5. E. Bernstein and U. Vazirani, ªQuantum complexity 20. A. K. Lenstra and H. W. Lenstra, Jr., eds., The Devel- theory,º in Proc. 25th ACM Symp. on Theory of Com- opment of the Number Field Sieve, Lecture Notes in putating, pp. 11±20 (1993). Mathematics No. 1554, Springer-Verlag (1993); this 6. A. Berthiaume and G. Brassard, ªThe quantum chal- book contains reprints of the articles that were critical lenge to structural complexity theory,º in Proc. 7th in the development of the fastest known factoring al- Conf. on Structure in Complexity Theory, IEEE Com- gorithm. puter Society Press, pp. 132±137 (1992). 21. H. W. Lenstra, Jr. and C. Pomerance, ªA rigorous 7. A. Berthiaume and G. Brassard, ªOracle quantum time bound for factoring integers,º J. Amer. Math. Soc. computing,º in Proc. Workshop on Physics and Com- Vol. 5, pp. 483±516 (1992). putation, pp. 195±199, IEEE Computer Society Press 22. S. Lloyd, ªA potentially realizable quantum com- (1992). puter,º Science, Vol. 261, pp. 1569±1571 (1993). 8. D. Coppersmith, ªAn approximate Fourier transform 23. S. Lloyd, ªEnvisioning a quantum supercomputer,º useful in quantum factoring,º IBM Research Report Science, Vol. 263, p. 695 (1994). RC 19642 (1994). 24. G. L. Miller, ªRiemann's hypothesis and tests for 9. D. Deutsch, ªQuantum theory, the Church±Turing primality,º J. Comp. Sys. Sci. Vol. 13, pp. 300±317 principle and the universal quantum computer,º Proc. (1976). Roy. Soc. Lond. Ser. A, Vol. 400, pp. 96±117 (1985). 25. S. Pohligand M. Hellman, ªAn improved algorithm for 10. D. Deutsch, ªQuantum computing discrete logarithms over GF(p) and its cryp- computational networks,º Proc. Roy. Soc. Lond. Ser. A, tographic signi®cance,º IEEE Trans. Information The- Vol. 425, pp. 73±90 (1989). ory, Vol. 24, pp. 106±110 (1978). 11. D. Deutsch and R. Jozsa, ªRapid solution of problems 26. C. Pomerance, ªFast, rigorous factoriza- by quantum computation,º Proc. Roy. Soc. Lond. Ser. tion and discrete logarithm algorithms,º in Discrete Al- A Vol. 439, pp. 553±558 (1992). gorithms and Complexity (Proc. Japan-US Joint Sem- 12. D. P. DiVincenzo, ªTwo-bit gates are univer- inar), pp. 119-143, Academic Press (1986). sal for quantum computation,º Phys. Rev. A, Vol. 51, 27. R. L. Rivest, A. Shamir, and L. Adleman ªA method of pp. 1015±1022 (1995). obtaining digital signatures and public-key cryptosys- 13. R. Feynman, ªSimulating physics with computers,º In- tems,º CommunicationsACM, Vol. 21, No. 2, pp. 120± ternational Journal of Theoretical Physics, Vol. 21, 126 (1978). No. 6/7, pp. 467±488 (1982). 28. A. Shamir, ªIP ¤ PSPACE,º in Proc. 31th Ann. Symp. 14. R. Feynman, ªQuan- on Foundations of Computer Science, pp. 11±15, IEEE tum mechanical computers,º Foundations of Physics, Computer Society Press (1990). Vol. 16, pp. 507±531 (1986). (Originally appeared in 29. D. Simon, ªOn the power of quantum computation,º Optics News, February 1985.) in Proc. 35th Ann. Symp. on Foundations of Computer 15. L. Fortnow and M. Sipser, ªAre there interactive proto- Science, pp. 116±123, IEEE Computer Society Press cols for co-NP languages?º Inform. Proc. Lett. Vol. 28, (1994). pp. 249±251 (1988). 30. W. G. Teich, K. Obermayer, and G. Mahler, ªStruc- 16. D. M. Gordon, ªDiscrete logarithms in GF(p) using the tural basis of multistationary quantum systems II: Ef- number ®eld sieve,º SIAM J. Discrete Math. Vol. 6, fective few-particle dynamics,º Phys. Rev. B, Vol. 37, pp. 124±139 (1993). pp. 8111±8121 (1988). 17. G. H. Hardy and E. M. Wright, An Introduction to the 31. T. Toffoli, ªReversible computing,º in Automata, Lan- Theory of Numbers, Fifth Edition, Oxford University guages and Programming, Seventh Colloq., Lecture Press, New York (1979). Notes in Computer Science No. 84 (J. W. De Bakker 18. R. Landauer, ªIs quantum mechanically coherent com- and J. van Leeuwen, eds.) pp. 632-644, Springer- putation useful?º in Proceedings of the Drexel-4 Verlag (1980). Symposium on Quantum Nonintegrability Ð Quantum 32. W. G. Unruh, ªMaintaining coherence in quantum Classical Correspondence (D. H. Feng and B-L. Hu, computers,º Phys. Rev. A, Vol. 51, pp. 992±997 (1995). eds.) International Press, to appear. 33. A. Yao, ªQuantum circuit complexity,º in Proc. 34th 19. Y. Lecerf, ªMachines de Turing reversibles. Recursive Ann. Symp. on Foundations of Computer Science, ¡ ¢ pp. 352±361, IEEE Computer Society Press (1993). ¦¨§©£ insolubilite en de l'equation £¥¤ , ouÁ ¦ est un isomorphisme de codes,º Comptes Ren- dues de l'Academie FrancËaise des Sciences, Vol. 257, pp. 2597-2600 (1963). 