Quantum Computer on kenji.blog

[Complete Guide] What is a Quantum Computer? ~The Ultimate Computing Principle from Scratch~

Sat, 05 Sep 2026 22:10:00 +0900

Introduction: The “Paradigm Shift in Computing” Brought by Quantum Computers

In recent years, not a day goes by without seeing the term “quantum computer” in the news or technical articles. Sci-fi-like stories are often told, such as “calculations that would take current supercomputers thousands of years can be finished in minutes” or “all current cryptographic technologies might be broken.” Giant IT companies like Google, IBM, and Microsoft, as well as universities and startups worldwide, are fiercely competing to commercialize this dream technology.

However, if asked, “What exactly is a quantum computer?”, few people could answer accurately. Many have a vague image of a “magic box that can calculate all combinations simultaneously,” but strictly speaking, that is incorrect.

In this article, we will thoroughly explain from the basics how quantum computers fundamentally differ from classical computers (the PCs and smartphones we usually use), and how they utilize mysterious phenomena of quantum mechanics such as “Superposition,” “Entanglement,” and “Quantum gates” for calculations, in a professional yet easy-to-understand manner. By the time you finish reading this article, you should clearly understand the essential greatness of quantum computers and their current challenges.

Chapter 1: The Crucial Difference Between Classical and Quantum Computers

To understand how a quantum computer works, we first need to review how the “classical computers” we currently use operate.

Comparison Table: Classical Computers vs Quantum Computers

Item	Classical Computer	Quantum Computer
Basic Unit	Bit (0 or 1)	Qubit (superposition of 0 and 1)
State Representation	Deterministic	Probabilistic (undetermined until observed)
Calculation Method	Sequential processing (requires physical cores for parallelization)	Quantum parallelism (manipulates exponential states simultaneously)
Excels at	Arithmetic operations, everyday data processing	Prime factorization, quantum chemistry calculations
Error Tolerance	Very strong	Very weak (requires cryogenic environments and error correction)

The World of Classical Computers: The “Bit” of 0 or 1

Classical computers represent all information in a state of either “0” or “1”. This is called a Bit. Physically, it is represented by whether the voltage of a transistor on a semiconductor chip is high (1) or low (0). The high-quality photos on your smartphone, the text you are reading now, and your favorite YouTube videos are all ultimately reduced to a massive sequence of 0s and 1s. Computation is nothing more than the process of applying operations to this sequence of 0s and 1s by combining basic logic circuits such as AND, OR, and NOT. This is a very reliable and deterministic world. If the input is the same, you will always get the same output.

The World of Quantum Computers: The “Qubit” That is Both 0 and 1

On the other hand, the smallest unit of information in a quantum computer is called a Qubit (Quantum bit). The biggest feature of a qubit is that, unlike a classical bit which is strictly either “0” or “1”, it can take on a state where “0 and 1 are mixed with specific probabilities.” This is called “Superposition”.

For example, if a classical bit is a coin placed with either “heads” or “tails” facing up, a qubit is often compared to a “coin constantly spinning in the air.” A spinning coin cannot be said to be heads or tails; both states are superimposed. And the moment the coin falls to the floor and stops moving (in quantum mechanics, this is called “observation”), it is determined as either “heads” or “tails” for the first time.

Quantum computers incorporate this very property unique to the microscopic world (quantum mechanics)—where “the state is not determined until observed”—directly into the information processing process.

Chapter 2: Three Quantum Mechanical Properties That Fundamentally Change Computing

The source of the astonishing computing power of quantum computers is not simply a high clock frequency or small components. It lies in utilizing the laws of physics themselves as computational resources. The following three quantum mechanical phenomena are the keys.

1. Superposition and Exponential Information Capacity

As mentioned earlier, a qubit can simultaneously hold the states of both 0 and 1. One qubit is a “superposition of 0 and 1,” but what happens when you increase the number of qubits?

1 Qubit: Superposition of 2 states (0, 1)
2 Qubits: Superposition of 4 states (00, 01, 10, 11)
3 Qubits: Superposition of 8 states
N Qubits: Superposition of $2^N$ patterns

With just 50 qubits, you can simultaneously hold $2^{50}$ (about 1.1 quadrillion) states. And with just 300 qubits, you can hold $2^{300}$ patterns at once—a number greater than all the atoms in the universe! This exponential information holding capacity is the foundation of a quantum computer’s potential. It is physically impossible for a classical computer to store more states in memory than there are atoms in the universe.

2. Entanglement: Spooky Action at a Distance

Quantum entanglement is such a counter-intuitive and mysterious phenomenon that Albert Einstein called it “Spooky action at a distance” and refused to accept it throughout his life.

When multiple qubits enter a state of “quantum entanglement,” they become strongly linked to each other, forming a shared destiny: “when the state of one is determined, the state of the other is instantly determined, no matter how far apart they are.”

For example, suppose we have two entangled qubits A and B (each in a superposition of 0 and 1). If we observe A and find it to be “0,” the state of B is instantly determined (for example, to definitely be “1”), exceeding the speed of light, which is the limit of information transmission. In quantum computers, this entanglement is used to represent complex correlations between multiple qubits and perform massively parallel information processing. Without entanglement, the computing power of quantum computers would not be much different from that of classical computers.

