Alice & Bob, a Paris- and Boston-based maker of superconducting cat-qubit quantum computers, published an RSA-2048 resource estimate on October 28, 2026, concluding that a machine built on its architecture could factor a 2048-bit RSA integer in 3.14 days with 22,593 physical qubits. In the same preprint, the authors estimated that the elliptic-curve discrete logarithm on secp256k1, the curve behind Bitcoin and Ethereum signatures, could be solved in 61.8 minutes on at most 29,588 physical qubits.
The authors assumed hardware far beyond any cat qubit measured so far. They modeled qubits that never suffer bit-flips, the errors that turn a 0 into a 1 or the reverse, a condition they equated to a bit-flip time of about 100 years per qubit. For cat qubits under full quantum control, the longest bit-flip times the authors cited from published experiments are 15 and 22 seconds, each measured on a single qubit.
In its published roadmap, Alice & Bob targets Graphene, a machine with 100 logical qubits encoded in 2,000 cat qubits, for 2030. That is less than a tenth of the qubits the attack would require. The company’s first error-correction demonstrations, reported on October 20, ran on chips with 6 and 12 qubits.
The claim and its basis
The preprint, titled “Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days,” was posted to the IACR Cryptology ePrint Archive and to arXiv. It has not been peer reviewed.
Axel Pappalardo and Dahmun Goudarzi share first authorship. Nine of the 10 authors work at Alice & Bob, and the 10th, André Schrottenloher, works at Inria, the French national institute for digital science.
In a press release, Alice & Bob said the work sets a record low for qubits multiplied by runtime for Shor’s algorithm. The company said it needs 40 times fewer physical qubits than the May 2025 estimate by Craig Gidney of Google Quantum AI, who estimated that fewer than 1 million noisy qubits could factor RSA-2048 in under a week.
The authors described that reduction as obtained “with different hardware hypotheses.” Their assumptions include an error-correction cycle of 1 microsecond, a reaction time of 10 microseconds for the control system to act on error-correction results, and a phase-flip probability of 0.05% per operation. A phase-flip leaves a qubit’s 0 and 1 in place but corrupts the superposition between them.
Alice & Bob’s cat qubits store information in two states of a microwave resonator. The company’s design suppresses bit-flips exponentially as the number of photons in the resonator grows, so error correction has to deal mainly with phase-flips. Codes that correct one type of error need far fewer physical qubits per logical qubit than the surface code in Gidney’s estimate, which corrects both.
The authors estimated that an added layer of bit-flip correction would relax the requirement to a bit-flip time of about 1 hour, raising the total to about 45,000 qubits. In an October blog post without an accompanying paper, Alice & Bob reported an average bit-flip time of 44 minutes on a single cat qubit, and 189 to 252 minutes for three cat qubits on its 12-qubit Helium 2 chip.
How the RSA-2048 resource estimate was built
The authors built on a line of factoring algorithms in which the logical qubits needed for RSA-2048 fell from about 6,200 in a 2019 design by Gidney and Martin Ekerå to about 1,400. A logical qubit is a unit of error-corrected information encoded in many physical qubits.
The authors wrote that most of the new work is at the physical layer. They compiled the costliest subroutines – additions, table look-ups, and phase corrections – directly to physical qubits, instead of multiplying a logical-qubit count by an average overhead.
They described RSA-2048 as the only configuration compiled in full at that level. The authors reused the RSA-2048 subroutines for the elliptic-curve figures and presented the results as upper bounds.
In the headline configuration, 1,433 logical qubits run about 760 million Toffoli gates, the three-qubit logic operations that dominate the cost of error-corrected arithmetic, at 7.84 hours per run and about 9.6 expected runs. Magic-state factories, which prepare the resource states that some logic operations consume, take about 13% of the 22,593 qubits, counting their routing.
Earlier estimates
Researchers at Alice & Bob contributed to two earlier estimates. A 2023 paper in Physical Review Letters put RSA-2048 at about 4 days on 349,133 cat qubits. A 2024 preprint on the company’s LDPC-cat codes, which store many logical qubits in one block, cut that to 95,941 qubits at about 7 days.
On October 22, Iceberg Quantum, a Sydney-based quantum architecture company, estimated that 72,000 physical qubits at a 0.1% error rate could factor RSA-2048 in an expected 3.7 days. Iceberg published the figure without an accompanying paper, as Quantum Observer reported.
Hardware and timeline
Alice & Bob said in its release that substantial engineering challenges remain and that it expects hardware improvements and falling resource requirements to converge in the early 2030s.
In its October 20 results under PROQCIMA, a French defense program, the company described its logical error rate as “not yet below threshold,” the point at which enlarging a code starts to lower its logical error rate.
The release quoted Antoine Joux, a cryptanalyst and Gödel Prize laureate, who said the paper “once again reduces the resources required.” In the paper’s acknowledgments, the authors thanked Joux for reviewing preliminary versions of the work.
The release said an elliptic-curve attack lasting about an hour is longer than Bitcoin’s 10-minute block time, “so transactions in progress remain out of reach.” Ten minutes is Bitcoin’s average block interval, and some transactions wait longer than an hour for confirmation, so the comparison does not set a firm limit on exposure. The authors wrote that a slower configuration that uses fewer qubits “is a threat to exposed public keys, such as P2PK outputs or reused addresses.”
The authors called for “an immediate migration effort, relying on hybrid schemes during the transition phase.” Alice & Bob’s release cited U.S. and U.K. guidance that sets 2035 for completing the move. In its final transition plan, published on October 27, NIST deprecates RSA at every approved key size after 2030.
