A Novel Hybrid Quantum Circuit for Integer Factorization: End-to-End Evaluation in Simulation and Real Quantum Hardware

Abstract

The literature indicates that the qubit requirements for factoring RSA-2048 remain on the order of 1 million, under commonly assumed architectures and error-correction models, leaving a substantial gap between current resource estimates and near-term practical feasibility. Reducing this requirement to the low-thousand-qubit regime therefore remains an important open research objective. This work proposes a hybrid classical–quantum algorithm that uses a classical modular exponentiation subroutine with a Quantum Number Theoretic Transform (QNTT) circuit to increase the speed and reduce the required quantum resources relative to Shor’s algorithm for integer factorization, which underpins cryptographic systems like RSA and ECC. We evaluate multiple coprime numbers, the result of multiplication of two primes, in both simulation and real quantum hardware, using IBM’s reference Shor implementation as the baseline. Because Shor and proposed Jesse–Victor–Gharabaghi (JVG) use different register sizes for the same coprime N, the reported gate/depth reductions should be interpreted as end-to-end quantum-resource budgets for factoring the same N, rather than a per-qubit or transform-only efficiency claim. In simulation, the JVG algorithm achieved substantial practical reductions in computational resources, decreasing runtime from 174.1 s to 5.4 s, memory usage from 12.5 GB to 0.27 GB, and quantum gate counts by approximately 99%. On quantum hardware, JVG reduced the required runtime from 67.8 s to 2 s, and the quantum gate counts by over 98%. We showed that the proposed algorithm can address the relevant RSA-1024 case scenario, establishing that this method can provide validation for large-scale situations. Furthermore, extrapolation to RSA-2048 indicates that the JVG algorithm significantly outperforms Shor’s approach, requiring a projected quantum runtime of 29 h for ten thousand runs for factorization under identical scaling assumptions. Overall, these results support JVG as a more hardware-compatible and robust noise-tolerant substitute for Shor’s framework, offering a viable research direction toward practical quantum integer factorization on near-term Noisy Intermediate-Scale Quantum (NISQ) devices.

1. Introduction

Quantum computing systems are anticipated to surpass their classical counterpart by implementing quantum mechanical principles like superposition, entanglement, and interference [1,2]. Driven by this potential, quantum computing has been attracting the attention of researchers and investors alike. Funding for the development of quantum technologies, from both public and private investors, increased 54% between 2023 and 2024, reaching US $2.0 billion worldwide, and is expected to reach around US $16.4 billion by 2027 [3,4]. This trend is also reflected in the rapid growth of quantum-focused companies such as D-Wave, IonQ, and Quantinuum, which have increased their market value by more than 2530%, 800%, and 812%, respectively, over the past 12 months, reaching a combined market capitalization of approximately USD 50 billion [5,6,7]. The massive investments in this sector have enabled significant advancements in multidisciplinary fields, such as finance [8,9], materials science [10,11], chemistry [12], pharmacology and health sciences [13,14], and machine learning [15,16].

Another major area impacted by quantum technology is cryptography [17,18,19]. Since Shor proposed a new algorithm using quantum information processing for efficient number factoring back in 1994 [20], his work proved the feasibility of a quantum-based algorithm for number factoring. By using modular exponentiation and the Quantum Fourier Transform (QFT), previously conceived by Coppersmith [21], Shor’s algorithm successfully captured the period of a function $f\left(x\right)=a^{x}modN$ given an initial superposition state. By leveraging these components, this algorithm performs in polynomial time $\mathrm{O}\left({\left(\log N\right)}^3\right)$, as opposed to the exponential time required by the classical procedures for RSA integer factorization [22,23]. The creation of this algorithm demanded a novel way to tackle quantum-based problems [24].

Building upon this knowledge, several subsequent studies sought to improve Shor’s algorithm. In [25], the authors focused on speeding up the arithmetic operations by using improved adder designs, allowing the parallel execution of quantum gates, while also optimizing the circuit’s overall structure. By doing so, they improved modular exponentiation performance by up to 700 times compared with existing approaches. Building upon the knowledge developed by Meter and Itoh [25], the authors in [26] proposed a new reversible circuit for modular exponentiation using linear-size circuits, and working on a register-transfer level instead of the commonly used qubit-transfer level. Their methodology’s overall performance showed better scalability than previously available methods, requiring four times fewer qubits.

The work by Ekerå [27] proposed changes to the QFT algorithm and the post-processing part alike. The author introduced a Shor’s discrete logarithm variant that is optimized when the discrete logarithm $\mathrm{d}$ is significantly smaller compared to the group order $\mathrm{q}$. The algorithm uses smaller QFTs whose sizes reduce the total qubit requirements in this setting. Furthermore, instead of the classical continued fraction method used in Shor’s post-processing, the author employed lattice-based techniques to recover the discrete logarithm from the quantum measurement outcomes. This work has been further expanded in the following work by Ekerå and Håstad [28], where the authors showed that the RSA factorization can be formulated as a short discrete logarithm, thus reducing the burden on quantum computers.

Chevignard et al. [29] optimized the number of required logical qubits for Shor’s algorithm by providing an alternative algorithm for the modular exponentiation part. By combining Ekerå–Håstad’s algorithm, compression techniques, and residual arithmetic, the authors could reduce the number of logical qubits required for RSA integer factoring. However, this simplification introduces a trade-off between the total number of qubits and the number of gates necessary for its implementation. Gidney [30] provides a review on the progress of factoring RSA-2048 using optimized, fault-tolerant variants of Shor’s algorithm. The author focused on minimizing logical qubit counts and circuit depth by combining algorithmic refinements, advanced quantum arithmetic, and lattice-based post-processing techniques, while explicitly accounting for surface-code error correction. Under optimistic physical error rates, Gidney [30] estimates that RSA-2048 factorization would require hundreds of thousands of logical qubits, corresponding to fewer than one million noisy physical qubits, and would take up to days to execute.

Other methodologies investigated different combinations of classical and quantum subroutines to factor coprime numbers, which are integers produced as a result of the product of two prime numbers. This strategy has been reported in several studies [31,32,33]. By combining both classical and quantum frameworks, a significant reduction in the computational burden for Shor’s factorization was achieved, proving the feasibility and utility of such an approach.

As the literature mentions, there are many efforts in different areas of Shor’s algorithm components, ranging from modular exponentiation to post-processing. However, a common feature of these works is their reliance on the QFT circuit or its variants for period extraction. Therefore, it remains necessary to investigate alternatives to the QFT structure itself. For example, alternative transforms may be more practical on quantum hardware for specific applications. One strong contender for this task is the Number Theoretic Transform (NTT), a specialized variant of the DFT that operates over finite fields via modular arithmetic rather than complex numbers [34,35]. Classically, the NTT runs in $\mathrm{O}\left(nlogn\right)$ time and avoids floating-point precision issues, making it well-suited to cryptographic computations [36]. A quantum version of the NTT could, in principle, serve as a substitute for the QFT in algorithms involving integer or polynomial structures. Such an implementation might offer advantages in precision and potentially simpler gate constructions, since modular addition can be easier to realize than arbitrary quantum rotations, especially in the current noisy quantum computer architectures.

Consequently, incorporating a quantum version of the NTT within a quantum framework could lead to a modular design of QFT circuits. By breaking down the QFT into smaller components and selectively substituting them with specialized transforms, the overall circuit can be simplified and made more efficient for NISQ hardware. Such modularization not only streamlines the implementation of fundamental quantum algorithms but also improves their adaptability and performance [37]. Modular QFT architectures support more efficient Quantum Phase Estimation (QPE), a key subroutine in many quantum applications such as quantum chemistry, Hamiltonian learning, and Variational Quantum Eigensolver (VQE) [38]. Decomposing QFT into optimally connected building blocks helps to overcome limitations in qubit connectivity, mitigate gate errors, and reduce decoherence, thereby enabling algorithms to tackle larger instances and deeper circuits [39]. Additionally, this strategy enables dynamic error mitigation and adaptive allocation of quantum resources, thereby enhancing the reliability and scalability of computations on available quantum devices.