3. Quantum Interference: The Magic That Brings Out the Right Answer

You might think, “If it can hold all patterns simultaneously, couldn’t it calculate them all at once in parallel and output the answer instantly?” This is the most common misconception about quantum computers. Even if you calculate in a superposition state, you must “observe” to finally know the answer. However, the moment you observe, the state randomly collapses into one of the $2^N$ patterns. This would just give you a random answer.

Here is where “Quantum Interference” comes in. When waves collide, they strengthen each other where their wavelengths match, and cancel each other out where they are out of sync (the principle is essentially the same as noise-canceling headphones).

An excellent “quantum algorithm” masterfully manipulates quantum states during the computation process so that “the probability amplitudes of states (waves) leading to the correct answer amplify each other” and “the probability amplitudes of states leading to incorrect answers cancel each other out.” It is designed so that when ultimately observed, the “correct answer” pops out with a probability as close to 100% as possible. Designing this interference process well is the very essence of quantum programming.

Chapter 3: How Do They Compute? “Quantum Gates” and “Quantum Circuits”

Just as classical computers use logic gates (AND, OR, NOT, etc.) to perform calculations, quantum computers apply operations called “Quantum Gates” to qubits to advance calculations. A combination of multiple quantum gates is called a ** Quantum Circuit**.

The state of a qubit is mathematically represented as a point on the surface of a 3-dimensional sphere called a “Bloch sphere.” The North Pole is “0”, the South Pole is “1”, and the equator represents a state where “0 and 1 are equally superimposed.” A quantum gate is nothing more than an operation that rotates the state (vector) on the surface of this sphere.

Let’s introduce some representative quantum gates.

1. Hadamard Gate (H Gate)

This is the most fundamental gate unique to quantum computers, not found in classical computers. When a qubit exactly in the “0” state passes through an H gate, it creates a “perfect superposition state” (a point on the equator of the Bloch sphere) where 0 and 1 are observed with exactly 50% probability each. As an initialization step for quantum computation, many algorithms begin by applying this H gate to all qubits.

2. Pauli Gates (X, Y, Z Gates)

These gates correspond to the NOT gate (flipping 0 to 1, and 1 to 0) of classical computers. On the Bloch sphere, they correspond to 180-degree rotations around the X, Y, and Z axes. The X gate, in particular, flips the North Pole (0) to the South Pole (1), working exactly the same as a classical NOT gate. The Z gate has the role of flipping the “phase” (like the timing of a wave) of a superposition, which is extremely important for causing quantum interference.

3. CNOT Gate (Controlled NOT Gate)

This is a hyper-important gate for creating quantum entanglement. It uses two qubits (a control bit and a target bit). It operates as follows: “If the control bit is 1, flip the state of the target bit (apply an X gate). If the control bit is 0, do nothing.” At first glance, it looks like a simple IF conditional branch, but what happens if the control bit is in a “superposition state of 0 and 1”? The target bit becomes a “superposition of flipped and unflipped states,” and the destinies of the two bits become completely linked. The two qubits beautifully become “entangled.”

By placing and applying these gates in sequence from left to right like a musical score, complex algorithms are executed.

Chapter 4: What Are Quantum Computers Good At, and What Are They Bad At?

Here is an important fact: quantum computers are not omnipotent gods. For everyday tasks like web browsing, video rendering, Excel macro processing, or running general smartphone apps, quantum computers will probably never surpass classical computers. Classical computers, which are already highly optimized and boast overwhelming speed and low cost, are better suited for these sequential processes.

Quantum computers truly shine only when applied to “specific problems where the combinations of calculations explode exponentially for classical computers, taking time comparable to the age of the universe.” This is called “Quantum Supremacy” or “Quantum Advantage.”

What Quantum Computers Excel At (Killer Applications)

1. Prime Factorization and Cryptanalysis (Shor’s Algorithm)

Currently, secure communications on the Internet (such as credit card payments and sending personal information) are protected by “RSA encryption,” which is based on the premise that “prime factorization of huge numbers is practically impossible (takes an enormous amount of time) for classical computers.” However, by using “Shor’s Algorithm” discovered by mathematician Peter Shor in 1994, a quantum computer can skillfully use interference to solve this at a dramatic speed (polynomial time). Because of this, there is a risk that the current cryptographic systems will collapse in the future, and central banks and government agencies worldwide are rushing to transition to “Post-Quantum Cryptography.”

2. Quantum Chemistry Calculations, New Materials, and Drug Discovery

The behavior of molecules and atoms in the natural world originally follows the laws of quantum mechanics. When trying to simulate the behavior of complex molecules on a classical computer, the combinations of electron interactions explode, hitting the computational limits even for relatively small molecules. As Nobel laureate Richard Feynman said, “Nature isn’t classical, dammit, and if you want to make a simulation of nature, you’d better make it quantum mechanical,” quantum computers exert overwhelming native power in material simulations. Breakthroughs that solve humanity’s challenges are expected, such as the design of revolutionary new drugs, the discovery of room-temperature superconductors, the development of highly efficient solar cells and battery materials, and the synthesis of energy-efficient fertilizers.

3. Combinatorial Optimization Problems and Search (Grover’s Algorithm)

Quantum algorithms also demonstrate power for problems that involve finding the optimal choice from an enormous number of options (logistics route optimization, financial portfolio optimization, etc.). By using “Grover’s Algorithm,” the target data can be found from an unsorted database in the square root of the time it would take a classical computer. For example, if there are 100 million pieces of data, a search that takes a maximum of 100 million tries classically can be completed in just about 10,000 tries.

