A FAST QUANTUM CIRCUIT FOR ADDITION WITH FEW QUBITS

Transcription

1 Quantum Information and Computation, Vol. 8, No. 6&7 (2008) c Rinton Press A FAST QUANTUM CIRCUIT FOR ADDITION WITH FEW QUBITS YASUHIRO TAKAHASHI 1,2 and NOBORU KUNIHIRO 2 1 NTT Communication Science Laboratories, NTT Corporation Atsugi, Kanagawa , Japan 2 The University of Electro-Communications Chofu, Tokyo , Japan Received January 19, 2007 Revised January 21, 2008 We show how to construct a fast quantum circuit for computing the sum of two n-bit binary numbers with few qubits. The constructed circuit uses O(n/ log n) ancillary qubits and its depth and size are O(log n) ando(n), respectively. The number of ancillary qubits is asymptotically less than that in Draper et al. s quantum carry-lookahead adder, and the depth and size are asymptotically the same as those of Draper et al. s. Moreover, we show that the circuit is useful for constructing an efficient quantum circuit for Shor s factoring algorithm. Keywords: quantum circuits, addition, ancillary qubits, Shor s factoring algorithm Communicated by: RJozsa&MMosca 1 Introduction In 1994, Shor proposed an efficient quantum algorithm for factoring [1]. In order to perform the algorithm on a quantum computer, it is important to construct efficient quantum circuits for the algorithm. This is because the computational resources of a quantum computer, such as qubits and computation times, will be limited. For constructing such circuits, efficient quantum circuits for addition are useful since Shor s algorithm uses modular exponentiation that is decomposed into elementary arithmetic operations [2, 3]. Thus, there is great interest in constructing efficient quantum circuits for addition. There have been many studies of quantum circuits for computing the sum of two n-bit binary numbers, and most of them have focused on decreasing the number of ancillary qubits [2, 4, 5, 6, 7]. In contrast, in 2006, Draper et al. focused on decreasing the depth and constructed a fast quantum circuit for addition using the classical carry-lookahead technique [8]. The circuit uses O(n) ancillary qubits and its depth and size are O(log n) and O(n), respectively. It is obvious that the size is optimal (up to a constant factor). Moreover, using the result in [9], we can easily show that the depth is optimal (up to a constant factor). It is natural to ask whether the number of ancillary qubits can be decreased without increasing the depth and size. In this paper, we show that this can be done. Our circuit uses O(n/ log n) ancillary qubits and its depth and size are O(log n) ando(n), respectively. Cuccaro et al. also state that such a circuit can be constructed [6], but they do not give any details. Roughly speaking, 636

2 Y. Takahashi and N. Kunihiro 637 the main idea is to combine a modified version of Draper et al. s quantum carry-lookahead adder with parallel applications of Takahashi et al. s quantum ripple-carry adder [7]. Since the modified version and the ripple-carry adder use few qubits, we can save ancillary qubits. A quantum circuit for addition of two binary numbers is useful for Shor s algorithm if it uses one of the numbers only to control some gates [3, 4]. This is because such a circuit canaddafixedclassicalnumbertoa quantum number (that is represented by qubits) without preparing qubits for the fixed classical number. Unfortunately, our circuit is not such a classical-quantum adder. However, we show that we can transform our circuit into such a classical-quantum adder without increasing the depth and the number of qubits. The modified version of our circuit uses the (exact) quantum Fourier transform, though the original circuit is a classical reversible circuit. Using the modified version, we construct a depth-efficient quantum circuit for Shor s algorithm with few qubits. More precisely, we decrease the depth of Beauregard s quantum circuit for Shor s factoring algorithm [3] from O(n 3 )too(n 2 log n) at the cost of increasing O(n/ log n) qubits, where n is the length of the number to be factored. When Draper et al. s quantum carry-lookahead adder is used, the depth can be decreased as above, but O(n) more qubits are required. 2 Draper et al. s Quantum Carry-Lookahead Adder In the following, we use the standard notation for quantum states and the standard diagrams for quantum circuits [10]. The size of the circuit is defined as the total number of elementary gates, where the elementary gates are one-qubit and two-qubit gates. The depth of the circuit is defined as follows. Input qubits are considered to have depth 0. For each gate G, the depth of G is equal to 1 plus the maximal depth of a gate on which G depends. The depth of the circuit is equal to the maximal depth of a gate in the circuit. Let a and b be two n-bit binary numbers and a n 1 a 0 be the binary representation for a, wherea 0 is the low-order bit. Similarly, let b n 1 b 0 be the binary representation for b and s n s 0 be the binary representation for a + b. The carry bit c i (0 i n) is defined as follows: { 0 i =0, c i = a i 1 b i 1 b i 1 c i 1 c i 1 a i 1 1 i n, where denotes addition modulo 2. It holds that { ai b s i = i c i 0 i n 1, c n i = n. For computing the carry bits, Draper et al. define two bits p[i, j] (1 i<j n) and g[i, j] (0 i<j n). As described in [8] (though we do not describe the definitions in detail), p[i, j] is 1 if a carry bit is propagated from bit position i to bit position j, and g[i, j] is 1 if a carry bit is generated between bit positions i and j. Thep[i, j] andg[i, j] are computed by the following relationships: The computation of p[i, j] For any i such that 1 i n 1, p[i, i +1]=a i b i. For any i, j such that 1 i<i+1<j n, p[i, j] =p[i, k] p[k, j], where k is any number satisfying i<k<j.

