Shor’s algorithm and Grover’s algorithm solve different problems. Shor uses quantum period finding to factor integers and solve discrete logarithms; a sufficiently capable fault-tolerant quantum computer could use it against RSA and elliptic-curve cryptography. Grover uses amplitude amplification to search an unstructured set of candidates with about the square root of the classical number of oracle queries. Its main cryptographic implication is a smaller brute-force security margin for symmetric keys and hash preimages—not a general break of encryption.
What makes these algorithms quantum?
A qubit can be in a quantum state whose amplitudes represent several possible basis states. A quantum algorithm manipulates those amplitudes with interference, increasing the likelihood of useful outcomes and reducing the likelihood of others. Measurement returns a limited, probabilistic result; it does not reveal every possibility represented in a superposition.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Introduction to Algorithms, fourth edition | $91.50 | Buy on Amazon |
| 2 |
|
Algorithms (4th Edition) | $68.77 | Buy on Amazon |
| 3 |
|
Introduction to Algorithms, 3rd Edition | $99.99 | Buy on Amazon |
| 4 |
|
Algorithms | $124.77 | Buy on Amazon |
| 5 |
|
Algorithm Design | $222.95 | Buy on Amazon |
Grover’s algorithm makes especially direct use of an oracle: a circuit that identifies whether a candidate satisfies a condition. The oracle must be built for the problem, and its cost matters. Shor’s algorithm instead exploits algebraic structure in modular arithmetic to extract a period. Neither algorithm is simply a classical program that runs all answers at once.
What Shor’s algorithm solves
Factoring and discrete logarithms
Shor’s algorithm solves integer factorization and discrete-logarithm problems in polynomial time in the input bit length. For factoring, the input is a composite integer N; the output is its nontrivial prime factors. RSA security relies on the practical difficulty of factoring a large composite modulus. Shor’s framework also solves discrete logarithms, including elliptic-curve discrete logarithms, which underpin systems such as Diffie–Hellman variants and elliptic-curve cryptography. Shor’s original paper covers factoring and discrete logarithms: the paper.
Recommended Free Tools
#1 Best Overall
- color: White
- INTRODUCTION TO ALGORITHMS, FOURTH EDITION
This is not a direct operation that decrypts every message. The algorithm would recover mathematical secrets—such as RSA factors or an elliptic-curve private key—from public information. Those secrets could then be used in conventional cryptographic attacks.
How the period-finding approach works
- Choose an integer a relatively prime to N.
- Study the periodic modular function f(x) = ax mod N and find its period r.
- Use a quantum period-finding circuit, commonly based on phase estimation and the quantum Fourier transform, to obtain information about r.
- Use classical continued-fraction and number-theory calculations to recover a candidate period and compute greatest common divisors involving ar/2 − 1 and N, and ar/2 + 1 and N.
- Check whether the resulting divisors are nontrivial factors. If the period or selected value of a is unhelpful, repeat with another choice.
The quantum subroutine is only part of the work: reversible modular exponentiation, phase estimation or an equivalent period-finding routine, and sufficient precision are required. Classical post-processing interprets the measurement. Some runs do not yield a useful period, so repetition may be necessary. Optimized circuits need not implement the textbook quantum Fourier transform literally.
For example, factoring 15 is a useful teaching demonstration of the workflow, but it is not evidence that a machine can factor a cryptographic-size modulus. IBM’s tutorial explains the implementation and warns of the scaling gap: IBM’s Shor tutorial.
Rank #2
What Grover’s algorithm solves
Unstructured search
Suppose a set has N candidates and an oracle can mark whether a candidate is valid, but there is no useful ordering or exploitable structure. Classical black-box search can require O(N) oracle evaluations. Grover’s algorithm finds a marked candidate using O(√N) oracle queries in the ideal query model. That is a quadratic improvement, not a conversion of arbitrary search into polynomial time. Grover introduced the algorithm in 1996: the original paper.
How amplitude amplification works
- Prepare an equal superposition over the candidate states.
- Apply an oracle that marks valid candidates, typically by changing their phase.
- Apply the diffusion operator, which reflects amplitudes about their average and increases the marked states’ amplitudes.
- Repeat the oracle-and-diffusion iteration an appropriate number of times, then measure.
- Verify the measured candidate with a classical check.
When there are M marked solutions among N candidates and M is known, the ideal iteration count is approximately (π/4)√(N/M). Too many iterations can over-rotate the state and lower the chance of measuring a solution. If the number of solutions is unknown, a strategy with varying iteration counts is safer than assuming one fixed optimum. IBM describes the oracle and amplitude-amplification construction in its Grover tutorial.
The oracle is not free: it must reversibly evaluate the search condition, and any temporary work registers must be handled correctly. A poor oracle, expensive circuit, or problem with exploitable structure can erase the apparent advantage of counting queries alone.
