We optimize the area and latency of Shor's factoring while simultaneously improving fault tolerance through: (1) balancing the use of ancilla generators, (2) aggressive optimization of error correction, and (3) tuning the core adder circuits. Our custom CAD flow produces detailed layouts of the physical components and utilizes simulation to analyze circuits in terms of area, latency, and success probability. We introduce a metric, called ADCR, which is the probabilistic equivalent of the classic Area-Delay product. Our error correction optimization can reduce ADCR by an order of magnitude or more. Contrary to conventional wisdom, we show that the area of an optimized quantum circuit is not dominated exclusively by error correction. Further, our adder evaluation shows that quantum carry-lookahead adders (QCLA) beat ripple-carry adders in ADCR, despite being larger and more complex. We conclude with what we believe is one of most accurate estimates of the area and latency required for 1024-bit Shor's factorization: 7659 mm$^{2}$ for the smallest circuit and $6 * 10^8$ seconds for the fastest circuit.
Quantum information processing and its associated technologies has reached an interesting and timely stage in their development where many different experiments have been performed establishing the basic building blocks. The challenge moving forward is to scale up to larger sized quantum machines capable of performing tasks not possible today. This raises a number of interesting questions like: How big will these machines need to be? how many resources will they consume? This needs to be urgently addressed. Here we estimate the resources required to execute Shor's factoring algorithm on a dist…
We estimate the resource requirements, the total number of physical qubits and computational time, required to compute the ground state energy of a 1-D quantum Transverse Ising Model (TIM) of N spin-1/2 particles, as a function of the system size and the numerical precision. This estimate is based on analyzing the impact of fault-tolerant quantum error correction in the context of the Quantum Logic Array (QLA) architecture. Our results show that due to the exponential scaling of the computational time with the desired precision of the energy, significant amount of error correciton is required …
This work is a tutorial on Shor's factoring algorithm by means of a worked out example. Some basic concepts of Quantum Mechanics and quantum circuits are reviewed. It is intended for non-specialists which have basic knowledge on undergraduate Linear Algebra.
The assumed computationally difficulty of factoring large integers forms the basis of security for RSA public-key cryptography, which specifically relies on products of two large primes or semi-primes. The best-known factoring algorithms for classical computers run in sub-exponential time. Since integer factorization is in NP, one can reduce this problem to any NP-hard problem, such as Boolean Satisfiability (SAT). While reducing factoring to SAT has proved to be useful for studying SAT solvers, attempting to factor large integers via such a reduction has not been found to be successful. Shor'…
A precise estimation of the computational complexity in Shor's factoring algorithm under the condition that the large integer we want to factorize is composed by the product of two prime numbers, is derived by the results related to number theory. Compared with Shor's original estimation, our estimation shows that one can obtain the solution under such a condition, by less computational complexity.
We present fast and highly parallelized versions of Shor's algorithm. With a sizable quantum computer it would then be possible to factor numbers with millions of digits. The main algorithm presented here uses FFT-based fast integer multiplication. The quick reader can just read the introduction and the ``Results'' section.
The security of messages encoded via the widely used RSA public key encryption system rests on the enormous computational effort required to find the prime factors of a large number N using classical (i.e., conventional) computers. In 1994, however, Peter Shor showed that for sufficiently large N a quantum computer would be expected to perform the factoring with much less computational effort. This paper endeavors to explain, in a fashion comprehensible to the non-expert readers of this journal: (i) the RSA encryption protocol; (ii) the various quantum computer manipulations constituting the S…
The intermediate quantum states of multiple qubits, generated during the operation of Shor's factoring algorithm are analyzed. Their entanglement is evaluated using the Groverian measure. It is found that the entanglement is generated during the pre-processing stage of the algorithm and remains nearly constant during the quantum Fourier transform stage. The entanglement is found to be correlated with the speedup achieved by the quantum algorithm compared to classical algorithms.
