We consider how to optimize memory use and computation time in operating a quantum computer. In particular, we estimate the number of memory qubits and the number of operations required to perform factorization, using the algorithm suggested by Shor. A $K$-bit number can be factored in time of order $K^3$ using a machine capable of storing $5K+1$ qubits. Evaluation of the modular exponential function (the bottleneck of Shor's algorithm) could be achieved with about $72 K^3$ elementary quantum gates; implementation using a linear ion trap would require about $396 K^3$ laser pulses. A proof-of-principle demonstration of quantum factoring (factorization of 15) could be performed with only 6 trapped ions and 38 laser pulses. Though the ion trap may never be a useful computer, it will be a powerful device for exploring experimentally the properties of entangled quantum states.
Integer factorization has been one of the cornerstone applications of the field of quantum computing since the discovery of an efficient algorithm for factoring by Peter Shor. Unfortunately, factoring via Shor's algorithm is well beyond the capabilities of today's noisy intermediate-scale quantum (NISQ) devices. In this work, we revisit the problem of factoring, developing an alternative to Shor's algorithm, which employs established techniques to map the factoring problem to the ground state of an Ising Hamiltonian. The proposed variational quantum factoring (VQF) algorithm starts by simplify…
We define an approximate version of the Fourier transform on $2^L$ elements, which is computationally attractive in a certain setting, and which may find application to the problem of factoring integers with a quantum computer as is currently under investigation by Peter Shor. (1994 IBM Internal Report)
We study the performance and resource usage of the variational quantum factoring (VQF) algorithm for different instance sizes and optimization algorithms. Our simulations show better chance of finding the ground state when using VQE rather than QAOA for optimization. In gradient-based optimization we find that the time required for quantum circuit gradient estimation is a significant problem if VQF is to become competitive with classical factoring algorithms. Further, we compare entangled and non-entangled circuits in VQE optimization and fail to see significant evidence in favour of including…
The intermediate quantum states of multiple qubits, generated during the operation of Shor's factoring algorithm are analyzed. Their entanglement is evaluated using the Groverian measure. It is found that the entanglement is generated during the pre-processing stage of the algorithm and remains nearly constant during the quantum Fourier transform stage. The entanglement is found to be correlated with the speedup achieved by the quantum algorithm compared to classical algorithms.
We present fast and highly parallelized versions of Shor's algorithm. With a sizable quantum computer it would then be possible to factor numbers with millions of digits. The main algorithm presented here uses FFT-based fast integer multiplication. The quick reader can just read the introduction and the ``Results'' section.
This work is a tutorial on Shor's factoring algorithm by means of a worked out example. Some basic concepts of Quantum Mechanics and quantum circuits are reviewed. It is intended for non-specialists which have basic knowledge on undergraduate Linear Algebra.
Shor's quantum factoring algorithm finds the prime factors of a large number exponentially faster than any other known method a task that lies at the heart of modern information security, particularly on the internet. This algorithm requires a quantum computer a device which harnesses the `massive parallelism' afforded by quantum superposition and entanglement of quantum bits (or qubits). We report the demonstration of a compiled version of Shor's algorithm on an integrated waveguide silica-on-silicon chip that guides four single-photon qubits through the computation to factor 15.