Additionally, to the best of the authors’ knowledge, an attempt at a purely classical computation of the phase estimation part of the factorization algorithm is yet to be addressed by the specialized literature. This is a crucial point to be addressed, since the quantum modular exponentiation is the most computationally demanding part of the factorization algorithm as proposed by Shor [40]. In this case, it is expected that by conveying part of the quantum algorithm into a classical framework, it could not only enable faster quantum computations but also factorize larger coprime numbers on currently available quantum machines.

The reviewed literature indicates that the physical qubit requirements for factoring RSA-2048 remain on the order of 1 million, under commonly assumed architectures and error-correction models, leaving a substantial gap between current resource estimates and near-term practical feasibility [30]. Reducing this requirement to the low-thousand-qubit regime therefore remains an important open research objective. To bridge this knowledge gap, we introduce a novel hybrid classical–quantum factorization algorithm, named the Jesse–Victor–Gharabaghi (JVG) algorithm, separating the portions of the processing that can be effectively executed in classical computers from the complex period finding that can be more effectively handled by quantum circuits. This way, the novel architecture incorporates a purely classical modular exponentiation subroutine, followed by a Quantum Number Theoretic Transform as an alternative to the usual QFT circuit. It is important to emphasize that JVG’s novelty lies in advancing number theory period finding by extracting it from a finite ring rather than a complex field.

The present work constitutes the first empirical validation of a hybrid QNTT-based approach through comprehensive benchmarking on both simulated and real quantum backends. This includes resource scaling projections under realistic NISQ constraints. This methodology offers a distinct and measurable contribution beyond previous QNTT formulations, which were neither integrated into, nor tested within, a complete quantum factoring framework.

At this stage of the study, the comparison will be limited to the proposed QNTT-based circuit and the standard Shor’s algorithm using QFT, as provided by IBM, which is our gold standard. This is so we have a clear baseline for evaluating performance and scalability. By establishing a direct comparison, it becomes possible to quantify the resource savings and noise resilience provided by the QNTT circuit, while maintaining the same algorithmic framework.

To keep the comparison interpretable, we report results from for two baselines: (i) IBM’s reference Shor implementation (a fully quantum pipeline including controlled modular exponentiation and IQFT) and (ii) a matched hybrid baseline in which modular-exponentiation values are generated classically and embedded into quantum registers, while the transform block is the inverse quantum Number Theoretic Transform. We separated these baselines because they represent different computational models, i.e., fully quantum and hybrid classical–quantum, respectively. The first approach serves as an end-to-end reference for Standard Shor’s workflow. The second isolates the behavior and cost of the hybrid JVG implementations. This lets us compare the change on the computational model as well as the transform choice.

Additionally, to the best of the authors’ knowledge, the specialized literature has not yet examined a Shor-like factorization workflow in which the modular-exponentiation values used for period estimation are generated in a purely classical subroutine and then encoded into a quantum register for the subsequent spectral step. Because quantum modular exponentiation is widely recognized as the dominant computational bottleneck in Shor’s algorithm [36], we introduce a hybrid classical–quantum factorization workflow, named the Jesse–Victor–Gharabaghi (JVG) algorithm, that delegates modular-exponentiation value generation to a classical routine and then performs quantum period estimation via a transform-and-measurement stage. In JVG, this transform stage is implemented using a Quantum Number Theoretic Transform (QNTT) circuit as an alternative to the conventional inverse Quantum Fourier Transform (IQFT).

2. Methodology

2.1. Quantum Fourier Transform

The Quantum Fourier Transform was conceived by Coppersmith [21]. It is the quantum counterpart of the classical Discrete Fourier Transform (DFT), mapping data from the time domain into the frequency domain. Classically, DFT has complexity $O\left(n^2\right)$ with the following formulation [34,41]:

$$\widehat{f_k}={\displaystyle \frac{1}{\sqrt{N}}}\sum _{j=0}^{N-1}{x}_j{e}^{{\displaystyle \frac{2\pi ijk}{N}}}$$

(1)

Equation (1) shows the output vector $\widehat{f_k}$ as being a normalized linear combination of elements of the input vector $x_j$. The term $e^{{\displaystyle \frac{2\pi ijk}{N}}}$ is the kernel of the transform function, given in terms of indices $j$ and $k$, and by the vector length $N$ itself. According to Euler’s equation, this term can be understood as a combination of the oscillatory influence of sine and cosine at different frequencies, as given by $2\pi i$. Additionally, by using advanced algorithm-building techniques, it is possible to implement a faster variant of DFT with complexity $O(n\log n)$, this version being often referred to as the Fast Fourier Transform (FFT) [42]. The QFT is mathematically defined as [43,44]:

$$\left|j\right.⟩\to {\displaystyle \frac{1}{\sqrt{N}}}\sum _{k=0}^{N-1}{e}^{{\displaystyle \frac{2\pi ijk}{N}}}|k⟩$$

(2)

In expression in Equation (2), the input quantum state $|j⟩$ is mapped into a superposition of states $|k⟩$. Additionally, this being a quantum transformation, it lies within a Hilbert space with dimension N. As a unitary operation over an N-dimensional Hilbert space, QFT performs a linear transformation that preserves inner products and vector norms, ensuring reversibility within the dynamics of a quantum computer [43]. The quantum circuit for a 4-qubit configuration for QFT is presented in Figure 1.

Figure 1 elucidates that the QFT circuit is a sequence of rotations applied over a superposition state. From left to right, the first quantum Hadamard gate puts the qubit into superposition. It is then followed by controlled gates $R_{\varphi }^Z$, which move the qubit around the Z-axis given a $\varphi$ angle. The last two operations are SWAPs, reversing the qubit orders to match the QFT’s definition [43,45].

The QFT, like its classical counterpart, also has an inverse configuration which is used in Shor’s algorithm. Considering the quantum circuit configuration, the IQFT is the same as applying the forward circuit (Figure 1) but reversed. The IQFT circuit is shown in Figure 2:

2.2. Number Theoretic Transform

The Number Theoretic Transform (NTT) is a specialized version of DFT. While the latter operates over complex numbers, the former performs analogous computations over a real finite field or ring, often the integer modulus of a prime [46]. Its formulation is presented in Equation (3) [35]:

$${\widehat{S}}_k=\sum _{j=0}^{L-1}{s}_j{\omega }^{jk}\left(modp\right)$$

(3)

where $mod$ indicates modular operations over a ring defined by a prime number $p$, as in ${\mathbb{Z}}_p=\{0,1,\dots p-1\}$. Modular arithmetic operations then map the results into the defined ring by taking the remainder upon division by $p$. This makes the values wrap around $p$ whenever they exceed this prime number [35]. Still in Equation (3), the term $\omega$ represents the primitive root. In arithmetic, primitive roots generate the set of $L=p-1$ integer coprime values to the prime $p$ through successive exponentiations. Additionally, it is needed that $L\left|\right(p-1)$ and the primitive root must ensure that ${\omega }^j\equiv 1modp$ while ${\omega }^k\not\equiv 1modp$, $\forall 0<k<j$ [35].

