yawiki.org entry for Shor's algorithm

	Navigation Home Recent Most Active Popular Blog Credits RSS
	Interaction Register Statistics
	Help Suggestions Contact Us How to Edit Help

[Edit]

Shor's algorithm is a quantum algorithm for factoring a number N in O((log N)³) time and O(log N) space, named after Peter Shor.
The algorithm is significant because it implies that RSA, a popular public-key cryptography method, might be easily broken, given a sufficiently large quantum computer. RSA uses a public key N which is the product of two large prime numbers. One way to crack RSA encryption is by factoring N, but with classical algorithms, factoring becomes increasingly time-consuming as N grows large; more specifically, no classical algorithm is known that can factor in time O((log N)^k) for any k. By contrast, Shor's algorithm can crack RSA in polynomial time.

Like many quantum computer algorithms, Shor's algorithm is probabilistic: it gives the correct answer with high probability, and the probability of failure can be decreased by repeating the algorithm. However, since a proposed answer (in particular primality) is polynomial time verifiable, the algorithm can be modified to work in expected polynomial time with zero error.

Shor's algorithm was discovered in 1994 by Peter Shor, but the classical part was known before, it is credited to G. L. Miller. Seven years later, in 2001, it was demonstrated by a group at IBM, which factored 15 into 3 and 5, using a quantum computer with 7 qubits.

    Shor's algorithm
        Procedure
            Classical part
            Quantum part: Period-finding subroutine
    N^{-1/2} sum_y e^{-2pi i x y/N} left|y
    N^{-2} left| sum_{b} e^{-2pi i (x_0 + r b) y/N}
        Explanation of the algorithm
            I. Obtaining factors from period
            II. Finding the period
        Modifications to Shors Algorithm

top

Procedure

The problem we are trying to solve is that, given an integer N, we try to find another integer p between 1 and N that divides N.

Shor's algorithm consists of two parts:

A reduction of the factoring problem to the problem of order-finding, which can be done on a classical computer.

A quantum algorithm to solve the order-finding problem.

top

Classical part

Pick a random number a < N

Compute gcd(a, N). This may be done using the Euclidean algorithm.

If gcd(a, N) ≠ 1, then there is a nontrivial factor of N, so we are done.

Otherwise, use the period-finding subroutine (below) to find r, the period of the following function:

$f(x) = a^x mbox N$ ,

i.e. the smallest integer r for which
$f(x+r) = f(x)$ .

If r is odd, go back to step 1.

If a ^r/2 ≡ -1 (mod N), go back to step 1.

The factors of N are gcd(a^r/2 ± 1, N). We are done.

top

Quantum part: Period-finding subroutine

Start with a pair of input and output qubit registers with log₂N qubits each, and initialize them to

$N^ sum_x left|x$
ight angle left|0 ight angle

where x runs from 0 to N - 1.

Construct f(x) as a quantum function and apply it to the above state, to obtain

$N^ sum_x left|x$
ight angle left|f(x) ight angle

Apply the inverse quantum Fourier transform on the input register. The
inverse quantum Fourier transform on N points is defined by:

$U_ left|x$
ight angle
top N^{-1/2} sum_y e^{-2pi i x y/N} left|y ight angle

This leaves us in the following state:

$N^ sum_x sum_y e^ left|y$
ight angle left|f(x) ight angle

Perform a measurement.
We obtain some outcome y in the input register and $f(x_0)$ in the output register.
Since f is periodic, the probability of measuring some pair y and $f(x_0)$ is given by

$left| N^ sum_ e^$
ight|^2
top N^{-2} left| sum_{b} e^{-2pi i (x_0 + r b) y/N} ight|^2

Analysis now shows that this probability is higher, the closer yr/N is to an integer.

Turn y/N into an irreducible fraction, and extract the denominator r′, which is a candidate for r.

Check if f(x) = f(x + r′). If so, we are done.

Otherwise, obtain more candidates for r by using values near y, or multiples of r′. If any candidate works, we are done.

