On October 29, 2026, French quantum computing company Alice & Bob published an estimate that factoring a 2048-bit integer, the size used in RSA-2048 keys, would require 22,593 physical cat qubits and take an average of 3.14 days to succeed. It is a design assessment that spells out the steps a quantum computation would need, from qubit layout to the operations performed in each error-correction cycle.
However, this is not a report that a quantum computer has broken RSA-2048. It is a theoretical estimate that rests on conditions set for the device, such as its error rates, and in particular it requires bit-flips to be suppressed to an extremely low level. A physical qubit is an individual qubit in the hardware, while a logical qubit is a unit that combines multiple physical qubits to protect information from errors. The number of physical qubits shown here and the question of whether a machine that could actually run the computation exists need to be considered separately.
3.14 days is not the time for a single run
The estimate is based on the paper "Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days," by 10 authors including Axel Pappalardo and Dahmun Goudarzi. It was published on October 28, 2026 on the IACR Cryptology ePrint Archive as Paper 2026/2665 and is currently a preprint that has not been peer reviewed. It is not a study that ran a computation on real hardware; it calculates the computing resources needed to factor RSA-2048 from the number of quantum circuit operations and an assumed noise model.
In the baseline design, 22,593 physical cat qubits are needed to build 1,433 logical qubits. That figure includes not only the qubits that hold data but also those used for auxiliary operations, information transfer paths, and preparing the resource states the computation requires. The research team examined in detail the processing needed to factor RSA-2048, but did not run a factorization on an actual machine.
The 3.14-day figure is also not the time for a single computation. In the baseline design, each attempt is estimated to take 7.84 hours, with an expected 9.60 attempts needed to succeed, giving an expected total time of 75.3 hours, or about 3.14 days. In other words, it is the average time if attempts are repeated until one succeeds, and does not mean success is guaranteed within 3.14 days.
The estimate assumes a device with an error-correction cycle of 1 microsecond and a response time of 10 microseconds for decoding and classical control. The circuit-level phase-flip error rate is set at pZ=0.0005 (0.05%), and bit-flips are ignored. The paper also examined a design that cuts the number of physical cat qubits to 21,188 at the cost of an expected total time of 8.08 days. Either way, a device meeting the assumed error rates and operating speeds is required, and comparing qubit counts alone with existing quantum processors says little about actual computing power.
Qubit layout and operations designed around biased errors
To run long computations, a quantum computer must keep operating while correcting errors that arise in quantum information. Cat qubits store information using quantum states of differing phase inside a superconducting resonator. In theory, increasing the average number of photons in the resonator suppresses bit-flip errors, which confuse 0 and 1, exponentially, while phase-flip errors, which invert the relative phase of the quantum state, increase linearly. The research team exploited this bias in errors to design a quantum computing system that mainly corrects phase flips.
At the center of the design is the "LDPC-cat code," based on low-density parity-check (LDPC) codes. It spreads information across multiple physical qubits and performs corrections based on measurement results used to detect errors. The device is envisioned as a two-layer structure: the upper layer holds densely packed data qubits, and the lower layer contains qubits that assist with data access and operations. The lower layer is also responsible for transferring information and preparing the resource states needed for computation.
The team also reworked the design of the adder circuits that are central to factoring. By carrying out state preparation and some operations in parallel with the wait for classical-side decoding to finish, they reduce the time lost to idling. The distinguishing feature of this work is that it considers not only the number of qubits needed but also where and in what order each operation is performed. That said, not every step was evaluated with the same precision, and some phase operations were counted only roughly.
In addition to the LDPC-cat code, the paper compares a design using repetition cat codes. The repetition-cat design needs 49,649 physical cat qubits for an expected total time of 2.67 days, while the LDPC-cat baseline needs 22,593 for 3.14 days. Adopting the LDPC-cat code cuts the qubit count to about 1/2.2 but lengthens the computation. This is a comparison of designs under the conditions set in the same study, and the qubit savings have not been confirmed on real hardware.
Caution is also needed about differences in device assumptions when comparing with other research. For example, Craig Gidney's 2025 resource estimate for RSA-2048 calculated that it could be factored in under a week using fewer than one million physical qubits. That estimate assumes a uniform physical gate error rate of 0.1%, surface codes, and a two-dimensional grid of qubits. Because the conditions differ from this design, which exploits the biased noise specific to cat qubits, the required qubit counts cannot simply be compared to judge which performs better.
Ignoring bit-flips requires a bit-flip time of about 100 years
One of the most demanding conditions in the baseline design is bit-flip suppression. As a guideline for ignoring bit-flips in factoring RSA-2048, the paper cites a bit-flip time of about 101 years per physical qubit. This does not mean running the device continuously for 100 years; it indicates the average time before a bit-flip occurs in an individual qubit. The figure is meant to keep bit-flips across the entire chip used for the computation to under one per 10 attempts on average.
Moreover, meeting the 101-year condition does not make the effect of bit-flips disappear entirely. According to the paper, even under this condition, bit-flips increase the runtime by about 11%. The 3.14 days, calculated by ignoring bit-flips, therefore cannot be treated as a value the actual runtime will reliably fall within. Reducing the effect further would require extending the bit-flip time even more, and errors would have to be suppressed across the entire multi-qubit chip, including measurement and initialization, not just during operations.
