We show that a set of gates that consists of all one-bit quantum gates (U(2)) and the two-bit exclusive-or gate (that maps Boolean values $(x,y)$ to $(x,x \oplus y)$) is universal in the sense that all unitary operations on arbitrarily many bits $n$ (U($2^n$)) can be expressed as compositions of these gates. We investigate the number of the above gates required to implement other gates, such as generalized Deutsch-Toffoli gates, that apply a specific U(2) transformation to one input bit if and only if the logical AND of all remaining input bits is satisfied. These gates play a central role in many proposed constructions of quantum computational networks. We derive upper and lower bounds on the exact number of elementary gates required to build up a variety of two-and three-bit quantum gates, the asymptotic number required for $n$-bit Deutsch-Toffoli gates, and make some observations about the number required for arbitrary $n$-bit unitary operations.Comment: 31 pages, plain latex, no separate figures, submitted to Phys. Rev. A. Related information on http://vesta.physics.ucla.edu:7777

We investigate the concept of quantum secret sharing. In a ((k, n)) threshold scheme, a secret quantum state is divided into n shares such that any k of those shares can be used to reconstruct the secret, but any set of k − 1 or fewer shares contains absolutely no information about the secret. We show that the only constraint on the existence of threshold schemes comes from the quantum "no-cloning theorem", which requires that n < 2k, and, in all such cases, we give an efficient construction of a ((k, n)) threshold scheme. We also explore similarities and differences between quantum secret sharing schemes and quantum error-correcting codes. One remarkable difference is that, while most existing quantum codes encode pure states as pure states, quantum secret sharing schemes must use mixed states in some cases. For example, if k ≤ n < 2k − 1 then any ((k, n)) threshold scheme must distribute information that is globally in a mixed state.Suppose that the president of a bank wants to give access to a vault to three vice presidents who are not entirely trusted. Instead of giving the combination to any one individual, it may be desirable to distribute information in such a way that no vice president alone has any knowledge of the combination, but any two of them can jointly determine the combination. In 1979, Blakely [1] and Shamir [2] addressed a generalization of this problem, by showing how to construct schemes that divide a secret into n shares such that any k of those shares can be used to reconstruct the secret, but any set of k − 1 or fewer shares contains absolutely no information about the secret. This is called a (k, n) threshold scheme, and is a useful tool for designing cryptographic key management systems. Now, consider a generalization of such schemes to the setting of quantum information, where the secret is an arbitrary unknown quantum state. Salvail [3] (see also [4]) obtained a method to divide an unknown qubit into two shares, each of which individually contains no information about the qubit, but which jointly can be used to reconstruct the qubit. Hillery, Bužek, and Berthiaume [4] proposed a method for implementing some clas- * Email: cleve@cpsc.ucalgary.ca † Email: gottesma@t6-serv.lanl.gov ‡ Email: hkl@hplb.hpl.hp.com sical threshold schemes that uses quantum information to transmit the shares securely in the presence of eavesdroppers. Define a ((k, n)) threshold scheme, with k ≤ n, as a method to encode and divide an arbitrary secret quantum state (which is given but not, in general, explicitly known) into n shares with the following two properties. First, from any k or more shares the secret quantum state can be perfectly reconstructed. Second, from any k − 1 or fewer shares, no information at all can be deduced about the secret quantum state. Formally, this means that the reduced density matrix of these k − 1 shares (with the other shares traced out) is independent of the value of the secret. Each share can consist of any number of qubits (or higher-dimensional states), and not all shares nee...

Quantum computers use the quantum interference of different computational paths to enhance correct outcomes and suppress erroneous outcomes of computations. A common pattern underpinning quantum algorithms can be identified when quantum computation is viewed as multi-particle interference. We use this approach to review (and improve) some of the existing quantum algorithms and to show how they are related to different instances of quantum phase estimation. We provide an explicit algorithm for generating any prescribed interference pattern with an arbitrary precision.

Classical fingerprinting associates with each string a shorter string (its fingerprint), such that, with high probability, any two distinct strings can be distinguished by comparing their fingerprints alone. The fingerprints can be exponentially smaller than the original strings if the parties preparing the fingerprints share a random key, but not if they only have access to uncorrelated random sources. In this paper we show that fingerprints consisting of quantum information can be made exponentially smaller than the original strings without any correlations or entanglement between the parties: we give a scheme where the quantum fingerprints are exponentially shorter than the original strings and we give a test that distinguishes any two unknown quantum fingerprints with high probability. Our scheme implies an exponential quantum/classical gap for the equality problem in the simultaneous message passing model of communication complexity. We optimize several aspects of our scheme.

We present an efficient quantum algorithm for simulating the evolution of a sparse Hamiltonian H for a given time t in terms of a procedure for computing the matrix entries of H. In particular, when H acts on n qubits, has at most a constant number of nonzero entries in each row/column, and H is bounded by a constant, we may select any positive integer k such that the simulation requires O((log * n)t 1+1/2k ) accesses to matrix entries of H. We show that the temporal scaling cannot be significantly improved beyond this, because sublinear time scaling is not possible.