Quantum processors are potentially superior to their classical counterparts for many computational tasks including factorization. Circuit methods as well as adiabatic methods have already been proposed and implemented for finding the factors of a given composite number. The main challenge in scaling it to larger numbers is the unavailability of large number of qubits. Here we propose a hybrid scheme that involves both classical and quantum computation, which reduces the number of qubits required for factorization. The classical part involves setting up and partially simplifying a set of bit-wi…
The security of messages encoded via the widely used RSA public key encryption system rests on the enormous computational effort required to find the prime factors of a large number N using classical (i.e., conventional) computers. In 1994, however, Peter Shor showed that for sufficiently large N a quantum computer would be expected to perform the factoring with much less computational effort. This paper endeavors to explain, in a fashion comprehensible to the non-expert readers of this journal: (i) the RSA encryption protocol; (ii) the various quantum computer manipulations constituting the S…
This paper presents a computer program, written in Maple, that allows a user to simulate certain aspects of Shor's quantum factoring algorithm on a desktop or laptop computer. The program does not simulate the unitary operations carried out by a quantum computer but does faithfully mimic its output at the crucial "readout" step of the order-finding process. The program reqires only two inputs from the user - the number to be factored (which can be up to 10 digits long) and the number of qubits to be used in the factoring (for which a helpful hint is given). The program then returns a detailed …
We describe an array of quantum gates implementing Shor's algorithm for prime factorization in a quantum computer. The array includes a circuit for modular exponentiation with several subcomponents (such as controlled multipliers, adders, etc) which are described in terms of elementary Toffoli gates. We present a simple analysis of the impact of losses and decoherence on the performance of this quantum factoring circuit. For that purpose, we simulate a quantum computer which is running the program to factor N = 15 while interacting with a dissipative environment. As a consequence of this inter…
We report a proof-of-concept demonstration of a quantum order-finding algorithm for factoring the integer 21. Our demonstration involves the use of a compiled version of the quantum phase estimation routine, and builds upon a previous demonstration by Martín-López et al. in Nature Photonics 6, 773 (2012). We go beyond this work by using a configuration of approximate Toffoli gates with residual phase shifts, which preserves the functional correctness and allows us to achieve a complete factoring of N=21. We implemented the algorithm on IBM quantum processors using only 5 qubits and successfull…
Amongst the most remarkable successes of quantum computation are Shor's efficient quantum algorithms for the computational tasks of integer factorisation and the evaluation of discrete logarithms. In this article we review the essential ingredients of these algorithms and draw out the unifying generalization of the so-called abelian hidden subgroup problem. This involves an unexpectedly harmonious alignment of the formalism of quantum physics with the elegant mathematical theory of group representations and fourier transforms on finite groups. Finally we consider the non-abelian hidden subgrou…
Tomography has reached its practical limits in characterization of new quantum devices, and there is a need for a new means of characterizing and validating new technological advances in this field. We propose a different verification scheme based on compiled versions of Shor's factoring algorithm that may be extended to large circuits in the future. The general version Shor's algorithm has been experimentally elusive due to bottlenecks associated with the modular exponentiation operation. Experiments to date have only been able to execute compiled versions of the latter operation. We provide …
The quantum multicomputer consists of a large number of small nodes and a qubus interconnect for creating entangled state between the nodes. The primary metric chosen is the performance of such a system on Shor's algorithm for factoring large numbers: specifically, the quantum modular exponentiation step that is the computational bottleneck. This dissertation introduces a number of optimizations for the modular exponentiation. My algorithms reduce the latency, or circuit depth, to complete the modular exponentiation of an n-bit number from O(n^3) to O(n log^2 n) or O(n^2 log n), depending on a…
The number of steps any classical computer requires in order to find the prime factors of an $l$-digit integer $N$ increases exponentially with $l$, at least using algorithms known at present. Factoring large integers is therefore conjectured to be intractable classically, an observation underlying the security of widely used cryptographic codes. Quantum computers, however, could factor integers in only polynomial time, using Shor's quantum factoring algorithm. Although important for the study of quantum computers, experimental demonstration of this algorithm has proved elusive. Here we report…
In the near-term, hybrid quantum-classical algorithms hold great potential for outperforming classical approaches. Understanding how these two computing paradigms work in tandem is critical for identifying areas where such hybrid algorithms could provide a quantum advantage. In this work, we study a QAOA-based quantum optimization algorithm by implementing the Variational Quantum Factoring (VQF) algorithm. We execute experimental demonstrations using a superconducting quantum processor and investigate the trade-off between quantum resources (number of qubits and circuit depth) and the probabil…
The preprocessing stage of Shor's algorithm generates a class of quantum states referred to as periodic states, on which the quantum Fourier transform is applied. Such states also play an important role in other quantum algorithms that rely on the quantum Fourier transform. Since entanglement is believed to be a necessary resource for quantum computational speedup, we analyze the entanglement of periodic states and the way it is affected by the quantum Fourier transform. To this end, we derive a formula that evaluates the Groverian entanglement measure for periodic states. Using this formula, …
Quantum information processing and its associated technologies has reached an interesting and timely stage in their development where many different experiments have been performed establishing the basic building blocks. The challenge moving forward is to scale up to larger sized quantum machines capable of performing tasks not possible today. This raises a number of interesting questions like: How big will these machines need to be? how many resources will they consume? This needs to be urgently addressed. Here we estimate the resources required to execute Shor's factoring algorithm on a dist…
Quantum computational algorithms exploit quantum mechanics to solve problems exponentially faster than the best classical algorithms. Shor's quantum algorithm for fast number factoring is a key example and the prime motivator in the international effort to realise a quantum computer. However, due to the substantial resource requirement, to date, there have been only four small-scale demonstrations. Here we address this resource demand and demonstrate a scalable version of Shor's algorithm in which the n qubit control register is replaced by a single qubit that is recycled n times: the total nu…
The assumed computationally difficulty of factoring large integers forms the basis of security for RSA public-key cryptography, which specifically relies on products of two large primes or semi-primes. The best-known factoring algorithms for classical computers run in sub-exponential time. Since integer factorization is in NP, one can reduce this problem to any NP-hard problem, such as Boolean Satisfiability (SAT). While reducing factoring to SAT has proved to be useful for studying SAT solvers, attempting to factor large integers via such a reduction has not been found to be successful. Shor'…
We show that a Young's N slit interferometer can be used to factor the integer N. The device could factor four- or five-digit numbers in a practical fashion. This work shows how number theory may arise in physical problems, and may provide some insight as to how quantum computers can carry out factoring problems by interferometric means.