Chapter 5: The Hardware Walls In the Way: “Decoherence” and “Quantum Error Correction”

Although theoretically magically powerful, the path to practical application of quantum computers is blocked by extremely high and steep physical walls. The biggest enemy is “Noise”.

The “superposition” and “quantum entanglement” of qubits are extremely delicate and fragile states. Even the slightest ambient heat, electromagnetic fluctuation, or cosmic rays can instantly cause that magical state to collapse, turning it into just a classical bit. This phenomenon is called “Decoherence”.

The Fierce Competition of Physical Implementation Methods

Currently, there is a battle for supremacy worldwide regarding how to physically create these delicate qubits.

Superconducting Method: Adopted by Google, IBM, Amazon, etc. It uses loop-shaped superconducting circuits and controls the quantum state by cooling it to a cryogenic temperature close to absolute zero (about -273°C) using massive refrigerators. It is currently the most advanced method and the easiest to scale up the number of qubits, but the cooling equipment is huge and expensive.
Trapped Ion Method: Adopted by IonQ, Quantinuum, etc. It traps ions (atoms) in a vacuum using electromagnetic fields and controls them by shining precise lasers. Its strength is that all qubits are uniform and can maintain their state for a long time (long coherence time), but the operation speed is slower compared to superconducting.
Photonic Method: Focused on by PsiQuantum, etc. It uses particles of light (photons). It has the great advantage of not requiring a cryogenic environment and mostly operating at room temperature, while being highly compatible with existing silicon chip manufacturing and fiber-optic communication technologies.
Topological Method: Researched for a long time by Microsoft. It is an ambitious approach trying to create qubits fundamentally robust against environmental noise (resistant to errors) by utilizing the topological properties of special particles called anyons. It is theoretically the strongest, but the physical realization hurdle is considered the highest.

The Path to the Ultimate Goal: “Fault-Tolerant Quantum Computer (FTQC)”

Calculation errors (like bit flips from cosmic rays) also exist in today’s classical computers, but they are perfectly corrected by “error-correcting codes,” so we can use our smartphones without ever noticing an error. To perform practical large-scale calculations on a quantum computer, similar “Quantum Error Correction (QEC)” is essential.

However, because quantum states have the property of “breaking when observed,” there is a fatal dilemma: you cannot directly look inside (observe) to check for errors. To avoid this, theories have been established (like surface codes) that skillfully combine many unstable “physical qubits” to build one stable “logical qubit” that can detect and correct errors. However, it is said that 1,000 to 10,000 physical qubits are needed to create just one logical qubit. Executing Shor’s algorithm using thousands of logical qubits would require a massive system with millions to tens of millions of physical qubits overall.

We are currently in what is called the era of NISQ (Noisy Intermediate-Scale Quantum) devices. These are transitional machines operating with tens to hundreds of qubits without error correction. Experts predict that it will take a long-term research and development period of 10 to several decades to realize the ultimate goal, a fully error-correctable “Fault-Tolerant Quantum Computer (FTQC)”.

Chapter 6: History and Future Prospects of Quantum Computers

Finally, let’s take a bird’s-eye view of how quantum computers were born and where they are heading.

From the Birth of the Theory to the Demonstration of “Quantum Supremacy”

1980s: Physicists Paul Benioff and Richard Feynman proposed the concept of a computer using the principles of quantum mechanics. The phrase “If you want to make a simulation of nature, you’d better make it quantum mechanical” was the starting point.
1994: Peter Shor published a quantum algorithm for prime factorization (Shor’s algorithm). It shocked the world and triggered a massive influx of research funding.
1996: Lov Grover published Grover’s algorithm to speed up data search.
**2019 **: A historical milestone. Google announced that using its 53-qubit superconducting processor “Sycamore,” it completed a random number generation verification calculation in about 200 seconds that would have taken a classical supercomputer 10,000 years (so they claimed). This caused a sensation as the world’s first declaration of demonstrating “Quantum Supremacy” (although IBM and others later improved the classical supercomputer algorithm and argued it could be calculated in a few days, leading to heated debates).
From 2023 onwards: IBM announced the processor “Condor” with over 1,000 qubits. Furthermore, early demonstrations of error correction technology are being reported one after another, such as Harvard University’s success in creating and manipulating “logical qubits.”

Towards the Technology of the Next Generation

A quantum computer is not merely a “next-generation CPU with a faster clock speed.” It is a true paradigm shift in computer science, fundamentally rewriting the concept of computation itself with the rules of quantum mechanics that govern the microscopic world.

We will probably not have a “personal quantum smartphone” that fits in our pockets during our lifetime (and there is no need for one). However, the future is steadily approaching where powerful quantum data centers behind cloud networks like AWS and Azure might one day suddenly discover a cure for an incurable disease, or calculate dream clean energy materials to solve global warming (for example, catalysts to synthesize ammonia from atmospheric nitrogen at room temperature).

We are currently in a dawn comparable to the 1940s ENIAC, which ran on punch cards while the heat from its massive vacuum tubes made the whole room hot. However, top-level researchers and engineers worldwide are pooling their wisdom, and technical breakthroughs are reported daily. We, who can witness the evolution of this new “dawn of computing” in real time, can be said to live in a historically very exciting era.

The door to the quantum world has just been opened. Keep an eye on future developments.

