The shrinking resource frontier is not a hardware milestone
A 128-page preprint published in October 2026 proposes a striking resource estimate for one of the most consequential benchmarks in quantum computing: factoring a 2,048-bit RSA modulus. Axel Pappalardo and colleagues calculate that a particular superconducting cat-qubit architecture could complete the task with 22,593 physical cat qubits and an expected elapsed quantum runtime of 3.14 days. The result is not a laboratory factorization of RSA-2048. It is a carefully specified, architecture-dependent prediction, conditional on a fault model and on physical operations that have not yet been demonstrated together in a processor of the stipulated scale.
Why should this matter to anyone who does not work in quantum computing? Because much of the digital world’s security depends on mathematical problems that ordinary computers cannot solve within a practical amount of time. When a browser establishes a secure connection to a website, when a banking application authenticates its server, when an employee connects to a corporate network through a VPN, or when a smartphone verifies that a software update comes from its legitimate publisher, cryptographic mechanisms help establish confidentiality, authenticity, and integrity. Those mechanisms underpin the trust relationships on which everyday digital services depend.
Consider the familiar padlock associated with an HTTPS website. HTTPS uses TLS, the successor to the now-obsolete SSL protocols, to establish an encrypted and authenticated connection between the browser and the server. In contemporary TLS deployments, asymmetric cryptography typically performs two distinct functions: a digital signature helps authenticate the server, while an ephemeral key exchange establishes secrets from which the symmetric encryption keys are derived. The actual traffic is then protected by symmetric encryption, such as AES or ChaCha20. The security of the public-key mechanisms commonly used for authentication and key establishment—including RSA, elliptic-curve signatures, and elliptic-curve Diffie–Hellman—rests on mathematical problems that a sufficiently powerful quantum computer running Shor’s algorithm could solve efficiently.
The consequences extend well beyond web browsing. Quantum attacks against these public-key mechanisms could eventually affect the authentication of online banking services, confidential VPN communications, secure email and messaging protocols, digitally signed contracts, software distribution, firmware updates, and the authorization of cryptocurrency transactions. The precise vulnerability depends on which cryptographic algorithms each system uses: Shor’s algorithm does not directly break AES or every component of TLS, nor does it imply that all encrypted communications would become readable immediately. It threatens the mathematical foundations of specific public-key mechanisms that often establish or authenticate the security of those systems.
The temporal dimension makes the problem more consequential than an ordinary future technology risk. An adversary can record certain encrypted communications today and attempt to decrypt them years later, once quantum capabilities become available. Information that must remain confidential for decades can therefore be captured and retained today, even though its contents may become accessible to an adversary only after the necessary quantum capabilities emerge. Signature-based authentication creates a related but different problem: keys and trust anchors used to authorize software, transactions, or documents may remain valid long after the mathematical assumptions supporting them have become insecure. These risks concern not only future communications, but also information and trust relationships created today whose required security lifetime extends into the quantum era.
This is why reducing the estimated resources required to execute Shor’s algorithm matters, even without an operational quantum computer capable of breaking RSA-2048. A resource estimate does not provide a date for cryptographic compromise, but it changes our understanding of the engineering requirements that separate the mathematical attack from its physical realization.
The numerical improvement is substantial. Gidney and Ekerå’s influential 2019/2021 surface-code estimate involved approximately 20 million noisy qubits and eight hours. Gidney’s 2025 refinement brought the estimate below one million qubits, with a runtime measured in days. The new cat-qubit estimate reduces the physical footprint by nearly fortyfold relative to Gidney’s 2025 detailed calculation of 897,864 qubits, although the assumed physical error channels, encoded operations, and architectures are different. The figures must not be interpreted as results of a controlled comparison in which every variable except the qubit technology has been held constant.
Alice & Bob illustrates this historical movement in the resource-frontier graphic accompanying its blog post, referenced below as an SVG asset. The image is useful for displaying the joint dependence on qubit count and runtime; its coordinates are published estimates, not observations of hardware actually factoring RSA-2048.
The intellectual question is consequently more precise than whether quantum computers have suddenly become forty times easier to build. Which improvements arise from mathematics and logical compilation; which arise from exploiting a physical noise asymmetry; and which require hardware capabilities that have not yet been achieved? A complete interpretation also requires distinguishing a nominal qubit footprint from the full processor and its supporting infrastructure. Replacing one error-correction architecture with another changes not just data storage but gates, resource-state production, routing, decoding, and the ways failures accumulate.
The paper reports three cryptanalytic workloads. Its main result is the physically mapped RSA-2048 configuration. It also estimates roughly 29,588 cat qubits and about 61.8 minutes for elliptic-curve discrete logarithms on secp256k1, and approximately 6,656 cat qubits and 21.2 minutes for a deliberately smaller 512-bit finite-field discrete-logarithm benchmark. These estimates do not have identical levels of compilation completeness: the latter workloads reuse the RSA physical primitives and employ less exhaustive resource derivations. The paper additionally explores space-efficient and parallel variants, as well as a roughly 45,000-qubit alternative that would correct some physical bit flips at the cost of further modeled overhead.
The claim worth defending is therefore substantial but bounded. The authors have moved the modeled architecture frontier for fault-tolerant quantum cryptanalysis; they have not demonstrated that a cryptographically relevant quantum processor exists. Nevertheless, the distinction between mathematical possibility and physical realization should not obscure the cybersecurity implications: the public-key cryptography on which everyday digital trust depends is vulnerable to a known class of quantum algorithms, and successive improvements in their implementation are reducing the estimated resources needed to exploit that vulnerability. This is the foundation for both the technical appraisal of the paper and its broader implications for industrial strategy, digital sovereignty, and the transition to post-quantum cryptography.
Alice & Bob: from European quantum research to industrial sovereignty
Alice & Bob was founded in France in 2020 by Théau Peronnin, its chief executive, and Raphaël Lescanne, its chief technology officer. The scientific origin of the company lies in research on bosonic cat states and engineered stabilization of superconducting oscillators. Lescanne’s work, developed through the French quantum-research ecosystem, demonstrated why carefully designed dissipation could produce a physical qubit with a strongly asymmetric error channel; Peronnin and Lescanne then sought to industrialize that approach. The company’s stated ambition is to construct a universal, fault-tolerant quantum computer rather than rely exclusively on noisy intermediate-scale computation.
The commercial organization has grown beyond its French founding laboratory. By October 2026, the company reported more than 250 employees, four offices, and more than €180 million in cumulative financing. Its January 2025 €100 million Series B was led by Future French Champions, AVP, and Bpifrance, with participation from existing investors including Elaia Partners, Breega, and Supernova Invest, as well as public investment mechanisms associated with the European Innovation Council and the French state. Future French Champions is a partnership involving Bpifrance and the Qatar Investment Authority, a useful reminder that the location of investment management and the ultimate source of investment capital are not necessarily identical. In May 2026, Alice & Bob announced an undisclosed additional investment by NVentures, NVIDIA’s venture-capital arm. Participation in financing establishes economic exposure but does not, by itself, establish voting control, rights over research, or ownership of the company’s technology.
The financial commitments are accompanied by investments in industrial capacity. Alice & Bob announced plans for a research and production facility of approximately 4,000 square metres in Paris, financed in part through its Series B. This is significant because the transition from laboratory demonstrations to fault-tolerant processors requires much more than a theoretically favorable qubit design: specialized fabrication, device packaging, cryogenics, quantum-control electronics, classical processing, error-correction software, and sustained calibration capabilities must eventually operate as an integrated system.
In October 2026, Alice & Bob reported that its GPU-based LDPC-cat decoding proof of concept used NVIDIA NVQLink and Quantum Machines’ OPX1000 control infrastructure. The experiment employed synthetic syndrome data and did not demonstrate real-time decoding, but it illustrates the hybrid quantum–classical architecture required by its approach. Such partnerships can accelerate development by exploiting specialized industrial capabilities; they also introduce dependencies whose strategic significance cannot be determined solely from the company’s French headquarters.
