The number of qubits needed to break RSA-2048 is the size of quantum computer that could factor a 2048-bit RSA modulus with Shor’s algorithm. The best published estimate today, from Craig Gidney in 2025, is fewer than one million noisy physical qubits running for under a week. No such machine exists yet, but this figure is twenty times lower than the 2021 estimate.
For organizations running operational technology (OT) and critical infrastructure, this number shapes how urgently the encrypted links between substations, plants, control rooms, cloud environments and remote engineers need to change. This article explains where the estimates come from, why they keep falling, and what the figures mean for planning.
How many qubits does it take to break RSA-2048 today?
The current reference point is Gidney’s May 2025 paper (arXiv 2505.15917), which puts RSA-2048 within reach of a fault-tolerant machine with fewer than one million noisy qubits. In that paper, Gidney reduced the expected number of qubits needed to break RSA2048 from 20 million to 1 million, and according to the OECD, such a machine with effective error correction, could break RSA-2048 encryption in less than a week (Gidney, 2025).
The earlier benchmark was the Gidney and Ekerå 2021 RSA-2048 resource estimate, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits”, published in Quantum 5, 433 (2021). The 2025 result trades speed for size: the machine is twenty times smaller, but the run takes days instead of hours.
| Estimate | Target | Qubits | Runtime or gate cost |
|---|---|---|---|
| Gidney and Ekerå (2021) | RSA-2048 | 20 million noisy physical qubits | About 8 hours |
| Gidney (2025), arXiv 2505.15917 | RSA-2048 | Fewer than 1 million noisy physical qubits | Less than a week |
| Roetteler et al. (2017) | 256-bit elliptic curve (P-256) | 2,330 logical qubits | Over 1011 Toffoli gates |
| Häner et al. (2020) | 256-bit elliptic curve | 2,124 logical qubits | Lower T-count than 2017 |
| Babbush et al. (2026) | 256-bit elliptic curve | 1,200 to 1,450 logical qubits | 90 to 70 million Toffoli gates |
Physical qubits versus logical qubits
The two kinds of figure in the table are not interchangeable. Logical qubits are high-fidelity and long-lived. Physical qubits are inherently noisy and short-lived due to the difficulty of isolating them from their external environment. Most quantum algorithms will require quantum error correction to construct individual logical qubits from groups of physical qubits. A headline qubit count from a hardware announcement is therefore not comparable to these estimates unless error rates and connectivity also match the assumptions in the papers.
Those assumptions are specific. The 2021 estimate assumed a planar grid of qubits with nearest-neighbor connectivity, a characteristic physical gate error rate of 10^-3, a surface code cycle time of 1 microsecond, and a reaction time of 10 microseconds.
Why do estimates for breaking RSA keep going down?
Estimates fall because researchers keep finding better arithmetic circuits, better error correction and better ways to fit the work into space and time, while the target, a 2048-bit modulus, stays fixed. Each improvement compounds the ones before it.
The 2021 work was itself a combination of more than a dozen earlier techniques, and its authors reported that their construction’s spacetime volume is a hundredfold less than comparable estimates from earlier works. The 2025 paper followed the same pattern: Gidney did this by combining and streamlining results from [CFS24], [Gid+25], and [GSJ24].
Gidney is open about the limits: “Without changing the physical assumptions made by this paper, I see no way reduce the qubit count by another order of magnitude.” But he also notes that there’s a saying in cryptography: “attacks always get better”. Over the past decade, that has held true for quantum factoring. Since then, research has explored different hardware assumptions, for example a 2026 preprint titled Factoring 2048 bit RSA integers with a half-million-qubit modular atomic processor. The practical lesson for planners is that any qubit figure is a snapshot, not a floor.
Is elliptic curve cryptography easier for a quantum computer to break than RSA?
Yes, by the logical qubit measure. Solving the elliptic curve discrete logarithm problem (ECDLP) on P-256 needs fewer logical qubits than factoring RSA-2048, even though both give similar classical security.
The 2017 Roetteler et al. analysis compared the two directly, and its logical-level comparison indicated that the amount of qubits required to attack elliptic curves is fewer than that required to attack RSA for current settings at comparable classical security levels, implying that elliptic curve encryption is really an easier target than RSA. For ECDLP on P-256, that work estimated that Shor’s algorithm needs 2330 logical qubits to attack a 256-bit elliptic curve, and a 2020 follow-up was able to reduce the number of qubits from 2338 to 2124, improve the T-count by a factor of 119 and the T-depth by a factor of 54.