This article aims to explain the basic concepts of quantum computing in an easy-to-understand manner for business professionals and the general public interested in technology. Please note that some rigorous mathematical and physical definitions (such as bra-ket notation and details of complex probability amplitudes) have been partially simplified.

Will Quantum Computers Really Break RSA Encryption? ~Shor's Algorithm and the Current State of the Art~

Sat, 05 Sep 2026 22:09:21 +0900

Introduction: The Intersection of Cryptography and Quantum Computers

In modern Internet society, “public-key cryptography” is the foundation for protecting the secrecy of communications. A representative example of this is “RSA encryption,” developed in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman. From online shopping payments we use every day to website browsing (HTTPS) and email transmission/reception, RSA encryption functions as the heart of the Internet infrastructure.

However, it has been pointed out that the advent of “quantum computers” could fundamentally overturn this security. Media outlets sometimes run sensational headlines like, “Once quantum computers are completed, passwords and codes worldwide will be decrypted in seconds.” But is this really true?

In this article, we delve deeply into the mechanisms of GNFS (General Number Field Sieve), a classical cryptanalysis method, and “Shor’s Algorithm,” the definitive cryptanalysis algorithm using a quantum computer. We will explain advanced concepts like Quantum Fourier Transform and period finding in an easy-to-understand manner, and examine in detail the current state of quantum hardware in the NISQ (Noisy Intermediate-Scale Quantum) era and the hurdles required to actually break RSA-2048.

The Core of RSA Encryption: The Difficulty of Prime Factorization

The security of RSA encryption relies on a very simple asymmetry in mathematics. It is based on the fact that “it is easy to multiply two enormous prime numbers together, but it is extremely difficult to find the original two prime numbers (prime factorization) from the result of that multiplication (a composite number).”

For example, suppose we have two prime numbers, $ p = 61 $ and $ q = 53 $. Calculating this multiplication $ N = p \times q = 3233 $ is instantaneous. However, if given only the number “3233” and asked, “Which prime numbers were multiplied to get this?”, the computational complexity explodes as the numbers get larger.

In the currently mainstream RSA-2048, a massive composite number $ N $ with a key length of 2048 bits—about 617 decimal digits—is used. If this $ N $ can be factored into primes, the encryption is as good as broken.

The Challenge by Classical Computers: GNFS (General Number Field Sieve)

To solve the prime factorization problem, mathematicians and cryptographers have developed various algorithms over the years. Among them, the fastest currently on classical computers is the General Number Field Sieve (GNFS).

GNFS is a method that extends computations in the ring of integers to more abstract algebraic number fields (Number Fields) to analyze and factorize a huge number $ N $. The rough flow is as follows:

Polynomial Selection: Find a polynomial $ f(x) $ with appropriate degrees and coefficients that has $ N $ as a root.
Data Collection (Sieving): Over the field of rational numbers and algebraic number fields, search for a massive amount of pairs of numbers that can be factored into small prime numbers (Smooth numbers). This process is called “sieving” and is the most time-consuming part.
Matrix Generation and Reduction: Based on the collected relations, generate a huge sparse matrix (a matrix where most components are 0) and find a solution using linear algebraic methods (such as the Block Lanczos algorithm).
Square Root Calculation: Finally, calculate the square root over the algebraic number field and derive the factors (prime factors) of $ N $.

The computational complexity of GNFS is non-asymptotically evaluated as $ O(\exp((\sqrt[3]{\frac{64}{9}} + o(1)) (\log N)^{\frac{1}{3}} (\log \log N)^{\frac{2}{3}})) $. This is called “sub-exponential” time complexity. While faster than exponential time, it is still far slower than polynomial time.

In fact, in 2020, an international research team succeeded in the prime factorization of RSA-250 (an 829-bit, 250-digit composite number) using GNFS. This calculation gathered computing resources from around the world and spent an enormous amount of computing time, roughly 2,700 CPU core years. However, when it comes to 2048 bits, the required computational complexity is said to swell to trillions of times the lifespan of the universe, making it impossible to decrypt within a realistic time frame using classical methods, no matter how many supercomputers are run in parallel.

The Trump Card of Quantum Computers: Shor’s Algorithm

Enter “Shor’s Algorithm,” announced by Peter Shor in 1994. This algorithm was groundbreaking because it could solve the prime factorization problem on a quantum computer in polynomial time ( $ O((\log N)^3) $ ). The difference between sub-exponential time and polynomial time is decisive; in theory, the use of quantum computers means the complete destruction of RSA encryption.

The Overall Flow of Shor’s Algorithm

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


graph TD
 A[Input number N to be factored] --> B[Select a random integer a]
 B --> C{Greatest Common Divisor<br>of a and N}
 C -->|Greater than 1| D[Luckily discovered a prime factor!]
 C -->|1 Mutually prime| E[Quantum computer takes the stage]
 E --> F[Find the period r of the function<br>f_x = a^x mod N<br>using Quantum Fourier Transform]
 F --> G{Is period r even and<br>a^r/2 ≢ -1 mod N?}
 G -->|Yes| H[Calculate greatest common divisor gcd_a^r/2 ± 1, N]
 H --> I((Prime factorization successful!))
 G -->|No| B

Shor’s algorithm does not solve the prime factorization problem directly, but rather uses theorems from number theory to transform it into another problem called the “Period Finding Problem,” and solves that rapidly by leveraging the characteristics of a quantum computer.

