Pith. sign in

REVIEW 3 major objections 4 minor 22 references

Efficient Quantum Modular Reduction: Crandall reduction and its Fault-tolerant resource analysis

T0 review · 3 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper shows how to make reversible quantum modular reduction for moduli $q=2^n-c$ using two folding steps plus conditional subtractions, beating optimized Barrett reduction in qubits, T-count, T-depth, and runtime.

desk verdict A useful idea with a real accounting flaw: the Crandall-reduction circuits likely beat Barrett, but the T-depth formulas are not worst-case because they drop carries that the circuit needs. read the letter →

arxiv 2608.11563 v1 pith:EBNC2SE4 submitted 2026-08-12 quant-ph

Changyeol Lee , Sungyeon Kook , Wooyeong Song , Kwangil Bae , Wonhyuk Lee , IlKwon Sohn This is my paper · ORCID
classification quant-ph
keywords Crandallreductionpseudo-MersennemodulusquantummodularreversiblecircuitT-countT-depthsurfacecodefault-tolerantcomputation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to show that when the modulus has the special form $q=2^n-c$, quantum modular reduction can be built from two fixed folding steps and conditional subtractions, avoiding division and general multiplication. It derives explicit conditions for one-step and two-step normalization—$c^2+2c\le 2^n$ and $c^2+3c\le 2^{n+1}$—and turns them into two reversible circuit variants, Crandall reduction-1 and Crandall reduction-2. The reported worst-case resources are $T_{\mathrm{CR1}}=4F(n)+20n+4$ T gates with depth $F(n)+5n+1$, where $F(n)=\lfloor n^2/4\rfloor+(n-1)\lceil n/2\rceil$; at $n=10$ this cuts both metrics by about 46.9% compared with optimized folding Barrett reduction. The authors further map both variants to the surface code and estimate that the lower T-depth reduces required code distance and total execution time, for example 30.05 ms versus 53.77 ms at $n=20$ under their fast-decoder setting. If correct, the result gives a concrete modulus-class-specific way to reduce the dominant non-Clifford cost in quantum arithmetic for cryptanalytic algorithms.

What carries the argument

The load-bearing mechanism is Crandall folding: the congruence $2^n\equiv c\pmod q$ lets the high half of a $2n$-bit input be multiplied by the small constant $c$ and added to the low half, replacing division by bit shifts plus constant multiplication. The circuit fixes exactly two folds and then normalizes by subtract-then-restore: subtract $q$ and conditionally add it back when the sign bit shows a negative result. Reversible components are specialized to the fixed classical bit patterns, so gates corresponding to zero bits of $c$ and $q$ are removed; carry and borrow logic uses the temporary logical-AND construction, which contributes T-count 4 and T-depth 1 per carry-generation block. The worst-case resource counts follow from bounding the Hamming weight of admissible $c$ by $\lfloor n/2\rfloor$ and the effective active-bit range by $\lceil n/2\rceil$.

What would settle it

For a fixed $n$, enumerate every admissible $c$ (for the two-step variant, all $c$ with $c^2+3c\le 2^{n+1}$); for each $c$, count the carry-generation blocks in the two folding multiplications and the accumulation adder under the paper's construction. If any admissible $c$ yields a folding T-depth greater than $\lfloor n^2/4\rfloor+(n-1)\lceil n/2\rceil+n-2$, the reported formulas are not worst-case; at $n=10$, checking the full range up to $c=43$ already tests this.

Watch

Extended reading notes

Core claim

The paper's central claim is that Crandall reduction—classically a looped fold-and-subtract method for moduli $q=2^n-c$—can be made into a reversible quantum circuit with a fixed structure of two folding steps, followed by one or two conditional subtractions. It derives sufficient conditions: one-step normalization works when $c^2+2c\le 2^n$, and two-step normalization works when $c^2+3c\le 2^{n+1}$. Using a temporary logical-AND-based arithmetic primitive and quantum-classical specialization for the fixed constants, the worst-case T-depth formulas are $T^{\mathrm{CR1}}_D=F(n)+5n+1$ and $T^{\mathrm{CR2}}_D=F(n)+9n+4$, with T-counts four times those depths; here $F(n)=\lfloor n^2/4\rfloor+(n-1)\lceil n/2\rceil$. The paper reports that both variants use fewer qubits, fewer T gates, and less T-depth than optimized folding Barrett reduction, with a representative 46.9% reduction at $n=10$, and that the lower T-depth propagates to smaller surface-code distance and shorter estimated execution time.