Given its similar formulation to the DFT, NTT can be implemented classically to reach complexity $O(n\log n)$ [47]. This is achieved by implementing the Gentleman–Sande algorithm [48]. Originally conceived as a variation of the Cooley–Tukey FFT algorithm [49], the Gentleman–Sande algorithm works in bit-reverse order, performing a decimation-in-frequency (DIF) factorization of the NTT. In this approach, the input sequence is processed in an orderly manner, but the outputs are produced in digit-reversed order. Each stage of the algorithm recursively breaks the problem into smaller parts, combining results using butterfly operations and twiddle factors (i.e., the unitary roots). The bit-reversal step must then be unscrambled at the end to recover the coefficients in the correct order. This variant, alongside Cooley–Tukey’s decimation-in-time (DIT) approach, forms one of the two standard recursive FFT factorizations, and is frequently adapted in NTT applications due to its memory efficiency and modular structure [42,48].

2.3. Quantum Number Theoretic Transform

Building upon the classical NTT and the Gentleman–Sande algorithm, the Quantum Number Theoretic Transform (QNTT) was developed to be used in a quantum framework. The original QNTT implementation used in this study was proposed by Lu et al. [50]. Their methodology combined quantum arithmetic operations together with quantum modular operations to implement a quantum version of the Gentleman–Sande butterfly operation for a configuration using four qubits as input and a modulus equal to 5. The authors implemented their QNTT circuit using NISQ-friendly operations. For example, the adder and subtractor gates are composed of sequences of CNOT gates, which is more efficiently implemented than, for example, the QFT-based adder drapper [51,52,53,54]. By doing so, Lu et al. [50] developed an efficient quantum circuit able to perform QNTT operations in a quantum framework. Figure 3 depicts the QNTT circuit. We recommend referring to their work for further information on this matter.

In Figure 3, the rectangular boxes represent the operations applied to the qubits. In this image, there are two input values represented by registers $|a_0⟩$ and $|a_1⟩$, each one containing n-qubits. The register $|p⟩$ is the integer prime number determining the ring ${\mathbb{Z}}_p$, containing n-qubits. The remaining registers, $|u⟩$ and $|v⟩$, are ancilla qubits that will help to compute the necessary operations, containing n-qubits each [50].

It can be observed that the QNTT circuit uses quantum modulus, addition, and subtraction operations to compute the transforms. It starts with a modulus operation computing $\left|a_0\right.⟩mod|p⟩$, where the result is stored in a register $|u⟩$ using a CNOT gate. Then, the modular operation for the second input value is computed, and its result is stored in $|v⟩$. The next adder and modular operations then compute $\left|a_0+a_1\right.⟩mod|p⟩$, which returns the transformed value for the register $|a_0⟩$. The last three operations compute $\left|a_1-a_0+p\right.⟩mod|p⟩$, finally, it returns the transformed value for the second input register.

2.4. Shor’s Algorithm

Shor’s algorithm was designed to factor a coprime number that is the product of two prime integers. This is done by finding the order $r$ such as $x^r\equiv 1modN$, $N$ being the coprime number to be factored and $x$ a random initial value [55]. The quantum circuit for the order-finding used in Shor’s algorithm is shown in Figure 4.

Figure 4 can be split into three main structures. The first consists of putting the first register $|m⟩$, initialized in state $|0⟩$, into superposition. After that, the quantum modular exponentiation is applied to the circuit via controlled rotations. Here, the controls are the qubits in register $m$ and the targets are the qubits in register $|n⟩$, initialized in state $|1⟩$. Note that the number of qubits in register $|m⟩$ determines the size of the superposition, which impacts the phase estimation. In contrast, the number of qubits in $|n⟩$ needs to be sufficiently large to store integers up to $N$. The last part of the circuit is the inverse QFT in the $|m⟩$ register. At the end of this circuit, the register $|m⟩$ is measured, revealing information about the period of the function $f\left(r\right)=x^{r}modN$ [20,43,45].

2.5. The New Proposed Algorithm

As depicted in Figure 4, the modular exponentiation algorithm is exclusively quantum-based in the original implementation of Shor’s. In this study, we propose a purely classical computation of modular exponentiation, thereby reducing the quantum computational resources required to factorize coprime numbers. In this methodology, the results for $f\left(r\right)=x^{r}modN$ for a set of values $r$ are stored classically and then mapped into a complex Hilbert space. Amplitude encoding takes an input map containing $n$ items $\{x_0,x_1,\dots ,x_{N-1}\}$ and prepares a normalized state $|j⟩$ using the following Equation (4) [44,55,56]:

$$|j⟩={\displaystyle \frac{1}{\sqrt{{\sum }_k{x}_k^2}}}\sum _{\mathrm{k}=0}^{\mathrm{N}-1}{x}_k|k⟩$$

(4)

From Equation (4), the normalization term ensures that the vector’s direction is preserved, keeping its relative internal structure. This feature map is useful for handling large input vectors. In the proposed methodology, this mapping allows for the usage of the previous classical information within the proposed JVG quantum framework [15,16]. This replaces the substantially deeper quantum modular exponentiation subroutine used in Shor’s original approach, shifting the resource burden from quantum arithmetic to classical precomputation plus quantum state initialization. This design enables reuse of the same classically generated $f\left(r\right)$ values across multiple quantum experiments within the proposed JVG framework. The proposed methodology is summarized in Figure 5.

In this study, the modular exponentiation values $f\left(r\right)=x^{r}modN$ were computed classically using NumPy and then encoded into the quantum circuit using amplitude encoding as a data-embedding step [16]. After applying the inverse transform block and measuring the transform register, we use the dominant peak location(s) to form candidate orders, which are then verified classically by checking whether $x^r=1\left(modN\right)$. Once a valid even order is found, we compute candidate factors using $\mathrm{g}\mathrm{c}\mathrm{d}(x^{{\displaystyle \frac{r}{2}}}\pm 1,N)$ and repeat with more shots and/or a new co-prime (x) if the result is trivial.

For the quantum period, finding the JVG algorithm substitutes the IQFT circuit with the IQNTT. The novel quantum circuit for integer factorization in a quantum framework is presented in Figure 6.

Differently from IQFT in Shor’s algorithm, the IQNTT retrieves the period of a given function $f\left(r\right)$ directly over a finite ring ${\mathbb{Z}}_p$. By changing spectral estimation from the complex domain to a ring-based spectrum, we extend the number-theoretic formulation of period finding, offering a further understanding of its implementation.

2.5.1. Theory for IQNTT-Based Period Extraction

In the proposed pipeline, the modular exponentiation values are generated classically using a finite number of sequency and subsequently encoded into a quantum state for spectral processing, like Shor’s. Since these data originate from modular arithmetic, a transform defined over a finite ring is a natural alternative to the conventional IQFT, which is defined over complex roots of unity. In this sense, the role of the IQNTT in the present methodology is not to claim a universal replacement of IQFT for every quantum algorithm, but rather to provide a spectral operator whose algebraic domain is aligned with the arithmetic structure of the present hybrid factorization workflow, while also providing a more suitable algorithm to replace it given the current quantum hardware constraints. We must disclose that this work is scenario-specific and should be interpreted as part of the overall JVG pipeline, rather than as a universal transform-only theorem.

To formalize the suitability of IQNTT for period extraction, one can consider a finite sequence $\{s_0,s_1,\dots ,s_{L-1}\}$ defined over a ring ${\mathbb{Z}}_p$, where $p$ is prime and $L\left|\right(p-1)$, such that there exists a primitive $L$-th root of unity $\omega \in {\mathbb{Z}}_p$ [46,57]. The sequence is periodic with period $r$, where $r\mid L$, i.e., $s_{j+r}=s_j,\forall j.$ The Number Theoretic Transform of this sequence was defined in Equation (3).