PROQCIMA: five competing technological approaches
The French PROQCIMA programme places Alice & Bob within a substantially broader national effort to develop industrially viable, universal quantum computers. Launched in March 2024 by the Direction générale de l’armement (DGA), with support from France 2030 and the French government’s investment apparatus, PROQCIMA adopts a staged competitive procurement mechanism rather than selecting a single favored quantum-computing technology at the outset.
On 5 March 2024, the DGA awarded framework agreements to five French companies: Alice & Bob, C12, Pasqal, Quandela, and Quobly. Their selection is particularly important because the companies pursue substantially different physical implementations of quantum information processing, each with its own scaling advantages and engineering constraints.
The diversity of these approaches is not incidental. Superconducting cat qubits promise reduced error-correction overhead through engineered noise asymmetry but require stabilized oscillator operation and demanding microwave and cryogenic infrastructure. Neutral atoms offer flexible spatial arrangements, but their control, gate dynamics, and correction-cycle durations differ from superconducting devices. Photonic computing has distinct opportunities for optical communication and integration, together with challenges in resource generation, loss management, and fault-tolerant processing. Electron-spin systems in carbon nanotubes or silicon seek advantages from nanoscale devices and semiconductor fabrication, while confronting their own constraints in qubit uniformity, control, coupling, and readout.
These are differences in underlying engineering assumptions rather than merely competing implementations of an otherwise identical processor. It is therefore impossible to establish which technology offers the most favorable route to a universal fault-tolerant computer simply by comparing announced physical-qubit counts. PROQCIMA’s architecture-neutral selection strategy is consistent with this uncertainty: public funding supports several technological hypotheses until experimental evidence and industrial feasibility justify progressively narrowing the field.
The programme was initially announced with a maximum aggregate framework value of €500 million, covering a multi-year process of technological proof of concept, maturation, and eventual industrialization. Its competitive structure envisages an initial assessment period from 2024 to 2026, a further competition through 2028 that should reduce the field from five candidates to three, and a subsequent maturation period culminating in the selection of at most two technologies by 2032. The objective is not simply to reward the most convincing theoretical design, but to identify approaches capable of sustaining increasingly integrated demonstrations and eventually being manufactured and operated at scale.
The technical ambition was materially revised in May 2026. Under the French government’s accelerated quantum strategy, the target for 2032 increased from 128 logical qubits to approximately 1,000 logical qubits, specified as 1,024 in a subsequent Ministry of Armed Forces communication. The government also announced a doubling of PROQCIMA funding for the 2026–2030 period, with €300 million allocated over four years. These announcements describe the revised programme’s financing and objectives; they should not be interpreted as €300 million already disbursed, nor simply added to the original €500 million framework ceiling without reconciling the relevant budgetary and contractual scopes.
A target of 1,024 logical qubits represents an ambitious industrial milestone, but it is not equivalent to demonstrating the RSA-2048 machine described by Pappalardo and colleagues. The preprint’s factoring workload requires 1,433 abstract logical qubits in its selected algorithmic configuration, while its physical architecture includes extensive storage, routing, resource-state production, decoding, and correction infrastructure. More fundamentally, a logical-qubit count does not establish the gate fidelity, effective logical error rate, computational depth, factory throughput, or bit-flip suppression required for a particular cryptanalytic workload. The existence of a programme target therefore supplies evidence of institutional ambition and planned investment, not experimental validation of the resource estimate.
Alice & Bob’s October 2026 Phase 1 disclosures are best understood within this distinction. The company reported three independently operated demonstrators, consisting of two six-qubit chips and one twelve-qubit chip. The reported work included noise-biased CNOT gates, ancilla measurement and reset, repeated distance-three repetition-code cycles, logical-error measurements, and a physical non-Clifford gate. The company also stated that the measured logical-error performance was not yet below the relevant error-correction threshold. These results constitute meaningful evidence of component integration and progress toward the programme’s early technical milestones, but not a demonstration of scalable fault-tolerant computation.
From national hardware development to a sovereign computing stack
The French institutional strategy is not confined to physical quantum processors. In September 2026, the Ministry of Armed Forces announced ALIQUANTE, a complementary five-year project intended to develop sovereign quantum-programming capabilities in preparation for the systems emerging from PROQCIMA. Led by the French defense innovation authorities, it was entrusted to a consortium comprising Thales Research & Technology, BULL SAS, and the Commissariat à l’énergie atomique (CEA).
ALIQUANTE is intended to provide tools for programming different QPU technologies, compiling quantum circuits, emulating quantum processors, estimating computational resources, and allocating execution between high-performance classical computing systems and quantum processors. Its intended applications include defense workloads and the processing of classified information.
This institutional development is directly relevant to interpreting the Alice & Bob RSA-2048 paper. A quantum processor’s strategic utility depends not only on the existence of physical qubits, but also on the ability to formulate algorithms, compile logical operations into physical instructions, manage classical–quantum coordination, and evaluate the resources required for useful computations. The cryptanalytic contribution of Pappalardo and colleagues demonstrates the importance of these capabilities: architectural choices concerning arithmetic, error-correcting codes, resource factories, and scheduling can materially change the modeled hardware requirements even when the underlying mathematical problem remains unchanged.
The distinction between hardware development and software sovereignty is consequently more than organizational. A state or industrial ecosystem possessing quantum processors but depending entirely on external compilers, firmware, cloud orchestration, calibration software, or classical decoding infrastructure may lack independent control over the resulting computing capability. Conversely, domestic expertise in algorithms and compilation can retain strategic value even before the corresponding physical machine becomes available.
At the same time, the objective of sovereignty introduces a potential tension between technological autonomy and participation in international supply chains. Alice & Bob’s relationships with NVIDIA and Quantum Machines illustrate the commercial advantages of integrating specialized external components; PROQCIMA and ALIQUANTE illustrate the French state’s interest in securing domestic capabilities across the hardware and software stack. These strategies need not be contradictory, but their compatibility depends on the substitutability of suppliers, access to technical interfaces, intellectual-property rights, operational control, and the ability to sustain or modify critical systems without unacceptable external dependencies.
The European dimension: scientific capability is not industrial autonomy
European policy provides a wider setting. The Commission’s 2025 Quantum Europe Strategy, COM(2025) 363, identifies Europe’s research capabilities alongside fragmentation, limited industrial scaling, and critical supply-chain dependencies. Its objectives cover research and innovation, quantum infrastructure, industrial ecosystems, skills, and dual-use applications relevant to security and defense. The Strategy seeks to translate European scientific capabilities into market-ready technologies and a more resilient industrial ecosystem by 2030.
The French approach is an important component of this broader European landscape, but French national sovereignty and European technological sovereignty are not identical concepts. PROQCIMA is structured around French-designed quantum computers and French strategic objectives; the European strategy concerns the technological and industrial capacities of a wider, interconnected ecosystem. National procurement may contribute to European capabilities, but the resulting industrial benefits, intellectual-property arrangements, and operational control cannot automatically be assumed to be distributed across the Union.
For the European economy, the significance of Alice & Bob and its PROQCIMA competitors therefore extends beyond the prospect of individual successful companies. The five approaches create opportunities for European specialization in superconducting devices, semiconductor processes, photonics, atomic manipulation, cryogenics, quantum-control electronics, and fault-tolerant software. Whether this becomes a durable industrial ecosystem depends on the development of shared manufacturing capabilities, specialized suppliers, skilled personnel, and viable commercial relationships between hardware developers and their customers.
The emergence of domestic expertise in quantum compilation is similarly significant. Mathematical algorithms, error-correction codes, decoders, and physical scheduling strategies are not merely academic outputs: they define hardware requirements and influence which industrial competencies become scarce or strategically important. The Alice & Bob resource estimate is thus relevant to industrial sovereignty not because it demonstrates that a European company has built an RSA-breaking quantum computer, but because it shows how European scientific and architectural research can redefine the projected requirements for such a machine.