Step 1: Reduction from Prime Factorization to the Period Finding Problem (Classical Processing)

The first step of the algorithm is performed on a classical computer. For the number $ N $ you want to factorize, pick a random integer $ a $ ( $ 1 < a < N $ ) that is coprime to $ N $ (their greatest common divisor is 1). If by chance the greatest common divisor is not 1, the common divisor found at that point is a prime factor of $ N $, and decryption is complete, but the probability of this is extremely low.

Next, consider the following sequence of modulo equations: $ f(x) = a^x \pmod N $

If we substitute $ x = 1, 2, 3, \dots $ into this function $ f(x) $, the values may seem random, but because we are calculating within a finite range, it will always return to the original value somewhere and repeat the same sequence of numbers. The period of this repetition is called $ r $. In other words, the problem of finding the smallest positive integer $ r $ such that $ a^r \equiv 1 \pmod N $, this is the “Period Finding Problem”.

If this period $ r $ is found, and $ r $ is an even number, then $ a^r - 1 \equiv 0 \pmod N $, and using the factorization formula, it can be transformed into: $ (a^{r/2} - 1)(a^{r/2} + 1) \equiv 0 \pmod N $ From here, by using the Euclidean algorithm to calculate the greatest common divisor of $ N $ and $ a^{r/2} \pm 1 $, a prime factor of $ N $ can be obtained with extremely high probability.

Finding the period $ r $ on a classical computer ultimately requires an exponential number of steps and cannot be sped up. However, a quantum computer can find this period $ r $ in an instant (in polynomial time).

Step 2: Preparation and Superposition of Quantum States

This is where the quantum computer comes into play. Quantum computers use “Qubits”, which can simultaneously hold the states of “0” and “1”. In Shor’s algorithm, two registers are prepared: a register to store inputs (the first register) and a register to store calculation results (the second register).

First, a quantum gate operation called a Hadamard gate is applied to all qubits in the first register. As a result, the first register becomes an equal superposition state of all conceivable values of $ x $ (from $ 0 $ to $ 2^n-1 $, where $ n $ is a sufficiently large number of bits).

In other words, inside the quantum computer, a state is created where countless input values $ x=0, 1, 2, 3, \dots $ exist simultaneously in parallel.

Step 3: Quantum Modular Exponentiation

Next, taking the superposition state of the first register as input, calculate $ f(x) = a^x \pmod N $ and store the result in the second register. Because this calculation is executed as a unitary transformation on a quantum circuit, the calculation of $ f(x) $ for all $ x $ is performed “simultaneously and in parallel (quantum parallelism)” while maintaining the superposition.

The space of the entire quantum system at this point is an enormous superposition of states: $ |x, a^x \bmod N\rangle $

However, if we simply measure (observe) the second register here, a single random value of $ a^x \bmod N $ will be probabilistically selected, and the $ x $ of the first register will be fixed to one value in conjunction with it. This is exactly the same as calculating it once on a classical computer, and the period $ r $ cannot be found.

Under the rules of quantum mechanics, you cannot directly peek into the contents of a superposition state. So how do we extract the global information of the overall “period”?

Step 4: Quantum Fourier Transform (QFT)

The true brilliance of Shor’s algorithm that breaks through this wall is the application of the Quantum Fourier Transform (QFT) to the first register.

Before making a measurement, we analyze the wave properties of the function $ f(x) $. Suppose we observed the second register. Suppose a value $ y $ was obtained. Then, the state of the first register collapses to a “superposition of all $ x $ such that $ a^x \pmod N = y $”. These values of $ x $ will be in a state that is discretely arranged at intervals of period $ r $, such as $ x_0, x_0 + r, x_0 + 2r, x_0 + 3r, \dots $ (a kind of comb-like probability amplitude distribution).

We apply the Quantum Fourier Transform (QFT) to this state. Just as the classical discrete Fourier transform converts a time-domain signal into the frequency domain, QFT causes interference in the probability amplitudes of the quantum state.

When QFT is applied, due to quantum interference effects, the probabilities of incorrect answers that do not resonate with the period $ r $ (where phases do not align) cancel each other out and approach zero (destructive interference), and only the probability of the correct answer that carries the information of the period $ r $ is amplified (constructive interference).

Step 5: Measurement and Continued Fraction Expansion (Classical Post-Processing)

When the first register is measured after applying QFT, an integer $ c $ close to the form $ c \approx \frac{j \cdot 2^n}{r} $ is obtained with very high probability (where $ j $ is an unknown integer and $ 2^n $ is the size of the register).

By returning this measurement result $ c $ to a classical computer and creating a fraction $ \frac{c}{2^n} \approx \frac{j}{r} $, and then calculating an approximate value using a mathematical method called “Continued fraction expansion”, the denominator, the period $ r $, can be successfully brought to light.

Once $ r $ is known, the prime factors of $ N $ can be calculated using the formula from Step 1, and the RSA encryption is completely broken.

The Capability and Challenges of Current Quantum Computers (NISQ)

While Shor’s algorithm is theoretically perfect, if asked, “Will RSA encryption be broken tomorrow?”, the answer is a definitive “No.” The reason lies in the limitations of current quantum computer hardware technology.

The NISQ (Noisy Intermediate-Scale Quantum) Era

We currently exist in an era known as “NISQ”. NISQ devices have tens to hundreds of physical qubits, but they are extremely vulnerable to noise.