Load-bearing premise

The worst-case T-depth and T-count formulas rest on an unproved bound: for every constant $c$ allowed by the normalization condition, the folding stage never needs more carry blocks than the maximum-Hamming-weight case within the assumed bit range, even when $c$ is large enough to extend beyond that range.

Editorial extensions

If this is right

  • For pseudo-Mersenne moduli $q=2^n-c$ with $c^2+2c\le 2^n$, the one-step variant achieves worst-case T-depth $F(n)+5n+1$ and T-count $4F(n)+20n+4$; both are lower than the optimized folding Barrett reduction circuits compared in the paper.
  • The two-step variant admits the larger range $c^2+3c\le 2^{n+1}$ (at $n=10$, $1\le c\le43$ instead of $1\le c\le31$) while still beating Barrett reduction on T-count and T-depth.
  • Because the proposed formulas have smaller quadratic coefficients than Barrett reduction, the resource advantage grows with operand size $n$.
  • The lower T-depth also lowers the required surface-code distance for a fixed target failure probability and shortens estimated fault-tolerant execution time, including decoder backlog time.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The fold-then-normalize template should transfer to other special-form moduli with a small power-of-two offset, such as $2^n+c$ or multi-term generalized Mersenne forms; the paper's range analysis gives a recipe for deriving the admissible constants.
  • The reported worst-case costs are conservative in one direction: constants with sparse binary representations need fewer partial-product additions, so an implementation could tune $c$ (or $n$) to land on a sparse admissible constant and beat the tabulated numbers.
  • In complete algorithms such as Shor's factoring, modular reduction is invoked many times; if the per-call savings survive integration and uncomputation, the end-to-end reduction in T-count could exceed the single-call figure.
  • The runtime model is sensitive to the decoder throughput ratio: if that ratio is even slightly above one, the exponential backlog term amplifies any T-depth difference, so the gap between Crandall and Barrett reduction could widen in decoder-limited settings.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The manuscript proposes two reversible quantum circuits, Crandall reduction-1 and Crandall reduction-2, for modular reduction modulo pseudo-Mersenne moduli q = 2^n − c. It fixes two classical folding steps in the quantum circuit, derives sufficient ranges on c for one-step and two-step normalization, and counts T gates and T-depth using temporary logical-AND-based adders combined with quantum-classical specialization for the constants c and q. It then extends the analysis to a surface-code setting, estimating required code distances via a KQ-style error model and runtimes through a magic-state factory latency model plus a decoder-backlog model, reporting a resource advantage over optimized folding Barrett reduction.

Significance. If the resource counts were correct, this would be a valuable modulus-specialized alternative to Barrett reduction: the derivation is parameter-free, the comparison against optimized folding Barrett reduction is systematic, and the fault-tolerant runtime model provides concrete quantitative predictions. The paper is generally clear, and the two-fold normalization-range analysis is mostly sound. However, the exactness of the reported T-count and T-depth formulas is the central contribution, and the carry-accounting errors identified below mean that the stated numbers are not yet reliable. The qualitative conclusion that Crandall reduction beats Barrett reduction appears robust to the corrections (the n=10 advantage drops from about 46.9% to about 43.9%), but all resource formulas and the derived code-distance expressions need to be re-derived and cross-checked.

