4 ms·

*ends as soon as practical quantum computers, something which might never happen, exist. The author mentions: > RSA-2048: ~4096 logical qubits, 20-30 million

by fnands 10mo ago

*ends as soon as practical quantum computers, something which might never happen, exist. The author mentions: > RSA-2048: ~4096 logical qubits, 20-30 million physical qubits > 256-bit ECC: ~2330 logical qubits, 12-15 million physical qubits For reference, we are at ~100 physical qubits right now. There is a bit of nuance in the logical to physical correlation though. Scepticism aside, the author does mention that it might be a while in the future, and it is probably smart to start switching to quantum resistant cryptography for long-running, critical systems, but I'm not a huge fan of the fear-mongering tone.

nottorp 10mo ago
You mean it will come right when AGI comes?
- LadyCailin 10mo ago
  Fusion powered AGI!
  - fnands 10mo ago
    Fusion powered Quantum AGI! (on the blockchain?) ;-)
    - ale42 10mo ago
      No, no, at that point they'll busy figuring out an actually quantum-proof blockchain (but powered by AGI)
    - oldgradstudent 10mo ago
      In your flying car, no less.
      - cbrozefsky 10mo ago
        That drives/flies itself
brohee 10mo ago
And no clear quantum Moore law emerging for the yearly increase in qbits (https://arxiv.org/abs/2303.15547 https://arxiv.org/abs/2303.15547)... The quantum panic pushes people to deploy immature solutions, and the remedy sure sometimes looks worse than the illness...
- wasabi991011 10mo ago
  Great manuscript to share. I will highlight to others that while the qubit count is not increasing exponentially, other metrics are.
thrance 10mo ago
...and 100, quite useless qubits too, with insane error rates and extremely fast decoherence times.
adgjlsfhk1 10mo ago
sota for rsa 2048 is <1 million physical qbits
- fnands 10mo ago
  Yeah, I was taking the author's numbers there, and there is a lot of nuance to the logical vs physical qubits relationship. Not super up to date on the latest work there, you got any links?
  - adgjlsfhk1 10mo ago
    "How to factor 2048 bit RSA integers with less than a million noisy qubits" (https://arxiv.org/abs/2505.15917 https://arxiv.org/abs/2505.15917) is the most up to date paper here, and uses ~1400 logical and ~900k physical
    - fnands 10mo ago
      Thanks!
cubefox 10mo ago
The fear-mongering tone is likely due to the fact that this was posted (though probably not written) by a company promoting quantum-safe cloud storage. Anyway, here is what Scott Aaronson recently said about quantum computing progress: > Indeed, given the current staggering rate of hardware progress, I now think it’s a live possibility that we’ll have a fault-tolerant quantum computer running Shor’s algorithm before the next US presidential election. And I say that not only because of the possibility of the next US presidential election getting cancelled, or preempted by runaway superintelligence! (...) > To clarify — if, before the 2028 presidential election, a fully fault-tolerant Shor’s algorithm was used even just to factor 15 into 3×5, I would view the “live possibility” here as having come to pass. > The point is, from that point forward, it seems like mostly a predictable matter of adding more fault-tolerant qubits and scaling up, and I find it hard to understand what the showstopper would be. https://scottaaronson.blog/?p=9325 https://scottaaronson.blog/?p=9325
- fnands 10mo ago
  I was actually reading his blog again last night (after chatting with a friend about QQ), and he has a follow up post, titled: "Quantum Investment Bros: Have you no shame?" Relevant quote: > It’s like this: if you think quantum computers able to break 2048-bit cryptography within 3-5 years are a near-certainty, then I’d say your confidence is unwarranted. If you think such quantum computers, once built, will also quickly revolutionize optimization and machine learning and finance and countless other domains beyond quantum simulation and cryptanalysis—then I’d say that more likely than not, an unscrupulous person has lied to you about our current understanding of quantum algorithms. And: > In any case, the main reason I made my remark was just to tee up the wisecrack about whether I’m not sure if there’ll be a 2028 US presidential election. So I would be careful posting those quotes without context, it makes Scott angry.
  - cwillu 10mo ago
    I don't see what you think is so misleading about those quotes that you think Scott Aaronson would be angry to see them posted.
tgv 10mo ago
About those sizes: they increase with the size of the key, right? So I would think the author's claim that RSA-8192 is just as vulnerable as RSA-4096 isn't quite as straight-forward. It would require considerably more qbits.

by fnands 10mo ago

nottorp 10mo ago

You mean it will come right when AGI comes?

