The Quantum Investor's Notebook logo The Quantum Investor's Notebook
← Back

Monday, October 26, 2026

RSA-2048 Resource Estimates: How to Read the Recipe

A resource estimate says how big a quantum computer would need to be to break RSA-2048, and how long it would run. It is a recipe built on stated assumptions. Change one assumption and the answer can move tenfold.

Two layers

The Q-DayThe hypothetical point at which a quantum computer can break widely used public-key encryption. Note explains what such a machine would threaten. This Note opens the estimate itself.

The first layer is the algorithm. It sets how many error-corrected logical qubitsA reliable ‘qubit’ built by bundling many error-prone physical qubits together with error correction. These are the units that actually matter for useful computing. are needed and how many expensive gates must run. In factoring, the expensive one is the Toffoli gateA three-qubit gate that error-corrected machines cannot run directly; each one consumes prepared magic states.. A 2019 estimate used a bit over 6,000 logical qubits and about 3 billion Toffoli gates.1,2 A 2025 estimate used about 1,400 logical qubits and about 6.5 billion Toffolis.2

The second layer is the hardware. Both estimates assume a 0.1% error per operation, an error-correction cycle of one microsecond, a 10-microsecond reaction time and a square grid of nearest-neighbor qubits.1,2 Those inputs set the code distanceAn error-correcting code that spreads one protected qubit over a square grid of physical qubits., 25 in the 2025 estimate. The distance sets how many physical qubits each logical qubit costs. The number of steps times the cycle time sets the runtime.

One worked chain

The 2025 estimate shows how the inputs connect. Each attempt runs about 12 hours.2 The algorithm needs about 1,400 logical qubits; counting idle workspace, the layout budgets for 1,600. At one cycle per microsecond, that is about 70 trillion logical-qubit cycles to protect. So the design targets a failure chance of one in a quadrillion per logical qubit per cycle, which leaves about 93% of attempts free of logical errors.2 Distance 25 reaches that, so each active logical qubit costs 2 × (25 + 1)², or 1,352, physical qubits. Six factories deliver one magic state every 25 microseconds.2 About nine attempts are expected, so the total is just under a week.2

Why 20 million became under 1 million

The 2019 estimate came to about 20 million physical qubits for 8 hours.1 The 2025 estimate came to under a million, about 898,000, for under a week.2 The hardware assumptions did not change. Three things did:

  • Fewer logical qubits. A newer arithmetic method works on an approximate version of the number, cutting the working space from over three times the key length to under one.2
  • Denser storage. Idle logical qubits are packed into “cold” storage at about 430 physical qubits each, against about 1,350 for active ones.2
  • Cheaper magic statesSpecial resource states that a fault-tolerant computer consumes to perform the operations it cannot do directly.. A new preparation method shrinks the factories that make them.2

The price was time: more Toffoli gates and fewer factories.2 Fewer qubits, longer run.

The same trade appears in 2026 preprints. Using qLDPC codesA quantum error-correcting code in which each check involves only a few qubits and each qubit sits in only a few checks, however large the code grows., one design needs fewer than 100,000 physical qubits for about a month, at the same error rate and cycle time.3 A critique notes that it assumes links between distant qubits that many platforms do not plan.6 A follow-up with each qubit wired to eight others needs about 120,000.4 A design for movable atoms needs about 11,000 qubits, with runtimes far longer.5

Two panels titled Reading an RSA-2048 Estimate. Left, labeled the recipe: five boxes stacked with arrows: algorithm; logical qubits + Toffoli count; error rate, cycle time, wiring; code distance; physical qubits and runtime. Beneath: change one input, the answer moves. Right, labeled same 0.1% error, 1-microsecond cycles: a log-log plot of physical qubits, marked 10,000, 1 million and 100 million, against runtime, marked 1 hour, 1 day and 1 month. Dots: 2019: 20 million, 8 hours; 2025: under 1 million, under a week; 2026 preprints: about 100,000 to 120,000, about a month. A red arrow runs from the 2019 dot down toward the 2026 dots, labeled fewer qubits, more time. A note reads different wiring: square grid (2019, 2025); richer links (2026).
Figure 1: Reading an RSA-2048 estimate. Hardware assumptions turn a logical recipe into physical qubits and runtime. At the same error rate and cycle time, estimates fell from 20 million qubits to under 1 million, and 2026 preprints go lower with richer wiring, but each step down took longer to run.