We consider a version of Shor's quantum factoring algorithm such that the quantum Fourier transform is replaced by an extremely simple one where decomposition coefficients take only the values of $1,i,-1,-i$. In numerous calculations which have been carried out so far, our algorithm has been surprisingly stable and never failed. There are numerical indications that the probability of period finding given by the algorithm is a slowly decreasing function of the number to be factorized and is typically less than in Shor's algorithm. On the other hand, quantum computer (QC), capable of implementin…
Lectures on quantum computing. Contents: Algorithms. Quantum circuits. Quantum Fourier transform. Elements of number theory. Modular exponentiation. Shor`s algorithm for finding the order. Computational complexity of Schor`s algorithm. Factoring integers. NP-complete problems.
Shor's algorithm has seriously challenged information security based on public key cryptosystems. However, to break the widely used RSA-2048 scheme, one needs millions of physical qubits, which is far beyond current technical capabilities. Here, we report a universal quantum algorithm for integer factorization by combining the classical lattice reduction with a quantum approximate optimization algorithm (QAOA). The number of qubits required is O(logN/loglog N), which is sublinear in the bit length of the integer $N$, making it the most qubit-saving factorization algorithm to date. We demonstra…
There exists a Hamiltonian formulation of the factorisation problem which also needs the definition of a factorisation ensemble (a set to which factorable numbers, $N'=x'y'$, having the same trivial factorisation algorithmic complexity, belong). For the primes therein, a function $E$, that may take only discrete values, should be the analogous of the energy from a confined system of charges in a magnetic trap. This is the quantum factoring simulator hypothesis connecting quantum mechanics with number theory. In this work, we report numerical evidence of the existence of this kind of discrete s…
This is an expository talk written for the Bourbaki Seminar. After a brief introduction, Section 1 discusses in the categorical language the structure of the classical deterministic computations. Basic notions of complexity icluding the P/NP problem are reviewed. Section 2 introduces the notion of quantum parallelism and explains the main issues of quantum computing. Section 3 is devoted to four quantum subroutines: initialization, quantum computing of classical Boolean functions, quantum Fourier transform, and Grover's search algorithm. The central Section 4 explains Shor's factoring algorith…
Ideal quantum algorithms usually assume that quantum computing is performed continuously by a sequence of unitary transformations. However, there always exist idle finite time intervals between consecutive operations in a realistic quantum computing process. During these delays, coherent "errors" will accumulate from the dynamical phases of the superposed wave functions. Here we explore the sensitivity of Shor's quantum factoring algorithm to such errors. Our results clearly show a severe sensitivity of Shor's factorization algorithm to the presence of delay times between successive unitary tr…
In a quantum computer any superposition of inputs evolves unitarily into the corresponding superposition of outputs. It has been recently demonstrated that such computers can dramatically speed up the task of finding factors of large numbers -- a problem of great practical significance because of its cryptographic applications. Instead of the nearly exponential ($\sim \exp L^{1/3}$, for a number with $L$ digits) time required by the fastest classical algorithm, the quantum algorithm gives factors in a time polynomial in $L$ ($\sim L^2$). This enormous speed-up is possible in principle because …
Shor's algorithm for factoring in polynomial time on a quantum computer\cite{Shor} gives an enormous advantage over all known classical factoring algorithm. We demonstrate how to factor products of large prime numbers using a compiled version of Shor's quantum factoring algorithm. Our technique can factor all products of $p,q$ such that $p,q$ are unequal primes greater than two, runs in constant time, and requires only two coherent qubits. This illustrates that the correct measure of difficulty when implementing Shor's algorithm is not the size of number factored, but the length of the period …
There have been several efforts to apply quantum SAT solving methods to factor large integers. While these methods may provide insight into quantum SAT solving, to date they have not led to a convincing path to integer factorization that is competitive with the best known classical method, the Number Field Sieve. Many of the techniques tried involved directly encoding multiplication to SAT or an equivalent NP-hard problem and looking for satisfying assignments of the variables representing the prime factors. The main challenge in these cases is that, to compete with the Number Field Sieve, the…