11 D where this equation was obtained from Condition (7.34) by further increase of D by 1; thus for some large constant it ¥2T dividing by . The ®rst thing to notice is that the multi- is less than . ¡ ¢¤£¦¥ § plier on is a fraction with denominator , since Recall that each good ( is obtained with probability at §©¨ ¢ £ ¥ £§©¨ ¢£¥ %¥©C evenly divides . Thus, we need only least ¥©%¥©7 from any experiment. Since there are ¥¨¢£¥ § ¥7CD round off to the nearest multipleof and divide good ( 's, after experiments, we are likely to obtain ¨! #"%$&¢£'¥© D § by a sample of good ( 's chosen equally likely from all good § § ( ( 's. Thus, we will be able to ®nd a set of 's such that all §©¨ ¢£¥ *£+§©¨¢£'¥ ? 5'TC ¢ ¢V£+¥ = < ©¤ §)( (7.40) prime powers dividing are relatively prime ? § ¢ to at least one of these ( 's. For each prime less than 20, to ®nd a candidate ¡ . To show that this experiment need we thus have at most 20 possibilities for the residue mod- ? ? ? ¢ W ¢ only be repeated a polynomial number of times to ®nd the ulo <%= , where is the exponent on prime in the prime factorization of ¢#£@¥ . We can thus try all possibilites for correct ¡ requires only a few more details. The problem is again that we cannot divide by a number which is not rela- residues modulo powers of primes less than 20: for each ¡ tively prime to ¢£¥ . possibility we can calculate the corresponding using the For the general case of the discrete log algorithm, we Chinese remainder theorem, and then check to see whether § it is the desired discrete logarithm. do not know that all possible values of ( are generated with reasonable likelihood; we only know this about one- This algorithm does not use very many properties of XZY , tenth of them. This additional dif®culty makes the next step so we can use the same algorithmto ®nd discrete logarithms [\Y harder than the corresponding step in the two previous al- over other ®elds such as G . What we need is that we gorithms. If we knew the remainder of ¡ modulo all prime know the order of the generator, and that we can multiply and take inverses of elements in polynomial time. powers dividing ¢#£,¥ , we could use the Chinese remain- der theorem to recover ¡ in polynomial time. We will only If one were to actually program this algorithm (which be able to ®nd this remainder for primes larger than 20, but must wait until a quantum computer is built) there are many with a little extra work we will still be able to recover ¡ . ways in which the ef®ciency could be increased over the ef- What we have is that each good ¨-§.) pair is generated ®ciency shown in this paper. with probability at least / ¥0213¢4 65,¥%¥©7 , and that at least ¨-§.) a tenth of the possible § 's are in a good pair. From Acknowledgements §32 Eq. (7.40), it follows that these § 's are mapped from to § ¨ ¢ £8¥© ( by rounding to the nearest integer multiple of I would like to thank Jeff Lagarias for ®nding and ®x- § ¥¨¢9£+¥ . Further, the good 's are exactly those in which ing a critical bug in the ®rst version of the discrete log al- §32 § ¨¢:£;¥ § is close to ( . Thus, each good corresponds gorithm. I would also like to thank him, Charles Bennett, § with exactly one ( . We would like to show that for any Gilles Brassard, Andrew Odlyzko, Dan Simon, Umesh ? ¢4<>= ¢£@¥ § prime power dividing , a random good ( is un- Vazirani, as well as other correspondents too numerous to ? likely to contain ¢ . If we are willing to accept a large con- list, for productive discussions, for corrections to and im- stant for the algorithm, we can just ignore the prime powers provements of early drafts of this paper, and for pointers to under 20; if we know ¡ modulo all prime powers over 20, the literature. we can try all possible residues for primes under 20 with only a (large) constant factor increase in running time. Be- References ¨A§.B cause at least one tenth of the § 's were in a good pair, § at least one tenth of the ( 's are good. Thus, for a prime 1. P. Benioff, ªQuantum mechanical Hamiltonian models ? ? ¢ § ¢ = = < < power , a random good ( is divisible by with proba- of Turing machines,º J. Stat. Phys. Vol. 29, pp. 515± ? ¥©C3¢ D § = < bilityat most . If we have good ( 's, the probability 546 (1982). of having a prime power over 20 that divides all of them is 2. P. Benioff, ªQuantum mechanical Hamiltonian mod- therefore at most els of Turing machines that dissipate no energy,º Phys. P Rev. Lett. Vol. 48, pp. 1581±1585 (1982). E ¥C . (7.41) 3. C. H. Bennett, ªLogical reversibility of computation,º ?+Q6R ¢ <>= FAG IBM J. Res. Develop. Vol. 17, pp. 525±532 (1973). = =HI!J G FNMO F 4. C. H. Bennett, E. Bernstein, G. Brassard and U. Vazi- = =LK rani, ªStrengths and weaknesses of quantum comput- where the sum is over all prime powers greater than 20 that ing,º manuscript (1994).