In 1994, mathematician Peter Shor showed that a sufficiently large quantum computer could break RSA and the elliptic-curve cryptography behind Bitcoin. More than thirty years on, nobody has built that machine. Now Alice & Bob estimates that a quantum computer built on its cat-qubit architecture could factor RSA-2048, a widely used encryption standard, in about three days with about 23,000 physical qubits.
The estimate was published in a blog post signed by Théau Peronnin, the company’s chief executive. To Alice & Bob’s knowledge, no published architecture is smaller at this runtime, which the company says puts it “at the frontier of size and speed together.”
Cat Qubit Architecture Achieves 23,000-Qubit RSA-2048 Estimate
Alice & Bob puts the requirement at about 23,000 cat qubits. That is down from just under 100,000 in the company’s 2024 estimate and roughly 350,000 in 2023. The post points readers to the accompanying paper for the hardware assumptions behind the numbers.
The company argues the benchmark matters beyond encryption. Running Shor’s algorithm needs a machine that can carry out billions of operations over hours to days, protected by quantum error correction from start to finish, and Alice & Bob says that is exactly what the first useful applications in chemistry and materials science will need.
Alice & Bob sets its figures against a trend it calls exponential. In 2019, Craig Gidney of Google Quantum AI and Martin Ekerå put breaking RSA-2048 at roughly 20 million physical qubits, and in 2025 Gidney brought that below one million.
Two Numbers, Not One
The company identifies two forces behind the falling estimates. One is better algorithms and compilation, meaning how efficiently a given computer can carry out each step. The other is building the machine itself: the talent, chip fabrication and quantum error correction. It cites Google’s Willow chip, with a logical qubit below threshold, and Quantinuum’s several encoded qubits beyond break-even after post-selection as signs that qubit counts and logical performance are both improving.
Reading such an estimate means looking at two numbers. Qubit count sets how big the machine is, along with its cryogenics, wiring, control electronics, cost and whether it will fit into a computing facility. Runtime tells you whether the answer is still useful when it arrives.
“The same design can trade one for the other, using fewer qubits for more time, or finishing in about an hour if you spread the work across ten machines,” Peronnin writes. The same approach, the company says, covers the elliptic curve behind Bitcoin’s signatures and a smaller benchmark that could be run sooner.
A Blueprint, Not an Envelope
Alice & Bob says the team compiled the complete algorithm down to the floor plan of the physical cat qubits and the layout of the machine it would build to run it. Before, the company says, quantum hardware had been developed in a general direction; now it is designing specific machines for specific computations.
The first such machines could be built in a matter of years, the company says, and because transitions take time, institutions should begin moving to post-quantum cryptography now. “We do not want to see today’s locks fail before they have been replaced, so we urge everyone to migrate, and to take it seriously,” Peronnin writes.
“Post-quantum standards already exist, but they have not been tested nearly enough, and there are not enough people working on them,” he adds. Alice & Bob urges more investment in migrating fast and in making sure those algorithms are resilient, and says it is open to collaborating with people doing that work.
The company argues that the quantum race will not be won by qubit count alone. It will depend, Peronnin writes, “on what we can compute, how quickly we can compute it, and how big of a machine we need to get there.”
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
