Alice & Bob published a resource estimate today: 22,593 cat qubits could factor RSA-2048 in about three days, and the elliptic-curve discrete logarithm on secp256k1, Bitcoin's curve, would take about an hour on at most 29,588 qubits.
https://postquantum.com/security-pqc/alice-bob-rsa-2048-cat-qubits/
What the paper achieves:
• The smallest RSA-2048 estimate I know of that runs in days, and the lowest qubits times runtime of any that comes with a paper.
• A physical compilation of Shor's algorithm for cat qubits, with layouts and schedules for every qubit of the dominant subroutines.
• A proposed common benchmark, a 512-bit discrete logarithm, that other architectures could run before RSA-2048.
What it assumes:
• No bit-flips during the run, which the paper equates with a bit-flip time of about 100 years per qubit.
• The best peer-reviewed measurement with quantum control is 22 seconds. Alice & Bob's own preliminary results reach 44 minutes, and about four hours on qubits where it has not yet shown the same level of control.
• Its largest chip with error-correction results has 12 cat qubits, running a distance-3 repetition code that is not yet below threshold.
• A variant with an extra error-correction layer relaxes the bit-flip requirement to about 1.3 hours, at about 45,000 qubits, but no gate set exists yet for that layer.
What it changes:
• No compliance date. NIST's final IR 8547 deprecates RSA and ECC after 2030 and disallows them after 2035.
• The order of work, possibly: on the same machine an elliptic-curve key takes about an hour against about three days for RSA-2048.
Free webinar on the 2026 estimates, today at 15:00 UTC, recording for everyone who registers: https://quantumacademy.com/event/webinar-q-day-estimates/
PostQuantum.comAlice & Bob: 22,593 Qubits Could Break RSA-2048Alice & Bob's Shor estimate puts RSA-2048 at 22,593 cat qubits and three days. What it assumes, and what the headlines will get wrong.
