01-20 }}, from "Discover Magazine", Dated January 19, 2011.
• [http://www.fi.muni.cz/usr/gruska/survey1.ps Josef Gruska - Quantum Computing Challenges] also in [https://www.amazon.com/Mathematics-Unlimited-Bj%C3%B6rn-Engquist/dp/3540669132 Mathematics unlimited: 2001 and beyond], Editors Björn Engquist, Wilfried Schmid, Springer, 2001, {{isbn|978-3-540-66913-5}}

• Version 1.0.0 of [http://www.libquantum.de/ libquantum]: contains a C language implementation of Shor's algorithm with their simulated quantum computer library, but the width variable in shor.c should be set to 1 to improve the runtime complexity.
• PBS Infinite Series created two videos explaining the math behind Shor's algorithm, "[http://www.pbs.org/video/how-to-break-cryptography-ahby1s/ How to Break Cryptography]" and "[http://www.pbs.org/video/hacking-at-quantum-speed-with-shors-algorithm-8jrjkq/ Hacking at Quantum Speed with Shor's Algorithm]".
• [https://short.classiq.io/shor Complete implementation of Shor's algorithm with Classiq]

{{Quantum computing}}

{{number theoretic algorithms}}

{{DEFAULTSORT:Shor's Algorithm}}

Category:Quantum algorithms

Category:Integer factorization algorithms

Category:Post-quantum cryptography

Category:Eponymous algorithms