Shor–Kitaev Algorithm

• Shor–Kitaev algorithm is a quantum order-finding method that factors integers by encoding the order as an eigenphase using iterative, semiclassical phase estimation.
• It replaces the wide control register with a recycled qubit and classical feedforward, reducing quantum resource requirements while maintaining phase accuracy.
• The algorithm recovers nontrivial factors via continued fractions and gcd operations, ensuring recovery when specific parity and phase conditions are met.

Searching arXiv for the cited papers and related terminology to ground the article in current arXiv records. The Shor–Kitaev algorithm usually denotes Shor’s factoring algorithm implemented through Kitaev’s iterative or semiclassical phase-estimation method: factoring is reduced to order-finding for a randomly chosen $a$ coprime to $N$, the order $r=\operatorname{ord}_N(a)$ is encoded as an eigenphase of modular multiplication, and classical postprocessing by continued fractions and greatest-common-divisor computations extracts nontrivial factors when $r$ satisfies the standard parity and nontriviality conditions (Monz et al., 2015, Barzen et al., 2022). In the quantum-compilation literature, however, the phrase is sometimes used for the distinct Solovay–Kitaev algorithm, which concerns unitary compilation rather than order-finding; the two usages are mathematically unrelated beyond the shared association with Kitaev (Bouland et al., 2021).

1. Terminology and scope

In the factoring literature, the relevant object is the reduction from integer factorization to modular order-finding. Given an odd composite $N$ and a uniformly random $a$ with $\gcd(a,N)=1$, one seeks the least positive integer $r$ such that

$a^r \equiv 1 \pmod N.$

If $r$ is even and $N$0, then the nontrivial factors of $N$1 are obtained from

$N$2

If these conditions fail, the procedure is repeated with a new base $N$3 (Dang et al., 2017, Monz et al., 2015).

The “Kitaev” qualifier refers to the replacement of the wide control register and global QFT of textbook Shor by an iterative, semiclassical phase-estimation loop on a recycled control qubit. This reduces the quantum width from roughly $N$4 qubits to $N$5 quantum qubits, with $N$6, at the cost of mid-circuit measurement, reset, and classical feedforward (Monz et al., 2015, Tankasala et al., 2019).

A persistent source of ambiguity is that “Shor–Kitaev” is also used informally for the Solovay–Kitaev compilation theorem. That usage is nonstandard in the factoring context. The factoring algorithm concerns phase estimation of modular multiplication; the compilation algorithm concerns approximation of arbitrary target unitaries by products from a universal gate library (Bouland et al., 2021).

2. Order-finding as an eigenphase problem

The quantum subroutine is built from the modular-multiplication unitary

$N$7

acting on an $N$8-qubit work register. If $N$9 is the order of $r=\operatorname{ord}_N(a)$0 modulo $r=\operatorname{ord}_N(a)$1, then the orbit generated by repeated multiplication by $r=\operatorname{ord}_N(a)$2 has length $r=\operatorname{ord}_N(a)$3, and one may define eigenstates

$r=\operatorname{ord}_N(a)$4

with

$r=\operatorname{ord}_N(a)$5

Phase estimation of $r=\operatorname{ord}_N(a)$6 therefore returns an estimate of the phase $r=\operatorname{ord}_N(a)$7, from which $r=\operatorname{ord}_N(a)$8 is recovered classically (Tankasala et al., 2019, Shukla et al., 5 Sep 2025).

In the standard QFT-based formulation, a control register of $r=\operatorname{ord}_N(a)$9 qubits is prepared in a uniform superposition and a work register is initialized to $r$0. Controlled powers $r$1 are applied, followed by a QFT on the control register. The pre-QFT joint state can be written as

$r$2

and, when reindexed by the order $r$3, it exhibits an explicit $r$4-term Schmidt structure across the control-work bipartition (Dumitrescu, 2017).

The textbook Shor circuit and the Kitaev-style circuit use the same controlled powers $r$5. Their difference lies in the readout mechanism. In the former, phase information is extracted by a global QFT on a control register of width approximately $r$6. In the latter, the same phase is read out sequentially, bit by bit, using a single recycled control qubit and classical feedback (Dang et al., 2017, Monz et al., 2015).

