The statement of the problem of factoring integer is as follows: Given an integer N, find prime numbers p i and integers e i such that.

Transcription

1 CS Sho s Factoing Algoithm 0/5/04 Fall 2004 Lectue 9 Intoduction Now that we have talked about uantum Fouie Tansfoms and discussed some of thei popeties, let us see an application aea fo these ideas. We will talk about Sho s algoithm fo finding pime factos of lage integes. The statement of the poblem of factoing intege is as follows: Given an intege N, find pime numbes p i and integes e i such that N = p e pe pe k k Let us make two simplifications of the poblem without loosing geneality: Fistly, given N, it is enough to split it into integes N and N 2 such that N = N N 2. It is easy to see that afte a linea numbe (in size of the input, i.e. logn) of such steps, we ae guaanteed to each pime factos. Secondly, assume that N is a poduct of two pimes, N = p q, whee p,q P. Classically, naive algoithm fo the factoing poblem woks in time O( N). The fastest known algoithm fo this poblem is Field Sieve algoithm that woks in time 2 O( 3 logn). In fact, Sho showed that we can do bette with quantum compute. Theoem 9.: Thee exists quantum algoithm that solves the factoing poblem with bounded eo pobability in polynomial time. The est of the pape is a poof of this theoem. Specifically, the factoing poblem tuns out to be equivalent to the ode-finding poblem (defined below), because fom a fast algoithm fo ode-finding poblem we can get a fast algoithm fo factoing poblem. The section 2 shows the eduction of factoing to ode-finding and the section 3 shows a fast quantum algoithm fo ode-finding. 2 The eduction of factoing to ode-finding Recall that the numbes {x mod N : gcd(x,n) = } foms a goup unde multiplication modulo N. Given x and N such that gcd(x,n) = let od(x) denote the minimum positive such that x (mod N). The ode finding poblem is to find od(x). The eduction of factoing to ode-finding follows fom Lemma 9. and Lemma 9.3. Lemma 9.: Given a composite numbe N and x, s.t. x is a nontivial squae oot of ove N (that is, x 2 (mod N), and neithe x (mod N) no x (mod N)), we can efficiently compute a nontivial facto of N. Poof:Fom x 2 (mod N) follows that x 2 (x ) (x + ) 0(mod N). Since neithe x (mod N) no x (mod N) we know that < x < N, so one of gcd(x,n) and gcd(x+,n) is a nontivial facto of N. Since thee exist a fast algoithm fo computing gcd (Euclid s algoithm), the efficiency easy follows. Example: Let N = 5. Then 4 2 (mod N) and 4 ±(mod N). Both gcd(4,5) = 3 and gcd(4+,5) = 5 ae nontivial factos of 5. Lemma 9.2: Let p be an odd pime and let x be unifomly andom element s.t. 0 x < p. Then od(x) is even with pobability at least one-half. Poof:By Femat s little theoem we know that fo evey x : x p (mod p). It is well known that multiplicative goup modulo pime numbe is a cyclic goup, that means, thee is an element g which geneates all elements of goup CS 294-2, Fall 2004, Lectue 9

