Even if the number of qubits doubled every year from here on out, it would be 15+ years until we had enough working space to run Shor's algorithm on modern cryp

Even if the number of qubits doubled every year from here on out, it would be 15+ years until we had enough working space to run Shor's algorithm on modern cryptographic key sizes. Back of the envelope: - It takes 9n error-corrected qubits to break an n-bit ECDH key [1] - Each error-corrected qubit requires ~2500 physical qubits [2][3] - Typical ECDH key size is 256 bits [4] - This year would be the year of ~64 physical qubit machines. [5][6][7] - log_2(256 * 9 * 2500 / 64) ~= 16.4 years Note that every one of the quantities in the estimate is subject to future research. E.g. the error corrected qubit size is smaller when using lattice surgery, but not enough to really move the needle on the time estimate. [1]: https://arxiv.org/abs/1706.06752 https://arxiv.org/abs/1706.06752 [2]: See section VI of https://arxiv.org/abs/1805.03662 https://arxiv.org/abs/1805.03662 [3]: https://docs.google.com/presentation/d/e/2PACX-1vReeRxH80RuuU1cAwrsJ1ybeVQyxG35CqvRSGRGX2PhkYybAup7ScLz6G-AYH5DF-J7EhEJzMoVceCL/pub#slide=id.g3bd373e21f_0_23 https://docs.google.com/presentation/d/e/2PACX-1vReeRxH80Ruu... [4]: https://crypto.stackexchange.com/a/47337/7860 https://crypto.stackexchange.com/a/47337/7860 [5]: https://ai.googleblog.com/2018/03/a-preview-of-bristlecone-googles-new.html https://ai.googleblog.com/2018/03/a-preview-of-bristlecone-g... [6]: https://www-03.ibm.com/press/us/en/pressrelease/53374.wss https://www-03.ibm.com/press/us/en/pressrelease/53374.wss [7]: https://newsroom.intel.com/press-kits/quantum-computing/#49-qubit-processor https://newsroom.intel.com/press-kits/quantum-computing/#49-...