# Shor's algorithm

(Redirected from Shor algorithm)

Shor's algorithm, named after mathematician Peter Shor, is a quantum algorithm (an algorithm that runs on a quantum computer) for integer factorization formulated in 1994. Informally, it solves the following problem: given an integer N, find its prime factors.

On a quantum computer, to factor an integer N, Shor's algorithm runs in polynomial time (the time taken is polynomial in log N, which is the size of the input).[1] Specifically it takes quantum gates of order O((log N)2(log log N)(log log log N)) using fast multiplication,[2] demonstrating that the integer factorization problem can be efficiently solved on a quantum computer and is thus in the complexity class BQP. This is almost exponentially faster than the most efficient known classical factoring algorithm, the general number field sieve, which works in sub-exponential time – about O(e1.9 (log N)1/3 (log log N)2/3).[3] The efficiency of Shor's algorithm is due to the efficiency of the quantum Fourier transform, and modular exponentiation by repeated squarings.

If a quantum computer with a sufficient number of qubits could operate without succumbing to noise and other quantum decoherence phenomena, Shor's algorithm could be used to break public-key cryptography schemes such as the widely used RSA scheme. RSA is based on the assumption that factoring large numbers is computationally intractable. So far as is known, this assumption is valid for classical (non-quantum) computers; no classical algorithm is known that can factor in polynomial time. However, Shor's algorithm shows that factoring is efficient on an ideal quantum computer, so it may be feasible to defeat RSA by constructing a large quantum computer. It was also a powerful motivator for the design and construction of quantum computers and for the study of new quantum computer algorithms. It has also facilitated research on new cryptosystems that are secure from quantum computers, collectively called post-quantum cryptography.

In 2001, Shor's algorithm was demonstrated by a group at IBM, who factored 15 into 3 × 5, using an NMR implementation of a quantum computer with 7 qubits.[4] After IBM's implementation, two independent groups implemented Shor's algorithm using photonic qubits, emphasizing that multi-qubit entanglement was observed when running the Shor's algorithm circuits.[5][6] In 2012, the factorization of 15 was performed with solid-state qubits.[7] Also in 2012, the factorization of 21 was achieved, setting the record for the largest number factored with Shor's algorithm.[8] In April 2012, the factorization of 143 (=11×13) was achieved, although this used adiabatic quantum computation rather than Shor's algorithm.[9] In November 2014, it was discovered that this 2012 adiabatic quantum computation had also factored larger numbers, the largest being 56153,[10][11] (this number is equal to 233×241).

## Procedure

The problem we are trying to solve is, given an odd composite number ${\displaystyle N}$, find an integer ${\displaystyle d}$, strictly between ${\displaystyle 1}$ and ${\displaystyle N}$, that divides ${\displaystyle N}$. We are interested in odd values of ${\displaystyle N}$ because any even value of ${\displaystyle N}$ trivially has the number ${\displaystyle 2}$ as a prime factor. We can use a primality testing algorithm to make sure that ${\displaystyle N}$ is indeed composite.

Moreover, for the algorithm to work, we need ${\displaystyle N}$ not to be the power of a prime. This can be tested by checking that ${\displaystyle {\sqrt[{k}]{N}}}$ is not an integer, for all ${\displaystyle k\leq \log _{2}(N)}$.

Since ${\displaystyle N}$ is not a power of a prime, it is the product of two coprime numbers greater than ${\displaystyle 1}$. As a consequence of the Chinese remainder theorem, the number ${\displaystyle 1}$ has at least four distinct square roots modulo ${\displaystyle N}$, two of them being ${\displaystyle 1}$ and ${\displaystyle -1}$. The aim of the algorithm is to find a square root ${\displaystyle b}$ that is different from ${\displaystyle 1}$ and ${\displaystyle -1}$; such a ${\displaystyle b}$ will lead to a factorization of ${\displaystyle N}$, as in other factoring algorithms like the quadratic sieve.

