 +,NICT $*"'(# )%!&201920192 711/O;@BE ACDP
Q8 % .(,*GMJLNH* ?(,INKQ
76A3••••0A3
5 2-!F&9>76A3+6:<9RSAA3O %4PRSAA+6:)$'@#"=>A3

2

$

1MWU]^YSL,`J.*LENKMa$ 1L5M:$ LMa=AF?L")KOP-6BRQ• L&IJQ@%K(C=?c• LH@7K4#BRG=Q?c• 7K2BRG=Q?c• VTZX\[_KDQ0M<Q?c* +BRG=Q$ "LAMa• / !3• '8 ! ;@ 9H<QI=>LH@-6BRG=Qb
30)2)2!($/%E(1) .35*$4&,• " 7A9@:?035*$-$• 35*$4/7A9@:?0C$exp
64/9 + *(1) (ln 0)1/2 (ln ln 0)3/2

(2) #+'5*$4&,• 200912D768=;< (232)/ •
14$6
• 14$>8B:D1500 AMD Opteron processor(2.2 GHz with 2 GB RAM)4F
(3) % !=• OSG=V* (=LQRIJK>+18/39<2<;C,• JSMSHRNPSK=!
= =" F80C51<4C<>UUU(1) '<:2?8E/67-C/W(2)  =$8T )<:2?8ADC/W(3) % != F&4C29<@B#.U5

CRYPTREC"%

,1=

1. &.62-/=

2.  0+ 6)=3. 0$!6 *5=(-/34=1024, 2048:890#0 '6%
CRYPTREC Report2017https://www.cryptrec.go.
jp/report/cryptrec-rp2000-2017.pdf
34;<7346

9E,?*:;49@/($O4;
FTP ($?FRO#H.D>):>4LQ
23R203E+?FB7R• ?6L<8"C0O':;4S• I:7FR'C 8>:?I-:;4S/($E?ISSS(1) +CA9G?N5=>4L5T(2)  E&?R1CA9G?!JML5T(3) ($% E
O K;4S

7*/+.,-

1985 : Deutsch$2 Turing Machine)
1994 : Simon&*/+.,-0 &1
1994 : Shor&*/+.,-2" #&*/+.,-&
0!(#'& 1
1996 3 Grover&*/+.,-0#1
3%( &*/+.,Quantum Algorithm Zoo
https://math.nist.gov/quantum/zoo/8

-,'!<D

B5$?

1.GEF- ?.
20158KNSA4JGEF- @?&)D*
20162KNIST4JGEF- ? " ,%D*-,'!?#>3:J( +J/ 1?06>7=2 ?.
694
2019110>JRound 2 algorithmsD*H897J128#;*6C:2=2I
2019130J Round 2 algorithmsD*20222024A;> "92. Noisy Intermediate-scale Quantum (NISQ)
"!)

Noisy Intermediate-scale Quantum (NISQ) system• Google 72(%&• IBM 50(%&• Intel 49(%&)'#$)  *10(3)2#!2:+8

Quantum Computing: Progress and Prospects (2018)*•/=;<2 *%>"7 (?#!'%.8&2:+813+)8(it is still too early to be able to predict the time horizon
for a scalable quantum computer.)• NISQ2$::+A5,3@/(862:8A•
1+94@6-0 (%:+*National Academies of Sciences, Engineering, and Medicine11

(1) /,&DHJ(+D1>J

1. ( +W3 5L40A+:;B8A9J
2. 2E .G'CSOTNU/RPQW
MTQEVFH:#+<K@6JX• ( + (K05, TK08, HRS16)• 3 5 (RNSL17)nRPQE( +L*7EDXXX• !%C .AFW
3n+2 /RPQWO(n3)E MTQ
• /RPQL =? .AFW
2n+2/RPQW O(n4)E MTQ
U#%C$Y-IF:"6W/RPQF) V12

Shor/#4<5;8:/B N@ a. *+, ar = 1(mod N),-2 /  r >?312@
Step1:  |0C|1C3
Step2: Hadamard 3&1®

Step3: 0)3&

®

Step:4 $QFT3&

2 m -1j 1
å2m1j =02 m -1

jjamod Nå

2 m j =0

1 r -1 ~s®
uså
r s =0 r

Step5: 1=6793"B~s®
r

Step6: % '3!( r 312A

13





(11010011)2=211 b0b1b2b3
b4
b5b6b7c1c2
c3
c4
c5c6c7b8

C-NOT gate
cctt ÅcToffoli gate
c1c1
c2c2tt Å (c1 Ù c2 )

14





#!"% $"*768#!"

2048#!"

# of qubits # of gates# of qubits # of gates



2306

1.221011

6146

3.041012

#!"


1539--40991.351015



1539

8.681011

4099

1.221013* N. Kunihiro, “Exact Analysis of Computational Time for Factoringin Quantum Computers,” IEICE Trans. Vol. 88-A, No.1 2005.

15

(2) Shor 

[1] Experimental realization of Shor's quantum factoring algorithm
using nuclear magnetic resonance, Nature, 2001.
[2] Shor’s Quantum Factoring Algorithm on a Photonic Chip,
Science, 2009.
[3] Computing prime factors with a Josephson phase qubit quantum
processor, Nature Physics, 2012.
[4] Realization of a scalable Shor algorithm, Science, 2016.
[5] Experimental realisation of Shor’s quantum factoring algorithm
using qubit recycling, Nature Photonics, 2012.