In Equation (3), if the sequence $s_j$ is $r$-periodic and $r\mid L$, then ${\widehat{S}}_k=0$ for every $k$ that is not a multiple of $L/r$. Equivalently, the NTT spectrum is concentrated on harmonics indexed as $k=m{\displaystyle \frac{L}{r}},m=0,1,\dots ,r-1.$ Since the sequence has period $r$, the index $j$ can be written as $j=qr+t$, where $t=0,1,\dots ,r-1$ and $q=0,1,\dots ,{\displaystyle \frac{L}{r}}-1$.

Substituting this decomposition into the NTT expression yields Equation (5) as:

$${\widehat{S}}_k=\sum _{t=0}^{r-1}\sum _{q=0}^{{\displaystyle \frac{L}{r}}-1}{s}_{qr+t}{\omega }^{\left(qr+t\right)k}(\mathrm{m}\mathrm{o}\mathrm{d}p)$$

(5)

Using periodicity, $s_{qr+t}=s_t$, thus in Equation (6):

$${\widehat{S}}_k=\sum _{t=0}^{r-1}{s}_t{\omega }^{tk}\sum _{q=0}^{{\displaystyle \frac{L}{r}}-1}{\left({\omega }^{rk}\right)}^q(\mathrm{m}\mathrm{o}\mathrm{d}p)$$

(6)

The second factor is a finite geometric series. If ${\omega }^{rk}\ne 1$, then we have Equation (7) defined as:

$$\sum _{q=0}^{L/r-1}{\left({\omega }^{rk}\right)}^q={\displaystyle \frac{{\left({\omega }^{rk}\right)}^{L/r}-1}{{\omega }^{rk}-1}}={\displaystyle \frac{{\omega }^{Lk}-1}{{\omega }^{rk}-1}}=0\left(\mathrm{m}\mathrm{o}\mathrm{d}p\right)$$

(7)

Because $\omega$ has order $L$, hence ${\omega }^L=1$. Therefore, $S\left(k\right)\ne 0$ can only occur when ${\omega }^{rk}=1$, which is equivalent to $L\mid rk$. Since $r\mid L$, this happens precisely when $k$ is a multiple of $L/r$. Hence, the NTT spectrum is supported only on those harmonics.

This result shows that periodic information is preserved in a sparse spectral form under the NTT, in direct analogy with the role played by Fourier analysis for periodic signals [58]. In the present factorization framework, this is particularly relevant because the sequence being analyzed is generated from modular exponentiation and therefore already belongs to a modular arithmetic setting. Furthermore, IQNTT is mathematically suitable for extracting the order information required by the factorization post-processing stage, while doing so in a domain that is naturally compatible with the arithmetic structure of the problem.

Additionally, the IQFT circuit requires extensive qubit interactions, which is difficult to implement on present quantum hardware. Noisy Intermediate-Scale Quantum (NISQ) devices have limitations such as reduced coherent time per qubit, high error rates per gate, i.e., gate operation errors and gate fidelity, and restricted connectivity, all of which hinder the feasibility of IQFT circuits [59,60]. Conversely, the QNTT and its inverse circuit (Figure 3) avoid rotations in the input transformation, offering a simpler design. As a result, less complex implementations such as QNTT are preferable, as they offer a more efficient hardware-compatible framework for the current quantum devices [61]. The quantitative extent of this advantage is then assessed empirically in Section 3 through simulation and real-hardware benchmarks.

For the IBM Shor baseline, we benchmark the complete order-finding circuit (superposition, controlled modular exponentiation, IQFT, and measurement). For the hybrid JVG workflow, modular-exponentiation values are generated classically and embedded, and we benchmark the quantum portion starting from the embedded state, comparing IQFT vs. IQNTT under identical settings.

We understand that the removal of $x^{r}modN$ would mask the true depth, connectivity stress, and error accumulation that determines its feasibility on NISQ devices. This way, the reported hardware and transpiled metrics are meaningful for NISQ devices, while also being able to provide realistic resource forecasts.

Finally, for the benchmark, we assess resource growth for both simulated and empirical data using Log–Log plots. The fits and slopes are used to compare practical growth rates between the two frameworks at realizable sizes and RSA-relevant scenarios, revealing practical scaling relevance under current NISQ constraints.

2.5.2. Mathematical and Algorithmic Advantages of QNTT over QFT for NISQ Architectures

While the structural substitution of the QFT with the QNTT provides empirical resource reductions, these benefits are fundamentally rooted in the mathematical differences between their respective basis operations and scaling properties. These are described below.

• Elimination of Continuous Phase Synthesis

The standard QFT maps computational basis states using complex roots of unity, requiring a sequence of precise phase rotations applied over a superposition state. Mathematically, for an n-qubit register, the QFT demands $O\left(n^2\right)$ operations, which are heavily dominated by controlled-phase rotations. As the register size n grows, the required rotation angles become exponentially small, following the proportion ${\displaystyle \frac{\pi }{2^k}}$.

Executing these infinitesimal, continuous phase rotations introduces significant coherent errors and phase noise on Noisy Intermediate-Scale Quantum (NISQ) hardware [61]. Furthermore, to run such a circuit on a fault-tolerant architecture, these continuous arbitrary angles must be synthesized into a finite universal gate set (such as Clifford + T). According to the Solovay–Kitaev theorem, synthesizing these rotations to a target precision imposes a massive logarithmic scaling overhead for T-gates, rendering large-scale QFT highly resource-intensive [62].

2.

Exact Finite Ring Arithmetic

Conversely, the QNTT operates strictly over a finite field or ring, typically the integer modulus of a prime. The core transformation in the quantum Gentleman–Sande QNTT relies entirely on modular arithmetic, specifically, addition and subtraction modulo p. In the quantum hardware implementation, these adder and subtractor operations are constructed entirely from sequences of exact CNOT gates.

Because the QNTT avoids rotations in the input transformation, it offers a mathematically simpler and exact design. By shifting the spectral transform from the continuous complex domain ($\mathbb{C}$) to a discrete finite ring $\left({\mathbb{Z}}_p\right)$, the algorithm replaces floating-point phase approximations with strict Boolean logic [42,63]. This completely eliminates the phase truncation errors inherent to large QFTs, allowing the period extraction to be exact without requiring complex rotation gate decomposition.

3.

Decoherence and Error Mitigation Scaling

The algorithmic probability of a circuit yielding a correct measurement outcome decays exponentially with its depth and the two-qubit gate error rate. In the standard QFT, the dense all-to-all connectivity required by the controlled rotations forces extensive SWAP routing on restricted-topology hardware, rapidly deepening the circuit.

The QNTT mitigates this exponential decay by replacing global continuous interactions with localized modular additions and subtractions implemented by CNOT and Toffoli-style primitives [50]. This topological simplification mathematically bounds the error accumulation. The empirical manifestation of this mathematical advantage is observed in the benchmark results, where replacing the QFT-heavy pipeline with the QNTT framework reduced the total quantum gate count by more than 99% for the tested instances. By remaining strictly within exact modular arithmetic, the QNTT bypasses the principal noise vectors of modern quantum hardware, validating its superior scaling behavior.

3. Results

To evaluate the performance of the proposed methodology, we conducted experiments using two different approaches. The first one used the Qiskit SDK to simulate the quantum circuit on a classical device.

Table 1. Hardware for the quantum simulations using a classical computer.

RAM (GB)	CPU	GPU
32	13th Generation i7 (Intel Corporation, Santa Clara, CA, USA)	RTX 4080 16 GB (NVIDIA Corporation, Santa Clara, CA, USA)

has information about the hardware used for quantum simulations in a Windows 11 operating system.

