Alice & Bob Demonstrates End-to-End Shor’s Algorithm Compilation Requiring 23,000 Cat Qubits to Break RSA-2048

Shor’s Algorithm on Cat Qubits: A New Resource Landscape

Alice & Bob, together with partners at Inria, CEA, and the University of Edinburgh, have released a detailed physical‑layer resource estimate for running Shor’s algorithm on a bosonic‑cat‑qubit platform. Their pre‑print (IACR ePrint 2026/2665) claims that 22,593 physical cat qubits can factor an RSA‑2048 integer in 3.14 days, a footprint roughly 40 × smaller than the most optimistic transmon‑based projections.

---

Why Cat Qubits Shrink the Qubit Count

Traditional fault‑tolerant designs using two‑dimensional surface codes must correct both bit‑flip (σₓ) and phase‑flip (σ_z) errors, leading to massive overheads—often millions of physical qubits for a single logical qubit. The cat‑qubit approach exploits asymmetric noise suppression: autonomous two‑photon stabilization exponentially reduces bit‑flip errors, leaving phase flips as the dominant error channel. This bias enables the use of low‑density parity‑check (LDPC) cat codes instead of repetition codes, cutting the required physical qubits by more than half compared with the authors’ 2023 baseline (≈49 k qubits).

The micro‑architecture pairs specialized parity‑CNOT gates and multi‑target CNOT extensions with a continuous‑flow adder derived from recent algorithmic optimizations (Craig Gidney). The result is a tightly packed schedule that includes physical routing, magic‑state factory floor plans, and adder operations—all laid out in the paper’s supplemental material.

---

Benchmark Configurations

| Target | Qubit Count | Runtime | |--------|------------|---------| | RSA‑2048 (balanced) | 22,593 | 3.14 days | | RSA‑2048 (accelerated, parallel factories) | 610,530 | 1.25 hours | | RSA‑2048 (hardware‑constrained) | 21,188 | 8.08 days | | ECDLP‑256 (secp256k1) | 29,588 | 61.8 minutes | | FFDLP‑512 | 6,656 | 21.2 minutes |

The balanced configuration assumes a 1 µs error‑correction cycle, a 10 µs classical reaction time, and a phase‑flip error probability of 10⁻³. Bit‑flip errors are treated as effectively absent (suppressed to a ~100‑year lifetime). If residual bit‑flip events occur hourly, a distance‑3 concatenation layer pushes the required size to ~45 k qubits.

---

Cryptographic Implications

• RSA‑2048: A three‑day run is far from the real‑time threat posed by today’s internet traffic, but it demonstrates that the physical resources needed are within reach of a large‑scale quantum factory.
• Bitcoin (secp256k1): Factoring the associated elliptic‑curve discrete logarithm in ~62 minutes would not compromise the 10‑minute block interval, but it would endanger dormant or reused public‑key addresses once machines of this scale exist.
• Post‑Quantum Migration: The results reinforce timelines set by NIST and the UK NCSC, which require critical infrastructure to transition to post‑quantum cryptography by 2035.

---

Practical Takeaways

1. Resource optimism: Cat‑qubit platforms could make large‑scale quantum attacks feasible with orders‑of‑magnitude fewer qubits than previously thought.
2. Hardware focus: Continued improvements in photon‑number stabilization and LDPC cat‑code implementations are the key levers for reducing overhead.
3. Strategic planning: Organizations should monitor progress in bosonic error correction and adjust migration roadmaps accordingly, especially for high‑value assets like cryptocurrency wallets.

---

The full technical paper is available on the IACR ePrint archive, and Alice & Bob’s engineering breakdown provides additional implementation details.