Daniel F. V. James Department of Physics University of Toronto

1/35

Daniel F. V. JamesDaniel F. V. JamesDepartment of PhysicsDepartment of PhysicsUniversity of TorontoUniversity of Toronto

Factoring Numbers with a Linear-Optics Quantum Computer

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.

DEPARTMENT OF PHYSICS UNIVERSITY OF TORONTO, 60 ST. GEORGE STREET, TORONTO, ONTARIO, CANADA M5S 1A7

2/35

• Funding:

• My Shiny Brand New Group at TorontoToronto René Stock (postdoc) Asma Al-Qasimi (Ph.D.) Hoda Hossein-Nejad (Ph.D.) Arghavan Safavi (B.Eng.)MIT Felipe Corredor (B.Eng.)Stanford Max Kaznadiy (B.Sc.) Ardavan Darabi (B.Sc.) Rebecca Nie (B.Sc.)

• Collaborators:Prof. Rainer Blatt (Innsbruck)Prof. Andrew White (Queensland)Prof. Paul Kwiat (Illinois)Prof. Emil Wolf (Rochester)



3/35



NMR

Trapped Ions

Neutral Atoms

Photons

Solid State

Superconductors

Cavity QED

1. S

cala

ble

qubi

ts

2. In

itial

izat

ion

3. C

oher

ence

4. Q

uant

um G

ates

5. M

easu

rem

ent

Theoretical possibility

Experimental reality

No known approach

Whither Quantum Computing?Roadmap Traffic-Light Diagram(Apr 2004) -updated

Clock states, DFS

SET detectors(> 80%)

QLD, APL gates

NMR Algorithmic cooling

Entanglement at UCSB

NIST gates

4/35

What can we do with them?• Neat experiments like teleportation, Bell’s inequalities,...

• Scalability: more qubits and logic gates, larger scale entanglement, connections between remote nodes, speed.

• Find a signal, then maximize it: do Shor’s algorithm for simplified, small scale cases, then progressively improve it.

• Other applications quantum simulations, QKD repeaters,...



• Outline:1. RSA Encryption and Factoring2. Simplifications for a Few Qubits3. Linear Optics Quantum Computing (LOQC)4. Factoring 15 with LOQC5. Where next and conclusions

5/35

Alice

Bob

1. RSA* Encryption and Factoring



*Rivest, Shamir & Adelman, 1978; (also Clifford Cocks, 1973).

• select two prime numbers: p,q

• calculate: n = p.q; = (p-1).(q-1)

• select e, with GCD(e,) = 1

• calculate d, with e.d = 1 mod public key: n,e

• Message: M

• calculate: E = Me mod n

encrypted message, E

• calculate: Ed mod n = M mod n

• Easy to find the message if you know p and q

• Security relies on difficulty of factoring n

Message M

6/35

• Example: n = 77; c = 8;

0

20

40

60

80

0 10 20 30 40a

f n,c(x

)

x

• The function fn,c(x) = cx mod n , is periodic, (period r). • Either or is a factor of n.

€

GCD cr / 2 −1,n( )

€

GCD cr / 2 +1,n( )

• Chose a number, c, which is coprime with n i.e. GCD(c,n) =1

GCD 85 +1,77( )=11

GCD 85 −1,77( ) =7

From data, r = 10;

Period Finding Factoring

Factoring Numbers*



*P. Shor, Proc. 35th Ann. Symp. Found. Comp. Sci. 124-134 (1994);also: Preskill et al., Phys Rev A 54, 1034 (1996).

7/35

Large number of evaluations are replaced by one

Quantum Factoring

€

then you can do this : ˆ U f x 0x∑ ⎛

⎝ ⎜

⎞

⎠ ⎟= x fN ,C x( )

x∑

• Classical factoring: evaluate fn,c(x) for a large number of

values of x until you can find r.

€

if you can do this : ˆ U f x 0 = x fN ,C x( )

• Quantum parallelism:



i.e. the state of multiple qubits corresponding to x; e.g.if x=29, ⏐x =⟩ ⏐11101⟩

8/35

€

φ x( ) =1

2L / 2fN ,C y( ) exp i

2π

2Lx.y

⎛

⎝ ⎜

⎞

⎠ ⎟

y =0

2 L -1

∑

Quantum Factoring (cont.)• Quantum Fourier Transform to argument register:

€

UQFT ⊗ I( ) x fN ,C x( )x∑ = x φ x( )

x∑

• If 2L/r=M, number of periods in the argument register:

€

φ x( ) = M ϕ s if x = sM s = 0,1,2....r −1( )

0 otherwise

⎧ ⎨ ⎩

0 T 2T

Periodic Function

... 0 1/T 2/T 3/T ...