We consider a discrete-time quantum walk, called the Grover walk, on a distance regular graph $X$. Given that $X$ has diameter $d$ and invertible adjacency matrix, we show that the square of the transition matrix of the Grover walk on $X$ is a product of at most $d$ commuting transition matrices of continuous-time quantum walks, each on some distance digraph of the line digraph of $X$. We also obtain a similar factorization for any graph $X$ in a Bose Mesner algebra.
We consider a hypothetical topological quantum computer where the qubits are comprised of either Ising or Fibonacci anyons. For each case, we calculate the time and number of qubits (space) necessary to execute the most computationally expensive step of Shor's algorithm, modular exponentiation. For Ising anyons, we apply Bravyi's distillation method [S. Bravyi, Phys. Rev. A 73, 042313 (2006)] which combines topological and non-topological operations to allow for universal quantum computation. With reasonable restrictions on the physical parameters we find that factoring a 128 bit number requir…
A scheme to encode arbitrarily long integer pairs on degenerate optical parametric oscillations multiplexed in time is proposed. The classical entanglement between the polarization directions and the phases of the oscillating pulses, regarded as two computational registers, furnishes the integer correlations within each pair. We show the major algorithmic steps, modular exponentiation and discrete Fourier transform, of Shor's quantum factoring algorithm can be executed in the registers as pulse interferences under the assistance of external logics. The factoring algorithm is thus rendered equi…
A major obstacle to implementing Shor's quantum number-factoring algorithm is the large size of modular-exponentiation circuits. We reduce this bottleneck by customizing reversible circuits for modular multiplication to individual runs of Shor's algorithm. Our circuit-synthesis procedure exploits spectral properties of multiplication operators and constructs optimized circuits from the traces of the execution of an appropriate GCD algorithm. Empirically, gate counts are reduced by 4-5 times, and circuit latency is reduced by larger factors.
We report an experimental demonstration of a complied version of Shor's algorithm using four photonic qubits. We choose the simplest instance of this algorithm, that is, factorization of N=15 in the case that the period $r=2$ and exploit a simplified linear optical network to coherently implement the quantum circuits of the modular exponential execution and semi-classical quantum Fourier transformation. During this computation, genuine multiparticle entanglement is observed which well supports its quantum nature. This experiment represents a step toward full realization of Shor's algorithm and…
It is pointed out that an exactly solvable permutation operator, viewed as the quantization of cyclic shifts, is useful in constructing a basis in which to study the quantum baker's map, a paradigm system of quantum chaos. In the basis of this operator the eigenfunctions of the quantum baker's map are compressed by factors of around five or more. We show explicitly its connection to an operator that is closely related to the usual quantum baker's map. This permutation operator has interesting connections to the art of shuffling cards as well as to the quantum factoring algorithm of Shor via th…
Factoring six-digit integers with superconducting quantum circuits
National Laboratory of Solid State Microstructures, School of Physics, Nanjing University（南京大学固体微结构物理学院）；Shishan Laboratory, Suzhou Campus of Nanjing University（南京大学苏州校区石湖实验室）；Jiangsu Key Laboratory of Quantum Information Science and Technology, Nanjing University（南京大学量子信息科学与技术江苏省重点实验室）；Hefei National Laboratory（合肥国家实验室）；Synergetic Innovation Center of Quantum Information and Quantum Physics, University of Science and Technology of China（中国科学技术大学量子信息与量子科技创新研究院）
We construct simplified quantum circuits for Shor's order-finding algorithm for composites N given by products of the Fermat primes 3, 5, 17, 257, and 65537. Such composites, including the previously studied case of 15, as well as 51, 85, 771, 1285, 4369,... have the simplifying property that the order of a modulo N for every base a coprime to N is a power of 2, significantly reducing the usual phase estimation precision requirement. Prime factorization of 51 and 85 can be demonstrated with only 8 qubits and a modular exponentiation circuit consisting of no more than four CNOT gates.
