--- title: Shor–Kitaev Algorithm url: https://www.emergentmind.com/topics/shor-kitaev-algorithm type: topic --- # Shor–Kitaev Algorithm Searching arXiv for the cited papers and related terminology to ground the article in current arXiv records. The **Shor–Kitaev algorithm** usually denotes Shor’s factoring algorithm implemented through Kitaev’s iterative or semiclassical phase-estimation method: factoring is reduced to order-finding for a randomly chosen \(a\) coprime to \(N\), the order \(r=\operatorname{ord}_N(a)\) is encoded as an eigenphase of modular multiplication, and classical postprocessing by continued fractions and greatest-common-divisor computations extracts nontrivial factors when \(r\) satisfies the standard parity and nontriviality conditions [1507.08852, 2205.01925]. In the quantum-compilation literature, however, the phrase is sometimes used for the distinct Solovay–Kitaev algorithm, which concerns unitary compilation rather than order-finding; the two usages are mathematically unrelated beyond the shared association with Kitaev [2112.02040]. ## 1. Terminology and scope In the factoring literature, the relevant object is the reduction from integer factorization to modular order-finding. Given an odd composite \(N\) and a uniformly random \(a\) with \(\gcd(a,N)=1\), one seeks the least positive integer \(r\) such that \[ a^r \equiv 1 \pmod N. \] If \(r\) is even and \(a^{r/2}\not\equiv -1 \pmod N\), then the nontrivial factors of \(N\) are obtained from \[ \gcd(a^{r/2}-1,N),\qquad \gcd(a^{r/2}+1,N). \] If these conditions fail, the procedure is repeated with a new base \(a\) [1712.07311, 1507.08852]. The “Kitaev” qualifier refers to the replacement of the wide control register and global QFT of textbook Shor by an iterative, semiclassical phase-estimation loop on a recycled control qubit. This reduces the quantum width from roughly \(3n\) qubits to \(n+1\) quantum qubits, with \(n=\lceil \log_2 N\rceil\), at the cost of mid-circuit measurement, reset, and classical feedforward [1507.08852, 1908.07187]. A persistent source of ambiguity is that “Shor–Kitaev” is also used informally for the Solovay–Kitaev compilation theorem. That usage is nonstandard in the factoring context. The factoring algorithm concerns phase estimation of modular multiplication; the compilation algorithm concerns approximation of arbitrary target unitaries by products from a universal gate library [2112.02040]. ## 2. Order-finding as an eigenphase problem The quantum subroutine is built from the modular-multiplication unitary \[ U_a |x\rangle = |a x \bmod N\rangle, \] acting on an \(n\)-qubit work register. If \(r\) is the order of \(a\) modulo \(N\), then the orbit generated by repeated multiplication by \(a\) has length \(r\), and one may define eigenstates \[ |u_s\rangle = \frac{1}{\sqrt r}\sum_{k=0}^{r-1} e^{-2\pi i s k/r}|a^k \bmod N\rangle, \] with \[ U_a |u_s\rangle = e^{2\pi i s/r}|u_s\rangle. \] Phase estimation of \(U_a\) therefore returns an estimate of the phase \(s/r\), from which \(r\) is recovered classically [1908.07187, 2509.05010]. In the standard QFT-based formulation, a control register of \(t\) qubits is prepared in a uniform superposition and a work register is initialized to \(|1\rangle\). Controlled powers \(U_a^{2^j}\) are applied, followed by a QFT on the control register. The pre-QFT joint state can be written as \[ |\Psi\rangle = 2^{-n/2}\sum_{x=0}^{2^n-1} |x\rangle \otimes |a^x \bmod N\rangle, \] and, when reindexed by the order \(r\), it exhibits an explicit \(r\)-term Schmidt structure across the control-work bipartition [1705.01140]. The textbook Shor circuit and the Kitaev-style circuit use the same controlled powers \(U_a^{2^j}\). Their