How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits

Abstract

We significantly reduce the cost of factoring integers and computing discrete logarithms in finite fields on a quantum computer by combining techniques from Shor 1994, Griffiths-Niu 1996, Zalka 2006, Fowler 2012, Ekerå-Håstad 2017, Ekerå 2017, Ekerå 2018, Gidney-Fowler 2019, Gidney 2019. We estimate the approximate cost of our construction using plausible physical assumptions for large-scale superconducting qubit platforms: a planar grid of qubits with nearest-neighbor connectivity, a characteristic physical gate error rate of 10−3, a surface code cycle time of 1 microsecond, and a reaction time of 10 microseconds. We account for factors that are normally ignored such as noise, the need to make repeated attempts, and the spacetime layout of the computation. When factoring 2048 bit RSA integers, our construction's spacetime volume is a hundredfold less than comparable estimates from earlier works (Van Meter et al. 2009, Jones et al. 2010, Fowler et al. 2012, Gheorghiu et al. 2019). In the abstract circuit model (which ignores overheads from distillation, routing, and error correction) our construction uses 3n+0.002nlg⁡n logical qubits, 0.3n3+0.0005n3lg⁡n Toffolis, and 500n2+n2lg⁡n measurement depth to factor n-bit RSA integers. We quantify the cryptographic implications of our work, both for RSA and for schemes based on the DLP in finite fields.

A Threshold for Quantum Advantage in Derivative Pricing

“…orders of magnitudes slower than our requirement), we are optimistic that future work on algorithms, circuit optimization, error correction, and hardware will continue to improve the required resource estimates and runtimes. For example, in the case of Shor's algorithm, the estimated resource requirements have reduced by almost three orders of magnitude through careful analysis across several publications [28]. This work represents the first milestone on the journey towards quantum advantage for pricing financial derivatives and we are looking forward to future enhancements.…”

Qulacs: a fast and versatile quantum circuit simulator for research purpose

“…Another important usage of the simulator for quantum circuits is performance analysis of the quantum error correction and fault-tolerant quantum computing. To construct a quantum computer large enough for Shor's algorithm [48,49], a quantum simulation for quantum manybody systems [36,50], or algorithms for linear systems [51], quantum error correction [52] is necessary to reduce logical error rates to an arbitrarily small value. Many types of quantum errorcorrecting codes and schemes have been proposed.…”

Quantum technology for military applications

“…• Timeline expectation: mid-to long-term • Qubits requirement: ∼ 6200 for 2048 bit RSA factorisation [35], ∼ 2900 for 256 bit ECDLP-based 3 encryption [36] • Main challenges: number of logical qubits One of the most well-known quantum computer applications is the factorisation of large prime numbers by exponential speedup described by Shor's algorithm [37]. This is a threat for public-key cryptography schemes, such as RSA, DH and ECC, 4 based on the large prime number multiplications, the discrete logarithm problem or the elliptic-curve discrete logarithm problem-based schema that are considered computationally intractable or very hard for classical computers.…”