Abstract In 1994, Shor introduced his famous quantum algorithm to factor integers and compute discrete logarithms in polynomial time. In 2023, Regev proposed a multidimensional version of Shor’s algorithm that requires far fewer quantum gates. His algorithm relies on a number-theoretic conjecture on the elements in $(\mathbb {Z}/N\mathbb {Z})^{\times }$ that can be written as short products of very small prime numbers. We prove a version of this conjecture using tools from analytic number theory such as zero-density estimates. As a result, we obtain an unconditional proof of correctness of this improved quantum algorithm and of subsequent variants.
Abstract In 1994, Shor introduced his famous quantum algorithm to factor integers and compute discrete logarithms in polynomial time. In 2023, Regev proposed a multidimensional version of Shor’s algorithm that requires far fewer quantum gates. His algorithm relies on a number-theoretic conjecture on the elements in (Z/NZ)× that can be written as short products of very small prime numbers. We prove a version of this conjecture using tools from analytic number theory such as zero-density estimates. As a result, we obtain an unconditional proof of correctness of this improved quantum algorithm and of subsequent variants.
Factoring large integers has long been a computationally difficult problem in classical computing, forming the foundation of widely used encryption methods like RSA. In 1994, Shor’s quantum algorithm introduced a revolutionary method for factoring integers exponentially faster than classical algorithms, laying the groundwork for quantum cryptography. Despite numerous attempts to enhance Shor’s algorithm over the last three decades, significant breakthroughs remained elusive until Regev’s discovery in 2023. Regev introduced a novel, multi-dimensional version of the quantum factoring algorithm, achieving a substantial improvement by reducing the required number of quantum gates to O(n^2 lo gn )(n^(3/2) logn ), compared to Shor’s originalO(n^2 lo gn )original O(n^2 logn ) gate complexity. Although Regev’s approach offers a significant speedup, it comes with increased qubit requirements and relies on an unproven number theory assumption. This paper presents an overview of Regev’s factoring algorithm, including a review of Shor’s work for context, followed by an examination of key recent developments and follow-up research. These include efforts to reduce the qubit count, improve error resilience, generalizegeneralise Regev’s algorithm to related problems, and validate the number theory assumption. This review serves as an accessible entry point for researchers interested in the rapidly evolving field of quantum computing and factoring algorithms.
Abstract: Oded Regev's multidimensional quantum factoring algorithm (J. ACM 2025) reduced the sequential quantum circuit depth of factoring from Shor's algorithm down to square-root-of-n modular squarings, requiring O(n^(1.5)) quantum gates per run across O(sqrt(n)) runs. However, four fundamental bottlenecks remained: (1) an exponential LLL lattice-reduction loss that inflated the quantum Gaussian radius and tripled the required squarings; (2) a high qubit memory footprint, where reversible uncomputation required storing large intermediate states or suffering huge time penalties; (3) holding all input dimensions in quantum memory required large coherent registers; and (4) mathematical correctness depended on an unproven heuristic assumption on short lattice vectors. We present a unified quantum-classical architecture that resolves these bottlenecks and establishes new complexity frontiers for quantum factorization: (1) Lattice Post-Processing Overhaul: By replacing LLL with polynomial-time Block Korkine-Zolotarev (BKZ) reduction and quantum sample amplification, we eliminate the exponential transference loss, shrinking the Gaussian radius exponent by 3x and cutting critical-path modular depth by 6x through Windowed Horizon Aggregation. (2) Pebbling-Free Dual-Inverse Arithmetic: By integrating radius compression into dual-inverse Zeckendorf-Fibonacci reversible arithmetic, we eliminate intermediate storage checkpoints with zero time penalty, reducing total memory to approximately 7.44n qubits. (3) Streamed Estimation in 4n Qubits: Combining radius compression with streamed backwards Fibonacci quantum phase estimation shrinks the required ladder depth by 3x, executing the entire attack on a recycled control register using only 4n coherent qubits (or 3n qubits with in-place arithmetic). For RSA-2048, this cuts continuous coherence runtime from 8.0 hours down to 8.2 minutes (a 58x speedup over Shor's algorithm). (4) Sub-O(n^(1.5)) Gate Frontier: We prove an Arithmetic-Geometric Mean (AM-GM) transference