Yet European technological sovereignty should not be equated with the nationality of a founder or the registered office of a company. Its operational meaning is the capacity to develop, manufacture, deploy, maintain, modify, and govern a critical system despite external dependencies. That requires examining control over intellectual property, specialized fabrication, cryogenic components, electronic controllers, decoder hardware, cloud and HPC integration, software maintenance, export constraints, and governance rights. Foreign investment does not necessarily negate autonomy; European headquarters do not guarantee it.
In this sense, the relevance of Alice & Bob’s 2026 result is twofold. Scientifically, it advances an architecture-dependent estimate of the resources required for fault-tolerant quantum cryptanalysis. Industrially, it offers a concrete example of why control over the full quantum-computing stack matters as much as ownership of the physical processor. PROQCIMA’s competition among five technological approaches, the subsequent acceleration of its targets, and the complementary ALIQUANTE software initiative all demonstrate that France is treating quantum computing as a long-term industrial and strategic capability rather than an isolated laboratory endeavor. Whether these investments ultimately produce an autonomous European computing infrastructure remains an open empirical and industrial question.
Why cat-qubit noise bias changes error-correction overhead
A physically asymmetric error channel
The cat-qubit advantage begins with the choice of physical encoding, not with a more efficient abstraction of Shor’s algorithm. A cat qubit stores logical information in a stabilized manifold of an oscillator that contains approximately distinguishable coherent states |\alpha\rangle and |-\alpha\rangle. A convenient schematic computational basis is
|0\rangle_{\mathrm{cat}}\simeq|\alpha\rangle,
\qquad |1\rangle_{\mathrm{cat}}\simeq|-\alpha\rangle,
\qquad \bar n=|\alpha|^2.
\tag{2}
Their overlap has magnitude |\langle\alpha|-\alpha\rangle|=e^{-2\bar n}; increasing the mean photon number \bar n therefore makes the two states more distinguishable. Engineered two-photon dissipation can stabilize the corresponding manifold. In the standard Lindblad notation, its idealized contribution is
\frac{d\rho}{dt}=\kappa_2\mathcal D[a^2-\alpha^2]\rho,
\qquad \mathcal D[L]\rho=L\rho L^\dagger-\tfrac12\{L^\dagger L,\rho\},
\tag{3}
where \rho is the oscillator density matrix, a the annihilation operator, \kappa_2 the stabilization rate, and \mathcal D the Lindblad dissipator. This is a simplified stabilization model, not a full description of real control circuitry or every unwanted physical process.
The crucial physical distinction is between logical phase and bit flips. Because a|\pm\alpha\rangle=\pm\alpha|\pm\alpha\rangle, single-photon loss acts approximately as a relative-phase operation in the cat computational basis. It produces a frequent phase error rather than routinely interchanging the two computational states. Meanwhile, the probability of an unwanted logical bit flip can decrease approximately exponentially with increasing state separation, although the exact scaling depends on stabilization, control, and device imperfections.
The same protection is not free: photon-loss-related phase errors typically increase approximately linearly with \bar n. At the level of relevant observable decay rates, the characteristic relationship is \Gamma_{\mathrm{phase}}\simeq2\kappa_1\bar n, with \kappa_1 the single-photon loss rate, whereas the idealized bit-flip component can exhibit exponential suppression. A practical quantum computer must therefore choose an operating point that balances the physical phase-error burden against residual bit flips and the errors introduced by gates.
Using the asymmetry in an error-correcting code
A conventional quantum error-correcting code must protect logical information against multiple physical Pauli error mechanisms. If the hardware itself makes one error class sufficiently rare, an outer code can concentrate on correcting the dominant class. The repetition-cat construction exploits this by correcting phase flips while relying on the physical cat encoding to suppress bit flips. A distance-d repetition-code memory occupies d physical cat data qubits and d-1 measurement ancillae, giving 2d-1 physical cat qubits in the relevant layout.
The baseline RSA repetition-only architecture uses d=15 and requires 49,649 physical cat qubits. The LDPC-cat alternative combines denser quantum storage with a repetition-coded operational layer. At selected code distances (d_{\mathrm{rep}},d_{\mathrm{LDPC}})=(13,16), it reduces the physical footprint to 22,593 cat qubits. Dense storage is not free, because the access and measurement of its logical information require extra routing and surgery. Accordingly, the LDPC-cat baseline has a longer single-shot duration of 7.84 hours rather than 6.92 hours, and an expected runtime of 3.14 days rather than 2.67 days for repetition-only coding.
The distinction is a concrete example of why qubit count alone is not enough to judge an architecture. The LDPC layer holds many logical qubits more compactly, but operations must access the encoded data through a structured physical interface. The resulting gain is a space–time trade-off, not a uniform reduction of every resource metric.
The baseline argument remains conditional on the neglected physical bit flips. In both the repetition-cat and LDPC-cat codes used for RSA-2048, a single physical bit flip can act as a logical error. The authors calculate that the LDPC-cat architecture would require a physical bit-flip probability of approximately 1.57\times10^{-16} per physical-qubit correction cycle to keep its cumulative bit-flip failure probability near 10% per shot, corresponding to an idle-state characteristic bit-flip time of approximately 101 years under the conversion used in Appendix C. This is a statistical lifetime parameter, not a claim that a device must literally be tested for a century; however, it exceeds the controlled experimental lifetimes reviewed by the authors by many orders of magnitude.
The authors also explore an additional code layer capable of correcting bit flips. Its roughly 44,850-qubit RSA projection relaxes the required lifetime to the order of one hour, but rests on extrapolated memory simulations and an uncompleted set of encoded computational operations. It must not be treated as an alternative design compiled to the same level of detail as the 22,593-qubit baseline.
The anatomy of the resource estimate: registers, arithmetic, factories, and shots
Where the time goes
The estimated runtime is dominated by millions of repeated arithmetic operations. Appendix C, Table XXVII counts 4,849,026 calls to a Lookup(6,31) operation inside ComputeExponent, each lasting 1,554 correction cycles, and the same number of 31-bit quantum–quantum adders, each lasting 1,302 cycles. Those two operations consume approximately 7.54\times10^9 and 6.31\times10^9 cycles, respectively, close to half of a shot. Additional measurement, reshuffling and residue-reconstruction operations account for most of the remaining time.
Approximately 88% of the modeled duration belongs to adders, comparisons and lookups. The result identifies a clear optimization target: improving the performance of those frequently repeated primitives matters more to runtime than eliminating a small number of final operations. Yet the encoded-memory architecture creates its own penalty. Z-basis measurements and register movements account for almost 10% of the LDPC-cat shot duration, whereas they are less important in the repetition-only design; denser logical storage is slower to access.
The calculation follows a schedule of operation instances, not merely the number of logical Toffoli gates:
T_{\mathrm{shot}}
=\sum_{\mathrm{op}}N_{\mathrm{op}}T_{\mathrm{op}}+T_{\mathrm{other}}
\simeq2.82\times10^{10}\text{ correction cycles}.
\tag{7}
With one microsecond assigned to each correction cycle, a shot lasts approximately 7.84 hours. That conversion is entirely conditional on the stipulated physical clock.
Factories and expected repetitions
Non-Clifford arithmetic operations consume specialized resource states. The baseline design allocates one |CX\,CX\,X\rangle factory and two |i\rangle factories, with a total factory-core footprint of 1,872 physical qubits. The larger factory is modeled as producing a resource state every 21 correction cycles, compared with a 16-cycle LDPC surgery duration and a seven-cycle production time for the |i\rangle states. Consequently, the effective cadence of the arithmetic pipeline is
T_{\mathrm{cad}}=\max(16,21,7)=21\text{ cycles}.
