Alice & Bob published a preprint a few days ago that puts RSA-2048 at 22,593 physical cat qubits and 3.14 days, about 40 times fewer qubits than Craig Gidney’s 2025 estimate, on hardware assumptions nobody has demonstrated. Its authors are also more cautious about Bitcoin than the company’s press release. I go through the paper and the other 2026 estimates in a free webinar at 15:00 UTC today. Then Quantum Academy’s first four weeks, in which we trained more than 100 people, and why I think an hour with a practitioner beats an AI-led course. Iceberg Quantum claims 72,000 qubits and 3.7 days for Pinnacle 1.2 without publishing the circuits or the decoder behind the figures. In its final IR 8547, NIST gives P-256 the same 2030 deprecation date as RSA-2048. And Google and Quantinuum reported hardware results in October.
Alice & Bob Puts RSA-2048 at 22,593 Cat Qubits, If Each One Gets a 100-Year Bit-Flip Time
Alice & Bob, the Paris- and Boston-based company that builds quantum computers from superconducting cat qubits, published a resource estimate today concluding that a machine built on its architecture could factor a 2048-bit RSA integer with 22,593 physical qubits in 3.14 days. The same 122-page preprint puts the elliptic-curve discrete logarithm on secp256k1, the curve behind Bitcoin and Ethereum signatures, at an expected 61.8 minutes on at most 29,588 physical qubits.
The paper shows what a cat-qubit machine could do if the physics delivers. It does not show that the physics will deliver, and it moves no compliance date.
Alice & Bob says its design requires 40 times fewer physical qubits than Gidney’s May 2025 estimate of 897,864; the authors describe that comparison as made “with different hardware hypotheses.” Both designs run Shor’s algorithm on about 1,400 logical qubits. A cat qubit suppresses bit-flips, so Alice & Bob’s design mainly has to correct phase-flips and uses about 16 physical qubits per logical qubit, against about 640 in Gidney’s.
What Alice & Bob Assumes for 3.14 Days
The 3.14 days assumes negligible bit-flips, a 0.05% phase-flip probability in the paper’s circuit-level noise model, a one-microsecond error-correction cycle and a ten-microsecond decoder response, all at once. The authors calculate that a bit-flip time of about 101 years per qubit would keep bit-flip failures to about 10% of runs, adding about 11% to the runtime and taking it to about 3.5 days.
The longest bit-flip times the paper cites from published experiments with quantum control are 15 and 22 seconds, each on a single qubit. The authors write that “it is therefore not certain that the bit-flip time can be extended by another eight orders of magnitude.” They also sketch a variant of about 45,000 qubits that would need a bit-flip time of about 1.3 hours, a rough extrapolation to a construction that has not yet been designed, with no logical gate set yet for the codes it relies on.
Alice & Bob’s error-correction results of 20 October came from 6- and 12-qubit demonstrators: a distance-3 repetition code with a logical error rate “not yet below threshold.” Since 2023 the company’s theorists have cut its RSA-2048 figure from 349,133 cat qubits to 22,593. The hardware results to watch, from bit-flip times under quantum control on a multi-qubit chip to a repetition code below threshold, are in my full analysis, along with every configuration in the paper and how it compares with the other 2026 estimates.
Bitcoin and the Order of the Work
The press release says an attack of about an hour is longer than Bitcoin’s 10-minute block time, “so transactions in progress remain out of reach.” The paper says “only a factor of about six separates it from this threshold” and that Bitcoin’s migration “needs to be finalized with no delay.” Neither account should treat an average block interval as a hard safety boundary: low-fee transactions can wait for hours, and coins in addresses whose public keys are already on the blockchain face no race at all.
On the balanced figures, a secp256k1 key falls about 73 times faster than an RSA-2048 key. For that reason I would review exposed elliptic-curve keys and long-lived trust anchors early. Attack runtime is one input; key exposure, the required security lifetime and replacement lead time still set the sequence.
The formal deadlines are unchanged. Under Executive Order 14412, US federal high-value assets and high-impact systems, excluding national security systems, must use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. An estimate like this one can still justify an earlier internal target or a wider margin before those dates. The release says the research “proves” the risk is approaching fast. The paper establishes a lower resource target; it does not establish when hardware that meets it will arrive.
Quantum Academy Trained More Than 100 People in Its First Four Weeks
I opened Quantum Academy on 2 October. Less than a month later, we have trained more than 100 people, the site receives tens of thousands of unique visitors a day, people rather than bots, and we are deep in building custom courses for several large organizations in risk and technology. I explained at launch why I started it: Applied Quantum’s clients kept asking us to train their teams.
This venture is personal. I love teaching, and it has been part of my working life since my IT career started in 1992. I am proudest of the faculty, experienced practitioners many of you will already know from their work in the industry; a few more well-known names are joining.