Fourier Transform

9/35



Quantum Factoring (cont., again)

€

x φ x( )x∑ = s2L /r ϕ s

s =0

r-1∑

• Thus the state after the QFT is:

• Discard the function register: the argument register is in a mixed state:

€

ρ final = s2L r s2L rs =0

r-1∑

• Measurement of the function register yields, with high probability a number which is a multiple of N/r; extracting r, you can find the factors.

10/35

modular exponentiation Fourier trans.initiation

Circuit Diagram

argument

function

€

x 0x=0

2 L-1∑

€

x fN ,C x( )x=0

2 L-1∑€

C20

€

C21

€

C2L−1

....

QFT

€

sN /r ϕ ss =0

r-1∑

readout



11/35

RSA cryptosystem:

• polynomial work to encrypt/decrypt

• exponential work to break = factoring

• BUT quantum factoring is only polynomial work

27997833911221327870829467638722601621070446786955428537560009929326128400107609345671052955360856061822351910951365788637105954482006576775098580557613579098734950144178863178946295187237869221823983

RSA 200:3532461934402770121272604978198464368671197400197625023649303468776121253679423200058547956528088349

7925869954478333033347085841480059687737975857364219960734330341455767872818152135381409304740185467

x=

Vulnerability of RSA to Quantum Computers?



RSA200

0 200 400 600 800 10001

10

100

10001 10

41 10

51 10

61 10

71 10

81 10

91 10

101 10

111 10

121 10

131 10

141 10

151 10

161 10

171 10

181 10

191 10

201 10

211 10

221 10

231 10

24

Classical ~ exp{AL}# of instructions

# of bits, L, factored

~ 1020 instructions: 16 months (2003-05)

Shors Algorithm~ L3

~ 1012 operations:Hours ?

12/35



2. Simplifications for a Few QubitsN=15, C=4

x fN,C(x)

0 1

1 4

2 1

3 4

i.e. period 2

N=15, C=2

x fN,C(x)

0 1

1 2

2 4

3 8

4 1

i.e. period 4

13/35



Simplifications for a Few QubitsN=15, C=4

x fN,C(x)

00 001

01 100

10 001

11 100

i.e. period 2

N=15, C=2

x fN,C(x)

000 0001

001 0010

010 0100

011 1000

100 0001

i.e. period 4

this is too profligate with qubits....

14/35



Simplifications for a Few QubitsN=15, C=4

x LogC[fN,C(x)]

00 00

01 01

10 00

11 01

i.e. period 2

N=15, C=2

x LogC[fN,C(x)]

000 00

001 01

010 10

011 11

100 00

i.e. period 4

15/35

cancel



Minimalist Period 2 Circuit

X

QFT

Z

• Top rail cancellation occurs for all r =2n.• Two qubits, one quantum gate

x LogC[fN,C(x)]

00 00

01 01

10 00

11 01

16/35

XX

X



Slightly Less Minimalist Period 2 Circuitwithout Logarithm of fN,C(x)

• Three qubits, two gates.

17/35

X

X

What about Period 4?

QFT

Z

Z

T

€

T =exp iπ /8[ ] 0

0 exp −iπ /8[ ]

⎛

⎝ ⎜

⎞

⎠ ⎟

x LogC[fN,C(x)]

000 00

001 01

010 10

011 11

100 00

18/35

X

X

What about Period 4?

Z

• 4 qubits, 2 quantum gates

x LogC[fN,C(x)]

000 00

001 01

010 10

011 11

100 00

Z

19/35

Measurement-induced nonlinearity*

* Knill, Laflamme & Milburn (“KLM”) , Nature 409, 46 (2001)

•••

•••QUBITSQUBITSaa

LINEAROPTICAL

NETWORK

•••

•••

SINGLEPHOTONS

FAST FEEDFORWARDSINGLE PHOTON

DETECTION



3. Linear Optics Quantum Computing

20/35

XZ|C⟩XZ|T⟩BXZ|φ⟩|φ⟩|CNOT⟩-NONDETERMIN

GATEB

• Non-deterministic gates• Don’t always work, but heralded when they do

• Many non-deterministic gates proposed …

• Teleport non-deterministic gates deterministic

NON-DETERMIN

GATE

•••

•••QUBITSQUBITS•••

•••

SINGLEPHOTONSSINGLE PHOTON

DETECTION&

FEEDFORWARD

• Teleportation: moving information without measuring it



Linear Optics Quantum Computing (cont.)