In turn, finding such a ${\displaystyle b}$ is reduced to finding an element ${\displaystyle a}$ of even period with a certain additional property (as explained below, it is required that the condition of Step 6 of the classical part does not hold). The quantum algorithm is used for finding the period of randomly chosen elements ${\displaystyle a}$, as this is a hard problem on a classical computer.

Shor's algorithm consists of two parts:

1. A reduction, which can be done on a classical computer, of the factoring problem to the problem of order-finding.
2. A quantum algorithm to solve the order-finding problem.

### Classical part

1. Pick a random number a < N.
2. Compute gcd(a, N). This may be done using the Euclidean algorithm.
3. If gcd(a, N) ≠ 1, then this number is a nontrivial factor of N, so we are done.
4. Otherwise, use the quantum period-finding subroutine (below) to find r, the period of the following function:
${\displaystyle f(x)=a^{x}{\bmod {N}}.}$

This is the order ${\displaystyle r}$ of ${\displaystyle a}$ in the ${\displaystyle (\mathbb {Z} _{N})^{\times }}$, which is the smallest positive integer r for which ${\displaystyle f(x+r)=f(x)}$, or ${\displaystyle f(x+r)=a^{x+r}{\bmod {N}}\equiv a^{x}{\bmod {N}}.}$ By Euler's Theorem,

${\displaystyle r}$ divides ${\displaystyle \varphi (N)}$, the Euler's totient function.
5. If r is odd, go back to step 1.
6. If a r /2 ${\displaystyle \equiv }$ −1 (mod N), go back to step 1.
7. gcd(ar/2 + 1, N) and gcd(ar/2 - 1, N) are both nontrivial factors of N. We are done.

For example: ${\displaystyle N=15,a=7,r=4}$, ${\displaystyle \mathrm {gcd} (7^{2}\pm 1,15)=\mathrm {gcd} (49\pm 1,15)}$, where ${\displaystyle \mathrm {gcd} (48,15)=3}$, and ${\displaystyle \mathrm {gcd} (50,15)=5}$. For ${\displaystyle N}$ that is a product of two distinct primes ${\displaystyle p}$ and ${\displaystyle q}$, the Euler's totient function ${\displaystyle \varphi (N)}$ is just ${\displaystyle N-p-q+1}$, which for ${\displaystyle N=15}$ is ${\displaystyle 8}$. Note, ${\displaystyle r}$ divides ${\displaystyle 8}$.

### Quantum part: period-finding subroutine

Quantum subroutine in Shor's algorithm.

The quantum circuits used for this algorithm are custom designed for each choice of N and each choice of the random a used in f(x) = ax mod N. Given N, find Q = 2q such that ${\displaystyle N^{2}\leq Q<2N^{2}}$, which implies ${\displaystyle Q/r>N}$. The input and output qubit registers need to hold superpositions of values from 0 to Q − 1, and so have q qubits each. Using what might appear to be twice as many qubits as necessary guarantees that there are at least N different x which produce the same f(x), even as the period r approaches N/2.

Proceed as follows:

