
where |ki is a n-qubit computational-basis state, |ai is
a single ancilla qubit, and the action of the X gate is
given by the Pauli matrix σ
x
. Note that if the state of
the ancilla is |ai =
1
√
2
(|0i − |1i), as done in Grover’s
subroutine, the action of U
prime
on a superposition is
to introduce relative minus sign for prime numbers.
The relevant observation here is that the above uni-
tary amounts to code on a quantum computer a pri-
mality test, which is a language that belongs to the
complexity class P . As a consequence, the operation
U
prime
only involves a polynomial number of quantum
gates, which will depend on the specific primality test
chosen. For the sake of illustration, a detailed explicit
form of a quantum primality oracle with O(n
6
) gates,
based on the classical Miller-Rabin test [14], was pro-
duced in Ref. [1]. Other primality algorithms, such
as the AKS primality test [15], could be used as well.
We can then consider a first probabilistic way
to create the Prime state. We need to apply the
unitary U
prime
on the uniform superposition of all
computational-basis vectors, |φi =
1
√
2
n
P
2
n
−1
i=0
|e
i
i,
plus an ancilla in the |0i state; where |φi is created
by applying n Hadamard gates, H
⊗n
, onto the initial
|0 . . . 0i state. This yields:
r
2
n
− π(2
n
)
2
n
X
p: not prime
|pi|0i+
r
π(2
n
)
2
n
X
p: prime
|pi|1i.
(3)
By measuring the ancillary qubit in the above state,
and post-selecting whenever the result of the mea-
surement is |1i, one obtains the Prime state. This
will occur with probability ∼
1
n ln 2
, according to the
Prime Number Theorem (see below). Because this
probability decreases only polynomially with n, this
is an efficient method to create the state.
A more refined, deterministic way to create the
Prime state consists in using a Grover’s algorithm
that uses a primality test as oracle. The efficiency of
the algorithm hinges on two facts. The first was men-
tioned previously, that is, the oracle based on U
prime
is efficient. The second fact that guarantees the ef-
ficiency in the construction of the Prime state is the
relatively high abundance of primes, π(x), which is
asymptotically given by the logarithmic integral func-
tion, Li(x) ≡
R
x
2
dt
ln t
, i.e.
π(x) ∼ Li(x)
x→∞
−−−−→
x
ln x
. (4)
This result is known as the Prime Number Theorem
(PNT) [16], and it implies that the needed number of
calls to Grover’s oracle is only O(
√
n). Indeed, this
estimate is given by
π
4
q
N
M
[17], where N = 2
n
is the
dimension of the Hilbert space of n qubits and M is
the number of solutions to the oracle, i.e. M = π(2
n
).
Therefore, the overall computational complexity of
generating a Prime state of n qubits on a quantum
computer with this method, using e.g. Miller-Rabin
primality test, is O(n
6.5
) [1].
As mentioned previously, once an oracle for the
Prime state has been created, it can be used to nu-
merically verify (or falsify) the Riemann hypothesis,
which constitutes one of Clay Mathematics Institute’s
Millennium Problems [18]. The Riemann hypothesis
states, for the distribution of prime numbers, that the
deviations of π(x) from Li(x) are bounded asymptot-
ically with x as [19]
|π(x) −Li(x)| ≤
1
8π
√
x ln x for x > 2657 . (5)
The quantum algorithm proposed in Ref. [1] allows to
compute π(x) beyond the limits achievable by means
of classical computation –once a fault-tolerant univer-
sal quantum computer is built– by using a quantum
counting algorithm that provides an estimate of the
number of terms in superposition in the Prime state.
So far, π(x) have been computed up to 10
27
[4], which
implies that a Prime state with a minimum of ∼ 90
logical qubits would be needed to surpass this com-
putation (since 2
90
' 1.238 × 10
27
).
To do so, it was suggested to apply a quantum
counting algorithm [5] that delivers the number of so-
lutions M to an oracle search problem; in this case,
the number of primes that are marked by Grover’s or-
acle, G. This algorithm uses Quantum Phase Estima-
tion (QPE) [20] to obtain the eigenvalues of G, which
in turn reveal the number of solutions to the query
problem. In order to obtain an estimate of π(x) that
is meaningful, the precision in the estimation should
be smaller than the fluctuations allowed by the Rie-
mann Hypothesis. To achieve such precision, O(
√
2
n
)
calls to the oracle are needed. This is quadratically
better than the performance of any classical counter-
part in an identical oracular setting of the counting
problem. Recently, there have been new proposals for
quantum counting the solutions to an oracle G that
do not rely on QPE [21]. In practice, any quantum
counting algorithm may be applied.
For the sake of completeness, let us recall that the
best classical algorithms that compute π(x) uncon-
ditionally, i.e. the validity of the estimation not de-
pending on the truthfulness of the Riemann Hypoth-
esis or any other unproven conjecture, do not however
rely on enumerating all primes. The main algorithm
for computing π(x) is a combinatorial method due to
Meissel [22] and Lehmer [23], which has subsequently
been improved by Lagarias, Miller and Odlyzko [24],
Del´eglise and Rivat [25], and Gourdon [26]. The latter
version of this algorithm, which has time complexity
O(x
2/3
ln
−2
x), was used to compute π(10
27
). An-
other two analytic algorithms for computing π(x), put
Accepted in Quantum 2020-11-28, click title to verify. Published under CC-BY 4.0. 3