A ON Shor'S Quantum Factoring Algorithm: Abstract
A ON Shor'S Quantum Factoring Algorithm: Abstract
LECTURE
ON
SHOR’S QUANTUM FACTORING ALGORITHM
VERSION 1.1
arXiv:quant-ph/0010034v1 9 Oct 2000
Contents
1. Preamble to Shor’s algorithm 1
2. Number theoretic preliminaries 2
3. Overview of Shor’s algorithm 3
4. Preparations for the quantum part of Shor’s algorithm 5
5. The quantum part of Shor’s algorithm 6
6. Peter Shor’s stochastic source S 8
7. A momentary digression: Continued fractions 10
8. Preparation for the final part of Shor’s algorithm 11
9. The final part of Shor’s algorithm 16
10. An example of Shor’s algorithm 17
References 21
This assumption is based on the fact that, in spite of the intensive efforts
over many centuries of the best minds to find a polynomial time factoring
algorithm, no one has succeeded so far. As of this writing, the most asymp-
totically efficient classical algorithm isthe number
h theoretic sievei[10], [11],
which factors an integer N in time O exp (lg N ) (lg lg N )2/3 . Thus,
1/3
However, ... Peter Shor suddenly changed the rules of the game.
Since the time of Euclid, it has been known that every positive integer N
can be uniquely (up to order) factored into the product of primes. Moreover,
1
RSA is a public key cryptographic system invented by Rivest, Shamir, Adleman.
Hence the name. For more information, please refer to [17].
A LECTURE ON SHOR’S FACTORING ALGORITHM 3
We begin by briefly describing all five steps. After that, we will then
focus in on the quantum part of the algorithm, i.e., STEP 2.
4 SAMUEL J. LOMONACO, JR.
Step 1. Choose a random positive integer m. Use the polynomial time Eu-
clidean algorithm2 to compute the greatest common divisor gcd (m, N )
of m and N . If the greatest common divisor gcd (m, N ) 6= 1, then we
have found a non-trivial factor of N , and we are done. If, on the other
hand, gcd (m, N ) = 1, then proceed to STEP 2.
2
The Euclidean algorithm is O lg2 N . For a description of the Euclidean algorithm,
see for example [3] or [2].
A LECTURE ON SHOR’S FACTORING ALGORITHM 5
Choose a power of 2
Q = 2L
such that
N 2 ≤ Q = 2L < 2N 2 ,
and consider f restricted to the set
SQ = {0, 1, . . . , Q − 1}
which we also denote by f , i.e.,
f : SQ −→ SQ .
3
In this step we could have instead applied the Hadamard transform to Register1
with the same result, but at the computational cost of O (lg N ) sufficiently local unitary
transformations. The term sufficiently local unitary transformationis defined in the last
part of section 7.7 of [13].
A LECTURE ON SHOR’S FACTORING ALGORITHM 7
STEP 2.2 Let Uf be the unitary transformation that takes |xi |0i to |xi |f (x)i.
Apply the linear transformation Uf to the two registers. The result
is:
Q−1 Q−1
1 X Uf 1 X
|ψ1 i = √ |xi |0i 7−→ |ψ2 i = √ |xi |f (x)i
Q x=0 Q x=0
Remark 2. The state of the two registers is now more than a superposition
of states. In this step, we have quantum entangled the two registers.
STEP 2.3. Apply the Q-point Fourier transform F to Reg1. The resulting state
is:
Q−1
X Q−1
X Q−1
X
F⊗I
|ψ2 i = √1 |xi |f (x)i 7−→ |ψ3 i = 1
ω xy |yi |f (x)i
Q Q
x=0 x=0 y=0
Q−1
X
1 |Υ(y)i
= Q k|Υ(y)ik · |yi k|Υ(y)ik ,
y=0
where
Q−1
X
|Υ(y)i = ω xy |f (x)i .
x=0
STEP 2.4. Measure Reg1, i.e., perform a measurement with respect to the or-
thogonal projections
|0i h0| ⊗ I, |1i h1| ⊗ I, |2i h2| ⊗ I, . . . , |Q − 1i hQ − 1| ⊗ I ,
where I denotes the identity operator on the Hilbert space of the second
register Reg2.
