The most common question about quantum risk is “when?”. A good way to approach it is to ask a more precise question: how big a quantum computer would it take?
Why RSA-2048 is the benchmark
RSA with 2048-bit keys is one of the most widely used public-key algorithms, protecting certificates, VPNs and software signing. Breaking it is the classic test of whether a quantum computer is “cryptographically relevant”.
How the estimates have fallen
| Year | Estimated machine | Time to break one key |
|---|---|---|
| 2019 (Gidney & Ekerå) | About 20 million noisy qubits | About 8 hours |
| 2025 (Gidney) | Fewer than 1 million noisy qubits | Less than a week |
Both estimates make the same assumptions: qubits with an error rate of about 0.1% per operation, arranged in a grid and running continuous error correction. The 20-fold drop in qubits came from better algorithms and error-correction techniques, not from better hardware.
How today’s machines compare
Today’s largest gate-based machines have around a thousand physical qubits, and none can yet run long, error-corrected computations. The gap between a thousand noisy qubits and a million well-controlled ones is still very large, but better algorithms have shrunk it faster than many people expected.
What about elliptic curves?
Elliptic-curve keys are much shorter than RSA keys, and research suggests that breaking a 256-bit elliptic curve may need fewer logical qubits than breaking RSA-2048. So ECC, used by most modern websites and cryptocurrencies, is not safer against quantum attack; if anything, it may fall first.
The lesson
task_altKey takeaways
- check_circleEstimates for breaking RSA-2048 fell from about 20 million qubits (2019) to under 1 million (2025).
- check_circleThe drop came from smarter algorithms, not better hardware.
- check_circleElliptic-curve cryptography may need even fewer qubits to break.