The 2026 work by Babbush and colleagues lowered this again: at n=256 bits, the circuits use either 1200 logical qubits and 90 million Toffoli gates or 1450 logical qubits and 70 million Toffoli gates. This matters for OT because many site-to-site tunnels, remote access sessions and device certificates use ECDH and ECDSA rather than RSA. Moving from RSA to elliptic curves gives no protection against a quantum computer.
What is a cryptographically relevant quantum computer?
A cryptographically relevant quantum computer (CRQC) is a fault-tolerant quantum computer large and reliable enough to run Shor’s algorithm against keys in real use, such as RSA-2048 or P-256. It is defined by what it can do, not by a fixed qubit count.
NIST describes how experts have begun referring to such a mature device as a “cryptographically relevant” quantum computer. Instead of billions of years, it’s possible a quantum computer could solve this puzzle in days or even hours. The term also appears in US policy. National Security Memorandum 10 (NSM-10), quoted in NIST IR 8547, warns that any digital system that uses existing public standards for public-key cryptography could be vulnerable to an attack by a Cryptographically Relevant Quantum Computer (CRQC).
Shor’s algorithm threatens only public-key schemes. The existing algorithm standards for symmetric cryptography are less vulnerable to attacks by quantum computers. NIST does not expect to need to transition away from these standards as part of the PQC migration. The weak point in a VPN or encrypted tunnel is the key exchange, not the bulk cipher.
When is Q-Day expected to happen?
No one can give a reliable date for Q-Day, the day a CRQC breaks deployed public-key cryptography. NIST states that researchers need to surmount many technical challenges before this can happen. Experts’ estimates range from a few years to a few decades.
Because the date is uncertain, regulators work from migration deadlines instead of predictions. NSM-10 sets the US goal of mitigating as much of the quantum risk as is feasible by 2035. NIST IR 8547 turns that into a timeline: 112-bit security strength deprecated after 2030, disallowed after 2035; 128-bit and higher security strength disallowed after 2035. NIST adds that it will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems transitioning much earlier.
Gidney himself backs this timeline and explains why: “Not because I expect sufficiently large quantum computers to exist by 2030, but because I prefer security to not be contingent on progress being slow.”
Should critical infrastructure operators plan for Q-Day before 2030?
Yes. For OT and critical infrastructure, the planning deadline is set by how long your data must stay confidential and how long migrations take, not by Q-Day itself. Both point to starting well before 2030.
Why the deadline arrives early for OT
Mosca’s rule frames this: if x + y > z, then worry, where x is the time of maintaining data security, y the time for PQC standardization and adoption, and z the time for a quantum computer to be developed. In OT, both x and y are long. Network diagrams, protection relay settings, SCADA engineering files and maintenance credentials sent between sites can stay sensitive for as long as the assets run, often decades. Migration is also slow: NIST notes that integrating a new algorithm can take 10 to 20 years, partly because companies have to respond to the changes by building the algorithms into products.
The other reason is recorded traffic. Adversaries could simply wait for the time when a big enough quantum computer is available, and then use it to break the encryption and gain access to the data. If the time until a quantum computer is shorter than the time desired to keep the data secret, there is a threat already. Inter-site links over the public internet are the easiest traffic to record.
What to prioritise on site, cloud and remote links
- Map key exchanges, not just tunnels. For each link (site to site, edge to cloud, remote engineer access), record which key agreement is used. RSA, ECDH and finite-field Diffie-Hellman are all exposed to Shor’s algorithm.
- Rank links by data lifetime. A telemetry stream that loses value in minutes is a lower priority than a link carrying engineering backups or identity material.
- Prefer hybrid key agreement. Combining a classical exchange with a post-quantum one such as ML-KEM (FIPS 203) keeps protection in place if either part turns out to be weak. NIST IR 8547’s 2035 disallowance was not intended to apply to hybrid modes that incorporate an approved PQC algorithm alongside a quantum-vulnerable algorithm.
- Demand crypto agility. Given how fast estimates move, assume the algorithm will need to change during the equipment’s service life.
- Avoid touching fragile endpoints. PLCs and legacy HMIs often cannot take new software. Protecting the network path at Layer 3 avoids that dependency.
As one example of that last approach, Quantum Network’s QPN gateway sits at each end of an inter-site connection and encrypts at Layer 3, so no software is installed on the equipment behind it. Its key agreement combines a classical part and ML-KEM into one session key, and both handshakes renew every two minutes.
Where Quantum Network fits
Quantum Network is a quantum-safe encryption gateway that protects the connections between your own locations, without replacing the network equipment you already run.