Elliptic Curves Fall First: The 2026 Quantum Estimates For ECC

Elliptic curve cryptography (ECC) became popular because it gives the same classical security as RSA with much shorter keys. TLS 1.3 supports elliptic curve Diffie-Hellman for key exchange and ECDSA and EdDSA for certificate signatures,¹ and elliptic curve signatures also secure software, devices and most cryptocurrencies. Short keys turn out to have a downside. Against Shor’s algorithm, smaller numbers mean a smaller quantum circuit.

This article sets out the resource estimates for breaking 256-bit elliptic curve keys, especially the burst of results in March 2026, and compares them with the RSA-2048 figures covered in How Many Qubits To Break RSA. It is current as of October 2026. These numbers have moved quickly and are likely to move again.

Why Smaller Keys Are Easier Targets

Shor’s algorithm attacks the discrete logarithm problem on elliptic curves just as it attacks factoring. The circuit’s size depends mainly on the size of the numbers involved. NIST rates a 256-bit elliptic curve key as comparable in classical strength to a 3072-bit RSA key, both at 128 bits,² yet the quantum computer only has to work with 256-bit values.

That was clear well before 2026. In 2017 Roetteler, Naehrig, Svore and Lauter derived precise costs for elliptic curve discrete logarithms. For a curve over an n-bit prime field they needed at most 9n plus a small term logical qubits, which comes to about 2,330 for P-256. They concluded that at comparable classical security levels, elliptic curves need fewer qubits than RSA, making ECC “an easier target than RSA”.³

The Estimates Over Time

Fewer logical qubits, more gates. Chevignard, Fouque and Schrottenloher, in a paper for EUROCRYPT 2026, reduced the logical qubits for the P-256 discrete logarithm to 1,193, down from 2,124 in a 2020 estimate by Häner and colleagues. The cost is a far higher gate count: about 2 to the power 39 Toffoli gates in each of 22 independent runs, against roughly 2 to the power 30 in the earlier estimate.⁴ The result shows how qubit counts and gate counts trade against each other, which matters when reading headline numbers.

Google Quantum AI and collaborators. On 30 March 2026, Babbush, Zalcman, Gidney, Broughton, Khattar, Neven, Bergamaschi, Drake and Boneh published estimates for the 256-bit elliptic curve discrete logarithm problem that underpins most cryptocurrency signatures. They give two variants: fewer than 1,200 logical qubits with fewer than 90 million Toffoli gates, or fewer than 1,450 logical qubits with fewer than 70 million. On superconducting hardware with a 0.1 percent physical error rate and planar connectivity, they say the attack could run in minutes on fewer than 500,000 physical qubits.⁵

Neutral atoms. The same day, Cain and colleagues estimated that a reconfigurable neutral atom machine with 26,000 physical qubits could compute P-256 discrete logarithms in a few days under plausible assumptions, while RSA-2048 would take one to two orders of magnitude longer on the same design.⁶

Side By Side With RSA-2048

The RSA-2048 column below uses Gidney’s 2025 figures.⁷

The striking row is the gate count. On these figures, the elliptic curve attack needs roughly seventy to ninety times fewer Toffoli gates than Gidney’s RSA-2048 construction. That gap goes a long way to explaining why the runtime falls from days to minutes on similar hardware, although the papers also differ in layout and qubit counts.

Fast Clocks, Slow Clocks And Why Runtime Matters

The Google paper distinguishes fast-clock architectures, such as superconducting and photonic machines, from slow-clock ones, such as neutral atoms and trapped ions.⁵ The distinction matters because the uses of a quantum attack differ.

For harvest now, decrypt later, runtime barely matters. An attacker reading a stored archive can wait days per key. For forging a signature in real time, runtime is everything. The Google authors argue that the first fast-clock machines could attack some cryptocurrency transactions in the short window between broadcast and confirmation.⁵ A slow-clock machine taking days per key could not, but it would still threaten long-lived public keys and recorded traffic.

What This Means For Organisations

The practical message does not depend on which estimate proves most accurate. Elliptic curve keys are not a safer choice than RSA against quantum attack, and on current evidence they are likely to fall first. Organisations that moved from RSA to ECC for efficiency have not reduced their quantum exposure.

That puts elliptic curve key exchange in TLS, VPNs and messaging at the front of the queue for post-quantum or hybrid key exchange, which addresses harvesting risk. It also puts long-lived ECDSA keys, such as those for code signing, device identity and digital assets, high on the list for migration to post-quantum signatures. The replacement algorithms are covered in the Post-Quantum Cryptography group.