\tag{8}
Three alternating buffers, together occupying 702 physical qubits, prevent repeated stalls while previously consumed resources are being replaced. These factory footprints, output error rates and production times are modeled using the companion FeMoco constructions; they have not been measured as a sustained factory supplying the compiled RSA workload.
Finally, the factoring procedure is probabilistic. For s=8, the authors obtain approximately 9.2 expected algorithmic shots before physical logical failures are considered. The repetition layer, LDPC layer and resource-state factories collectively contribute an estimated 4.16% physical failure probability per shot. Under the model’s independent-retry approximation,
E[R]\simeq\frac{9.2}{1-0.0416}\simeq9.60,
\qquad
T_{\mathrm{expected}}\simeq9.60\times7.84\text{ h}\simeq3.14\text{ days}.
\tag{9}
This is the correct provenance of the headline. The algorithm supplies a probability of obtaining useful measurement data; the proposed physical machine supplies a modeled shot duration and logical-error budget; their combination yields expected total execution time. Neither the shot duration nor the number of shots is an experimental RSA-2048 measurement.
The relevant accounting boundaries also differ. Multiplying the full qubit footprint by the shot cycle count gives about 6.38\times10^{14} allocated qubit-cycles. Table XXIX reports a smaller physical volume of approximately 4.2\times10^{14} qubit-cycles because its counting convention excludes factory cores and does not charge the final Fourier-transform access zone throughout the arithmetic execution. Such distinctions matter whenever a qubit-day or qubit-cycle metric is used to compare architectures.
The physical assumptions that dominate feasibility
One physical model, several coupled constraints
The balanced configuration assumes a stochastic phase-flip probability p_Z=5\times10^{-4} per relevant circuit-level fault location, a one-microsecond correction cycle, a ten-microsecond classical reaction delay, and negligible bit flips. Within the noise model, phase errors are assigned to preparation, measurement, CNOT, and idle locations according to prescribed probabilities, including Z_c, Z_t and Z_cZ_t patterns following CNOT operations. Physical code distances are selected to keep the aggregate modeled failure probability within an acceptable budget.
These parameters cannot safely be optimized one by one without reconsidering the others. Increasing the cat state’s photon number can improve suppression of bit flips while increasing phase-error exposure; lengthening a physical operation can reduce one control error but increase susceptibility to decoherence; strengthening the correction code consumes more qubits and can increase syndrome-extraction time. The fundamental question is whether the assumed combination of physical error rates, operation times and encoded interactions is experimentally accessible.
The preprint contains a useful sensitivity comparison. When p_Z is doubled to 10^{-3}, the selected distances increase from (13,16) to (17,22), qubit count increases to 25,673, and total expected runtime increases to 3.63 days. The lower logical failure probability in the higher-noise configuration is a consequence of choosing stronger codes, not of improved physical hardware.
The doubling produces a 13.6% rise in physical qubits and a 15.6% rise in total runtime. The discrete jumps in code distances explain why the resource impact is not a smooth linear function of the physical error rate. The study varies a parameter within one specified stochastic model; it does not quantify arbitrary coherent or correlated faults.
Bit flips remain the most consequential unverified physical assumption
The more demanding constraint is the near-absence of residual physical bit flips. For a processor containing N_{\mathrm{phys}} physical qubits over T_{\mathrm{shot}} correction cycles, a conservative model in which each independent bit flip fails a shot gives, for small p_{\mathrm{bf}},
P_{\mathrm{bf,shot}}\simeq N_{\mathrm{phys}}T_{\mathrm{shot}}p_{\mathrm{bf}}.
\tag{10}
Here p_{\mathrm{bf}} is the physical bit-flip probability per qubit per correction cycle. Under the conservative independent-fault model, the authors allocate a separate 10% per-shot failure budget to physical bit flips. Using the first-order approximation P_{\mathrm{bf,shot}}\simeq N_{\mathrm{phys}}T_{\mathrm{shot}}p_{\mathrm{bf}}, this gives p_{\mathrm{bf}}\lesssim1.57\times10^{-16}. The corresponding idle-state characteristic bit-flip lifetime is approximately 101 years under the paper’s conversion convention. Solving the exact independent-fault probability instead gives a slightly less restrictive bound, corresponding to approximately 96 years. Neither calculation represents an experimentally demonstrated lifetime. The baseline 3.14-day prediction excludes the resulting residual-bit-flip overhead: including an independent 10% failure contribution would add approximately 11% to expected runtime.
The characteristic lifetime is not a storage duration required of the real machine; it is a measure of the exceedingly low allowable rate of an uncorrected failure mechanism accumulated over a very large space-time workload. The difference from currently published, controlled experimental lifetimes is many orders of magnitude. Moreover, large-cat asymptotic suppression may saturate in physical devices, and the use of entangling gates can introduce additional bit-flip mechanisms. The fitted CNOT-induced model p_X^{CX}=0.5e^{-2\bar n} is extrapolated toward the large photon numbers required by the calculation, rather than experimentally established over the full intended regime.
The authors propose an outer distance-three Elevator-code layer as a mitigation. At a target physical bit-flip probability near 10^{-11} per fault location, they estimate about 44,850 cat qubits for the LDPC-cat architecture and a much shorter characteristic bit-flip lifetime. But the result depends on memory simulations extrapolated to much smaller bit-flip probabilities and on assumptions about protecting factories, routing and logical gates for which complete constructions are absent. It is not a second fully compiled processor.
Classical control and physically distributed operation
A one-microsecond correction cycle involves repeated stabilizer measurement, data acquisition, and processing. The LDPC storage block has 5,045 data qubits and 1,434 logical slots, implying 3,611 independent stabilizer checks in its model. If every check produces one syndrome result per one-microsecond cycle, the LDPC layer alone would generate roughly 3.6\times10^9 syndrome outcomes per second. This is an inferred raw-rate illustration, not an experimentally verified end-to-end classical telemetry requirement. It shows why decoding is a continuous real-time workload rather than an occasional supervisory task.
The ten-microsecond reaction assumption introduces a second performance boundary. Mean decoding speed is not sufficient if delayed decisions stall a dependent logical operation; the entire classical loop—measurement, transfer, decode, and feedback—must meet its actual deadline with high reliability. Alice & Bob’s October 2026 GPU demonstration used synthetic syndrome data and explicitly did not establish real-time decoding.
The physical proposal also assumes a layered layout whose connectivity may require multiple chiplets and quantum links. The resource estimate acknowledges this architecture but excludes a complete partitioning and costing of inter-chip communication. A quantum link can affect fidelity, entanglement distribution, routing and logical scheduling, not merely add a classical network delay. The processor’s full cryogenic, control, packaging, electronics and calibration systems are similarly outside the physical-qubit metric. Their size and industrial cost cannot be recovered by multiplying the reported qubit count by an assumed constant.
Unmodeled correlations create another limitation. Shared control faults, drift, crosstalk, or environmental disturbances may produce error patterns whose probability does not factor according to the independent stochastic model. Those mechanisms are not proven failures of this proposed device; they are reasons why a logical error rate derived from a simplified physical model requires direct empirical validation before being treated as a hardware reliability guarantee.
Comparing quantum architectures without false equivalence
What constitutes a comparable quantum resource?
A physical qubit is not a universal unit of implementation complexity. A bosonic oscillator encoding a cat qubit, a superconducting transmon, a trapped ion, and a neutral atom have different control electronics, error mechanisms, gate speeds, connectivity and scaling constraints. Even if a study reports the same number of physical qubits for the same mathematical problem, the machines may differ substantially in capital cost, cryogenic requirements, manufacturing yield, and operational reliability.
A meaningful comparison must make its accounting boundaries explicit. A resource model may include factories and routing within the processor footprint or may put most logical information in a distinct memory subsystem. It may report time per shot or the time required to achieve a specified expected success probability. It may assume independent error channels, idealized code operations, fast decoders, or a particular physical clock. These differences are not peripheral qualifications: they determine the numerical output of the estimate.