If after this computation, we ignore the two registers Reg1 and Reg2, we
see that what we have created is nothing more than a classical probability
distribution S on the sample space
{0, 1, 2, . . . , Q − 1} .
In other words, the sole purpose of executing STEPS 2.1 to 2.4 is to create
a classical finite memoryless stochastic source S which outputs a symbol
y0 ∈ {0, 1, 2, . . . , Q − 1} with the probability
k|Υ(y0 )ik2
P rob(y0 ) = .
Q2
Q0
P −1 −1 r−1 h i
X X
P X Q
P P0 +x0 y
= ω (P x1 +x0 )y |f (P x1 + x0 )i + ω |f (P x1 + x0 )i
x0 =0 x1 =0 x0 =0
Q
0 −1
P −1 r−1
X X P yx1
P X Q
P y P0
= ω x y · ω x y
0
|f (x0 )i + ω 0 ·ω |f (x0 )i
x0 =0 x1 =0 x0 =0
Q0
Q
0 −1
r−1
X P −1
X P yx1 X X P yx1
P P
= ω x0 y · ω |f (x0 )i + ω x0 y · ω |f (x0 )i
x0 =0 x1 =0 x0 =r x1 =0
2 2
2πi Q0 2πi Q0
·P y· +1 ·P y·
e Q P
−1 e Q P
−1
=r 2πi + (P − r)) 2πi
·P y ·P y
e Q −1 e Q −1
10 SAMUEL J. LOMONACO, JR.
where we have used the fact that ω is the primitive Q-th root of unity given
by
ω = e2πi/Q .
As a corollary, we have
p0 = a0 , p1 = a1 a0 + 1, pn = an pn−1 + pn−2 ,
q0 = 1, q1 = a1 , qn = an qn−1 + qn−2 .
j k
4 a a 1
{a}Q = a − Q · round Q
= a−Q· Q
+ 2
.
12 SAMUEL J. LOMONACO, JR.
π 1
P
π 1
N
π
≤ 2 · 1− N · 1+ Q ≤ 2 · 1− N · 1+ N2
< 2 ,
where we have made use of the inequalities
N 2 ≤ Q < 2N 2 and 0 < P ≤ N .
It immediately follows that
π {P y}Q Q0 π
· < .
Q P 2
Thus,
π{P y}Q Q0 π{P y}Q Q
r sin2 Q
· P
+1 +(P −r) sin2 Q
· P0
P rob (y) =
πP y
Q2 sin2 Q
2 2
4 π{P y}Q Q0 π{P y}Q Q
r· · · +1 +(P −r)· 42 · · P0
π2 Q P π Q
≥
π{P y}Q
2
Q2 Q
2
P·
Q0 2
4 P 4 1 Q−r
≥ π2
· Q2
= π2
· P · Q
2
4 1 r 4 1 1 2
= π2
· P · 1− Q ≥ π2
· P · 1− N
Lemma 1. Let
P
Y = y ∈ SQ | {P y}Q ≤ and SP = {d ∈ SQ | 0 ≤ d < P } .
2
Then the map
Y −→ SP
P
y 7−→ d = d(y) = round Q ·y
A LECTURE ON SHOR’S FACTORING ALGORITHM 13
We now need the following theorem5 from the theory of continued frac-
tions:
Theorem 1. Let ξ be a real number, and let a and b be integers with b > 0.
If
a 1
ξ− ≤ 2 ,
b 2b
then the rational number a/b is a convergent of the continued fraction ex-
pansion of ξ.
As a corollary, we have:
P d(y)
Corollary 2. If {P y}Q ≤ 2, then the rational number P is a convergent
y
of the continued fraction expansion of Q.
Proof. Since
P y − Qd(y) = {P y}Q ,
we know that
P
|P y − Qd(y)| ≤ ,
2
which can be rewritten as
y d(y) 1
− ≤ .
Q P 2Q
5
See [5, Theorem 184, Section 10.15].
14 SAMUEL J. LOMONACO, JR.
Since d(y)
P is a convergent of the continued fraction expansion of
y
Q, it
follows that, for some n,
d(y) pn
= ,
P qn
where pn and qn are relatively prime positive integers given by a recurrence
relation found in the previous subsection. So it would seem that we have
found a way of deducing the period P from the output y of STEP 2.4, and
so we are done.
Not quite!
