Peter W. Shor

Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer

A digital computer is generally believed to be an efficient universal computing device; that is, it is believed able to simulate any physical computing device with an increase in computation time of at most a polynomial factor. This may not be true when quantum mechanics is taken into consideration. This paper considers factoring integers and finding discrete logarithms, two problems which are generally thought to be hard on a classical computer and have been used as the basis of several proposed cryptosystems. Efficient randomized algorithms are given for these two problems on a hypothetical quantum computer. These algorithms take a number of steps polynomial in the input size, e.g., the number of digits of the integer to be factored.

Algorithms for quantum computation: discrete logarithms and factoring

A computer is generally considered to be a universal computational device; i.e., it is believed able to simulate any physical computational device with a cost in computation time of at most a polynomial factor: It is not clear whether this is still true when quantum mechanics is taken into consideration. Several researchers, starting with David Deutsch, have developed models for quantum mechanical computers and have investigated their computational properties. This paper gives Las Vegas algorithms for finding discrete logarithms and factoring integers on a quantum computer that take a number of steps which is polynomial in the input size, e.g., the number of digits of the integer to be factored. These two problems are generally considered hard on a classical computer and have been used as the basis of several proposed cryptosystems. We thus give the first examples of quantum cryptanalysis.<<ETX>>

Elementary gates for quantum computation.

We show that a set of gates that consists of all one-bit quantum gates (U(2)) and the two-bit exclusive-or gate (that maps Boolean values (x,y) to (x,x ⊕y)) is universal in the sense that all unitary operations on arbitrarily many bits n (U(2 n )) can be expressed as compositions of these gates. We investigate the number of the above gates required to implement other gates, such as generalized Deutsch-Toffoli gates, that apply a specific U(2) transformation to one input bit if and only if the logical AND of all remaining input bits is satisfied. These gates play a central role in many proposed constructions of quantum computational networks. We derive upper and lower bounds on the exact number of elementary gates required to build up a variety of two- and three-bit quantum gates, the asymptotic number required for n-bit Deutsch-Toffoli gates, and make some observations about the number required for arbitrary n-bit unitary operations.

Simple Proof of Security of the BB84 Quantum Key Distribution Protocol

We prove that the 1984 protocol of Bennett and Brassard (BB84) for quantum key distribution is secure. We first give a key distribution protocol based on entanglement purification, which can be proven secure using methods from Lo and Chaus proof of security for a similar protocol. We then show that the security of this protocol implies the security of BB84. The entanglement purification based protocol uses Calderbank-Shor-Steane codes, and properties of these codes are used to remove the use of quantum computation from the Lo-Chau protocol.

Good quantum error correcting codes exist

With the realization that computers that use the interference and superposition principles of quantum mechanics might be able to solve certain problems, including prime factorization, exponentially faster than classical computers @1#, interest has been growing in the feasibility of these quantum computers, and several methods for building quantum gates and quantum computers have been proposed @2,3#. One of the most cogent arguments against the feasibility of quantum computation appears to be the difficulty of eliminating error caused by inaccuracy and decoherence @4#. Whereas the best experimental implementations of quantum gates accomplished so far have less than 90% accuracy @5#, the accuracy required for factorization of numbers large enough to be difficult on conventional computers appears to be closer to one part in billions. We hope that the techniques investigated in this paper can eventually be extended so as to reduce this quantity by several orders of magnitude. In the storage and transmission of digital data, errors can be corrected by using error-correcting codes @6#. In digital computation, errors can be corrected by using redundancy; in fact, it has been shown that fairly unreliable gates could be assembled to form a reliable computer @7#. It has widely been assumed that the quantum no-cloning theorem @8# makes error correction impossible in quantum communication and computation because redundancy cannot be obtained by duplicating quantum bits. This argument was shown to be in error for quantum communication in Ref. @9#, where a code was given that mapped one qubit ~two-state quantum system! into nine qubits so that the original qubit could be recovered perfectly even after arbitrary decoherence of any one of these nine qubits. This gives a quantum code on nine qubits with a rate 1

Fault-tolerant quantum computation

It has recently been realized that use of the properties of quantum mechanics might speed up certain computations dramatically. Interest in quantum computation has since been growing. One of the main difficulties in realizing quantum computation is that decoherence tends to destroy the information in a superposition of states in a quantum computer making long computations impossible. A further difficulty is that inaccuracies in quantum state transformations throughout the computation accumulate, rendering long computations unreliable. However, these obstacles may not be as formidable as originally believed. For any quantum computation with t gates, we show how to build a polynomial size quantum circuit that tolerates O(1/log/sup c/t) amounts of inaccuracy and decoherence per gate, for some constant c; the previous bound was O(1/t). We do this by showing that operations can be performed on quantum data encoded by quantum error-correcting codes without decoding this data.

Remote State Preparation

Quantum teleportation uses prior entanglement and forward classical communication to transmit one instance of an unknown quantum state. Remote state preparation (RSP) has the same goal, but the sender knows classically what state is to be transmitted. We show that the asymptotic classical communication cost of RSP is one bit per qubit--half that of teleportation--and even less when transmitting part of a known entangled state. We explore the tradeoff between entanglement and classical communication required for RSP, and discuss RSP capacities of general quantum channels.

Geometric applications of a matrix-searching algorithm

LetA be a matrix with real entries and letj(i) be the index of the leftmost column containing the maximum value in rowi ofA.A is said to bemonotone ifi1 >i2 implies thatj(i1) ≥J(i2).A istotally monotone if all of its submatrices are monotone. We show that finding the maximum entry in each row of an arbitraryn xm monotone matrix requires Θ(m logn) time, whereas if the matrix is totally monotone the time is Θ(m) whenm≥n and is Θ(m(1 + log(n/m))) whenm<n. The problem of finding the maximum value within each row of a totally monotone matrix arises in several geometric algorithms such as the all-farthest-neighbors problem for the vertices of a convex polygon. Previously only the property of monotonicity, not total monotonicity, had been used within these algorithms. We use the Θ(m) bound on finding the maxima of wide totally monotone matrices to speed up these algorithms by a factor of logn.

Quantum Error Correction and Orthogonal Geometry

A quantum error-correcting code is a way of encoding quantum states into qubits (two-state quantum systems) so that error or decoherence in a small number of individual qubits has little or no effect on the encoded data. The existence of quantum error-correcting codes was discovered only recently [1]. Although the subject is relatively new, a large number of papers on quantum error correction have already appeared. Many of these describe specific examples of codes [1 ‐ 9]. However, the theoretical aspects of these papers have been concentrated on properties and rates of the codes [7,10 ‐ 12], rather than on recipes for constructing them. This Letter introduces a unifying framework which explains all the codes discovered to date and greatly facilitates the construction of new examples. The basis for this unifying framework is group theoretic. It rests on the structure of certain finite subgroups E , L in Os2 n d and E 0 , L 0 in Us2 n d [13]. Since the natural

Quantum nonlocality without entanglement

We exhibit an orthogonal set of product states of two three-state particles that nevertheless cannot be reliably distinguished by a pair of separated observers ignorant of which of the states has been presented to them, even if the observers are allowed any sequence of local operations and classical communication between the separate observers. It is proved that there is a finite gap between the mutual information obtainable by a joint measurement on these states and a measurement in which only local actions are permitted. This result implies the existence of separable superoperators that cannot be implemented locally. A set of states are found involving three two-state particles that also appear to be nonmeasurable locally. These and other multipartite states are classified according to the entropy and entanglement costs of preparing and measuring them by local operations.