3 638 A fast quantum circuit for addition with few qubits The computation of g[i, j] For any i such that 0 i n 1, g[i, i +1]=a i b i. For any i, j such that 0 i<i+1<j n, g[i, j] =(g[i, k] p[k, j]) g[k, j], where k is any number satisfying i<k<j. It holds that g[0,j]=c j for all 1 j n. Roughly speaking, for two n-bit binary numbers a and b, Draper et al. s quantum carrylookahead adder computes a + b as follows: It first computes p[i, i +1] (1 i n 1) and g[i, i +1] (0 i n 1). Then, it computes g[0,i](1 i n) by successively doubling the sizes of the intervals under consideration. Lastly, it computes s i (0 i n), where s 0 = p[0, 1], s i = p[i, i +1] g[0,i](1 i n 1), and s n = g[0,n]. Note that each g[i, i +1] in the first step requires a new ancillary qubit and thus n ancillary qubits are used. The circuits for the first and last steps are simple. The key circuit is the one for the second step that computes g[0,i]. We call this circuit the CARRY gate. In the following, we explain the CARRY gate in detail since our circuit uses a modified version of it. The CARRY gate is a circuit for the quantum operation p[i, i +1] g[j, j +1] p[i, i +1] g[0,j+1]. 1 i n 1 0 j n 1 1 i n 1 0 j n 1 The CARRY gate consists of four stages P,G,C,P 1. Each stage consists of about log n rounds and each round consists of Toffoli gates that are performed simultaneously. The memory location containing p[i, i + 1] initially will contain p[i, i + 1] and the memory location containing g[j, j + 1] initially will contain g[0, j + 1] at the end of the computation. We assume that there are ancillary memory locations containing 0 initially. The CARRY gate is defined as follows, where we denote a round t of a stage S as S t and define p 0 [i] =p[i, i +1] and g 0 [i] =g[i, i +1]: P t :Fort =1,..., log n 1: for i =1,..., n/2 t 1: Apply a Toffoli gate to memory locations containing p t 1 [2i] andp t 1 [2i +1] and an ancillary memory location containing 0 to compute p t 1 [2i] p t 1 [2i +1]=p[2 t i, 2 t (i +1)]. We call the value p t [i] and write it into the ancillary memory location. Note that each p t [i] requires a new ancillary qubit. G t :Fort =1,..., log n : fori =0,..., n/2 t 1: Apply a Toffoli gate to memory locations containing g t 1 [2i] and p t 1 [2i +1] and g t 1 [2i + 1] to compute (g t 1 [2i] p t 1 [2i +1]) g t 1 [2i +1]=g[2 t i, 2 t (i +1)]. We call the value g t [i] and write it into the memory location containing g t 1 [2i +1]. C t :Fort = log(2n/3),...,1: for i =1,..., (n 2 t 1 )/2 t : Apply a Toffoli gate to memory locations containing g[0, 2 t i]andp t 1 [2i] andg t 1 [2i] to compute (g[0, 2 t i] p t 1 [2i]) g t 1 [2i] =g[0, 2 t 1 (2i +1)]

