Alice & Bob Estimates 22,593 Qubits Could Break RSA-2048 in Three Days, but Nobody Can Build Those Qubits Yet

29 Oct 2026 – Alice & Bob, a Paris- and Boston-based company building quantum computers from superconducting cat qubits, published a resource estimate on Thursday concluding that a machine built on its architecture could factor a 2048-bit RSA integer with 22,593 physical qubits in 3.14 days. The same paper puts the elliptic-curve discrete logarithm on secp256k1, the curve behind Bitcoin and Ethereum account signatures, at 61.8 minutes on at most 29,588 physical qubits. Solving that problem recovers a private key from its public key.

The 122-page preprint, dated 23 October and posted to the IACR Cryptology ePrint Archive, is titled “Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days.” Nine of its ten authors are Alice & Bob researchers, with Axel Pappalardo and Dahmun Goudarzi sharing first authorship; the tenth is André Schrottenloher of Inria. In its press release, Alice & Bob said the work sets a record low for qubits multiplied by runtime for Shor’s algorithm and needs 40 times fewer physical qubits than the May 2025 estimate by Craig Gidney of Google Quantum AI, a reduction the paper describes as obtained “with different hardware hypotheses.”

The figures assume a 1-microsecond error-correction cycle (one round of error checks across the chip), a 10-microsecond decoder reaction time (how long the classical computer that interprets those checks takes to respond), a phase-flip probability of 5×10⁻⁴ (0.05%) per operation and no bit-flips. A bit-flip turns a qubit’s 0 into 1 or the reverse, while a phase-flip leaves those values in place but corrupts the superposition between them.

The paper says the no-bit-flip condition corresponds to a bit-flip time, a measure of how long a qubit keeps its value, of about 100 years per qubit, and that an extra layer of bit-flip correction would relax it to about one hour at a cost of about 45,000 qubits. The longest bit-flip times it cites from published experiments with quantum control, in which the qubit could also be manipulated and measured, are 15 and 22 seconds, each measured on a single qubit. The largest chip on which Alice & Bob has reported error-correction results has 12 cat qubits.

RSA, Elliptic-Curve and 512-Bit Discrete-Logarithm Estimates

The paper describes the RSA-2048 configuration as the only one compiled in full at the physical level. Its run times leave out moves between subroutines, about 0.2% of a run, and the final quantum Fourier transform. The elliptic-curve figures reuse the RSA subroutines and are presented as upper bounds. The figures for FFDLP-512, a finite-field discrete logarithm (the problem behind classic Diffie-Hellman key exchange) in a 512-bit prime group with an 80-bit exponent, reuse the same compiled subroutines. The authors propose FFDLP-512 as an intermediate benchmark and “a common reference point for all fault-tolerant architectures.”

In the figures below, a logical qubit is a unit of error-corrected information encoded in many physical qubits. Toffoli gates are the three-qubit logic operations that dominate the cost of an error-corrected computation.

• RSA-2048: 1,433 logical qubits, about 7.6×10⁸ Toffoli gates per run and 7.84 hours per run. Ekerå’s classical post-processing needs about nine runs, and errors from the approximate arithmetic add a small correction, for an expected 9.2. Logical errors spoil another 4.2% of runs, so the paper expects 9.6 runs, or 3.14 days in total.
• Elliptic-curve discrete logarithm (ECDLP) on secp256k1: Schrottenloher’s gate-optimized circuit, with 1,462 logical qubits and about 5.8×10⁷ Toffoli gates. The algorithm needs one successful run. One run computes in 54 minutes. The authors round it up to 60 to leave room for register moves and the final transform. At 1.03 expected runs, the total is 61.8 minutes.
• FFDLP-512: 208 logical and 6,656 physical qubits, with 2.51-minute runs and 8.44 expected runs, for 21.2 minutes.

