Shor’s Factoring Algorithm

Carsten Urbach

In order to break RSA cryptography one needs to be able to factorise a large integer \(n\), which is known to be the product of two prime numbers \(n=p q\).

Factoring Algorithm

Given an integer \(n\), the factoring algorithm determines \(p, q\) such that \(n=pq\). We assume \(p,q\neq 1\).

  1. Choose \(m, 1\leq m \leq n\) uniformnly random with \(m\) co-prime to \(n\).
  2. Find the order \(r\) of \(m\) modulo \(n\).
  3. If \(r\) is even, compute \(l=\mathrm{gcd}(m^{r/2}-1, n)\)
  4. If \(l>1\) then \(l\) is a factor of \(n\). Otherwise, or if \(r\) is odd start with 1 for another value of \(m\).

Greatest common divisor

Euclid described a classical algorithm for finding the greatest common divisor (gcd) of two positive integers \(m > n\). It may be implemented recursively as follows:

Order finding

Another ingredient is the order finding algorithm, which we are also going to solve classically here, actually with the most naive algorithm

Factoring

Shor’s algorithms can be implemented as follows

And we can test whether it works

m= 25 
[1] 5
m= 86 
r= 12 
[1] 7
m= 504 
[1] 7

Note that this computation is a bit tricky in R because of the integer arithmetic with large integers. However, for our example here, the code is sufficient.