lower bound showing that unstructured lattices cannot break below n^(1.5) gates in polynomial classical time, and circumvent this barrier for smooth-quotient composite moduli using a block-projected pipeline to achieve O(n^(4/3) log n) quantum gates. (5) Unconditional Correctness: Using Cedric Pilatte's analytic number theory framework (zero-density estimates and p-torsion stabilization), we unconditionally prove that the lattice algorithm factors any composite number N in strictly polynomial classical time with single-batch success probability of at least 31.25% (approaching 37.5%). Under the Generalized Riemann Hypothesis, factoring requires only 4n qubits and small prime bases. --- AI Research and Authorship Disclosure: In full accordance with international scientific disclosure standards, open-access repository guidelines on AI-assisted research, and ACM/IEEE policies on generative artificial intelligence, the provenance, governance, and execution of this work are delineated as follows: 1. Conceptual Initiative, Research Vision, and Workflow Direction (Denis Gnitiyov):The foundational research initiative to achieve this breakthrough was conceived and launched by Denis Gnitiyov upon studying Oded Regev's multidimensional quantum factoring framework. Acknowledging that the high-level advanced mathematics (higher-dimensional lattice geometry, analytic number theory, and fault-tolerant quantum circuit synthesis) exceeds manual human calculation, Denis Gnitiyov conceived the project vision, established the initiative to systematically eliminate the theoretical and physical bottlenecks of the Regev paradigm, directed the multi-LLM research workflow, and maintained supervisory governance over the end-to-end scientific pipeline. 2. Paper Architecture, Bottleneck Formulation, and Orchestration (Gemini Flash 3.8):Gemini Flash 3.8 served as the paper builder, systems architect, and research orchestrator. Operating under Denis Gnitiyov's initiative, Gemini Flash 3.8 ingested and dissected Regev's multidimensional factoring research, systematically analyzed the theoretical framework to identify and formulate the four foundational bottlenecks, structured the overarching modular paper architecture, formulated the specific mathematical target problems to be solved, and handled the complete synthesis, typesetting, and mathematical structuring of the LaTeX manuscript. 3. Advanced Mathematical Discovery, Derivations, and Proof Engineering (Gemini Argon 4):Gemini Argon 4 served as the primary mathematical reasoning and discovery engine. In response to the technical bottlenecks and problem formulations established by Gemini Flash 3.8, Gemini Argon 4 derived the formal mathematical proofs and quantum circuit synthesis, including lattice transference separation under BKZ, the AM-GM transference barrier and smooth-quotient algorithm, Pilatte's unconditional p-torsion bounds, and reversible Zeckendorf-Fibonacci arithmetic.
We provide two improvements to Regev's recent quantum factoring algorithm (Journal of the ACM 2025), addressing its space efficiency and its noise-tolerance. Our first contribution is to improve the quantum space efficiency of Regev's algorithm while keeping the circuit size the same. Our main result constructs a quantum factoring circuit using O(nlogn) qubits and O(n3/2logn) gates. We achieve the best of Shor and Regev (upto a logarithmic factor in the space complexity): on the one hand, Regev's circuit requires O(n3/2) qubits and O(n3/2logn) gates, while Shor's circuit requires O(n2logn) gates but only O(nlogn) qubits. As with Regev, to factor an n-bit integer N, we run our circuit independently O(n) times and apply Regev's classical postprocessing procedure. Our optimization is achieved by implementing efficient and reversible exponentiation with Fibonacci numbers in the exponent, rather than the usual powers of 2, adapting work by Kaliski (arXiv:1711.02491) from the classical reversible setting to the quantum setting. This technique also allows us to perform quantum modular exponentiation that is efficient in both space and size without requiring significant precomputation, a result that may be useful for other quantum algorithms. A key ingredient of our exponentiation implementation is an efficient circuit for a function resembling in-place quantum-quantum modular multiplication. Our second contribution is to show that Regev's classical postprocessing procedure can be modified to tolerate a constant fraction of the quantum circuit runs being corrupted by errors. In contrast, Regev's analysis of his classical postprocessing procedure requires all ≈n runs to be successful. In a nutshell, we achieve this using lattice reduction techniques to detect and filter out corrupt samples.