1. Initialize the registers to
${\displaystyle Q^{-{\frac {1}{2}}}\sum _{x=0}^{Q-1}\left|x\right\rangle =\left({\frac {1}{\sqrt {2}}}\sum _{x_{1}=0}^{1}\left|x_{1}\right\rangle \right)\otimes ...\otimes \left({\frac {1}{\sqrt {2}}}\sum _{x_{q}=0}^{1}\left|x_{q}\right\rangle \right)}$
This initial state is a superposition of Q states, and is easily obtained by generating q independent qubits, each a superposition of "0" and "1" states. We can accomplish this by initializing the qubits to the zero-position, and then applying the hadamard gate in parallel to each of the q qubits, where ${\displaystyle 2^{q}=Q}$.
2. Construct f(x) as a quantum function and apply it to the above state, to obtain
${\displaystyle Q^{-{\frac {1}{2}}}\sum _{x}\left|x,f(x)\right\rangle .}$
This is still a superposition of Q states. However, the ${\displaystyle q+n}$ qubits, i.e the q input qubits and ${\displaystyle n\;(>\log _{2}(N))}$ output qubits, are now entangled or not separable, as the state cannot be written as a tensor product of states of individual qubits.
3. Apply the quantum Fourier transform to the input register. This transform (operating on a superposition of power-of-two Q = 2q states) uses a Qth root of unity such as ${\displaystyle \omega =e^{\frac {2\pi i}{Q}}}$ to distribute the amplitude of any given ${\displaystyle \left|x\right\rangle }$ state equally among all Q of the ${\displaystyle \left|y\right\rangle }$ states, and to do so in a different way for each different x.
• Let y be one of the r possible integers modulo Q such that yr/Q is an integer; then
${\displaystyle U_{QFT}\left|x\right\rangle =Q^{-{\frac {1}{2}}}\sum _{y}\omega ^{xy}\left|y\right\rangle .}$
This leads to the final state
${\displaystyle Q^{-1}\sum _{x}\sum _{y}\omega ^{xy}\left|y,f(x)\right\rangle .}$
Now we reorder this sum as
${\displaystyle Q^{-1}\sum _{z}\sum _{y}\left|y,z\right\rangle \sum _{x:\,f(x)=z}\omega ^{xy}.}$
This is a superposition of many more than Q states, but many fewer than Q2 states, since there are fewer than Q distinct values of ${\displaystyle z=f(x)}$. Let
• ${\displaystyle \omega =e^{\frac {2\pi i}{Q}}}$ be a Qth root of unity,
• r be the period of f,
• x0 be the smallest of the x which have f(x) = z (we have x0 < r), and
• b indexes these x, running from 0 to ${\displaystyle \lfloor (Q-x_{0}-1)/r\rfloor }$ so that ${\displaystyle x_{0}+rb
Then ${\displaystyle \omega ^{ry}}$ is a unit vector in the complex plane (${\displaystyle \omega }$ is a root of unity and r and y are integers), and the coefficient of ${\displaystyle Q^{-1}\left|y,z\right\rangle }$ in the final state is
${\displaystyle \sum _{x:\,f(x)=z}\omega ^{xy}=\sum _{b}\omega ^{(x_{0}+rb)y}=\omega ^{x_{0}y}\sum _{b}\omega ^{rby}.}$
Each term in this sum represents a different path to the same result, and quantum interference occurs – constructive when the unit vectors ${\displaystyle \omega ^{ryb}}$ point in nearly the same direction in the complex plane, which requires that ${\displaystyle \omega ^{ry}}$ point along the positive real axis.
4. Perform a measurement. We obtain some outcome y in the input register and z in the output register. Since f is periodic, the probability of measuring some pair y and z is given by
${\displaystyle \left|Q^{-1}\sum _{x:\,f(x)=z}\omega ^{xy}\right|^{2}=Q^{-2}\left|\sum _{b}\omega ^{(x_{0}+rb)y}\right|^{2}=Q^{-2}\left|\sum _{b}\omega ^{bry}\right|^{2}.}$
Analysis now shows that this probability is higher the closer the unit vector ${\displaystyle \omega ^{ry}}$ is to the positive real axis, or the closer yr/Q is to an integer. Unless r is a power of 2, it won't be a factor of Q.
5. Since ${\displaystyle yr/Q}$ is close to some integer c, the known value y/Q is close to the unknown value c/r. Performing [classical] continued fraction expansion on y/Q allows us to find approximations d/s of it which satisfy two conditions:
1. s < N
2. |y/Q − d/s| < 1/(2Q).
Given these conditions (and assuming d/s is irreducible), s is very likely to be the appropriate period r, or at least a factor of it.
6. Check [classically] if ${\displaystyle f(x)=f(x+s)\Leftrightarrow a^{s}\equiv 1{\pmod {N}}}$ If so, we are done.
7. Otherwise, [classically] obtain more candidates for r by using multiples of s, or by using other s with d/s near y/Q. If any candidate works, we are done.
8. Otherwise, try again starting from step 1 of this subroutine.

## Explanation of the algorithm

The algorithm is composed of two parts. The first part of the algorithm turns the factoring problem into the problem of finding the period of a function, and may be implemented classically. The second part finds the period using the quantum Fourier transform, and is responsible for the quantum speedup.