major comments (3)
  1. [Appendix B, Eqs. (42)-(44), (50)] The folding and normalization T-depth formulas omit carry or borrow outputs that the circuit logically requires. In Eq. (42), the accumulation of c·a1 into a0 must produce the top bit of a(1) at position n+m−1, since a(1) can reach 2^{n+m}−1; a no-carry adder of effective length n+m−1 produces only bits 0 through n+m−2, so the correct depth is n+m−1, not n+m−2. In Eq. (43), each of the k−1 partial-product accumulations in the second multiplier must propagate its carry into the next bit of the accumulating product, so each addition costs depth m, not m−1. In Eq. (44), the final accumulation of the second product into a'_0 can carry into bit n, so the n-bit no-carry adder of depth n−1 is insufficient and depth n is required. In Eq. (50), the normalization subtractor must output the borrow that controls the restoration addition, so the p=n+1-bit subtractor has depth p, not p−1. Applying these four corrections for n=10 raises T_CR1^D from 121 to 128 and T_CR1_count from 484 to 512, changing the claimed 46.9% reduction over optimized folding Barrett to about 43.9%. Thus Eq. (20) and Table 1 are not exact worst-case resource counts of the circuit as described.
  2. [Section 4.1, Eq. (17)/(20) vs Appendix B Eq. (48); Table 2 odd-n rows] The resource formulas are internally inconsistent for odd n. Eq. (17) and Eq. (20) use (n−1)ceil(n/2) in the folding depth, while the derivation in Appendix B, Eq. (45)-(48), yields (n−1)floor(n/2). For n=11, these differ by 10 in the folding T-depth (89 versus 99, or 136 versus 146 in T_CR1^D). In addition, substituting the Table 1 values of K and D_T into Eqs. (22)-(24) for odd n gives K·D_T = (18n^3 + 129n^2 + 66n + 3)/4 for Crandall-1, not the expression corresponding to Table 2's odd-n row, which contains (18n^3 + 93n^2 + 60n + 9)/4. Since Table 2's code-distance formulas are presented as derived from the logical resource estimates, this discrepancy must be resolved and the affected distance formulas rechecked.
  3. [Appendix B, paragraph after Eq. (39)] The worst-case bound for two-step normalization is asserted without proof. The text claims that admissible constants whose most significant bit lies above the effective range m are offset by a smaller Hamming weight, but no inequality is provided. For n=10, the two-step range includes c=43, which has wt(c)=4 and a highest bit at position 5, while c=31 has wt(c)=5 within positions 0..4; the depth formula depends on both the shift range and the Hamming weight, and it is not shown that the smaller Hamming weight always dominates the larger shift range. Since Eq. (17) is presented as a worst-case bound over all admissible c, this step needs either a proof or a counterexample.
minor comments (4)
  1. [Section 2.2, Eqs. (8)-(9)] The algebraic simplifications in Eqs. (8) and (9) are incorrect: (c+1)2^n / (2^n−c) is not equal to c + c(c+1)/(2^n−c), and the correct expression involves a remainder of (2^n + c^2)/(2^n−c) for Eq. (8) and requires a ceiling rather than a floor. The subsequent conclusions about N_max1 and N_max2 happen to be correct under the stated conditions, but the displayed equations should be fixed.
  2. [Section 5.4 and Figure 6(a)] The statement that 'the execution time was compared on the log10(talg[s]) scale' followed by values such as 1283.13, 932.19, 521.03, and 632.12 is inconsistent; if these are actual runtimes in seconds, the axis label and text should say so, and if they are log10 values, the numbers are implausibly large. Please clarify the units and the axis scaling.
  3. [Table 2 and Eq. (24)] Eq. (24) as written does not contain a ceiling operation, but the entries in Table 2 use ceiling over a base-10 logarithm. The rounding convention should be stated explicitly so the formulas can be reproduced.
  4. [Abstract and Section 4.1] The phrase 'first exact reversible quantum circuit formulation' is stronger than what the manuscript currently supports, given the carry-accounting issues in Appendix B; after correcting the formulas, please re-evaluate this claim or qualify it as 'first formulation with exact resource counts' only once the counts are verified.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the Crandall reduction construction and its resource counts are derived from first principles, with only a minor, non-load-bearing self-citation for the external Barrett baseline.

full rationale

The paper's central derivation is self-contained and parameter-free. The normalization conditions in Section 2.3 follow directly from inequalities on the folded result a(2) <= c^2 + (2^n - 1) and the modulus q = 2^n - c, with no quantity fitted to data. The resource formulas in Section 4 and Appendix B are obtained by counting CCX-level carry-generation blocks, using the worst-case Hamming weight of the admissible constants c, and then multiplying by the fixed T-count 4 and T-depth 1 of the depth-optimized temporary logical-AND primitive. There is no step in which a 'prediction' reduces to an input value or in which a defined quantity is circularly defined in terms of the claimed output. The only author-overlap signal is the citation of optimized folding Barrett reduction [8], which includes one of the present authors (Changyeol Lee). That citation supplies the external baseline counts used for comparison, but it does not justify the Crandall construction itself: the Crandall circuit costs are derived independently, and the comparison is simply arithmetic once both sets of counts are accepted. If the baseline counts are incorrect, this would be a benchmarking or correctness concern, not a circularity of the derivation. Similarly, the skeptic's concern about no-carry adders omitting required final carries is a potential resource-estimation error in Appendix B, not a circular dependency between inputs and the claimed result. Accordingly, no circular step is identified, and the honest finding is a low score reflecting at most a minor, non-load-bearing self-citation.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The central derivation rests on standard quantum arithmetic components and on two paper-specific assumptions: the effective-range lemma for worst-case T-depth (Appendix B) and the exponential decoder-backlog runtime model (Section 5.3). Neither is machine-checked or validated by simulation. No free parameters are fitted to data; physical and hardware constants (error rate, cycle time, decoder throughput) are taken from prior literature.

