The Signal
Alice & Bob Estimates 22,593 Cat Qubits for RSA-2048
Alice & Bob researchers estimate that a fault-tolerant cat-qubit computer could factor RSA-2048 with 22,593 physical qubits in 3.14 days. The estimate depends on demanding error assumptions, including no bit-flips, and describes a machine t
Quantum.world Team · Written with AI · fact-checked ·
Alice & Bob researchers say a future computer could factor an RSA-2048 integer with 22,593 physical cat qubits in 3.14 days. The estimate, published as an IACR Cryptology ePrint preprint on October 28, depends on a fault-tolerant machine and a noise model that assumes no bit-flips. It is a resource projection, not a demonstration: the proposed computer does not exist.
22,593 qubits, under a demanding noise model
The paper compiles Shor’s algorithm for superconducting cat qubits, tracing the calculation from its logical operations to physical-qubit layouts and schedules. The authors present two architectures, based on repetition cat codes and low-density parity-check (LDPC) cat codes, and report their fully compiled RSA-2048 configuration as requiring 22,593 physical qubits. Their abstract summarizes the result this way:
“factoring RSA-2048, the configuration we compile in full, requires about 23 000 cat qubits and 3.14 days.”
Axel Pappalardo et al., “Shor’s algorithm compiled on cat qubits”
The estimate assumes a one-microsecond error-correction cycle, a 10-microsecond reaction time for the classical decoder, phase-flip noise with probability 5 × 10-4, and no bit-flips. The authors say the last condition corresponds to a bit-flip time of about 100 years. Adding a distance-3 bit-flip correction layer relaxes that requirement to about one hour, but raises the estimate to roughly 45,000 cat qubits.
The qubit count trades against runtime
The 22,593-qubit figure is one point on a space-time trade-off, not a minimum that holds at every speed. The paper estimates that a larger system of about 611,000 cat qubits could complete the RSA-2048 calculation in 1.25 hours. Alice & Bob’s company post also describes a roughly one-hour version spread across ten machines.
That distinction matters when comparing estimates. A lower qubit count can mean a longer computation, while a faster calculation can require more hardware working in parallel. The paper’s estimate is tied to its particular codes, circuit compilation and noise assumptions, rather than a general count of how many qubits any quantum computer would need.
A calculation, not a cryptographic break
RSA-2048 relies on the difficulty of factoring a large integer with classical computers; Shor’s algorithm offers a way to do that on a sufficiently capable fault-tolerant quantum computer. The new work does not factor an RSA key or show that current devices can run the required calculation. Instead, it gives a detailed estimate for a machine built around cat qubits and error correction.
The paper also estimates other discrete-logarithm benchmarks using compiled operations from the RSA work. Its abstract gives a requirement of at most 30,000 cat qubits and about one hour for the secp256k1 problem, and about 6,700 qubits and 21 minutes for a proposed FFDLP-512 benchmark. Those figures are projections under the paper’s architecture, not experimental results.
A smaller estimate does not make RSA obsolete today
Alice & Bob’s October 29 blog post places the result against earlier resource estimates, including a 2025 estimate below one million physical qubits and the company’s own earlier cat-qubit estimates. Those comparisons track changing algorithms and hardware assumptions; they do not show that a machine meeting the new estimate is close at hand.
The security implications depend on building hardware that can sustain error-corrected computation at the assumed scale and noise levels. Alice & Bob argues in its post that organizations should begin moving to post-quantum cryptography before existing systems become vulnerable. For now, the paper’s concrete result is a design target: 22,593 physical cat qubits, 3.14 days, and a no-bit-flip assumption that the authors’ alternative estimate relaxes only by increasing the count to about 45,000.