The Quantum Frequency

Part I: The Mathematical Foundations of Periodicity

Before diving into the quantum mechanics that power Shor's Algorithm, we must first establish the bedrock of its mathematical certainty: the elegant world of modular arithmetic. Far from being just "clock math," modular arithmetic provides the language of finite structures and cycles, essential concepts in number theory and abstract algebra. In this section, we explore its rigorous foundations, built by giants like Gauss and Euler, introducing core ideas like congruence, modular groups, Euler's totient function, and the absolutely critical concept of multiplicative order. This "order," denoted as r, represents the fundamental period hidden within a number-theoretic sequence, and it is the primary target Shor's algorithm finds.

1.1 The Genesis of Modularity: Gauss and Disquisitiones Arithmeticae

The formal study of modular arithmetic was systematized in 1801 by Carl Friedrich Gauss in his seminal work, Disquisitiones Arithmeticae^[1]. Gauss introduced the modern notation for congruence and was the first to explore its properties with the rigor of a new mathematical era.

Definition: Congruence. For a positive integer n, two integers a and b are said to be congruent modulo n, written as \(a \equiv b \pmod{n}\), if their difference \((a - b)\) is an integer multiple of n.

This relation partitions all integers into n distinct sets, known as congruence classes or residue classes. The set of these n classes is denoted \(\mathbb{Z}/n\mathbb{Z}\). Arithmetic operations (addition and multiplication) can be consistently defined on these classes, turning \(\mathbb{Z}/n\mathbb{Z}\) into a commutative ring.

1.2 The Multiplicative Group of Integers Modulo n

The true engine of RSA cryptography and Shor's algorithm lies within a more specific structure: the multiplicative group of integers modulo n. This group, denoted \((\mathbb{Z}/n\mathbb{Z})^\times\), is formed only by those residue classes \([a]\) that have a multiplicative inverse. An inverse exists if and only if \(a\) is co-prime to the modulus \(n\) (i.e., \(\text{gcd}(a, n) = 1\)).

1.3 Euler's Totient Function and Theorem: The Size of the Playground

The size, or order, of the group \((\mathbb{Z}/n\mathbb{Z})^\times\) is given by Euler's totient function, \(\phi(n)\). It counts the number of positive integers up to \(n\) that are relatively co-prime to \(n\). Its properties are fundamental:

• If \(p\) is a prime number, \(\phi(p) = p - 1\).
• If \(p\) and \(q\) are distinct prime numbers, \(\phi(pq) = \phi(p)\phi(q) = (p-1)(q-1)\). This property is the cornerstone of the RSA cryptosystem's security.

Euler's Theorem, a direct consequence of Lagrange's Theorem from group theory, states that for any integer \(a\) co-prime to \(n\):

1.4 The Central Concept: The Multiplicative Order (The Period \(r\))

Euler's theorem tells us *a* power that results in 1, but not necessarily the smallest positive such power. This smallest positive integer \(r\) is the multiplicative order, and it's central to Shor's algorithm.

Definition: Multiplicative Order. The multiplicative order of an integer \(a\) modulo \(n\) (where \(\text{gcd}(a, n) = 1\)) is the smallest positive integer \(r\) such that: \[a^r \equiv 1 \pmod{n}\].

This \(r\) is the period of the function \(f(x) = a^x \pmod{N}\) that Shor's algorithm seeks to find. The entire premise of Shor's algorithm rests on this fact: efficiently finding \(r\) gives us profound structural information about \(\phi(N)\), which in turn allows us to deduce the factors \(p\) and \(q\). Classically, finding \(r\) for large \(N\) can be as hard as factoring \(N\) itself, requiring exponential time. This is where quantum computation offers its profound advantage.

Part II: The Signal Processing Analogue Deconstructed

To truly grasp how a quantum computer performs its magic, we must first understand a powerful tool from classical computation: the Fourier Transform. This mathematical technique is the cornerstone of digital signal processing, and at its core, it's a method for finding the underlying periodicities (frequencies) within a signal. By drawing a strong analogy between finding the multiplicative order \(r\) in number theory and finding dominant frequencies in a signal, we illuminate the path Shor's algorithm takes.

