# Alice & Bob: RSA-2048 factoring estimated at 23 000 cat qubits and 3.14 days

- Published: 2026-11-05 15:15 UTC
- Section: Digital & Computing › Data security
- Tags: Shor's algorithm resource estimate, cat qubits, RSA-2048 factoring, superconducting qubits, LDPC cat codes, repetition cat codes, ECDLP secp256k1, bit-flip time, Alice & Bob preprint
- URL: https://realtech.media/news/rt-4c680bdfb53347fef1fbf85d_alice_bob_rsa/

**A preprint estimates Shor's algorithm on superconducting cat qubits: RSA-2048 needs about 23 000 qubits and 3.14 days, assuming no bit-flip errors. No such machine exists yet.**

![Alice & Bob: RSA-2048 factoring estimated at 23 000 cat qubits and 3.14 days](https://sgzwpqqelzmajkcubgkl.supabase.co/storage/v1/object/public/rt-media/2026/11/de834e465c139773.webp)
*ScienceAlert*

A team led by researchers from the quantum computing company Alice & Bob has posted a preprint on eprint.iacr.org with an end-to-end resource estimate of Shor's algorithm on superconducting cat qubits. The work covers the algorithm for RSA, ECDLP and FFDLP and compiles it down to physical-qubit operations and chip layouts. According to the authors, factoring RSA-2048 requires about 23 000 cat qubits and 3.14 days [1]. The preprint has not yet undergone peer review.

## Assumptions and architectures

The estimate assumes a 1 μs error-correction cycle time, a 10 μs reaction time, circuit-level phase-flip noise with probability 5 × 10⁻⁴ and no bit-flips [1]. Cat qubits suppress bit-flip errors exponentially while phase-flip errors grow only linearly, which is why the model is built around phase-flip noise.

The authors compile the dominant subroutines for two architectures: one based on repetition cat codes and one based on LDPC cat codes [1]. They designed a parity-Cnot gate for cat qubits, extended a multi-target Cnot gate to the LDPC-cat architecture and adapted an active injection procedure [1]. The adder is taken from Gidney's 2025 resource estimate for factoring RSA-2048 and adapted to cat qubits. The factory designs and lookup compilation come from the FeMoco resource estimation of Kroell et al. [1]

## Other problems and trade-offs

Reusing the operations compiled for RSA-2048, solving ECDLP on secp256k1 requires at most 30 000 cat qubits and 1 hour [1]. FFDLP-512, which the authors propose as an intermediate benchmark, takes about 21 minutes [1]. Trading space for time, RSA-2048 runs in 1.25 hours on about 611 000 cat qubits [1].

The requirement of no bit-flips corresponds to a bit-flip time of about 100 years. It can be relaxed to a bit-flip time of about one hour by adding a concatenation layer with a distance-3 bit-flip error-correcting code. In that case the authors estimate the cost of RSA-2048 at about 45 000 cat qubits [1].

No quantum computer of this size exists today. Scalability, stability and temperature control remain open engineering tasks, and the estimate holds only under the stated error model.

## Sources

1. [eprint.iacr.org](https://eprint.iacr.org/2026/2665)
2. [ScienceAlert](https://www.sciencealert.com/a-quantum-computer-could-crack-major-internet-encryption-in-just-3-days-study-suggests)

---

Source: RealTech, realtech.media — https://realtech.media/news/rt-4c680bdfb53347fef1fbf85d_alice_bob_rsa/