Shor's Algorithm: Quantum Factoring

• Shor's algorithm is a quantum period-finding method that factors integers and computes discrete logarithms using the quantum Fourier transform.
• It combines coherent modular arithmetic with quantum phase estimation to reduce the hardness assumptions underpinning RSA, Diffie–Hellman, and ECC.
• Research focuses on optimizing modular exponentiation, fault-tolerant circuit designs, and resource estimates to scale quantum factorization for practical cryptographic threats.

Shor’s algorithm is a quantum algorithm for integer factorization and discrete logarithms that reduces these problems to order-finding or period-finding and solves the quantum subroutine by combining coherent modular arithmetic with the quantum Fourier transform (QFT). In the fault-tolerant regime it runs in polynomial time in the bit-length of the input, in contrast to the sub-exponential classical status of general-purpose factoring, and it therefore undercuts the hardness assumptions underlying RSA, Diffie–Hellman, and elliptic-curve cryptography (Bagourd et al., 17 Dec 2025, Huang et al., 18 Feb 2025).

1. Problem setting and cryptographic significance

Shor’s algorithm addresses two central number-theoretic tasks: integer factorization and discrete logarithms. For factoring, the input is a composite integer $N$, typically $N=pq$ with $p,q$ prime. For discrete logarithms, the input is a group element $h$ in a cyclic subgroup generated by $g$, and the objective is to recover the exponent $s$ such that $h=g^s$. The same period-finding template applies in both settings, with the concrete function $f$ determined by the ambient algebraic structure (Bagourd et al., 17 Dec 2025, Huang et al., 18 Feb 2025).

The cryptographic relevance is direct. RSA relies on the hardness of factoring a large modulus $N=pq$, while many discrete-log based schemes, including finite-field Diffie–Hellman and elliptic-curve cryptography, rely on the hardness of discrete logarithm problems. A sufficiently large, fault-tolerant quantum computer running Shor’s algorithm would therefore break essentially all widely deployed public-key cryptosystems of these types at cryptographically relevant sizes (Bagourd et al., 17 Dec 2025).

Peter Shor introduced the algorithm in 1994, and later literature has treated it as the paradigmatic example of an exponential quantum speedup for an arithmetically natural problem. At a structural level, the algorithm is hybrid: the quantum component is used only for order-finding, while gcd computations, continued fractions, and factor extraction remain classical (Bagourd et al., 17 Dec 2025, Monz et al., 2015).

2. Classical reduction from factoring to order-finding

For factoring, the classical front end selects an integer $a$ with $N=pq$0. If $N=pq$1, a nontrivial factor has already been found. Otherwise one defines the order of $N=pq$2 modulo $N=pq$3 as

$N=pq$4

The function

$N=pq$5

is periodic with period $N=pq$6, and the factorization problem is reduced to finding this period efficiently (Bagourd et al., 17 Dec 2025, Smolin et al., 2013).

Once $N=pq$7 is known, the classical post-processing is elementary. If $N=pq$8 is even and

$N=pq$9

then

$p,q$0

yield nontrivial factors with high probability. If $p,q$1 is odd, or if $p,q$2, the attempt fails for that choice of $p,q$3 and the procedure is repeated (Bagourd et al., 17 Dec 2025, Monz et al., 2015).

This order-centric view is broad enough that one line of work reinterprets Shor’s method as a particular case of a quantum version of Pollard’s Rho. In that formulation, choosing the iterated map $p,q$4 leads to the sequence $p,q$5, and the standard Shor factor-extraction step becomes a collision-detection condition in the Pollard framework (Bastos et al., 2020). This suggests that the essential computational object is not factorization per se, but periodic structure in modular dynamics.

3. Quantum subroutine: modular exponentiation, QFT, and phase estimation

The textbook order-finding circuit uses two registers. The first register, of size $p,q$6 with $p,q$7, is prepared in a uniform superposition, and the second register stores residues modulo $p,q$8. After Hadamards on the first register, the state is transformed by modular exponentiation into

$p,q$9

Because $h$0 is periodic in $h$1 with period $h$2, the first register carries a hidden frequency structure that can be extracted by the QFT (Bagourd et al., 17 Dec 2025, Smolin et al., 2013).

