Let N be a (large) positive integer, let b be an integer satisfying 1< b < N that is relatively prime to N, and let r be the order of b modulo N. Finally, let QC be a quantum computer whose input register has the size specified in Shor's original description of his order-finding algorithm. In this paper, we analyze the probability that a single run of the quantum component of the algorithm yields useful information---a nontrivial divisor of the order sought. We prove that when Shor's algorithm is implemented on QC, then the probability P of obtaining a (nontrivial) divisor of $r$ exceeds $.7$ whenever N \ge 2^{11} and r\ge 40, and we establish that $.7736$ is an asymptotic lower bound for $P$. When $N$ is not a power of an odd prime, Gerjuoy has shown that $P$ exceeds 90 percent for $N$ and $r$ sufficiently large. We give easily checked conditions on N and r for this 90 percent threshold to hold, and we establish an asymptotic lower bound for $P$ of 2\Si(4\pi)/\pi ~0.9499 in this situation. More generally, for any nonnegative integer $q$, we show that when QC(q) is a quantum computer whose input register has $q$ more qubits than does QC, and Shor's algorithm is run on QC(q), then an asymptotic lower bound on P is 2\Si(2^{q+2}\pi)/\pi (if N is not a power of an odd prime). Our arguments are elementary and our lower bounds on P are carefully justified.
input register