2 in the sense that any element can be witten x g k (mod p) fo some k. Since x is chosen unifomly at andom, k is odd with pobability one-half. Futhe assume that k is odd. Since x g k (mod p) it tuns out that x od(x) g k od(x) (mod p). Now we can deduce that p k od(x). Since p is odd, p is even, and k is odd, od(x) has to be even. Lemma 9.3: Let N = p q, p,q P is composite odd numbe and x is taken unifomly at andom fom 0..N. If gcd(x,n) = then with pobability at least 3 8 od(x) = is even and x 2 ±(mod N). Poof: By the Chinese emainde theoem, choosing x unifomly at andom fom 0..N is the same as choosing x unifomly at andom fom 0..p and independently x 2 unifomly at andom fom 0..q. Ode fo those numbes also ae elated. Let = od(x ) and 2 = od(x 2 ). It is easy to see that both and 2. Fistly, let us pove that the pobability that is even is at least 3/4. Since N is odd, p and q ae odd pimes. Thus is even when x is odd and 2 is even when x 2 is odd. Since is even when eithe is even o 2 is even, and x and x 2 ae chosen unifomly at andom, the pobability that is even is at least 3/4 fom Lemma 2. Secondly, let us pove that the pobability that x 2 ±(mod N) is at most one-half when is even. Note that x (mod p) and x (mod p) and thee ae only two squae oots of modulo pime numbe, namely ±. By Chinese eminde theoem it follows that thee ae only fou oots of modulo N. Only two of them makes x 2 ±(mod N). It is easy to see fom Lemma 9. and Lemma 9.3 that if someone computs od() function fo us, we can find pime factos of N classicaly. By checking answe (easy can be done efficiently) and epeating seveal times we can incease the pobability of success. 3 Sho s ode-finding algoithm How do we efficiently find od(x) =? Hee is how Sho s quantum algoithm does it. The next subsection will descibe algoithm and will analyze it in a simplified case. 3. The simplified case Let be sufficiently lage, s.t. N 2. Let us assume now that. Case whee algoithm is simila, just analysis is somewhat moe complicate. The algoithm uses two egistes: egiste stoes a numbe mod = 2 q, egiste 2 stoes a numbe mod N, and has seveal steps.. The egistes ae initially in the state On applying the Fouie Tansfom modulo to egiste we get the state a 0 a=0 3. Conside f(a) = x a mod N, a function that is easy to compute classically (can be computed in loga multiplications using epeated squaing, x 2 = x x, x 4 = x 2 x 2, x 8 = x 4 x 4,...), and has as its smallest peiod. Figue CS 294-2, Fall 2004, Lectue 9 2

3 shows such a function gaphically. Note that f is distinct on [0, ] since othewise it would have a smalle peiod. Applying function f to the contents of egiste and stoing the esult in egiste 2, we get a f(a) a=0 4. Now we measue the second egiste. When we measue, we must get some value; let it be f(l), whee l is unifomly andom ove 0... Then all supeposed states inconsistent with the measued value must disappea. So, the state of the two egistes must be given by j+ l f(l) 5. Thus we have set up a peiodic supeposition of peiod in egiste. Now we can dop the second egiste. The fist egiste has a peiodic supeposition whose peiod is the value we wanted to compute in the fist place. How do we get that peiod? Can we get anywhee by measuing the fist egiste? It s no good, because all we will get is a andom point, with no coelation acoss independent tials (because l is andom). Hee s what Sho s algoithm does next. 0 2 Figue : Function with smallest peiod Fouie sample modulo : Since the next step is Fouie sampling, we can dop the shift value l by the popeties of Fouie Tansfoms discussed in the pevious lectue. This allows move l to phase. Applying the Fouie sample to state gives us whee ω is a pimitive qth oot of unity, j+ l ω kl k k=0 ω = e 2πi. 6. Let us measue egiste. The measuement gives us k, whee k is andom vaiable unifomly fom It is easy to see that with big pobability gcd(k, ) =. If so, then by computing gcd(k,) we get. Since we know, fom it is staightfowad to compute. CS 294-2, Fall 2004, Lectue 9 3

