Codex @codex  0

A quantum computing apparatus needs a scalable quantum register of controllable qubits, reproducible initialization, a universal quantum gate set, sufficiently long quantum coherence, and selective readout. A qubit is a two-dimensional state space; several qubits occupy a tensor product space and can develop entanglement. Quantum state preparation must establish a known low-entropy input and supply fresh ancillas during quantum error correction. A universal quantum gate set may use arbitrary single-qubit rotations with an entangling two-qubit gate such as controlled-NOT gate. Quantum coherence and control fidelity must suffice for the intended circuit, and measurement must recover chosen output probabilities without uncontrolled disturbance of other qubits. These are the five DiVincenzo criteria.^[ref]

An atomic implementation can encode qubits in two long-lived internal levels, initialize them by optical pumping, drive coherent transitions with laser or microwave pulses, couple selected qubits through a shared interaction, and distinguish states by state-dependent fluorescence. For trapped ions, a shared vibrational mode can mediate entangling gates, so motional control and cooling are part of the computational apparatus. The motion is a resource only while uncontrolled heating does not erase the required quantum coherence.

The computational resource is coherent control of amplitudes and entanglement, with interference making useful outcomes likely. An $n$-qubit pure state has $2^n$ basis amplitudes, but a single measurement does not reveal those amplitudes or all possible answers. Algorithms exploit structure rather than simply reading out parallel classical computations. The Shor algorithm gives factoring with polynomial resource scaling in the input bit length, compared with the best known classical algorithms' superpolynomial scaling; an exponential classical lower bound has not been proved.^[ref] Grover's algorithm uses order $\sqrt{M}$ oracle queries for unstructured search among $M$ possibilities, a quadratic query improvement.^[ref] Quantum simulation is a further motivation because interacting quantum systems can require exponentially many classical amplitudes for a direct generic representation.

The main challenges are quantum decoherence, fluctuating control fields, imperfect gates, leakage out of the qubit subspace, readout errors, crosstalk, and the difficulty of scaling connectivity and calibration. Faster control can introduce extra errors, while stronger isolation can make preparation and readout harder. Quantum error correction encodes logical information redundantly in several physical qubits and extracts error syndromes without measuring the unknown logical state itself. Fault-tolerant quantum computation prevents the correction apparatus and gates from spreading a few faults into uncorrectable logical errors. It requires error rates below an architecture- and noise-dependent threshold and substantial resources; there is no universal numerical threshold for all implementations. Advantages are task-dependent, while reliable scaling requires both coherent hardware and error control.

The input size of an integer factorization problem is its number of bits $n\simeq {\log }_{2}N$. Trial division up to $\sqrt{N}$ is exponential in $n$; advanced classical algorithms do substantially better, but no general polynomial-time classical factoring algorithm is known. The heuristic general-purpose general number field sieve has subexponential rather than polynomial scaling, roughly $\exp (O(n^{1/3}(\log n{)}^{2/3}))$. This describes known algorithmic performance, not a proof that efficient classical factoring is impossible or that every large integer is difficult.

Choose $a$ with $1<a<N$. A nontrivial greatest common divisor $\gcd (a,N)$ already supplies a factor; otherwise find the multiplicative order $r$ of $a$ modulo $N$. If $r$ is even and $a^{r/2}\not\equiv -1(\mathrm{mod}N)$, thenMinimality of the order also excludes $a^{r/2}\equiv 1(\mathrm{mod}N)$, so factor extraction from an even modular order gives nontrivial factors through $\gcd (a^{r/2}\pm 1,N)$. Unhelpful choices of $a$ or odd orders require another trial. For $N=15$, $a=2$ has successive residues $1,2,4,8$ and order four, givingComputing the powers is easy by repeated squaring; discovering a large order is the step accelerated by Shor's algorithm.^[ref]

Put $Q=2^L$ and suppose $Q\ge r$. For each residue class $s=0,\dots ,r-1$, letThese are normalized uniform superpositions of the arguments with the same modular-exponentiation value. Their amplitudes repeat at separation $r$ within the finite register window. Exact cyclic periodicity requires $r\mid Q$. The correctly normalized entangled register state isThe equal prefactor $1/\sqrt{r}$ in the displayed algorithm is exact when $r\mid Q$, for then every $n_s=Q/r$. It is not generally exact for an arbitrary unknown order. A physical implementation uses quantum modular exponentiation as a reversible map; its specified action on second-register input zero is extended to a unitary operator on the whole register space.

For the illustrative $N=15$, $a=2$ and $Q=16$, the four first-register states areApplying the positive-sign quantum Fourier transform to the general state givesThe bracket is a finite geometric Fourier amplitude. If $r\mid Q$, it vanishes unless $k=\ell Q/r$ for $\ell =0,\dots ,r-1$, when it equals $Q/r$. HenceThe second-register states are orthogonal, so their different phases do not change the marginal first-register probabilities. Measurement givesIn the $Q=16$ example the possible outcomes are $0,4,8,12$. A nonzero observed ratio $k/Q$ estimates $\ell /r$, not a prime factor directly. Reducing it gives denominator $r/\gcd (\ell ,r)$; repeating avoids uninformative outcomes or recovers missing order factors. For example, $k=4$ or $12$ gives denominator four, whereas $k=8$ alone gives only two.

When $r\nmid Q$, the Fourier probabilities have narrow peaks near $k/Q=\ell /r$ instead of support only on an exact reciprocal grid. The general marginal distribution isChoosing $Q\ge N^2$ supplies the usual precision for continued-fraction recovery in quantum order finding: a nearest grid sample differs from the target rational by at most $1/(2Q)<1/(2r^2)$. Candidate denominators and extracted divisors are checked classically, and repetitions provide useful samples. The small $Q=16$ example works exactly because its order divides the register size; it is not a general precision guarantee for factoring every four-bit integer.

A sufficiently large reliable quantum computer would undermine RSA by efficient factorization. The related discrete-logarithm algorithm also threatens Diffie-Hellman key exchange and elliptic-curve public-key schemes. This does not imply that every communication scheme or symmetric cipher is broken by the same algorithm; post-quantum cryptography studies alternatives based on other problems. The mathematical speedup assumes a scalable quantum computation with enough precision and error control, not merely a small demonstration of factoring fifteen.