Otherwise, go back to step 1 of the subroutine.

top

Explanation of the algorithm

The algorithm is composed of two parts. The first part of the algorithm turns the factoring problem into the problem of finding the period of a function, and may be implemented classically. The second part finds the period using the inverse quantum Fourier transform, and is responsible for the quantum speedup.

top

I. Obtaining factors from period

The integers less than N and coprime with N form a finite group under multiplication modulo N, which is typically denoted (Z/NZ)^×. By the end of step 3, we have an integer a in this group. Since the group is finite, a must have a finite order r, the smallest positive integer such that

$a^r equiv 1 mbox N.,$

Therefore, N | (a ^r − 1). Suppose we are able to obtain r, and it is even. Then

$a^r - 1 = (a^ - 1) (a^ + 1) equiv 0 mbox N$

$Rightarrow N | (a^ - 1) (a^ + 1).,$

r is the smallest positive integer such that a ^r ≡ 1, so N cannot divide (a ^{r / 2} − 1). If N also does not divide (a ^{r / 2} + 1), then N must have a nontrivial common factor with each of (a ^{r / 2} − 1) and (a ^{r / 2} + 1).

Proof: For simplicity, denote (a ^{r / 2} − 1) and (a ^{r / 2} + 1) by u and v respectively. N | uv, so kN = uv for some integer k. Suppose gcd(u, N) = 1; then mu + nN = 1 for some integers m and n (this is a property of the greatest common divisor.) Multiplying both sides by v, we find that mkN + nvN = v, so N | v. By contradiction, gcd(u, N) ≠ 1. By a similar argument, gcd(v, N) ≠ 1.

This supplies us with a factorization of N. If N is the product of two primes, this is the only possible factorization.

top

II. Finding the period

Shor's period-finding algorithm relies heavily on the ability of a quantum computer to be in many states simultaneously.
Physicists call this behaviour a "superposition" of states. To compute the period of a function f, we evaluate the function at all points simultaneously.

Quantum physics does not allow us to access all this information directly, though. A measurement will yield only one of all possible values, destroying all others.
Therefore we have to carefully transform the superposition to another state that will return the correct answer with high probability.
This is achieved by the inverse quantum Fourier transform.

Shor thus had to solve three "implementation" problems.
All of them had to be implemented "fast", which means that they can be implemented with a number of quantum gates that is polynomial in

log N

Create a superposition of states.

This can be done by applying Hadamard gates to all qubits in the input register.
Another approach would be to use the quantum Fourier transform (see below).
Implement the function f as a quantum transform.

To achieve this, Shor used repeated squaring for his modular exponentiation transformation.
It is important to note that this step is more difficult to implement than the quantum Fourier transform, in that it requires ancillary qubits and substantially more gates to accomplish.
Perform an inverse quantum Fourier transform.

By using controlled rotation gates and Hadamard gates Shor designed a circuit for the quantum Fourier transform that uses just $O((log N)^2)$ gates.

After all these transformations a measurement will yield an approximation to the period r.
For simplicity assume that there is a y such that yr/N is an integer.
Then the probability to measure y is 1.
To see that we notice that then

$e^ = 1$

for all integers b.
Therefore the sum whose square gives us the probability to measure y will be N/r since b takes roughly N/r values and thus the probability is

1/r^2

.
There are r y such that yr/N is an integer and also r possibilities for

f(x_0)

, so the probabilities sum to 1.

Note: another way to explain Shor's algorithm is by noting that it is just the quantum phase estimation algorithm in disguise.

top

Modifications to Shors Algorithm
There have been many modifications to Shor's algorithm. For example, whereas, an order of twenty to thirty runs are required on a quantum computer in the case of Shor's original algorithm, and with some of the other modifications, in the case of the modification done by David McAnally at the University of Queensland an order of only four to eight runs on the quantum computer is required.

	Source Privacy License Download Contact Us Atlas Scientus.org Dictionary (Yet Another Wiki) RC : 1.39 This article is licensed under the GNU Free Documentation License [copyleft]. It uses material from the Wikipedia article "Shor's algorithm". link