We present a simple method for constructing optimal fault-tolerant approximations of arbitrary unitary gates using an arbitrary discrete universal gate set. The method presented is numerical and scales exponentially with the number of gates used in the approximation. However, for the specific case of arbitrary single-qubit gates and the fault-tolerant gates permitted by the concatenated 7-qubit Steane code, we find gate sequences sufficiently long and accurate to permit the fault-tolerant factoring of numbers thousands of bits long. A general scaling law of how rapidly these fault-tolerant app…
Shor's quantum factoring algorithm finds the prime factors of a large number exponentially faster than any other known method a task that lies at the heart of modern information security, particularly on the internet. This algorithm requires a quantum computer a device which harnesses the `massive parallelism' afforded by quantum superposition and entanglement of quantum bits (or qubits). We report the demonstration of a compiled version of Shor's algorithm on an integrated waveguide silica-on-silicon chip that guides four single-photon qubits through the computation to factor 15.
Integer factorization has been one of the cornerstone applications of the field of quantum computing since the discovery of an efficient algorithm for factoring by Peter Shor. Unfortunately, factoring via Shor's algorithm is well beyond the capabilities of today's noisy intermediate-scale quantum (NISQ) devices. In this work, we revisit the problem of factoring, developing an alternative to Shor's algorithm, which employs established techniques to map the factoring problem to the ground state of an Ising Hamiltonian. The proposed variational quantum factoring (VQF) algorithm starts by simplify…
A scheme to encode arbitrarily long integer pairs on degenerate optical parametric oscillations multiplexed in time is proposed. The classical entanglement between the polarization directions and the phases of the oscillating pulses, regarded as two computational registers, furnishes the integer correlations within each pair. We show the major algorithmic steps, modular exponentiation and discrete Fourier transform, of Shor's quantum factoring algorithm can be executed in the registers as pulse interferences under the assistance of external logics. The factoring algorithm is thus rendered equi…
This paper presents a computer program, written in Maple, that allows a user to simulate certain aspects of Shor's quantum factoring algorithm on a desktop or laptop computer. The program does not simulate the unitary operations carried out by a quantum computer but does faithfully mimic its output at the crucial "readout" step of the order-finding process. The program reqires only two inputs from the user - the number to be factored (which can be up to 10 digits long) and the number of qubits to be used in the factoring (for which a helpful hint is given). The program then returns a detailed …
Given n=p*q with p and q prim and y in Z_{p*q}^*. Shor's Algorithm computes the order r of y, i.e. y^r=1 (mod n). If r=2k is even and y^k \ne -1 (mod n) we can easily compute a non trivial factor of n: gcd(y^k-1,n). In the original paper it is shown that a randomly chosen y is usable for factoring with probabily {1/2}. In this paper we will show an efficient possibility to improve the lower bound of this probability by selecting only special y in Z_n^* to {3/4}, so we are able to reduce the fault probabilty in the worst case from {1/2} to {1/4}.
We report a proof-of-concept demonstration of a quantum order-finding algorithm for factoring the integer 21. Our demonstration involves the use of a compiled version of the quantum phase estimation routine, and builds upon a previous demonstration by Martín-López et al. in Nature Photonics 6, 773 (2012). We go beyond this work by using a configuration of approximate Toffoli gates with residual phase shifts, which preserves the functional correctness and allows us to achieve a complete factoring of N=21. We implemented the algorithm on IBM quantum processors using only 5 qubits and successfull…
We study the results of a compiled version of Shor's factoring algorithm on the ibmqx5 superconducting chip, for the particular case of $N=15$, $21$ and $35$. The semi-classical quantum Fourier transform is used to implement the algorithm with only a small number of physical qubits and the circuits are designed to reduce the number of gates to the minimum. We use the square of the statistical overlap to give a quantitative measure of the similarity between the experimentally obtained distribution of phases and the predicted theoretical distribution one for different values of the period. This …
We consider a version of Shor's quantum factoring algorithm such that the quantum Fourier transform is replaced by an extremely simple one where decomposition coefficients take only the values of $1,i,-1,-i$. In numerous calculations which have been carried out so far, our algorithm has been surprisingly stable and never failed. There are numerical indications that the probability of period finding given by the algorithm is a slowly decreasing function of the number to be factorized and is typically less than in Shor's algorithm. On the other hand, quantum computer (QC), capable of implementin…
Quantum computational algorithms exploit quantum mechanics to solve problems exponentially faster than the best classical algorithms. Shor's quantum algorithm for fast number factoring is a key example and the prime motivator in the international effort to realise a quantum computer. However, due to the substantial resource requirement, to date, there have been only four small-scale demonstrations. Here we address this resource demand and demonstrate a scalable version of Shor's algorithm in which the n qubit control register is replaced by a single qubit that is recycled n times: the total nu…