4 Y. Takahashi and N. Kunihiro 639 Fig. 1. The CARRY gate for n =8. and write it into the memory location containing g t 1 [2i]. Note that g[0, 2 t i] is computed in an earlier stage or round. P 1 t :Fort = log n 1,...,1: for i =1,..., n/2 t 1: Apply a Toffoli gate to memory locations containing p t 1 [2i] andp t 1 [2i +1]andp t [i] to compute p t 1 [2i] p t 1 [2i +1]=p[2 t i, 2 t (i +1)] and write it into the memory location containing p t [i] to set the memory location to 0. The CARRY gate for n = 8 is depicted in Fig. 1. It consists of P 1,P 2,G 1,G 2,G 3,C 2,C 1, P 1 2,andP Our Circuit 3.1 The Use of Only Upper Rounds As described in the previous section, Draper et al. s quantum carry-lookahead adder requires O(n) ancillary qubits. The reason is that g 0 [i] andp t [i] require new ancillary qubits. If we reduce the number of g 0 [i] s and p t [i] s we deal with, we can save ancillary qubits. Thus, for some l, we consider the situation where we start the computation by the CARRY gate with p l 1 [i] (1 i n/2 l 1 1), which is the output of P l 1 in the CARRY gate. A simple calculation shows that, if we have g l 1 [i] (0 i n/2 l 1 1),

5 640 A fast quantum circuit for addition with few qubits which is the output of G l 1 in the CARRY gate, the CARRY gate outputs g[0, 2 l 1 (j +1)]=c 2 l 1 (j+1) for 0 j n/2 l 1 1 without using any round t<l. More precisely, g[0, 2 l 1 ]isoneof the initial values, g[0, 2 l 1 (j +1)] when j +1= 2 p for some p 1 is computed by G t for some t l, andg[0, 2 l 1 (j +1)]when j +1=2 p (2q +1)forsomep 0andq 1 is computed by C t for some t l. Based on the above observation, we construct a quantum circuit for the quantum operation p l 1 [i] g l 1 [j] 1 i n/2 l i n/2 l j n/2 l 1 1 p l 1 [i] 0 j n/2 l 1 1 g[0, 2 l 1 (j +1)]. The circuit is defined as the CARRY gate except that the initial values of t in P t and G t are set to l and the last values of t in C t and P 1 t are set to l. The circuit uses ancillary qubits in P t and the number is log n 1 ( n/2 t 1). t=l Since the circuit decreases l 1 rounds in each stage in the CARRY gate, the depth of the circuit is O(log n l). The size of the circuit is log n 1 O( t=l ( n/2 t 1)). We call the circuit the CARRY l gate. Note that the CARRY gate is the CARRY 1 gate. The CARRY 2 gate for n = 8 is depicted in Fig. 2. It consists of P 2,G 2,G 3,C 2,andP Computation of the Initial Values For constructing a quantum circuit for addition using the CARRY l gate, we need to compute the initial values p l 1 [i] (1 i n/2 l 1 1), g l 1 [i] (0 i n/2 l 1 1). Note that p l 1 [i] =p[2 l 1 i, 2 l 1 (i +1)]andg l 1 [i] =g[2 l 1 i, 2 l 1 (i + 1)]. Using the relationships for computing p[i, j] and g[i, j] in Section 2, we can easily show that p[i, j] and g[i, j] are computed by the following relationships: For any i, j such that 1 i<j n, p[i, j] =(a i b i ) (a j 1 b j 1 ). For any i, j such that 0 i<j n, g[i, j] =HIGHBIT(a j 1 a i,b j 1 b i ), where HIGHBIT(a j 1 a i,b j 1 b i ) is the high order bit of the sum of two (j i)-bit numbers a j 1 a i and b j 1 b i. To compute p l 1 [i] for any i, we construct a quantum circuit for the quantum operation a b 0 a a 0 b 0 a n 1 b n 1 (a 0 b 0 ) (a n 1 b n 1 ).

