Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days

What it is

An IACR ePrint preprint (2026/2665, received 28 October 2026) by Axel Pappalardo, Dahmun Goudarzi and colleagues. Contact addresses are at alice-bob.com. It compiles Shor's algorithm for RSA, ECDLP and FFDLP down to physical-qubit operations on superconducting cat qubits, with chip layouts and schedules. Only RSA-2048 is compiled in full. The other targets reuse its operations.

How it works

Two architectures are compiled: repetition cat codes and LDPC cat codes. The authors design a parity-Cnot gate for cat qubits, extend a multi-target Cnot gate to the LDPC-cat architecture, and adapt an active injection procedure.

The adder comes from Gidney's 2025 RSA-2048 estimate, adapted to cat qubits. The phaseup gets only a coarser estimate. Factory designs and lookup compilation are taken from the FeMoco estimate of Kroell et al.

Preconditions / Affected

The figures assume:

• a 1 µs error-correction cycle time;
• a 10 µs reaction time;
• circuit-level phase-flip probability p_Z = 5e-4;
• no bit-flips, which the paper equates to a bit-flip time of about 100 years.

The results apply to RSA, ECDLP and FFDLP, which rely on factoring or discrete-log hardness.

Results beyond the summary

The bit-flip relaxation adds a concatenation layer with a distance-3 bit-flip error-correcting code.

What to do

The page gives no mitigation or migration steps. For planning, the useful inputs are the hardware thresholds above: a phase-flip rate near 5e-4 and bit-flip suppression, either to about 100 years or to about one hour with the extra code layer. Those are the parameters to track when judging how close cat-qubit hardware is to these estimates.

Caveats

• This is a preprint, with no peer-review venue stated.
• The estimate rests on the no-bit-flip assumption. The relaxed bit-flip variant raises the RSA-2048 count to about 45 000 qubits, and its runtime is not given in the abstract.
• The phaseup estimate is coarser than the rest of the compilation.
• The ECDLP figure is an upper bound ("at most"), not a full compilation.
• The abstract does not say whether current hardware reaches the assumed noise levels.