### Obtaining factors from period

The integers less than N and coprime with N form the multiplicative group of integers modulo N, a finite abelian group ${\displaystyle G}$. The size of this group is given by Euler's totient function ${\displaystyle \phi (N)}$. By the end of step 3, we have an integer ${\displaystyle a}$ in this group. Since the group is finite, ${\displaystyle a}$ must have a finite order ${\displaystyle r}$, the smallest positive integer such that

${\displaystyle a^{r}\equiv 1\ {\mbox{mod}}\ N.}$

Therefore, ${\displaystyle N}$ divides ${\displaystyle a^{r}-1}$ (also written ${\displaystyle N\mid a^{r}-1}$). Suppose we are able to obtain r, and it is even. (If r is odd, see step 5.) Now ${\displaystyle b\equiv a^{r/2}{\pmod {N}}}$ is a square root of 1 modulo ${\displaystyle N}$, different from 1. This is because ${\displaystyle r}$ is the order of ${\displaystyle a}$ modulo ${\displaystyle N}$, so ${\displaystyle a^{r/2}\not \equiv 1{\pmod {N}}}$, else the order of ${\displaystyle a}$ in this group would be ${\displaystyle r/2}$. If ${\displaystyle a^{r/2}\equiv -1{\pmod {N}}}$, by step 6 we have to restart the algorithm with a different random number ${\displaystyle a}$.

Eventually, we must hit an ${\displaystyle a}$, of order ${\displaystyle r}$ in ${\displaystyle G}$, such that ${\displaystyle b\equiv a^{r/2}\not \equiv 1,-1{\pmod {N}}}$. This is because such a ${\displaystyle b}$ is a square root of 1 modulo ${\displaystyle N}$, other than 1 and ${\displaystyle -1}$, whose existence is guaranteed by the Chinese remainder theorem, since ${\displaystyle N}$ is not a prime power.

We claim that ${\displaystyle d=\operatorname {gcd} (b-1,N)}$ is a proper factor of ${\displaystyle N}$, that is, ${\displaystyle d\neq 1,N}$. In fact if ${\displaystyle d=N}$, then ${\displaystyle N}$ divides ${\displaystyle b-1}$, so that ${\displaystyle b\equiv 1{\pmod {N}}}$, against the construction of ${\displaystyle b}$. If on the other hand ${\displaystyle d=\operatorname {gcd} (b-1,N)=1}$, then by Bézout's identity there are integers ${\displaystyle u,v}$ such that

${\displaystyle (b-1)u+Nv=1}$.

Multiplying both sides by ${\displaystyle b+1}$ we obtain

${\displaystyle (b^{2}-1)u+N(b+1)v=b+1}$.

Since ${\displaystyle N}$ divides ${\displaystyle b^{2}-1\equiv a^{r}-1{\pmod {N}}}$, we obtain that ${\displaystyle N}$ divides ${\displaystyle b+1}$, so that ${\displaystyle b\equiv -1{\pmod {N}}}$, again contradicting the construction of ${\displaystyle b}$.

Thus ${\displaystyle d}$ is the required proper factor of ${\displaystyle N}$.

### Finding the period

Shor's period-finding algorithm relies heavily on the ability of a quantum computer to be in many states simultaneously. Physicists call this behavior a "superposition" of states. To compute the period of a function f, we evaluate the function at all points simultaneously.

Quantum physics does not allow us to access all this information directly, though. A measurement will yield only one of all possible values, destroying all others. If not for the no cloning theorem, we could first measure f(x) without measuring x, and then make a few copies of the resulting state (which is a superposition of states all having the same f(x)). Measuring x on these states would provide different x values which give the same f(x), leading to the period. Because we cannot make exact copies of a quantum state, this method does not work. Therefore, we have to carefully transform the superposition to another state that will return the correct answer with high probability. This is achieved by the quantum Fourier transform.

Shor thus had to solve three "implementation" problems. All of them had to be implemented "fast", which means that they can be implemented with a number of quantum gates that is polynomial in ${\displaystyle \log N}$.