6 Y. Takahashi and N. Kunihiro 641 Fig. 2. The CARRY 2 gate for n =8. The circuit is simply constructed using CNOT gates and a Toffoli gate with n control bits. For n input bits and one target bit, we can construct an O(n)-depth O(n)-size quantum circuit for such a Toffoli gate with a constant number of ancillary qubits [11]. Thus, the circuit for the above operation uses a constant number of ancillary qubits and its depth and size are O(n). We call the circuit the INIT-P n gate. For any i, p l 1 [i] is computed by the INIT-P 2 l 1 gate. To compute g l 1 [i] for any i, we construct a quantum circuit for the quantum operation a b 0 a b c n, where c n is the high order bit (that is, the last carry bit) of a+b. The construction is based on that of Takahashi et al. s quantum ripple-carry adder [7]. Let A i and B i denote the memory locations initially containing a i and b i, respectively. Let Z be the memory location containing 0 initially. Location A i will contain a i, B i will contain b i,andz will contain c n at the end of the computation. The circuit is defined as follows: 1. Apply a Toffoli gate to A 0 and B 0 and Z. The gate writes c 1 into Z. 2. Apply a NOT gate to B 0. The gate writes b 0 1intoB Apply a gate for computing majority [6], which consists of two CNOT gates and one Toffoli gate, to A i and B i and Z and then apply a Toffoli gate to A i and B i and A 0 for 1 i n 2. Then, apply a gate for computing majority to A n 1 and B n 1 and Z. The gates write a 0 c 1 c n 1 into A 0, a i c i into A i and b i c i into B i for 1 i n 1, and c n into Z. 4. Apply a CNOT gate to A 0 and B n i and then apply a CNOT gate to A 0 and A n i and then apply a Toffoli gate to A n i 1 and B n i 1 and A 0 for 1 i n 2. The gates write a 0 into A 0 and a i a 0 c 1 into A i and b i a 0 c 1 into B i for 2 i n 1.

7 642 A fast quantum circuit for addition with few qubits Fig. 3. The INIT-G 5 gate. 5. Apply a Toffoli gate to A 0 and B 0 and B n i and then apply a Toffoli gate to A 0 and B 0 and A n i for 1 i n 2. The gates write a i into A i and b i into B i for 2 i n Apply a NOT gate to B 0. The gate writes b 0 into B Apply a Toffoli gate to A 0 and B 0 and B 1 and then apply a Toffoli gate to A 0 and B 0 and A 1. The gates write a 1 into A 1 and b 1 into B 1. The circuit uses no ancillary qubits and its depth and size are O(n). We call the circuit the INIT-G n gate. The INIT-G 5 gate is depicted in Fig. 3. For any i, g l 1 [i] is computed by the INIT-G 2 l 1 gate. 3.3 Computation of the Sum The CARRY l gate outputs c 2 l 1 (i+1) (0 i n/2 l 1 1). Thus, we cannot obtain all s i simply. For any i, we need to construct a quantum circuit for computing s j (2 l 1 (i +1) j<2 l 1 (i + 2)). It holds that s j = a j b j d j,where { c2 l 1 (i+1) j =2 d j = l 1 (i +1), a j 1 b j 1 b j 1 d j 1 d j 1 a j 1 2 l 1 (i +1)+1 j<2 l 1 (i +2). That is, it suffices to construct a quantum circuit for the quantum operation a b c a t n 1 t 0 c, where c is a one-bit number, t j = a j b j d j (0 j n 1), and d j is redefined as { c j =0, d j = a j 1 b j 1 b j 1 d j 1 d j 1 a j 1 1 j n 1. The construction is also based on that of Takahashi et al. s quantum ripple-carry adder. Let A i and B i denote the memory locations initially containing a i and b i, respectively. Let Z be