The following theorem can be found in [5, Theorem 328, Section 18.4]:
A LECTURE ON SHOR’S FACTORING ALGORITHM 15
Theorem 2.
φ(N )
lim inf = e−γ ,
N/ ln ln N
where γ denotes Euler’s constant γ = 0.57721566490153286061 . . . , and
where e−γ = 0.5614594836 . . . .
As a corollary, we have:
Corollary 3.
4 e−γ − ǫ (P ) 1 2
P rob {y ∈ Y | gcd(d(y), P ) = 1} ≥ 2 · · 1− ,
π ln 2 lg lg N N
Thus, if STEP 2.4 is repeated O(lg lg N ) times, then the probability of suc-
cess is Ω (1).
Remark 5. For the curious reader, lower bounds LB(P ) of e−γ − ǫ (P ) for
3 ≤ P ≤ 841 are given in the following table:
P LB(P )
3 0.062
4 0.163
5 0.194
7 0.303
13 0.326
31 0.375
61 0.383
211 0.411
421 0.425
631 0.435
841 0.468
Thus, if one wants a reasonable bound on the P rob {y ∈ Y | gcd(d(y), P ) = 1}
before continuing with Shor’s algorithm, it would pay to first use a classical
algorithm to verify that the period P of the randomly chosen integer m is
not too small.
We are now prepared to give the last step in Shor’s algorithm. This step
can be performed on a classical computer.
Step 2.5 Compute the period P from the integer y produced by STEP 2.4.
The indicated algorithm for computing mqn mod N requires O(lg qn ) arithmetic
6
operations.
A LECTURE ON SHOR’S FACTORING ALGORITHM 17
• End of Loop
• If you happen to reach this point, you are a very unlucky quantum
computer scientist. You must start over by returning to STEP
2.0. But don’t give up hope! The probability that the integer y
produced by STEP 2.4 will lead to a successful completion of Step
2.5 is bounded below by
4 e−γ − ǫ (P ) 1 2 0.232 1 2
· · 1− > · 1− ,
π 2 ln 2 lg lg N N lg lg N N
provided the period P is greater than 3. [ γ denotes Euler’s
constant.]
f (a) 1 3 9 27 81 61 1 3 · · ·
∴ Unknown period P = 6
STEP 2.0 Initialize registers 1 and 2. Thus, the state of the two registers becomes:
|ψ0 i = |0i |0i
18 SAMUEL J. LOMONACO, JR.
STEP 2.1 Apply the Q-point Fourier transform F to register #1, where
16383
X
1
F |ki = √ ω 0·x |xi ,
16384 x=0
2πi
and where ω is a primitive Q-th root of unity, e.g., ω = e 16384 . Thus
the state of the two registers becomes:
16383
X
1
|ψ1 i = √ |xi |0i
16384 x=0
STEP 2.2 Apply the unitary transformation Uf to registers #1 and #2, where
Uf |xi |ℓi = |xi | f (x) − ℓ mod 91i .
(Please note that Uf2 = I.) Thus, the state of the two registers becomes:
1 P16383 x
|ψ2 i = √16384 x=0 |xi |3 mod 91i
+ |12i |1i + |13i |3i + |14i |9i + |15i |27i + |16i |81i + |17i |61i
+ ...
Remark 7. The state of the two registers is now more than a superposition
of states. We have in the above step quantum entangled the two registers.
STEP 2.3 Apply the Q-point F again to register #1. Thus, the state of the
system becomes:
1 P16383 1 P16383 xy
|ψ3 i = √16384 x=0
√
16384 y=0 ω |yi |3x mod 91i
1 P16383 P16383
= 16384 x=0 |yi x=0 ω xy |3x mod 91i
1 P16383
= 16384 x=0 |yi |Υ (y)i ,
A LECTURE ON SHOR’S FACTORING ALGORITHM 19
where
16383
X
|Υ (y)i = ω xy |3x mod 91i
x=0
Thus,
|Υ (y)i = |1i + ω y |3i + ω 2y |9i + ω 3y |27i + ω 4y |81i + ω 5y |61i
+ ω 12y |1i + ω 13y |3i + ω 14y |9i + ω 15y |27i + ω 16y |81i + ω 17y |61i
+ ...