Quantum algorithms could be much faster than classical ones in solving the factoring problem. Adiabatic quantum computation for this is an alternative approach other than Shor's algorithm. Here we report an improved adiabatic factoring algorithm and its experimental realization to factor the number 143 on a liquid crystal NMR quantum processor with dipole-dipole couplings. We believe this to be the largest number factored in quantum-computation realizations, which shows the practical importance of adiabatic quantum algorithms.
Shor's factoring algorithm (SFA), by its ability to efficiently factor large numbers, has the potential to undermine contemporary encryption. At its heart is a process called order finding, which quantum mechanics lets us perform efficiently. SFA thus consists of a \emph{quantum order finding algorithm} (QOFA), bookended by classical routines which, given the order, return the factors. But, with probability up to $1/2$, these classical routines fail, and QOFA must be rerun. We modify these routines using elementary results in number theory, improving the likelihood that they return the factors…
We optimize the area and latency of Shor's factoring while simultaneously improving fault tolerance through: (1) balancing the use of ancilla generators, (2) aggressive optimization of error correction, and (3) tuning the core adder circuits. Our custom CAD flow produces detailed layouts of the physical components and utilizes simulation to analyze circuits in terms of area, latency, and success probability. We introduce a metric, called ADCR, which is the probabilistic equivalent of the classic Area-Delay product. Our error correction optimization can reduce ADCR by an order of magnitude or m…
We analyze quantum computers which perform Shor's factoring algorithm, paying attention to asymptotic properties as the number L of qubits is increased. Using numerical simulations and a general theory of the stabilities of many-body quantum states, we show the following: Anomalously fluctuating states (AFSs), which have anomalously large fluctuations of additive operators, appear in various stages of the computation. For large L, they decohere at anomalously great rates by weak noises that simulate noises in real systems. Decoherence of some of the AFSs is fatal to the results of the computat…
High-performance techniques to simulate quantum programs on classical hardware rely on exponentially large vectors to represent quantum states. When simulating quantum algorithms, the quantum states that occur are often sparse due to special structure in the algorithm or even in the underlying problem. We thus introduce a new simulation method that exploits this sparsity to reduce memory usage and simulation runtime. Moreover, our prototype implementation includes optimizations such as gate (re)scheduling, which amortizes data structure accesses and reduces memory usage. To benchmark our imple…
We study the results of a compiled version of Shor's factoring algorithm on the ibmqx5 superconducting chip, for the particular case of $N=15$, $21$ and $35$. The semi-classical quantum Fourier transform is used to implement the algorithm with only a small number of physical qubits and the circuits are designed to reduce the number of gates to the minimum. We use the square of the statistical overlap to give a quantitative measure of the similarity between the experimentally obtained distribution of phases and the predicted theoretical distribution one for different values of the period. This …
We propose a prime factoring machine operated in a frame work of quantum annealing (QA). The idea is inverse operation of a quantum-mechanically reversible multiplier implemented with QA-based Boolean logic circuits. We designed the QA machine on an application-specific-annealing-computing architecture which efficiently increases available hardware budgets at the cost of restricted functionality. The circuits are to be implemented and fabricated by using superconducting integrated circuit technology. We propose a three-dimensional packaging scheme of a qubit-chip / interposer / package-substra…
Although quantum computers are capable of solving problems like factoring exponentially faster than the best-known classical algorithms, determining the resources responsible for their computational power remains unclear. An important class of problems where quantum computers possess an advantage is phase estimation, which includes applications like factoring. We introduce a new computational model based on a single squeezed state resource that can perform phase estimation, which we call the power of one qumode. This model is inspired by an interesting computational model known as deterministi…