Meanwhile, experimental values from prior studies cited in the paper are far from this required level. In experiments on single cat qubits, bit-flip times at rest in a system with quantum control were reported as 15 seconds at an average photon number of 11.3, and 22 seconds for squeezed cat states at an average photon number of 4.1. These are not results newly measured in this study, nor comparison experiments under identical conditions. The resilience of a single idle qubit cannot be equated with the resilience a large device could maintain during computation, and the paper itself notes that uncertainty remains over how far the bit-flip time can be extended.
To address this problem, the research team also examined an "elevator code" that additionally corrects bit-flips. Combining the LDPC-cat code with this extra error correction would, by rough estimate, increase the number of physical cat qubits needed from 22,593 to 44,850 but reduce the required bit-flip time from 101 years to 1.3 hours. However, the figure of 44,850 was not derived from a detailed design of the circuits and operations needed for the whole computation. It is an approximate value extrapolated by assuming proportionality from simulation results for quantum memory.
The bit-flip simulations that served as the basis for the extrapolation ran 1 million trials each for code distances 9, 11, 13, and 15. The range over which pX, the probability of a bit-flip, was verified was greater than 10⁻⁶ and less than 5×10⁻⁵. But the pX=10⁻¹¹ applied to the RSA-2048 design, along with code distances 17 and 21, all fall outside the range actually simulated. The result that extra correction could relax the bit-flip time requirement to 1.3 hours therefore depends on extrapolation to unverified conditions.
Furthermore, the full set of logical gates using the additional code, as well as the specific configurations for ancilla state preparation and information transfer, are not complete. In an appendix, the research team itself acknowledges that these estimates depend on assumptions that require future verification. Although a way to ease the bit-flip requirement has been shown, it has not yet been confirmed that this works as a design capable of executing all the operations needed for factoring.
The gap between 6- to 12-qubit demonstrators and the large-scale design
To connect this design to actual computing capability, the assumed error rates and operating procedures must be verified on real hardware. On October 20, 2026, Alice & Bob announced two 6-qubit chips and one 12-qubit chip as demonstrators for PROQCIMA, France's quantum computer development program. The company reported running a distance-3 repetition code of three data qubits over multiple error-correction cycles, along with operations such as a CNOT that maintains protection against bit-flips. Measurement and initialization of ancilla qubits and a non-Clifford operation were also demonstrated.
However, according to the company, the logical error rate has not yet fallen below the error-correction threshold. The improvements needed to bring it below threshold are evaluated through digital-twin simulations using data from the real devices. These are results announced by the company itself, not results confirmed through independent peer review. No results have been shown from third parties reproducing this RSA-2048 resource estimate, or verifying an actual factorization of RSA-2048 on hardware.
Putting this research and the demonstrators' development status together, there are three stages: 22,593 in the baseline design, a rough 44,850 with additional correction, and 6 to 12 in the demonstrators. Each has different assumptions and a different degree of verification, so they cannot be compared simply by qubit count.
| Stage | Physical cat qubits | Assumptions and verification status | Remaining challenges |
|---|---|---|---|
| Baseline design | 22,593 | Resource estimate for RSA-2048 from the October 2026 paper. Assumes pZ=0.0005 and ignores bit-flips | Hardware verification needed to show the assumed error rates can be maintained during computation |
| Rough estimate with extra correction | 44,850 | Proportional extrapolation based on the paper's quantum memory model | Verification of conditions outside the simulated range and of undesigned logical operations |
| Demonstrators | Two with 6, one with 12 | Hardware results from the company's October 20, 2026 announcement | Logical error rate has not reached below threshold |
What this comparison shows is that a large gap still exists between the large-scale design presented in this research and the technology confirmed on real hardware. Particularly important are whether bit-flips during operation can be suppressed enough, and whether the logical error rate can be reduced as qubits are added. Whether the conditions assumed in the paper are backed by measured data will also be important in judging the feasibility of this resource estimate.
The shift to post-quantum cryptography can't wait for a code-breaking machine
This research does not predict when a quantum computer capable of breaking RSA-2048 will be completed. Even so, organizations that use current public-key cryptography cannot afford to wait until quantum computers become practical before starting countermeasures. The reason is the "Harvest Now, Decrypt Later" threat, in which ciphertext collected today could be decrypted by future quantum computers. For information that must remain confidential for a long time, a move to post-quantum cryptography needs to be considered before quantum computers capable of such decryption appear.
On October 27, 2026, the U.S. National Institute of Standards and Technology (NIST) announced the final version of NISTIR 8547, its guidance on transitioning to post-quantum cryptography. NIST already published post-quantum cryptography standards in August 2024, and has indicated a policy of migrating first from key-establishment methods that protect data requiring long-term confidentiality. The transition requires identifying systems and supply chains where current cryptographic methods are used and allowing for the time needed to update them.
NIST's main target is to advance the transition across U.S. federal systems by 2035. For especially high-priority assets and high-impact systems, it sets different target dates by use: 2030 for key-establishment methods and 2031 for digital signatures. These are not deadlines applied uniformly to private organizations worldwide, nor were they changed in response to Alice & Bob's research.
When planning a move to post-quantum cryptography, it is important to understand how long the data to be protected must stay confidential, which products and business partners embed current cryptographic methods, and how long system updates will take. In quantum computer development, the key questions ahead are whether real machines can maintain the error rates assumed in this paper during computation, and whether additional error correction can be applied to the entire computation. Whether the 22,593-qubit estimate leads to a real machine capable of breaking RSA-2048 depends on whether these technical conditions can be demonstrated.