Researchers at Alice & Bob have published an end-to-end resource estimate for running Shor's algorithm on cat qubits, and the figure for secp256k1, the curve behind bitcoin keys, is at most 30,000 qubits and one hour of runtime. The number holds only under the noise and cycle-time assumptions the authors fix.
What the paper covers
The paper, posted to the Cryptology ePrint Archive, compiles Shor's algorithm from its mathematical description down to the allocation and scheduling of physical qubits on a chip layout. It covers three problems: RSA factoring, the elliptic curve discrete logarithm (ECDLP) and the finite field discrete logarithm (FFDLP).
- Two hardware architectures: repetition cat codes and LDPC cat codes
- A new parity-CNOT gate for cat qubits and a multi-target CNOT gate extended to the LDPC architecture
- An active injection procedure adapted to cat-qubit architectures
- The adder from Gidney's 2025 RSA-2048 resource estimate, adapted to cat qubits
- Factory designs and lookup compilation taken from the FeMoco estimate by Kroell et al.
The authors are researchers at Alice & Bob, alongside co-authors affiliated with Univ Paris-Saclay, CEA, CNRS, Inria, Univ Rennes and the University of Edinburgh.
The numbers
Problem | Cat qubits | Runtime |
|---|---|---|
RSA-2048 (fully compiled) | 22,593 | 3.14 days |
ECDLP secp256k1 | at most 30,000 | 1 hour |
FFDLP-512 | about 6,700 | 21 minutes |
RSA-2048 (space for time) | about 611,000 | 1.25 hours |
RSA-2048 is the only configuration compiled in full. The secp256k1 figures reuse the operations compiled for RSA, and FFDLP-512 is proposed by the authors as an intermediate benchmark.
The assumptions behind the figures
The estimates hold only under the parameters the authors fix:
- 1 microsecond error-correction cycle time
- 10 microsecond reaction time
- Circuit-level phase-flip noise with probability 5 x 10^-4
- No bit-flips, equivalent to a bit-flip time of about 100 years
If the bit-flip time drops to about one hour, the authors add a concatenation layer into a distance-3 bit-flip code, and the RSA-2048 cost rises to about 45,000 cat qubits.
What it means for you
Your bitcoin keys sit on secp256k1, so ECDLP is the exact problem covered by the 30,000-qubit, one-hour estimate.
The paper is a resource estimate: it describes chip layouts and schedules for cat qubits under the noise assumptions above, not the result of a run on hardware.