The 2019/2021 Gidney–Ekerå superconducting surface-code calculation used approximately 20 million qubits for an eight-hour RSA-2048 computation. Gidney’s 2025 improvement, using modern arithmetic and more efficient logical storage and resource-state production, reduced the detailed count to 897,864 qubits and roughly 4.96 days, under largely conventional surface-code physical assumptions. The cat-qubit proposal takes advantage of much of that accumulated algorithmic work while changing the physical encoding, error-correction scheme, logical operations and scheduling model. The nearly fortyfold qubit reduction relative to 2025 is thus a comparison of different integrated designs, not proof of the independent advantage of one code or one physical operation.
Quantum LDPC constructions provide another route to reduced physical overhead. Webster and colleagues’ Pinnacle Architecture proposes high-rate codes with dedicated processing and memory regions, and reports RSA-2048 configurations in the order of one hundred thousand physical qubits, with considerable space–time trade-offs. A follow-up analyzes a variant with fixed degree-eight connectivity. These results show how coding and layout alone can improve resource efficiency under a different noise model, but changing connectivity or the number of parallel processing units changes the attainable footprint and runtime.
Neutral-atom architectures expose a different trade-off. Cain and colleagues propose reconfigurable arrays with favorable qubit-count projections, in some RSA-2048 configurations below the cat-qubit footprint. Their characteristic correction cycle, however, is approximately a millisecond, three orders of magnitude slower than the microsecond assumption used in the cat-qubit RSA estimate. The resulting runtime projections are much longer. It would be misleading either to declare the smaller neutral-atom qubit count a universal victory or to dismiss it on time alone without examining the underlying scientific and industrial operating constraints.
The earlier Gouzien–Sangouard 2021 result is a useful boundary case. It describes RSA-2048 factoring with a 13,436-qubit processor in 177 days, but relies on a separate large, multimode quantum memory. Treating its processor count as the complete physical memory requirement would hide the key architectural resource used to obtain that count. As with a computer whose storage is external to its central processing unit, changing the accounting boundary changes the apparent compactness of the machine.
The simplest common proxy for size and time is the product of allocated physical qubits and expected elapsed time:
V_{\mathrm{wall}}=N_{\mathrm{phys}}T_{\mathrm{expected}}.
\tag{11}
With days as the time unit, the balanced cat-qubit configuration requires approximately 22593\times3.14\simeq70,900 physical qubit-days. Gidney’s detailed 2025 estimate gives approximately 897,864\times4.96\simeq4.45\times10^6 physical qubit-days, around 63 times larger. The arithmetic is correct as a comparison of reported model outputs, but a physical qubit-day does not capture the non-qubit costs of operating different hardware, and no common experimental reliability assumptions have been imposed.
Within the cat architecture itself the trade-off is explicit: 21,188 qubits require 8.08 days in the space-efficient design, while ten chips containing a total of 610,530 qubits are projected to reduce elapsed time to 1.25 hours. The latter figure depends on additional parallel scheduling assumptions and does not mean that a single balanced chip could simply run at a clock sixty times faster. The resource frontier is therefore better understood as a set of conditional trade-offs than as a single chronological ranking of increasing technological maturity.
Experimental evidence and the remaining engineering gap
Single-qubit physics and encoded memory are different demonstrations
The relevant experimental literature is richer than a single company’s device announcements. Lescanne and colleagues’ 2020 result established exponential suppression of one physical error mechanism in an oscillator encoding. Réglade and colleagues subsequently demonstrated controlled cat qubits with bit-flip characteristic lifetimes exceeding ten seconds, providing evidence that useful operations need not immediately destroy the engineered asymmetry. Experiments involving squeezed cat states provided another strategy for shaping error protection; these results support the physical mechanism without establishing its behavior during the complete fault-tolerant gate set or at the photon numbers used in the RSA extrapolation.
A 2025 AWS-led experiment by Putterman and colleagues demonstrated a distance-five repetition-cat quantum memory using five bosonic data modes and four transmon ancillae. It reported below-threshold suppression of the corrected phase-error component. That is important evidence for concatenating bosonic protection with active error correction, but it does not establish fault-tolerant universal logic or arbitrary suppression of the residual bit-flip channel. Nor is it an experimental result obtained on Alice & Bob’s integrated processor architecture.
The distinction matters mathematically. Under an error model in which contributions are small, total logical error can be decomposed approximately into phase and bit-flip components,
\epsilon_L(d,\bar n)\approx\epsilon_L^{Z}(d,\bar n)+\epsilon_L^{X}(d,\bar n).
\tag{12}
Increasing repetition-code distance d can reduce the corrected phase-error component \epsilon_L^Z, but it need not reduce the uncorrected bit-flip component \epsilon_L^X. Calling one component below threshold does not establish scalable fault tolerance against the complete physical noise channel.
Alice & Bob’s October 2026 integration evidence
On 20 October 2026, Alice & Bob reported three PROQCIMA Phase 1 demonstrators—two six-qubit chips and one twelve-qubit chip. The reported operations include noise-biased CNOT gates, syndrome-ancilla measurement and reset, repeated cycles of a distance-three repetition code, and a non-Clifford physical gate. The company also reported measured logical errors that were not yet below its relevant error-correction threshold. This is an integrated component milestone, not evidence of a functioning large logical processor.
The reported non-Clifford demonstration does not validate the resource-state factories assumed in the RSA compilation. A single physical non-Clifford gate is distinct from a fault-tolerant production pipeline supplying specific encoded states with the modeled output errors and a 21-cycle cadence. Similarly, demonstrating a small repetition code does not validate the 1,434-slot LDPC storage architecture, the full access layer, or a large-scale decoder.
The 13 October 2026 NVIDIA/Quantum Machines proof of concept showed that synthetic LDPC-cat syndrome data could be processed using an accelerated GPU interface. Alice & Bob explicitly described the experiment as not constituting real-time decoding. The crucial missing evidence is sustained, representative, end-to-end performance: acquisition of genuine syndrome data, transfer, decoding, and feedback within the required schedule while the quantum hardware performs the relevant operations.
An experimental demonstration of FFDLP-512, the paper’s proposed intermediate problem, would provide stronger evidence of an integrated, fault-tolerant computational workload than isolated physical gate tests. Yet this smaller benchmark still assumes stringent noise suppression; Appendix C associates its LDPC-cat configuration with a bit-flip characteristic lifetime of roughly two months under the authors’ 10% per-shot budget. A successful result would be significant for demonstrating many interacting components, but it would not automatically validate a longer and larger RSA-2048 execution.
Scientific progress should consequently be tracked through integrated logical-error scaling, reliable gates, real-time decoding, factory throughput and long-duration operation—not by extrapolating directly from the number of physical devices demonstrated. These requirements can be advanced in parallel, but they eventually must be satisfied simultaneously.
What the estimates imply for cryptography and post-quantum migration
A known mathematical vulnerability and an uncertain implementation timeline
Shor’s algorithm exploits the algebraic structure of integer factorization and finite-group discrete logarithms. A sufficiently capable fault-tolerant quantum computer could threaten the corresponding conventional public-key systems; the mathematical result does not depend on the Alice & Bob hardware proposal. What resource-estimation research changes is the projected physical cost of executing that attack. A smaller estimate is evidence of improved theoretical and engineering constructions, not a probability distribution for the date when an adversary obtains the required machine.
The risks differ according to the cryptographic primitive. RSA factorization can compromise RSA encryption and signing keys. Discrete-logarithm computation can compromise finite-field Diffie–Hellman key establishment, elliptic-curve key exchange, and discrete-logarithm-based signatures such as ECDSA and Schnorr. These attack paths should not be generalized to AES or to conventional cryptographic hashes: Shor’s factorization and discrete-logarithm algorithms do not directly break their underlying mathematical problems.
