I guess it depends on the specific experimental setup of your quantum computer somehow, but I'm just curious about the real-world speeds. A hypothetical computer that does few steps but takes a minute for each measurement wouldn't be so useful.
I guess it depends on the specific experimental setup of your quantum computer somehow, but I'm just curious about the real-world speeds. A hypothetical computer that does few steps but takes a minute for each measurement wouldn't be so useful.
With error correction... it depends how many spare qubits you have. All the non-trivial operations are done by "magic state distillation", where you produce special states in one part of the computer then consume them to perform the operation elsewhere. The more qubits you have, the more space you can allocate to magic state factories.
For example, a 32-bit addition can be done with 124 |T> states [1]. If you have N qubits allocated to factories then you can expect to get about 100N magic states per second. So if you have a tiny computer with 20 qubits dedicated to a factory, then a single addition will take over half a second. But if you can spare 2000 qubits for factories (about the same amount of qubits you'd need to store the problem in the first place) then you'd be producing T-states at 200KHz and 32-bit-adding at 1600Hz.
Shor's algorithm is, effectively, a single modular exponentiation. Performing an N-bit modular exponentiation requires something like 4N^3 |T> states. So 1024^3*4/200KHz = 6 hours to a factor a 1024 bit key, assuming 2000 qubits on factories and that the other rough numbers are close.
"Logic gates at the surface code threshold: Superconducting qubits poised for fault-tolerant quantum computing"
Campbell et al.
Nature, 2014
https://arxiv.org/abs/1402.4848From page 9:
Initialization ~50ns
Measurement ~200ns
One-qubit gates ~20ns
Two-qubit gates ~40ns
Single measurement is like revealing single pixel of a picture. If you do it enough times, you know what's on the picture.
For example take the classic attacks on DLP -- instead of essentially manually factoring the keys we can create a program (Shor's algorithm, etc) that essentially treats the problem of factoring as the task of determining the base frequencies of the key when treating the public component as a wave (at least as I understand it).
On an ideal quantum computer that task should be polynomial complexity, although there's still some (hopefully small) probability of error, but basically you just repeat many times and use a classical computer to verify the solution.