Many public key cryptosystems, such as RSA, will become obsolete if Shor's algorithm is ever implemented in a practical quantum computer. A message encrypted with RSA can be deciphered by factoring the public key N, which is the product of two prime numbers. Known classical algorithms cannot do this in time O((log N)k) for any k, so they quickly become infeasible as N is increased. By contrast, Shor's algorithm can crack RSA in polynomial time. It has also been extended to attack many other public key cryptosystems.
Like all quantum computer algorithms, Shor's algorithm is probabilistic: it gives the correct answer with high probability, and the probability of failure can be decreased by repeating the algorithm.
Shor's algorithm was demonstrated in 2001 by a group at IBM, which factored 15 into 3 and 5, using a quantum computer with 7 qubits.
Table of contents |
2 Explanation of the algorithm |
Period-finding subroutine:
The algorithm is composed of two parts. The first part of the algorithm turns the factoring problem into the problem of finding the period of a function, and may be implemented classically. The second part finds the period using the quantum fourier transform, and is responsible for the quantum speedup.
The integers less than N and coprime with N form a finite group under multiplication modulo N, which is typically denoted (Z/NZ)×. By the end of step 3, we have an integer a in this group. Since the group is finite, a must have a finite order r, the smallest positive integer such that
Proof: For simplicity, denote (a r / 2 - 1) and (a r / 2 + 1) by u and v respectively. N | uv, so kN = uv for some integer k. Suppose gcd(u, N) = 1; then mu + nN = 1 for some integers m and n (this is a property of the greatest common divisor.) Multiplying both sides by v, we find that mkN + nvN = v, so N | v. By contradiction, gcd(u, N) ≠ 1. By a similar argument, gcd(v, N) ≠ 1.
This supplies us with a factorization of N. If N is the product of two primes, this is the only possible factorization.Procedure
where x runs from 0 to N - 1.
where A is a normalization constant, and j runs from 0 to A - 1.Explanation of the algorithm
I. Obtaining factors from period
Therefore, N | (a r - 1). Suppose we are able to obtain r, and it is even. Then
r is the smallest positive integer such that a r ≡ 1, so N cannot divide (a r / 2 - 1). If N also does not divide (a r / 2 + 1), then N must have a nontrivial common factor with each of (a r / 2 - 1) and (a r / 2 + 1).