8 Y. Takahashi and N. Kunihiro 643 Fig. 4. The SUM 5 gate. the memory location containing c initially. Location A i will contain a i, B i will contain t i, and Z will contain c at the end of the computation. The circuit is defined as follows: 1. Apply a CNOT gate to B n 1 and A i and then apply a CNOT gate to B n 1 and B i for 0 i n 2. The gates write b n 1 a i into A i and b n 1 b i into B i for 0 i n Apply a CNOT gate to Z and B n 1. The gate writes b n 1 c into B n Apply a gate for computing majority to A i and B i and B n 1 and then apply a Toffoli gate to A i and B i and Z for 0 i n 3. Then, apply a gate for computing majority to A n 2 and B n 2 and B n 1. The gates write d n 2 into Z, a i d i into A i and b i d i into B i for 0 i n 2, and b n 1 d n 1 into B n Apply a CNOT gate to Z and A n i and then apply a Toffoli gate to A n i 1 and B n i 1 and Z for 2 i n 1. The gates write c into Z and a i into A i for 1 i n Apply a CNOT gate to Z and A 0. The gate writes a 0 into A Apply a CNOT gate to A i and B i for 0 i n 1. The gate writes t i into B i for 0 i n 1. The circuit uses no ancillary qubits and its depth and size are O(n). We call the circuit the SUM n gate. The SUM 5 gate is depicted in Fig. 4. For any i, s j (2 l 1 (i+1) j<2 l 1 (i+2)) is computed by the SUM 2 l 1 gate. 3.4 The Whole Circuit We construct a quantum circuit for the quantum operation a b 0 a a + b.

9 644 A fast quantum circuit for addition with few qubits Let k be a number such that k = O(log n) andk =2 p for some p. For simplicity, we assume that n is divisible by k. We set l = p +1. Notethatl = O(log log n) and n/2 l 1 = n/k. For an n-bit number a, weconsiderak-bit number a(i) =a (i+1)k 1 a ik (0 i n/k 1). Similarly, we consider b(i) for an n-bit number b. LetA i and B i denote the memory locations initially containing a i and b i, respectively. Let Z be the memory location containing 0 initially. Location A i will contain a i, B i will contain s i, and Z will contain s n at the end of the computation. We assume that there are ancillary memory locations containing 0 initially. The first half of our circuit is defined as follows: 1. Apply the INIT-G 2 l 1 gate to memory locations containing a(i) andb(i) andtoan ancillary memory location containing 0 for 0 i n/k 1. The gate writes g l 1 [i] into the ancillary memory location for 0 i n/2 l Apply the INIT-P 2 l 1 gate to memory locations containing a(i) andb(i) andtoan ancillary memory location containing 0 for 1 i n/k 1. The gate writes p l 1 [i] into the ancillary memory location for 1 i n/2 l 1 1anda i b i into B i for k i n Apply the CARRY l gate to memory locations containing all g l 1 [i] andallp l 1 [i] and to ancillary memory locations containing 0. The gate writes c 2 l 1 (i+1) into the memory location containing g l 1 [i] for0 i n/2 l Apply the gates applied in Step 2 for implementing the INIT-P 2 l 1 gate in reverse order. The gates write 0 into the memory location containing p l 1 [i] for1 i n/2 l 1 1 and b i into B i for k i n Apply the SUM 2 l 1 gate to memory locations containing a(i +1) and b(i +1) and to a memory location containing c 2 l 1 (i+1) for 0 i n/2 l 1 2, and apply a slightly modified version of the SUM 2 l 1 gate, obtained by ignoring the memory location containing c (in the definition of the gate), to memory locations containing a(0) and b(0). The gate writes s i into B i for 0 i n 1. The remaining work is to erase c 2 l 1 (i+1) for 0 i n/2 l 1 1. This is done by Draper et al. s technique that uses the fact that the carry bits generated for computing a + s is the same as those for computing a + b, wheres is the bitwise complement of s n s 0 [8]. The last half of our circuit is defined as follows: 1. Apply a NOT gate to B i for 0 i n k 1. The gate writes s i 1intoB i for 0 i n k Apply the first half of our circuit excluding Step 5 in reverse order, where we do not apply gates that are applied to memory locations containing a(n/k 1) and b(n/k 1) in the first half since we do not erase the last carry bit. The gate writes 0 into a memory location containing c 2 l 1 (i+1) for 0 i n/2 l Apply a NOT gate to B i for 0 i n k 1. The gate writes s i into B i for 0 i n k 1.