Why captured traffic creates a present decision problem
A harvest-now, decrypt-later adversary can record encrypted data and the public key-establishment transcript today, even without the ability to decrypt it. A future quantum attack against the recorded ECDHE or finite-field DH values could then recover the session secrets, provided that the necessary information was captured and the post-quantum capability becomes available while the protected data remains sensitive.
Let t_0 denote the transmission time, H the period for which the information must remain confidential, and t_Q the unknown time at which the adversary obtains sufficient quantum capability. Under the stated capture and attack assumptions, the confidentiality exposure exists when
t_Q < t_0+H.
\tag{13}
The relation does not predict t_Q; it explains why information longevity matters independently of the date of first quantum exploitation. Conventional ephemeral key exchange provides forward secrecy against later theft of a long-term authentication key, but that guarantee does not defeat an attack against the recorded ephemeral public values themselves. A future cryptanalytic capability can therefore endanger past traffic even when the original protocol was correctly configured according to classical security guidance.
Authentication produces a different timing problem. If a digital-signature private key can be recovered in the future, an adversary may produce fraudulent signatures or impersonate a trusted issuer. Long-term signed records also require a strategy for preserving validation evidence and trusted timestamps. Merely replacing the signing algorithm does not retroactively establish the validity of every historical signature; the long-term evidence framework must be considered separately.
These mechanisms belong to a broader problem of time-dependent cryptographic trust, examined in detail in When Digital Trust Expires: Quantum Computing and the Collapse of Signature-Based Security. That analysis extends beyond delayed decryption to distinguish delayed forgery of signed artifacts, abuse of long-lived trust anchors, and retroactive software supply-chain compromise. It examines how cryptographic guarantees can expire while verification mechanisms continue to accept historically trusted keys and signatures, and develops corresponding technical and organizational countermeasures. Its appendices formalize the temporal risk through Mosca’s inequality, explicitly incorporating migration time, and apply the framework to a concrete e-commerce and financial-integration architecture. The central implication is that post-quantum migration must address not only the future confidentiality of information, but also the longevity of authentication, authorization, provenance, and evidentiary trust.
Concrete post-quantum mechanisms now exist
NIST’s 2024 standards provide standardized replacements for the main public-key functions: FIPS 203 specifies ML-KEM for establishing shared secrets, FIPS 204 specifies ML-DSA signatures, and FIPS 205 specifies SLH-DSA signatures. These constructions rest on different computational assumptions from RSA and classical discrete logarithms. Their standardization does not prove unconditional security, but it allows migration projects to move beyond speculative algorithm selection and toward tested implementation and protocol integration.
However, finding quantum-resistant algorithms is itself an ongoing cryptanalytic research problem. The withdrawal of HAWK from NIST’s Additional Digital Signatures process in July 2026 illustrates the difficulty. An AI-assisted algebraic key-recovery attack exploiting a Galois involution reduced the effective dimension of the underlying lattice problem, undermining the candidate’s concrete security estimates. The designers subsequently withdrew HAWK rather than attempt a reparameterization that would have compromised its competitiveness. The episode, examined in detail in my earlier article The Withdrawal of HAWK, demonstrates how new mathematical insights can invalidate apparently promising post-quantum constructions before standardization.
A second example comes from China’s Next-Generation Commercial Cryptographic Algorithms (NGCC) initiative. In September 2026, the publication of 119 candidate algorithms was followed by an unusually rapid wave of public cryptanalysis. Markku-Juhani O. Saarinen’s Chinese NGCC Algorithms: The First Week of AI Cryptanalysis documents 191 reported findings affecting 89 candidates during the first week, including 78 classified as critical under the study’s methodology. The analysis includes AI-assisted discovery of weaknesses affecting candidate signatures, key-establishment mechanisms, and other cryptographic constructions.
These developments must be interpreted carefully. HAWK was a withdrawn candidate, not an adopted NIST standard; the NGCC findings concern proposals undergoing initial scrutiny, not evidence that ML-KEM, ML-DSA, or SLH-DSA have been broken. Moreover, the reported attacks are principally classical or AI-assisted cryptanalytic results, not demonstrations of attacks executed on quantum computers. Their relevance is methodological: post-quantum security is an evolving assessment of computational hardness, not an immutable property conferred by the label quantum-resistant. The same research dynamic that progressively reduces the resources required to attack RSA must therefore be considered when evaluating the durability of its proposed replacements.
For TLS 1.3, the IETF’s 2026 hybrid-key-exchange framework and concrete ECDHE–ML-KEM groups provide a means of combining traditional and post-quantum key establishment. RFC 10024 defines X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024. Correctly implemented hybrid key establishment can protect a session secret if the appropriate component remains secure; it does not automatically provide post-quantum authentication when the certificate chain still relies on RSA or ECDSA. Nor does library support imply that each negotiated connection actually uses a hybrid group.
The standards must be implemented in real systems. Key and signature sizes, certificate formats, protocol fragmentation, embedded memory, software update mechanisms, and support from cryptographic modules can become significant. Industrial controllers and network appliances may be constrained by fixed hardware and very long operating lives. Consequently, the required work encompasses inventory, architecture, procurement, supplier contracts, interoperability testing, key and trust-anchor management, and operational change procedures—not simply replacing one library function with another.
The HAWK and NGCC cases add a further requirement: cryptographic migration must preserve the capacity to replace algorithms after their initial adoption. Standardization provides a necessary basis for interoperable deployment, but continued cryptanalysis, implementation security, and cryptographic agility remain essential to maintaining confidence in the replacements over the lifetime of deployed systems.
From the shrinking RSA-2048 resource frontier to institutional cryptographic migration
The significance of the Alice & Bob result extends beyond its contribution to quantum-computing architecture. By estimating that RSA-2048 factorization could be performed using 22,593 physical cat qubits in an expected 3.14 days, Pappalardo and colleagues provide a substantially more compact architectural model for executing a cryptanalytic attack whose mathematical feasibility has been established since Shor’s 1994 algorithm. The result does not demonstrate that such a machine exists, nor does it establish when one will become available. Nevertheless, it changes the quantitative discussion of the resources potentially required to defeat a foundational public-key cryptosystem.
This distinction matters because the security of RSA is not based on a physical impossibility, but on the assumed computational difficulty of integer factorization for available computing technologies. A sufficiently capable quantum computer changes that computational model. Consequently, improvements in quantum resource estimates are relevant to evaluating the future security of deployed cryptographic systems, even when the corresponding hardware capabilities remain experimentally unverified.
The implications can be separated into direct cryptographic consequences and indirect institutional and operational consequences.
The direct consequence concerns RSA-based cryptographic functions. A successful factorization of an RSA-2048 public modulus would allow an adversary to reconstruct the associated private-key information, potentially compromising RSA digital signatures, authentication mechanisms, certificate-based trust relationships, and applications using RSA encryption or key transport. This would affect systems in which RSA remains a security dependency, including software signing, firmware verification, public-key infrastructures, and long-lived digitally signed records.
The broader quantum threat also extends to Diffie–Hellman and elliptic-curve cryptography, although through a different mathematical problem: discrete logarithms. The preprint’s separate estimate for secp256k1 is relevant here, but it has a different compilation status from the more complete RSA-2048 calculation. These distinctions are important when translating the paper into cybersecurity implications. Modern TLS 1.3, for example, does not use RSA for key establishment; its exposure to future quantum attacks against recorded sessions generally concerns elliptic-curve Diffie–Hellman, whereas RSA may still be used for authentication signatures.
The indirect consequence arises because increasingly resource-efficient quantum algorithms alter the technological assumptions under which digital infrastructure is designed, purchased, operated, and maintained. A system whose security depends on RSA or elliptic-curve cryptography may remain in production for decades, while the computational hardness assumption supporting that cryptography is not guaranteed to remain valid over the same period. The result is a mismatch between the lifetime of digital assets and the potentially shorter security lifetime of their cryptographic foundations.