Qubits are susceptible to external environmental influences such as heat and electromagnetic waves, and “decoherence” (loss of quantum entanglement) where the quantum state breaks down, and “gate errors” during gate operations occur frequently. If one tries to execute a very deep quantum circuit (with an enormous number of calculation steps) like Shor’s algorithm, errors accumulate during the calculation, and the final output becomes completely meaningless noise.

Physical Qubits and Logical Qubits

What is indispensable for solving this error problem is “Quantum Error Correction”. While error correction codes are also used in classical computers, quantum error correction is extremely complex due to the “no-cloning theorem” which forbids the duplication of quantum states.

In quantum error correction, an ideal, error-free “logical qubit” is created by combining a large number of noisy “physical qubits” using techniques such as the “Surface Code”.

Assuming current error rates, it is estimated that approximately 1,000 to 10,000 physical qubits will be required to create one logical qubit. This is called “error correction overhead”.

What Resources Are Needed to Break RSA-2048?

So, how many resources are actually needed to run Shor’s algorithm to decrypt RSA-2048?

According to a groundbreaking resource estimation in a 2021 paper by Craig Gidney (Google) and Martin Ekerå, if an optimized Shor’s algorithm is used and error correction by surface codes is performed, the following resources will be required:

Number of logical qubits: Approx. 4,096
**Number of physical qubits : ** Approx. 20 million (Assuming an error rate of about $10^{-3}$)
Computation time: Approx. 8 hours (Millions to billions of physical gate operations required)

In contrast, what is the current state of quantum hardware? The superconducting quantum processor “Condor” announced by IBM at the end of 2023 has 1,121 qubits. In addition, groundbreaking research on the generation of logical qubits (such as the generation of 48 logical qubits using a neutral atom quantum computer by Harvard University and QuEra, etc.) has appeared, but we are not yet at the stage where we can continuously execute “perfect, noise-free calculations” for a long time.

Scaling up from a few thousand physical qubits to 20 million practical physical qubits (and a system that is interconnected, operates stably at cryogenic temperatures, and can process control signals at ultra-high speeds) presents a tremendous engineering wall (wiring problems, limits of cooling capacity, bloating of control electronics). Many experts predict that it will take at least 10 to 30 years, or even longer, to realize a “Fault-Tolerant Quantum Computer (FTQC)” capable of breaking RSA-2048.

The Creeping Threat of “Store Now, Decrypt Later” and the Dawn of PQC

It is premature to think, “We are safe since it will still take more than 10 years.” Currently, there is data that must remain secret for decades to come, such as national classified information, medical data, and long-term infrastructure designs.

What is feared here is the threat of an attack method known as “Store Now, Decrypt Later”. Malicious nations or organizations intercept all communication data currently encrypted with RSA or ECC (Elliptic Curve Cryptography) and store it in storage. Then, 10 or 20 years later, the moment a powerful quantum computer is completed, they use Shor’s algorithm to decrypt all past data and expose secrets.

To counter this time lag threat, the standardization process for “Post-Quantum Cryptography (PQC)” has been rapidly advancing, primarily led by NIST (National Institute of Standards and Technology).

PQC is a new cryptographic algorithm based on mathematical problems that are difficult to solve even with a quantum computer (i.e., Shor’s algorithm cannot be applied). The main approaches include the following:

Lattice-based cryptography: Based on problems such as LWE (Learning with Errors). The mainstream in NIST standardization (Kyber, Dilithium, etc.).
Code-based cryptography: Relies on the difficulty of the decoding problem of error-correcting codes.
Multivariate cryptography: Relies on the difficulty of solving systems of multivariate quadratic equations.
Hash-based signatures: Digital signatures that rely solely on the security of hash functions.

Major software and platforms such as Google Chrome and Apple’s iMessage have already started introduction testing and hybrid implementation of PQC.

Conclusion

Quantum computers are transitioning from a pipe dream in the world of science fiction to a real engineering challenge. Shor’s algorithm is a great intellectual achievement of humanity that merges mathematics and quantum mechanics, but at the same time, it harbors a “destructive power” that shakes the foundations of our digital society.

RSA encryption will not suddenly become unusable tomorrow. However, considering the evolution of quantum technology and the risk of “Store Now, Decrypt Later,” a large-scale migration that will remain in cryptographic history—the transition to PQC—has already begun. We are now witnessing the front lines of a paradigm shift in information security.

[Complete Mathematical Guide] Why the Ultimate Classical 'GNFS' Loses to Quantum Algorithms: The Paradigm Shift in Prime Factorization

Mon, 01 Jan 0001 00:00:00 +0000

Information security in the modern internet society is protected by public-key cryptography, such as RSA cryptography. The basis for the security of RSA relies on the fact that “the prime factorization of huge composite numbers is computationally extremely difficult.”

In this article, we will unravel the mathematical mechanism of the “General Number Field Sieve” (GNFS), which is the most powerful prime factorization algorithm for classical computers. We will also dive deeply into why it is completely defeated by “Shor’s Algorithm,” discovered by Peter Shor, exploring this paradigm shift thoroughly with mathematical formulas and conceptual diagrams.

1. The Approach to Prime Factorization in Classical Computing: Evolution from Fermat’s Factorization Method

The prime factorization problem is the problem of finding prime numbers $p$ and $q$ such that $N = p \times q$ for a given composite number $N$.