How to read a new estimate

  • What error rate does it assume? Compare it with what machines have shown at scale, not with their best single gate.
  • How fast is a cycle? Some platforms run cycles nearer a millisecond, a thousand times slower, so the same recipe takes far longer.3
  • What wiring? Nearest neighbors only, or long-range links?
  • What is the runtime, and per what? One attempt, or the expected total over several?
  • What is left out? Extra memory hardware, control electronics, decoding, cooling. A 2021 design needed only 13,436 processing qubits but also a memory holding 28 million modes, for 177 days.7
  • Is it peer reviewed? Several of the newest are preprints.

Every estimate assumes error correction working at a scale no machine has reached. Falling estimates lower the bar; they do not say when anyone clears it. As with qubit countThe raw number of physical qubits in a machine. A weak measure of power on its own, since quality and connectivity matter more., the headline number means little without its assumptions.

Sources

  1. C. Gidney and M. Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum 5, 433 (2021). arXiv:1905.09749. (About 3n logical qubits and 0.3n³ Toffolis; square grid, 0.1% gate error, 1 µs cycle; distance 27. In lab/qday-monitor/sources.) ↩
  2. C. Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits,” preprint, arXiv:2505.15917 (2025). (Same assumptions plus 10 µs reaction time; earlier estimate “3 billion Toffoli gates and a bit more than 3n logical qubits”; 1,409 logical qubits, 6.5 billion Toffolis; 897,864 physical qubits; hot patches 2(d + 1)² = 1,352 at d = 25, cold storage 430; 12.07 hours per shot, target 10⁻¹⁵ per logical qubit round, 93.3% error-free shots, six CCZ factories at 25 µs, 9.2 expected shots; savings from approximate residue arithmetic, yoked surface codes and cultivation. In lab/qday-monitor/sources.) ↩
  3. P. Webster, L. Berent, O. Chandra, E. T. Hockings, et al. (Iceberg Quantum), “The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes,” preprint, arXiv:2602.11457 (2026). (Fewer than 100,000 physical qubits at 10⁻³ error, 1 µs cycle, 10 µs reaction time, in about one month; three months at a 1 ms cycle. In lab/qday-monitor/sources, v1 and v2.) ↩
  4. P. Webster, T. Peham, and L. Z. Cohen (Iceberg Quantum), “The Pinnacle Architecture with fixed connectivity of degree eight,” preprint, arXiv:2609.21249 (2026). (About 120,000 physical qubits, one month. In lab/qday-monitor/sources.) ↩
  5. M. Cain, Q. Xu, R. King, L. R. B. Picard, et al., “Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits,” preprint, arXiv:2603.28627 (2026). (RSA-2048 runtime one to two orders of magnitude longer than the few days for P-256. In lab/qday-monitor/sources.) ↩
  6. P. S. Mundada, A. Khindanov, Y. Wang, et al., “Heterogeneous architectures enable a 138x reduction in physical qubit requirements for fault-tolerant quantum computing under detailed accounting,” preprint, arXiv:2604.06319 (2026). (The qLDPC estimate assumes non-local couplings not available or planned on many platforms. In lab/qday-monitor/sources.) ↩
  7. É. Gouzien and N. Sangouard, “Factoring 2048-bit RSA integers in 177 days with 13436 qubits and a multimode memory,” Physical Review Letters 127, 140503 (2021). arXiv:2103.06159. (Plus a memory of 28 million spatial and 45 temporal modes. In lab/qday-monitor/sources.) ↩