2.1 The Fourier Transform: From Time to Frequency

Imagine a complex sound wave. It's a jumble in the time domain, but in the frequency domain, it's revealed as a combination of simple, pure tones (sine waves) at different pitches and volumes. The Fourier Transform is the mathematical key that unlocks this transformation. For a discrete signal \(x[n]\) with \(N\) samples, this transformation is the Discrete Fourier Transform (DFT):

A large magnitude \(|X[k]|\) at a particular frequency bin \(k\) indicates a strong presence of that frequency in the signal. Finding the index \(k\) where \(|X[k]|\) is highest is equivalent to finding the most dominant frequency, and thus, the most prominent period in the signal.

Beyond the standard Fourier Transform, other powerful tools exist for analyzing signals. For instance, Wavelet Transforms offer a different perspective, analyzing signals not just in terms of frequency components but also their localization in time. This allows for multiresolution analysis, useful for signals with transient features. While the QFT is directly analogous to the DFT, the principles of wavelet analysis have also inspired quantum counterparts like the Quantum Wavelet Transform, which could find applications in quantum image processing or data compression.

2.2 The Fast Fourier Transform (FFT): An Efficient Calculation

A direct computation of the DFT is computationally intensive, requiring \(O(N^2)\) operations. The Fast Fourier Transform (FFT), most famously implemented by the Cooley-Tukey algorithm^[2], is a brilliant optimization that computes the DFT in a much more efficient \(O(N \log N)\) operations. This efficiency made spectral analysis a practical tool in countless fields, from audio processing to medical imaging. The core idea behind FFT's efficiency is a "divide and conquer" approach, recursively breaking down a DFT of size \(N\) into smaller DFTs.

Interactive Example: Visualizing the DFT

Explore how the DFT reveals the frequency content of a signal. Generate a sine wave and add noise, or upload a custom signal (e.g., a WAV audio file) to see its frequency spectrum.

Part III: The Quantum Paradigm Shift and Shor's Algorithm

The previous sections established two parallel worlds: number theory's hidden periods (\(r\)) and signal processing's frequency analysis (DFT). The genius of Peter Shor's 1994 algorithm lies in his discovery that a quantum computer can bridge these worlds^[3]. It uses the principles of quantum mechanics to perform a Fourier analysis on the number-theoretic function \(f(x) = a^x \pmod{N}\), thereby efficiently finding its period \(r\).

3.1 The Quantum Period-Finding Subroutine: QFT and Phase Estimation

This is the heart of Shor's breakthrough. It leverages key quantum mechanical properties:

• Superposition: Qubits can represent multiple values simultaneously.
• Quantum Parallelism: A single quantum operation can compute a function \(f(x)\) for a superposition of all inputs, effectively evaluating it for many values of \(x\) at once.
• Quantum Interference: The Quantum Fourier Transform (QFT) is a quantum operation that causes the probability amplitudes of different quantum states to interfere. Think of it as a quantum "prism" that separates a complex state into its fundamental periodic components. States corresponding to the period interfere constructively (their amplitudes add up), while others interfere destructively (their amplitudes cancel out), dramatically amplifying the signal of the period.

The Quantum Fourier Transform (QFT) and Phase Estimation

The Quantum Fourier Transform (QFT) is central to Shor's algorithm, serving as the quantum analogue of the classical Fast Fourier Transform. For an \(n\)-qubit register, the QFT can be implemented efficiently using a sequence of Hadamard gates and controlled phase gates. Specifically, for an input state \(|x\rangle\), where \(x = x_{n-1}2^{n-1} + \dots + x_1 2^1 + x_0 2^0\), the QFT maps it to:

This transformation can be decomposed into a circuit of single-qubit Hadamard gates and controlled phase (or controlled-\(R_k\)) gates. A Hadamard gate is applied to each qubit, followed by a sequence of controlled rotations where the rotation angle depends on the qubit's position and the control qubit's state. For example, for a target qubit \(j\), a controlled-\(R_k\) gate is applied, conditioned on each qubit \(j-k\), with \(R_k = \begin{pmatrix} 1 & 0 \\ 0 & e^{2\pi i / 2^k} \end{pmatrix}\). This intricate gate sequence introduces relative phases that, when measured, reveal information about periodicities.

The QFT acts as the core component of Quantum Phase Estimation (QPE), a powerful subroutine, first formally detailed by Kitaev [13]. QPE allows us to estimate the phase \(\phi\) of an eigenvector \(|u\rangle\) of a unitary operator \(U\), such that \(U|u\rangle = e^{2\pi i \phi}|u\rangle\). In Shor's algorithm, the unitary operator is modular exponentiation \(U|x\rangle = |ax \pmod N\rangle\), and its eigenvectors are states that implicitly encode the period \(r\). By preparing a superposition of these states and applying the QFT, we can measure the phase \(\phi = j/r\), from which the period \(r\) can be classically extracted.

