RSA-2048 quantum estimate: 22,593 qubits, not a break

In their RSA-2048 quantum estimate, Alice & Bob researchers put the number at 22,593 physical cat qubits to factor RSA-2048 in 3.14 days — under hardware assumptions nobody has demonstrated yet. This is a resource calculation, not a break. What matters is how hardware-specific error correction and redesigned arithmetic shrink the projected machine — and what that means for migration planning.

RSA still protects online banking, email, and digital signatures. Alice & Bob's announcement recommends starting the post-quantum transition now because replacing infrastructure takes years. For engineers maintaining key exchange and signing systems, the move is to separate the mathematical resource reduction from the hardware still needed to realize it.

How does the RSA-2048 quantum estimate get so small?

The reduction comes from designing the computation around a specific qubit type, not treating all quantum hardware as interchangeable. A logical qubit spreads error-corrected information across physical qubits. Cut the physical overhead and you shrink the machine — even if the logical qubit count barely moves.

PostQuantum's detailed examination of the paper notes the researchers compile expensive subroutines into physical layouts and schedules. That goes past simple logical-qubit counting times an average overhead. This is primarily an architectural result: the paper specifies what a suitable machine would actually need to do.

Cat qubits make one error much less likely

A cat qubit stores information in two states of a superconducting microwave resonator. Pump up the photon population and bit-flips drop exponentially; phase-flips only rise linearly. A bit-flip swaps the binary values. A phase-flip corrupts the superposition without swapping them.

That imbalance — noise bias — rewrites the error-correction problem. If bit-flips become negligible, you focus correction on phase-flips instead of splitting effort evenly. The saving only materializes if you preserve that bias during computation, not just in an idle qubit.

LDPC-cat codes pack the registers more densely

Low-density parity-check (LDPC) codes pack multiple logical qubits into one code block. The proposed LDPC-cat architecture bonds two chips face-to-face: one layer holds algorithm registers, while repetition codes underneath handle access, routing, and support.

The researchers estimate 49,649 physical qubits for repetition-cat versus 22,593 for LDPC-cat. PostQuantum says most of that drop comes from denser exponent-register storage. This compares implementations in the study — not proof that any real chip has doubled capacity.

A different adder avoids waiting for the decoder

Addition happens repeatedly in the calculation. An adder built for a different error-correction scheme can turn cheap operations expensive. So the team rebuilt the adder for cat qubits instead of porting an existing design.

The new design preps resource states early and schedules operations to hide the classical decoder's reaction time. The decoder reads error measurements and decides corrections. Per the paper, an n-bit addition takes 42n error-correction cycles at code distances up to 21.

The algorithm also folds in earlier Inria and Google work, including residue arithmetic that represents large numbers via smaller remainders. The researchers' contribution combines those algorithmic advances with hardware-specific compilation — don't credit the whole improvement to a brand-new factoring algorithm.

Why 3.14 days includes repeated runs

The reported runtime in the RSA-2048 quantum estimate is an expected total, not a single execution. The paper estimates 7.84 hours per RSA-2048 run. Classical post-processing needs about nine runs; approximate arithmetic and logical errors push the expected total to 9.6.

That gives the headline 3.14 days. Each run still demands uninterrupted error correction throughout. The physical-qubit count also covers supporting resources — error checks, routing, magic-state prep — not just the registers holding algorithm data.

The runtime calculation leaves out subroutine moves (~0.2% of a run) and the final quantum Fourier transform.

The unproven requirement is controlled bit-flip protection

The headline configuration in the RSA-2048 quantum estimate assumes zero bit-flips during computation. The paper ties that to a bit-flip time of ~100 years per qubit — a lifetime parameter, not a requirement to run one calculation for a century.

It also assumes a phase-flip probability of 5×10⁻⁴ per operation, a 1-microsecond error-correction cycle, and a 10-microsecond decoder reaction time. All three must hold across the whole machine.

PostQuantum reproduces the paper's RSA-2048 configurations, showing how runtime and hardware shift:

Comparing qubit count and runtime together shows that a smaller machine running far longer is a different engineering proposition than a slightly larger, faster one.

The experimental gap is substantial. The paper cites published bit-flip times of 15 and 22 seconds — each on a single qubit. Alice & Bob's largest chip with error-correction results has 12 cat qubits, and its logical error rate wasn't yet below threshold. Below threshold means scaling the code starts reducing logical errors instead of increasing them.

The extra bit-flip correction layer relaxes the lifetime requirement, but the ~45,000-qubit figure is a rough estimate. Elevator codes have only been simulated as quantum memory, not as a full computing implementation.

“no logical gate set has been designed for Elevator codes yet.”

— the researchers' paper, quoted by PostQuantum

The work is still a preprint. Supporting papers on factory designs, the LDPC-cat error model, and simultaneous lattice surgery are listed as in preparation. Alice & Bob expects hardware progress and falling resource requirements to converge in the early 2030s — that's the company's expectation, not a demonstrated delivery date.

Bitcoin's hour-long calculation targets exposed public keys

The elliptic-curve result targets a different problem: recovering a private key from its public key. For the elliptic-curve discrete logarithm on secp256k1, the researchers estimate at most 29,588 physical qubits and 61.8 minutes — an upper bound since it reuses RSA-compiled subroutines.

BigGo's report on the Bitcoin implications distinguishes attacks on unconfirmed transactions from attacks on public keys already exposed on-chain. The latter don't face the same short transaction window.

Alice & Bob argues the hour-long calculation exceeds Bitcoin's 10-minute block time, putting in-progress transactions outside the model. PostQuantum notes low-fee transactions can stall for hours during fee spikes. I wouldn't treat the block-time comparison as a guarantee that every pending transfer is safe.

The paper also doesn't establish a faster elliptic-curve configuration just by adding hardware. The authors didn't provide the fast RSA configuration for elliptic-curve because that algorithm needs one successful run and doesn't use the same residue-number-system technique. These stay projected attacks on hypothetical hardware.

Plan post-quantum migration around key exposure

The practical consequence is preparation, not an emergency patch from a demonstrated break. The paper recommends immediate migration effort and hybrid schemes during transition. Its authors also call for continued quantum cryptanalysis of post-quantum schemes — don't assume replacements need no further scrutiny.

Start with four migration tasks that don't depend on predicting an attack year:

1. Map cryptographic dependencies. Identify where systems use RSA or elliptic-curve cryptography for key establishment and signatures. Record where public keys are already exposed and which components would need replacement.
2. Prioritise by exposure and lifetime. Consider how long data must remain confidential, how long signatures must remain trustworthy and how long replacement will take. These factors belong alongside projected attack runtime.
3. Evaluate a hybrid transition path. Assess where hybrid schemes could support migration, and require an upgrade path that allows cryptographic choices to change without another wholesale replacement.
4. Build milestones around applicable obligations. Alice & Bob cites US and UK guidance ending in 2035, while PostQuantum notes earlier milestones within migration schedules. This paper does not change formal compliance dates.

The engineering case for migration doesn't require pretending the proposed quantum computer already exists. Acceptance of a hardware timeline should depend on measured progress toward the operating conditions the calculation demands.