The first part consisted of simulating both Shor’s and JVG on Qiskit Aer simulator (IBM, Armonk, NY, USA), where all the phases of the algorithm are conducted simulating a real quantum computer, to ensure that Shor’s and JVG are compared on an equal basis.

In this pipeline, we selected different coprime numbers ranging from 2 to 309 digits. Selecting these values is necessary to assess the algorithms’ performance on coprime values with different numbers of digits. For each one of these values, the total number of qubits used in the circuit also changes. The implemented Shor’s algorithm could not factor values with more than 5-digit numbers. We also experimented with larger coprime numbers, but due to hardware limitations, given that simulating quantum operations in classical devices is still very demanding [64,65], the Shor’s algorithm failed to run. However, given JVG’s hybrid configuration, it was possible to reduce the computational burden and use fewer resources during simulation, which allowed us to investigate the algorithm’s performance for larger coprime numbers up to 309 digits, representing an RSA-1024 configuration.

The second part involved implementing the same algorithms on an IBM quantum computer using the same numbers. At this stage, it is relevant to note that both methodologies compared the JVG against the Shor’s algorithm implemented by IBM [66], which here will be considered the gold standard for evaluations.

Because Shor’s algorithm and the proposed Jesse–Victor–Gharabaghi (JVG) method use different register sizes for the same coprime $N$, the reported reductions in gate count and circuit depth should be read as end-to-end quantum resource budgets to factor the same $N$, not as a per-qubit metric or a transform-only efficiency improvement.

While the present results do not target many factorizations, i.e., RSA-2048, they establish a clear trajectory of improvement, indicating that the same principles could translate into significant resource savings in the given NISQ era.

Table 2. Coprime numbers evaluated.

Number of Digits	Tested Using Shor’s Algorithm	Tested Using JVG’s Algorithm
2	Solved	Solved
3	Solved	Solved
4	Solved	Solved
5	Solved	Solved
10	Not Capable	Solved
15	Not Capable	Solved
20	Not Capable	Solved
30	Not Capable	Solved
40	Not Capable	Solved
50	Not Capable	Solved
75	Not Capable	Solved
150	Not Capable	Solved
309	Not Capable	Solved

contains information on the number of digits of the coprime numbers, and whether they were factored or not using each algorithm. Henceforth, whenever two-digit numbers are presented in the following tables, they will be listed in ascending order. Additional information can be found in the Supplementary Materials.

To maintain clarity between simulated and experimental outcomes, all performance metrics in this work are reported within their native execution contexts. The simulation-based results use Qiskit’s gate model with the CX and U primitives, along with wall-clock execution time and RAM (memory) consumption as system-level metrics. These measurements capture algorithmic behavior independent of hardware-specific constraints. Conversely, the quantum computer evaluations are based on IBM Q backends that utilize a different native gate basis, primarily SX, CZ, and RZ, and we also report the Qiskit Runtime (QR) wall-clock time returned by the runtime service as a practical indicator of end-to-end execution demand. Because QR can include system-level overheads beyond the circuit itself (e.g., service/runtime orchestration and compilation effects), we use it primarily for within-setting comparisons and trend analysis, while native gate counts remain the primary hardware-independent resource indicators. This ensures that simulator results reflect algorithmic scaling properties, while hardware results capture physical implementation behavior under realistic noise and transpilation conditions.

Finally, we disclose that the circuit preparation—transpilation—simulation is performed using the tools available in the Qiskit library. The selection of the quantum gates for the transpilation is conducted automatically by Qiskit and depends on the optimization level. We have no access other than defining the optimization level from 1 to 3, where level 3 is the most optimized one. Beyond this, we do not have direct control over the specific gate set used in either classical simulations or real-hardware executions. In practice, the transpiled gate set for execution on real quantum devices depends on the configuration of the target quantum processor and may vary from one device to another.

3.1. Results for Quantum Simulation

To account for stochastic effects in the simulation, each experiment was repeated 10 times. The mean and standard deviation were computed for every configuration across these runs. The average coefficient of variation is reported in

Table 3. Results for the simulations of number factorization for both algorithms.

Algorithm	Number of Digits (Qubits)	Runtime (s)	RAM Usage (MB)	CX	U
Shor’s	2 (18)	1.01 ± 0.01	419 ± 1.22	10,541 ± 7	13,971 ± 10
JVG	2 (6)	2.20 ± 0.27	261 ± 2.46	552 ± 0	657 ± 0
Shor’s	2 (22)	2.15 ± 0.02	488 ± 7.61	21,840 ± 6	29,448 ± 18
JVG	2 (6)	2.26 ± 0.05	260 ± 0.38	552 ± 0	657 ± 0
Shor’s	3 (34)	13.16 ± 0.13	1159 ± 10.30	109,994 ± 9	153,827 ± 40
JVG	3 (6)	2.00 ± 0.42	264 ± 5.70	552 ± 0	657 ± 0
Shor’s	4 (46)	40.91 ± 0.63	2794 ± 26.30	344,116 ± 12	490,193 ± 42
JVG	4 (6)	2.24 ± 0.06	260 ± 0.66	552 ± 0	657 ± 0
Shor’s	5 (70)	174.11 ± 2.40	12,505 ± 297.68	1,713,476 ± 16	2,485,724 ± 130
JVG	5 (10)	5.48 ± 0.14	267 ± 0.66	1720 ± 0	1975 ± 0
Shor’s	-	-	-	-	-
JVG	10 (16)	10.70 ± 0.31	278 ± 0.72	3475 ± 0	3962 ± 2
Shor’s	-	-	-	-	-
JVG	15 (22)	16.43 ± 0.56	289 ± 0.59	5238 ± 0	5958 ± 1
Shor’s	-	-	-	-	-
JVG	20 (24)	18.57 ± 0.83	289 ± 2.03	5821 ± 0	6618 ± 0
Shor’s	-	-	-	-	-
JVG	30 (34)	28.98 ± 0.90	303 ± 3.93	8736 ± 0	9918 ± 0
Shor’s	-	-	-	-	-
JVG	40 (42)	39.19 ± 0.92	312 ± 1.01	11,098 ± 0	12,590 ± 0
Shor’s	-	-	-	-	-
JVG	50 (54)	54.49 ± 0.98	328 ± 3.31	14,596 ± 0	16,550 ± 0
Shor’s	-	-	-	-	-
JVG	75 (70)	75.69 ± 1.46	345 ± 1.49	19,322 ± 0	21,894 ± 0
Shor’s	-	-	-	-	-
JVG	150 (80)	93.95 ± 3.73	360.74 ± 5.72	22,237 ± 0	28,495 ± 1
Shor’s	-	-	-	-	-
JVG	309 (110)	105.66 ± 1.74	368.01 ± 2.20	25,152 ± 0	25,195 ± 0
Average Coefficient of Variation	Shor’s	1.17%	1.21%	0.02%	0.03%
	JVG	4.76%	0.73%	0.00%	0.00%

for both approaches.

Results from Table 3 reveal a substantial performance advantage of JVG’s algorithm compared to Shor’s implementation. Most notably, it is noticeable that the proposed methodology was able to address the factorization of significantly larger numbers containing up to 309 digits. This reflects directly on the total amount of qubits used in each circuit. For Shor’s, the number of qubits increased as the coprime number increased. However, this relationship is not necessarily true for JVG’s approach. For example, from Table 3, we can observe that JVG’s circuit size did not change for factoring 15, 21, 143, and 1363, where all of them needed only a 6 qubit-long circuit. Furthermore, considering the largest coprime number for both algorithms, there is a significant difference in the number of qubits. While Shor’s algorithm required 70 qubits to factor a 5-digit coprime number, the JVG approach required only 10 qubits to execute the circuit corresponding to the same number, a difference of 86% in qubit count.

