Iceberg Quantum Cuts Its RSA-2048 Qubit Estimate

A future quantum computer could crack RSA-2048, one of the main algorithms protecting internet traffic and stored data today, with as few as 48,000 physical qubits and less than a day of running time, the Australian startup Iceberg Quantum said on 22 October. The figure comes entirely from the company’s own simulations: no machine capable of the feat exists, and the work has not been peer-reviewed.

The claim matters less as a prediction than as another downward tug on the numbers security planners use. Iceberg Quantum said its Pinnacle 1.2 update presents “the first direct circuit-level simulations demonstrating logical error rates low enough for RSA-2048 factoring”, and that the result cuts the estimated cost “an order of magnitude lower than estimated in Pinnacle 1.0, without changing the underlying architecture”. In its earlier arXiv preprint, the company argued 2048-bit RSA could be factored “with fewer than one hundred thousand physical qubits”, against a previous best estimate of close to one million.

The numbers are simulations, not a working machine

What Iceberg Quantum reported is a set of calculations, not an experiment on hardware. Its engineers built a software decoder they call Crevasse, with “a mean decoding time of four microseconds per round of error correction”, and used it to run trillions of simulated error-correction cycles. From those runs they report a logical error rate of about two in ten trillion per logical qubit-cycle for one of their codes, which they say is low enough to carry a factoring computation through to the end.

They then compiled a verified modular-exponentiation circuit, the maths at the heart of breaking RSA, and counted the operations. The resulting estimates vary sharply with the hardware assumed. At a physical error rate of one in 10,000 and a one-microsecond cycle, the company puts the job at 48,000 qubits and 0.98 days; at one in 1,000, at 72,000 qubits and 3.7 days. Slow the cycle to a millisecond and the counts balloon to 714,000 qubits and 29 days, or 2.1 million qubits and 32 days. For fixed-connectivity superconducting machines, a stripped-back design it calls Frozen Pinnacle needs “99 thousand physical qubits with an expected runtime of 5.0 days”.

Every one of those lines assumes a fault-tolerant quantum computer that nobody has built. The best devices demonstrated so far operate on the order of hundreds of physical qubits, and the hard engineering problem is holding error rates low while scaling up. Progress is real but incremental, as TSN’s coverage of Google’s “magic state cultivation” on its Willow chip and NVIDIA’s simulation of 104 qubits to test a cheaper error-correction method shows. A smaller paper estimate lowers the bar; it does not supply the machine.

Why a lower qubit count unsettles encryption

RSA and the related elliptic-curve schemes secure web sessions, software updates, payment systems and much stored data. Their safety rests on a bet that factoring very large numbers is computationally out of reach. A sufficiently large, error-corrected quantum computer running Shor’s algorithm would undo that bet, which is why successive estimates of “how big a machine” have been watched so closely. The headline direction of travel, from roughly 20 million qubits in a 2019 study to Iceberg Quantum’s claim of under 100,000, is the reason the migration to new algorithms has moved from research topic to planning deadline.

There is also a specific concern that does not need a machine to exist today: “harvest now, decrypt later”, in which an adversary stores encrypted traffic now and waits for the hardware to catch up. Data that must stay secret for a decade or more is therefore already exposed on paper, regardless of when a factoring machine actually arrives.

The defensive clock is already running

The sober counterpoint to any factoring claim is that the fix is standardised and the timetable is set. In August 2024 the US National Institute of Standards and Technology approved three post-quantum standards — FIPS 203, 204 and 205 — built on maths that quantum computers are not expected to break efficiently. Browsers, cloud providers and messaging tools have begun switching the key-exchange step over to them.

For UK readers, the National Cyber Security Centre has turned that into dates. Its guidance on migration to post-quantum cryptography asks large organisations and critical-infrastructure operators to finish discovery and build a migration plan by 2028, complete their highest-priority migrations by 2031, and move all systems to post-quantum cryptography by 2035. The NCSC frames the whole programme as ordinary, if large, cyber-security housekeeping rather than an emergency: a “mass technology change that will take a number of years”, best folded into routine system replacement.

That is the useful way to read Iceberg Quantum’s announcement. Weigh the upside soberly — the same architecture, the company notes, could also tackle legitimately hard problems such as the Fermi-Hubbard model, the kind of chemistry-and-materials work that is quantum computing’s actual promise — but treat the factoring figure as a simulated bound, not a countdown. The defences exist, the deadlines are published, and the migration is the part that is within anyone’s control. The open questions sit on the other side: whether the simulations survive outside scrutiny, and when, if ever, hardware reaches the scale they assume. The crypto world has seen the direction before, most visibly in Bitcoin’s own planning for the day large quantum computers arrive, which TSN covered when BIP 361 set out a five-year path to retire Bitcoin’s old signatures. Other governments are moving too, as with Vietnam’s three draft post-quantum standards.

The next thing to watch is not a working codebreaker but whether independent researchers can reproduce Iceberg Quantum’s error-rate simulations, and whether its qubit figures hold up once they do.