10 Y. Takahashi and N. Kunihiro 645 Fig. 5. Our circuit for addition for n =8andk =2. The whole circuit for n =8andk = 2 (and thus l =2)isdepictedinFig.5. In what follows, we show that the circuit uses O(n/ log n) ancillary qubits and its depth and size are O(log n) ando(n), respectively. To use the INIT-G 2 l 1 and INIT-P 2 l 1 gates, we prepare a constant number of qubits representing 0 for each gate and thus all such gates require O( n/2 l 1 ) qubits. The CARRY l gate uses log n 1 t=l ( n/2 t 1) ancillary qubits. Since l = O(log log n), these numbers are O(n/ log n) and thus the whole circuit uses O(n/ log n) ancillary qubits. The depths of the INIT-G 2 l 1 and INIT-P 2 l 1 and CARRY l and SUM 2 l 1 gates are O(log n) sincel = O(log log n). Thus, the depth of the whole circuit is O(log n). The sizes of the INIT-G 2 l 1 and INIT-P 2 l 1 and SUM 2 l 1 gates are O(log n) and the numbers of these gates in the whole circuit are O(n/ log n).thesizeofthe CARRY l gate is O(n/ log n). Thus, the size of the whole circuit is O(n). To compare our circuit with Draper et al. s quantum carry-lookahead adder in detail, we compute the number of qubits, the depth, and the size more precisely. Note that we count only Toffoli gates as in [8]. For simplicity, we set k =2 log log n (and thus l = log log n +1) and assume that n is divisible by k as above. Each step in our circuit is analyzed as follows: Step 1 requires n k ancillary qubits to use n k INIT-G 2 l 1 gates. It is easy to show that the depth and size of the INIT-G n gate are 4n 4 and5n 6, respectively, where n 2.

11 646 A fast quantum circuit for addition with few qubits Thus, the depth and size in Step 1 are 4 2 l 1 4=4k O(1) and (5 2 l 1 6) n k = 5n O(n/ log n), respectively. Step 2 requires n k 1 ancillary qubits to use n k 1INIT-P 2 gates. A Toffoli gate l 1 with n control bits (on 2n + 1 qubits) is decomposed into 4n 8 Toffoli gates, where n 3 [11]. Though this decomposition uses ancillary qubits, these ancillary qubits do not have to be initialized to 0 and thus we can use idle qubits (that are not related to the INIT-P 2 l 1 gates) as such ancillary qubits. Thus, the depth and size in Step 2 are 4 2 l 1 8=4k O(1) and (4 2 l 1 8)( n k 1) = 4n O(n/ log n), respectively. A direct calculation (as in [8]) shows that the CARRY l gateinstep3uses n k O(log n) ancillary qubits and its depth and size are log n k + log n 3k + O(1) and 4n k O(log n), respectively, where n k 4. Note that the case when k = 1 corresponds to the CARRY 1 gate used in Draper et al. s quantum carry-lookahead adder. Step 4 is the same as Step 2. Step 5 uses n k SUM 2 l 1 gates. It is easy to show that the depth and size of the SUM n gate are 2n 3and3n 5, respectively, where n 2. Thus, the depth and size in Step 5are2 2 l 1 3=2k O(1) and (3 2 l 1 5) n k =3n O(n/ log n), respectively. The other steps we need to consider are the same as the above steps excluding Step 5. Thus, by summing up the values, it follows that our circuit uses 3n k O(log n) ancillary qubits and its depth and size are 26k + log n k + log n 3k + log( n k 1) + log 1 3 ( n k 1) O(1) and 29n O(n/ log n), respectively, where n k 4. Roughly speaking, for n 16, the number of ancillary qubits, the depth, and the size are 3n log n n O(log n), 30 log n O(log log n), 29n O( log n ), respectively. On the other hand, the corresponding values in Draper et al. s quantum carrylookahead adder are 2n O(log n), 4logn + O(1), 10n O(log n). That is, the number of ancillary qubits in our circuit is asymptotically less than that in Draper et al. s quantum carry-lookahead adder and the coefficient of the leading term of the expression of the number of qubits in our circuit is small. However, the depth and size of our circuit are much larger than those of Draper et al. s quantum carry-lookahead adder. In particular, the depth of our circuit is about eight times larger than that in Draper et al. s. The main reason is that our circuit uses many kinds of logarithmic-depth quantum circuits (with few qubits). 4 Application to Shor s Algorithm 4.1 Reduction of the Depth of Beauregard s Circuit Beauregard constructed an efficient quantum circuit for Shor s factoring algorithm [3]. The dominant cost is O(n 2 ) applications of (a modified version of) Draper s adder that uses

