Alice & Bob: RSA-2048 factoring estimated at 23 000 cat qubits and 3.14 days
A preprint estimates Shor's algorithm on superconducting cat qubits: RSA-2048 needs about 23 000 qubits and 3.14 days, assuming no bit-flip errors. No such machine exists yet.
A team led by researchers from the quantum computing company Alice & Bob has posted a preprint on eprint.iacr.org with an end-to-end resource estimate of Shor's algorithm on superconducting cat qubits. The work covers the algorithm for RSA, ECDLP and FFDLP and compiles it down to physical-qubit operations and chip layouts. According to the authors, factoring RSA-2048 requires about 23 000 cat qubits and 3.14 days eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗. The preprint has not yet undergone peer review.
Assumptions and architectures
The estimate assumes a 1 μs error-correction cycle time, a 10 μs reaction time, circuit-level phase-flip noise with probability 5 × 10⁻⁴ and no bit-flips eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗. Cat qubits suppress bit-flip errors exponentially while phase-flip errors grow only linearly, which is why the model is built around phase-flip noise.
The authors compile the dominant subroutines for two architectures: one based on repetition cat codes and one based on LDPC cat codes eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗. They designed a parity-Cnot gate for cat qubits, extended a multi-target Cnot gate to the LDPC-cat architecture and adapted an active injection procedure
eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗. The adder is taken from Gidney's 2025 resource estimate for factoring RSA-2048 and adapted to cat qubits. The factory designs and lookup compilation come from the FeMoco resource estimation of Kroell et al.
eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗
Other problems and trade-offs
Reusing the operations compiled for RSA-2048, solving ECDLP on secp256k1 requires at most 30 000 cat qubits and 1 hour eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗. FFDLP-512, which the authors propose as an intermediate benchmark, takes about 21 minutes
eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗. Trading space for time, RSA-2048 runs in 1.25 hours on about 611 000 cat qubits
eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗.
The requirement of no bit-flips corresponds to a bit-flip time of about 100 years. It can be relaxed to a bit-flip time of about one hour by adding a concatenation layer with a distance-3 bit-flip error-correcting code. In that case the authors estimate the cost of RSA-2048 at about 45 000 cat qubits eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗.
No quantum computer of this size exists today. Scalability, stability and temperature control remain open engineering tasks, and the estimate holds only under the stated error model.