difference lies in the readout mechanism. In the former, phase information is extracted by a global QFT on a control register of width approximately \(2n\). In the latter, the same phase is read out sequentially, bit by bit, using a single recycled control qubit and classical feedback [1712.07311, 1507.08852]. ## 3. Iterative phase estimation and the semiclassical QFT Kitaev’s iterative phase-estimation method replaces the \(2n\)-qubit Fourier register by a one-qubit control recycled across approximately \(2n\) stages. At each stage, the control qubit is prepared in \(|+\rangle\), a controlled-\(U_a^{2^j}\) is applied, a phase correction depending on earlier measurements is inserted, then a Hadamard is applied and the control is measured. The measured bit is stored classically, the qubit is reset, and the cycle repeats [1507.08852, 1908.07187]. If the unknown phase is \(\phi\), then at iteration \(m\) the control accumulates phase \(2\pi 2^m \phi\). With previously extracted bits \(b_0,\dots,b_{m-1}\), the classical estimate \[ \tilde{\phi}_m = \sum_{\ell=0}^{m-1} \frac{b_\ell}{2^{m-\ell}} \] determines the feedforward angle \[ \theta_m = -2\pi \tilde{\phi}_m. \] After the correction and Hadamard, the outcome probabilities are \[ P(b_m=0)=\cos^2\!\big(\pi(2^m\phi-\tilde{\phi}_m)\big),\qquad P(b_m=1)=\sin^2\!\big(\pi(2^m\phi-\tilde{\phi}_m)\big), \] so the next phase bit is obtained from a single-qubit interference experiment rather than a coherent multi-qubit QFT [1908.07187, 2509.05010]. This architecture is frequently described as a semiclassical QFT or Griffiths–Niu-style inverse QFT. In the Innsbruck ion-trap implementation it appears as \(KQFT^{(M)}\), a semiclassical QFT acting \(M\) times on one physical control qubit with real-time feedforward [1507.08852]. In software-oriented realizations such as Quantum-Kit, the same pattern is implemented by a hybrid circuit containing one recycled quantum control qubit, \(n\) work qubits, and \(2n\) classical bits that store measurement outcomes and drive subsequent phase rotations and reinitialization [1908.07187]. The principal resource trade-off is therefore width against latency. Standard Shor uses about \(2n\) control qubits plus an \(n\)-qubit work register, whereas the Shor–Kitaev variant uses \(n+1\) quantum qubits and classical memory, but serializes the phase-estimation process [1507.08852, 1908.07187]. ## 4. Continued fractions, recovery guarantees, and success conditions The classical postprocessing problem is to recover \(r\) from a rational approximation to \(k/r\). In the QFT-based analysis, one chooses a power-of-two modulus \(N\) satisfying \(n^2 < N < 2n^2\), measures a value \(y\), and studies \(x=y/N\). The relevant theorem is Legendre’s criterion: if \[ \left|x-\frac{a}{b}\right| < \frac{1}{2b^2}, \] then \(a/b\) is a convergent of the continued-fraction expansion of \(x\) [2205.01925]. For Shor order-finding, the target rational is \(k/p\), where \(p\) is the period. The detailed probability analysis shows that, with probability approximately \(4/\pi^2\), there exists \(k\in\{0,\dots,p-1\}\) such that \[ \left|\frac{y}{N}-\frac{k}{p}\right| < \frac{1}{2p^2}. \] Under that event, continued fractions recover \(k/p\) as a convergent. If \(\gcd(k,p)=1\), the denominator is exactly \(p\); if not, the denominator is a proper divisor of \(p\), and repetition is required [2205.01925]. In the iterative phase-estimation version, the same continued-fraction criterion applies once the estimated phase \(\hat{\phi}\) satisfies \[ |\hat{\phi}-k/p| \le \frac{1}{2p^2}. \] A sufficient precision target is \(m \ge \lceil 2\log_2 p\rceil + O(1)\), and in standard presentations one takes about \(2n\) phase bits, since \(p