12 Y. Takahashi and N. Kunihiro 647 (approximate) quantum Fourier transforms (QFTs) [4], where n is the length of the number to be factored. The QFT-based adder performs the quantum operation b 0 a + b, where a is an n-bit classical number and we know what a is beforehand. We call the operation the ADD(a). Note that we do not prepare qubits for a since a is used only to control some gates. Since the QFT-based adder uses no ancillary qubits and its depth and size are O(n) and O(n log n), respectively, it can be shown that Beauregard s circuit uses 2n + 3 qubits and its depth and size are O(n 3 )ando(n 3 log n), respectively. When Draper et al. s quantum carry-lookahead adder computes the sum of two binary numbers, one of the numbers is used only to control some gates. Thus, we can directly use the adder in place of the QFT-based adder in Beauregard s circuit. Since the depth and size of the adder are O(log n) and O(n), respectively, the depth and size of the resulting circuit are O(n 2 log n) ando(n 3 ), respectively. We need to add O(n) qubits to Beauregard s circuit. This is because the adder requires O(n) ancillary qubits to perform the ADD(a). That is, Draper et al. s quantum carry-lookahead adder decreases the depth and size of Beauregard s circuit at the cost of adding O(n) qubits. When our circuit for addition computes the sum of two binary numbers, the numbers are not used only to control some gates. Thus, unfortunately, we cannot use our circuit in Beauregard s circuit directly. However, we show below that a modified version of our circuit decreases the depth of Beauregard s circuit as above at the cost of adding only O(n/ log n) ancillary qubits. To show this, it suffices to construct a quantum circuit for computing the sum of two n-bit binary numbers that uses O(n/ log n) ancillary qubits and its depth is O(log n), where the circuit has the property that it uses one of the numbers only to control some gates. 4.2 Modification of Our Circuit For constructing the circuit for addition described above, it suffices to modify the INIT-G n and SUM n gates since only these gates do not have the above property. The main idea is to use the QFT-based adder in place of (a modified version of) Takahashi et al. s quantum ripple-carry adder. The INIT-G n gate performs the quantum operation a b 0 a b c n. Using the QFT-based adder, we can perform the operation as follows: a b 0 a a + b = a a + b mod 2 n c n a b c n. The first arrow corresponds to the QFT-based adder for computing a+b and the second arrow to the inverse of the QFT-based adder for computing a + b mod 2 n. The modified INIT-G n gate uses no ancillary qubits. Since we need to use the exact QFT, the depth and size of the modified INIT-G n gate are O(n) ando(n 2 ), respectively.

