Alice & Bob puts RSA-2048 within reach of about 23,000 cat qubits in a new estimate
A new Alice & Bob preprint compiles Shor's algorithm onto cat qubits and estimates RSA-2048 could fall to 22,593 physical qubits running for 3.14 days.
Alice & Bob, the Paris- and Boston-based developer of cat-qubit quantum computers, published a resource estimate on October 29 suggesting that a fault-tolerant machine built on its architecture could factor a 2048-bit RSA key with 22,593 physical qubits in 3.14 days. The company describes the result as a new low for total quantum resources, measured as qubits multiplied by runtime, needed to run Shor's algorithm against today's public-key encryption. The work is a theoretical projection posted as a preprint, not a demonstration on hardware.
What was announced
The figures come from the paper "Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days", posted to the IACR Cryptology ePrint Archive by a team of Alice & Bob researchers together with a co-author from Inria and the University of Rennes. Alongside RSA-2048, the team estimates that the 256-bit elliptic-curve discrete logarithm problem (ECDLP), the math behind the signatures used by Bitcoin and Ethereum, could be solved with at most 29,588 physical qubits in 61.8 minutes. It also proposes a smaller benchmark, FFDLP-512, at roughly 6,700 qubits and 21 minutes.
According to the company's announcement, the RSA figure uses 40 times fewer physical qubits than the 2025 estimate by Craig Gidney of Google Quantum AI, which put RSA-2048 at under a million noisy qubits and less than a week of runtime on a surface-code machine.
The technical details
Rather than multiplying a logical-qubit count by an average overhead, the authors compile the most expensive parts of the algorithm down to individual physical-qubit operations, producing chip layouts and schedules. Alice & Bob attributes the savings to three ingredients: cat qubits that suppress bit-flip errors in hardware so that error correction only has to deal with phase flips; LDPC-cat codes, which the company says more than halve the RSA-2048 qubit count compared with its earlier repetition-code approach (from 49,649 to 22,593); and an adder rebuilt for cat qubits so that it runs at a steady pace without waiting on error correction. On the algorithm side the team draws on recent work from Google and from Inria researchers.
The assumptions matter. The paper assumes a 1-microsecond error-correction cycle, a 10-microsecond reaction time, a phase-flip error probability of 5 × 10⁻⁴ and no bit flips at all, which corresponds to a bit-flip time of about 100 years. If bit flips occur roughly once an hour, an extra layer of encoding is needed and the RSA-2048 estimate rises to about 45,000 qubits. The design can also trade space for time: about 611,000 qubits would cut the RSA runtime to 1.25 hours, while about 21,188 qubits would stretch it to 8.08 days.
Why it matters
Resource estimates for Shor's algorithm have fallen steadily as error-correction and algorithm design improve, and each drop compresses the timeline that security teams plan around. Alice & Bob says it expects hardware progress and shrinking requirements to converge in the early 2030s, while acknowledging substantial engineering challenges. Ali El Kaafarani, founder and CEO of PQShield, said in the release that governments and businesses should "deploy PQC in the most mission-critical places straight away."
What to watch
The headline numbers depend on cat qubits with extremely long bit-flip times that have not yet been shown at scale, so the key test is hardware progress toward those assumptions. Peer review of the preprint and independent scrutiny of its compilation choices will also be worth following. Alice & Bob says it is briefing government and industry stakeholders and urges organizations to begin migrating to post-quantum cryptography now, noting that US and UK guidance targets completion by 2035.
Sources
Facts on this page come from the sources below, retrieved by DesignQuantum.
- Alice & Bob Sets Record Low for Quantum Resources Required to Break Internet Encryption (Alice & Bob press release) alice-bob.com
- Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days (IACR ePrint 2026/2665) eprint.iacr.org
- How to factor 2048 bit RSA integers with less than a million noisy qubits (Gidney, arXiv 2505.15917) arxiv.org
- LDPC-cat codes for low-overhead quantum computing in 2D (arXiv 2401.09541) arxiv.org
- Reducing the Number of Qubits in Quantum Discrete Logarithms on Elliptic Curves (IACR ePrint 2026/280) eprint.iacr.org
- Alice & Bob Estimates 22,593 Qubits to Break RSA-2048 (The Quantum Insider) thequantuminsider.com