assumptions (5)
  • standard math The temporary logical-AND construction (Gidney) computes a CCX with T-count 4 and T-depth 1, and measurement-based uncomputation costs no T gates.
    Used throughout Section 3.2 and Appendix A as the CCX-level primitive. Standard result, but not machine-checked here.
  • domain assumption The subtract-then-restore normalization block (quantum-classical subtractor followed by controlled quantum-classical adder) correctly maps a value in [0,3q) into [0,q).
    Assumed in Section 3.1 and Section 2.3; the sign qubit and wraparound behavior are not fully analyzed.
  • ad hoc to paper The worst-case folding T-depth is bounded using the effective active-bit range m=ceil(n/2) and maximum Hamming weight k=floor(n/2); constants outside this range are offset by lower Hamming weight.
    Appendix B asserts this without proof; it is load-bearing for the Table 1 formulas.
  • domain assumption The KQ error model and surface-code logical error model of Eq. (23), with parameters from Refs. [10,18,19], describe the circuit failure probability.
    Section 5.1; standard but approximate model.
  • ad hoc to paper The decoder backlog evolves as delta_k = f^(k-1) delta_1 and total runtime is t approximately 6.5 d c_t D_T plus backlog terms.
    Section 5.3 states this is a simplified exponential backlog model intended for coarse-grained estimates, not validated against decoder simulations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Efficient Quantum Modular Reduction: Crandall reduction and its Fault-tolerant resource analysis." pith.science (2026). https://pith.science/paper/EBNC2SE4

@misc{pith2026260811563,
  author       = {Pith},
  title        = {Pith review of: Efficient Quantum Modular Reduction: Crandall reduction and its Fault-tolerant resource analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EBNC2SE4}},
  note         = {Machine review of arXiv:2608.11563}
}
abstract

Modular arithmetic is central to quantum algorithms for cryptographic problems, including Shor's algorithm and Grover-based cryptanalysis, with modular reduction contributing substantially to circuit cost. Pseudo-Mersenne moduli $q=2^n-c$ allow classical Crandall reduction to replace division with folding and constant arithmetic, providing a structural opportunity for more efficient quantum modular reduction than Barrett reduction. We translate this advantage into a reversible quantum setting by deriving explicit folding and normalization conditions for $2n$-bit inputs. To the best of our knowledge, this constitutes the first exact reversible quantum circuit formulation of Crandall reduction. Based on this formulation, we develop two variants: Crandall reduction-1 is designed to minimize execution cost through one-step normalization, whereas Crandall reduction-2 uses two-step normalization to support a wider range of $c$ with limited overhead. Logical resource estimates show that both variants require fewer qubits and lower T-count and T-depth than optimized folding Barrett reduction. At $n=10$, Crandall reduction-1 reduces both T-count and T-depth by approximately 46.9% relative to optimized folding Barrett reduction. Surface-code analysis further shows that, at $n=20$ under the Sparse Blossom decoder, the estimated runtimes of the two variants are 30.05 ms and 35.39 ms, respectively, compared with 53.77 ms for optimized folding Barrett reduction. These results demonstrate the practical value of exploiting modulus-specific arithmetic structure in fault-tolerant quantum circuit design.

Figures

Figures reproduced from arXiv: 2608.11563 by the authors.

