6789:;<*+)=;>?

,#-&+&<@.

A=;

/(BkmlongpqQrsnXtulvxwonzy|{!

"

012

#$%'&(#)3!45

&

CEDEFHGJIKMLONEGQPEISR ISTUTFVEWSR IXTNZY\[^]`_aYcbdIe[fDgYhN]ZYdiEjÊË`Ì`ËUÍ`ÎÎÏ

Any software problem can be solved by adding another layer of indirection.
Steven M. Bellovin D`N

PD`F ~ fNSTSjJDHGJIOGR[NR[fDHG[GHJDXTO¡¢_

Quantum computation is slow, expensive, and error-prone.
By doing some of the work classically, we can lower thetotal cost of the computation.
¾N _e[f]µ´FJIHN

Modular exponentiation is thedominant cost in Shor's algorithm.
n classical modular multiplications andn quantum modular multiplications areused in the standard method.

Binary expansion ofLet d j ¨ a 2 mod N
dj values are computed classically3.

  

a mod N ÁSÂm2 w kb m , k Á a mod N
Ä1mod Nb
jÃ 0 t x ,j1
qÅt 0, kt 0, kt 0, kt 0, kt1(x)t0(x)

qº 1
x¹ 0

Æxa mod N ÇÈqº 11
qÅx¹ 0ÆÉlº 1j¹ 0

 `¶­`D`£ISREdIXTg·mREcIbtjx ,jmod N Ç f£`DXTX[¥RE 3) For k from 0 to l-1, doa) In quantum domain, use |tk(x)> as index into b,|c> = |b[|tk(x)>]>b) multiply |product> by |c>, modulo Nb) Update b array: classically multiply each element by itself(square it, modulo N) w times to create bj,k+1 ÿ     ¢Ð AddressÑÒÔÓfÓ¢Õ¢Ö×ÙsuperpositionØaÚÜÛÝfÞ¯ßhà Ó used to steer

b 7, k b 6, k b 5, k b 4, k b 3, k b 2, k b 1, k b 0, kmod N1) Initialize |product> to 1
2) Classically calculate initial bj,0 table values for all j, 0 <= j < 2w

The best implementation will use an array that holds classically-computed values,
and allows a superposition of addresses to be used to retrieve a superposition ofthose values. We call this a quantum-addressable classical memory (QACM)2.

}}xj« 0djj³ ~ R`R[GJ£µ´¥R}O~ NHGR ~ HJ F`FHTcI`_`_`NH IzN__e[f]EN|PI  DXTcK }E `Pg

t 1, ktl-1(x)lFor the superposition |x>, this becomes4

t 1, kx : x n ¦ 1 x n ¦ 2 §§¢§ x 0¬ 1{{t k x À will be index into array b.

{¿3t 2, k

lw2w = n2w classical modular multiplications andl = n/w quantum multiplications(compared to n classical and n quantum using standard algorithm)

reader to appropriate data cells

Classical data cells­`DHRN|D_SR®N`GF`IeI`]SR¤[¯GJ£Q°HDST Fe[±EIQ²

Output superposition

Minimum cost depends on ratio of
quantum to classical multiplication cost.
Quantum cost must factor in repetitions ofShor's algorithm.
Curve can be used for different definitionsof cost, e.g., economic, or wall clock time.
(Graph assumes zero QACM cost.)

q:c cost 1e12:1
q:c cost 1e9:1
q:c cost 1,000,000:1
q:c cost 1,000:1
q:c cost 1:1

1e+14

1e+12

áEâ\ãâXäåâOæJçâ`èTotal cost

1e+10We use |b[|t>]> to indicate the superposition retrieved from the array b by using |t> as
the index. Our QACM will need to hold 2w entries of n bits each to speed up modular
exponentiation of an n bit number by a factor of w.

1e+081e+06

10000é10011) P. Shor, “Polynomial time algorithms for prime factorization and discrete logarithms on aquantum computer”, SIAM J. Comp., 1997.
2) M. Nielsen & I. Chuang, Quantum Computation and Quantum Information, pp. 266—268,
Cambridge University Press, 2000.
3) N. Kunihiro, “Practical running time of factoring by quantum circuits”, EQIS 2003.
4) A. Barenco et al, “Approximate Fourier transform and decoherence”, PRA, 1996.

a j mod N ¼

x n ½ 1 x n ½ 2 ... x 2w x 2w ½ 1 ... x w x w ½ 1 ... x 0

Divide x into l words oflength w, l = n/w

x

Pointers (memory addresses) and array indices are the mostcommon forms of indirection. Indirection saves space, allows
sharing of objects, and allows data to be filled in later in thecomputation.
Indirection may be an arbitrary number of levels deep; we areusing only one, for the moment.
Arguments by value: add 4,3 (zero levels of indirection)
Arguments by reference: add this, that (one level of indirection)

jj¹ 0ï¥ðñXò óðô¯õdöø÷EùQúHûSò üýsï¯õdýSð ñ`ó`üQûgþ÷zô¥ð ýFor iteration k,

na x mod N ©zªqº 1 »1q¸

To factor the n bit
number N, we must
evolve to hold:j

Use part of superposition |x> as an index into a table.
For Shor's algorithm1, the table contains classicallycomputed parts of the modular exponentiation of a. This
allows us to reduce the number of multiplications
necessary in the quantum domain by a factor of w, inexchange for 2w more classical multiplications.

 f£`DST¤[¥RJ 

5101520
Word length (w)

Q:C cost ratio Optimum w
1000
61.00E+006
131.00E+009
221.00E+012
312530

Entries in b
array
64
8K
4M
2G

35

40

Cost
reduction
4.3x
11.7x
20.2x
29.1x

é

Barenco et al showed that theÓ¢ßÓ¯Ød× Øh× ê¯ëof Ýsuccessëì Ó¢í^withîfÓ Shor's
probability
algorithm may be 10-5 for sizes of a4
few kilobits .
When repeating the algorithm, theclassical parts can be saved andreused. The quantum portion of theexponentiation must be redone.