The paper’s Table II trades qubits for time on the same architecture:

Physical cat qubits on the LDPC-cat architecture, including the helper qubits used for error checks, routing and magic-state factories, at a phase-flip probability of 5×10⁻⁴ with bit-flips assumed negligible. Source: Table II of the paper, which describes the trade-offs as extrapolated from the balanced configuration.

The fast configurations execute independent runs at the same time on ten identical chips, and for RSA-2048 each chip also runs seven arithmetic engines that share one exponent register. The paper says these time-efficient variants do not apply directly to the elliptic-curve problem, “which needs a single successful run and does not make use of RNS-type technique,” so it gives no fast configuration for it. The slow configurations use a smaller magic-state factory.

The paper also reports variants of the RSA-2048 estimate. At a phase-flip probability of 10⁻³ (0.1%), it needs 25,673 qubits and 3.63 days. The repetition-cat architecture (explained, with the LDPC-cat design, in the next section) needs 49,649 qubits and 2.67 days at the headline phase-flip probability. With the extra bit-flip layer, built from the company’s Elevator codes, the authors estimate about 45,000 qubits and give no separate runtime.

How Alice & Bob Compiled Shor’s Algorithm for Cat Qubits

A cat qubit stores 0 and 1 as two states of a microwave resonator’s field that differ only in phase. The resonator is a superconducting circuit that traps microwave photons. Alice & Bob holds the resonator in that pair of states with an engineered two-photon dissipation: a nonlinear element converts photon pairs from the resonator into single photons of a lossy buffer mode; a drive applied to that mode sets the size of the states. The rate of bit-flips between the two states falls exponentially as the number of photons in the resonator grows, while the rate of phase flips grows only linearly. This imbalance is called noise bias. Error correction then has to handle mainly phase flips. A code that handles one type of error needs far fewer physical qubits per logical qubit than the surface code in Gidney’s estimate, which corrects both. I described the physics and the company’s record in my profile of Alice & Bob and in my guide to superconducting cat qubits.

For RSA, the paper builds on a line of algorithms that runs from Ekerå and Håstad through May and Schlieper to Chevignard, Fouque and Schrottenloher and Gidney’s 2025 paper. Across these papers, the authors reduce factoring to a short discrete logarithm and shrink the input and output registers. They also compute in a residue number system (in which each large number is a set of small remainders) with approximate arithmetic. For RSA-2048, the logical qubit count fell from about 6,200 in Gidney and Ekerå’s 2019 design, three times the key size, to about 1,400. For elliptic curves the paper uses Schrottenloher’s June 2026 circuits. It also notes that the best optimizations of Regev’s 2023 alternative to Shor’s algorithm are still an order of magnitude less practical than the latest versions of Shor’s.

The authors say most of the paper’s new work is at the physical layer. In place of multiplying logical qubits by an average overhead, they compile the most expensive subroutines, the additions, table look-ups and phase corrections, directly to physical qubits and schedule the operation of each one in every error-correction cycle:

• Lattice-surgery primitives. Three operations built for cat qubits with lattice surgery, the usual technique for operating on error-corrected qubits: a parity-CNOT gate, a multi-target CNOT gate (CNOT, or controlled-NOT, is the basic two-qubit gate) and “active injection.”
• A redesigned adder. Gidney’s design uses an adder that assumes surface-code costs, in which |i⟩ states and Hadamard gates are cheap. On cat qubits both are expensive, so the team rebuilt the adder around auto-AND and phase-fixup resource states. It measures each step’s parities in a single lattice-surgery step and prepares resource states ahead of time, which hides the decoder’s reaction time. An n-bit addition takes 42n error-correction cycles at every code distance (a measure of how many errors a code can correct) up to 21.
• Two architectures. In the repetition-cat architecture, every logical qubit is a repetition code, a line of cat qubits that stores one qubit of information so that phase flips can be corrected by majority vote. The LDPC-cat architecture is a two-layer flip chip, two chips bonded face to face. The top layer stores the algorithm’s registers in a single code block from the LDPC-cat family that Diego Ruiz and colleagues published in Nature Communications in 2025, and a layer of repetition codes underneath provides access to those registers, the routing, the buffers and the factory outputs. LDPC stands for low-density parity-check, a type of code that stores many logical qubits in one block and needs fewer physical qubits per logical qubit than repetition codes. The LDPC-cat design needs 2.2 times fewer qubits than the repetition-cat design, mostly because it stores the exponent register more densely.
• Magic-state factories. Some operations cannot be run directly on error-corrected qubits and instead consume what are called magic states, which dedicated areas of the chip prepare in advance. Here, a two-level factory of 1,566 qubits produces the |CX CX X⟩ states from which the auto-AND states for the adder’s AND gates are prepared, and two color-code factories of 153 qubits each produce the |i⟩ states those preparations consume. With their routing they take 2,849 of the 22,593 qubits, about 13%.