Figure 1
Figure 1. Overall structure of the quantum Crandall reduction circuit for n = 4 and c = 3. The folding stage consists of quantum-classical multiplication by c and quantum-quantum addition to accumulate the folded values. The normalization stage subtracts the fixed modulus q = 2n − c and conditionally restores it when the subtraction result is negative. After forward evaluation, the desig￾nated output register M contains a mod… view at source ↗
Figure 2
Figure 2. illustrates its computation and measurement-based uncomputation for carry and borrow propagation. 𝑎 𝑏 𝑎 ∙ 𝑏 𝑎 𝑏 𝑎 𝑏 𝑎 𝑏 𝑎 ∙ 𝑏 𝑎 𝑏 H 𝑎 𝑏 𝑎 ∙ 𝑏 Z (a) (b) 𝑎 𝑏 𝑇 𝑻† 𝑻† T H S 𝑎 𝑏 𝑎 ∙ 𝑏 [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Temporary logical-AND computation circuit with T-depth 1. An additional temporary ancilla is used to parallelize the T /T† gates, reducing the T-depth from 2 to 1 while preserving the T-count of 4. The additional ancilla is restored to |0⟩ after the computation and can be reused in subsequent arithmetic operations. Based on this primitive, the resource costs of the component arithmetic circuits are obtained by count… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: illustrates the CCX gate simplification used to specialize the quantum-classical arithmetic circuits according to the fixed classical bit pattern. 𝑎 𝑏 𝑎 𝑏 0 𝑎 ∙ 𝑏 𝑎 1 𝑎 1 0 𝑎 𝑎 0 𝑎 0 0 0 [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Logical T-count and T-depth comparison for Barrett reduction circuits and the proposed Crandall reduction circuits. Crandall reduction-1 achieves the lowest non-Clifford cost, while Crandall reduction-2 supports a wider range of c with moderate additional overhead. 5 S…
Figure 6
Figure 6. Figure 6: Comparison of execution times for modular reduction circuits in a surface-code-based FTQC environment. The execution time is calculated using the runtime model in equation (30), where DT (n), d(n), and ∆1(n) are obtained from the logical resource estimates and code-dis…
Figure 7
Figure 7. Figure 7: shows the two ripple-carry adder structures used in the folding stage. Both propagate the carry from the least significant bit to the most significant bit and uncompute the temporary carry values in reverse order. The standard form includes the final carry-out, whereas…
Figure 8
Figure 8. Figure 8: Quantum-classical multiplier for a 4-qubit quantum operand and the 3-bit classical constant 1112. Adders associated with zero bits of the constant are omitted in the specialized circuit. 𝑞𝑎0 𝑞𝑏0 𝑐0 𝑞𝑎1 𝑞𝑏1 𝑐1 𝑞𝑎2 𝑞𝑏2 𝑐2 𝑞𝑎3 𝑞𝑏3 𝑐3 𝑠𝑢𝑏0 𝑞𝑏0 𝑐0 𝑠𝑢𝑏1 𝑞𝑏1 𝑐1 𝑠𝑢𝑏2 𝑞𝑏2 𝑐2 𝑠𝑢…
Figure 9
Figure 9. Figure 9: Quantum-classical subtraction circuit. The left-hand circuit shows the quantum-quantum subtractor based on the inverse temporary logical-AND-based adder, and the right-hand circuit shows its quantum-classical form after replacing one operand with the bit pattern of the…
Figure 10
Figure 10. Figure 10: Controlled quantum-classical adder circuit used for the restoration step in normalization. The control qubit determines whether the fixed classical constant q = 2n − c is added back. The bit pattern of q is embedded into the circuit to remove unnecessary gates. For on…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 6 canonical work pages

  1. [1]

    Bennett C H 1973 Logical reversibility of computationIBM J. Res. Dev.17525–532 (doi: 10.1147/rd.176.0525)

    doi:10.1147/rd.176.0525 1973

  2. [2]

    Paradis A, Bichsel B and Vechev M 2024 Reqomp: space-constrained uncomputation for quantum circuitsQuantum81258 (doi: 10.22331/q-2024-02-19-1258)

    doi:10.22331/q-2024-02-19-1258 2024

  3. [3]

    Orts F, Paulaviˇ cius R and Filatovas E 2024 Quantum circuit optimization of an integer dividerJ. Syst. Softw.215112091 (doi: 10.1016/j.jss.2024.112091)

    arXiv 2024

  4. [4]

    Thapliyal H, Varun T S S, Mu˜ noz-Coreas E, Britt K A and Humble T S 2017 Quantum circuit designs of integer division optimizing T-count and T-depth2017 IEEE International Symposium on Nanoelectronic and Information Systemspp 123–128 (doi: 10.1109/iNIS.2017.34)

    work page doi:10.1109/inis.2017.34 2017

  5. [5]

    Comput.44 519–521 (doi: 10.1090/S0025-5718-1985-0777282-X)

    Montgomery P L 1985 Modular multiplication without trial divisionMath. Comput.44 519–521 (doi: 10.1090/S0025-5718-1985-0777282-X)

    doi:10.1090/s0025-5718-1985-0777282-x 1985

  6. [6]