16

DeviceYear

JournalNMRIBM2001

15

NaturePhotonic chip

U. of Bristol

200915

ScienceSuperconductivity UCSB

2012

15

Nature Physics

Ion Trap

U. Innsbruck201615

SciencePhoton

U. of Bristol

201221NaturePhotonics• %1014 qubit&• # %!qubit$"&• "&17

[1]
1

 IBM, NMR($ |+⟩|1⟩ ⟶2# %&'x7 mod 15x2
y0y21($ |+⟩|7% mod 15⟩

2# %&'x4 mod 15x1x3
y1y3x3=1

 7

x2=1,y0  y2 SWAPx2=1,
y1  y3 SWAP18 N=15  

1 → x3==1 16 → x2==1  4y mod 15y=(y3 y2 y1 y0)2
4 y= (y3 y2 y1 y0 00)2=16 (y3 y2)2+(y1 y0 00)24 y mod 15= (y3 y2)2+(y1 y0 00)2=(y1 y0 y3 y2)22SWAP

19

[4]

 (Innsbruck, Ion Trap)

a=2, 7, 8, 13 x 4 mod 15x

H

Hx a mod 15
H

H

IQFT

y0y1y2U4Ua
a=2, 7,8, 13y320

X

X X
X X
X

X

X

X X
X X
X
U2X

X

X X

X X X

X

X
U8X
U7X
X

X
X
||U4U13X X

X

SWAP



X

XX XC-SWAP
X
X||U1121

[2]



(U. of Bristol, Photonic chip)x1x2x3y0y1

a=7
70=1, 71= 7, 72 =4, 73=13, 74=1
Trick: encode1→ (00)2, 7 → (01)2, 4 →(10)2, 13 → (11)2.
U7: (00)2à (01)2,U4: (0x)2à(1x)2
 &4'Shor %!$"# '22

[2][5]
Shor$)%(&'!!
1()*+$ |.⟩|1⟩ ⟶2# %&'1()*+$ |.⟩|0 % mod 4⟩

2# %&'“simplified” or “compiled” Shor$)%(&'
12#()*+$ |.⟩|0⟩ ⟶%&'

12#()*+$ |.⟩|. mod 6⟩%&'r ,!! !Shor$)%(&'*+ [5] ,21 #",23

Oversimplifying Quantum Factoring*a! 2 (a2 mod N = 1)''11# |*⟩|1⟩ ⟶# |*⟩|0 $ mod 1⟩
2 $%&
2 $%&
“oversimplified” Shor",$+&*
1'# |*⟩|0⟩ ⟶2 $%&|0>H1'# |*⟩|* mod 2⟩

2 $%&

H|0>
•• .20,000-bit- !
)'(%#&!  !
* A Smolin, John & Smith, Graeme & Vargo, Alexander. (2013).
Oversimplifying quantum factoring. Nature. 499. 163-165.

24

N, a



SageMath
k=4096p=random_prime(2^k-1, false, 2^(k-1))
q=random_prime(2^k-1, false, 2^(k-1))
N=p*q
a= crt(1, -1, p, q)2048-bit RSA
4096-bit RSA18192-bit RSA10




25

,'"M4?#&/G

• #&;L?B GJGH15• ?@<P1152B3K:CM <A4KQ07)B8>5E:C• B8K@9G M 4E4*M$4P•.G, '"NNISQEDOB /M<AIK• !EBHE4GBP0E+7 %• M-F*M=KG6J(7 %26

Quantum Computing: Progress and Prospects  Key Finding 1:
Given the current state of quantum computing and recent rates ofprogress, it is highly unexpected that a quantum computer that cancompromise RSA 2048 or comparable discrete logarithm based publickey cryptosystems will be built within the next decade.
Key Finding 10:
Even if a quantum computer that can decrypt current cryptographic
ciphers is more than a decade off, the hazard of such a machine ishigh enough - and the time frame for transitioning to a new security
protocol is sufficiently long and uncertain - that prioritization of thedevelopment, standardization, and deployment of post-quantum
cryptography is critical for minimizing the chance of a potential
security and privacy disaster.

27

Key Finding 3:
Research and development into practical commercial applicationsof noisy intermediate scale quantum (NISQ) computers is an issueof immediate urgency for the field. The results of this work will
have a profound impact on the rate of development of large-scalequantum computers and on the size and robustness of a commercial
market for quantum computers.
Key Finding 4:
Given the information available to the committee, it is still too early
to be able to predict the time horizon for a scalable quantum
computer. Instead, progress can be tracked in the near term bymonitoring the scaling rate of physical qubits at constant averagegate error rate, as evaluated using randomized benchmarking, andin the long term by monitoring the effective number of logical(error corrected) qubits that a system represents.
   281);2875:+ '#<>?*,= (• Grover=CNDMFJB07(• ;,$ (2"/$ )• IGEL.=&"$ (2"/% )• Simon=CNDMFJB07( (2010-)• Even-MansourR3-round Feistel scheme< 6?P /-Q(Kuwakado-Morii, ISIT2010)• LWRR 4=KOH< 6?P /-Q(CRYPTO2016)

 R< !3%A@90?

29

[V\@80&V! 5YBXSJT*(1) *<,XZkF AU7: 3• =%k6Wiejd]^N-_aTJ`(2) CY17Gb2
• JNSKY)Zk17GVPTZ?
• JNSKY)ZkfjcghVQ` XN
• '+,W=X^`GL"[PJ(3) @80&Y#Y b;$• #b(Q`OVZDPJ• @80&Y #b?Xa`OVLUM`YZk[R[RY9l• 4HWEK_./b>\`6LI`l30