A machine built from 22,593 cat qubits could factor an RSA-2048 key in roughly 3.14 days, according to a resource estimate from the Paris-based company Alice & Bob. RSA-2048 is the key size that protects much of the internet’s encrypted traffic, including the sessions behind online banking. No one has built anything close: the largest laser-trapped array in the news, Caltech’s 6,100 qubits, is not a working computer, and the new figure comes from an unreviewed preprint.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The 22,593-qubit estimate and its authors
The paper is titled “Shor’s algorithm compiled on cat qubits” and was posted to the Cryptology ePrint Archive on Oct. 28. Its ten authors are Axel Pappalardo, Dahmun Goudarzi, Victor Hertz, Hugo Jacinto, Larissa Kroell, Andre Schrottenloher, Peter Shanahan, Elie Gouzien, Remi de La Vieuville and Vivien Londe, most of them at Alice & Bob, with others from Paris-Saclay, CEA, CNRS, Inria in Rennes and the University of Edinburgh. The preprint gives 22,593 qubits and 3.14 days for RSA-2048 under stated assumptions, including a one-microsecond error-correction cycle and a ten-microsecond reaction time.
The company’s press release of Oct. 29 quotes chief executive Theau Peronnin saying that fewer than 23,000 physical cat qubits could be enough to factor RSA-2048 in three days. Antoine Joux, a cryptanalysis specialist and Godel Prize laureate, called the work important for tracking how soon quantum computers become a real threat to public-key cryptography. Ali El Kaafarani, founder and chief executive of PQShield, used the release to urge organizations to deploy standardized post-quantum cryptography in critical systems now.
Cat qubits and the qubit-versus-time tradeoff
Cat qubits store information in photons trapped in a tiny oscillator, which suppresses bit-flip errors exponentially while phase-flip errors grow only linearly, so error correction has to handle just one kind of mistake. Alice & Bob credits three advances: the hardware suppression of bit flips, a 2024 family of LDPC-cat codes that cut the RSA-2048 count from 49,649 qubits in an earlier 2023 estimate to 22,593, and a redesigned adder that runs at steady speed without waiting on error correction.
The same hardware can trade size for speed. The paper’s tradeoff table lists a fast option of 610,530 qubits across linked machines finishing RSA-2048 in 1.25 hours, and a slow option of 21,188 qubits needing 8.08 days. For the elliptic-curve signatures used by Bitcoin, the balanced estimate is 29,588 qubits and 61.8 minutes. As ScienceAlert’s report points out, that runtime is longer than Bitcoin’s roughly ten-minute block time, so in-flight transactions would stay out of reach.
A third case, finite-field discrete logarithms at 512 bits, comes out at 6,656 qubits and 21.2 minutes. Alice & Bob’s own blog post on the estimate says no published architecture is smaller at this runtime, and warns that pushing too far in either direction produces a machine too big to build.
Bit-flip assumptions behind the estimate
The 22,593-qubit figure assumes the cat qubits suffer no bit flips during the computation, which is roughly equivalent to a bit-flip time of about a century. Other qubit types may hold steady for milliseconds. The best result reported so far is a 44-minute average bit-flip time, which Alice & Bob described in a post on a cat qubit that jumps once an hour. If bit flips occur about once an hour, the paper says RSA-2048 needs about 45,000 qubits, roughly double the 22,593 figure.
The comparison with Google is the part of the claim most open to argument. Google Quantum AI’s Craig Gidney cut the estimate for breaking RSA-2048 from about 20 million qubits in 2019 to under one million in 2025, and Alice & Bob says its figure is about 40 times lower than that. ScienceAlert cautions that the comparison rests on Alice & Bob’s own error-rate and error-correction assumptions, which differ from Gidney’s. Alice & Bob’s own cat-qubit estimates fell from 350,000 in 2023 to just under 23,000.
Hardware gaps and the 2035 migration deadline
Engineering gaps remain in temperature control, scalability, stability and linking chips together. Caltech’s 6,100-qubit array shows how far atom-trapping has come, but it is not a functional quantum computer. The authors suggest that improving hardware and falling resource requirements could converge in the early 2030s, though ScienceAlert says the timeline for any real threat is uncertain. Alice & Bob, founded in 2020 and based in Paris and Boston, has raised 180 million euros and employs more than 250 people, so the estimate is a company projection about its own hardware path, not an independent audit.
American and British guidance calls for finishing the move to post-quantum cryptography by 2035, and Alice & Bob recommends starting now because replacing cryptographic infrastructure can take years. Whether any lab can hold a cat qubit steady for anything near a century, rather than 44 minutes, is the question that decides whether 22,593 stays a paper figure.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
