A one-million-qubit machine could crack 2048-bit RSA in seven days, study finds

A preprint from Google Quantum AI recalibrates expectations for the hardware needed to crack widely deployed 2048-bit RSA encryption. The team demonstrates—on paper—that roughly one million noisy qubits, operating continuously for about seven days, would suffice. Previous estimates hovered near 20 million qubits, so the new figure reduces the window between theory and practical threat.

Two advances drive the reduction. First, researchers refined Shor’s factoring algorithm by using approximation rather than exact modular exponentiation, trimming the number of logical qubits without inflating run-time unreasonably. Second, denser error-correction schemes—yoked surface codes layered with “magic-state cultivation”—triple storage density for idle logical qubits while controlling error rates. Together, these techniques cut physical-qubit requirements by a factor of twenty compared with 2019 projections.

Hardware, however, still lags behind the study’s hypothetical machine. Today’s leading processors, such as IBM’s 1,121-qubit Condor and Google’s 53-qubit Sycamore, remain orders of magnitude smaller. Roadmaps do exist: IBM targets a 100,000-qubit system by 2033, and Quantinuum aims for a fully fault-tolerant platform by 2029. Even so, sustaining a million qubits with low enough error rates and coordinating billions of logic operations over five continuous days remains an engineering hurdle.

RSA, Elliptic Curve Diffie-Hellman, and similar asymmetric schemes anchor much of today’s secure communication. Because ciphertext collected now could be decrypted later, NIST urges migration to post-quantum cryptography (PQC) algorithms, with vulnerable systems deprecated after 2030 and disallowed after 2035. Google has already integrated the ML-KEM key-encapsulation mechanism into Chrome and its internal networks, signaling an industry shift toward quantum-resistant standards.

The work offers a concrete threat model for both hardware designers and policy makers. As quantum algorithms mature and error rate shrinks, the gap between laboratory capability and cryptanalytic attack narrows.