The Steps of Shor's Quantum Period-Finding Subroutine:

1. Initialization: Prepare two quantum registers. The first (input) register, with \(n\) qubits (e.g., \(2\log_2 N\) qubits for a target \(N\)), is put into a uniform superposition of all numbers from \(0\) to \(Q-1\) (\(Q=2^n\), chosen such that \(Q \ge N^2\)). This is done by applying Hadamard gates to each qubit. The second (output) register, storing values modulo \(N\), is typically initialized to \(|1\rangle\).
2. Modular Exponentiation: A quantum circuit computes the function \(f(x) = a^x \pmod{N}\) for all \(x\) in the input register simultaneously, storing the result in the output register. This operation, \(U_f: |x\rangle|y\rangle \to |x\rangle|y \cdot a^x \pmod N\rangle\), creates entanglement between the two registers: \(\sum_{x=0}^{Q-1} |x\rangle |a^x \pmod N\rangle\).
3. Measurement of Output: The output register is measured, collapsing its state to a random value \(v\). Due to entanglement, the input register simultaneously collapses into a superposition of only those \(x\) values for which \(a^x \pmod N = v\). This resulting state, \(|x_0\rangle, |x_0+r\rangle, |x_0+2r\rangle, \dots\), is now periodic with period \(r\).
4. Quantum Fourier Transform (QFT): The QFT is applied to the collapsed input register. This step is where the "quantum magic" happens: the QFT transforms the periodic state, causing the probability amplitudes to interfere. Through constructive interference, the amplitudes become highly concentrated at frequencies corresponding to multiples of \(Q/r\), while destructive interference cancels out other frequencies.
5. Measurement of Input: Finally, the input register is measured. With high probability, the measurement yields an integer \(k\) that is very close to an integer multiple of \(Q/r\). That is, \(k \approx j \cdot Q/r\) for some integer \(j\).
6. Classical Post-Processing: Using the measured value \(k\) and the total number of states \(Q\), the continued fractions algorithm is employed to find the simplest fraction \(\frac{j}{r}\) that approximates \(\frac{k}{Q}\). From this, the period \(r\) is extracted. This \(r\) is then used to factor \(N\) by computing \(\text{gcd}(a^{r/2} \pm 1, N)\).

Interactive Example, Stage 1: The Algorithm's Flow (The 'What')

Before diving into the quantum circuit, let's understand the high-level flow. This first simulator abstracts away the quantum mechanics to focus on the overall process. It shows how finding the period `r` (the "magic" quantum step) and performing classical post-processing leads to the factors of `N`. This builds a conceptual foundation for what the quantum computer needs to accomplish.

Interactive Example, Stage 2: The Quantum Circuit (The 'How')

Now that we've seen the overall flow, let's look under the hood. This simulator visualizes the actual quantum circuit for the period-finding subroutine. You can see how superposition (via Hadamard gates), modular exponentiation, and the Quantum Fourier Transform (QFT) are sequenced to manipulate the quantum state and reveal the period `r`.

3.2 The Broader Quantum Landscape: Shor vs. Grover

It is crucial to understand that Shor's algorithm is not a universal speedup. Its **exponential speedup** comes from exploiting the specific mathematical structure (periodicity) of the factoring problem, meaning its efficiency scales polynomially with the size of the number to be factored (e.g., \(O((\log N)^3)\) gate operations). In contrast, Grover's algorithm^[4] addresses unstructured search problems (like finding a key in a database) with a **quadratic speedup** (\(O(N)\) becomes \(O(\sqrt{N})\)). This is significant but not exponential, meaning symmetric-key cryptography (like AES) is less threatened than public-key systems. Other areas like **Variational Quantum Algorithms (VQAs)** and **Quantum Machine Learning (QML)** explore different types of problems, often seeking heuristic advantages on near-term, noisy quantum hardware.

Part IV: The Engineering Frontier: Realizing the Quantum Computer

The theoretical elegance of Shor's algorithm highlights the immense potential of quantum computation. However, building a functional, fault-tolerant quantum computer capable of executing it on cryptographically relevant numbers presents monumental engineering challenges.