LadyCailin 10mo ago
Fusion powered AGI!
- fnands 10mo ago
  Fusion powered Quantum AGI! (on the blockchain?) ;-)
  - ale42 10mo ago
    No, no, at that point they'll busy figuring out an actually quantum-proof blockchain (but powered by AGI)
  - oldgradstudent 10mo ago
    In your flying car, no less.
    - cbrozefsky 10mo ago
      That drives/flies itself

brohee 10mo ago

And no clear quantum Moore law emerging for the yearly increase in qbits (https://arxiv.org/abs/2303.15547 https://arxiv.org/abs/2303.15547)... The quantum panic pushes people to deploy immature solutions, and the remedy sure sometimes looks worse than the illness...

wasabi991011 10mo ago
Great manuscript to share. I will highlight to others that while the qubit count is not increasing exponentially, other metrics are.

thrance 10mo ago

...and 100, quite useless qubits too, with insane error rates and extremely fast decoherence times.

adgjlsfhk1 10mo ago

sota for rsa 2048 is <1 million physical qbits

fnands 10mo ago
Yeah, I was taking the author's numbers there, and there is a lot of nuance to the logical vs physical qubits relationship. Not super up to date on the latest work there, you got any links?
- adgjlsfhk1 10mo ago
  "How to factor 2048 bit RSA integers with less than a million noisy qubits" (https://arxiv.org/abs/2505.15917 https://arxiv.org/abs/2505.15917) is the most up to date paper here, and uses ~1400 logical and ~900k physical
  - fnands 10mo ago
    Thanks!

cubefox 10mo ago

The fear-mongering tone is likely due to the fact that this was posted (though probably not written) by a company promoting quantum-safe cloud storage. Anyway, here is what Scott Aaronson recently said about quantum computing progress: > Indeed, given the current staggering rate of hardware progress, I now think it’s a live possibility that we’ll have a fault-tolerant quantum computer running Shor’s algorithm before the next US presidential election. And I say that not only because of the possibility of the next US presidential election getting cancelled, or preempted by runaway superintelligence! (...) > To clarify — if, before the 2028 presidential election, a fully fault-tolerant Shor’s algorithm was used even just to factor 15 into 3×5, I would view the “live possibility” here as having come to pass. > The point is, from that point forward, it seems like mostly a predictable matter of adding more fault-tolerant qubits and scaling up, and I find it hard to understand what the showstopper would be. https://scottaaronson.blog/?p=9325 https://scottaaronson.blog/?p=9325

fnands 10mo ago
I was actually reading his blog again last night (after chatting with a friend about QQ), and he has a follow up post, titled: "Quantum Investment Bros: Have you no shame?" Relevant quote: > It’s like this: if you think quantum computers able to break 2048-bit cryptography within 3-5 years are a near-certainty, then I’d say your confidence is unwarranted. If you think such quantum computers, once built, will also quickly revolutionize optimization and machine learning and finance and countless other domains beyond quantum simulation and cryptanalysis—then I’d say that more likely than not, an unscrupulous person has lied to you about our current understanding of quantum algorithms. And: > In any case, the main reason I made my remark was just to tee up the wisecrack about whether I’m not sure if there’ll be a 2028 US presidential election. So I would be careful posting those quotes without context, it makes Scott angry.
- cwillu 10mo ago
  I don't see what you think is so misleading about those quotes that you think Scott Aaronson would be angry to see them posted.

tgv 10mo ago

About those sizes: they increase with the size of the key, right? So I would think the author's claim that RSA-8192 is just as vulnerable as RSA-4096 isn't quite as straight-forward. It would require considerably more qbits.