Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits

TL;DR

This paper demonstrates that with advances in quantum error correction and circuit design, Shor's algorithm can be run on as few as 10,000 atomic qubits, making cryptographically relevant quantum computing more feasible.

Contribution

It shows that optimized quantum error correction and circuit design enable execution of Shor's algorithm at practical scales with significantly fewer qubits than previously estimated.

Findings

Shor's algorithm can be executed with ~10,000 atomic qubits.

Runtime for discrete logarithms on P-256 could be a few days with 26,000 qubits.

Factoring RSA-2048 could take one to two orders of magnitude longer.

Abstract

Quantum computers have the potential to perform computational tasks beyond the reach of classical machines. A prominent example is Shor's algorithm for integer factorization and discrete logarithms, which is of both fundamental importance and practical relevance to cryptography. However, due to the high overhead of quantum error correction, optimized resource estimates for cryptographically relevant instances of Shor's algorithm require millions of physical qubits. Here, by leveraging advances in high-rate quantum error-correcting codes, efficient logical instruction sets, and circuit design, we show that Shor's algorithm can be executed at cryptographically relevant scales with as few as 10,000 reconfigurable atomic qubits. Increasing the number of physical qubits improves time efficiency by enabling greater parallelism; under plausible assumptions, the runtime for discrete logarithms on the P-256 elliptic curve could be just a few days for a system with 26,000 physical qubits, while the runtime for factoring RSA-2048 integers is one to two orders of magnitude longer. Recent neutral-atom experiments have demonstrated universal fault-tolerant operations below the error-correction threshold, computation on arrays of hundreds of qubits, and trapping arrays with more than 6,000 highly coherent qubits. Although substantial engineering challenges remain, our theoretical analysis indicates that an appropriately designed neutral-atom architecture could support quantum computation at cryptographically relevant scales. More broadly, these results highlight the capability of neutral atoms for fault-tolerant quantum computing with wide-ranging scientific and technological applications.