Shor's Algorithm
Shor's Algorithm for Integer Factorization and Discrete Logarithm · Also known as: Shor factorization, quantum factorization
Shor's Algorithm is a polynomial-time quantum algorithm for factoring large integers and computing discrete logarithms, problems believed to be intractable on classical computers. Discovered by Peter Shor in 1994, it demonstrated the potential of quantum computers to break widely used cryptographic systems like RSA, marking a landmark in quantum computing theory.
Read the full method
Sign in with a free account to read this section.
Method map
The neighbourhood of related methods — select a node to explore.
When to use it
Shor's algorithm is used to factor large integers (e.g., 2048-bit RSA moduli) for cryptanalysis. It applies when integer factorization or discrete logarithm computation is the bottleneck. In practice, Shor's algorithm remains theoretical for most problems due to the massive qubit and gate requirements (millions of logical qubits for realistic RSA-size numbers).
Strengths & limitations
- Solves factorization in polynomial time, exponentially faster than known classical algorithms.
- Proven to break RSA encryption and related cryptosystems.
- Elegant mathematical structure combining quantum mechanics with number theory.
- Demonstrates genuine quantum advantage for a practically important problem.
- Established the motivation for quantum-resistant cryptography research.
- Requires millions of logical qubits with extremely low error rates for practical factorization.
- Current quantum devices (10–1000 qubits) cannot factor numbers of cryptographic relevance.
- Order-finding subroutine requires deep quantum circuits, vulnerable to noise and decoherence.
- Implementation details (modular exponentiation, QFT) are technically complex and error-prone.
- Only provides exponential speedup relative to known classical algorithms, not truly subexponential.
Frequently asked
How many qubits are needed to factor a 2048-bit RSA key?
Approximately 20 million physical qubits are required, accounting for error correction and surface code overhead. The logical qubits needed are 2048–4096. This is far beyond current technology; even leading quantum computers have fewer than 10,000 physical qubits with relatively high error rates.
How long would it take to run Shor's algorithm on an RSA-2048 key?
With a fault-tolerant quantum computer and assuming gates can run at ~microsecond timescales, the computation would take hours. However, building such a machine is the major challenge; we do not yet have the engineering to reach the required error correction thresholds.
What is the quantum Fourier transform and why is it essential?
The quantum Fourier transform (QFT) is a quantum version of the discrete Fourier transform that runs in polynomial time on a quantum computer (as opposed to exponential time classically). It extracts periodicities in quantum superpositions, enabling Shor's algorithm to efficiently find the order of an element.
Can Shor's algorithm be used to attack my current encrypted data?
Not yet. Current quantum computers cannot factor integers larger than ~100, whereas cryptographic keys are 2048+ bits. However, adversaries may be harvesting encrypted data today for decryption when quantum computers become powerful enough (the 'harvest now, decrypt later' attack).
Is there a quantum algorithm for all NP-complete problems?
No. Shor's algorithm exploits the specific structure of factorization. For general NP-complete problems, Grover's algorithm offers only a quadratic speedup. Factorization is exceptional; not all hard problems have similarly efficient quantum algorithms.
Sources
- Shor, P. W. (1994). Algorithms for quantum computation: discrete logarithms and factoring. Proceedings of the 35th Annual Symposium on Foundations of Computer Science, 124–134. DOI: 10.1109/SFCS.1994.365700 ↗
- Shor, P. W. (1997). Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Review, 41, 303–332. DOI: 10.1137/S0036144598347011 ↗
- Ekert, A. K., Raussendorf, R. (2014). A short introduction to quantum computing. Reviews of Modern Physics, 74, 339–373. link ↗
How to cite this page
ScholarGate. (2026, June 3). Shor's Algorithm for Integer Factorization and Discrete Logarithm. ScholarGate. https://scholargate.app/en/quantum-computing/shors-algorithm
Which method?
Set this method beside its closest kin and read them side by side — the library lays the books on the table; the choice is yours.
- Grover's AlgorithmQuantum Computing↔ compare
- Quantum Key Distribution (BB84)Quantum Computing↔ compare
- Quantum Phase EstimationQuantum Computing↔ compare