Alice & Bob Estimates 22,593 Qubits to Break RSA-2048
Alice & Bob, a French company specializing in error-corrected machines using cat qubits, claims that breaking RSA-2048 would require 22,593 physical cat qubits and 3.14 days on fault-tolerant superconducting hardware. Indeed, this estimate comes from a new paper focused on compiling Shor’s algorithm, which Alice & Bob states represents a record low for the total quantum resources needed for this attack. This figure is significantly lower than the million-qubit estimates from a year ago and emerges as regulators are already planning for RSA’s eventual retirement.
Details of the Estimate
Alice & Bob derived this number by precisely mapping the function and timing of each physical qubit throughout the most demanding sections of the circuit, generating complete chip layouts and schedules instead of relying on an average count.
The paper, titled “Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days,” presents the following key findings:
- For RSA-2048: 22,593 physical cat qubits and 3.14 days.
- For ECDLP-256 (which underlies ECDSA and ECDH): 29,588 physical qubits and 61.8 minutes.
- Cat qubits naturally suppress bit-flip errors in hardware, meaning error correction only needs to address phase-flips.
- The use of LDPC-cat codes reduced the RSA qubit count from the company’s 2023 estimate of 49,649 to 22,593.
- A redesigned adder maintains a consistent speed without interruptions for error correction.
Alice & Bob asserts that their design requires 40 times fewer physical qubits than Craig Gidney’s 2025 estimate of under one million noisy qubits (arXiv). The team incorporated recent algorithmic research from Inria and Google. CEO Théau Peronnin stated that the result “changes the paradigm altogether,” a claim made by the company itself. The necessary hardware for this does not yet exist, and Alice & Bob anticipates that engineering advancements and decreasing requirements will converge in the early 2030s.
The Current Status of RSA-2048
The timing of this estimate is crucial. NIST‘s draft IR 8547 proposes to deprecate RSA and other 112-bit public-key algorithms after 2030 and prohibit their use after 2035, with FIPS 203, 204, and 205 designated as replacements. As of mid-2026, this document remained a draft, though its proposed dates are already being used as a working baseline in federal guidance.
Some deployed systems are already adapting. On October 18, 2026, Zcash developers suggested implementing dedicated incoming viewing keys for every cross-chain swap, a measure aimed at addressing quantum privacy risks, which is still under review.
For more QNews coverage on quantum threat estimates and PQC migration, visit qnews.io.