In May 2025 Craig Gidney published an estimate that a quantum computer with fewer than one million noisy qubits could factor a 2048-bit RSA integer in under a week. The 2019 estimate was about 20 million qubits and roughly eight hours. It is a resource estimate, not a prediction of when such a machine will exist.
What the paper claims
The paper, "How to factor 2048 bit RSA integers with less than a million noisy qubits" (arXiv 2505.15917, submitted 21 May 2025), lowers the estimated hardware needed. The qubit count drops by a large factor compared with the earlier 2019 figure, at the cost of a longer runtime of under a week.
The assumptions matter
The estimate depends on stated assumptions:
- Qubits arranged in a square grid with nearest-neighbor connections.
- A uniform gate error rate of 0.1 percent.
- A surface code cycle time of 1 microsecond.
- A control system reaction time of 10 microseconds.
If hardware cannot reach those figures, the estimate does not apply. If it does better, the numbers could shrink again.
What it does not tell you
It does not say a machine with a million good qubits exists, or will exist in any given year. This post gives no date for future hardware, because no source I fetched supports one.
What it does change
Two things for planning:
- Estimates have been moving down. The cost of attacking RSA-2048 on paper fell by a large factor in six years. That is a reason not to anchor on a single comfortable timeline.
- The threat model for long-lived data gets harder to dismiss. If your data must stay secret for ten or more years, a shrinking estimate is relevant.
How to use this without panic
- Treat quantum risk like any risk with an uncertain date: inventory, prioritize by data lifetime, and make migration steps routine.
- Keep policy dates, such as the 2035 federal goal, separate from technical forecasts. Policy dates come from risk management, not from a physics prediction.
- Re-read new estimates when they come out, and update your plan only if assumptions change materially.
Finally, be careful how you quote it. Say that a 2025 paper estimated fewer than a million noisy qubits under stated assumptions. Do not say that RSA will fall in a given year, and do not say the number is a measured fact about hardware. Accurate phrasing protects your credibility with technical readers, and it keeps internal risk discussions focused on decisions you can actually make, such as inventory and data lifetime, instead of arguing about forecasts nobody can verify.
Quick check
Does this paper mean RSA is already broken?
No. It estimates the resources a future machine would need. CISA states that quantum decryption capable of breaking modern public-key encryption does not yet exist.
Does it affect AES?
The paper is about factoring, which is the RSA problem. NIST says AES can continue to be used at 128, 192 or 256 bits.
Sources
- Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits
- CISA, Quantum
- NIST PQC FAQs
Last reviewed: 19 October 2026.
