Real Quantum

Cracking RSA with fewer qubits takes months

Georg Singer
3–5 minutes


What was shown

The authors calculated on paper how much hardware a quantum computer needs to break RSA, a lock behind much of today's online encryption, at a key size of 2048 bits. Picture a workshop with a few workers and a big warehouse next door, instead of a factory floor with one worker per task. A processor of 13,436 physical qubits, the basic switches of a quantum computer, draws on a multimode memory that holds many separate pieces of quantum information. The result is 177 days instead of 8 hours, with far fewer qubits than the 20 million of the standard design. No machine was built or run.

“Under the assumptions used in Ref. [3] for the gate error rate and the cycle time, we show that it should be possible to factor a 2 048 -bit RSA integer in 177 days using a multimode memory with a storage time of about 2 hours and a processor including 13 436 physical qubits—a reduction by more than 3 orders of magnitude of the number of physical qubits, as compared to the standard architecture without memory [3], at the cost of a ≈500 times longer run-time.”

— Introduction, in: Factoring 2048-bit RSA Integers in 177 Days with 13436 Qubits and a Multimode Memory1

  • How it was done: a calculation on paper, not run on any machine
  • Qubits: 13,436 physical qubits in the processor plus a memory of 28 million spatial and 45 temporal modes; a calculation, not a device.
  • Error correction: A code guarding against errors is assumed; its tolerable error level, 0.75%, is a working hypothesis because the real value is unknown.
  • Compared against classical computing: no comparison stated in the paper

Who it affects

Every organization whose security rests on RSA encryption, from banks to software vendors. Today nothing changes: the estimate needs a memory that does not exist, and the move to new encryption follows official deadlines. The paper does show that the qubit count for such an attack is not a fixed figure.

Every organization that relies on public-key cryptography: no market estimate is used here. What sets the pace are official deadlines to replace today's public-key encryption: NSA by 2030 and 2035; UK National Cyber Security Centre by 2031 and 2035; European Commission by 2030; BSI and partner agencies of European states by 2030; Canadian Centre for Cyber Security by 2035. These are government deadlines, not forecasts, and they do not depend on this paper.

What is still missing

The estimate rests on a multimode memory holding 28 million spatial modes with low error, which does not exist yet; the authors say building it is now the challenge. The error tolerance of 0.75% is only a working hypothesis, because the real value is unknown. The run-time is also about 500 times longer: 177 days against 8 hours.

Against published roadmaps: the task needs 13,436 physical qubits. Announcements we have on file reach that many:

  • IonQ2 (a vendor describing its own planned product): 200,000 physical qubits for 2029.
  • QuEra3 (a vendor describing its own planned product): 20,000 physical qubits for 2029.
  • IQM4 (a vendor describing its own planned product): 1 million physical qubits for 2030 or later.

But the paper also needs a further component besides qubits and gates, and none of these announcements includes it. This brief therefore gives no year. An announcement is not a delivered machine.

Who is working on it

The paper (March 2021) lists its authors' affiliations as: Université Paris–Saclay, CEA, CNRS, Institut de Physique Théorique, 91,191 Gif-sur-Yvette, France. That is who signed this work — it is not a ranking of who is ahead.

It supports a hybrid design: a small processor of superconducting qubits, linked by a microwave interface to a memory built from rare-earth-doped solids, as an alternative to a large planar grid of qubits.

How this brief was made

This brief was written by software, not by a person: a language model read the full text of the paper, and code then checked every quotation, number and name in this brief against that text before it was published. The rules are set out under Method. Responsible for the rules and for this page: Georg Singer. The paper is peer-reviewed, published in Phys. Rev. Lett. 127, 140503 (2021). Georg Singer holds no shares in any company or institution named in this brief (as of October 2026).

Sources

  1. arxiv.org Factoring 2048-bit RSA Integers in 177 Days with 13436 Qubits and a Multimode Memory
  2. ionq.com IonQ
  3. quera.com QuEra
  4. meetiqm.com IQM