Shor's algorithm

Shor's algorithm is a quantum algorithm for finding the prime factors of an integer. It was developed in 1994 by the American mathematician Peter Shor.^[1][2] It is one of the few known quantum algorithms with compelling potential applications and strong evidence of superpolynomial speedup compared to best known classical (non-quantum) algorithms.^[3] On the other hand, factoring numbers of practical significance requires far more qubits than available in the near future.^[4] Another concern is that noise in quantum circuits may undermine results,^[5] requiring additional qubits for quantum error correction.

Shor proposed multiple similar algorithms for solving the factoring problem, the discrete logarithm problem, and the period-finding problem. "Shor's algorithm" usually refers to the factoring algorithm, but may refer to any of the three algorithms. The discrete logarithm algorithm and the factoring algorithm are instances of the period-finding algorithm, and all three are instances of the hidden subgroup problem.

On a quantum computer, to factor an integer ${\displaystyle N}$, Shor's algorithm runs in polynomial time, meaning the time taken is polynomial in ${\displaystyle \log N}$.^[6] It takes quantum gates of order ${\displaystyle O\!\left((\log N)^{2}(\log \log N)(\log \log \log N)\right)}$ using fast multiplication,^[7] or even ${\displaystyle O\!\left((\log N)^{2}(\log \log N)\right)}$ utilizing the asymptotically fastest multiplication algorithm currently known due to Harvey and Van Der Hoven,^[8] thus demonstrating that the integer factorization problem can be efficiently solved on a quantum computer and is consequently in the complexity class BQP. This is significantly faster than the most efficient known classical factoring algorithm, the general number field sieve, which works in sub-exponential time: ${\displaystyle O\!\left(e^{1.9(\log N)^{1/3}(\log \log N)^{2/3}}\right)}$.^[9]