Alice & Bob: RSA-2048 factoring estimated at 23 000 cat qubits and 3.14 days
A preprint estimates Shor's algorithm on superconducting cat qubits: RSA-2048 needs about 23 000 qubits and 3.14 days, assuming no bit-flip errors. No such machine exists yet.
A team led by researchers from the quantum computing company Alice & Bob has posted a preprint on eprint.iacr.org with an end-to-end resource estimate of Shor's algorithm on superconducting cat qubits. The work covers the algorithm for RSA, ECDLP and FFDLP and compiles it down to physical-qubit operations and chip layouts. According to the authors, factoring RSA-2048 requires about 23 000 cat qubits and 3.14 days eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗. The preprint has not yet undergone peer review.
Assumptions and architectures
The estimate assumes a 1 μs error-correction cycle time, a 10 μs reaction time, circuit-level phase-flip noise with probability 5 × 10⁻⁴ and no bit-flips. Cat qubits suppress bit-flip errors exponentially while phase-flip errors grow only linearly, which is why the model is built around phase-flip noise.
The authors compile the dominant subroutines for two architectures: one based on repetition cat codes and one based on LDPC cat codes. They designed a parity-Cnot gate for cat qubits, extended a multi-target Cnot gate to the LDPC-cat architecture and adapted an active injection procedure. The adder is taken from Gidney's 2025 resource estimate for factoring RSA-2048 and adapted to cat qubits. The factory designs and lookup compilation come from the FeMoco resource estimation of Kroell et al.
Other problems and trade-offs
Reusing the operations compiled for RSA-2048, solving ECDLP on secp256k1 requires at most 30 000 cat qubits and 1 hour eprint.iacr.org
eprint.iacr.orgeprint.iacr.orgOpen source ↗. FFDLP-512, which the authors propose as an intermediate benchmark, takes about 21 minutes. Trading space for time, RSA-2048 runs in 1.25 hours on about 611 000 cat qubits.
The requirement of no bit-flips corresponds to a bit-flip time of about 100 years. It can be relaxed to a bit-flip time of about one hour by adding a concatenation layer with a distance-3 bit-flip error-correcting code. In that case the authors estimate the cost of RSA-2048 at about 45 000 cat qubits.
No quantum computer of this size exists today. Scalability, stability and temperature control remain open engineering tasks, and the estimate holds only under the stated error model.