Applying the QFT to the first register maps

$h$3

and measurement yields an outcome $h$4 such that $h$5 is close to $h$6 for some integer $h$7. Classical continued-fraction reconstruction then recovers a candidate denominator $h$8, which is verified by checking whether $h$9 (Bagourd et al., 17 Dec 2025, Monz et al., 2015).

A complementary formulation uses quantum phase estimation. If

$g$0

acts on the work register, then eigenstates of $g$1 have eigenvalues $g$2, so estimating the eigenphase $g$3 is equivalent to order-finding. This phase-estimation view is central to Kitaev-style iterative variants, where the multi-qubit QFT register is replaced by a single recycled qubit and classical feed-forward (Xiao et al., 2022, Monz et al., 2015).

Kitaev’s semiclassical formulation sharply reduces qubit count. For an $g$4-bit $g$5, the original layout uses $g$6 computational qubits and $g$7 QFT qubits, whereas the iterative version uses $g$8 computational qubits and one recycled QFT qubit, reducing the total from $g$9 to $s$0 qubits at the price of deeper sequential control logic (Monz et al., 2015). Distributed variants extend the same phase-estimation logic across multiple processors: one proposal uses two quantum computers to estimate partial bits of $s$1, synchronizes them with quantum teleportation, and reduces nearly $s$2 qubits per device relative to a traditional multi-control-register implementation (Xiao et al., 2022).

4. Arithmetic synthesis and asymptotic resources

The computational bottleneck is modular exponentiation. Implementing

$s$3

requires controlled modular multiplications, which in turn require reversible addition, subtraction, comparison, and multiplication circuits. QFT itself is comparatively cheap; the dominant cost lies in arithmetic synthesis and ancilla management (Bagourd et al., 17 Dec 2025, Liu et al., 2021).

This asymmetry is visible in hardware-oriented resource analyses. A CNOT-count-optimized construction for factoring an $s$4-bit integer gives a total count

$s$5

for one run of Shor’s algorithm, with the $s$6 term coming from QFT and the leading term from modular exponentiation. The same work analyzes ion-trap runtime under CNOT-dominated cost and gives a lower-bound style estimate of 72 years for factoring a 1024-bit RSA modulus under its fault-tolerant assumptions (Liu et al., 2021).

More recent architectural estimates, discussed in a survey of practical challenges, still place RSA-2048 factoring firmly in the fault-tolerant era rather than the NISQ era. The survey reports resource estimates ranging from 20 million physical qubits for an 8-hour attack, to 13,436 qubits with a multimode memory for a 177-day attack, and also discusses later sub-million-noisy-qubit estimates, all of which still presume robust fault-tolerant control well beyond current public devices (Bagourd et al., 17 Dec 2025).

Current work on resource optimization often restructures the phase-estimation layer rather than changing the arithmetic objective. A modular, windowed formulation of Shor’s algorithm decomposes the counting register into shallow independent blocks with overlap and classical stitching; it leaves the work register unchanged but reduces the counting register per block to a few qubits, for example three or four, while preserving the order-finding logic (Shukla et al., 5 Sep 2025). A related near-term reduction strategy proposes a reduced version of Shor’s algorithm that does not use assumptions on the number to factor, often factors with only one iteration, and in simulator comparisons matches the original algorithm for some numbers considered (Rossi et al., 2021).

5. Experimental realizations, compiled circuits, and interpretive cautions

Experimental demonstrations have historically focused on very small composites, especially $s$7 and $s$8, across NMR, photonic, trapped-ion, Josephson phase-qubit, and superconducting platforms. A recurring limitation is that these realizations almost always use compiled circuits: large parts of generic modular exponentiation are simplified or removed using classical knowledge of the factors or of the period structure, so they remain proofs of principle rather than blind factoring procedures (Bagourd et al., 17 Dec 2025).

This point has been made sharply in the literature on compiled Shor circuits. A particularly explicit critique shows that for any $s$9 with distinct odd primes, one can choose a base $h=g^s$0 with period $h=g^s$1, yielding a compiled “factoring” circuit that uses only two coherent qubits and constant quantum time. The same work argues that the relevant experimental difficulty is not the size of the number factored but the length of the period actually found, and that allowing the compiler to exploit prior knowledge of the factors can trivialize the quantum portion of the task (Smolin et al., 2013).