As a direct implication of the circuit size, the simulation time will also differ significantly. The data in Table 3 also reveal that JVG uses significantly less resources than the original Shor’s algorithm. Figure 7 and Figure 8 show the plot for the time and memory (RAM) metrics using a Log₁₀ scale, while Figure 9 represents the increase in the number of qubits in function of the number of digits. Note that the x-axis represents the number of digits required to factor each coprime, not the coprime number itself. These plots should be read as resources required by each pipeline to factor the tested instances, not as a matched-qubit comparison.

Figure 7, Figure 8 and Figure 9 reveal a clear divergence in scaling behavior between the two approaches. Over the measured range, the JVG pipeline exhibits an approximately power-law growth trend in the Log–Log plot, with respect to the number of digits, as indicated by the best-fit regression. Shor’s implementation displays a markedly steeper growth consistent with exponential-like behavior under the same fitting procedure, as noted by the difference between the exponential terms for each fit line. This resulted in the JVG model requiring around 100 s to finish the factorization of a 309-digit coprime number, compared to 170 s for Shor’s to factor a 5-digit-long instance, 41% less time per simulation run. Considering a 5-digit coprime number, the JVG alternative shows improved RAM usage, requiring on average 267 MB of memory, compared to 12.5 GB for the Shor quantum circuit, a 98% lower RAM usage between the two approaches. Considering the largest coprime number for JVG, the RAM usage was around 368 MB, which remains substantially lower than the values reported by Shor’s in the simulated outcomes.

The gate count also reveals that number factorization using the JVG circuit has superior scalability than the traditional Shor’s circuit. Still considering the 5-digit-long case, JVG reduced the number of CX and U gates by 99% compared to the traditional Shor’s. Furthermore, direct assessment on the data in Table 3 reveals better scalability for JVG’s methodology. This implies that the total computational resources will increase, but at a slower rate than Shor’s algorithm.

Considering the variation in resource usage from the smallest to the largest coprime number successfully factored by both algorithms, it is possible to observe how each approach scales as the circuit size increases. For instance, Shor’s circuit exhibited an increase of 172 times in runtime and nearly 29 times for RAM consumption regarding this interval. JVG, in turn, increased 1.5 times regarding the runtime, while the memory presented a small variation of 2%, remaining stable. For gate count, the most significant difference is observed for the U gate, which increased by over 175 times for Shor, while JVG increased nearly 3 times for this same indicator.

As previously stated, Shor’s algorithm, under the same experimental and hardware constraints, could not be executed for coprime numbers larger than 5 digits due to prohibitive computational and memory requirements. On the other hand, JVG’s algorithm was able to factor the corresponding coprime numbers. This distinction is a significant cornerstone, as it is possible to verify the algorithm’s performance beyond Shor’s feasibility and gain access to information related to data performance, resource scaling, and noise sensitivity. Consequently, these results demonstrate that the proposed JVG algorithm has space for further improvements that may lead to successful runs at scales currently unattainable by fully quantum algorithms.

3.2. Results for Implementation on a Real Quantum Device

We also repeated the circuits ten times when implementing the circuits in a quantum device. Differently from the simulation methodology, we could not run the circuits for 5 digits for Shor’s algorithm. This was due to the current constraints of the NISQ devices. They still offer limited coherence time and qubit connectivity, which prevent more profound and more complex quantum circuits from being implemented. Given Shor’s configuration with a computationally expensive modular exponentiation quantum circuit, larger configurations proved to be unfeasible. Nevertheless, we were able to implement JVG’s algorithm for the same previously presented coprime values, which offers a better take on the proposed methodology.

In this phase, the quantum device used in our methodology was “ibm_torino”, which uses the Heron R1 quantum processor and has 133 qubits. For further information, see reference [67].

Additionally, for every configuration, the mean and standard deviation were calculated across these runs, in the same fashion previously described.

Table 4. Results for the implementation of number factorization for both algorithms on a real quantum computer.

Algorithm	Number of Digits (Qubits)	QR (s)	SX	CZ	RZ
Shor’s	2 (18)	4.0 ± 0	54,390 ± 230	26,444 ± 129	24,761 ± 142
JVG	2 (6)	2.00 ± 0	2019 ± 10	1023 ± 7	1350 ± 4
Shor’s	2 (22)	6.5 ± 0.5	116,626 ± 397	56,942 ± 210	50,738 ± 176
JVG	2 (6)	2 ± 0	2014 ± 3	1020 ± 3	1351 ± 3
Shor’s	3 (34)	26.8 ± 0.9	642,895 ± 1098	314,000 ± 536	254,806 ± 456
JVG	3 (6)	2 ± 0	2031 ± 3	1018 ± 4	1333 ± 8
Shor’s	4 (46)	67.8 ± 2.5	2,085,030 ± 2554	1,013,958 ± 1468	805,239 ± 1627
JVG	4 (6)	2 ± 0	2013 ± 4	1019 ± 3	1350 ± 4
Shor’s	5 (70)	-	-	-	-
JVG	5 (10)	2 ± 0	6762 ± 84	3387 ± 47	4184 ± 21
Shor’s	-	-	-	-	-
JVG	10 (16)	2 ± 0	14,423 ± 118	7203 ± 61	8532 ± 62
Shor’s	-	-	-	-	-
JVG	15 (22)	3 ± 0	22,541 ± 255	11,283 ± 129	12,952 ± 62
Shor’s	-	-	-	-	-
JVG	20 (24)	3 ± 0	25,282 ± 197	12,652 ± 97	14,338 ± 75
Shor’s	-	-	-	-	-
JVG	30 (34)	4 ± 0	39,313 ± 228	19,688 ± 150	21,598 ± 69
Shor’s	-	-	-	-	-
JVG	40 (42)	4 ± 0	50,762 ± 355	25,416 ± 170	27,469 ± 97
Shor’s	-	-	-	-	-
JVG	50 (54)	5 ± 0	68,143 ± 1138	34,134 ± 587	36,130 ± 61
Shor’s	-	-	-	-	-
JVG	75 (70)	6.1 ± 0.32	91,734 ± 771	45,951 ± 397	47,823 ± 111
Shor’s	-	-	-	-	-
JVG	150 (80)	7 ± 0	106,533 ± 701	53,404 ± 359	54,994 ± 105
Shor’s	-	-	-	-	-
JVG	309 (110)	8.9 ± 0.32	151,144 ± 1617	75,759 ± 857	76,673 ± 117
Average Coefficient of Variation	Shor’s	3.80%	0.26%	0.29%	0.33%
	JVG	0.62%	0.75%	0.83%	0.36%

Note: QR (s) denotes Qiskit Runtime wall-clock time reported by the runtime service.

contains the results for implementing the algorithms.

In Table 4, both methodologies exhibited stable behavior across repeated runs, with relative standard deviations remaining within a few percentage points of the mean. The inclusion of add/subtract blocks in the QNTT circuit, together with its hybrid architecture, correlates with reduced numbers of SX, CZ, and RZ gates. The same behavior was observed in the data in Table 3 for the simulated results. The JVG algorithm showed more stable runs concerning the QR variation, as its standard deviation was near zero across the assessed circuits, a significant improvement over the 3.80% reported by Shor’s algorithm. The JVG implementation maintained comparable variability for the primary quantum gate metrics, reaching 0.75% for SX, 0.83% for CZ, and 0.36% for RZ gates. The counterpart version reached 0.26%, 0.29%, and 0.33%, respectively. Table 4 confirms the simulated results previously presented, where the proposed JVG algorithm managed to use less resources than the traditional Shor’s algorithm.