    Barrett P 1987 Implementing the Rivest Shamir and Adleman public key encryption algorithm on a standard digital signal processorAdvances in Cryptology—CRYPTO ’86 (Lecture Notes in Computer Science vol 263) ed A M Odlyzko (Berlin: Springer) pp 311–323 (doi: 10.1007/3-540-47721-7 24)

    doi:10.1007/3-540-47721-7 1987

  7. [7]

    Crandall R E 1993 Method and apparatus for public key exchange in a cryptographic system US Patent 5,271,061, issued 14 December 1993

    work page 1993

  8. [8]

    Rep.1522808 (doi: 10.1038/s41598-025-04987-1)

    Zhang J, Cho S-M, Lee C and Seo S-H 2025 Optimized quantum folding Barrett reduction for quantum modular multipliersSci. Rep.1522808 (doi: 10.1038/s41598-025-04987-1)

    work page doi:10.1038/s41598-025-04987-1 2025

Show all 22 references
  1. [9]

    Fowler A G, Mariantoni M, Martinis J M and Cleland A N 2012 Surface codes: towards practical large-scale quantum computationPhys. Rev. A86032324 (doi: 10.1103/PhysRevA.86.032324)

    2012 doi

  2. [10]

    Fowler A G and Gidney C 2019 Low overhead quantum computation using lattice surgery arXiv:1808.06709

    2019 arXiv

  3. [11]

    Litinski D 2019 A game of surface codes: large-scale quantum computing with lattice surgeryQuantum3128 (doi: 10.22331/q-2019-03-05-128)

    2019 doi

  4. [12]

    Process.2160 (doi: 10.1007/s11128-021-03398-1)

    Ha J, Lee J and Heo J 2022 Resource analysis of quantum computing with noisy qubits for Shor’s factoring algorithmsQuantum Inf. Process.2160 (doi: 10.1007/s11128-021-03398-1)

    2022 doi

  5. [13]

    Bosselaers A, Govaerts R and Vandewalle J 1994 Comparison of three modular reduction functionsAdvances in Cryptology—CRYPTO ’93(Lecture Notes in Computer Science vol 773) ed D R Stinson (Berlin: Springer) pp 175–186 (doi: 10.1007/3-540-48329-2 16)

    1994 doi

  6. [14]

    Bajard J-C, Imbert L and Plantard T 2005 Modular number systems: beyond the Mersenne familySelected Areas in Cryptography—SAC 2004(Lecture Notes in Computer Science vol 3357) ed H Handschuh and M A Hasan (Berlin: Springer) pp 159–169 (doi: 10.1007/978-3-540-30564-4 11)

    2005 doi

  7. [15]

    Gidney C 2018 Halving the cost of quantum additionQuantum274 (doi: 10.22331/q-2018-06-18-74)

    2018 doi

  8. [16]

    Google Quantum AI and Collaborators 2025 Quantum error correction below the surface code thresholdNature638920–926 (doi: 10.1038/s41586-024-08449-y)

    2025 doi

  9. [17]

    Phys.14123011 (doi: 10.1088/1367-2630/14/12/123011)

    Horsman C, Fowler A G, Devitt S and Van Meter R 2012 Surface code quantum computing by lattice surgeryNew J. Phys.14123011 (doi: 10.1088/1367-2630/14/12/123011)

    2012 doi

  10. [18]

    Steane A M 2003 Overhead and noise threshold of fault-tolerant quantum error correctionPhys. Rev. A68042322 (doi: 10.1103/PhysRevA.68.042322) 19 IOP PublishingJournalvv(yyyy) aaaaaa Authoret al

    2003 doi

  11. [19]

    O’Gorman J and Campbell E T 2017 Quantum computation with realistic magic-state factoriesPhys. Rev. A95032338 (doi: 10.1103/PhysRevA.95.032338)

    2017 doi

  12. [20]

    Haah J, Hastings M B, Poulin D and Wecker D 2017 Magic state distillation with low space overhead and optimal asymptotic input countQuantum131 (doi: 10.22331/q-2017-09-11-31)

    2017 doi

  13. [21]

    Terhal B M 2015 Quantum error correction for quantum memoriesRev. Mod. Phys.87 307–346 (doi: 10.1103/RevModPhys.87.307)

    2015 doi

  14. [22]

    Tan Xet al2023 Scalable surface-code decoders with parallelization in timePRX Quantum4040344 (doi: 10.1103/PRXQuantum.4.040344) 20

    doi

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.