21/35

+ teleportation+ error correction= scalable QC

Internal ancillas

• Simplified 2-photonRalph, Langford, Bell, & White,PRA 65, 062324 (2002)

• Simplified 2-photon Hofmann & Takeuchi,PRA 66, 024308 (2002)

• Linear-optical QNDKok, Lee & Dowling, PRA 66, 063814 (2002)

External ancillasNON-

DETERMINGATE

QNDQND

Gasparoni et al., PRL 93, 020504 (2004)

Pittman et al., PRA 68, 032316 (2004)Walther et al., Nature 434, 169 (2005)

• KLM 4-photonKnill, Laflamme, & Milburn,Nature 409, 46 (2001)

• Entangled ancilla 4-photon Pittman, Jacobs, and Franson,PRL 88, 257902 (2002)

• Simplified 4-photon Ralph, White, Munro, & Milburn,PRA 65, 012314 (2001)

• Efficient 4-photon Knill, PRA 66, 052306 (2002)

• Entangled input 2-photon Pittman, Jacobs, and Franson,PRL 88, 257902 (2002)

NON-DETERMIN

GATE

Proposed Entangling Gates

22/35

C0

C1

T0

T1

C0

C1

T0

T1

phaseshift

CSIGN gate



Two Qubit Gate*

DEPARTMENT OF PHYSICS,UNIVERSITY OF QUEENSLAND

€

00

control qubit

€

⎧⎨⎩

€

⎧⎨⎩

target qubit

*Ralph, Langford, Bell & White, PRA 65, 062324 (2002)

23/35

C0C1T0T1-1/3

1/3

1/3

CSIGN gate



Two Qubit Gate*


€

00

€

+ 83 ϕ⊥

€

→ 13 00


control qubit

€

⎧⎨⎩

€

⎧⎨⎩

target qubit

24/35

both transmittedboth reflected

C0C1T0T1-1/3

1/3

1/3

CSIGN gate




Two Qubit Gate*


€

10

€

→ 13 − 1− 1

3( ){ } 00

€

→ −13 00

€

+ 83 ′ ϕ ⊥

Non-deterministicCSIGN gate with probability 1/9

25/35

C0C1T0T1HWPHWP

-1/3

1/3

1/3

Control in Control out

Target in Target out

C0C1T0T1HWPHWP

CNOT gate



Interferometric Gate*



26/35

C

T

Non-classical interferenceRH = 1/3

RV = 1

C0C1T0T1HWPHWP




Interferometric Gate*


27/35

C

T

Non-classical interference

No dual-path interferometers

No adjustment if wrong splitting ratio

RH = 1/3

RV = 1

C0C1T0T1HWPHWP

Langford, Weinhold, Prevedel, Pryde, O’Brien, Gilchrist and White, PRL 95, 210504 (2005)



Beam-splitter Gate*


28/35



*Pryde, O’Brien, Gilchrist, James, Langford, Ralph, and White, PRL 93 080502 (2004); Langford, et al., PRL 95, 210504 (2005)

Ideal Measured

average gate fidelity:

1 gate works 90-95% of time; 2 gates should work 80-90% of time

Process Tomography of a Quantum Gate*


= 94 ± 2 %

29/35



*Lanyon, Weinhold, Langford, Barbieri, James, Gilchrist, and White, PRL 99, 250505 (2007)DEPARTMENT OF PHYSICS,

UNIVERSITY OF QUEENSLAND

4-photonsource

4. Factoring Experiment*

30/35

GCD of Cr/2±1 and NGCD of 41±1 and 15 = 3,5

P110 = 27 ± 2%

order-2 order-4

F = 99.9 ± 0.3%SL= 99.9 ± 0.6% F = 98.5 ± 0.6%

SL= 98.1 ± 0.8%

P000 = 27 ± 2%P100 = 24 ± 2%

GCD of Cr/2±1 and NGCD of 41±1 and 15 = 3,5

r=2

add redundantbit then reverseargument bits

P10 = 48 ± 3%

P00 = 52 ± 3% failure

r=6

GCD of 43±1 and 15 = 3,5

r=2

P010 = 23 ± 2%

algorithm works near perfectly …?

Order-finding algortihm uses mixed output state: non-deterministic



Measuring the output


31/35

order-2

order-4

FGHZ = 59 ± 4%WGHZ = 9 ± 4%

SL= 62 ± 4%

F2Bell = 98.5 ± 0.6%=

Tbd = 41 ± 5%Tce = 33 ± 5%

SL= 98.1 ± 0.8%

joint state of argumentand function registersis entangled & mixed

joint state of argumentand function registersis highly entangled

independent photons

dependent photonsQuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.