Two supporting papers are listed as in preparation. One supplies the factory designs, the table look-up circuit and the logical error model the paper uses to choose the LDPC-cat code distance; the other covers the simultaneous lattice surgery behind the adder.

Alice & Bob’s Earlier Shor Estimates

Alice & Bob’s 2023 estimate, by Élie Gouzien and colleagues in Physical Review Letters, put a 256-bit elliptic-curve discrete logarithm at 9 hours on 126,133 cat qubits, using repetition codes, and RSA-2048 at about four days on 349,133. The 2024 LDPC-cat paper cut the RSA-2048 figure to 95,941 cat qubits, at about seven days. Both papers assumed that single-photon loss, the main source of phase flips, happens 100,000 times more slowly than the two-photon dissipation that stabilizes the cat.

Statements in the Release and the Paper

Alice & Bob said in the release that substantial engineering challenges remain and that it expects hardware improvements and falling resource requirements to converge in the early 2030s. Its published roadmap targets a machine called Graphene, with 100 logical qubits encoded in 2,000 cat qubits, in 2030. On 20 October, the company reported its first error-correction results from PROQCIMA, the French defense program to build universal quantum computers: multiple cycles of a distance-3 repetition code against phase flips on three data qubits, run on demonstrators built from 6- and 12-qubit chips, with a logical error rate “not yet below threshold.” Below threshold is the point at which enlarging a code starts to lower its logical error rate instead of raising it.

The release said an elliptic-curve attack of about an hour is longer than Bitcoin’s 10-minute block time, “so transactions in progress remain out of reach.” The paper says the 61.8-minute configuration “does not yet open Bitcoin to new threat models,” and adds that “only a factor of about six separates it from this threshold” and that Bitcoin’s migration “needs to be finalized with no delay.”

“This latest estimate doesn’t just push that frontier, it changes the paradigm altogether: fewer than 23,000 physical cat qubits could be enough to factor RSA-2048 in just three days,” said Théau Peronnin, chief executive of Alice & Bob.

The release also quoted Antoine Joux, a cryptanalyst and Gödel Prize laureate, who said the paper “details how you implement these algorithms on Alice & Bob’s physical architecture and once again reduces the resources required to do so.” The paper’s acknowledgments thank Joux and André Chailloux “for their careful review of preliminary versions of this work.” Ali El Kaafarani, founder and chief executive of PQShield, said in the release that the research “proves that the risk security leaders have been preparing for is real and approaching fast.”

The release cited US and UK guidance calling for organizations to complete the transition to post-quantum cryptography by 2035, and recommended that they begin now. The paper says its results “push for an immediate migration effort, relying on hybrid schemes during the transition phase,” and calls for the same effort on the quantum cryptanalysis of post-quantum schemes as on RSA and elliptic curves. It also states that Anthropic’s Claude Opus 5.5 was used to review the text and the Qualtran implementations and to polish the style of the figures, and that the authors checked all of its outputs.

