In August 1977 Martin Gardner's column in Scientific American introduced the RSA cipher and printed a 129-digit challenge number. The estimate attributed to Ron Rivest put the time to factor it at about 40 quadrillion years. A volunteer effort coordinated over the internet factored RSA-129 in April 1994. The arithmetic had been sound; the assumptions about future machines and algorithms had not held. Resource estimates for a quantum attack on RSA are read most usefully the same way, as a list of conditions under which a number becomes true.
The newest such list arrived on 28 October 2026, when the Cryptology ePrint Archive received and approved paper 2026/2665. Its title states the result: 22,593 qubits for RSA-2048 in 3.14 days. This post reads that one paper and asks which of its conditions a reader should watch.
Practical takeaway. The 22,593-qubit figure treats bit flips as negligible, which the authors equate to a characteristic bit-flip time of about 100 years. The variant that tolerates a bit-flip time of about one hour needs about 45,000 cat qubits. In September 2025 Alice & Bob reported a 44-minute average bit-flip time for one fully characterized cat qubit, and longer preliminary traces on three others.
What Alice & Bob posted to the IACR ePrint Archive on 28 October 2026
Nine of the ten authors list Alice & Bob, the Paris company that builds superconducting cat qubits; two of them also list Université Paris-Saclay, CEA and CNRS, or the University of Edinburgh. The tenth, André Schrottenloher, is at Inria and the University of Rennes. The paper is a preprint under a CC BY license, filed in the archive's "Attacks and cryptanalysis" category.
The authors describe an end-to-end resource estimate: from the mathematical description of Shor's algorithm to the allocation and scheduling of physical qubits on a chip layout. They compile the dominant subroutines for two architectures, one built on repetition cat codes and one on LDPC cat codes. They design a parity-CNOT gate for cat qubits, extend a multi-target CNOT gate to the LDPC architecture, and adapt the adder from Craig Gidney's May 2025 estimate for RSA-2048. The abstract is candid about the limits of that compilation. The adder is compiled in full, while the phase-estimation step, which the authors call the "phaseup", rests on "a coarser resource estimate".
Which four assumptions carry the 22,593-qubit figure for RSA-2048
A cat qubit stores information in two states of a microwave resonator, and its design trades one kind of error for another. Bit flips are suppressed exponentially as the resonator holds more photons; phase flips remain and are corrected by a simpler code. That trade is the company's whole engineering thesis, and it explains why the paper's count is so low next to Gidney's figure of fewer than a million noisy qubits on a conventional square grid.
The paper's headline rests on four stated conditions: a 1-microsecond error-correction cycle, a 10-microsecond reaction time, circuit-level phase-flip noise with probability 5 × 10⁻⁴, and no bit flips, an approximation the abstract equates to a characteristic bit-flip time of about 100 years. Relaxing it to about one hour requires a further layer of concatenation into a distance-3 bit-flip code, and the cost of RSA-2048 then rises to about 45,000 cat qubits.
The same compiled operations give the paper's other results. Trading space for time, RSA-2048 falls to 1.25 hours on about 611,000 cat qubits. A 512-bit finite-field discrete logarithm, which the authors propose as an intermediate benchmark, needs about 6,700 cat qubits and 21 minutes.
How the count fell from 126,133 cat qubits in 2023 to at most 30,000 for Bitcoin's secp256k1 curve
The figure that matters most outside the lab concerns elliptic curves. The paper estimates that solving the discrete logarithm on secp256k1, the curve behind Bitcoin and Ethereum signatures, requires at most 30,000 cat qubits and one hour. In February 2023 an Alice & Bob team led by Élie Gouzien, also an author of the new paper, estimated a 256-bit elliptic-curve logarithm at 126,133 cat qubits and 9 hours. Gouzien's earlier work with Nicolas Sangouard had put RSA-2048 at 177 days on 13,436 qubits by leaning on a multimode memory. Across these five years the research line has moved from memory-based designs to compiled chip layouts; the RSA-2048 runtime has fallen from 177 days to 3.14 days, and the elliptic-curve count has fallen by about three quarters.
For a custodian of digital assets the elliptic-curve line carries more weight than the RSA line. Public keys already visible on a blockchain could be attacked at leisure once such a machine exists, and the qubit count sits in the same order of magnitude as the RSA figure. The paper gives no date for such a machine and makes no claim that one exists.
