CyphrQ
Menu

How Many Qubits to Break RSA-2048? Gidney's 2025 Estimate

Gidney's 2025 paper estimates under 1 million noisy qubits and under a week to factor RSA-2048, down from 20 million. What it assumes and what to do.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

How many qubits to break RSA-2048? Craig Gidney's May 2025 paper estimates that a quantum computer with fewer than one million noisy qubits could factor an RSA-2048 key in under a week. His 2019 estimate was 20 million qubits. Today's machines are far smaller, so this is a planning input, not an alarm. It is one more reason to start migrating.

You don't need to memorise the number. You do need to know what it assumes, why it keeps falling, and what it changes about your timeline (very little, and that is the point).

How many qubits does it take to break RSA-2048?

The 2025 estimate is fewer than one million "noisy" qubits, running for less than a week. The paper is Craig Gidney's How to factor 2048 bit RSA integers with less than a million noisy qubits, submitted to arXiv on 21 May 2025.

A "noisy" qubit is an ordinary physical qubit that makes errors. The paper's layout uses about 897,864 of them, and the author rounds up to one million for slack. The run time is about 12 hours per attempt and about 4.96 days per successful factoring once errors are accounted for, rounded up to a week.

Two details matter before you quote any of this:

  • It is a design on paper. Nobody has built this machine. The Google post announcing it calls the claim theoretical and describes the work as a preprint (Google).
  • The number depends on hardware assumptions. Change them and the answer changes. The next section lists them.

What does the estimate assume about the hardware?

The 2025 paper keeps the same hardware assumptions as the 2019 paper by Gidney and Martin Ekerå. In both, the machine is a square grid of superconducting-style qubits where each qubit talks only to its neighbours. The figures below come from the 2025 paper and the 2019 abstract:

Assumption Value
Physical gate error rate 0.1% (1 error per 1,000 gates)
Surface code cycle time 1 microsecond
Control system reaction time 10 microseconds
Connectivity Square grid, nearest-neighbour

The surface code is the error-correcting scheme these estimates use. It spends many physical qubits to build each reliable "logical" qubit. If you want the plain-language version of that idea, I wrote about logical qubits and error correction separately.

The reaction time is how fast the classical control system can read a measurement and decide what to do next. Slower hardware means a longer run, and worse error rates mean more qubits per logical qubit.

How does the 2025 estimate compare with 2019?

The qubit count fell about twentyfold. The run time went the other way.

Gidney and Ekerå, 2019 Gidney, 2025
Physical qubits 20 million fewer than 1 million
Run time 8 hours less than 1 week
Hardware assumptions 0.1% error, 1 us cycle, 10 us reaction, grid Same

The 2019 paper is titled How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits and was published in Quantum in 2021. The 2025 paper says its longer run time comes from using more Toffoli gates (a basic three-qubit operation these circuits are built from) and fewer "magic state factories" than 2019. It still uses over 100 times fewer Toffoli gates than a 2024 method by Chevignard, Fouque and Schrottenloher.

The paper reports about 6.5 billion Toffoli gates and six magic state factories, with a layout of 1,537 logical qubits. Trading time for qubits is the whole story: you can run longer on a smaller machine.

In practice, the 2024 method shows how lopsided these trade-offs can be. The 2025 paper's introduction says the 2019 approach needed about 3 billion Toffoli gates, while the 2024 approach needed about 2 trillion, and calls that "a strikingly inefficient spacetime trade-off." Much of the 2025 progress came from combining existing ideas so that neither number blew up.

Why did the qubit estimate fall from 20 million to 1 million?

Three techniques did most of the work, according to the paper's abstract:

  1. Approximate residue arithmetic. An approximate way of doing the modular arithmetic at the heart of factoring. Google's post says it cut the overhead of the 2024 approach from 1,000 times more operations than earlier work to 2 times.
  2. Yoked surface codes. A second layer of error correction that stores idle logical qubits more densely. Google's post says it triples the storage density of idle logical qubits.
  3. Magic state cultivation. A cheaper way to produce the special resource states that certain gates need, which shrinks the factories.

None of these changed the physics or assumed better hardware. The same 0.1% error rate gives you a machine twenty times smaller.

Are today's quantum computers anywhere close?

No. Google's May 2025 post says quantum computers with relevant error rates "currently have on the order of only 100 to 1000 qubits," against the roughly one million the estimate needs.

That gap is the honest reading. The estimate does not say a break is near. It says the target keeps moving closer from the engineering side, while the hardware side still has a long way to go.

The paper is also candid about its limits. The author says he sees no way to reduce the qubit count by another order of magnitude under these assumptions, and that he cannot plausibly claim 2048-bit RSA could be factored with a hundred thousand noisy qubits. Some parts rest on conjecture or are left for future work, such as detailed simulations of the "cold storage" of idle qubits.

I haven't reviewed work published after the paper, and other groups may have proposed different architectures with different assumptions. Estimates built on different hardware assumptions aren't directly comparable, so check the assumptions before comparing any two numbers.

What does this mean for migration timelines?

It reinforces them. It doesn't move them.

