Quantum code-breaking estimates collapsed, but the calendar did not, review warns

A systematic review published in Frontiers in Computer Science traces how the physical-qubit estimate for factoring RSA-2048, the workhorse algorithm protecting much of today’s secure communication, fell from about one billion in 2012 to 20 million in 2019, roughly 900,000 in 2025, and between about 11,000 and 471,000 in 2026 depending on which operating point a study selects. Estimates for breaking 256-bit elliptic-curve cryptography, the other dominant public-key target, followed a comparable path. The review’s author, Simon Baradziej of UiT The Arctic University of Norway, assembled 84 sources from preprint servers, standards repositories and peer-reviewed venues, and charted 13 core studies in a structured extraction matrix recording the assumption set behind every physical-qubit figure.

The headline numbers, however, conceal a more complicated story, and the review’s central contribution is to take them apart. The reductions did not come from new hardware suddenly approaching the required scale. They came from better algorithms for the arithmetic that Shor’s procedure requires, from improved methods of quantum error correction that lower the physical overhead per unit of logical computation, from a shift to higher-rate code families, and from architectural assumptions that current devices do not yet satisfy. When the assumptions behind an estimate change, the stated requirement changes even though no new machine has been built. Conflating those layers, the review argues, produces a misleading sense of accelerating doom.

The decomposition matters because the reductions are not equally robust. The fall from about one billion to 20 million physical qubits between 2012 and 2019 rested on arithmetic innovation and better magic-state factories, with the surface code and planar nearest-neighbor connectivity held constant throughout. The fall from 20 million to about 900,000 between 2019 and 2025 is the strongest single quantitative finding in the corpus: Gidney’s 2025 estimate explicitly holds the same hardware assumptions as the 2019 work, making it the one clean like-for-like comparison available. Roughly three orders of magnitude of the total reduction therefore rest on algorithmic and error-correction advances that hold under the connectivity current hardware provides.

The final step, from about 900,000 down to figures between 11,000 and 471,000 in 2026, is different in kind. The 2026 estimates replaced the surface code with high-rate quantum low-density parity-check codes, which achieve their efficiency by defining stabilizer checks over qubits that are not physically adjacent. That requires non-local connectivity, which current superconducting hardware does not provide. Neutral-atom platforms can supply the required connectivity by physically transporting atoms, but at a stabilizer cycle time of one millisecond, three orders of magnitude slower than the microsecond cycles assumed by the superconducting estimates. A reader comparing 11,033 neutral-atom qubits against 897,864 superconducting qubits without adjusting for that thousandfold difference in clock speed, the review warns, is not comparing like with like.

The assumption-dependence runs deep. Webster and colleagues’ 2026 architecture requires about 98,000 physical qubits for a one-month runtime at a physical error rate of 10 to the minus 3, but about 471,000 for a one-day runtime, and 53,000 to 149,000 at the better error rate of 10 to the minus 4. A single source can span a factor of nine across its own reported grid. Cain and colleagues’ neutral-atom estimates span 11,033 to about 102,000 qubits across configurations. Drawing a trend line through single points selected from such curves, the review concludes, is a statement about the selection rule as much as about the literature.

There is also a credibility problem. The review scores each source on peer-review status, transparency, reproducibility and independence, and the estimates driving the largest reductions are the least settled. Fowler’s 2012 estimate and Gidney and Ekerå’s 2021 estimate each score 11 of 12, both refereed and reproduced. The 2026 preprints score 5 or 6, none independently reproduced, and every physically costed estimate published after 2023 scores zero on independence. When the synthesis is restricted to peer-reviewed sources alone, the direction of travel survives but the magnitude weakens materially: every figure below 20 million physical qubits for RSA-2048 currently rests on unreviewed work. The apparent convergence between two 2026 preprints reaching similar orders of magnitude is weaker than mutual corroboration, since both rest on non-local connectivity and descend from a common recent literature.