1. Create a superposition of states. This can be done by applying Hadamard gates to all qubits in the input register. Another approach would be to use the quantum Fourier transform (see below).
2. Implement the function f as a quantum transform. To achieve this, Shor used repeated squaring for his modular exponentiation transformation. It is important to note that this step is more difficult to implement than the quantum Fourier transform, in that it requires ancillary qubits and substantially more gates to accomplish.
3. Perform a quantum Fourier transform. By using controlled rotation gates and Hadamard gates, Shor designed a circuit for the quantum Fourier transform (with Q = 2q) that uses just ${\displaystyle q(q-1)/2=O((\log Q)^{2})}$ gates.[12]

After all these transformations a measurement will yield an approximation to the period r. For simplicity assume that there is a y such that yr/Q is an integer. Then the probability to measure y is 1. To see that we notice that then

${\displaystyle e^{-{\frac {2\pi ibyr}{Q}}}=1}$

for all integers b. Therefore, the sum whose square gives us the probability to measure y will be Q/r since b takes roughly Q/r values and thus the probability is ${\displaystyle 1/r^{2}}$. There are r y such that yr/Q is an integer and also r possibilities for ${\displaystyle f(x_{0})}$, so the probabilities sum to 1.

Note: another way to explain Shor's algorithm is by noting that it is just the quantum phase estimation algorithm in disguise.

### The bottleneck

The runtime bottleneck of Shor's algorithm is quantum modular exponentiation, which is by far slower than the quantum Fourier transform and classical pre-/post-processing. There are several approaches to constructing and optimizing circuits for modular exponentiation. The simplest and (currently) most practical approach is to mimic conventional arithmetic circuits with reversible gates, starting with ripple-carry adders. Knowing the base and the modulus of exponentiation facilitates further optimizations.[13][14] Reversible circuits typically use on the order of ${\displaystyle n^{3}}$ gates for ${\displaystyle n}$ qubits. Alternative techniques asymptotically improve gate counts by using quantum Fourier transforms, but are not competitive with fewer than 600 qubits due to high constants.

## Discrete logarithms

Given prime ${\displaystyle p}$ with generator ${\displaystyle g}$ where ${\displaystyle 1, suppose we know that ${\displaystyle x=g^{r}{\pmod {p}}}$, for some r, and we wish to compute r, which is the discrete logarithm: ${\displaystyle r=\log _{g}x{\pmod {p}}}$. Consider the abelian group ${\displaystyle \left(\mathbb {Z} _{p}\right)^{\times }\times \left(\mathbb {Z} _{p}\right)^{\times }}$ where each factor corresponds to modular multiplication of nonzero values, assuming p is prime. Now, consider the function

${\displaystyle f(a,b)=g^{a}x^{-b}{\pmod {p}}.}$

This gives us an abelian hidden subgroup problem, as f corresponds to a group homomorphism. The kernel corresponds to modular multiples of (r,1). So, if we can find the kernel, we can find r.

## In popular culture

On the television show Stargate Universe, the lead scientist, Dr. Nicholas Rush, hoped to use Shor's algorithm to crack Destiny's master code. He taught a quantum cryptography class at the University of California, Berkeley, in which Shor's algorithm was studied.

In the animated film Summer Wars, the character Kenji Koiso reads an article titled "Shor's Factorization Algorithm" while riding on a train, foreshadowing his ability to understand and calculate complex equations.

In the TV series The Big Bang Theory it was mentioned in a Physics bowl competition in season 1 episode 13.