Ideal quantum algorithms usually assume that quantum computing is performed continuously by a sequence of unitary transformations. However, there always exist idle finite time intervals between consecutive operations in a realistic quantum computing process. During these delays, coherent "errors" will accumulate from the dynamical phases of the superposed wave functions. Here we explore the sensitivity of Shor's quantum factoring algorithm to such errors. Our results clearly show a severe sensitivity of Shor's factorization algorithm to the presence of delay times between successive unitary tr…
The quantum multicomputer consists of a large number of small nodes and a qubus interconnect for creating entangled state between the nodes. The primary metric chosen is the performance of such a system on Shor's algorithm for factoring large numbers: specifically, the quantum modular exponentiation step that is the computational bottleneck. This dissertation introduces a number of optimizations for the modular exponentiation. My algorithms reduce the latency, or circuit depth, to complete the modular exponentiation of an n-bit number from O(n^3) to O(n log^2 n) or O(n^2 log n), depending on a…
The number of steps any classical computer requires in order to find the prime factors of an $l$-digit integer $N$ increases exponentially with $l$, at least using algorithms known at present. Factoring large integers is therefore conjectured to be intractable classically, an observation underlying the security of widely used cryptographic codes. Quantum computers, however, could factor integers in only polynomial time, using Shor's quantum factoring algorithm. Although important for the study of quantum computers, experimental demonstration of this algorithm has proved elusive. Here we report…
The preprocessing stage of Shor's algorithm generates a class of quantum states referred to as periodic states, on which the quantum Fourier transform is applied. Such states also play an important role in other quantum algorithms that rely on the quantum Fourier transform. Since entanglement is believed to be a necessary resource for quantum computational speedup, we analyze the entanglement of periodic states and the way it is affected by the quantum Fourier transform. To this end, we derive a formula that evaluates the Groverian entanglement measure for periodic states. Using this formula, …
Lectures on quantum computing. Contents: Algorithms. Quantum circuits. Quantum Fourier transform. Elements of number theory. Modular exponentiation. Shor`s algorithm for finding the order. Computational complexity of Schor`s algorithm. Factoring integers. NP-complete problems.
Tomography has reached its practical limits in characterization of new quantum devices, and there is a need for a new means of characterizing and validating new technological advances in this field. We propose a different verification scheme based on compiled versions of Shor's factoring algorithm that may be extended to large circuits in the future. The general version Shor's algorithm has been experimentally elusive due to bottlenecks associated with the modular exponentiation operation. Experiments to date have only been able to execute compiled versions of the latter operation. We provide …
Shor's algorithm for factoring in polynomial time on a quantum computer\cite{Shor} gives an enormous advantage over all known classical factoring algorithm. We demonstrate how to factor products of large prime numbers using a compiled version of Shor's quantum factoring algorithm. Our technique can factor all products of $p,q$ such that $p,q$ are unequal primes greater than two, runs in constant time, and requires only two coherent qubits. This illustrates that the correct measure of difficulty when implementing Shor's algorithm is not the size of number factored, but the length of the period …
We analyze quantum computers which perform Shor's factoring algorithm, paying attention to asymptotic properties as the number L of qubits is increased. Using numerical simulations and a general theory of the stabilities of many-body quantum states, we show the following: Anomalously fluctuating states (AFSs), which have anomalously large fluctuations of additive operators, appear in various stages of the computation. For large L, they decohere at anomalously great rates by weak noises that simulate noises in real systems. Decoherence of some of the AFSs is fatal to the results of the computat…
This is an expository talk written for the Bourbaki Seminar. After a brief introduction, Section 1 discusses in the categorical language the structure of the classical deterministic computations. Basic notions of complexity icluding the P/NP problem are reviewed. Section 2 introduces the notion of quantum parallelism and explains the main issues of quantum computing. Section 3 is devoted to four quantum subroutines: initialization, quantum computing of classical Boolean functions, quantum Fourier transform, and Grover's search algorithm. The central Section 4 explains Shor's factoring algorith…
We present reversible classical circuits for performing various arithmetic operations aided by dirty ancillae (i.e. extra qubits in an unknown state that must be restored before the circuit ends). We improve the number of clean qubits needed to factor an n-bit number with Shor's algorithm from 1.5n+O(1) to n+2, assisted by n-1 dirty qubits, without increasing the asymptotic size or depth of the circuit.