This is the central theme of my earlier article, When Digital Trust Gets a Deadline. That analysis examines how post-quantum transition requirements convert uncertain future cryptographic risks into present architectural, procurement, and governance decisions. In particular, it develops the concept of cryptographic debt: the accumulation of systems, protocols, keys, certificates, and supplier dependencies whose security assumptions may become obsolete before the systems themselves are retired. The Alice & Bob result reinforces the technical rationale for managing this debt, without providing a defensible prediction of when cryptographically relevant quantum computing will become operational.
Institutional action predates the result, but increases its practical relevance
The relevance of the preprint is amplified by the fact that the quantum threat to public-key cryptography is already being addressed through formal standardization, national cybersecurity policies, and institutional migration programs. These initiatives largely predate the October 2026 paper. They should therefore not be described as reactions to the Alice & Bob estimate; rather, the new research provides additional evidence relevant to their underlying risk assumptions.
In August 2024, the US National Institute of Standards and Technology finalized the first three principal post-quantum cryptographic standards: FIPS 203 for ML-KEM key encapsulation, FIPS 204 for ML-DSA digital signatures, and FIPS 205 for SLH-DSA hash-based digital signatures. These standards provide cryptographic alternatives based on mathematical problems for which no comparably effective quantum attacks are currently known. Their significance is practical: the transition no longer depends exclusively on experimental cryptographic proposals, but can proceed using standardized algorithms whose implementations and protocol integrations can be developed and evaluated.
On 27 October 2026, one day before the public posting of the Alice & Bob preprint, NIST finalized IR 8547, Transition to Post-Quantum Cryptography Standards. The report identifies quantum-vulnerable public-key algorithms and describes the transition toward standardized post-quantum key-establishment and digital-signature mechanisms. It also supports the implementation of US federal migration requirements under Executive Order 14412 and OMB Memorandum M-26-15. The near coincidence of publication dates is noteworthy, but it does not imply a causal relationship: NIST’s transition program was already established independently of the new resource estimate.
The US institutional approach became more prescriptive through Executive Order 14412 of 22 June 2026, which directs the migration of designated federal high-value assets and high-impact systems, excluding National Security Systems, to post-quantum key establishment by 31 December 2030 and post-quantum digital signatures by 31 December 2031. The order also establishes responsibilities for migration planning, cryptographic inventory management, federal coordination, and future procurement requirements affecting covered contractors. Its impact is not confined to the mathematical selection of replacement algorithms: it makes cryptographic migration a managed program involving technology ownership, suppliers, and acquisition processes.
The European Union is pursuing a coordinated transition through Commission Recommendation (EU) 2024/1101 and the NIS Cooperation Group roadmap published on 23 June 2025. The roadmap calls for Member States to begin transitioning by the end of 2026 and for critical infrastructure protection to migrate as soon as possible, with an end-2030 target for high-risk cases. These are coordinated policy milestones, not universally enforceable deadlines automatically applicable to every private enterprise. Specific legal obligations depend on national implementation, sectoral regulation, and the requirements applicable to the entity concerned.
Comparable priorities appear in other national programs. The UK’s National Cyber Security Centre establishes staged targets for cryptographic discovery and planning by 2028, priority migration by 2031, and completion by 2035. Australia’s Signals Directorate recommends planning by the end of 2026, beginning priority migrations by 2028, and completing the transition away from conventional quantum-vulnerable asymmetric cryptography by the end of 2030. These dates are not equivalent legal obligations, but they demonstrate that the issue is being managed internationally as a multi-year infrastructure transformation rather than an isolated research concern.
China’s State Cryptography Administration provides a complementary example of institutional engagement. Its January 2026 research program explicitly includes post-quantum cryptographic algorithms, automated identification of vulnerabilities in RSA, ECC, SM2, and SM9 implementations, and dynamically reconfigurable cryptographic modules for critical information infrastructures. Unlike the US and European transition instruments, this program specifies research and engineering objectives rather than a general nationwide migration deadline. It is nevertheless evidence that the ability to discover and replace vulnerable cryptography is becoming an explicit technological development objective across different jurisdictions.
The relationship between the Alice & Bob result and these institutional actions is therefore one of converging evidence and policy, not cause and effect. Advances in quantum algorithms and resource estimation progressively clarify what a capable quantum adversary might require, while governments and standardization bodies are already establishing the cryptographic replacements, transition plans, and industrial capabilities intended to address that future risk.
Direct and indirect consequences for deployed digital infrastructure
The practical implications differ according to the cryptographic function involved and the technological lifetime of the protected system.
For operators of critical infrastructure, the principal challenge is that the migration cannot be reduced to replacing one library or changing a certificate. Cryptographic mechanisms are embedded in equipment identity, secure remote access, VPN gateways, firmware-signing processes, trust anchors, telemetry protection, and supplier-maintained systems. Some components can be updated through software, while others may require replacement hardware, changes to communication protocols, or extensive system requalification.
This distinction is recognized, although not prescribed algorithm by algorithm, within the European NIS2 framework. Article 21(2)(h) of Directive (EU) 2022/2555 includes policies and procedures concerning cryptography and, where appropriate, encryption among the cybersecurity risk-management measures for covered entities. It does not directly mandate ML-KEM or ML-DSA, but the adequacy of cryptographic risk management increasingly depends on whether organizations understand their dependencies and can plan proportionate replacement of vulnerable mechanisms.
For an electricity-generation or storage facility, for example, a quantum-vulnerable VPN or device certificate creates a cryptographic exposure, but does not necessarily create an immediate ability to issue physical commands. That consequence depends on the system’s authorization controls, command arbitration, segmentation, interlocks, and independent protections. A rational transition program must therefore connect cryptographic risks to the actual security architecture and operational consequences of the affected assets.
The relevant engineering objective is cryptographic agility: the ability to replace cryptographic algorithms and protocols within applications, hardware, firmware, and infrastructure while preserving their intended security and operation. NIST’s CSWP 39upd1, updated in June 2026, explicitly addresses this requirement as a property of systems and their architecture, rather than as a simple selection of new algorithms.
The broader significance of the Alice & Bob paper is thus not that it imposes a new compliance deadline or demonstrates the imminent obsolescence of RSA. It is that a mathematically established attack is being translated into progressively more efficient physical designs at the same time that institutions are transforming quantum risk into concrete technology-lifecycle requirements.
The two developments operate on different timescales. Quantum resource estimates continue to evolve as algorithms, codes, and physical architectures improve; enterprise cryptographic migration requires years of inventory, procurement, implementation, validation, and coordinated deployment. Waiting for an operational demonstration of RSA-2048 factorization before beginning the latter would therefore confuse the availability of an attack with the time required to defend against it.
The principal conclusion is that the shrinking modeled resource frontier increases the relevance of an institutional response that was already underway, without proving when the quantum threat will become operational. The appropriate enterprise response is to preserve cryptographic agility, identify long-lived dependencies, and ensure that systems deployed today can remain trustworthy even when their original public-key security assumptions are no longer acceptable.
Why the secp256k1 estimate deserves a separate qualification
The paper’s modeled elliptic-curve discrete-logarithm workload targets secp256k1, a curve used for Bitcoin’s ECDSA and Schnorr signatures. Public exposure of a curve point can enable private-scalar recovery if a sufficiently capable quantum computer exists. The risks differ between Bitcoin output types: older pay-to-public-key arrangements reveal the public key directly; pay-to-public-key-hash outputs generally reveal it during spending; Taproot output keys are present directly in the output’s witness program. Key reuse can create additional exposure for unspent outputs.