3. Iterative phase estimation and the semiclassical QFT

Kitaev’s iterative phase-estimation method replaces the $r$7-qubit Fourier register by a one-qubit control recycled across approximately $r$8 stages. At each stage, the control qubit is prepared in $r$9, a controlled-$N$0 is applied, a phase correction depending on earlier measurements is inserted, then a Hadamard is applied and the control is measured. The measured bit is stored classically, the qubit is reset, and the cycle repeats (Monz et al., 2015, Tankasala et al., 2019).

If the unknown phase is $N$1, then at iteration $N$2 the control accumulates phase $N$3. With previously extracted bits $N$4, the classical estimate

$N$5

determines the feedforward angle

$N$6

After the correction and Hadamard, the outcome probabilities are

$N$7

so the next phase bit is obtained from a single-qubit interference experiment rather than a coherent multi-qubit QFT (Tankasala et al., 2019, Shukla et al., 5 Sep 2025).

This architecture is frequently described as a semiclassical QFT or Griffiths–Niu-style inverse QFT. In the Innsbruck ion-trap implementation it appears as $N$8, a semiclassical QFT acting $N$9 times on one physical control qubit with real-time feedforward (Monz et al., 2015). In software-oriented realizations such as Quantum-Kit, the same pattern is implemented by a hybrid circuit containing one recycled quantum control qubit, $a$0 work qubits, and $a$1 classical bits that store measurement outcomes and drive subsequent phase rotations and reinitialization (Tankasala et al., 2019).

The principal resource trade-off is therefore width against latency. Standard Shor uses about $a$2 control qubits plus an $a$3-qubit work register, whereas the Shor–Kitaev variant uses $a$4 quantum qubits and classical memory, but serializes the phase-estimation process (Monz et al., 2015, Tankasala et al., 2019).

4. Continued fractions, recovery guarantees, and success conditions

The classical postprocessing problem is to recover $a$5 from a rational approximation to $a$6. In the QFT-based analysis, one chooses a power-of-two modulus $a$7 satisfying $a$8, measures a value $a$9, and studies $\gcd(a,N)=1$0. The relevant theorem is Legendre’s criterion: if

$\gcd(a,N)=1$1

then $\gcd(a,N)=1$2 is a convergent of the continued-fraction expansion of $\gcd(a,N)=1$3 (Barzen et al., 2022).

For Shor order-finding, the target rational is $\gcd(a,N)=1$4, where $\gcd(a,N)=1$5 is the period. The detailed probability analysis shows that, with probability approximately $\gcd(a,N)=1$6, there exists $\gcd(a,N)=1$7 such that

$\gcd(a,N)=1$8

Under that event, continued fractions recover $\gcd(a,N)=1$9 as a convergent. If $r$0, the denominator is exactly $r$1; if not, the denominator is a proper divisor of $r$2, and repetition is required (Barzen et al., 2022).

In the iterative phase-estimation version, the same continued-fraction criterion applies once the estimated phase $r$3 satisfies

$r$4

A sufficient precision target is $r$5, and in standard presentations one takes about $r$6 phase bits, since $r$7 (Barzen et al., 2022, Shukla et al., 5 Sep 2025).

Order recovery does not by itself guarantee successful factoring. After obtaining a candidate $r$8, one must verify $r$9, then check that $a^r \equiv 1 \pmod N.$0 is even and that $a^r \equiv 1 \pmod N.$1. Only then do the gcd computations yield nontrivial factors. If any condition fails, the run is inconclusive and a new base $a^r \equiv 1 \pmod N.$2 is chosen (Dang et al., 2017, Monz et al., 2015).

5. Entanglement structure and tensor-network simulation

The pre-QFT state generated by modular exponentiation is the entanglement bottleneck of Shor order-finding. A tree tensor network study showed that the control-work bipartition has Schmidt rank exactly $a^r \equiv 1 \pmod N.$3, reflecting the $a^r \equiv 1 \pmod N.$4-fold periodic structure of the “Shor wavefunction,” and that for clusters of $a^r \equiv 1 \pmod N.$5 control qubits the Schmidt number grows exponentially as $a^r \equiv 1 \pmod N.$6 before saturating. When $a^r \equiv 1 \pmod N.$7, measurement of the work register causes the last $a^r \equiv 1 \pmod N.$8 control qubits to disentangle, and the remaining MPS bond dimensions saturate at $a^r \equiv 1 \pmod N.$9 (Dumitrescu, 2017).

