Qubit Count Is the Wrong Metric

Often, headlines about quantum computing are focused on qubit count. Shor's algorithm requires a certain number of qubits to break RSA (although this number is regularly shrinking). Announcements of an N-qubit quantum computer may make Q-Day appear closer or further away than the reality.

The crucial distinction is the difference between physical and logical qubits. Raw physical qubits are noisy and not the important number. Logical qubits matter more, but they're not the whole story either.

Physical vs. Logical Qubits

Qubits come in two main flavors: physical and logical. A physical qubit is something like a trapped ion, where quantum properties can be stored and measured from its physical state. Physical qubits are often noisy and have a limited window of coherence.

A logical qubit encodes one qubit's information across multiple physical qubits, enabling error detection and correction. Error correction takes advantage of this many to one ratio to decrease noise and create a trustworthy qubit. For running RSA, hundreds or thousands of physical qubits are needed per logical qubit (depending on error rate and design).

Announcements of an N-qubit quantum computer typically focus on the physical qubit count. However, Shor's and other quantum algorithms require a certain number of logical qubits. The exact number of physical and logical qubits required depends on runtime and has shrunk significantly over time due to improvements in quantum algorithms and error correction schemes.

Implementations can also use fewer qubits while accepting longer runtimes. For example, a 2019 estimate required 20 million noisy physical qubits and 8 hours to break RSA-2048, while a 2025 study required less than 1 million noisy physical qubits and under a week.

What Defines Cryptographic Relevance?

Quantum computers are complicated and reliant on classical computers as well. The key factors that help determine whether a new quantum computer actually moves closer to breaking RSA include:

• Error Rate vs. Threshold: Adding qubits with an error rate below the error threshold suppresses logical errors exponentially, which is good for Shor's algorithm. However, adding physical qubits with too much noise (i.e. above the threshold) actually makes things worse.
• Break-Even and Scaling: Logical qubits need to be able to outlast the best physical qubit that supports them. Additionally, error rates need to fall as code grows.
• Runtime and Error Rates: To break RSA-2048, Gidney's 2025 design for Shor's algorithm needs about 1,400 logical qubits running for days at a time. Throughout this time, logical errors need to stay low to reach the right answer.
• Classical Computing Speed: Classical computers are used for decoding and error correction for quantum computers. Cycle time and real-time decoding are essential to make sure that the classical computer doesn't become a bottleneck.

How to Evaluate a Quantum Computing Announcement

When reading an announcement of a new quantum computer, some key questions to ask include:

• Are qubits physical or logical?
• Are logical qubits error detected or error-corrected with demonstrated scaling?
• What is the logical error rate over how many operations?
• What task was used to evaluate error rates and what were the assumptions?

These questions can help to determine whether a new announcement actually represents a step forward toward breaking RSA-2048. However, this isn't the whole picture. Improvements in error correction, algorithms, and classical hardware (for decoding and error correction) can reduce the number of physical (and sometimes logical) qubits needed by Shor's algorithm or the algorithm's runtime.

Q-Day estimates can move closer even without a new and improved quantum computer. This means that organizations shouldn't use quantum computer headlines as a reason to delay migration.

Educational content, not legal, financial, investment, or professional security advice. Terms