STEP 2.4 Measure Reg1. The result of our measurement just happens to turn
out to be
y = 13453
Step 2.5 Using the recurrence relations found in subsection 13.7 of this paper,
we successively compute (beginning with n = 0) the an ’s and qn ’s for
the continued fraction expansion of
y 13453
ξ= = .
Q 16384
For each non-trivial n in succession, we check to see if
3qn = 1 mod 91.
If this is the case, then we know qn = P , and we immediately exit from
Step 2.5 and proceed to Step 3.
To satisfy the reader’s curiosity we have listed in the table below all the
values of an , pn , and qn for n = 0, 1, . . . , 14. But it should be mentioned
again that we need only to compute an and qn for n = 0, 1, 2, 3, as indicated
above.
n 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14
an 0 1 4 1 1 2 3 1 1 3 1 1 1 1 3
pn 0 1 4 5 9 23 78 101 179 638 817 1455 2272 3727 13453
qn 1 1 5 6 11 28 95 123 218 777 995 1772 2767 4539 16384
Step 4. Since
3P/2 = 33 = 27 6= −1 mod 91,
we goto Step 5.
A LECTURE ON SHOR’S FACTORING ALGORITHM 21
References
[1] Brassard, Gilles, and Paul Bratley, “Algorithmics: Theory and Practice,”
Printice-Hall, (1988).
[2] Cormen, Thomas H., Charles E. Leiserson, and Ronald L. Rivest, “Introduction to
Algorithms,” McGraw-Hill, (1990).
[3] Cox, David, John Little, and Donal O’Shea, “Ideals, Varieties, and Algorithms,”
(second edition), Springer-Verlag, (1996).
[4] Ekert, Artur K.and Richard Jozsa, Quantum computation and Shor’s factoring
algorithm, Rev. Mod. Phys., 68,(1996), pp 733-753.
[5] Hardy, G.H., and E.M. Wright, “An Introduction to the Theory of Numbers,”
Oxford Press, (1965).
[6] Hoyer, Peter, Efficient quantum transforms, quant-ph/9702028.
[7] Jozsa, Richard, Quantum algorithms and the Fourier transform, quant-ph
preprint archive 9707033 17 Jul 1997.
[8] Jozsa, Richard, Proc. Roy. Soc. London Soc., Ser. A, 454, (1998), 323 - 337.
[9] Kitaev, A., Quantum measurement and the abelian stabiliser problem,
(1995), quant-ph preprint archive 9511026.
[10] Lenstra, A.K., and H.W. Lenstra, Jr., eds., “The Development of the Number
Field Sieve,” Lecture Notes in Mathematics, Vol. 1554, Springer-Velag, (1993).
[11] Lenstra, A.K., H.W. Lenstra, Jr., M.S. Manasse, and J.M. Pollard, The number
field sieve. Proc. 22nd Annual ACM Symposium on Theory of ComputingACM,
New York, (1990), pp 564 - 572. (See exanded version in Lenstra & Lenstra, (1993),
pp 11 - 42.)
[12] LeVeque, William Judson, “Topics in Number Theory: Volume I,” Addison-
Wesley, (1958).
[13] Lomonaco, Samuel J., Jr., A Rosetta Stone for quantum mechanics with an
introduction to quantum computation: Lecture Notes for the AMS Short
Course on Quantum Computation, Washington, DC, January 2000, in
“Quantum Computation,” edited by S.J. Lomonaco, Jr., AMS PSAPM Series.
(to appear)
[14] Miller, G. L., Riemann’s hypothesis and tests for primality, J. Comput. System
Sci., 13, (1976), pp 300 - 317.
[15] Shor, Peter W., Polynomial time algorithms for prime factorization and
discrete logarithms on a quantum computer, SIAM J. on Computing, 26(5)
(1997), pp 1484 - 1509. (quant-ph/9508027)
[16] Shor, Peter W., Introduction to quantum algorithms, Lecture Notes for the
AMS Short Course on Quantum Computation, Washington, DC, January
2000,” to appear in “Quantum Computation,” edited by S.J. Lomonaco, AMS
PSAPM Series. (To appear) (quant-ph/0005003)
[17] Stinson, Douglas R., “Cryptography: Theory and Practice,” CRC Press, Boca
Raton, (1995).
22 SAMUEL J. LOMONACO, JR.