13 648 A fast quantum circuit for addition with few qubits The SUM n gate performs the quantum operation a b c a t n 1 t 0 c. Using the QFT-based adder, we can perform the operation as follows: a b c a a + b mod 2 n c a a + b + c mod 2 n c = a t n 1 t 0 c. The first arrow corresponds to the QFT-based adder for computing a + b mod 2 n and the second arrow to a slightly modified version of the QFT-based adder for computing x+c mod 2 n for any x. The modified SUM n gate uses no ancillary qubits and its depth and size are O(n) and O(n 2 ), respectively. When we use the modified INIT-G n and SUM n gates in our circuit for addition, the resulting circuit uses O(n/ log n) ancillary qubits and its depth is O(log n). This is because the depths and the numbers of qubits in the modified INIT-G n and SUM n gates are the same as those in the original INIT-G n and SUM n gates. Moreover, since we use the QFT-based adder, the resulting circuit uses one of the numbers only to control some gates. Note that the size of the resulting circuit is O(n log n) since the number of the modified INIT-G n and SUM n gates in the resulting circuit is O(n/ log n) and each gate is O(log 2 n) in size. As described in the previous subsection, using the modified version of our circuit for addition, we can decrease the depth of Beauregard s circuit from O(n 3 )too(n 2 log n) atthe cost of adding O(n/ log n) ancillary qubits. That is, the whole circuit uses 2n + O(n/ log n) qubits. Recently, Kutin and Zalka constructed quantum circuits for modular exponentiation with depth O(n 2 ) [12, 13]. Kutin s circuit uses 3n + O(log n) qubits and thus the coefficient of the leading term is larger than that of our circuit. Zalka does not give the precise number of qubits in the circuit. 5 Conclusions and Future Work We constructed a fast quantum circuit for computing the sum of two n-bit binary numbers with few qubits. The circuit uses O(n/ log n) ancillary qubits and its depth and size are O(log n) and O(n), respectively. The circuit is useful for constructing a depth-efficient quantum circuit for Shor s factoring algorithm with few qubits. An interesting challenge would be to decrease the number of ancillary qubits without increasing the depth and size in our circuit for addition. For example, it is not known whether we can construct a logarithmic-depth linear-size quantum circuit for addition with a logarithmic-number of ancillary qubits [8]. Another challenge would be to construct an efficient quantum circuit for addition for an interesting input size, such as 1024 bits. As described in Section 4.2, our circuit can use other circuits for addition as a part of it and thus we can consider many modified versions of our circuit. How can we modify our circuit for addition in order to construct a more efficient quantum circuit for addition for an interesting input size? Acknowledgments

14 Y. Takahashi and N. Kunihiro 649 The authors thank Yasuhito Kawano, Seiichiro Tani, Yumi Nakajima, Go Kato, and the anonymous referees for their helpful comments. References 1. P. W. Shor (1994), Algorithms for quantum computation: discrete logarithms and factoring, Proc. 35th Annual IEEE Symposium on Foundations of Computer Science, pp V. Vedral, A. Barenco, and A. Ekert (1996), Quantum networks for elementary arithmetic operations, Physical Review A, Vol. 54 No. 1, pp S. Beauregard (2003), Circuit for Shor s algorithm using 2n + 3 qubits, Quantum Information and Computation, Vol. 3 No. 2, pp T. G. Draper (2000), Addition on a quantum computer, quant-ph/ P. Kaye (2004), Reversible addition circuit using one ancillary bit with application to quantum computing, quant-ph/ S. A. Cuccaro, T. G. Draper, S. A. Kutin, and D. P. Moulton (2005), A new quantum ripplecarry addition circuit, The Eighth Workshop on Quantum Information Processing. Also on quantph/ Y. Takahashi and N. Kunihiro (2005), A linear-size quantum circuit for addition with no ancillary qubits, Quantum Information and Computation, Vol. 5 No. 6, pp T. G. Draper, S. A. Kutin, E. M. Rains, and K. M. Svore (2006), A logarithmic-depth quantum carry-lookahead adder, Quantum Information and Computation, Vol. 6 No. 4&5, pp M. Fang, S. Fenner, F. Green, S. Homer, and Y. Zhang (2006), Quantum lower bounds for fanout, Quantum Information and Computation, Vol. 6 No. 1, pp M. A. Nielsen and I. L. Chuang (2000), Quantum Computation and Quantum Information, Cambridge University Press. 11. A. Barenco, C. H. Bennett, R. Cleve, D. P. DiVincenzo, N. Margolus, P. Shor, T. Sleator, J. A. Smolin, and H. Weinfurter (1995), Elementary gates for quantum computation, Physical Review A, Vol. 52 No. 5, pp S. A. Kutin (2006), Shor s algorithm on a nearest-neighbor machine, quant-ph/ C. Zalka (2006), Shor s algorithm with fewer (pure) qubits, quant-ph/