How many qubits are needed to break RSA-2048?

The logical resource count (1,399 logical qubits, 6.5×10⁹ Toffoli Gates) comes from Gidney's "How to factor 2048 bit RSA integers with less than a million noisy qubits" (arXiv:2505.15917). The physical footprint is derived from the Litinski lattice-surgery cost model (arXiv:1808.02892): magic-state distillation factory selection, tile layout, and the code distance required to keep the total logical error under budget, treating each Toffoli gate as 4 T gates (the optimistic bound).

Results are reported under two published logical-error calibrations because they disagree by 13-268x (d=7 to d=25), the spread is genuine model uncertainty, not a rounding choice. That spread covers logical-error calibration only. It does not cover the protocol-vintage gap described below. Estimated wall-clock time at a 1 µs cycle: 132.9 days (optimistic) to 160.4 days (conservative).

One caveat matters more than the calibration spread, and it cuts against this page. Gidney's own headline figure, at the same 0.001 error rate and 1 µs cycle time, is under 1 million physical qubits in under a week. The gap is protocol vintage, not a disagreement about the physics. This page prices magic states from the 2019 Litinski distillation catalog and charges every idle logical qubit a plain surface-code patch, which is what forces distance 29 across roughly 1,399 data tiles. Gidney reaches under 1 million by storing idle logical qubits in yoked surface codes and by replacing distillation with magic-state cultivation, which allocates less space to magic states rather than more. His logical resource count is the one this page already consumes, so the difference is entirely in the error-correction layer, and this model names both gaps in its own caveats. Treat the figures here as an upper bound on the requirement, not a best estimate.

The best disclosed device is about 3.5 orders of magnitude short of the physical-qubit requirement. Error rates are closer to ready than scale: the best two-qubit error rate on record is 0.0003 (Trapped-Ion, July 2024), already below the surface-code threshold. The bottleneck is qubit count, not fidelity.