The reported 29,588-qubit, approximately one-hour estimate is not an experimental demonstration that Bitcoin transactions can currently be stolen or rewritten within an hour. It is a less comprehensively compiled model based on RSA-derived physical operations. Actual attacks would depend on operational quantum hardware, public-key exposure, transaction timing, network behavior, and the feasibility of adopting new signature rules through Bitcoin’s distributed consensus and wallet ecosystem.
The practical conclusion is broader than any individual cryptocurrency. Resource-estimation improvements remove grounds for complacency about long-term mathematical vulnerabilities, but they do not justify precise forecasts about when an adversary will acquire fault-tolerant quantum computation. Migration can be rational before that date is known because protected data and deployed infrastructure have long lifetimes.
Reproducibility, open questions, and conclusions
What would constitute independent reproduction?
A resource estimate combines claims whose verification standards differ. Correct mathematical reduction is established by proof; reversible arithmetic may be checked by circuit simulation or formal equivalence; a physical mapping must be checked against actual connectivity and resource constraints; a logical failure estimate must survive an appropriate stochastic or physical noise simulation; and a claim about available hardware requires experiment. The 2026 preprint is stronger than an average-overhead estimate because it specifies a substantial part of this chain, but the chain is not closed merely because its final numbers can be recomputed from published tables.
At the arithmetic level, the paper provides a modern factoring derivation, explicit subroutines and Qarton/Qualtran implementations. The exact public version-pinned code and scripts used to generate every RSA-specific figure and table were not independently executed in this review. This is a limitation of the present review, not evidence that such artifacts cannot exist. At the physical level, the analytic layout equations, call counts, and cycle schedule are detailed enough to reconstruct aggregate totals; verifying that every qubit interaction and shared routing resource can be scheduled without unmodeled stalls requires more than checking the sums.
The study’s error estimates depend on specific logical error-rate fits and a model of independent errors. Reproduction of the numerical formulas is possible under their stipulated parameters; experimental validation would require representative data from many physical cat qubits under gates, measurement, feedback and continuous error correction. In particular, a calibrated simulation of memory alone does not validate the failure probability of a universal logical gate set, nor does a fast synthetic-data decoder establish the real-time behavior of a complete control loop.
The updated FeMoco companion publication improves reproducibility. Kroell and colleagues’ Ground-state energy estimation compiled on cat qubits appeared on arXiv on 27 October 2026, correcting the in preparation status given to reference [49] in the RSA manuscript. Its descriptions of lookup, Phaseup and resource-state factories can now be examined in a public technical document. The separate simultaneous-lattice-surgery paper, cited as reference [48], has not been verified here as a complete public technical manuscript or executable artifact. Neither the companion publication nor an accessible abstract would substitute for independent verification of the complete physical schedule.
The decisive research questions
The most important unresolved questions are not whether the logical arithmetic can be optimized further; the preprint itself leaves several opportunities, including a more efficient final exponent-measurement architecture. The harder questions concern physical and architectural consistency. Can the requisite bit-flip suppression survive realistic gates at the intended mean photon number without increasing phase-flip errors beyond the selected correction code’s capability? Can an LDPC block encoding more than a thousand logical slots exhibit the modeled logical error scaling while its access and routing layer performs the necessary operations? Can the factory and decoder deliver a sustained throughput consistent with a one-microsecond correction cycle? And what additional cost arises when the abstract layout is partitioned across physical chiplets with imperfect links?
An especially useful intermediate experiment would combine encoded storage, repeated syndrome extraction, a representative logical arithmetic operation, and real-time classical feedback, then demonstrate that strengthening the code reduces the relevant total logical error probability. This would test multiple interacting assumptions instead of one favorable device metric. The smaller FFDLP-512 workload proposed by the authors could eventually supply a still stronger end-to-end benchmark if implemented with the same intended physical architecture, although its physical noise requirements remain demanding.
A complete reproducibility package would also benefit from machine-readable source versions for the algorithm, architecture, scheduler, factory models and failure calculations. Such material would permit comparative re-compilation under alternative code distances and experimentally measured fault distributions. The ability to change parameters and obtain a new consistent physical plan is more persuasive than a fixed table whose inputs and dependencies cannot be independently inspected.
Research leadership is necessary, but insufficient, for sovereignty
Alice & Bob’s role in European quantum computing illustrates why algorithmic sophistication, hardware physics and industrial capacity cannot be separated. A resource estimator identifies the operations that dominate a future useful quantum computer; a physical device must then realize those operations; a factory and software stack must produce them reproducibly; and a provider must maintain the machine over time. Public European research institutions, the French PROQCIMA programme, the company’s private investors and international industrial partners support different parts of this chain.
The European sovereignty question is consequently not answered by the company’s Paris headquarters or its scientific authorship. It requires evidence concerning manufacturing access, control electronics, intellectual-property governance, software maintainability, classical decoding infrastructure, and the ability to operate the complete system despite external supply-chain constraints. The participation of NVentures and the use of NVIDIA and Quantum Machines technologies show international financial and technological relationships; without ownership agreements or supply-chain analysis, they do not establish either foreign control or European self-sufficiency.
In this sense, the published physical-resource decomposition has industrial value beyond RSA. It makes visible which parts of the stack are likely to consume hardware, which require specialized intellectual property, and which could become bottlenecks for industrial scale-up. European technological autonomy is strengthened by the capability to understand and reproduce a critical computing stack, not simply by locating a future quantum-processing unit within the Union.
Conclusion
Pappalardo and colleagues have supplied a serious physical resource compilation for RSA-2048, replacing broad logical-to-physical multipliers with detailed arrangements of logical storage, arithmetic primitives, routing, factories, measurements, and failure probabilities. The balanced configuration of 22,593 cat qubits over an expected 3.14 days is internally reconstructible from the paper’s published layout and scheduling tables. The reduction relative to earlier resource models is substantial, and it reflects a productive combination of modern algorithms, efficient logical memory and physically biased noise.
The correct evidentiary classification is nevertheless indispensable. The main RSA architecture is compiled at the level of the authors’ selected logical and physical primitives; its qubit count, runtime and failure probabilities are modeled under specified physical assumptions; other targets and configurations are in varying degrees extrapolated; and only selected underlying physical components have been experimentally demonstrated. The company has not demonstrated RSA-2048 factorization on a fault-tolerant quantum processor. A lifetime parameter near a century for uncorrected physical bit flips, sustained microsecond correction cycles, large-scale LDPC error correction and multi-chip operational integration remain unresolved requirements of the baseline model.
The paper should therefore change how the resource frontier is discussed, but not how scientific evidence is classified. It shows that a carefully selected physical encoding and algorithmic implementation can substantially lower the hardware resources predicted for a known quantum attack. It does not establish the date at which an attacker will obtain those resources or the industrial cost of constructing the machine. Competing architectures demonstrate similar opportunities for improvement through coding and scheduling, while facing different hardware constraints. An eventual technological ranking requires empirical operating points rather than incompatible theoretical assumptions.
The cybersecurity implication is likewise conditional but actionable. RSA and conventional finite-field and elliptic-curve public-key systems face a known quantum-algorithmic vulnerability, while the confidentiality lifetime of recorded information and the long replacement cycle of deployed infrastructure give organizations reasons to migrate before the quantum arrival date is known. The availability of NIST post-quantum standards and 2026 hybrid TLS specifications makes controlled transition possible; the uncertain hardware timetable does not justify indefinite delay or indiscriminate emergency replacement.
Finally, the result illustrates a broader form of technological progress. Quantum computation is becoming more explicitly a question of hardware–algorithm co-design: researchers can reduce projected computational requirements by reorganizing algorithms, codes, gates, and layouts, even when physical devices remain far from realizing the projected computation. The resulting intellectual capability has strategic value for Europe, provided that it is matched by reproducibility, manufacturing capacity, and operational control. The 22,593-qubit figure is best understood as a major advance in the modeled architecture of quantum computing, not as an accomplished cryptanalytic attack.
