Alice & Bob Estimates 22,593 Cat Qubits Could Break RSA-2048 in 3.14 Days, a Paper Calculation Still Far From Hardware

Alice & Bob, the Paris-based maker of superconducting cat-qubit hardware, said on 29 October 2026 that a fault-tolerant machine with 22,593 physical cat qubits could run Shor's algorithm against RSA-2048 in an expected 3.14 days. The figure comes from a resource-estimate preprint on the IACR ePrint archive, and it is a paper calculation, not a demonstration: no machine of that size exists.

What does the estimate say?

The preprint, titled "Shor's algorithm compiled on cat qubits," lists ten authors and was approved on the archive on 28 October 2026. Its headline result is RSA-2048 in about 3.14 days on roughly 23,000 cat qubits. For the 256-bit elliptic curve used by Bitcoin and Ethereum signatures (secp256k1), the authors report at most about 30,000 cat qubits and about one hour. The Quantum Insider's account gives the figures as 29,588 qubits and 61.8 minutes.

Speed can be bought with hardware: a fast RSA-2048 configuration needs about 611,000 cat qubits and about 1.25 hours, according to the preprint.

The estimate rests on stated assumptions. According to the paper, the machine runs an error-correction cycle of 1 microsecond with a decoder reaction time of 10 microseconds, and phase-flip noise of 5 × 10⁻⁴ per operation. It also assumes no bit-flips at all, which the authors equate with a bit-flip time of about 100 years per qubit. Relaxing that with an extra bit-flip code layer raises the RSA-2048 cost to about 45,000 qubits, the preprint says.

Why do cat qubits change the arithmetic?

Cat qubits suppress one class of error, bit-flips, in hardware, so error correction has to handle mainly phase-flips. Alice & Bob says its savings come from replacing the repetition code used in its 2023 estimate with LDPC-cat codes first proposed in 2024. According to the Quantum Insider, that change alone cuts the RSA-2048 count from 49,649 to 22,593 qubits. The team also compiled the expensive subroutines directly onto physical qubits and redesigned the adder so that it keeps running while the decoder works.

The company's chief executive, Théau Peronnin, framed the trend in a blog post summarised by Quantum Zeitgeist. The company's own estimate for cat qubits fell from roughly 350,000 in 2023 to just under 100,000 in 2024 and now about 23,000. Craig Gidney and Martin Ekerå of Google estimated roughly 20 million physical qubits for RSA-2048 in 2019, and Gidney brought that to under one million in 2025.

How does it compare with Google's 2025 estimate?

PostQuantum.com's analysis puts Gidney's May 2025 figure at 897,864 qubits and about 4.96 days. On that basis, the Alice & Bob design is roughly 40 times smaller in qubit count and about 63 times lower in qubit-days. The designs assume different qubit types: transmons for Google, cat qubits for Alice & Bob. A like-for-like ranking depends on whether each platform's error assumptions are ever met in hardware.

What is still unproven?

The distance between the paper and a working machine is large, and the preprint says so. PostQuantum.com reports that the best published bit-flip times under quantum control are 15 and 22 seconds, each on a single qubit. The RSA estimate assumes a time more than eight orders of magnitude longer, and the authors write that it is "not certain" this can be reached.

Alice & Bob's own preliminary results are 44 minutes on one idle qubit and 189 to 252 minutes on three qubits of its 12-qubit Helium 2 chip, the same analysis says, and the company says these do not show the same level of control. The largest chip on which it has reported error-correction results has 12 cat qubits. Error correction demonstrated so far is a distance-3 repetition code against phase-flips, not yet below threshold, and the paper cites no demonstration of its two-layer chip or of real-time decoding.

The 3.14-day figure also assumes perfect bit-flip protection. With a realistic 101-year bit-flip time, about 10% of runs would fail and the total would stretch to roughly 3.5 days, according to PostQuantum.com.

The preprint has not been peer reviewed, according to its ePrint listing, and nine of its ten authors work for the company. André Schrottenloher of Inria is the exception. Alice & Bob's description of its design as the smallest at this runtime is, in the company's words, "to our knowledge," and the Quantum Zeitgeist report notes that it has not been independently verified.

What does it mean for Bitcoin and for encryption migration?

The elliptic-curve result drew immediate attention from the cryptocurrency community. The Quantum Insider notes that 61.8 minutes is longer than Bitcoin's roughly ten-minute block interval, so transactions already in flight would remain out of reach for a machine at that speed. The paper is more cautious than the press release, according to PostQuantum.com: it says the design is about a factor of six from that threshold and that Bitcoin's migration "needs to be finalized with no delay." The paper does not analyse the priming technique Google used to shorten post-key computation, so exposed addresses and mempool transactions are the likelier targets.

Antoine Joux, a cryptanalysis specialist, called the paper an important reference for tracking when the quantum threat becomes real, the Quantum Insider reported. Ali El Kaafarani, chief executive of PQShield, said post-quantum standards already exist and organisations should deploy them in critical systems now.

The estimate does not move any official deadline. PostQuantum.com lists the existing timelines: a US executive order requiring post-quantum key establishment by 31 December 2030 for federal high-value systems, NIST's IR 8547, which deprecates RSA and elliptic-curve cryptography after 2030 and disallows them after 2035, and an EU roadmap that targets high-risk systems by the end of 2030. Alice & Bob expects hardware progress and falling resource needs to converge in the early 2030s, and says the first such machines could be built "in a matter of years," with no roadmap dates given.

What we don't know yet

Several points remain open. No independent group has reproduced the resource count, and the paper has not been through peer review. Whether cat-qubit bit-flip times can be extended by eight orders of magnitude while hundreds of qubits are operated together is an experimental question that no published result answers. The sources also differ on the preprint's date: PostQuantum.com gives 23 October, while the archive records approval on 28 October. The sources agree that migration to post-quantum cryptography should begin now.