4.1 DiVincenzo's Criteria and Hardware Progress

In 2000, David DiVincenzo outlined five criteria for a viable quantum computer^[5], guiding experimental progress. These include having a scalable system of qubits, the ability to initialize them, long coherence times, a universal set of quantum gates, and the ability to measure qubits. As of the 2024 era, remarkable progress has been made across various platforms:

• Superconducting Qubits: Companies like IBM and Google have pioneered this approach, building processors with over 1,000 qubits (e.g., IBM Condor). They benefit from fast gate speeds and compatibility with existing microfabrication techniques, but require extreme cryogenic temperatures and are prone to crosstalk.
• Trapped-Ion Qubits: Leaders like IonQ and Quantinuum use precisely controlled lasers to trap individual ions. These offer extremely long coherence times and high-fidelity gates, but scaling them up to large numbers of qubits while maintaining connectivity is a significant engineering challenge.
• Neutral Atom Arrays: Companies like QuEra are advancing with neutral atom systems, where arrays of individual atoms are trapped by optical tweezers. These offer excellent scalability and homogeneity, but maintaining qubit addresses and performing multi-qubit gates are active research areas.

Despite this, achieving the scale and quality needed for fault-tolerance remains a primary research goal, largely due to the pervasive issue of decoherence.

4.3 The Practicality of Shor's Algorithm: Qubit and Gate Counts

Breaking a 2048-bit RSA key with Shor's algorithm is a benchmark for quantum supremacy in cryptography. The resource requirements are staggering, even with theoretical optimizations:

• Qubit Count: A straightforward implementation requires approximately \(2n\) qubits for the input register and \(n\) for the output, where \(n=2048\). This means about **4,096 perfect, logical qubits**. With the overhead of QEC (e.g., 1000 physical qubits per logical qubit for a high-distance surface code at the 1% error threshold), this could translate to **millions of physical qubits**^[6].
• Gate Count: The algorithm would require billions of high-fidelity quantum gate operations. The total number of gates scales approximately as \(O(n^3)\) for Shor's.
• Success Probability: A single run of the quantum part succeeds if the measurement \(k\) leads to a useful period \(r\). This depends on \(\text{gcd}(j, r) = 1\) in the approximation \(\frac{k}{Q} \approx \frac{j}{r}\). The probability of this is reasonably high (e.g., \(O(1/\log\log r)\)), but multiple runs with different random bases `a` may be needed to guarantee success for factoring.

4.4 Emerging Quantum Paradigms for Near-Term Devices: Variational Quantum Algorithms (VQAs)

While fault-tolerant quantum computers are still some years away, the era of Noisy Intermediate-Scale Quantum (NISQ) devices (50-1000+ qubits without full QEC) is here. These devices are too noisy for Shor's algorithm but can run a class of algorithms known as Variational Quantum Algorithms (VQAs). VQAs are hybrid quantum-classical algorithms where a quantum computer executes a parameterized quantum circuit, and a classical computer optimizes the circuit parameters to minimize a cost function. Examples include the Variational Quantum Eigensolver (VQE) for chemistry and materials science, and the Quantum Approximate Optimization Algorithm (QAOA) for combinatorial optimization. Research in 2025 continues to focus on improving the robustness and expressivity of these algorithms on current hardware, exploring their potential for quantum advantage in specific applications.

4.5 Quantum Networking and Quantum Key Distribution (QKD)

Beyond computation, quantum mechanics offers revolutionary possibilities for secure communication. Quantum Networking aims to build a quantum internet, enabling applications like distributed quantum computing, quantum sensors, and ultra-secure communication. A key application is Quantum Key Distribution (QKD), which allows two parties to establish a shared secret key with security guaranteed by the laws of physics, not computational hardness. Protocols like BB84 leverage the no-cloning theorem to ensure that any eavesdropping attempt is detectable. Unlike Post-Quantum Cryptography (PQC), which relies on mathematical problems hard for quantum computers, QKD offers "information-theoretic" security, meaning its security doesn't break even if an adversary has an infinitely powerful quantum computer. Advancements in quantum repeaters and satellite-based QKD in 2025 are pushing the boundaries of range and practicality, offering a complementary solution to PQC for cryptographic key exchange.