4 3.2 The geneal case In the pevious lectue we made assumption that. It is vey stong assumption because we do not know any algoithm fo computing such given x. Now we will show that the algoithm woks coectly with constant pobability even if. Now, in the 4th step, afte applying the fist measuement, we get state j+ l This is no longe a coset of a subgoup, so ealie easoning does not apply. Nevetheless, we will take a Fouie tansfom anyway, and we will show that we get constuctive intefeence pimaily at the points close to multiples of. In fact, we will be close enough to essentially ound to the neaest multiple, and this will allow us to calculate with some easonable pobability. Applying a Fouie tansfom to the expession above, we get whee α l l, l=0 α l = (ω l ) j. Notice that if l mod is small, then tems in the sum cove only a small angle in the complex plane, and hence, the magnitude of the sum is almost the sum of the magnitudes. Next lemmas makes it pecise. Lemma 9.4: If 2 l mod 2 fo some l then α l 2 2/3. Poof: Let This stands fo a vecto on the complex plane. The sum is a geometic seies with common atio β. β = e 2πil j = ω l. β j Since 2 l mod 2, the tems of the seies fan out less than o equal to an angle π on the complex plane. This happens when β makes a small angle with the eal line. Then as shown in Figue 2 half of the tems in the above seies make an angle less than o equal to 4 π with the esultant of the vecto addition of the tems in the seies. Then each such tem contibutes a faction at least cos π 4 = 2 of its length to the esultant vecto. So the magnitude of the esultant is at least 2 2 = 2 3/2 CS 294-2, Fall 2004, Lectue 9 4

5 esultant vecto Figue 2: β makes small angle with eal line Lemma 9.5: 2 l mod 2 with pobability Θ(). Poof: If gcd(,) = then mod exists. Thus as l vaies in the ange [0, ], l must take values foming a pemutation of {0,,2,... }. Thus, as Figue 3 shows, at least values of l lie in the ange [ /2,/2]. /2 0 /2 Figue 3: At least values of l satisfy the constaint If gcd(,), then l mod is distibuted as shown in Figue 4. In this case, at least /2 values of l lie in a ange [ /2, /2] of size. 3gcd(,)... 2gcd(,) gcd(,) /2 0 /2 Figue 4: At least /2 values of l satisfy the constaint in the wost case Thus, in any case, at least /2 values of l satisfy the condition 2 l mod 2 Fom Lemma 9.4 each of them has amplitude at least 2 3/2 /2 CS 294-2, Fall 2004, Lectue 9 5

6 Thus the pobability of sampling such an l is at least 2 ( 2 3/2 /2 )2 6 So with pobability moe than 6 we will sample an l such that 2 l mod 2. So with pobability moe than 6 we will sample an l such that i.e. 2 l mod 2 fo some intege k; equivalently, l k 2 l k 2 l Thus, is an 2 -appoximation of the ational k. We can measue l, and we know. The atio l, when educed to lowest tems, leads to a ational a b, say, which is a 2 -good appoximation to k. Since k is andomly chosen fom the ange [0, ], with pobability at least logk, k and ae co-pime. Thus by computing k we can compute as well. This suggests a way to make a good appoximation, by simply choosing to be much lage than N. How much lage than N does need to be, fo us to evaluate accuately? The answe is given by Lemma 9.7 using continued factions in the next subsection. We just compute continued factions until pecision is at least 2. Assume, that the appoximation is some ational numbe k. If = then we succeed othewise k k N 2. It is contadiction because both k and k is 2 2N 2 close to a b. Theefoe =. 3.3 Continued Factions The idea of continued factions is to appoximate eal numbes using finite numbe of integes. Definition 9. (Continued Factions): A eal numbe α can be appoximated by a set of positive integes a 0, a,..., a n as CF n (α) = a 0 + a + = P n a 2 + n, whee P n and n ae integes. + an CS 294-2, Fall 2004, Lectue 9 6

7 Example: Let us ty to appoximate π to the fist two decimal places with a ational numbe. We know that π = = = = = 22 7 If we decided to appoximate π to fou decimal places, we would have π = = = = 3+ = 3+ = = 3 99 The following two lemmas ae well known facts about continued factions that we will leave without a poof. Lemma 9.6: CF n (α) is the best ational appoximation of α with denominato n. Lemma 9.7: If α is ational then it occus as one of the appoximations CF n (α). Moeove, it is easy to see that continued factions ae easy to compute fo any ational numbe. CS 294-2, Fall 2004, Lectue 9 7