We consider how to optimize memory use and computation time in operating a quantum computer. In particular, we estimate the number of memory qubits and the number of operations required to perform factorization, using the algorithm suggested by Shor. A $K$-bit number can be factored in time of order $K^3$ using a machine capable of storing $5K+1$ qubits. Evaluation of the modular exponential function (the bottleneck of Shor's algorithm) could be achieved with about $72 K^3$ elementary quantum gates; implementation using a linear ion trap would require about $396 K^3$ laser pulses. A proof-of-p…
Shor's factoring algorithm (SFA) finds the prime factors of a number, $N=p_1 p_2$, exponentially faster than the best known classical algorithm. Responsible for the speed-up is a subroutine called the quantum order finding algorithm (QOFA) which calculates the order -- the smallest integer, $r$, satisfying $a^r \mod N =1$, where $a$ is a randomly chosen integer coprime to $N$ (meaning their greatest common divisor is one, $\gcd(a, N) =1$). Given $r$, and with probability not less than $1/2$, the factors are given by $p_1 = \gcd (a^{\frac{r}{2}} - 1, N)$ and $p_2 = \gcd (a^{\frac{r}{2}} + 1, N)…
We report an experimental demonstration of a complied version of Shor's algorithm using four photonic qubits. We choose the simplest instance of this algorithm, that is, factorization of N=15 in the case that the period $r=2$ and exploit a simplified linear optical network to coherently implement the quantum circuits of the modular exponential execution and semi-classical quantum Fourier transformation. During this computation, genuine multiparticle entanglement is observed which well supports its quantum nature. This experiment represents a step toward full realization of Shor's algorithm and…
We describe an array of quantum gates implementing Shor's algorithm for prime factorization in a quantum computer. The array includes a circuit for modular exponentiation with several subcomponents (such as controlled multipliers, adders, etc) which are described in terms of elementary Toffoli gates. We present a simple analysis of the impact of losses and decoherence on the performance of this quantum factoring circuit. For that purpose, we simulate a quantum computer which is running the program to factor N = 15 while interacting with a dissipative environment. As a consequence of this inter…
In existing general-purpose architectures for surface-code-based fault-tolerant quantum computers, the cost of a quantum computation is determined by the circuit volume, i.e., the number of qubits multiplied by the number of non-Clifford gates. We introduce an architecture using non-2D-local connections in which the cost does not scale with the number of qubits, and instead only with the number of logical operations. Each logical operation has an associated active volume, such that the cost of a quantum computation can be quantified as a sum of active volumes of all operations. For quantum com…
We construct simplified quantum circuits for Shor's order-finding algorithm for composites N given by products of the Fermat primes 3, 5, 17, 257, and 65537. Such composites, including the previously studied case of 15, as well as 51, 85, 771, 1285, 4369,... have the simplifying property that the order of a modulo N for every base a coprime to N is a power of 2, significantly reducing the usual phase estimation precision requirement. Prime factorization of 51 and 85 can be demonstrated with only 8 qubits and a modular exponentiation circuit consisting of no more than four CNOT gates.