Against that backdrop, a major milestone was the ion-trap realization of a fully scalable Shor algorithm in the Kitaev style, factoring 15 by effectively employing and controlling seven qubits and four cache-qubits, together with generalized modular multipliers, and reporting success probabilities in excess of 90% (Monz et al., 2015). The significance of that experiment lay less in the size of $h=g^s$2 than in the faithful implementation of scalable ingredients: modular multipliers, qubit recycling, feed-forward, and full-register control.

Large-scale classical simulation has become a complementary probe of the algorithm beyond present hardware. GPU-based simulation of iterative Shor circuits has factored the semiprime

$h=g^s$3

without exploiting prior knowledge of the solution, and has shown average success probabilities above 50% for the original algorithm because of a high frequency of “lucky” cases. The same study reports a post-processing procedure that can bring the success probability arbitrarily close to one with only a single run of the quantum algorithm and explicitly challenges quantum hardware to factor a non-trivial semiprime larger than this without oversimplification (Willsch et al., 2023).

The literature also contains deliberately provocative comparisons that separate logical structure from genuine quantum advantage. A room-temperature realization based on classical pass-transistor logic reproduced the full logical structure of Shor’s subroutine for 15 with the same asymptotic resource scaling as a scalable quantum computer, but without quantum speedup, in order to clarify which features of experimental demonstrations are genuinely quantum and which are circuit-theoretic (Johansson et al., 2017).

6. Generalizations, noise, and current research directions

Shor’s algorithm is not confined to factoring. In finite-field discrete logarithms, the quantum circuit evaluates

$h=g^s$4

and QFT on two exponent registers recovers the linear relation needed to solve for the discrete log. Large-scale simulation over all 1,860 possible pairs $h=g^s$5 up to 32 qubits has shown that the success probability is a periodic function of the subgroup order $h=g^s$6, clarified its detailed waveform, and quantified a substantial gap between safe-prime and Schnorr groups: with a ripple-carry adder, a Schnorr group with $h=g^s$7 bits is almost equivalent, under Shor’s algorithm, to a safe-prime group with $h=g^s$8 bits (Kishi et al., 31 Mar 2025).

For elliptic curves, the same period-finding template applies to the map

$h=g^s$9

The dominant cost is reversible point addition, so coordinate choice becomes a quantum resource question rather than a purely classical implementation question. One recent analysis shows that projective coordinates, despite their classical advantages, do not provide the same advantages as affine coordinates when using Shor’s method to tackle the ECDLP; in the compared constructions, affine Weierstrass arithmetic remains superior in depth, gate count, and qubit count (Huang et al., 18 Feb 2025).

Noise and state-preparation dependence remain active topics. A generalized analysis of Shor’s algorithm with arbitrary pure initial states in register $f$0 and pseudo-pure states on $f$1 derives both lower and upper performance bounds and proves that, for pseudo-pure initialization,

$f$2

where $f$3 is the success probability for the corresponding pure-state initialization (Ye et al., 16 Aug 2025). This makes precise how ensemble mixedness suppresses order-finding performance while preserving the same underlying structure.

Circuit-level noise studies refine the picture further. One recent analysis of the original Shor circuit reports substantially better fault tolerance under $f$4 noise than under $f$5 or $f$6 noise, finds that fault-tolerant positions under $f$7 noise scale with the same quartic order as the total number of possible error positions, and extrapolates that the minimum probability of a correct output for the modular exponentiation circuit in factoring 2048-bit integers under biased noise is approximately $f$8 (Yang et al., 30 Aug 2025). This suggests a highly asymmetric noise sensitivity: some phase-noise structure is tolerated far better than bit-flip structure, but the regime required for cryptographically relevant factoring remains far beyond present NISQ error rates.

Taken together, these developments place Shor’s algorithm in a dual role. It remains the canonical asymptotic demonstration that quantum computation changes the complexity landscape of number theory, but it has also become a detailed engineering object whose arithmetic synthesis, compilation discipline, state preparation, noise model, and architectural embedding all materially affect realizability. The long-term cryptographic threat is therefore not in dispute; what remains unsettled is the path from small, often compiled demonstrations to large, fault-tolerant, blind executions of the full algorithm (Bagourd et al., 17 Dec 2025).