What does this mean for the timing of the threat? Here the review makes its sharpest analytical point: a reduction in required qubits compresses a resource threshold, not a calendar. Mosca’s inequality, the standard risk-timing framework, compares three quantities: how long data must stay confidential, how long migration to quantum-resistant cryptography takes, and how long until a cryptographically relevant quantum computer exists. If the first two exceed the third, data encrypted today will be exposed before protection is in place. The resource estimates inform the third term, but the mapping from a machine specification to the date such a machine is built depends on fabrication yield, achieved error rates at scale, connectivity, decoder throughput, control electronics and sustained-runtime engineering, none of which a resource estimate models. A lower threshold cannot make a capable machine arrive later, but the size of the shift depends on which constraint binds, and the corpus does not identify which one does.

The gap between estimates and demonstrated hardware remains large. The most advanced public demonstration of error correction, on Google’s Willow processor, showed logical error rates suppressed by a factor of 2.14 when the code distance increased by two, on a 101-qubit distance-7 code. Current devices operate with relevant error rates at the order of only 100 to 1,000 qubits. The largest coherent neutral-atom array traps over 6,100 atoms, which sits within an order of magnitude of the lowest neutral-atom estimate of about 9,700 qubits for breaking P-256, a juxtaposition frequently reported as alarming. But the estimate requires those qubits to sustain a fault-tolerant computation with high-rate codes, arbitrary connectivity through atom transport, and days of operation without an uncorrected logical failure. The demonstrated array is a coherent trapping result, not a fault-tolerant computation, and no published demonstration is close to closing that gap.

The review’s scenario analysis, run across threat horizons of five to twenty-five years and migration times of three to fifteen years, yields a finding that reverses the natural reading of the headline numbers. Data with very long confidentiality obligations, such as classified material with a 25-year declassification horizon or genomic data, falls inside the exposure region under the harvest-now-decrypt-later threat model in every cell of the grid, including the most conservative. That case was settled by inspection before the recent estimates appeared, and is not strengthened much by them. Short-lived data such as session keys stays outside the exposure region under every plausible parameter choice. The evidence does real work only for the intermediate band, obligations between roughly five and fifteen years, where a shift in the plausible threat horizon moves data across the boundary. That unglamorous middle, the review notes, is in most organizations a large share of the data.

The final stratum is a recommendation, and the review is careful to label it as risk management rather than as a consequence of the evidence. Given the asymmetry between the bounded cost of migrating earlier than necessary and the unrecoverable cost of migrating later, and given that the harvest-now-decrypt-later clock starts when ciphertext is captured, the reasonable posture is to sequence migration by confidentiality lifetime and capture exposure rather than by system criticality, and to treat elliptic-curve-protected long-lived data as no less urgent than RSA-protected data of the same vintage. Under shared hardware assumptions, the elliptic-curve attack requires roughly 72 to 93 times fewer Toffoli gates and about half the physical qubits of the RSA attack, even though elliptic curves are classically the stronger target. Standardized post-quantum algorithms finalized by NIST in 2024 removed the principal external obstacle to acting. The review’s central caution stands regardless: no single qubit figure should be treated as settled. The trajectory, not any point on it, is the finding, and the interval of plausible outcomes for the threat horizon is wider than the pre-2025 literature assumed.

Subject of Research: Systematic review of quantum resource estimates for breaking public-key cryptography and their implications for Mosca's risk-timing inequality

Article Title: Mosca’s inequality revisited: a systematic review of quantum risk-timing models after the 2025–2026 reductions in quantum resource estimates

Article References: Baradziej, S. (2026). Mosca’s inequality revisited: a systematic review of quantum risk-timing models after the 2025–2026 reductions in quantum resource estimates. Frontiers in Computer Science, 8, 1914634. https://doi.org/10.3389/fcomp.2026.1914634

Image Credits: AI Generated

DOI: 10.3389/fcomp.2026.1914634

Keywords: quantum computing, post-quantum cryptography, RSA-2048, elliptic-curve cryptography, Mosca's inequality, quantum error correction, harvest now decrypt later, resource estimation, qLDPC codes, Shor's algorithm, cryptographic migration, systematic review