This thesis contains a collection of efficient quantum algorithms and classical pre- and post-processing algorithms for various number- and group-theoretical problems with concrete cryptanalytical applications. More specifically, the focus is on the integer factoring problem (IFP), the discrete logarithm problem (DLP), and the order-finding problem (OFP), and on certain important variations of these problems. It is for example explained how the OFP and complete IFP may be solved efficiently in a single run of a reduced version of Shor's algorithm for the OFP with very high success probability, as evidenced by a lower bound that is 1 − o(1), how the short DLP in groups of unknown order may be solved efficiently and with an advantage over Shor's algorithm for the DLP (that furthermore requires the order to be known), as evidenced by a lower bound on the single-run success probability that is 1 − o(1), how the RSA IFP may be solved efficiently and with an advantage over Shor's algorithm for the IFP, by reducing the RSA IFP to a short DLP, how the DLP may heuristically be solved efficiently, and with high success probability that is 1 − o(1), in a single run of a reduced version of Shor’s algorithm for the DLP that admits efficient implementation, how the DLP may be solved in groups of unknown order, such as Schnorr groups, by jointly solving an OFP and a DLP at lower overall cost but higher per-run cost compared to first solving the OFP and then the DLP, how tradeoffs — between the number of group operations that are evaluated quantumly and the number of runs that are required — may be achieved in all of the aforementioned algorithms, and how all of the aforementioned algorithms may be simulated efficiently classically, for arbitrary large cryptographically relevant problem instances, when the solution to the instance is known, enabling the number of runs required when performing tradeoffs to be tightly estimated. It is furthermore for example explained how Regev's recent quantum algorithm for the IFP may be extended to the DLP and OFP, yielding i) a reduction in the circuit size and depth by a factor compared to Shor for these problems when working in , for N an n-bit integer, at the expense of performing runs, and ii) slight improvements of Regev's orginal algorithm for the IFP, how the above algorithms may be simulated efficiently classically, for large special-form problem instances that are classically tractable, and that Regev’s post-processing, and the post-processing for our extensions, are robust to an arbitrarily large fraction < 1 of the runs being bad. The above has implications for cryptography based on the intractability of the IFP and DLP — including but not limited to for widely used schemes such as RSA, DSA and Diffie–Hellman. The algorithms in this thesis are all derived from, and make notable improvements to, the seminal works of Shor. Some of the contributions are joint works with other authors.
We present our perspectives on the current status of, integer factoring and discrete logarithm, algorithms underlying the strength of classical public-key cryptography protocols used in key-exchange, encryption and digital signatures. We present an expository overview of the algebraic, number-theoretic and algorithmic principles behind the canonical, powerful algorithms used in the factoring of large, composite RSA modulii. These cover the two main ideas of group order based methods, and quadratic congruence based methods. We provide the resource estimates for the record breaking factoring based on the general number field sieve. Next we present an overview of the algorithmic theory of quantum computation behind, the polynomial time Shor's quantum algorithm for, period finding in hidden subgroup structure problems. This algorithm has played a key role in advancing post-quantum cryptography, and also in the exciting, contemporary developments in quantum computing, networking, sensing, and materials science as a whole. Latest advances in quantum computing rest on a variety of physics, engineering, algorithms, compilation, hardware, software techniques. There are several tradeoffs based on number of qubits, coherence times, control issues, errors and fault tolerance. In this environment, nuances of mathematical ideas, behind every step of the intricate arithmetical and algebraic computations under quantum models plays a significant role. We provide an overview of some of the recent ideas behind such algorithms. We conclude with a recent deep question on the ultimate feasibility of ultra large-scale, error-free, discrete, quantum computations required typically in cryptanalysis.
Abstract We generalize our earlier works on computing short discrete logarithms with tradeoffs, and bridge them with Seifert's work on computing orders with tradeoffs, and with Shor's groundbreaking works on computing orders and general discrete logarithms. In particular, we enable tradeoffs when computing general discrete logarithms. Compared to Shor's algorithm, this yields a reduction by up to a factor of two in the number of group operations evaluated quantumly in each run, at the expense of having to perform multiple runs. Unlike Shor's algorithm, our algorithm does not require the group order to be known. It simultaneously computes both the order and the logarithm. We analyze the probability distributions induced by our algorithm, and by Shor's and Seifert's order-finding algorithms, describe how these algorithms may be simulated when the solution is known, and estimate the number of runs required for a given minimum success probability when making different tradeoffs.