We significantly reduce the cost of factoring integers and computing discrete logarithms over finite fields on a quantum computer by combining techniques from Griffiths-Niu 1996, Zalka 2006,Fowler 2012, Eker ̊a-H ̊astad 2017, Eker ̊a 2017, Eker ̊a 2018, Gidney-Fowler 2019, Gidney 2019. We estimate the approximate cost of our construction using plausible physical assumptions for large-scale superconducting qubit platforms: a planar grid of qubits with nearest-neighbor connectivity,a characteristic physical gate error rate of 10−3, a surface code cycle time of 1 microsecond, and a reaction time of 10 microseconds. We account for factors that are normally ignored such as noise,the need to make repeated attempts, and the space time layout of the computation. When factoring2048 bit RSA integers, our construction’s space time volume is a hundredfold less than comparable estimates from earlier works (Fowler et al. 2012, Gheorghiu et al. 2019). In the abstract circuit model (which ignores overheads from distillation, routing, and error correction) our construction uses 3n+ 0.002nlgnlogical qubits, 0.3n3+ 0.0005n3lgnToffolis, and 500n2+n2lgnmeasurementdepth to factor n-bit RSA integers. We quantify the cryptographic implications of our work, both for RSA and for schemes based on the DLP in finite fields. Read More

#quantum