NIST's transition plan is NIST IR 8547, "Transition to Post-Quantum Cryptography Standards." It is an initial public draft, published on 12 November 2024, and its comment period closed on 10 January 2025. As far as I could see on NIST's page, no final version has been published.

Gidney's paper and Google's post both cite the draft's guidance that vulnerable systems should be deprecated after 2030 and disallowed after 2035. Deprecated means discouraged; disallowed means no longer acceptable for that purpose. Gidney writes that he agrees with those dates, and gives his reason: he prefers security not to be contingent on progress being slow. He adds that "attacks always get better."

That is the useful way to read the 20-million-to-1-million drop. You can't predict when a large machine will exist, but you can see that the estimates for building one trend down. Migration takes years, so waiting for a firm date is the risky option.

Google's post gives two priorities:

  • Encryption in transit first. Data recorded now can be decrypted later, so protect key exchange early.
  • Start signature migration early. Signature keys are harder to replace, so Google argues for moving earlier rather than later.

Symmetric cryptography is not affected in the same way, according to the same post.

Which RSA-2048 steps belong in this quarter's plan?

Use the estimate as an argument for a plan, not a deadline.

  1. Pick a planning horizon of 2030 to 2035 and ask which of your systems must still be secure then.
  2. List the long-lived secrets you send over networks: health, legal, identity and contract data.
  3. Ask vendors for their post-quantum roadmap in writing, and for the date of support for the NIST standards.
  4. Ask which system holds your long-lived signing keys, such as code signing, firmware and document signing, and who can replace them.
  5. Re-read estimates with their assumptions. When you see a new qubit figure, find the error rate and cycle time behind it before you compare it with 1 million.

My Q-Day guide covers the standards, the dates and the vendor questions in more detail.

Going deeper: for security and IT teams

This section is for readers who already work with PKI, TLS and key management.

Which assumptions matter most

Four assumptions drive the number, and all four are in the 2025 paper:

  • Error rate of 0.1%. A uniform depolarizing model with one error per 1,000 gates. Hardware with a worse rate needs bigger codes and more qubits per logical qubit. Better hardware shrinks the machine.
  • Surface code cycle of 1 microsecond and a 10 microsecond reaction time. Run time scales with these. A slower machine takes longer for the same circuit.
  • Square grid, nearest-neighbour links. The layout assumes no long-range connections.
  • Magic state supply. Six factories using magic state cultivation, followed by distillation from eight T gates to one CCZ gate. The paper says these are smaller than the 2019 factories.

The paper also states conjectures. The efficiency of the search for residue primes is conjectured ("I conjecture this is true in general"), and the masked period finding step is modelled on an assumption that the real case matches a randomised one. Detailed simulations of cold storage are listed as future work. Treat the headline figure as a careful estimate with named open points.

Why estimates fall, and why that matters for planning

The drop came from three sources: better algorithms (approximate arithmetic), better error-correction layout (yoked codes) and cheaper resource-state production (cultivation). Those are software and design improvements. They don't wait for hardware to improve, which is why a single estimate is a weak basis for a date.

Google's post notes that the error-correction improvements apply to other computations as well, such as chemistry and materials simulation. So the work that lowers the bar for factoring is the same work that makes other quantum applications cheaper.

What this changes in a crypto inventory

The estimate doesn't change what to inventory. It changes how you rank it:

  1. Long-lived confidentiality over key exchange. TLS, VPN, SSH and any protocol that records well. These carry the "recorded now, decrypted later" exposure.
  2. Long-lived signing keys with slow replacement. Code signing, firmware signing, internal CAs, and anything burned into devices. Gidney's co-authored post says signature keys are harder to replace, so start early.
  3. Short-lived signatures and tokens. Last, because a break only helps an attacker at the time it is used.

For each item, record the algorithm and key size, the owner, who holds the key (you or a vendor), and how long it takes to change. RSA-2048 is the case in this paper, but ECC is also in scope of the same migration, so don't build an inventory that only searches for "RSA". The practical template for a cryptographic bill of materials is in the Q-Day guide linked above.

What to verify or ask

  • Vendors: which standardised post-quantum algorithms they support today, and when, and whether the upgrade will arrive as a normal update.
  • Your own team: how long it takes to change an algorithm across every endpoint. If the answer is "a project", that is your first finding.
  • Anyone quoting a qubit figure: the physical error rate, cycle time, connectivity and run time behind it. A number without its assumptions is a headline, not an estimate.
  • Status of NIST IR 8547: it was still a draft when I checked, so confirm the final wording before you write dates into policy.

Learn more

Key takeaways

  • Gidney's 2025 estimate: fewer than 1 million noisy qubits and under a week to factor RSA-2048, with 0.1% gate error, a 1 microsecond cycle and a nearest-neighbour grid.
  • The 2019 estimate was 20 million qubits and 8 hours, on the same assumptions. The saving came from better algorithms and error correction, not better hardware.
  • Google says relevant machines have on the order of 100 to 1,000 qubits today, so this is a planning input, not a forecast.
  • NIST's draft IR 8547 says vulnerable systems should be deprecated after 2030 and disallowed after 2035. It was still a draft when I checked.
  • Protect long-lived data in transit first, and start signature migration early.
  • Never compare two qubit estimates without comparing their assumptions.

Sources