D. QUANTUM ALGORITHMS 117 D.3 Shor If computers that you build are quantum, Then spies everywhere will all want ’em. Our codes will all fail, And they’ll read our email, Till we get crypto that’s quantum, and daunt ’em. — Jennifer and Peter Shor6 These lectures primarily follow Rie↵el, Eleanor & Polak, Wolfgang, “An Introduction to Quantum Computing for Non-Physicists.” (19 Jan. 2000) http://arxiv.org/abs/quant-ph/9809016v2 [IQC]. 1. RSA: The widely used RSA public-key cryptography system is based ¶ on the difficulty of factoring large numbers. 2. Complexity: The best classical algorithms are exponential in the size ¶ of the input, m =logM. Specifically, the best current (2006) algorithm (the number field sieve (m1/3 log2/3 m) algorithm)runsintimeeO . 3. Shor’s algorithm is bounded error-probability quantum polynomial time ¶ (BQP), specifically, (m3). O 4. Period finding: Shor’s algorithm reduces factoring to finding the ¶ period of a function. 5. Shor’s algorithm was invented in 1994, inspired by Simon’s algorithm. ¶ 6. QFT: Like the classical Fourier transform, the Quantum Fourier Trans- ¶ form puts all the amplitude of the function into multiples of the fre- quency (reciprocal period). 7. Measuring the state yields the period with high probability. ¶ 6NC 216. 118 CHAPTER III. QUANTUM COMPUTATION D.3.a Quantum Fourier transform 1. Ciscoid basis: Let f be a function defined on [0, 2⇡). ¶ You know that it can be represented in the ciscoid (sine and cosine) ba- def ikx sis, uk(x) =cis( kx)=e− ,wherek =0, 1, 2,...represents the over- tone series (natural− number multiples of the fundamental frequency). (The “ ”signisirrelevant,butwillbeconvenientlater.) − 2. The Fourier coefficients are given by fˆ = u f . ¶ k h k | i 3. DFT: For the discrete Fourier transform we suppose that f is repre- ¶ def j def sented by N samples, fj = f(xj), where xj =2⇡ N ,withj N = 0, 1,...,N 1 . 2 { − } 4. Discrete basis: Likewise each of the basis functions is represented by ¶ N samples: def 2⇡ikj/N u =cis( kx )=e− ,j N. kj − j 2 5. Roots of unity: Notice that N samples of the fundamental period ¶ correspond to the N primitive N th-roots of unity, that is, !j where ! = e2⇡i/N . kj Hence, ukj = !− . 6. Orthonormality: It is easy to show that the uk are orthogonal, and ¶ in fact that u /pN are ON. | i | ki 7. Therefore, f can be represented by a Fourier series, ¶ | i 1 1 f = fˆ u = u f u . | i p k| ki p h k | i| ki N k N N k N X2 X2 8. Discrete Fourier transform: Define the discrete Fourier transform ¶ of f, fˆ =Ff ,tobethevectorofFouriercoefficients,fˆ = u f . | i | i k h k | i 9. Determine F as follows: ¶ ˆ f0 u0 f u0 ˆ h | i h | f1 1 u1 f 1 u1 fˆ = 0 . 1 = 0 h .| i 1 = 0 h . | 1 f . pN . pN . | i B C B C B C B fˆN 1 C B uN 1 f C B uN 1 C B − C B h − | i C B h − | C @ A @ A @ A D. QUANTUM ALGORITHMS 119 10. Therefore let ¶ 0 0 0 1 0 (N 1) ! · ! · ! · − u0 1 0 1 1 ··· 1 (N 1) h | ! · ! · ! · − def 1 u1 1 0 2 0 2 1 ··· 2 (N 1) 1 F = 0 h . | 1 = ! · ! · ! · − . pN . pN B . ···. C B C B . .. C B uN 1 C B (N 1) 0 (N 1) 1 (N 1) (N 1) C B h − | C B ! − · ! − · ! − · − C @ A B ··· C @ A That is, F = u /pN = !kj/pN for k, j N. kj kj 2 11. Note that the “ ”signswereeliminatedbytheconjugatetranspose, ¶ − u = u †. h k| | ki 12. Unitary: Fisunitarytransformation(exercise). ¶ 13. FFT: The FFT reduces the number of operations required from (N 2) ¶ to (N log N). O It doesO this with a recursive algorithm that avoids recomputing values. However, it is restricted to N =2n. 14. QFT: The QFT is even faster, (log2 N), that is, (n2). ¶ However, because the spectrumO is encoded in theO amplitudes of the state, we cannot get them all. It too is restricted to N =2n. 15. The QFT transforms the amplitudes of a quantum state: ¶ U f j = fˆ k , QFT j| i k| i j N k N X2 X2 where fˆ def=Ff. 16. Suppose f has period r,andsupposethatr N. ¶ Then all all the amplitude of fˆshould be at multiples| of its fundamental frequency, N/r. 17. If r N,thentheamplitudewillbeconcentratednear multiples of ¶ N/r.6| The approximation is improved by using larger n. 120 CHAPTER III. QUANTUM COMPUTATION 18. The QFT can be implemented