Part V: The Cryptographic War and the Post-Quantum Future

The potential advent of fault-tolerant quantum computers creates an existential threat to our current public-key cryptography. Algorithms like RSA and Elliptic Curve Cryptography, which underpin secure communications and transactions worldwide, rely on mathematical problems (factoring large numbers and discrete logarithms) that Shor's algorithm can solve efficiently. This has ignited a global race to develop and deploy a new generation of algorithms resistant to quantum attacks: Post-Quantum Cryptography (PQC).

5.1 The Imminent Threat: "Harvest Now, Decrypt Later"

The "Harvest Now, Decrypt Later" (HNDL) scenario is a pressing threat. Adversaries can covertly collect today's encrypted data and store it, anticipating that they will be able to decrypt it in the future once a capable quantum computer exists. This makes data with a long lifespan (e.g., government secrets, financial records, medical histories, intellectual property) vulnerable now, even if a quantum computer doesn't exist yet. The urgency for PQC deployment stems from this forward-looking risk.

5.2 The NIST PQC Standardization Process

The U.S. National Institute of Standards and Technology (NIST) has led a public, multi-round process since 2016 to standardize PQC algorithms^[7]. The first set of standards, finalized in 2024, are based on mathematical problems believed to be hard for both classical and quantum computers, offering a path to cryptographic migration. The selected algorithms represent a diverse set of underlying mathematical problems to ensure resilience against unforeseen cryptanalytic breakthroughs.

5.3 A Deeper Look: The Learning With Errors (LWE) Problem

Lattice-based cryptography, which forms the foundation of NIST's primary public-key encryption and digital signature standards (Kyber and Dilithium), often relies on the **Learning With Errors (LWE)** problem^[9]. Conceptually, the LWE problem asks an attacker to find a secret vector \(\mathbf{s}\) given a set of "noisy" linear equations. That is, you are given many samples of the form \(( \mathbf{a}_i, b_i )\), where \(b_i \approx \mathbf{a}_i \cdot \mathbf{s} \pmod q\), and the approximation is due to a small, randomly introduced "error" or "noise" term \(e_i\). So, \(b_i = (\mathbf{a}_i \cdot \mathbf{s} + e_i) \pmod q\). The challenge is to find \(\mathbf{s}\) when \(e_i\) is small but unknown.

For greater efficiency and structure, many PQC schemes utilize variants like **Ring-LWE** and **Module-LWE**. In Ring-LWE, the vectors \(\mathbf{a}\) and \(\mathbf{s}\) are replaced by polynomials in a specific ring (e.g., \(R_q = \mathbb{Z}_q[x]/(x^n+1)\)), making operations faster and key sizes smaller. Module-LWE extends this, treating \(\mathbf{a}\) and \(\mathbf{s}\) as vectors of these polynomials. These structured variants are crucial for performance but require careful analysis to ensure their hardness properties are maintained.

Side-Channel Attacks on PQC Implementations

While PQC algorithms are designed to be mathematically secure against quantum computers, their practical implementations can be vulnerable to side-channel attacks. These attacks exploit physical leakage from cryptographic devices, such as variations in power consumption, electromagnetic emissions, or timing of operations, to infer secret information. For instance, specific implementations of Kyber or Dilithium might reveal patterns during polynomial multiplications or error samplings that leak bits of the secret key. NIST's PQC standardization process includes considerations for these implementation-level security aspects, and ongoing research in 2025 continues to investigate and mitigate such vulnerabilities.

5.4 The Transition: Hybrid Schemes and Crypto-Agility

The transition to PQC will not be instantaneous. For a considerable period, systems will likely operate in a **hybrid mode**. For example, a TLS handshake might perform two key exchanges—one classical (like Elliptic Curve Diffie-Hellman) and one post-quantum (like Kyber)—and combine the results. The IETF is standardizing mechanisms like `X25519Kyber768` for this purpose. This ensures that the connection is secure as long as *at least one* of the algorithms remains unbroken. This approach provides a safety net against both unforeseen flaws in the new PQC standards and the eventual arrival of a quantum computer. The ultimate goal is **crypto-agility**: designing systems that can easily swap out cryptographic algorithms as new threats emerge or better standards become available.

Interactive Example: Lattice Problems (SVP & CVP)

Appendix: Recent Advances & Future Outlook

The fields of quantum computing and post-quantum cryptography are rapidly evolving. Staying current with breakthroughs is crucial for both theoretical understanding and practical deployment. This appendix provides a snapshot of how dynamic updates can be integrated to reflect the latest research and industry developments.

