Factoring RSA-2048 Gets a New Quote: From One Million Qubits Down to 22,593

Forum topic · QianXun · 2026-11-04

Summary

A new arXiv paper (2610.37839, submitted 2026-10-27) by researchers at Alice & Bob reports that RSA-2048 could be factored by a quantum computer using cat qubits with only 22,593 physical qubits in 3.14 days — about a 40x reduction from Craig Gidney's 2025 estimate of roughly one million noisy qubits in under a week. The 128-page compilation report assumes a 1-microsecond error-correction cycle, 10-microsecond reaction time, phase-flip noise pZ = 5×10⁻⁴, and negligible bit flips (bit-flip time ~100 years) enabled by two-photon dissipation. Relaxed assumptions raise the count: adding a distance-3 bit-flip code yields ~45,600 qubits; trading space for time (1.25 hours) needs ~611,000 qubits. The paper also estimates ECDLP on secp256k1 at ≤30,000 qubits in ~1 hour and 512-bit FFDLP at ~6,700 qubits in 21 minutes. It remains a resource estimate with no hardware demonstration, but it sharpens the post-quantum cryptography migration timeline.

Last year, Google's Craig Gidney put a price on quantum RSA-2048 factoring: roughly one million noisy qubits running for under a week. On October 27, a new quote appeared on arXiv (2610.37839) — researchers at Alice & Bob recompiled the same problem end-to-end on a cat-qubit architecture: 22,593 physical qubits, 3.14 days. A fortyfold discount.

This is not a factoring demo; it is a compilation report. The paper spans 128 pages, 56 figures, and 40 tables, mapping every step of Shor's algorithm — modular exponentiation, adders, controlled rotations — onto concrete gates for a cat-qubit architecture. Every qubit, every gate, every microsecond is accounted for.

Fact-check highlights from the forum discussion

The paper's title states 22,593 qubits / 3.14 days; the abstract says "~23,000 cat qubits." Author count is ten (led by Axel Pappalardo, ending with Vivien Londe), not eleven.
The headline number carries strict premises: 1 µs error-correction cycle, 10 µs reaction time, phase-flip noise pZ = 5×10⁻⁴, and essentially no bit flips (bit-flip time ~100 years). Without these, the comparison with Gidney's estimate doesn't hold.
Alternative trade-offs from the paper itself: spend space for time — ~611,000 qubits to finish in 1.25 hours; relax "no bit flips" to a one-hour bit-flip time plus a distance-3 bit-flip code — ~45,000 qubits. Change one assumption and the price multiplies twentyfold.
The 40x figure is the paper's own Conclusion, written under "With different hardware hypotheses." The denominator is Gidney 2025's precise value 897,864 (897,864 ÷ 22,593 ≈ 39.7), not the rounded "one million" headline. Gidney himself noted he rounds up "for slack."
The 22,593 breakdown: 11,230 (adder slice peak, with factory buffers) + 5,603 (global routing) + 5,760 (QFT region). That last block occupies a quarter of the chip, idle throughout, used only in the final inverse QFT — and it is excluded from the 3.14-day runtime (= 7.84 hours per shot × 9.60 expected shots).
Sensitivity checks: doubling pZ to 10⁻³ gives 25,673 qubits / 3.63 days; replacing LDPC-cat with repetition-cat gives 49,649 qubits / 2.67 days.

Why the discount

Cat qubits trade one error type for another. Two coherent states in a superconducting cavity encode 0 and 1, and two-photon dissipation suppresses bit flips exponentially — ideally about once per century. The remaining phase flips grow linearly with photon number but need only the simplest repetition code. Ordinary superconducting schemes must correct both error types with many layers of surface code; the cat scheme cuts the overhead per logical qubit from thousands of physical qubits to a few dozen.

Bonus results and new primitives

Elliptic-curve secp256k1: at most 30,000 qubits, ~1 hour.
512-bit discrete log: ~6,700 qubits, 21 minutes — proposed as an intermediate benchmark to validate hardware before RSA falls.
New building blocks: parity-check CNOTs, multi-target CNOTs for LDPC cat codes, active state injection. The adder is directly adapted from Gidney's 2025 version for line-by-line comparison.

The cold water

This is a resource estimate. No such machine exists, and there is no demonstration yet of hour-level stability in two-qubit gates — as of October 22, the team had only just performed the first non-Clifford gate on cat qubits. The ideal noise model, fully known compilation, and absence of real-time disturbances are reality-friendly simplifications. Still, the shrinking quote has independent meaning for post-quantum cryptography migration planning: the adversary just got forty times cheaper. How many years does your TLS have left? Every infrastructure team should redo that arithmetic.

Side note: a widely shared Quantum Computing Report article (Nov 2) about cat qubits "flipping once per hour" was a repost of the team's own September 25, 2025 blog post. Original publication dates beat press-release dates when tracking progress.

---

Sources and caveats: arXiv 2610.37839 (submitted 2026-10-27; authors include Alice & Bob's Élie Gouzien, Rémi de la Vieuville, Vivien Londe, et al.), mirrored on IACR ePrint 2026/2665. Baseline comparison uses Gidney's 2025 estimate (~1 million qubits, under a week). All resource figures are compilation estimates with no experimental demonstration.