Figure 10 presents the plots comparing QR versus the total number of digits and qubits in the circuit for each coprime number. In Figure 10, the QR consumption associated with Shor’s algorithm follows a different empirical trend than that observed in Figure 7. In this case, the data are better described by a power-law fit rather than the exponential-like growth previously observed. Similarly, the JVG algorithm also shows a power-law profile, in the Log–Log plot. Still, the increase in QR consumption for JVG remains significantly lower than the one exhibited by Shor’s implementation. Across all evaluated coprime numbers, JVG maintained a QR time well below 10 s. In contrast, Shor’s algorithm presented a significant variation in its QR-reported runtime, growing from 4 s to around 68 s between its initial and final configurations. A similar disparity is observed in quantum gate usage. Relative to the full Shor factoring pipeline for the same tested instances, the total quantum gate count is reduced by more than 99% in the JVG approach.

Moreover, Shor’s algorithm exhibited an approximately 16-fold increase in QR from its initial to its final configuration, whereas the QR associated with JVG increased by only a factor of three over a substantially larger problem size. Circuit size followed a similar trend. As the coprime number increased from two to four digits, Shor’s implementation expanded markedly from 18 to 46 qubits, leading to a rapid escalation in resource consumption, as shown in Table 4. By contrast, the JVG architecture displayed considerably more stable behavior, particularly for smaller coprime numbers, and was able to execute circuits corresponding to a 309-digit coprime number using a 110-qubit configuration. This reaffirms the intense resource consumption by Shor’s algorithm, compared to JVG, especially in terms of QR and qubit usage.

3.3. Projections for RSA-Relevant Scenarios

The goal of this extrapolation is to compare measured resource-growth behavior between the two pipelines, and not to claim a change in the known asymptotic complexity. These projections should therefore be interpreted as indicative scaling trends rather than precise forecasts, because extrapolation beyond the measured range is sensitive to error accumulation, compilation choices, and hardware-specific constraints that can change at larger qubit counts.

For clarity, we focus on a single cryptographically relevant reference point, namely, RSA-2048. Importantly, the projected “QR time” reported represents an estimate of the quantum execution cost for a single order-finding attempt under the same experimental compilation/runtime context, rather than a guaranteed end-to-end wall-clock “time-to-break RSA” under all conditions. The total time-to-factor depends on the number of attempts required (e.g., repetitions over shots and/or co-prime choices of $x$) to obtain a usable order and nontrivial factors.

Considering that the same circuit size to factor RSA-2048 is used for both methodologies, we can observe a substantial divergence relative to Shor’s baseline in the projected quantum execution cost per order-finding attempt. Considering the regression equations from Figure 10, for a cryptographic relevant quantum computer, Shor’s methodology is projected to demand years to factor an RSA-2048 number, while JVG is estimated to require around minutes to perform the same task. Converting per-attempt values into an end-to-end “time-to-factor” requires accounting for the expected number of repetitions needed to recover a valid order and nontrivial factors. For example, ten thousand attempts would scale the JVG estimates to roughly 29 h, while preserving the large gap relative to the Shor baseline.

4. Discussion

Before interpreting these findings, it is important to clarify the conceptual scope of our contribution. The novelty of the JVG algorithm lies in its hybrid architecture, which combines classical modular exponentiation with a QNTT step, resulting in a compact quantum circuit. By removing the most resource-intensive components of the factoring pipeline to classical computation, i.e., the quantum modular exponentiation circuit, the quantum portion of the algorithm is reduced to a minimal and well-structured configuration that performs spectral analysis more efficiently than standard Shor’s, as observed in both simulated and experimental results. Finally, we state again that since Shor and JVG allocate different numbers of qubits to represent the same coprime $N$, our gate-count and depth comparisons should be interpreted as whole-pipeline resource budgets for factoring $N$, not as an isolated improvement in the transform stage or a per-qubit advantage.

4.1. Implications of Simulated Results for JVG’s Algorithm

The overall performance of the proposed JVG algorithm showed remarkable improvement over the standard Shor’s methodology, as observed in Table 3. JVG’s faster runtime of quantum circuits is essential for the feasibility testing of the algorithm before moving to a real quantum device. The lower memory usage by JVG indicates better efficiency in terms of classical hardware use. This is of relevant interest given that currently, the simulation of quantum operations in classical devices is heavily constrained in memory usage [64,65]. Thus, more efficient algorithms offer a superior option for modelling and simulating more complex circuits.

Considering number factorization using Shor’s algorithm, the high amount of gates makes it hard to implement on the current noisy machines [61]. The proposed JVG methodology, combining a classical modular exponentiation subroutine with a QNTT structure, demonstrated improved scaling for quantum gate usage. The implementation of the proposed factorization methodology opens the way for a more NISQ-friendly alternative, in which scalability is essential [68]. Additionally, the proposed JVG algorithm offers more efficient simulations on classical backends, which remain an essential step for validating quantum algorithms before moving to a real quantum machine [69,70].

Therefore, the improvements achieved with JVG provide more tractable simulations of larger problem instances and a more realistic foundation for implementing integer factorization, while enabling relevant savings on a simulation cost-per-run basis.

4.2. Implications of Experimental Quantum Results for the JVG Algorithm

Considering the experimental data in Table 4, once again, the JVG methodology managed to reach better metric indicators. Considering the QR metric, the proposed methodology requires less processing time and executes more efficiently, demonstrating that the JVG algorithm can better manage resource growth when implemented on real quantum devices. This is important for current NISQ machines, since they still lack a larger coherence time, thus preventing long computations [61,68]. In this context, it would be possible to implement factorization algorithms more efficiently for more complex circuits [28,71].

On real quantum hardware, such as IBM Quantum backends, operational cost is dominated by backend occupancy time, circuit depth, and the number of repetitions required to obtain a valid result, rather than by directly observable energy consumption. In this context, higher throughput and shorter quantum runtimes translate into lower effective cost per successful execution. Assuming identical experimental configuration, Shor’s algorithm needed 68 s to factor a 4-digit long coprime number, while JVG needed only 2 s. This represents a 97% reduction in effective backend occupancy time per run, under identical experimental configuration. This highlights the more efficient use of quantum hardware resources achieved by the JVG approach.

The reduced number of quantum gates in JVG’s configuration is particularly relevant in the current NISQ context. In particular, two-qubit controlled gates such as CZ are significant sources of error and reduced entanglement fidelity on quantum hardware when compared with single-qubit operations [72,73]. By mitigating their use, it is possible to obtain more reliable circuits in terms of both stability and noise resistance, which are highly desirable properties. When combined with reductions in single-qubit gates such as SX and RZ, these improvements enable shallower and more error-resistant implementations of number factorization algorithms.

The values presented in Table 4 should be regarded as indicative of performance trends rather than absolute benchmarks, as the experimental setup remains constrained by the current limitations of NISQ hardware. Likewise, percentage-based improvements on small baselines may exaggerate significance. Thus, this discussion focuses on comparative growth rates to assess true scalability and robustness.

Nevertheless, despite these hardware constraints, the experimental findings reinforce the robustness of the JVG methodology when implemented on real quantum devices, validating its projected trends observed in the experimental setup, further supporting the reliability and practical significance of the proposed approach in NISQ computing applications.