Recent Research Highlights (Dynamic Content)

Below is a placeholder for dynamically fetched updates. In a live environment, this section could pull summaries of recent arXiv papers on QEC, NIST PQC news, or experimental results from leading quantum hardware providers, ensuring the document remains at the cutting edge. (Note: Direct fetching from external APIs may be subject to CORS policies in a browser, a production setup might use a server-side proxy).

References and Annotated Further Reading

1. Gauss, C. F. (1801). Disquisitiones Arithmeticae. The foundational text of modern number theory, introducing modular arithmetic.
2. Cooley, J. W., & Tukey, J. W. (1965). An algorithm for the machine calculation of complex Fourier series. Mathematics of Computation, 19(90), 297-301. The seminal paper on the Fast Fourier Transform (FFT), enabling modern signal processing.
3. Shor, P. W. (1994). Algorithms for quantum computation: discrete logarithms and factoring. In Proceedings of the 35th Annual Symposium on Foundations of Computer Science (pp. 124-134). The landmark paper that introduced the quantum factoring algorithm and launched the field of quantum cryptography.
4. Grover, L. K. (1996). A fast quantum mechanical algorithm for database search. In Proceedings of the 28th Annual ACM Symposium on Theory of Computing (pp. 212-219). The paper introducing the quantum search algorithm, demonstrating a quadratic speedup for unstructured problems.
5. DiVincenzo, D. P. (2000). The Physical Implementation of Quantum Computation. Fortschritte der Physik, 48(9-11), 771-783. DOI: 10.1002/1521-3978(200009)48:9/11%3C771::AID-PROP771%3E3.0.CO;2-E Outlines the five key criteria that serve as a blueprint for building a physical quantum computer.
6. Fowler, A. G., Mariantoni, M., Martinis, J. M., & Cleland, A. N. (2012). Surface codes: Towards practical large-scale quantum computation. Physical Review A, 86(3), 032324. DOI: 10.1103/PhysRevA.86.032324 A key paper on the surface code, detailing its structure and immense resource requirements for fault-tolerance.
7. National Institute of Standards and Technology (NIST). (2024). Post-Quantum Cryptography Standardization. csrc.nist.gov/projects/post-quantum-cryptography The official, authoritative resource for the ongoing PQC standardization process.
8. Castryck, W., & Decru, T. (2023). An efficient key recovery attack on SIDH. In Advances in Cryptology – EUROCRYPT 2023 (pp. 423-453). DOI: 10.1007/978-3-031-30617-4_15 The paper detailing the powerful classical attack that broke the SIKE isogeny-based algorithm.
9. Regev, O. (2005). On lattices, learning with errors, random linear codes, and cryptography. In Proceedings of the 37th Annual ACM Symposium on Theory of Computing (pp. 84-93). DOI: 10.1145/1060590.1060603 The foundational paper that introduced the Learning with Errors (LWE) problem and its cryptographic applications.
10. Nielsen, M. A., & Chuang, I. L. (2010). Quantum Computation and Quantum Information: 10th Anniversary Edition. Cambridge University Press. DOI: 10.1017/CBO9780511976667 The definitive, comprehensive textbook on the field of quantum computation and information theory.
11. Gottesman, D. (1997). Stabilizer codes and quantum error correction. arXiv:quant-ph/9705052. arXiv:quant-ph/9705052 A foundational paper on the stabilizer formalism, which is the mathematical framework for many QEC codes, including the surface code.
12. Ajtai, M. (1996). Generating hard instances of lattice problems. In Proceedings of the 28th Annual ACM Symposium on Theory of Computing (pp. 99-108). DOI: 10.1145/237814.237825 A seminal work establishing the connection between the average-case and worst-case hardness of lattice problems, forming the theoretical basis for secure lattice-based cryptography.
13. Kitaev, A. (1995). Quantum measurements and the Abelian Stabilizer Problem. arXiv:quant-ph/9511026. arXiv:quant-ph/9511026 Introduced quantum phase estimation and period-finding, foundational to Shor’s algorithm.
14. Peikert, C. (2016). A Decade of Lattice Cryptography. Foundations and Trends in Theoretical Computer Science, 10(4), 283–424. DOI: 10.1561/0400000057 Comprehensive survey of lattice-based cryptography, including LWE and its variants.