New RSA calculation cuts quantum gates, but can still run slower

Researchers have found a way to reduce the estimated quantum operations needed to factor an RSA-2048 number, a task relevant to the security of widely used public-key cryptography. But their calculations also reveal a catch: a circuit with fewer operations can take longer on a different machine.^[1]

The November 6 preprint by Monit Sharma and Hoong Chuin Lau of Singapore Management University reports about 46% fewer Toffoli gates at a budget of 1,806 logical qubits, compared with the best setting of its reference circuit within that budget. These are simulated resource counts for a future fault-tolerant computation, not an attack performed on a 2048-bit key. It is a preprint, not a peer-reviewed hardware demonstration.^[1]

Its contribution is useful precisely because it separates questions often compressed into one headline: how much arithmetic must be done, how much memory it needs, and how long a particular computer would take to do it.

Stop doing the same lookup twice

The work builds on Craig Gidney's 2025 low-qubit factoring construction. Much of that circuit's costly arithmetic involves looking up values in tables and cleaning up temporary working information. Quantum calculations must clear that working information carefully so it does not spoil the desired result.^[1]

The researchers combine three changes. A single lookup retrieves entries for several small primes because those lookups share an address. Intermediate results are retained rather than later recomputed. With those results available, some modular reductions can be postponed until the end of a sequence. That saves work while using additional storage.^[1]

A Toffoli is a three-qubit logic operation, and counting it helps estimate the cost of fault-tolerant arithmetic. A logical qubit is an error-protected information unit, not one physical device. Neither number alone specifies the size or speed of a buildable computer.^[1]

The comparison changes the headline

At 1,461 logical qubits, the paper estimates 5.08 billion Toffoli operations per factoring, against 5.98 billion for the best reference setting within that budget: about 15% fewer. At 1,806 qubits the figures are 2.55 billion versus 4.74 billion, a reduction of about 46%.^[1]

Calculated from those rounded figures, the larger-budget case removes approximately 2.19 billion operations. The smaller-budget case removes approximately 900 million. Those are meaningful changes in a resource estimate, while the remaining workload still contains billions of operations.

The paper also gives a larger 61% saving against one fixed published configuration. That is a different comparison. Allowing the old method to choose its best settings within the same qubit allowance reduces the headline gain to 46%. Matching resources avoids giving the new method credit simply for spending more memory.^[1]

Fewer gates can still mean a longer wait

On the paper's surface-code timing model, the 1,806-qubit option takes an estimated 1.38 days, versus 3.44 days for a reference tuned for that architecture. On its space-efficient neutral-atom model, however, that same circuit takes 164.7 years against 120.6 years for the tuned reference.^[1]

Those strikingly different times are conditional projections, not observed runtimes. The neutral-atom option also exceeds the model's 1,480-logical-qubit memory; the extra memory and its atom count are not costed. Its penalty arises because a wider lookup result is expensive to process on that architecture. Lower gate count does not erase that bottleneck.^[1]

What remains to be checked

The authors tested complete smaller instances from 32 to 330 bits and projected the RSA-2048 cost from sampled primes. Their branch simulator tracks values and phases rather than directly simulating the full interference. Selected small circuits received separate gate-level checks, but that is not a complete hardware implementation or independent certification of every large circuit.^[1]

They have released a benchmark archive so others can inspect the accounting. The useful next step is independent reproduction and architecture-specific compilation, including memory, movement, routing and error costs. For readers following the quantum threat to encryption, this is a better arithmetic proposal with explicit trade-offs, not a new date on which RSA will fail.^[1][2]