4.3. Implications of the Projected Values for RSA-Relevant Scenarios

The RSA projections are entirely data-oriented and derived from the experimentally observed relationships between gate count and qubit number. They provide an evidence-based estimation of how both methodologies might behave under more complex circuit configurations, and for relevant scales, considering the experimental setup. The projected results indicate that the JVG algorithm sustains a markedly slower resource growth rate across all gate types and circuit-depth metrics compared to Shor’s framework. Specifically, they suggest that the JVG architecture maintains its scalability advantage even for RSA-size problems, reinforcing its potential as a more hardware-efficient, noise-resilient solution for future quantum cryptographic implementations. This behavior is already evident in the measured results presented in Table 3 and Table 4, where the JVG resource consumption exhibits an approximately linear increase with circuit size (and digit increase), as opposed to the growth observed for Shor’s algorithm. Therefore, JVG exhibits markedly slower empirical growth in runtime and quantum gate count.

Interpreting the projected QR values as per-attempt quantum execution cost, the RSA-scale estimates still indicate an extreme separation between the pipelines: the Shor baseline grows into multi-year projected QR-time. At the same time, JVG remains in the seconds-to-minutes regime per attempt for the exact samekey sizes. The end-to-end “time-to-factor” then follows by multiplying these per-attempt values by the expected number of attempts required to recover a valid order and nontrivial factors. However, that repetition factor depends on implementation details and success probability; it does not alter the central observation that JVG exhibits a substantially slower empirical growth trend under the measured compilation and hardware constraints.

Nevertheless, the projected runtime for RSA-relevant scenarios discloses an important difference between the two methodologies. We must reinforce the idea that projected time values are calculated directly using a power-fit regression equation. This means that the projections are performed using a small-scale and noisy machine to extrapolate values for a quantum circuit which is still not physically feasible within the current NISQ machine limitations. As such, the projected values fall within an area of uncertainty and should not be understood as realistic resource estimates for breaking RSA-sized keys, but rather as measures for the relative scale difference between Shor’s and JVG’s algorithms under the current methodology and how adopting the hybrid configuration could be beneficial to this specific task. In fact, the specialized literature reported that near-future quantum devices could be able to tackle RSA encryption keys but would require many hours to completely factor them [30,74].

JVG offers both a more efficient framework for validating algorithms on classical backends and a more suitable alternative for implementing integer factorization on current devices, where reducing computational cost is paramount [30,71].

4.4. Statistical Consistency and Implications on NISQ Hardware Devices

The statistical analysis for both simulated and experimental benchmarks provide insight into the stability and reliability of the obtained results. The consistently low coefficients of variation observed in both environments indicate that JVG architecture exhibits robustness to errors and predictability comparable to Shor’s within the same benchmarking framework. The results suggest that the JVG gate structure has a favorable interaction with NISQ noisy characteristics. The statistical analysis validates the repeatability of the experiments. Also, it provides strong evidence that the JVG framework constitutes a more noise-resilient and hardware-efficient approach to quantum integer factorization.

4.5. Impact of Classical Modular Exponentiation and QNTT-Based Period Finding

As previously stated, the most significant bottleneck in Shor’s pipeline is the quantum modular exponentiation subroutine [40,74]. By replacing quantum modular exponentiation with a classical computation followed by quantum-state encoding, JVG’s algorithm achieved significant reductions in both execution time and overall computational resource requirements for the tested coprime integers when compared with Shor’s approach. This resulted in successful factorization of a 309-digit-long number in both simulated and experimental frameworks.

Beyond the hybrid decomposition itself, the integration of the QNTT circuit within the order-finding stage further contributed to the superior performance of the JVG methodology. The QNTT offered a novel methodology for number factorization by expanding QFT period finding from $\mathbb{C}$ to a finite ${\mathbb{Z}}_p$ ring. Thus, rather than sample phase estimations with complex roots of unity as in QFT, QNTT retrieves the period for number factorization by using $\omega$ mod $p$. This ring-based alternative expands number theory for factorization by implementing modular arithmetic. Empirically, this resulted in the JVG circuit’s slower growth in time and gates and its low variability on hardware, indicating that the periodicity of ring structures can be directly leveraged to improve quantum integer factorization on NISQ devices. As shown in Table 3 and Table 4 and Figure 7, Figure 8 and Figure 9, the linear behavior of QR-time for the proposed methodology is noticeable when compared to Shor’s.

While QFT relies on rotational gates (Figure 1 and Figure 2), JVG is less dependent on these operations. These gates require long lasting qubit interactions, which can amplify not only errors in NISQ machines but also offer worse scalability, as reported. By contrast, the inclusion of the QNTT structure proved to be NISQ-friendly. Here, JVG replaces many fine-angle controlled rotations with regular add and subtract structures implemented by CNOT and Toffoli-style primitives [52,54]. This architecture enables a more regular, localized gate topology, reducing errors from entanglement and other qubit interactions, as evidenced by the reported benchmark results and projected values.

On real backends, this yields shallower depth and lower run-to-run variability, consistent with the observed small coefficients of variation. Additionally, although modular exponentiation dominates the asymptotic cost in Shor’s algorithm, the proposed approach effectively reduces both the depth and the number of two-qubit operations across the full pipeline, improving scalability within fixed hardware budgets.

Additionally, we show that RSA-1024-scale factorization (309 digits) is achievable under the proposed methodology, marking a key milestone of this study. This is a clear indication of the scalability achieved by the proposed algorithm for both time and quantum gate resources for an end-to-end routine. This demonstrates that the workflow can be executed at cryptographically relevant sizes, supporting the methodology’s scalability. While projections for RSA-2048 are promising under the present methodology, we emphasize that these projections are extrapolations and do not by themselves imply practical RSA-2048 factorization on near-term hardware.

5. Conclusions

This study proposes testing the hypothesis that a hybrid classical–quantum algorithm for number factorization can outperform a fully quantum one, such as Shor’s algorithm. It leverages the properties of number theory to theoretically transform into a quantum framework, combining a classical modular exponentiation subroutine with the QNTT circuit into Shor’s pipeline to achieve a more efficient alternative for number factorization, while also expanding the number theory for number factorization. To verify the feasibility and performance of the proposed methodology, we investigated several coprime numbers across quantum circuits of varying qubit sizes.

In the simulation results, the JVG approach was consistently more scalable regarding runtime, memory, and gate count. Furthermore, performance gains became more relevant with the growth of circuit size, leading to improved handling of larger problem sizes. For both simulated and experimental setups, the proposed methodology managed to reach faster computational times while using fewer quantum gates, achieving a shallower circuit. Additionally, we reported results concerning RSA-1024, showing that the proposed methodology can address meaningful real-world cases. These outcomes are relevant because they provide evidence of a better alternative to Shor-based algorithms, reducing resource overhead and mitigating noise-prone operations involving quantum gates, including RSA-scale scenarios. These characteristics are desired in circuits for near-term quantum machines.

Future research should investigate ways to improve the proposed methodology. A possible topic of investigation is to examine other mapping methodologies for the hybrid circuit. Another possibility is to change the post-processing strategy, which could benefit from the proposed methodology.

Overall, this study establishes JVG’s hybrid classical–quantum circuit as a promising alternative toward implementing practical quantum integer factorization. The demonstrations of consistent improvements on runtime, memory usage, and gate counts during both simulated and experimental phases make the proposed methodology a more efficient and error-resilient approach for NISQ devices. These gains were achieved by segregating exponentiation to the classical computer and replacing computationally intensive IQFT with a more NISQ-friendly quantum period-finding quantum circuit, which in the validation employed the IQNTT algorithm. Given the importance of number factorization with reduced quantum resources, it directly affects fields such as cryptography.

The validation findings suggest that JVG is a promising and scalable alternative for quantum integer factorization, including RSA-scale security in the NISQ era. As future advances in quantum hardware unfold, the JVG framework is expected to undergo refinements and adaptations similar to those experienced by Shor’s algorithm. Such developments could ultimately yield more practical and resource-efficient quantum factoring methods, enabling efficient cryptographic applications on quantum devices within the NISQ era.