Our motto is measure the gap: compare what is claimed about quantum technology with what has been demonstrated, then plan from the difference. Today’s paper is a worked example. The 22,593 is a count of physical qubits, and each of them would need a bit-flip time nobody has measured. The deadlines in a migration plan apply whatever bit-flip time the hardware reaches. We use the habit in both directions, on claims that a code-breaking machine is about to arrive and on claims that it never will.
We launched with live courses, online and in person, and live teaching will stay our priority. In a live session you can ask how a concept applies to your own estate, challenge an instructor’s assumption and work through a scenario with peers who face the same problem. My view is that an hour with a practitioner who has defended a migration plan to a board beats any AI-led course I have seen. We do use AI to help draft course material, and our AI Editorial Policy sets out how subject-matter experts review it; every live session is taught by its instructor.
The catalog has more than 80 courses and 11 professional credentials, and the schedule lists the next live sessions. Teams can book any course as private training.
Iceberg Claims 72,000 Qubits for RSA-2048 in Pinnacle 1.2 Without Publishing the Circuits or the Decoder
On 22 October, Iceberg Quantum released Pinnacle 1.2, an update to the qLDPC architecture behind its February estimate. Iceberg now says 72,000 physical qubits at a 0.1% physical error rate and a 1-microsecond cycle could factor RSA-2048 in an expected 3.7 days, down from about 98,000 qubits and up to a month. For superconducting chips, whose connections are fixed at fabrication, it gives 99,000 qubits for 5.0 days.
Iceberg released the figures in a blog post with updated simulation results and resource tables. It has not published a paper for them, the compiled circuits, or a description of Crevasse, the new decoder it credits with a mean of four microseconds per round. Its earlier papers are on arXiv, which is how Craig Gidney and Scott Aaronson could assess the February estimate within days; nobody outside Iceberg can reproduce the new figures from what it has disclosed. Until it does, I treat them as company figures. The disclosure I would look for next is the decoder’s sustained throughput on named hardware, together with the circuits or a zero-knowledge proof of them of the kind Google published in March.
NIST Gives P-256 the Same 2030 Deprecation Date as RSA-2048 in Final IR 8547
On 27 October, NIST published the final version of IR 8547, its plan for retiring quantum-vulnerable public-key cryptography. The two dates stayed: deprecation after 2030, disallowance after 2035. The 2024 draft deprecated only 112-bit parameters such as RSA-2048 after 2030 and left P-256, RSA-3072 and Ed25519 acceptable until 2035. The final report deprecates RSA, ECDSA, EdDSA and quantum-vulnerable key establishment at every approved strength after 2030.
Any migration plan that kept P-256 on a 2035 schedule now contains a deprecated algorithm from 2031. A deprecated algorithm can still be used, but the data owner has to examine the risk and decide. My recommendation is to record that decision for every classical-only use you keep, at the system or service level, with an owner, a justification and a migration date.
On hybrids, NIST wrote that a key-establishment combination built with the composite technique in SP 800-56C can still be validated under FIPS 140 after 2035 if at least one input comes from an approved scheme such as ML-KEM (formerly CRYSTALS-Kyber), even when the classical input is disallowed. For hybrid deployments such as X25519MLKEM768, offered by default in the major browsers, that requires a validated ML-KEM implementation. NIST also recommends ML-KEM-768 as the default parameter set.
Google and Quantinuum Report Error-Correction Results on 105- and 98-Qubit Machines
In October, Science published Google Quantum AI’s magic-state cultivation experiment on Willow, first posted as a preprint in December 2025. It cut the error of an encoded T state about 40-fold, to an upper bound of one to two in 10,000. That bound is 1,000 to 2,000 times above the 10⁻⁷ T-state error Gidney’s 2025 RSA-2048 estimate assumes, a comparison between a measured upper bound and a modeled requirement, from the smallest, distance-3 version of the protocol.
On 19 October, Quantinuum reported that logical errors on its 98-qubit Helios machine fell with a fitted suppression factor of about 12 as its color codes grew from distance 3 to 7, reaching 5×10⁻⁶ per round at distance 7. I would put that factor in front of a board, because it helps determine the error-correction overhead a larger machine would need. The preprint has not been peer reviewed, and the headline figures were decoded after the experiments. Each round takes about a fifth of a second.
Willow has 105 physical qubits and Helios has 98. The sub-week RSA-2048 designs from Alice & Bob and Iceberg need more than 200 times as many physical qubits as either, a headcount comparison across qubits with very different operating assumptions. The next results to watch are cultivation at distance 5 and Quantinuum’s codes decoded in real time.
If a colleague is about to brief their board on today’s 22,593-qubit headline, forward this to them first. If I got something wrong, hit reply – I read everything and correct publicly. And tell me whether you would rather get separate editions for quantum computing and for quantum security.
— Marin