What Alice & Bob measured in September 2025: a 44-minute average bit-flip time on one cat qubit
Alice & Bob's own hardware gives the nearest comparison with the paper's assumptions. On 25 September 2025 the company's technical blog post reported 41 bit flips over 61 hours on one cat qubit of its Galvanic Cat design at a mean photon number of 11, an average bit-flip time of 44 minutes with a 95% confidence interval of 33 to 60 minutes. It gave a phase-flip time of 420 nanoseconds and a Z-gate fidelity of 94.2%, and called the results "preliminary". Quantum Computing Report placed the figure at four times the company's 2030 roadmap target of 13 minutes and well above the 430 seconds reported in 2024. The same company post shows traces from three qubits on its Helium 2 chip with bit-flip times of 189, 252 and 189 minutes, and states that this measurement alone does not show those qubits can be operated with the same level of control.
Those results concern qubits sitting idle. The company itself wrote that it still has to replicate them during an error-correction experiment, particularly during the CNOT gate. The paper's relaxed variant needs bit-flip times of about one hour across some 45,000 qubits that are driven, coupled and measured continuously for days, with phase-flip noise held at 5 × 10⁻⁴ per cycle. The gap is measurable, and the paper deserves credit for making it so: each assumption is a number a later hardware paper can confirm or miss.
Why NIST's 2030 deprecation and the HKMA's 2030 aim were set without this paper
Policy did not wait for this estimate. On 27 October 2026, the day before the preprint was received, NIST's final IR 8547 scheduled RSA-2048, P-256, RSA-3072 and Ed25519 for deprecation after 2030 and disallowance after 2035 under NIST standards and guidelines. On 2 November the Hong Kong Monetary Authority and HKUST released a planning toolkit for banks, whose sector the regulator had scored 2.3 out of 10 on quantum preparedness against a 2030 aim. Neither instrument depends on this paper's qubit count. NIST sets a transition schedule and the HKMA a sector-readiness aim, and neither fixes a date for the attack, which is why a lower estimate tightens the margin without moving the deadline.
The human stake sits with data that must stay confidential for decades: patient records, tax files, the private keys behind savings held as digital assets. A cheaper attack shortens the period during which today's encrypted traffic stays safe if someone stores it now.
How Quentir Reads It
Quentir reads ePrint 2026/2665 as a hardware specification written by a hardware company. Its value is its transparency: the cycle time, the reaction time, the phase-flip rate and the bit-flip time are all stated, so each future Alice & Bob chip can be scored against them. Its limit is authorship and status. The estimate comes from the firm whose architecture it favors, it is not yet peer-reviewed, and its phase-estimation step is estimated more coarsely than its adder.
Three signals would change the reading: a peer-reviewed version, an independent compilation by a group outside the company, and a multi-qubit chip that holds hour-long bit-flip times while running gates. Quentir will follow those alongside the supervisory and standards clocks. The All-access membership holds every Quentir analysis of these estimates, from Gidney's 2025 paper to this one, in one subscription.
Sources: Axel Pappalardo, Dahmun Goudarzi, Victor Hertz, Hugo Jacinto, Larissa Kroell, André Schrottenloher, Peter Shanahan, Élie Gouzien, Rémi de La Vieuville and Vivien Londe, Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days, Cryptology ePrint Archive, Paper 2026/2665, received and approved 28 October 2026; Craig Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, 21 May 2025; Élie Gouzien and Nicolas Sangouard, Factoring 2048-bit RSA Integers in 177 Days with 13436 Qubits and a Multimode Memory, arXiv:2103.06159, 10 March 2021; Élie Gouzien et al., Performance Analysis of a Repetition Cat Code Architecture: Computing 256-bit Elliptic Curve Logarithm in 9 Hours with 126133 Cat Qubits, arXiv:2302.06639, 13 February 2023; Alice & Bob, Just Out of the Lab: A Cat Qubit That Jumps Every Hour, 25 September 2025; Quantum Computing Report, Alice & Bob Sets New Bit-Flip Stability Record for Superconducting Cat Qubits, 27 September 2025. Links checked 3 November 2026.
Published intelligence, built to inform your own decisions. Published: November 3, 2026.