Measuring the output


32/35

x LogC[fN,C(x)]

0 0

1 1

2 2

3 0

4 1

5 2

i.e. period 3

5. Where next: Period 3?



N=21, C=4x LogC[fN,C(x)]

000 00

001 01

010 10

011 00

100 01

101 10

i.e. period 3

After modular exponentiation, a three qubit argument register plus two qubit function register will be in the state:⏐⟩= ⏐⟩⏐⟩⏐⟩⊗⏐⟩⏐⏐⟩⏐⟩⏐⟩⊗⏐⟩⏐⏐⟩⏐⟩⊗⏐⟩

33/35

A bit less scary...



• Can we make this state using established techniques for making W states and GHZ states?

where: ⏐⟩⏐⟩⏐⟩√

⏐⟩⏐⟩⏐⟩⏐⟩√

⏐⟩⏐⟩⏐⟩⏐⟩√

flip qubit #2:⏐⟩= ( ⏐⟩⊗⏐⟩⏐⟩⊗⏐⟩⏐⟩⊗⏐⟩

€

18

€

3

€

3

€

2

34/35

€

3 00 + 3 01 + 2 10 GHZ W W

Period 3 Circuit



H

X

X

X

Ry()

• 5 qubits, 8 gates + QFT (still pretty scary)• Period is not a power of 2; full QFT needed.• Size of the argument register will not be a factor of the period.

QFTXX

X

X

X

H

R(

35/35

Conclusions



• Simplified versions of Shor’s Algorithm are accessible with today’s quantum technology technology.

• Improving these results, step-by-step, is as good a route to practical quantum computers.

• Complexity of quantum circuit depends on period r, rather than size of number.

36/35



BUT....• Unless you get real lucky, N is not a multiple of r

• How actually do you implement the unitary operations for modular exponentiation and quantum Fourier transform?

- you can fix this using bigger registers, so the ‘periodic’ signal swamps the rest.

- both can be done efficiently (i.e. in a polynomial number of operations)

- break down complicated operations into simpler operations (e.g. multiplexed adders and repeated squaring), which can be performed by CNOTs and related multi-qubit quantum gates.

- QFT can be simplified by dropping some operations, and by doing it ‘semi-classically’ by measurement and feed-forward*

*R. B.Griffiths and C.-S. Niu Phys. Rev. Lett. 76 3228 (1996).

37/35

€

φ x( ) =1

2L / 2fN ,C y( ) exp i

2π

2Lx.y

⎛

⎝ ⎜

⎞

⎠ ⎟

y =0

2 L -1

∑

Quantum Factoring (cont.)• Quantum Fourier Transform to argument register:

€

UQFT ⊗ I( ) x fN ,C x( )x∑ = x φ x( )

x∑

• Assume that 2L=Mr (i.e. the size of the argument register is equal to a multiple of the unknown period, r):

€

φ x( ) = M ϕ s if x = sM s = 0,1,2....r −1( )

0 otherwise

⎧ ⎨ ⎩

€

ϕ s = 1r

fN ,C y( ) exp 2πis.y /r( )y =0

r-1∑ ϕs ϕ t =δst

where:

38/35

• Process tomography: measure combinations of basis processes

|0⟩|H⟩

|0+1⟩|D⟩

|0+i1⟩|R⟩

• State tomography: measure combinations of basis states

I X Y Z

n qubit gate requires 24n measurements

n qubit state requires 22n measurements

rotations on Poincare sphere

• Reconstructed states and processes are unphysical: effect of uncertainties Maximum likelihood or Bayesian analysis required

0 1 0 + 1 0 + i1H V D R

for 2 photon states, bi-photon Stokes parameters

I II XI YI Z

X IXXXYXZ

Y IYXYYYZ

Z IZXZYZR

HHHVHDHR

VHVVVDVR

DHDVDDDR

RHRVRDRR



*James, Kwiat, Munro and White, PRA 64, 030302 (2001)

Quantum Tomography*


39/35

4-photonsource



*Lanyon, Weinhold, Langford, Barbieri, James, Gilchrist, and White, PRL 99, 250505 (2007)

Factoring Circuits*


40/35

* order-2order-2 order-4



Factoring Circuits*

*Lanyon, Weinhold, Langford, Barbieri, James, Gilchrist, and White, PRL 99, 250505 (2007)


41/35

* order-2 order-4order-2 order-4



Factoring Circuits


42/35

Process and state tomography require 24n and 22n measurements:impractical for large circuits

Correlation measurements between registers require only 2n measurements:. logical measurement of argument register, Mij

Output state is: After logical measurement of argument register, function register is

order-2 order-4

{P01,P10} = {83 ± 4%, 59 ± 5%}{P00,P01,P10,P11} ={87 ± 3%, 84 ± 4%, 82 ± 5%, 67 ± 6%}

argument and function registers are highly correlatedQuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.


Circuit outputs


Documents

Daniel F. V. James Department of Physics University of Toronto