Insider Brief
- Alice & Bob researchers estimate that running Shor’s algorithm against RSA-2048 would require 22,593 physical cat qubits and 3.14 days on fault-tolerant superconducting quantum hardware.
- The study estimates that attacking the 256-bit elliptic-curve discrete logarithm problem would require 29,588 physical qubits and 61.8 minutes, with the results based on cat-qubit hardware, LDPC-cat codes and a redesigned adder.
- The estimates are theoretical resource projections rather than demonstrations of cryptographic attacks, and Alice & Bob recommends that organizations begin migrating to post-quantum cryptography as research continues to reduce projected hardware requirements.
PRESS RELEASE — Alice & Bob, a leader in fault-tolerant quantum computing, sets a record low for the total quantum resources (qubits multiplied by runtime) required to run Shor’s algorithm on today’s encryption. Its cat-qubit architecture needs 40 times fewer physical qubits than Google Quantum AI’s Craig Gidney 2025 estimate to break RSA-2048 ( arxiv).
In the paper “Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days” (IACR ePrint) researchers estimate the resources to break the following systems on fault-tolerant superconducting cat-qubit hardware:
- RSA-2048: 22,593 physical qubits, 3.14 days. RSA relies on the difficulty of factoring large integers. It is one of the world’s most widely used public-key systems, securing much of the internet, from online banking to email and digital signatures.
- ECDLP-256: 29,588 physical qubits, 61.8 minutes. The elliptic-curve discrete logarithm problem underpins elliptic-curve cryptography, including ECDSA, which secures blockchains such as Bitcoin and Ethereum, and ECDH, which is used to set up encrypted connections across the web. For Bitcoin, about an hour is longer than the network’s 10-minute block time, so transactions in progress remain out of reach.
“Shor’s algorithm is the iconic benchmark for quantum computing, with a well-defined mathematical problem and a clear quantum advantage. Estimates of the resources needed to run the algorithm have been steadily falling as the field has developed better approaches to error correction and algorithm design. This latest estimate doesn’t just push that frontier, it changes the paradigm altogether: fewer than 23,000 physical cat qubits could be enough to factor RSA-2048 in just three days.” said Théau Peronnin, CEO, Alice & Bob
How it was done
Most resource estimates count the logical qubits an algorithm needs, then multiply by an average number of physical qubits per logical qubit. This work goes further: for the parts of the algorithm that use the most resources, it works out exactly what each physical qubit does and when, producing complete chip layouts and schedules.
The results rest on three advances:
- Cat qubits: Alice & Bob’s cat qubits suppress bit-flip errors at the hardware level, so error correction only needs to handle phase-flips. This sharply cuts the number of physical qubits per logical qubit.
- LDPC-cat codes: LDPC-cat codes ( 2024 ) are more efficient than the repetition code used in its earlier cat-qubit estimates ( 2023 ), and more than halve the qubit count, from 49,649 to 22,593 for RSA-2048.
- A redesigned adder: Addition is one of the operations Shor’s algorithm runs most often. The team rebuilt it from the ground up for cat qubits, so it runs at a steady speed without stopping to wait for error correction.
On the algorithm side, the team drew on recent breakthroughs from Inria ( IACR ePrint ) and Google ( arXiv ) to make the algorithms more efficient.
Why it matters
Although substantial engineering challenges remain, Alice & Bob expect hardware improvements and falling resource requirements to converge in the early 2030s.
The cryptography results are just one example of how the unique properties of quantum mechanics can be harnessed to tackle problems that remain out of reach of today’s classical computers, with the potential to drive breakthroughs across entire fields ranging from materials science and chemistry to physics.
*Alice & Bob’s extrapolation on state-of-the-art quantum hardware infrastructure for 1M Transmons from Gidney et al. 2025, and Alice & Bob’s 23K cat qubits from Pappalardo, Goudarzi et al. 2026
Preparing for the post-Quantum Era
Replacing cryptographic infrastructure across large organizations can take years. US and UK guidance calls for organizations to complete the transition to post-quantum cryptography by 2035. As advances in quantum computing keep reducing the hardware needed, Alice & Bob recommends that organizations begin that transition now.
At the same time, post-quantum schemes need to build confidence through continued testing and scrutiny. They earn trust by surviving attempts to break them, so quantum cryptanalysis of these new schemes deserves the same effort as that of RSA and elliptic curves.
Alice & Bob is engaging with government and industry stakeholders to support their understanding of this work and its implications for the urgent transition to post-quantum cryptography.
“For the cryptographic community, figuring out how soon Shor’s algorithm, run on a quantum computer, poses a concrete threat to classical public key cryptography is of paramount importance. This paper details how you implement these algorithms on Alice & Bob’s physical architecture and once again reduces the resources required to do so. For anyone keeping track of how soon the threat from quantum computers becomes real – this is an important paper.” says Professor Antoine Joux, specialist in cryptanalysis and Gödel Prize laureate
“This very valuable research proves that the risk security leaders have been preparing for is real and approaching fast. The post-quantum standards to replace vulnerable cryptography already exist. Businesses and governments need to work together to deploy PQC in the most mission-critical places straight away, bake crypto-agility into their systems, and plan to complete their transition well ahead of the impending deadlines.” s ays Dr Ali El Kaafarani, Founder & CEO, PQShield