Quantum error-correction records are still billions of times short of a code-breaking machine

The best error-correction results reported in the past month are still several orders of magnitude short of what published estimates say a machine able to break today's public-key cryptography would need. Quantinuum's record logical qubit, announced on October 19, fails about five times per million error-correction rounds. Craig Gidney's 2025 estimate for factoring RSA-2048 assumes roughly 1,400 logical qubits that each fail about once in a quadrillion rounds.

These two sets of numbers rarely appear in the same place. Cloudflare justifies its post-quantum migration with "harvest now, decrypt later", the practice of storing encrypted data today so it can be decrypted once quantum computers are capable enough. The post does not mention qubits. NIST's draft transition report, IR 8547, says organizations must start migrating before the years their data must stay secret plus the years migration takes add up to more than the time until a cryptographically relevant quantum computer exists. That last number is exactly what error-correction research bears on.

What the estimates ask for

A logical qubit is a single error-protected unit of information spread across many physical qubits, and the code distance is a measure of how many physical errors that protection can absorb. Gidney, of Google Quantum AI, posted his RSA estimate to arXiv in May 2025. It has not yet been peer reviewed. He estimates that a 2048-bit RSA key could be factored in under a week by fewer than a million noisy physical qubits. He assumes a square grid of qubits that connect only to their neighbours, a 0.1 percent physical gate error rate, and a 1-microsecond error-correction cycle. His design uses about 6.5 billion Toffoli gates (a three-qubit logic operation that dominates the cost) and 1,399 logical qubits for the algorithm, or 1,537 including idle workspace. That works out to 897,864 physical qubits. To keep the whole run reliable, he targets a logical error rate of 10^-15 per logical qubit per round, which he reaches with distance-25 surface-code patches of 1,352 physical qubits each.

Elliptic-curve keys, which protect Bitcoin and much of the web, are estimated to need fewer resources. One estimate says that on superconducting hardware with 10^-3 physical error rates, the job would take minutes on fewer than half a million physical qubits. It separates fast-clock machines (superconducting and photonic) from slow-clock ones (trapped ions and neutral atoms).

IonQ says the attack needs 1,457 logical qubits, 39 million Toffoli gates and 19,397 physical trapped-ion qubits. It estimates 25.7 days per attempt with a 29.5-millisecond error-correction cycle, and a proven minimum success probability of 40.7 percent per attempt. Across the RSA and IonQ estimates, the logical requirement falls between about 1,200 and 1,500 qubits. The physical count ranges from about 19,000 to about 900,000, depending on the hardware and the error-correcting code.

What was reported this month

Quantinuum's paper, posted October 19 on its website and on arXiv and not yet peer reviewed, ran triangular color codes at distances 3, 5 and 7 on its Helios trapped-ion computer, which Science News reports has 98 physical qubits. The logical error rates per error-correction cycle were 5.5 x 10^-4, 3.8 x 10^-5 and 5 x 10^-6. Each step up in distance cut errors by a factor the authors put at 12. For two-qubit logic operations at distance 5, the error rate was 7 x 10^-5 per gate. The distance-7 code used up to 37 physical qubits. Science News notes the experiment involved a single logical qubit. Quantinuum says its error rate is 100 times lower than the best result on other hardware.

Infleqtion announced on September 24 that it had entangled 30 logical qubits using 80 physical neutral-atom qubits on its Sqale system. The release gives no logical error rate. Robin Blume-Kohout of Sandia National Laboratories, who was not involved in the Quantinuum work, said in Quantinuum's release that a scaled-up version could reach useful reliability with fewer than a million physical qubits.

Measuring the gap

Logical qubit count: the largest group reported this month is 30, with no published error rate, against the 1,200 to 1,500 the estimates require. That is a gap of 40 to 50 times. The record-fidelity result used one logical qubit. Error rate: 5 x 10^-6 per round against Gidney's 10^-15 target is a factor of about five billion. The comparison is rough. The codes differ, Quantinuum measured memory rather than a full computation, and Gidney's target belongs to his surface-code design, not to every design. Physical qubits: Helios has 98, against IonQ's 19,397 and Gidney's roughly 900,000. Gates: the estimates call for tens of millions to billions of Toffoli gates, while this month's records cover stored information and simpler two-qubit operations.

Using the scaling rule in Quantinuum's paper, an error reduction of 12 per step would need about nine more distance steps, to roughly distance 25, to get from 5 x 10^-6 to 10^-15. Neither Quantinuum nor Google has shown that the reduction holds that far. Google's Willow team found that rare correlated errors, occurring about once an hour, limited performance in a related test.

Speed matters too. Willow's 1.1-microsecond cycle is close to Gidney's assumption. IonQ's 29.5-millisecond cycle is what stretches its estimate to weeks.

What would answer the timing question

The public record does not give a date. Company roadmaps point toward the end of the decade. Quantinuum says its fault-tolerant Apollo machine is expected by 2029. IonQ says it is on track for a fault-tolerant 10,000-physical-qubit system in 2027. Infleqtion says it will reach 100 logical qubits in 2028 and 1,000 by 2030. None of these companies has published logical error rates for those future systems. Three kinds of results would narrow the uncertainty: hundreds of logical qubits computing together with reported error rates per operation, logical Toffoli gates at scale, and error suppression that holds at larger code distances.

NIST's draft schedule does not wait for those results. It would deprecate RSA and ECDSA at the 112-bit security level after 2030 and disallow both after 2035, in line with National Security Memorandum 10's 2035 goal. It also notes that migrations have historically taken 10 to 20 years.