Reading Quantum Roadmaps: What Breaking Encryption Would Take

Quantum companies now publish detailed roadmaps with named processors, target years and qubit counts. For security teams these documents are tempting to read as a countdown to the day RSA breaks. They are not designed for that, and reading them well takes some care.

This article explains what a quantum computer would need in order to break today’s public-key cryptography, sets that against what vendors have demonstrated and what they promise and shows why the migration dates proposed or recommended by government bodies do not depend on any single roadmap. It draws on the earlier articles on error correction and hardware.

What A Cryptographically Relevant Machine Needs

A cryptographically relevant quantum computer, often shortened to CRQC, is one that could run Shor’s algorithm against real key sizes such as 2048-bit RSA. A widely cited 2025 estimate comes from Craig Gidney of Google. In a May 2025 preprint he estimated that a machine built from a flat grid of qubits, each failing no more than 0.1 percent of the time, would need fewer than a million noisy physical qubits running continuously for less than a week.¹ His 2019 estimate with Martin Ekerå had been 20 million qubits for eight hours.²

Preprints in 2026 went further by changing the architecture, and they trade fewer qubits for longer runs. Webster and colleagues’ Pinnacle design uses a different family of error-correcting codes, which needs qubits to interact beyond their nearest neighbours. Under the same error and speed assumptions as Gidney, it puts RSA-2048 at fewer than 100,000 physical qubits for a run of about a month, or about 139,000 for a run of a week.³ Cain and colleagues argue that a machine built from movable neutral atoms could run Shor’s algorithm at cryptographically relevant scale with as few as 10,000 of them, but that size suits slow runs. Their faster configurations need about 26,000 atoms for around 10 days on a 256-bit elliptic curve key, and about 102,000 atoms for around 97 days on RSA-2048.⁴ Neither design has been built. The dated history of these estimates is in How Many Qubits To Break RSA-2048?

From 2019 to 2026 the smallest published qubit count for RSA-2048 fell more than 200-fold, although the 2026 figures assume different hardware and much longer runs than the 2019 one. That downward trend is the most important point in this article. It came from better algorithms, codes and architectures, not from better hardware. The hardware still has to arrive, and it has to arrive as a complete system.

Inside the 2025 estimate, the work is organised as about 1,400 logical qubits (1,399 in the paper’s Table 5, and fewer than 1,600 including idle qubits) carrying out about 6.5 billion Toffoli gates, a type of three-qubit logic operation, with each attempt taking roughly 12 hours.¹ Every one of those figures sits far beyond what any machine has demonstrated.

Demonstrated Results Versus Targets

The error-corrected demonstrations covered in this series involve tens of logical qubits, run for short periods. Vendor roadmaps promise hundreds to tens of thousands of logical qubits by around 2030. The table separates the two.

Several things stand out. IBM’s 2029 target of 200 logical qubits and 100 million gates is well short of the roughly 1,400 logical qubits and billions of operations in the 2025 RSA-2048 estimate.⁵⁶ IonQ’s 2030 target would, if met, be in the range a CRQC needs, but it is a company target, and an ambitious one compared with what any company has demonstrated.⁷ Infleqtion’s figures come from a press release that does not say whether its logical qubits are error corrected or only error detected.⁸

How To Read A Roadmap

A roadmap is a statement of intent written partly for customers and investors. Read it with five questions in mind.

First, are the targets in physical or logical qubits? Physical counts say little on their own. Second, how is a logical qubit defined, and at what error rate? IonQ, for example, attaches logical error rates to its targets; others do not.⁷ Third, how many operations can the machine run before an error, and for how long? The estimates cited here all need billions of operations under sustained fault-tolerant control, with runtimes that depend on the configuration. Fourth, which past milestones did this vendor hit on time? A roadmap’s track record is evidence. Fifth, does the target rest on peer-reviewed results, or on announcements and preprints?

Intermediate milestones are the best place to apply the track-record test. IBM’s roadmap, for instance, lists Loon for 2025, Kookaburra for 2026 and Cockatoo for 2027 before Starling in 2029, each meant to prove one part of the final architecture.⁵ IBM announced Loon in November 2025, in line with that plan.⁹ Whether the later steps arrive on schedule will say more about 2029 than the 2029 target itself.

Why Security Timetables Do Not Wait

Government bodies set out their migration timetables without relying on any single roadmap. NIST published its first three post-quantum standards, FIPS 203, 204 and 205, on 13 August 2024.¹⁰ In a draft report from November 2024, which as of October 2026 has not been finalised, NIST proposes treating RSA and elliptic curve algorithms at the 112-bit security level as deprecated after 2030 and disallowing them after 2035.¹¹ The UK National Cyber Security Centre asks organisations to finish discovery and planning by 2028, migrate their highest-priority systems by 2031 and complete migration by 2035.¹²

The logic is simple. Large organisations take many years to replace cryptography, and data stolen today can be decrypted later. The reasoning behind that risk is set out in The Quantum Threat, and the practical steps in Preparing For Migration. Roadmaps are worth tracking as a signal of pace. They should not set your timetable.