We present a distributed implementation of Shor's quantum factoring algorithm on a distributed quantum network model. This model provides a means for small capacity quantum computers to work together in such a way as to simulate a large capacity quantum computer. In this paper, entanglement is used as a resource for implementing non-local operations between two or more quantum computers. These non-local operations are used to implement a distributed factoring circuit with polynomially many gates. This distributed version of Shor's algorithm requires an additional overhead of O((log N)^2) commu…
Shor's algorithm (SA) is a quantum algorithm for factoring integers. Since SA has polynomial complexity while the best classical factoring algorithms are sub-exponential, SA is cited as evidence that quantum computers are more powerful than classical computers. SA is critically dependent on the Quantum Fourier Transform (QFT) and it is known that the QFT is sensitive to errors in the quantum state input to it. In this paper, we show that the polynomial scaling of SA is destroyed by input errors to the QFT part of the algorithm. We also show that Quantum Error Correcting Codes (QECC) are not ca…
Recent research has demonstrated that quantum computers can solve certain types of problems substantially faster than the known classical algorithms. These problems include factoring integers and certain physics simulations. Practical quantum computation requires overcoming the problems of environmental noise and operational errors, problems which appear to be much more severe than in classical computation due to the inherent fragility of quantum superpositions involving many degrees of freedom. Here we show that arbitrarily accurate quantum computations are possible provided that the error pe…
Amongst the most remarkable successes of quantum computation are Shor's efficient quantum algorithms for the computational tasks of integer factorisation and the evaluation of discrete logarithms. In this article we review the essential ingredients of these algorithms and draw out the unifying generalization of the so-called abelian hidden subgroup problem. This involves an unexpectedly harmonious alignment of the formalism of quantum physics with the elegant mathematical theory of group representations and fourier transforms on finite groups. Finally we consider the non-abelian hidden subgrou…
We determine the cost of performing Shor's algorithm for integer factorization on a ternary quantum computer, using two natural models of universal fault-tolerant computing: (i) a model based on magic state distillation that assumes the availability of the ternary Clifford gates, projective measurements, classical control as its natural instrumentation set; (ii) a model based on a metaplectic topological quantum computer (MTQC). A natural choice to implement Shor's algorithm on a ternary quantum computer is to translate the entire arithmetic into a ternary form. However, it is also possible to…
We develop a scheme for fault-tolerant quantum computation based on asymmetric Bacon-Shor codes, which works effectively against highly biased noise dominated by dephasing. We find the optimal Bacon-Shor block size as a function of the noise strength and the noise bias, and estimate the logical error rate and overhead cost achieved by this optimal code. Our fault-tolerant gadgets, based on gate teleportation, are well suited for hardware platforms with geometrically local gates in two dimensions.
A major obstacle to implementing Shor's quantum number-factoring algorithm is the large size of modular-exponentiation circuits. We reduce this bottleneck by customizing reversible circuits for modular multiplication to individual runs of Shor's algorithm. Our circuit-synthesis procedure exploits spectral properties of multiplication operators and constructs optimized circuits from the traces of the execution of an appropriate GCD algorithm. Empirically, gate counts are reduced by 4-5 times, and circuit latency is reduced by larger factors.
We present a fault-tolerant universal gate set consisting of Hadamard and controlled-controlled-Z (CCZ) on Bacon-Shor subsystem codes. Transversal non-Clifford gates on these codes are intriguing in that higher levels of the Clifford hierarchy become accessible as the code becomes more asymmetric. For instance, in an appropriate gauge, Bacon-Shor codes on an $m\times m^k$ lattice have transversal $k$-qubit-controlled $Z$. Through a variety of tricks, including intermediate error-correction and non-Pauli recovery, we reduce the overhead required for fault-tolerant CCZ. We calculate pseudothresh…
In this paper, we use the methods found in quant-ph/0201095 to create a continuous variable analogue of Shor's quantum factoring algorithm. By this we mean a quantum hidden subgroup algorithm that finds the period P of a function F:R-->R from the reals R to the reals R, where F belongs to a very general class of functions, called the class of admissible functions. One objective in creating this continuous variable quantum algorithm was to make the structure of Shor's factoring algorithm more mathematically transparent, and thereby give some insight into the inner workings of Shor's original al…
The all-photonic quantum repeater (APQR) is a promising repeater scheme to realize long-distance quantum communication. For a practical APQR, an indispensable requirement is the robustness of the repeater graph state (RGS) against photon loss. We propose a new loss-tolerant scheme by applying the generalized Shor code to RGS, which can be experimentally demonstrated with current technology. Experimentally, we first prepare and verify the nine-qubit Shor code. Then, by applying the generalized Shor code to APQR and preparing a simplified encoded RGS with the structure of $1\times2$ based on the…