with n(n +1)/2gatesoftwotypes: ¶ (1) One is Hj, the Hadamard transformation of the jth qubit. (2) The other is a controlled phase-shift. Specifically Sj,k uses qubit xj to control whether it does a particular phase shift on the 1 component | i of qubit xk. That is, S x x x x0 is defined by j,k| j ki 7! | j ki def i✓k j S = 00 00 + 01 01 + 10 10 + e − 11 11 , j,k | ih | | ih | | ih | | ih | k j where ✓k j = ⇡/2 − . − That is, the phase shift depends on the indices j and k. 19. It can be shown that the QFT can be defined:7 ¶ n 1 n 1 − − UQFT = Hj Sj,k. j=0 Y k=Yj+1 This is (n2)gates. O 7See [IQC] for this, with a detailed explanation in NC 5.1 (pp. 517–21). § D. QUANTUM ALGORITHMS 121 D.3.b Shor’s algorithm 1. Shor’s algorithm depends on many results from number theory, which ¶ are outside of the scope of this course. Since this is not a course in cryptography or number theory, I will just illustrate the ideas. Suppose we are factoring M (and M =21willbeusedforconcrete examples). 2. Step 1: Pick a random number a<M.Ifa and M are not coprime ¶ (relatively prime), we are done. (Euclid’s algorithm is (m2)= (log2 M).) O O 3. Example: Suppose we pick a = 11, which is relatively prime with 21. ¶ 4. Modular exponentiation: Let g(x) def= ax (mod M), for x M def= ¶ 0, 1,...,M 1 . 2 { − } 5. This takes (m3)gates.It’sthemostcomplexpartofthealgorithm! ¶ (ReversibleO circuits typically use m3 gates for m qubits.) 6. Ex.: In our case, g(x)=11x (mod 21), so ¶ g(x)=1, 11, 16, 8, 4, 2, 1, 11, 16, 8, 4,... period | {z } 7. In order to get a good QFT approximation, pick n such that M 2 ¶ 2n < 2M 2.LetN =2n. Note that although the number of samples is N =2n,weneedonlyn qubits (thanks to the tensor product). 8. Ex.: For M =21wepickn =9forN =512since441 512 < 882. ¶ 9. Step 2 (quantum parallelism): Apply U to the superposition ¶ g def n n 1 = H⌦ 0 ⌦ = x | 0i | i p | i N x N X2 to get def m 1 = U 0 ⌦ = x, g(x) . | 1i g| 0i| i p | i N x N X2 122 CHAPTER III. QUANTUM COMPUTATION 10. Ex.: Note that 14 qubits are required [n =9forx and m def= lg M =5 ¶ for g(x)]. d e 11. Step 3 (measurement): The function g has a period r,whichwe ¶ want to transfer to the amplitudes of the state so that we can apply the QFT. 12. This is accomplished by measuring (and discarding) the result register ¶ (as in Simon’s algorithm). Suppose the result register collapses into state g⇤. The input register will collapse into a superposition of all x such that g(x)=g⇤.Wecanwriteit def 1 1 = f(x) x, g⇤ = f(x) x g⇤ , | 2i Z | i Z | i | i x N " x N # X2 X2 where def 1, if g(x)=g f(x) = ⇤ , 0, otherwise ⇢ and Z def= x g(x)=g is a normalization factor. |{ | ⇤}| p 13. Note that the values x for which f(x) =0di↵erfromeachotherbythe ¶ period. 6 As in Simon’s algorithm, if we could measure two such x,wewould have useful information, but we can’t. 14. Note: As it turns out, the preceding measurement of the result register ¶ can be avoided. This is in general true for “internal” measurement processes in quantum algorithms (Bernstein & Vazirani 1997). 15. Ex.: Suppose we measure the result register and get g⇤ =8. ¶ Fig. III.24 shows the corresponding f. 16. Step 4 (QFT): Apply the QFT to obtain, ¶ 1 def= U f(x) x | 3i QFT Z | i x N ! X2 1 = fˆ(ˆx) xˆ . Z | i xˆ N X2 D. QUANTUM ALGORITHMS 123 26 E. Rieffel and W. Polak · 0.012 0.0108 26 0.0096 E. Rieffel and W. Polak · 0.0084 0.012 0.0072 0.0108 0.006 0.0096 0.0048 0.0084 0.0036 0.0072 0.0024 0.006 0.0012 0.0048 0.0 0.0036 0 64 128 192 256 320 384 448 512 0.0024 Fig. 2. Probabilities for measuring x when measuring the state C x, 8 obtained in2 Step 2, where Figure0.0012 III.24: Example probability distributionx X | f(x) for state X = x 211x mod 21 = 8 ∈ 1 { | }} | | Z− x0.0N f(x) x, 8 .InthisexampletheperiodisP r =6(e.g.,atx = 3, 9, 15,...2 0). [fig.| 64 source:i 128 IQC] 192 256 320 384 448 512 P 0.17 Fig. 2.0.153 Probabilities for measuring x when measuring the state C x, 8 obtained in Step 2, where x X | X = x 211x mod 21 = 8 ∈ {0.136| }} P 0.119 0.17 0.102 0.153 0.085 0.136 0.068 0.119 0.051 0.102 0.034 0.085 0.017 0.068 0.0 0.051 0 64 128 192 256 320 384 448 512 0.034 Fig.