Among many paper describing circuit solving period finding problem and discrete logarithm problem (DLP) (for simplity, let's say $g \equiv x^r$ (mod n) and try to find $r$), there are two variants that people usually ignore:

  1. Some paper use inverse QFT instead of QFT.
  2. Before applying QFT, some paper prepare the state as $$\frac{1}{q}\sum_{a, b}|a, b, g^ax^b⟩$$ instead of $$\frac{1}{q}\sum_{a, b}|a, b, g^ax^{-b}⟩$$

From this post and probability reduction we know these variants do not affect the probability analysis. However, in pratical implementation, variant no. 2 may save one quantum modular inverse operation. Also, I heard that using inverse QFT makes the probability analysis neater than using QFT, but I did not find any supporting document.

Therefore, is there any other reason that such preferences are made?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.