Reviewing On reducing the cost of breaking RSA-2048 to 100,000 physical qubits by Scott Aaronson.

Scott Aaronson discusses a preprint from a Sydney-based research group that proposes a way to run Shor’s algorithm to break RSA-2048 using fewer than 100,000 physical qubits. The key technical advance is the use of LDPC (Low-Density Parity-Check) codes in place of the more conventional surface codes for quantum error correction. Previous estimates for factoring RSA-2048 on a fault-tolerant quantum computer required millions of physical qubits, so a reduction to under 100,000 would represent a dramatic improvement. Aaronson considers the work credible, though he flags a significant practical concern: LDPC codes require nonlocal syndrome measurements, which pose serious engineering challenges for superconducting qubit architectures. He also notes that elliptic curve cryptography (ECC) is actually more immediately vulnerable to quantum attack than RSA, since ECC uses shorter keys that quantum algorithms can exploit more efficiently.

A particularly interesting thread in the post concerns the ethics of publishing such research openly. Aaronson initially questioned whether it was responsible to make the results public, but was persuaded by cryptographer Nadia Heninger, who pointed to the crypto community’s long-standing norm of transparency combined with responsible disclosure (typically a 90-day window). The reasoning is that keeping attack research secret tends to benefit only well-resourced adversaries (nation-states), while open publication lets defenders prepare. Aaronson also played a practical role by advising the authors to revise their paper’s title to avoid sensationalist media coverage implying the attack had already been carried out.

The implications here are worth sitting with. On one hand, this is not an announcement that RSA-2048 has been broken – no one has a 100,000 physical qubit machine, and the engineering gap between theoretical qubit counts and working hardware remains enormous. On the other hand, the trend line matters. Each advance in error-correcting codes and algorithmic optimization lowers the bar, and Aaronson himself acknowledges this is consistent with his long-held expectation that better codes would eventually emerge. For organizations still relying on classical public-key cryptography, the message is increasingly clear: the migration to post-quantum cryptographic standards (such as those recently standardized by NIST) should be treated as urgent infrastructure work, not a distant contingency plan. The fact that ECC may fall before RSA only adds to the urgency, given how widely ECC is deployed in TLS, SSH, and other critical protocols.