My Analysis

Alice & Bob’s paper is the first RSA-2048 estimate I know of under 25,000 physical qubits with a runtime measured in days. It also has the lowest product of qubit count and runtime of any RSA-2048 estimate I know of that comes with a paper. The only designs from other teams I know of below 25,000 qubits, Oratomic and Caltech’s, run for decades. Iceberg Quantum’s February Pinnacle paper needed about 471,000 qubits to bring its runtime down to about a day. The paper is also the most complete physical compilation of Shor’s algorithm for cat qubits I have seen. For the headline configuration, Alice & Bob assume a qubit nobody has built, with a bit-flip time of about 100 years. The best peer-reviewed measurement with quantum control is 22 seconds. Alice & Bob’s own preliminary results reach 44 minutes on a single qubit it could operate as a cat qubit, and 189 to 252 minutes on three qubits of its 12-qubit Helium 2 chip, where it has not yet shown the same level of control. The paper shows what a cat-qubit machine could do if the physics delivers. It does not show that the physics will deliver, and it does not change any formal compliance date.

I will go through this paper alongside the other 2026 estimates in a free one-hour webinar from Quantum Academy and Applied Quantum on 29 October at 15:00 UTC, an hour after the paper’s release, with 15 minutes for questions. Everyone who registers receives the recording.

Why Alice & Bob’s Estimate Is Both Small and Fast

Qubit-days are physical qubits multiplied by runtime in days, my calculation from each paper’s figures; lower means a smaller or faster machine. Where a paper gives only a ceiling, such as Google’s “under 500,000,” the product is a ceiling too.

On qubits multiplied by runtime, Alice & Bob’s RSA-2048 design needs about 63 times less than Gidney’s own accounting and about 6.6 times less than the fastest configuration of Iceberg Quantum’s Pinnacle architecture. I analyzed Gidney’s estimate when it appeared. Against Pinnacle’s headline 98,000-qubit, one-month configuration, the ratio is about 40. Iceberg’s Pinnacle 1.2 release of 22 October, published without a paper, claims about 266,000 qubit-days at the same 0.1% error rate, about 3.8 times Alice & Bob’s, and about 47,000 at a tenfold lower error rate, below Alice & Bob’s 71,000. Until Iceberg publishes the circuits and the decoder behind those figures, I treat them as company figures. Google Quantum AI’s March elliptic-curve figures are ceilings, so the most the comparison supports is that Alice & Bob’s qubit count is about a seventeenth of Google’s ceiling, at about three times Google’s runtime (my analysis of the Google paper). Per attempt, Alice & Bob’s elliptic-curve run is about 600 times faster than IonQ’s September design, 60 minutes against 25.7 days, on about 50% more qubits. IonQ’s Walking Cat architecture takes its name from multi-ion cat states that it prepares in factories and moves through the chip, and has no connection to cat qubits. The neutral-atom designs from Oratomic and Caltech need fewer qubits than Alice & Bob’s for both problems, at runtimes of about 10 days and more for elliptic curves and of decades for RSA-2048 at their smallest sizes. The paper’s own chart of RSA-2048 estimates since 2010 shows the product of qubits and runtime falling by five orders of magnitude, to 0.07 million qubit-days.

Three things make the combination possible, and only the third is the paper’s own contribution.

• The algorithm. The new design has 1,433 logical qubits, using the residue-arithmetic algorithms published in 2024 and 2025. Alice & Bob’s 2024 RSA-2048 design, at 95,941 qubits and about seven days, used an older algorithm and a code block holding 6,214 logical qubits. Gidney combined the same algorithmic advances with denser storage of idle qubits and cheaper magic states to bring his own estimate from 20 million qubits to 897,864 in 2025.
• The noise bias. Gidney’s design and this one both use about 1,400 logical qubits, with the same 1-microsecond cycle and the same 10-microsecond reaction time. The cat qubits’ strong noise bias is what allows the low-overhead error correction at the center of the estimate. The paper does not separate how much of the 40-fold difference in qubit count comes from the bias and how much from the different codes, noise models and factories.
• The compilation. An adder that never waits for the decoder, factories that take 13% of the chip and complete layouts and schedules on a chip with local connections only. It is the most detailed physical compilation for cat qubits I have seen, at the level of detail of IonQ’s September compilation for trapped ions.

