Tracking the Cost of Quantum Factoring

Google Quantum AI reports that 2048-bit RSA could theoretically be broken by a future quantum computer with about 1 million noisy qubits running for one week—a 20× reduction from 2019 estimates—due to advances in approximate modular exponentiation and improved error correction (denser logical qubits, magic state cultivation). Although current quantum hardware is far smaller, the report underscores the urgency of migrating to NIST’s standardized post-quantum cryptography (e.g., ML-KEM) to mitigate “store now, decrypt later” risks, notes that signature transitions are more complex and longer-lived, and aligns with NIST guidance to deprecate vulnerable systems after 2030 and disallow them after 2035, with Google already enabling PQC options such as Cloud KMS signature schemes.