Shor’s algorithm for factoring RSA-2048 (and related problems like elliptic-curve discrete logs) has seen dramatic reductions in estimated resources over the past 18 months. Theoretically breaking RSA-2048 would still require multi-day runtimes and billions of non-Clifford logical operations (primarily Toffoli gates) under realistic error rates (~0.1%) and cycle times. This remains far beyond near-term machines. Eventual runs will likely take days or many trillions of operations when full physical overhead is counted.

Key Recent Theoretical Papers (2025–2026)

Here are the most important open-access results:

Craig Gidney (Google Quantum AI), May 2025

[How to factor 2048 bit RSA integers with less than a million noisy qubits](https://arxiv.org/abs/2505.15917)
Combines approximate residue arithmetic (from Chevignard–Fouque–Schrottenloher), yoked surface codes, and magic-state cultivation.

Result is less than 1 million noisy physical qubits, ~1,400–1,600 logical qubits, ~6.5 billion Toffoli gates, expected runtime under one week (at 1 µs surface-code cycle time, 0.1% physical error). This is a ~20× reduction in physical qubits versus Gidney–Ekerå 2019 (20 million qubits / 8 hours).

Paul Webster et al. (Iceberg Quantum), February 2026
[The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100,000 physical qubits using quantum LDPC codes](https://arxiv.org/abs/2602.11457)
Uses high-rate quantum LDPC codes for much lower spacetime overhead.

Result Fewer than 100,000 physical qubits (e.g., ~94k at 0.1% error), runtime on the order of **one month** (1 µs cycle) or tunable with more qubits or slower cycles. Further drops to ~22k qubits at 0.01% error.

March 2026 neutral-atom focused paper
[Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits](https://arxiv.org/html/2603.28627v1) (arXiv:2603.28627)
High-rate lifted-product QLDPC codes + reconfigurable neutral atoms with specialized zones (memory, processing, surgery, magic states).

Results
– RSA-2048: 11k–14k physical qubits (space-efficient) with runtimes of hundreds of days (1 ms cycle), or ~100k qubits for ~97 days in parallelized versions.
– ECC-256 (P-256): as low as ~10k–26k physical qubits and ~10 days in optimized cases.
Especially relevant for neutral-atom platforms.

Supporting earlier work
Gidney–Ekerå 2019/2021 remains the classic baseline ([arXiv:1905.09749](https://arxiv.org/abs/1905.09749)). Chevignard et al. (CRYPTO 2025) supplied the key approximate arithmetic that Gidney optimized. Google also maintains a public tracker of historical estimates: [Tracking the Cost of Quantum Factoring](https://blog.google/security/tracking-cost-of-quantum-factori/).

What This Means for QuEra’s Megaquop and Gigaquop Roadmap (and Competitors)

QuEra’s neutral-atom roadmap is among the clearest paths to early fault-tolerant quantum computing:

– Megaquop era (Libra system, 2028 on Amazon Braket) ~1 million reliable logical operations, hundreds of logical qubits (target over 256), logical error rate ~10⁻⁶. First practical early-FT system for commercial and research use beyond classical reach.

Gigaquop era (2028–2029 kif QueRa hits roadmao) ~1 billion reliable logical operations, with over 1,000 logical qubits, logical error ~10⁻⁹,using over 20,000 physical qubits. A thousand-fold jump aimed at broader quantum advantage.

Comparison to RSA-2048 requirements
– Megaquop machines (~10⁶ logical ops) are still orders of magnitude short. Even the best current Shor circuits need ~6.5 billion Toffolis plus overheads, multiple shots, and continuous multi-day operation.
– Gigaquop machines (~10⁹ ops) reach the correct order of magnitude for the non-Clifford gate count. With further algorithmic improvements, high parallelism (a natural strength of reconfigurable neutral atoms), and competitive cycle times, they become interesting for optimized or smaller instances. Full end-to-end RSA-2048 still typically needs more logical qubits, sustained low error over days, and enough volume for shots + error-correction overhead.
– Neutral-atom systems (QuEra, Infleqtion, Atom Computing) are particularly well-matched to the newest 10k-qubit-scale QLDPC architectures thanks to long-range connectivity and atom rearrangement.

Other Quantum computer companies
– IBM modular qLDPC path (Kookaburra 2026 → Starling ~200 logical qubits / 100 million gates by ~2029).
– IonQ aggressive scaling targets (multi-thousand logical qubits later in the decade).
– Quantinuum, PsiQuantum, Infleqtion and others have parallel paths with different technology trade-offs.

None of the public roadmaps claim a full cryptographically relevant quantum computer (CRQC) capable of routine RSA-2048 breaks by 2028–29, but the algorithmic bar has dropped into the range that gigaquop-class hardware could approach if engineering keeps pace.

Shors Algroithm to Break RSA Will Still Be Beyond Gigaop Quantum Computers
Resource estimates for Shor’s algorithm have fallen rapidly—first 20× in physical qubits (Gidney 2025), then another ~10× with high-rate LDPC codes (Pinnacle 2026)—while runtimes remain in the days-to-weeks range and non-Clifford operations stay in the billions. Megaquop systems will be important early fault-tolerant milestones but not RSA breakers. Gigaquop systems start to look relevant for the problem, especially on platforms like QuEra’s.

Post-quantum cryptography migration remains urgent because “store now, decrypt later” risk continues to accumulate regardless of the exact timeline.