The FFDLP-512 benchmark is a proposal I would like other architectures to adopt. It exercises every component of Shor’s algorithm at a size reachable well before RSA-2048, so the next round of estimates could be compared on a common target. Classical computers already solve it: in 2015 the Logjam researchers showed that after a week-long precomputation for a 512-bit group they could compute discrete logarithms in that group in about a minute, and the 80-bit exponent makes the problem easier still. A quantum run at that size would prove the machine without breaking anything a classical cluster cannot.

A Reality Check for the Headlines

When IonQ published its estimate in September, headlines about breaking Bitcoin in 26 days were circulating within hours. Alice & Bob’s release offers smaller numbers with fewer qualifiers. Its subtitle gives qubit counts and runtimes, and the condition behind them, “The headline figures assume no bit-flips during the computation,” appears only in the notes to editors. The paper lists what each of its RSA-2048 configurations assumes.

Source: Tables I, II and XXXI–XXXIV of the paper.

What the 23,000-Qubit Figure Means

The 22,593 count includes the helper qubits used for error checks, routing and magic-state factories, all of them cat qubits, and each needs a bit-flip time of about 100 years. A cat qubit is also more hardware than the qubits on today’s largest chips: storage and buffer resonators, a nonlinear coupler and the lines that drive them. Transmon chips with more than 1,000 qubits exist (the transmon is the most common type of superconducting qubit). This design requires cat qubits and cannot run on any of them. Alice & Bob’s largest chip with error-correction results has 12 cat qubits, and Graphene, its 2030 target, has 2,000.

What “Three Days” Means

The 3.14 days is the expected total of 9.6 separate runs of 7.84 hours each, and each run needs uninterrupted error correction for its full length. The paper’s bit-flip time is a decay time, so a qubit flips on average once every two bit-flip times, and the authors pessimistically count any bit-flip anywhere on the chip as a failed run. At the required 101-year bit-flip time, bit-flips would still spoil about 10% of runs and add about 11% to the runtime, taking the total to about 3.5 days. The headline figure assumes none.

What “a Bitcoin Key in an Hour” Means

The 61.8 minutes is an upper bound, because the elliptic-curve run reuses subroutines built for RSA. On transactions in flight, the paper is less reassuring than the release. It puts the design within “a factor of about six” of recovering a key before the transaction that revealed it confirms. It does not analyze priming, the technique Google’s team used: running the first half of the computation before the target key is known and holding the machine in that state, which cut Google’s time after a key appears to 9 or 12 minutes, depending on the circuit. Whether a similar split would work on Alice & Bob’s schedule is an open question. Low-fee transactions can also wait in the mempool, the queue of transactions not yet included in a block, for hours during fee spikes, as I described in my anatomy of Bitcoin’s attack surface. Those transactions could be vulnerable even at 61.8 minutes. Coins held in exposed addresses are a larger target than coins in transactions waiting to confirm. Google Quantum AI’s March study counted about 6.9 million BTC in addresses whose public keys are already visible on the blockchain. A machine running continuously at the paper’s upper-bound speed could recover about 23 private keys a day.

What the 45,000-Qubit Variant Means

The variant with an hour-scale bit-flip time is the configuration closest to measured hardware, and the paper labels its qubit count a rough estimate. An outer Elevator code relaxes the requirement to a bit-flip time of about 1.3 hours. Alice & Bob’s preliminary idle measurements on three Helium 2 qubits, at 189 to 252 minutes, already exceed that, though without the level of control shown on the single qubit that reached 44 minutes. The authors list the caveats themselves. The Elevator code was simulated only as a memory, holding qubits without computing on them, and “no logical gate set has been designed for Elevator codes yet.” Its bit-flip model is used at error rates five orders of magnitude below the range it was fitted on. The LDPC-cat version has not been designed, so its 44,850 qubits are scaled from the 99% increase estimated for the repetition-cat version. The hour-scale bit-flip time is also required during two-qubit gates, and no experiment has shown it there.

