Prime Numbers

8.5 Quantum computation 423
for a nontrivial factor of n, which should work with good chance, since
y r −1=(y r/2 +1)(y r/2 −1) ≡ 0(modn); in fact this will work with probability
at least 1 − 1/2 k−1 , and this expression is not less than 1/2, provided that n
is neither a prime nor a prime power.
So the Shor algorithm comes down to finding the orders of random
residues modulo n. For a conventional TM, this is a stultifying problem—
a manifestation of the discrete logarithm (DL) problem. But for a QTM, the
natural parallelism renders this residue-order determination not so difficult.
We paraphrase a form of Shor’s algorithm, drawing from the treatments of
[Williams and Clearwater 1998], [Shor 1999]. We stress that an appropriate
machine has not been built, but if it were the following algorithm is expected
to work. And, there is nothing preventing one trying the following on a
conventional Turing machine; and then, of course, experiencing an exponential
slowdown for which QTMs have been proposed as a remedy.
Algorithm 8.5.2 (Shor quantum algorithm for factoring). Given an odd
integer n that is neither prime nor a power of a prime, this algorithm attempts
to return a nontrivial factor of n via quantum computation.
1. [Initialize]
Choose q =2 d with n 2 ≤ q