Introduction to Quantum Information Processing CS 467 / CS 667 Phys 667 / Phys 767 C&O 481 / C&O 681

Transcription

1 Introduction to Quantum Information Processing CS 467 / CS 667 Phys 667 / Phys 767 C&O 48 / C&O 68 Lecture (2) Richard Cleve DC 27 cleve@cs.uwaterloo.ca

2 Order-finding via eigenvalue estimation 2

3 Order-finding problem Let M be an m-bit integer Def: Z * M = {x {,2,, M - } : gcd(x,m ) = } (a group) Def: ord M (a) is the minimum r > such that a r = (mod M ) Order-finding problem: given a and M, find ord M (a) Example: Z * 2 = {,2,4,5,8,,,3,6,7,9,2} The powers of are:,, 6, 3, 4, 9,,, 6, Therefore, ord () = 6 2 Note: no classical polynomial-time algorithm is known for this problem 3

4 Order-finding algorithm () Define: U (an operation on m qubits) as: U y = a y mod M Define: ψ = r e 2πi ( / r ) a mod M Then U ψ r = e 2πi ( / r ) a + mod M r = e ( / r ) 2πi( / r )( + ) e a 2 πi + mod M = e 2πi ( / r) ψ 4

5 Order-finding algorithm (2) U 2n qubits n qubits corresponds to the mapping: x y à x a x y mod M Moreover, this mapping can be implemented with roughly O(n 2 ) gates The phase estimation algorithm yields a 2n-bit estimate of /r From this, a good estimate of r can be calculated by taking the reciprocal, and rounding off to the nearest integer Exercise: why are 2n bits necessary and sufficient for this? Problem: how do we construct state ψ to begin with? 5

6 Let Bypassing the need for ψ () ψ ψ ψ ψ = r r = 2 k r = = r r e e e e 2πi 2πi 2πi 2πi ( / r ) ( 2/ r ) ( k / r ) ( r / r ) a a a a mod M mod M mod M mod M Any one of these could be used in the previous procedure, to yield an estimate of k/r, from which r can be extracted What if k is chosen randomly and kept secret? 6

7 Bypassing the need for ψ (2) What if k is chosen randomly and kept secret? Can still uniquely determine k and r, from a 2m-bit estimate of k/r, provided they have no common factors, using the continued fractions algorithm* Note: If k and r have a common factor, it is impossible because, for example, 2/3 and 7/5 are indistinguishable So this is fine as long as k and r are relatively prime * For a discussion of the continued fractions algorithm, please see Appendix A4.4 in [Nielsen & Chuang] 7

8 Bypassing the need for ψ (3) What is the probability that k and r are relatively prime? Recall that k is randomly chosen from {,,r} The probability that this occurs is φ(r)/ r, where φ is Euler s totient function It is known that φ(r) = Ω(r/ loglogr), which implies that the above probability is at least Ω(/ loglog r) = Ω(/ log m) Therefore, the success probability is at least Ω(/ log m) Is this good enough? Yes, because it means that the success probability can be amplified to any constant < by repeating O(log m) times (so still polynomial in m) But we still need to generate a random ψ k here 8

9 Bypassing the need for ψ (4) Returning to the phase estimation problem, suppose that ψ and ψ 2 have respective eigenvalues e 2πiφ and e 2πiφ 2, and that α ψ + α 2 ψ 2 is used in place of an eigenvector: F M α ψ + α 2 ψ 2 U What will the outcome be? It will be an estimate of φ with probability α 2 φ 2 with probability α 2 2 (Showing this is left as an exercise) 9

10 Bypassing the need for ψ (5) Along similar lines, the state yields results equivalent to choosing a ψ k at random r r ψ k k = r Is it hard to construct the state ψ k? In fact, this is something that is easy, since r r r 2πi( k / r ) ψ k = e a mod M = r r k= k= r k = This is how the previous requirement for ψ is bypassed

11 Quantum algorithm for order-finding U a,m inverse QFT U a,m y = a y mod M measure these qubits and apply continued fractions algorithm to determine a quotient, whose denominator divides r Number of gates for Ω(/ log m) success probability is: O(m 2 log m loglog m) For constant success probability, repeat O(/ log m) times and take the smallest resulting r such that a r = (mod M )

12 Reduction from factoring to order-finding 2

13 The integer factorization problem Input: M (n-bit integer; we can assume it is composite) Output: p, q (each greater than ) such that pq = N Note : no efficient (polynomial-time) classical algorithm is known for this problem Note 2: given any efficient algorithm for the above, we can recursively apply it to fully factor M into primes* efficiently * A polynomial-time classical algorithm for primality testing exists 3

14 Factoring prime-powers There is a straightforward classical algorithm for factoring numbers of the form M = p k, for some prime p What is this algorithm? Therefore, the interesting remaining case is where M has at least two distinct prime factors 4

15 Numbers other than prime-powers Proposed quantum algorithm (repeatedly do):. randomly choose a {2, 3,, M } 2. compute g = gcd(a,m ) 3. if g > then output g, M/g else compute r = ord M (a) (quantum part) if r is even then compute x = a r /2 mod M compute h = gcd(x,m ) if h > then output h, M/h Analysis: we have M a r so M (a r /2 +)(a r /2 -) thus, either M a r /2 + or gcd(a r /2 +,M ) is a nontrivial factor of M It can be shown that at least half of the a {2, 3,, M } are have order even and result in gcd(a r /2 +,M ) being a nontrivial factor of M 5