What “the Early 2030s” Means

The early-2030s date comes from Alice & Bob. Peronnin told Fortune in November 2025 that Bitcoin needs to fork to stronger cryptography “by 2030, basically,” and that quantum computers “will be ready to be a threat a bit later than that.” The company’s roadmap ends at Graphene’s 2,000 cat qubits in 2030 and promises more logical qubits, lower error rates and faster speeds beyond it, without numbers. Alice & Bob’s 20 October release describes France’s PROQCIMA program as aiming for two prototypes of 1,000 logical qubits each, ready for industrialization by 2032. The defense ministry’s launch announcement in March 2024 set the prototypes at 128 logical qubits by 2032, with 2,048 logical qubits for the industrial machines that follow. The demonstrated error correction is a distance-3 repetition code against phase flips on three data qubits, not yet below threshold.

The Qubit This Estimate Needs

The bit-flip requirement is the paper’s own number. For the RSA-2048 run, a bit-flip may occur anywhere on the chip less than once every ten runs, which requires a bit-flip time of at least 101 years per qubit at about 18 photons. The elliptic-curve run needs about 17 years. The 21-minute FFDLP-512 benchmark needs about two months.

The paper compares these requirements with peer-reviewed measurements on single cat qubits: 15 seconds on an idle qubit at 11.3 photons, and 22 seconds for squeezed cat states at 4.1 photons. It calls the RSA-2048 requirement “more than eight orders of magnitude longer than the bit-flip times measured with quantum control,” and concludes that “it is therefore not certain that the bit-flip time can be extended by another eight orders of magnitude,” because bit-flip times saturate in current experiments for reasons not yet established. The paper does not mention the 44-minute bit-flip time Alice & Bob announced as preliminary results in September 2025, measured on one idle qubit and covered in my article on Alice & Bob’s one-hour cat qubit. Against that preliminary figure the gap is about 1.2 million times. The same post reported 189 to 252 minutes on three qubits of the 12-qubit Helium 2 chip, at 11 and 16 photons, and cautioned that this “is not sufficient to claim that all these systems can now be operated as cat qubits, and with the same level of control as the previous device.” Against 252 minutes, the gap is about 210,000 times.

Bit-flip times grow exponentially with photon number, and the paper’s rough guide puts the RSA-2048 requirement at about 18 photons, against 11 in the 44-minute experiment and 11 to 16 in the Helium 2 measurements. Whether that growth continues under quantum control has not been demonstrated. The paper lists three properties that remain to be demonstrated: bit-flip times that keep growing exponentially under quantum control up to about 18 photons, CNOT gates that preserve them, and both on a chip with many cat qubits. In three of the experiments it cites, bit-flip times stopped growing, in one of them by about 20 photons, and only an experiment without quantum control followed the exponential growth, up to about 40 photons.

The phase-flip side gets less attention. The paper sums up the hardware as a phase-flip probability of 5×10⁻⁴ per operation and says this probability is “mostly driven by” the ratio between the single-photon loss rate and the two-photon stabilization rate, “a critical hardware feature.” It does not give the hardware operating point that would achieve that probability together with the bit-flip protection above. The LDPC-cat paper’s main simulations used the same generic noise model at a phase-flip probability of 10⁻³. In that paper, a loss-to-stabilization ratio of one to 10,000 at 11 photons made every operation noisier than a standard depolarizing noise model at a 0.1% error rate, and the authors described that ratio as one that “may be achieved when the platform reaches its experimental maturity.” The new paper assumes half the earlier phase-flip probability, at about 18 photons; phase flips grow with photon number. In a blog post on cat-qubit design, Alice & Bob’s scientists put the best loss-to-stabilization ratio the company had published at about one to 150. The company has not published the ratio for its newer Galvanic Cat design, which produced the 44-minute result.

