Alice & Bob's ePrint 2026/2665 of 28 October 2026 Puts RSA-2048 at 22,593 Cat Qubits and 3.14 Days, Assuming a Bit-Flip Time of About 100 Years

What Alice & Bob posted to the IACR ePrint Archive on 28 October 2026

On 28 October 2026 the Cryptology ePrint Archive received and approved paper 2026/2665, "Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days". Nine of its ten authors work for Alice & Bob, the Paris company that builds superconducting cat qubits; the tenth, André Schrottenloher, is at Inria and the University of Rennes. The paper compiles Shor's algorithm from its mathematics down to the placement and scheduling of physical qubits on a chip, and reuses the result for Bitcoin's secp256k1 curve: at most 30,000 cat qubits and one hour.

Which assumption carries the 22,593-qubit headline

The headline assumes a 1-microsecond error-correction cycle, phase-flip noise of 5 × 10⁻⁴ per cycle and negligible bit flips, which the authors equate to a characteristic bit-flip time of about 100 years. With an extra distance-3 code, a bit-flip time of about one hour suffices and the count rises to about 45,000 cat qubits. In September 2025 Alice & Bob reported an average bit-flip time of 44 minutes, with a 95% confidence interval of 33 to 60 minutes, for one fully characterized cat qubit, plus preliminary traces above three hours on three other qubits that the company says are not by themselves enough to claim the same level of control.

Why the estimate leaves the 2030 dates where they are

The RSA-2048 resource estimate moves the attack cost again, but NIST's final IR 8547 and the HKMA's 2030 aim were set without it. The paper is a company preprint, not yet peer-reviewed, and its value lies in stating every hardware number an attacker would need.