Will quantum computers break RSA-2048? What the 22,593-qubit estimate does and does not mean

The short answer on RSA-2048 quantum risk: no quantum computer has broken RSA-2048, and the new 22,593-qubit figure does not change that. It comes from a preprint on the IACR ePrint Archive, received on 28 October 2026, titled "Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days". It is a resource estimate. It works out what a future machine would need, under stated assumptions, to factor a 2048-bit RSA key. It is not an attack that anyone has run.

It still matters, because each new estimate has lowered the bar, and data you encrypt today may need to stay secret for years. This explainer covers what the paper says, the assumptions behind it, how it compares with earlier estimates, and what security teams are being told to do now.

Four ideas to know first

The basics: why quantum computers threaten RSA

RSA is a public-key system. Its security rests on the fact that splitting a very large number into its two prime factors is extremely hard for ordinary computers. The UK National Cyber Security Centre (NCSC) groups RSA under "integer factorisation" in its post-quantum whitepaper, and lists it among the algorithms a large quantum computer could break.

The method a quantum computer would use is Shor's algorithm. It can factor large numbers and solve discrete logarithms, the hard problem behind elliptic-curve schemes. The NCSC lists ECDH, ECDSA and EdDSA as affected for that reason.

The catch is scale. Quantum bits, or qubits, are fragile. Running Shor's algorithm on a 2048-bit key needs many qubits plus constant error correction. Security agencies call a machine big and reliable enough to do this a cryptographically relevant quantum computer, or CRQC. The CISA guidance uses that term. Papers like this one ask: how small could a CRQC be?

What the 22,593-qubit paper says

The paper is by ten authors. Most list Alice & Bob as their affiliation. Others list Inria, the University of Edinburgh, and CEA and CNRS at Université Paris-Saclay. The ePrint page labels it "Preprint", files it under attacks and cryptanalysis, and does not mention peer review or a journal.

The authors compile Shor's algorithm all the way down to physical operations on a chip. They do this for two designs, one using repetition cat codes and one using LDPC cat codes. They adapt the adder circuit from Craig Gidney's 2025 RSA-2048 estimate and produce concrete chip layouts and schedules.

The headline numbers

• RSA-2048, main configuration: 22,593 qubits in the title, which the abstract rounds to "about 23 000 cat qubits", and 3.14 days.
• RSA-2048, trading space for time: 1.25 hours on about 611,000 cat qubits.
• RSA-2048 without the no-bit-flip assumption: about 45,000 cat qubits (explained below).
• Elliptic-curve discrete log on secp256k1: at most 30,000 cat qubits and 1 hour.
• FFDLP-512, a smaller benchmark the authors propose: about 6,700 cat qubits and 21 minutes.

The assumptions that decide the result

Every resource estimate is only as good as its hardware assumptions. The abstract states these for the main RSA-2048 result:

The last row matters most. The 22,593 figure assumes bit-flip errors do not occur at all. The authors show the requirement can be loosened to a bit-flip time of about one hour, by adding a further layer of error correction with a distance-3 bit-flip code. With that layer, their RSA-2048 estimate rises to about 45,000 cat qubits.

So the paper does not say a 22,593-qubit machine exists or is near. It says that if cat-qubit hardware reaches these numbers, this is roughly what RSA-2048 would cost.

How it compares with earlier estimates

Craig Gidney's May 2025 arXiv preprint is the main reference point. Its abstract says a 2019 estimate he co-published with Ekerå assumed 20 million noisy qubits and eight hours. The 2025 paper cut that to fewer than one million noisy qubits, in less than a week.

Do not read the qubit columns as a straight race. The 2025 paper counts noisy qubits under a surface code. The 2026 paper counts cat qubits under a different error model. A cat qubit is a different kind of physical qubit, so 22,593 cat qubits and one million surface-code qubits describe different machines. What the two papers share is the direction: estimates keep getting smaller.

Why it matters now: harvest now, decrypt later

If no CRQC exists, why act? The NCSC names the reason: "there is a risk from an attacker collecting and storing data today and decrypting it at some point in the future." This is often called harvest now, decrypt later. The NCSC says it mainly matters for high-value data that must stay secret for a long time.

Not everything is at risk. The NCSC says "the security of symmetric cryptography is not significantly impacted by quantum computers", and that AES with keys of at least 128 bits can continue to be used. That includes the AES-256 encryption covered in our guide to PDF passwords. The exposure is in public-key cryptography: RSA and the elliptic-curve schemes used for key exchange and signatures.

What to do: post-quantum cryptography explained

Post-quantum cryptography (PQC) means new public-key algorithms designed to resist quantum attacks while running on ordinary computers. On 13 August 2024, NIST finalised the first three standards:

• FIPS 203, ML-KEM (based on CRYSTALS-Kyber): the primary standard for general encryption.
• FIPS 204, ML-DSA (based on CRYSTALS-Dilithium): the primary standard for digital signatures.
• FIPS 205, SLH-DSA (based on SPHINCS+): a signature standard on a different mathematical approach, a backup in case ML-DSA proves vulnerable.

NIST's Dustin Moody said at the time: "We encourage system administrators to start integrating them into their systems immediately." He added that full integration will take time.

Ask your vendors

Most organisations do not write their own cryptography. It sits inside products they buy. On 5 November 2026, CISA, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) and the NSA published Post-Quantum Questions to Ask Your Vendors. It is a vendor-neutral set of questions with a quick-reference list. The CISA page says the questions help you find out whether a vendor:

1. understands quantum-related risks;
2. "maintains transparency over its cryptographic implementations";
3. "supports a secure, cost-effective and timely transition to PQC".

The agencies point out that cryptography is often built into systems that are hard to update, such as "industrial control systems and Internet of Things (IoT) devices", and say that "early, structured engagement with these vendors is critical to planning efforts". Their timing is simple: move to PQC "before CRQCs become available".

A concrete example

Say your company runs a customer portal over TLS and signs its software updates. Medical or legal records sent through the portal today may need to stay private for decades, so harvest now, decrypt later applies to them. Signing keys matter too, because a future attacker who can forge signatures could push fake updates. A sensible first step is to list where RSA and elliptic-curve keys are used: TLS certificates, VPNs, code signing, firmware. Then ask each supplier which of ML-KEM, ML-DSA or SLH-DSA they will support, and when. Devices with long lives, like IoT hardware, deserve the earliest questions, because they are the hardest to update later.

What is confirmed vs not yet known

For more practical security explainers, see how to check your Android security patch level, or browse all articles on Dexaloop Tech.

Questions

Sources

• Pappalardo et al., Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days (IACR ePrint 2026/2665, preprint) (accessed 7 November 2026)
• Post-Quantum Questions to Ask Your Vendors (CISA, with ASD's ACSC and NSA, 5 Nov 2026) (accessed 7 November 2026)
• Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits (arXiv 2505.15917, preprint) (accessed 7 November 2026)
• NIST Releases First 3 Finalized Post-Quantum Encryption Standards (NIST, 13 Aug 2024) (accessed 7 November 2026)
• Next steps in preparing for post-quantum cryptography (UK NCSC whitepaper, version 2.0) (accessed 7 November 2026)

Written from the sources above and checked against them before publishing. Found a mistake? Email support@dexaloop.com and we will correct it.

More in Security and privacy

• pull_request_target vs pull_request: what it does, why GitHub is blocking it, and how to use it safely
• How to check Android security patch level, and what the date means

Related guides

• Pdf passwords explained