## References

2. ^ Beckman, David; Chari, Amalavoyal N.; Devabhaktuni, Srikrishna; Preskill, John (1996). "Efficient Networks for Quantum Factoring" (PDF). Physical Review A. 54 (2): 1034–1063. arXiv:quant-ph/9602016. Bibcode:1996PhRvA..54.1034B. doi:10.1103/PhysRevA.54.1034.
3. ^ "Number Field Sieve". wolfram.com. Retrieved 23 October 2015.
4. ^ Vandersypen, Lieven M. K.; Steffen, Matthias; Breyta, Gregory; Yannoni, Costantino S.; Sherwood, Mark H. & Chuang, Isaac L. (2001), "Experimental realization of Shor's quantum factoring algorithm using nuclear magnetic resonance" (PDF), Nature, 414 (6866): 883–887, arXiv:quant-ph/0112176, Bibcode:2001Natur.414..883V, doi:10.1038/414883a, PMID 11780055
5. ^ Lu, Chao-Yang; Browne, Daniel E.; Yang, Tao & Pan, Jian-Wei (2007), "Demonstration of a Compiled Version of Shor's Quantum Factoring Algorithm Using Photonic Qubits" (PDF), Physical Review Letters, 99 (25): 250504, arXiv:0705.1684, Bibcode:2007PhRvL..99y0504L, doi:10.1103/PhysRevLett.99.250504
6. ^ Lanyon, B. P.; Weinhold, T. J.; Langford, N. K.; Barbieri, M.; James, D. F. V.; Gilchrist, A. & White, A. G. (2007), "Experimental Demonstration of a Compiled Version of Shor's Algorithm with Quantum Entanglement" (PDF), Physical Review Letters, 99 (25): 250505, arXiv:0705.1398, Bibcode:2007PhRvL..99y0505L, doi:10.1103/PhysRevLett.99.250505, PMID 18233509
7. ^ Lucero, Erik; Barends, Rami; Chen, Yu; Kelly, Julian; Mariantoni, Matteo; Megrant, Anthony; O'Malley, Peter; Sank, Daniel; Vainsencher, Amit; Wenner, James; White, Ted; Yin, Yi; Cleland, Andrew N.; Martinis, John M. (2012). "Computing prime factors with a Josephson phase qubit quantum processor". Nature Physics. 8 (10): 719. arXiv:1202.5707. Bibcode:2012NatPh...8..719L. doi:10.1038/nphys2385.
8. ^ Martín-López, Enrique; Enrique Martín-López; Anthony Laing; Thomas Lawson; Roberto Alvarez; Xiao-Qi Zhou; Jeremy L. O'Brien (12 October 2012). "Experimental realization of Shor's quantum factoring algorithm using qubit recycling". Nature Photonics. 6 (11): 773. arXiv:1111.4147. Bibcode:2012NaPho...6..773M. doi:10.1038/nphoton.2012.259. Retrieved October 23, 2012.
9. ^ Nanyang Xu; Jing Zhu; Dawei Lu; Xianyi Zhou; Xinhua Peng; Jiangfeng Du (30 March 2012). "Quantum Factorization of 143 on a Dipolar-Coupling Nuclear Magnetic Resonance System". Physical Review Letters. 108 (13): 130501. Bibcode:2012PhRvL.108m0501X. doi:10.1103/PhysRevLett.108.130501. PMID 22540684.
10. ^ Zyga, Lisa (28 November 2014). "New largest number factored on a quantum device is 56,153". Phys.org. Science X Network. Retrieved 4 August 2015.
11. ^ Nikesh S. Dattani; Nathaniel Bryans (November 2014). "Quantum factorization of 56153 with only 4 qubits". arXiv:1411.6758 [quant-ph].
12. ^ Shor 1999, p. 14.
13. ^ Markov, Igor L.; Saeedi, Mehdi (2012). "Constant-Optimized Quantum Circuits for Modular Multiplication and Exponentiation". Quantum Information and Computation. 12 (5–6): 361–394. arXiv:1202.6614. Bibcode:2012arXiv1202.6614M.
14. ^ Markov, Igor L.; Saeedi, Mehdi (2013). "Faster Quantum Number Factoring via Circuit Synthesis". Phys. Rev. A. 87: 012310. arXiv:1301.3210. Bibcode:2013PhRvA..87a2310M. doi:10.1103/PhysRevA.87.012310.
15. ^ Bernstein, Daniel J.; Heninger, Nadia; Lou, Paul; Valenta, Luke (2017). "Post-quantum RSA" (PDF). International Workshop on Post-Quantum Cryptography: 311–329. Archived (PDF) from the original on 2017-04-20.