The basic idea reduces to finding non-trivial $x$ and $y$ that satisfy the following congruence:

$$ x^2 \equiv y^2 \pmod N $$

By rearranging this, we get:

$$ x^2 - y^2 \equiv 0 \pmod N $$ $$ (x - y)(x + y) \equiv 0 \pmod N $$

Here, if $x \not\equiv \pm y \pmod N$, we can obtain a non-trivial factor of $N$ by calculating $\gcd(x-y, N)$ or $\gcd(x+y, N)$. This fact is the foundation of modern prime factorization algorithms like GNFS.

2. The Ultimate Classical Algorithm: The Depths of the “General Number Field Sieve” (GNFS)

“GNFS” is the fastest known prime factorization algorithm for classical computers today. Its time complexity requires sub-exponential time.

Complexity of GNFS

Letting the number of digits (bits) of the number $N$ be $b = \log_2 N$, the computational complexity of GNFS is expressed as follows:

$$ O\left( \exp \left( \left(\frac{64}{9} b\right)^{1/3} (\log b)^{2/3} \right) \right) $$

As can be seen from this formula, the computational complexity is not polynomial time, but “sub-exponential time,” which is slightly slower than exponential time. Still, as the number of digits increases, the computation time grows astronomically.

Mathematical Mechanism of GNFS

GNFS consists broadly of four steps:

Polynomial Selection
Sieving
Matrix Reduction
Square Root

2.1. Polynomial Selection and Number Fields

First, we select irreducible polynomials $f(x)$ and $g(x)$ with integer coefficients. These are set to have a common root $m$ modulo $N$. That is,

$$ f(m) \equiv 0 \pmod N $$ $$ g(m) \equiv 0 \pmod N $$

Usually, $g(x)$ is chosen as a linear polynomial $g(x) = x - m$. If we let $\alpha$ be a root of $f(x)$, a “Number Field” $\mathbb{Q}(\alpha)$ is constructed. We compare operations in the ring of $\mathbb{Q}(\alpha)$ and operations in the normal integer ring $\mathbb{Z}$ through the homomorphism $\phi: \alpha \mapsto m$.

2.2. Sieving

Next, we search for a massive number of coprime integer pairs $(a, b)$. The goal is to find pairs such that the following two values are both “B-smooth” (composed only of relatively small prime factors):

$a - bm$ (value over the integer ring)
$b^d f(a/b)$ (corresponding to the norm $N(a - b\alpha)$ over the number field)

Here, a high-speed search method called a “Sieve” is used. This efficiently extracts $(a, b)$ pairs that satisfy the conditions from a vast number of candidates.

2.3. Linear Algebra over GF(2) (Matrix Reduction)

From the collected pairs $(a, b)$, we construct exponent vectors and find the left null space of a massive sparse matrix over $\mathbb{F}_2$ (the field with only elements 0 and 1).

We find a vector $v$ as a solution so that the relations $ \prod (a_i - b_i m) $ and $ \prod (a_i - b_i \alpha) $ both become squares. This is nothing but solving a system of linear equations:

$$ M \mathbf{x} \equiv \mathbf{0} \pmod 2 $$

Advanced numerical algorithms such as the Block Lanczos Algorithm and the Block Wiedemann Algorithm are utilized here.

2.4. Square Root

Finally, we take square roots in both the number field and the integer ring to derive the relation $x^2 \equiv y^2 \pmod N$. Then, we calculate $\gcd(x-y, N)$ to obtain the factor.

3. The Breakthrough by Quantum Computing: “Shor’s Algorithm”

While GNFS requires sub-exponential time, “Shor’s Algorithm,” published by Peter Shor in 1994, can solve this problem in “polynomial time” by using a quantum computer.

Complexity of Shor’s Algorithm

When the number of qubits is $O(\log N)$, the time complexity is as follows:

$$ O((\log N)^3) $$

This means it does not cause an exponential explosion with respect to the number of bits. This is an astonishing result: even for huge composite numbers where the complexity of “classical computing” exceeds the lifespan of the universe, they can be cracked in hours to days with “quantum computing.”

Overview of Shor’s Algorithm: Reduction to the Period-Finding Problem

Shor’s algorithm cleverly reduces the prime factorization problem to a “period-finding problem.”

Choose a random integer $a$ coprime to $N$ ($1 < a < N$).
Define the function $f(x) = a^x \bmod N$.
Find the period $r$ of $f(x)$, i.e., the smallest positive integer $r$ such that $a^r \equiv 1 \pmod N$.
If $r$ is even, check if $a^{r/2} \not\equiv -1 \pmod N$, and calculate $\gcd(a^{r/2} \pm 1, N)$ to obtain a prime factor.

“Finding the period $r$” in step 3 is the bottleneck that requires exponential time on classical computers, but quantum computers solve this instantly using “quantum superposition” and the “Quantum Fourier Transform” (QFT).

4. Quantum Fourier Transform (QFT) and Period Extraction

Let’s look in detail with formulas at the manipulation of quantum states, which is the core of Shor’s algorithm.

