How to factor 2048 bit RSA integers with less than a million noisy qubits
Craig Gidney · 2025 · arXiv
| 编号 QA031 | 主题 加法与减法 | 链接 arXiv:2505.15917 |
摘要
摘要保留原文（英文）
摘要取自 arXiv / 出版方元数据，未作翻译，以保证与原文一致。
Planning the transition to quantum-safe cryptosystems requires understanding the cost of quantum attacks on vulnerable cryptosystems. In Gidney+Ekerå 2019, I co-published an estimate stating that 2048 bit RSA integers could be factored in eight hours by a quantum computer with 20 million noisy qubits. In this paper, I substantially reduce the number of qubits required. I estimate that a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits. I make the same assumptions as in 2019: a square grid of qubits with nearest neighbor connections, a uniform gate error rate of , a surface code cycle time of 1 microsecond, and a control system reaction time of microseconds.
The qubit count reduction comes mainly from using approximate residue arithmetic (Chevignard+Fouque+Schrottenloher 2024), from storing idle logical qubits with yoked surface codes (Gidney+Newman+Brooks+Jones 2023), and from allocating less space to magic state distillation by using magic state cultivation (Gidney+Shutty+Jones 2024). The longer runtime is mainly due to performing more Toffoli gates and using fewer magic state factories compared to Gidney+Ekerå 2019. That said, I reduce the Toffoli count by over 100x compared to Chevignard+Fouque+Schrottenloher 2024.
本站词条在引用该文献时，会以 wikilink（sources/QA031）链接到本页；右侧「反向链接」面板自动列出所有引用它的词条。