The number that changed the security conversation
Alice & Bob has put a sharper number on one of cybersecurity’s most uncomfortable questions: how many quantum resources would be needed to break the public-key encryption that still protects much of today’s internet. In a newly reported resource estimate, the company says a fault-tolerant machine based on superconducting cat qubits could factor RSA-2048 with 22,593 physical qubits in 3.14 days . It also estimates that a 256-bit elliptic-curve discrete-log problem, the class relevant to ECDSA and ECDH systems used across blockchains and secure web connections, could be attacked with 29,588 physical qubits in 61.8 minutes .
That is not the same as announcing a cryptographically relevant quantum computer. The paper is a compilation and resource-estimation exercise, not a hardware demonstration. But it matters because the threshold for concern in cryptography has never been a single magic qubit count. It is the product of many engineering choices: physical error rates, error-correction codes, gate scheduling, circuit depth, interconnects, and the ability to keep the whole machine coherent long enough to finish the computation.
The practical message is therefore subtler than “RSA is broken.” It is that the assumed cost curve for breaking RSA and elliptic-curve cryptography has moved again, and in the wrong direction for defenders.
Why cat qubits lower the estimate
Alice & Bob’s result rests on the company’s central bet: cat qubits can suppress one important class of errors at the hardware level. Conventional resource estimates must budget heavily for correcting both bit-flip and phase-flip errors. Cat qubits are designed so that bit flips are strongly suppressed, leaving the architecture to spend much of its correction overhead on phase flips .
The new estimate combines three ingredients. First, it uses the cat-qubit error model. Second, it applies LDPC-cat codes, which the company says are more efficient than the repetition-code approach used in its earlier estimates and reduce the RSA-2048 qubit count from 49,649 to 22,593 . Third, it redesigns the adder, a heavily used component inside Shor’s algorithm, so that the relevant operations can be scheduled more efficiently on the architecture .
The difference from older public estimates is large. Alice & Bob says its cat-qubit architecture requires 40 times fewer physical qubits than Craig Gidney’s 2025 Google Quantum AI estimate for breaking RSA-2048 . That comparison should be read carefully: different architectures make different assumptions, and “physical qubit” is not a fully interchangeable unit across platforms. Still, the direction is important. Better codes and better compilation can lower the cryptanalytic resource estimate even before hardware catches up.
The assumptions behind the headline
The 22,593-qubit figure is the headline, but the assumptions are the story. A separate analysis of the Alice & Bob ePrint notes that the estimate depends on a one-microsecond error-correction cycle, a 10-microsecond reaction time, a circuit-level phase-flip probability of 5 × 10⁻⁴, and an approximation in which bit flips are effectively absent, corresponding to a characteristic bit-flip time of about 100 years . Relaxing that assumption to a bit-flip time of about one hour raises the RSA-2048 estimate to roughly 45,000 cat qubits .
That distinction is crucial for security teams. The risk is not that 22,593 laboratory qubits today can suddenly decrypt the internet. The risk is that the viable design space is tightening. If an architecture can trade a harder hardware target for lower correction overhead, and if algorithm designers keep shaving circuit depth and scheduling costs, then long-term cryptographic planning has less slack than procurement cycles assume.
This is why the result should be read as a planning shock, not a breach notification. The attacker still needs a fault-tolerant machine, a large and stable processor, sufficiently good error rates, and a complete operational stack. But defenders must migrate systems that were often built over decades and are expected to protect data for decades more.
Post-quantum migration gets less optional
Alice & Bob’s report lands in a world where post-quantum cryptography is no longer theoretical policy work. The company points to U.S. and U.K. guidance calling for organizations to complete the transition to post-quantum cryptography by 2035 . That date can sound distant until an enterprise inventories certificates, hardware security modules, embedded devices, payment systems, industrial controllers, identity infrastructure, archived data and third-party dependencies.
The deeper issue is “harvest now, decrypt later.” Any information that must remain confidential into the 2030s is already exposed if it is intercepted today under classical public-key schemes and stored for a future quantum attack. Lower resource estimates increase the value of crypto-agility: the ability to swap cryptographic primitives without rebuilding the whole system.
The appropriate response is not panic. It is prioritization. Organizations should identify long-lived secrets, map where RSA and elliptic-curve cryptography are used, test hybrid and post-quantum key exchange where standards and products are mature, and make sure cryptographic dependencies are visible rather than buried in appliances and vendor defaults.
Hardware is moving toward manufacturability
The Alice & Bob estimate is also part of a wider shift in quantum computing from isolated device milestones toward systems engineering. Universal Quantum has introduced iQPU, a foundry-fabricated trapped-ion processor designed for modular scaling . According to Quantum Computing Report, the architecture combines a large trapped-ion compute surface, integrated ultra-low-noise control electronics, and UQConnect module-to-module links, with the chips intended for two quantum computers being delivered under a €67 million contract with the German Aerospace Center .
That does not validate Alice & Bob’s cat-qubit estimates; it is a different hardware path. But it supports the broader point: credible quantum programs are increasingly framed around manufacturability, modularity and integration rather than single-chip spectacle. Universal Quantum’s iQPU is described as fabricated on a commercial 200 mm wafer line, using integrated controls to reduce the wiring bottleneck that makes trapped-ion systems hard to scale .
For cryptography, this matters because the timeline to threat is not driven only by the best qubit in a lab. It is driven by whether the industry can repeatedly manufacture, connect, control and error-correct useful quantum modules.
Applications are also testing the stack
A second recent signal comes from FirstQFM, which demonstrated quantum reservoir computing on Rigetti’s 108-qubit Cepheus-1-108Q superconducting processor for a financial forecasting pilot . In a blinded out-of-sample evaluation across 43 anonymized assets and 600 trading dates, the hybrid quantum reservoir pipeline reportedly outperformed classical machine-learning and time-series foundation-model baselines on directional accuracy, macro-F1, cumulative gross profit and loss, and Sharpe ratio .
FirstQFM’s own technical write-up says the pilot used Rigetti’s 108-qubit processor and that quantum reservoir computing transforms time-series inputs through controlled quantum dynamics before sending measured features to a classical prediction head . The reported result is not a general proof of quantum advantage, and the Quantum Computing Report account explicitly notes caveats including larger drawdowns and unresolved classical simulability boundaries . Still, it is part of the same maturation pattern: quantum progress is being tested at the level of workflows, latency, validation and commercially relevant benchmarks.
The new threshold is a governance problem
Taken together, these developments sharpen the same lesson. The quantum threat to encryption is not a calendar date waiting to be discovered. It is a moving threshold shaped by architecture, compilation, error correction and industrial execution. Alice & Bob’s estimate lowers one important resource number. Universal Quantum’s iQPU points to more manufacturable modular hardware. FirstQFM’s Rigetti pilot shows that application developers are already probing quantum systems against real-world benchmarking disciplines.
For defenders, the safest conclusion is that post-quantum migration should be treated as infrastructure renewal, not as a last-minute patch. The padlock has not shattered. But the sound in the distance is no longer science fiction; it is the engineering clock getting louder.
Comments
Be the first to comment.