How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits

TL;DR

This paper proposes a quantum computing approach that significantly reduces the resources needed to factor large RSA integers, making quantum attacks more feasible within practical timeframes.

Contribution

It introduces a novel quantum factoring method that combines multiple techniques, drastically lowering the required qubits and time compared to previous estimates.

Findings

Spacetime volume for factoring 2048-bit RSA is a hundred times less than earlier estimates.

Uses approximately 3n + 0.002n log n logical qubits for n-bit integers.

Requires 0.3n^3 + 0.0005n^3 log n Toffolis and 500n^2 + n^2 log n measurement depth.

Abstract

We significantly reduce the cost of factoring integers and computing discrete logarithms in finite fields on a quantum computer by combining techniques from Shor 1994, Griffiths-Niu 1996, Zalka 2006, Fowler 2012, Eker{\aa}-H{\aa}stad 2017, Eker{\aa} 2017, Eker{\aa} 2018, Gidney-Fowler 2019, Gidney 2019. We estimate the approximate cost of our construction using plausible physical assumptions for large-scale superconducting qubit platforms: a planar grid of qubits with nearest-neighbor connectivity, a characteristic physical gate error rate of $10^{-3}$, a surface code cycle time of 1 microsecond, and a reaction time of 10 microseconds. We account for factors that are normally ignored such as noise, the need to make repeated attempts, and the spacetime layout of the computation. When factoring 2048 bit RSA integers, our construction's spacetime volume is a hundredfold less than comparable estimates from earlier works (Van Meter et al. 2009, Jones et al. 2010, Fowler et al. 2012, Gheorghiu et al. 2019). In the abstract circuit model (which ignores overheads from distillation, routing, and error correction) our construction uses $3 n + 0.002 n \lg n$ logical qubits, $0.3 n^3 + 0.0005 n^3 \lg n$ Toffolis, and $500 n^2 + n^2 \lg n$ measurement depth to factor $n$-bit RSA integers. We quantify the cryptographic implications of our work, both for RSA and for schemes based on the DLP in finite fields.