Shor's Algorithm Simulator: Quantum Integer Factoring Explained

simulator intermediate ~10 min
Loading simulation...
15 = 3 × 5 — factored via period r = 4

Shor's algorithm factors 15 by finding the period r=4 of 7^x mod 15 using a quantum Fourier transform, then extracting factors via gcd: 15 = 3 × 5.

Formula

a^r ≡ 1 (mod N) → period r via QFT
gcd(a^{r/2} ± 1, N) yields non-trivial factors
Complexity: O(n³) quantum vs O(exp(n^{1/3})) classical

The Problem That Launched a Revolution

In 1994, mathematician Peter Shor showed that a quantum computer could factor integers exponentially faster than any known classical algorithm. This single result transformed quantum computing from a theoretical curiosity into an urgent national security concern, because RSA encryption — the backbone of internet security — relies entirely on the difficulty of factoring large numbers. Shor's algorithm remains the most compelling evidence that quantum computers can solve important problems beyond classical reach.

From Factoring to Period-Finding

Shor's key insight was that factoring reduces to finding the period of modular exponentiation. Given N to factor, choose random a and find the smallest r such that a^r ≡ 1 (mod N). If r is even, then a^{r/2} ± 1 share non-trivial factors with N. The quantum part only needs to find this period r — everything else is classical. The reduction from factoring to period-finding was known classically; the quantum breakthrough was making period-finding efficient.

Quantum Fourier Transform

The heart of Shor's algorithm is the quantum Fourier transform (QFT), which maps computational basis states to frequency space. After preparing a superposition of a^x mod N for all x simultaneously (quantum parallelism), the QFT reveals the period as sharp peaks in the probability distribution. Measuring these peaks and using continued fractions extracts r with high probability. This simulation visualizes the QFT output peaks and how they correspond to the period.

The Road to Cryptographic Relevance

Factoring RSA-2048 requires about 4,000 error-corrected logical qubits, each encoded in thousands of physical qubits. Current quantum computers have hundreds of noisy physical qubits — a gap of roughly five orders of magnitude. Post-quantum cryptography standards (lattice-based, hash-based) are being deployed now in anticipation of future quantum computers. The race between quantum hardware and post-quantum migration defines modern cybersecurity strategy.

FAQ

What is Shor's algorithm?

Shor's algorithm, discovered by Peter Shor in 1994, is a quantum algorithm that factors integers in polynomial time — exponentially faster than the best known classical algorithms. It works by reducing factoring to period-finding, then using the quantum Fourier transform to find the period efficiently.

How does Shor's algorithm break RSA?

RSA encryption relies on the difficulty of factoring large semiprimes (products of two primes). Classical algorithms take exponential time, but Shor's algorithm runs in O(n³) time where n is the number of digits. A sufficiently large quantum computer could factor RSA-2048 keys in hours instead of billions of years.

How many qubits does Shor's algorithm need?

To factor an n-bit number, Shor's algorithm needs about 2n+3 logical qubits. With quantum error correction overhead, factoring RSA-2048 would require roughly 4,000 logical qubits or about 20 million physical qubits with current error rates.

Has Shor's algorithm been demonstrated experimentally?

Yes, but only for tiny numbers. IBM factored 15 in 2001 using 7 qubits. More recently, various groups have factored numbers up to 21 and 35. Factoring cryptographically relevant numbers requires error-corrected quantum computers that don't yet exist.

Sources

Embed

<iframe src="https://homo-deus.com/lab/quantum-computing/shor-algorithm/embed" width="100%" height="400" frameborder="0"></iframe>
View source on GitHub