Because the Schmidt coefficients in the relevant cuts are equal, the usual tensor-network truncation strategy is ineffective: discarding singular values does not produce a controlled approximation. This explains why exact classical simulation remains exponentially hard in worst-case instances with large $r$0, even though moderate instances can be tractable when $r$1 or its odd part is small (Dumitrescu, 2017).

A subsequent matrix-product-state optimization sharpened this picture by writing

$r$2

and partitioning the control register into the $r$3 least-significant qubits $r$4 and the remaining qubits $r$5. Immediately prior to measuring the work register $r$6, the $r$7 qubits primarily entangle with $r$8, while the $r$9 qubits carry the multipartite $N$00-dependent entanglement. After measuring $N$01, the $N$02 qubits become completely separable, and only $N$03 remains entangled (Dang et al., 2017).

The key optimization is therefore the dynamic MPS embedding

$N$04

rather than a static layout with all control qubits on one side of the work register. In the dynamic layout, the MPS matrices for qubits in $N$05 are smaller by a factor $N$06 than in the static layout, so space requirements depend on the factors of $N$07 rather than on $N$08 itself. The same work reported a 60-qubit simulation of Shor’s algorithm for $N$09, $N$10, and $N$11, where $N$12; the computation used 216 nodes, 5184 cores, and 13.824 TB of RAM, with total time approximately $N$13 s (Dang et al., 2017).

6. Physical realizations, desktop simulation, and modular extensions

A trapped-ion realization demonstrated a fully scalable Kitaev-style Shor algorithm for $N$14. The implementation effectively employed and controlled seven qubits and four “cache-qubits,” together with generalized arithmetic operations known as modular multipliers. It used one recycled control qubit, mid-circuit measurement, reset, and feedforward, and reported success probabilities in excess of $N$15. For bases $N$16, the measured orders were $N$17, and the squared statistical overlap with the ideal output distributions exceeded $N$18 for all tested bases (Monz et al., 2015).

Desktop-scale simulation has also been demonstrated in the semiclassical regime. Quantum-Kit implemented the Shor–Kitaev variant with one recycled control qubit and $N$19 classical bits, reporting factorization of the 20-bit integer $N$20 with 21 qubits in $N$21 s on a single-core desktop, and factorization of the 24-bit integer $N$22 in about $N$23 s with 25 qubits and 48 classical bits. For the 24-bit case, two runs recovered $N$24 and factors $N$25 and $N$26 (Tankasala et al., 2019).

More recent work preserves the Kitaev philosophy of a small phase register but moves from strictly one-bit-at-a-time estimation to modular windowing. In that formulation, phase estimation is decomposed into shallow, independent QPE blocks of size $N$27, often three or four qubits, with overlaps and a carry-aware stitching rule used to reconstruct a consistent eigenphase. The work register requirement is unchanged, but the active counting register is reduced from approximately $N$28 qubits to $N$29, and the blocks can be executed sequentially or in parallel (Shukla et al., 5 Sep 2025). This suggests a direct lineage from the Shor–Kitaev semiclassical reduction of width toward later blockwise, overlap-assisted phase-estimation architectures.

7. Distinct compilation usage: the Solovay–Kitaev algorithm

In quantum compilation, “Shor–Kitaev” is sometimes used informally for the Solovay–Kitaev algorithm, but this denotes a different problem class. The compilation problem takes a finite universal gate set $N$30 or $N$31 and asks for a gate sequence $N$32 such that $N$33 for a target unitary $N$34. In the classic inverse-closed setting, Solovay–Kitaev achieves polylogarithmic sequence length: $N$35 with the standard exponent $N$36 (Bouland et al., 2021).

The 2021 inverse-free extension removed the inverse-closed assumption entirely. For any fixed $N$37 and any gate set that densely generates $N$38, it provides an efficient algorithm using $N$39 gates, with exponent

$N$40

and $N$41 for a qubit. The construction relies on approximate generalized Pauli operators and self-correcting sequences such as $N$42 in the qubit case and $N$43 in general dimension, which serve as inverse factories without exact inverses (Bouland et al., 2021).

The distinction is therefore categorical. Shor–Kitaev in the factoring sense is an order-finding algorithm based on modular multiplication, phase estimation, continued fractions, and gcd extraction. Solovay–Kitaev is a recursive approximation theorem for unitary synthesis. Confusing the two obscures both the computational objective and the technical machinery involved (Bouland et al., 2021).