Rank #3
- Hard Cover
Shor and Grover compared
| Measure | Shor’s algorithm | Grover’s algorithm |
|---|---|---|
| Target problem | Integer factorization and discrete logarithms | Unstructured search with a marking oracle |
| Quantum method | Period finding, typically using phase estimation and the quantum Fourier transform | Oracle-based amplitude amplification |
| Quantum scaling | Polynomial in the input bit length for factoring and discrete logarithms | O(√N) oracle queries for a search space of size N |
| Classical comparison | Best known general-purpose classical factoring methods are subexponential, not polynomial | O(N) oracle queries in the unstructured black-box model |
| Typical output | Factors or a discrete logarithm | A marked candidate, which should be verified |
| Main implementation burden | Reversible modular arithmetic, circuit depth, error correction, and qubit resources | Building and repeatedly applying a reversible oracle; iteration count and noise |
| Cryptographic relevance | Threat to RSA and discrete-logarithm public-key systems at sufficient fault-tolerant scale | Reduces idealized brute-force work against symmetric keys and hash preimages |
Shor’s polynomial scaling is a much more dramatic asymptotic improvement for its particular targets than Grover’s quadratic query reduction. It is common to call Shor’s advantage “exponential,” but that shorthand needs qualification: the strongest general-purpose classical factoring algorithms are subexponential, and the exact comparison depends on the algorithms and cost model being compared. Grover’s O(√N) result is optimal in the standard black-box search model; it does not make an arbitrary search problem easy. IBM’s overview of Grover’s query comparison is available at the Qiskit API reference.
What the algorithms mean for cryptography
Public-key systems: Shor is the central concern
A large, error-corrected quantum computer running Shor could attack RSA by factoring its modulus and could attack discrete-logarithm systems, including elliptic-curve systems. No claim that these systems are currently broken follows from the existence of the algorithm: the required cryptographically relevant capability has not been demonstrated in the supplied sources.
One reason migration is discussed before such a machine exists is “harvest now, decrypt later”: an adversary could store encrypted traffic now in the hope of decrypting it later. AWS describes the relationship between quantum risk and factoring- or discrete-logarithm-based public-key systems, and discusses post-quantum migration including NIST-standardized ML-KEM and ML-DSA: AWS post-quantum cryptography overview.
Rank #4
Symmetric keys and hash preimages: Grover changes the margin
For exhaustive search over 2128 possible keys, the idealized Grover query count is on the order of 264, rather than 2128 classical trials. This is a security-strength heuristic, not a prediction that an attack will take a particular amount of time: it omits the costs of constructing and running the reversible circuit, fault tolerance, parallelization, and implementation details. Larger key sizes are a common way to preserve security margins, but there is no universal rule that every primitive simply needs exactly twice its current key length.
Grover-like reasoning also applies to hash preimage search, where an attacker seeks an input producing a target hash. Collision search is a different problem with different complexity and must not be treated as identical to preimage search. Nor does Grover automatically defeat every symmetric cipher, hash, authentication mechanism, or protocol; the attack model and implementation matter.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why small demonstrations do not imply practical attacks
A compiled demonstration simplifies a circuit for a small example, such as factoring 15 or 21. It can show that components of an algorithm work, but it does not preserve the resource demands of a general-purpose run at cryptographic scale. A general-purpose algorithm must retain the arithmetic or oracle structure required by the large instance.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Best Value
Physical qubits are hardware components; logical qubits are error-corrected units built from physical resources. Fault-tolerant execution needs error correction and substantial circuit depth. Noisy intermediate-scale devices have limited depth and errors that make large useful instances impractical. Amazon Braket’s service documentation says current noisy devices are too noisy to sustain pure algorithms such as Shor or Grover at useful scale: Amazon Braket documentation.
As a vendor estimate, IBM states that factoring an RSA-2048 integer would require millions of qubits including error-correction overhead and circuit depth on the order of a billion. That is an estimate, not a universal resource constant, and it underscores why factoring 15 is not evidence of an ability to break RSA: IBM’s Shor tutorial.
Which algorithm should you learn first?
- Start with Grover if you want to learn quantum circuits, oracles, phase marking, and amplitude amplification. It is generally the more approachable circuit exercise, although a useful oracle still takes care to design.
- Study Shor next if you want number theory, modular arithmetic, phase estimation, or the connection between quantum computing and public-key cryptography.
- Use a local simulator for conceptual work and small circuits; use a cloud QPU when your goal is specifically to study hardware noise, compilation, measurement, or execution—not to obtain useful cryptographic capability.
Grover’s method is part of the broader family of amplitude-amplification techniques. The quantum Fourier transform and phase estimation are reusable tools that appear in Shor and other algorithms. Deutsch–Jozsa and Bernstein–Vazirani are simpler oracle-based teaching examples; quantum walks can suit some structured graph searches. Variational algorithms are hybrid methods explored for some near-term tasks, but they do not replace Shor or Grover for the problems those algorithms target. For organizations concerned about cryptographic exposure, investigating post-quantum migration is more relevant than buying quantum-computing access.
Quick Recap
Common failure modes to keep in view
- Shor: a chosen a may share a factor with N, immediately revealing a factor; alternatively, the period may be odd or yield a trivial greatest-common-divisor result. Measurement may not provide enough information to recover the period, and errors in modular arithmetic can corrupt phase information. These cases call for checks and, where appropriate, repetition.
- Grover: an oracle that marks the wrong states, leaves work registers entangled, or costs too much can spoil the intended advantage. An iteration count based on one solution can be wrong when several exist; over-rotation and noisy measurements can also produce a non-solution. Verify every candidate and consider whether a classical prefilter or a structure-specific algorithm would be cheaper.
- Both: asymptotic or query complexity is not wall-clock runtime. Reversible circuit construction, compilation, connectivity, error correction, repetitions, and classical preparation and verification all affect total cost.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
