One Million Noisy Qubits Reprice the Attack on RSA-2048
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · July 26, 2026.
In May 2025, Google Quantum AI researcher Craig Gidney cut his own field's estimate of the hardware needed to break RSA-2048 by a factor of twenty. An attack that his own 2019 co-authored estimate priced at twenty million noisy qubits now fits on paper into fewer than one million, with RSA-2048 still widespread in certificates, VPNs, code signing, and long-lived infrastructure.
The claim is specific and checkable. In the arXiv preprint, Gidney estimates that a 2048 bit RSA integer could be factored in under a week by a quantum computer running fewer than a million noisy qubits, and he publishes the assumptions behind the count so that anyone can audit where the reduction comes from. The 2019 baseline assumed eight hours of runtime on twenty million qubits. The new paper trades time for hardware and tightens the arithmetic of error correction, and the result is a machine twenty times smaller doing the same job in a week. No such machine exists today. The paper is an estimate of cost, and cost estimates are exactly what security planning runs on.
The estimate is the security parameter
Encryption is a bet about the price of an attack. RSA-2048 is considered strong because the classical cost of factoring it is absurd, and the quantum cost has always been the open variable in that bet. Within this research line the estimated quantum cost has fallen hard: twenty million qubits in the 2019 Gidney and Ekerå estimate, fewer than one million in 2025, with the runtime moving from hours to under a week. The paper says nothing about when such a machine will exist. What it lowers is the hardware bar an arrival would have to clear, and that bar is the input every arrival forecast leans on.
The reason this matters now, years before any such machine is built, has a name in the security community: harvest now, decrypt later. An adversary who records encrypted traffic today can hold it and attack its public-key exchange on the day the hardware arrives. Forward secrecy in modern TLS, standardized in RFC 8446, moves the prize from a stored server key to each recorded session's own key exchange, and a machine in this class runs Shor's algorithm against the elliptic-curve exchange in wide deployment as well as against RSA, so recorded traffic stays in scope either way. For data whose value expires in months, that threat is abstract. For the data held by a defense ministry, a hospital network, or an energy grid operator, value is measured in decades. A weapons program record or a patient genome captured this year will still be sensitive on the day a million-qubit machine comes online, whenever that day is, and the same holds for diplomatic traffic with a long shelf life. The relevant deadline is the sum of how long your data must stay secret and how long your migration takes, measured against whatever arrival window you consider plausible. Gidney's paper does not name that window. It shrinks the machine that window has to produce.
Six years between two numbers
The cleanest way to see the movement is to put the two papers side by side. The 2019 estimate, published by Gidney and Ekerå, was titled "How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits," and it became the reference number that security roadmaps quietly leaned on. The 2025 revision comes from the same first author, asks the same question about the same key size, and prices the job at fewer than a million of the same noisy, physical qubits. Nothing about RSA changed in those six years. The mathematics of the factoring circuits did, along with the engineering assumptions of quantum error correction that the estimate is built on. That is what makes the pair of papers a signal instead of a headline. The question held still while the answer fell by a factor of twenty, and every step of the calculation is published for the field to attack.
What the standards clock says
The migration path exists and is public. NIST finalized its first set of post-quantum cryptography standards in August 2024, with the ML-KEM key encapsulation standard published as FIPS 203 at the center, and its Post-Quantum Cryptography project carries the standards, the timeline discussion, and the migration guidance in one place. The same NIST project pages carry 2035 as the United States federal migration horizon, set in policy years before this estimate landed. That date was chosen against the old hardware numbers, and nothing in it has been revised downward since the price of the attack fell.
What the standards do is remove the excuse that there is nothing to migrate to. What they do not remove is the work of migration itself, and that work starts with a cryptographic inventory: an organization has to find every place RSA and elliptic-curve keys live before it can replace them. In practice that inventory is the slowest and least glamorous part of the whole transition. Keys hide in firmware, in vendor appliances, in certificate chains, in protocols nobody has touched in a decade. Discovery across an estate like that is routinely the long pole of the transition, which is precisely why the deadline arithmetic above treats migration time as a first-class variable rather than a footnote.
How to read a factor of twenty
A skeptical reader should hold two things at once. First, the headline number is an estimate in physical, noisy qubits with the error-correction overhead already included, and today's machines are orders of magnitude away from it in both count and quality. Current hardware runs hundreds to thousands of physical qubits, and the error correction that turns them into usable logical qubits consumes almost all of them. Nothing in the paper shortens the engineering road. Second, the estimate is the honest signal to watch, because it prices the attack under assumptions the field can check, and within this line of work the 2025 revision cut the 2019 price by a factor of twenty. A planning document that quoted the 2019 number as its threat model aged badly in one afternoon in May 2025.
The sober reading for a board or a security team is arithmetic rather than alarm. Take the shelf life of your most sensitive data. Add your realistic migration time, with the inventory phase costed honestly. If the sum crosses any plausible arrival window for a machine of this class, the migration is already urgent today, regardless of how far away the machine feels. That test, published by Michele Mosca years ago, is the entire strategic content of this development, and the new paper tightened its inputs.
What a security team does with this
The practical translation is a short list, and none of it waits for a hardware announcement. Start the cryptographic inventory if it has not started, and treat it as a discovery program with an owner and a budget. Rank your data by how long it must stay confidential, because that ranking, run through the Mosca arithmetic above, tells you which systems migrate first. Put the question to your vendors in writing: which of their products carry RSA or elliptic-curve exchanges, and what their timeline is for the NIST standards, since FIPS 203 gives both sides a concrete target to name in contracts. Then resist the temptation to wait until the machine looks close. The entire logic of harvest now, decrypt later is that the attacker's patience converts your delay into their advantage, and patience is the cheapest capability an intelligence service has.
What to watch next
Three milestones tell you whether this estimate keeps moving. Watch the logical-qubit demonstrations hardware groups report alongside their physical-qubit counts and error rates, because those two together determine the correction overhead, and the paper's headline number is physical qubits with that overhead priced in. Watch for further revisions of the factoring estimate itself, since each one so far has cut the cost. And watch the standards adoption deadlines, because government procurement is the mechanism that will drag the broader market through the migration. Each of these signals is public and verifiable, and each moves slowly, which makes them exactly the kind of signal worth tracking on a weekly cadence rather than through occasional headlines. The machine is distant. The arithmetic it feeds runs on numbers your organization already has.
Sources
Primary source: Craig Gidney, Google Quantum AI, arXiv preprint 2505.15917, May 2025. Also drawn on: Gidney and Ekerå, arXiv 1905.09749 (2019); the NIST Computer Security Resource Center's Post-Quantum Cryptography project pages; and RFC 8446 (TLS 1.3), all accessed July 26, 2026.