4.1. Generation of Quantum Superposition

First, we prepare two quantum registers. Register 1 holds a superposition state of inputs $x$, and Register 2 holds the computation result $f(x)$. We apply the Hadamard Transform to the initial state $|0\rangle |0\rangle$ to create a superposition of all possible $x$.

$$ |\psi_1\rangle = \frac{1}{\sqrt{Q}} \sum_{x=0}^{Q-1} |x\rangle |0\rangle $$

(Here $Q$ is a power of 2 satisfying $N^2 \le Q < 2N^2$)

Next, we use a quantum oracle $U_f$ to compute $f(x) = a^x \bmod N$ and store it in Register 2.

$$ |\psi_2\rangle = U_f |\psi_1\rangle = \frac{1}{\sqrt{Q}} \sum_{x=0}^{Q-1} |x\rangle |a^x \bmod N\rangle $$

Let’s assume here that we measure Register 2 (in reality, the mathematical structure is the same even without measurement). If a value $y = a^{x_0} \bmod N$ is observed, the state of Register 1 collapses into a superposition of all $x$ such that $f(x) = y$. Letting the period be $r$, such $x$ are $x_0, x_0 + r, x_0 + 2r, \dots$

$$ |\psi_3\rangle = \frac{1}{\sqrt{M}} \sum_{k=0}^{M-1} |x_0 + kr\rangle $$

(Here $M \approx Q/r$ is the number of terms)

This state inherently contains information about the period $r$, but direct measurement will only yield a random $x_0 + kr$, and the period $r$ remains unknown. This is where QFT comes in.

4.2. Application of the Quantum Fourier Transform (QFT)

QFT is an operation that performs a discrete Fourier transform on the amplitudes of quantum states. The action of QFT on state $|x\rangle$ is defined as follows:

$$ \text{QFT} |x\rangle = \frac{1}{\sqrt{Q}} \sum_{y=0}^{Q-1} e^{2\pi i \frac{xy}{Q}} |y\rangle $$

When this is applied to $|\psi_3\rangle$, phase interference (quantum interference) occurs.

$$ |\psi_4\rangle = \text{QFT} |\psi_3\rangle = \frac{1}{\sqrt{MQ}} \sum_{y=0}^{Q-1} \sum_{k=0}^{M-1} e^{2\pi i \frac{(x_0 + kr)y}{Q}} |y\rangle $$

Expanding the sum in this equation reveals the part:

$$ \sum_{k=0}^{M-1} e^{2\pi i \frac{kry}{Q}} $$

This sum of a geometric series reinforces each other (Constructive Interference) only when $ry/Q$ is close to an integer, and cancels each other out (Destructive Interference) otherwise.

Therefore, the state $|y\rangle$ measured with high probability will be an integer $y$ that satisfies the condition:

$$ \frac{y}{Q} \approx \frac{c}{r} $$

(where $c$ is some integer).

4.3. Identifying the Period via Continued Fraction Expansion

After obtaining $y$ through measurement, we perform a “Continued Fraction Expansion” of $y/Q$ using a classical computer. This allows us to calculate the convergent fraction $c/r$ of $y/Q$, and extract candidates for the period $r$ from the denominator with high efficiency.

5. Comparison of Conceptual Models and the Paradigm Shift

To intuitively understand the difference between GNFS and Shor’s algorithm, we present a conceptual diagram using Mermaid notation.

Conceptual Diagram of Shor’s Algorithm via Quantum Circuit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


graph TD
 A[Initial State: 0...0] --> B[Superposition of all states via Hadamard Transform]
 B --> C[Modular exponentiation a^x mod N]
 C -->|Quantum Entanglement| D[Collapse to a state with periodicity]
 D --> E[Quantum Fourier Transform QFT]
 E -->|Probability amplification via interference| F[Measurement: Obtain y]
 F --> G[Classical processing: Continued Fraction Expansion]
 G --> H[Discovery of period r]
 H --> I[Calculate prime factors of N]

 style A fill:#f9f,stroke:#333,stroke-width:2px
 style E fill:#bbf,stroke:#333,stroke-width:2px
 style I fill:#bfb,stroke:#333,stroke-width:2px

The Essence of the Paradigm Shift

GNFS takes the approach of “searching for relations within a mathematical space (number field).” However, since the search space expands exponentially with the number of digits, it becomes virtually unsolvable for classical computer capabilities (even including parallelization) when the key length exceeds 2048 bits.

On the other hand, Shor’s algorithm utilizes the “wave nature of quantum interference.” It simultaneously evaluates all computation paths in a superposition state, uses QFT to cancel out (destructively interfere) unnecessary answers, and amplifies (constructively interferes) only the probability amplitude of the period that is the correct answer. Through this, instead of searching space, it realizes a completely different dimensional approach of “making the correct answer itself surface.”

6. Summary

In this article, we deeply compared the mathematical backgrounds and algorithmic structures of “GNFS,” the pinnacle of classical limits, and “Shor’s Algorithm,” which demonstrates the power of quantum computing.

While GNFS drove computational complexity down to sub-exponential time by employing mathematical tricks such as polynomial selection and massive matrix calculations, Shor’s algorithm fused the fundamental principles of quantum mechanics—superposition and interference—with a mathematical tool (QFT), achieving a breakthrough to polynomial time in one stroke.

Currently, Fault-Tolerant Quantum Computers (FTQC) capable of executing Shor’s algorithm at a practical scale (thousands of qubits) do not exist. However, the very existence of this mathematical and theoretical paradigm shift is the primary reason why the transition to Post-Quantum Cryptography (PQC) is urgently being accelerated worldwide today.