The chip also assumes that all physical qubits are identical. Every headline estimate assumes something similar. Gidney’s assumes a million-qubit grid on which all qubits and couplers work at a 0.1% gate error, and a University of Sydney study posted in July measured how far the qubits on a real 120-qubit chip depart from that uniformity.

How Far Alice & Bob’s Hardware Is From a CRQC

In my CRQC Quantum Capability Framework, a resource estimate moves A.1, the algorithmic resource layer, and the hardware side is tracked as nine capabilities plus engineering scale. This paper moves A.1 for one type of qubit, and none of the hardware capabilities moved with it. For a cryptographically relevant quantum computer (CRQC) built to this design, the seven capabilities the paper depends on most compare as follows.

AWS showed a cat-qubit repetition code below threshold at distance 5 on its Ocelot chip in February 2025, using transmons to read out the error checks, and Google showed a surface code below threshold at distance 7 in December 2024. In June, Alice & Bob published five criteria for judging logical-qubit claims, among them a logical qubit that stays free of logical errors for the full duration of the computation and a code parameter that can be tuned to lower the logical error rate. Its October result meets neither criterion yet.

What the Estimate Changes for Migration Plans

Formal compliance dates are unchanged. Under Executive Order 14412, US federal high-value assets and high-impact systems, excluding National Security Systems, which follow NSA’s CNSA 2.0, must use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. NIST’s final IR 8547, published on 27 October, deprecates RSA and elliptic-curve cryptography at every approved key size after 2030 and disallows them after 2035. The European Union’s roadmap asks for high-risk systems to move by the end of 2030, and Google set 2029 for its own migration. The 2035 dates in the release are where US and UK guidance ends, and both schedules have earlier milestones. As I have argued before, the deadlines that regulators, insurers and clients have already set decide migration budgets more than any Q-Day estimate does.

I agree with the paper’s call for an immediate migration effort. PQShield’s El Kaafarani said in the release that the research “proves” the risk is approaching fast. The paper shows that a smaller machine would be enough. How fast that machine approaches depends on the hardware results in the previous section, and none of them changed with this paper.

For systems whose elliptic-curve keys are already exposed or must stay trustworthy for years, the paper strengthens the case for moving them early, which I made in How ECC Became the Easiest Quantum Target. On Alice & Bob’s balanced figures, an elliptic-curve key takes 61.8 minutes on at most 29,588 qubits and an RSA-2048 key takes 3.14 days on 22,593, about 73 times longer. Runtime is one of four inputs to that priority; the others are key exposure, the data’s required confidentiality period and replacement time.

Results to Watch After This Paper

• Bit-flip times measured under quantum control up to about 18 photons, during repeated CNOT gates and on a multi-qubit chip, the three properties the paper says remain to be demonstrated.
• The loss ratio of the Galvanic Cat design, in a peer-reviewed paper.
• A repetition code below threshold on Alice & Bob’s own hardware, at distance 5 or more, with error rates published.
• The 48-cat-qubit Lithium chip and an error-corrected gate between two logical qubits.
• Real-time decoding of LDPC-cat codes on hardware data during error correction.
• The two supporting papers listed as in preparation, on the factories and LDPC-cat error model and on simultaneous lattice surgery, and a logical gate set for Elevator codes.
• Peer review of this preprint.

Alice & Bob’s theorists have taken the company’s RSA-2048 figure from 349,133 cat qubits in 2023 to 22,593. Over the same period, its hardware results moved from single cat qubits to a 12-qubit chip running a distance-3 repetition code. The paper gives that hardware a precise target, and the company’s next results on Helium and Lithium will show how fast it is closing the distance.

From the author