<=>$?

@A>!B=CED>GFIH¤¥¦'¥§¨¨ ©



!"$##"%'&$()#(+*-,/.01*324,56*78.9*3:';

Any software problem can be solved by adding another layer of indirection.
Steven M. Bellovinj XkS

O K SWl#Quantum computation is slow, expensive, and error-prone.
By doing some of the work classically, we can lower thetotal cost of the computation.
0,/.

 m n;9,WXo,5lModular exponentiation is thedominant cost in Shor's algorithm.
n classical modular multiplications andn quantum modular multiplications areused in the standard method.

,pÎxÏ(ÐsÑÒXÏoÓuÔÕa mod N 
x_gbihabdcef`^ _1qt 1, k[ JP U]\t 0, kt 0, kt 0, k}}t 0, kb 7, k b 6, k b 5, k b 4, k b 3, k b 2, k b 1, k b 0, k



 1

xj
dj0

Ù]Ü

mod NÖÓxÏ(Ûmod N{{{wktl-1(x)

t1(x)

t0(x)

jq 1

x 0xa mod N ¡

q 11q£¢l 1btj 0x 0P SSIv-'rs#'r

jx ,jmod NP S5vs#w,'r M3) For k from 0 to l-1, doa) In quantum domain, use |tk(x)> as index into b,|c> = |b[|tk(x)>]>b) multiply |product> by |c>, modulo Nb) Update b array: classically multiply each element by itself(square it, modulo N) w times to create bj,k+1ÝÞºßÉà5á8âäã£ßåWæ£ÞÍÞ3âçÞºèéáâiãWß

pª Address«£¬®­ ­ ¯u°²±´superposition³¶µ/·u¸º¹»²¼½­ used to steert 1, kÎuÔ8ÛlÏ"ÐÒ'Úlw2w = n2w classical modular multiplications andl = n/w quantum multiplications(compared to n classical and n quantum using standard algorithm)

reader to appropriate data cells

Classical data cells

!YSZUO0O8

q4S/.!9,uv

Output superposition
1e+14¾¿]À¿$ÁQ¿Â(Ã¿Ä

1e+12

Total cost

1e+08

1e+06q, '



10000

Å

100

1

5

10

15

20

25

30

3540

Word length (w)1) P. Shor, “Polynomial time algorithms for prime factorization and discrete logarithms on aquantum computer”, SIAM J. Comp., 1997.
2) M. Nielsen & I. Chuang, Quantum Computation and Quantum Information, pp. 266—268,
Cambridge University Press, 2000.
3) N. Kunihiro, “Practical running time of factoring by quantum circuits”, EQIS 2003.
4) A. Barenco et al, “Approximate Fourier transform and decoherence”, PRA, 1996.

s#"Minimum cost depends on ratio of
quantum to classical multiplication cost.
Quantum cost must factor in repetitions ofShor's algorithm.
Curve can be used for different definitionsof cost, e.g., economic, or wall clock time.
(Graph assumes zero QACM cost.)

q:c cost 1e12:1
q:c cost 1e9:1
q:c cost 1,000,000:1
q:c cost 1,000:1
q:c cost 1:1

1e+10

We use |b[|t>]> to indicate the superposition retrieved from the array b by using |t> as
the index. Our QACM will need to hold 2w entries of n bits each to speed up modular
exponentiation of an n bit number by a factor of w.

a mod N 1) Initialize |product> to 12) Classically calculate initial bj,0 table values for all j, 0 <= j < 2w

The best implementation will use an array that holds classically-computed values,and allows a superposition of addresses to be used to retrieve a superposition ofthose values. We call this a quantum-addressable classical memory (QACM)2.

t 2, kbm ,k  am2

1bmod Nj 0 t x ,jljj 0jx n  1 x n  2 ... x 2w x 2w  1 ... x w x w  1 ... x 0

 K 9,uv

3UVSW 00G,/.XYSZ M -#3

ØÙ-Ñ(Ú'ÛFor the superposition |x>, this becomes

4JLK  KMONP -#Q00ORTS/Ö×t k x  will be index into array b.

For iteration k,Pointers (memory addresses) and array indices are the mostcommon forms of indirection. Indirection saves space, allows
sharing of objects, and allows data to be filled in later in thecomputation.
Indirection may be an arbitrary number of levels deep; we areusing only one, for the moment.
Arguments by value: add 4,3 (zero levels of indirection)
Arguments by reference: add this, that (one level of indirection)a mod N }G~

Divide x into l words oflength w, l = n/w

nx

x : x n y 1 x n y 2 z{z{z x 0

Binary expansion ofLet d j | amod N
dj values are computed classically3.

q 1

1q

To factor the n bit
number N, we must
evolve to hold:2j

Use part of superposition |x> as an index into a table.
1
For Shor's algorithm , the table contains classicallycomputed parts of the modular exponentiation of a. This
allows us to reduce the number of multiplications
necessary in the quantum domain by a factor of w, inw
exchange for 2 more classical multiplications.

P S/vs#w,xr M

qlr8s#stu0

Q:C cost ratio Optimum w
1000
61.00E+006
131.00E+009
22
1.00E+012
31

Entries in barray
64
8K
4M
2G

Cost
reduction
4.3x
11.7x
20.2x
29.1x

ÅBarenco et al showed that the­£»/­u³²±Æ³Q±`ÇuÈYÈ/Ê ­WË5withÌÍ­ Shor's
probabilityof ¸Ésuccessalgorithm may be 10-5 for sizes of afew kilobits4.
When repeating the algorithm, theclassical parts can be saved andreused. The quantum portion of theexponentiation must be redone.