Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits

Abstract

Quantum computers have the potential to perform computational tasks beyond the reach of classical machines. A prominent example is Shor's algorithm for integer factorization and discrete logarithms, which is of both fundamental importance and practical relevance to cryptography. However, due to the high overhead of quantum error correction, optimized resource estimates for cryptographically relevant instances of Shor's algorithm require millions of physical qubits. Here, by leveraging advances in high-rate quantum error-correcting codes, efficient logical instruction sets, and circuit design, we show that Shor's algorithm can be executed at cryptographically relevant scales with as few as 10,000 reconfigurable atomic qubits. Increasing the number of physical qubits improves time efficiency by enabling greater parallelism; under plausible assumptions, the runtime for discrete logarithms on the P-256 elliptic curve could be just a few days for a system with 26,000 physical qubits, while the runtime for factoring RSA-2048 integers is one to two orders of magnitude longer. Recent neutral-atom experiments have demonstrated universal fault-tolerant operations below the error-correction threshold, computation on arrays of hundreds of qubits, and trapping arrays with more than 6,000 highly coherent qubits. Although substantial engineering challenges remain, our theoretical analysis indicates that an appropriately designed neutral-atom architecture could support quantum computation at cryptographically relevant scales. More broadly, these results highlight the capability of neutral atoms for fault-tolerant quantum computing with wide-ranging scientific and technological applications.

Figures (7)

• Figure 1: Fault-tolerant computation with atomic qubits.a, Neutral atom processor with four functional zones: a memory zone for storing quantum information, a processor zone for computation, an operation zone for performing Clifford operations, and a resource zone for generating magic states. Also included is a zone for an atomic reservoir and reloading. Each dot represents an atomic data qubit. b, Estimated number of physical qubits to run Shor's algorithm versus year of publication for prior resource estimates jones2012layeredfowler2012surfaceogorman2017quantumgheorghiu2019benchmarkinggidney2019howdallairedemers2025bracegidney2025howzhou2025resourcewebster2026pinnacle and the current work.
• Figure 1: Processor code and surgery performance.a, Block error rate per cycle as a function of physical error rate for the $\hbox{$\mathsf{lp}^{3, 5}_{20}$}$ (pink) and $\hbox{$\mathsf{bb}_{18}$}$ (blue) codes. A least-square fit to both the $\hbox{$\mathsf{bb}_{18}$}$ and $\hbox{$\mathsf{lp}^{3, 5}_{20}$}$ data yields a slope greater than $d/2$, the theoretical maximum value in the limit that the physical error rate $p\to 0$. We therefore fit the data point at the smallest physical error rate of $\mathsf{lp}^{3, 5}_{20}$ (pink dashed line) the form $y=ax^{10}$, where we find $a= 18.5$. Using the same procedure for $\mathsf{bb}_{18}$ (blue dashed line) to fit a line of the form $y=ax^{9}$, we find $a= 15.65$. b, Block error rates per cycle versus physical error rate for the $\hbox{$\mathsf{bb}_{18}$}$ code, either idling for $9$ cycles (solid line) or performing a surgery measurement of a high-weight logical operator (Table \ref{['tab:surgery']}) with $\tau_s = 15$ cycles (dashed line). Surgery failure rates are averaged over $X$- and $Z$-basis initialization and measurement experiments.
• Figure 2: Logical code performance and architecture.a, Block error rates per cycle for several lifted product codes and surface codes. Least-squares power law fits (dashed lines) are used to extrapolate to lower physical error rates $p$ which could not be numerically simulated. The blue fit is of the form $y=ax^b$, where $a=14.6\pm 0.7$ and $b=7.1 \pm 0.4$ are fitted parameters using data from the three smallest physical error rates. Using this same procedure, the fitted values of $b$ for $\mathsf{lp}^{3, 7}_{20}$ and $\mathsf{lp}_{24}^{3, 7}$ are larger than $d/2$, the theoretical maximum value as $p\to 0$. To be conservative, we therefore fit the form $y=ax^{d/2}$ from the smallest physical error rate (red and purple). b, Layout and compilation procedure for the logical architecture. The memory block stores quantum information, which is then teleported to the processor for computation. Sequential PPMs execute mid-circuit measurements and gate teleportation of magic states. Finally, the logical information is teleported back into the memory. Here, $\bar{P}$ denotes an arbitrary logical Pauli operator on the processor code.
• Figure 2: Parallel magic state distillation. We distill $k_f$$\ket{\overline{\text{CCZ}}}$ states using five copies of $[[n_f, k_f, d_f]]$ factory codes. Low-error cultivated surface-code $\ket{\overline{T}}$ states are loaded into one processor code using parallel surgery zhang2025constant. Transversal CNOT gates between this code and the four remaining processor codes are used to perform the PPMs in 8$T$-to-CCZ distillation litinski2019magic, outputting three blocks of high-fidelity $\ket{\overline{\text{CCZ}}}$ states.
• Figure 3: Resources required for Shor's algorithm.a, Number of Toffoli gates and logical qubits required in prior circuits for RSA--1024 and RSA--2048 gidney2025how, finite-field DH--2048 chevignard2025reducing, and ECC--256 babbush2026quantum. The colored boxes represent the total number of Toffoli gates that can be executed in the balanced architecture with $90\%$ total success probability, using either the $\mathsf{lp}^{3, 7}_{20}$ or $\mathsf{lp}_{24}^{3, 7}$ memory. b, Runtimes required for RSA--2048 in different architectures (annotations have one significant figure). The space-efficient and balanced architectures use the $\mathsf{lp}_{24}^{3, 7}$ memory and the circuit in Ref. gidney2025how, whereas the time-efficient architecture uses the circuit in Ref. gidney2019how. We emphasize that the time-efficient runtimes are based on the assumption that up to $P$ Toffoli gates are executed in parallel using high-rate surgery, as motivated by Ref. zheng2025high. c, Runtimes required for solving ECC--256, using the compilations in Ref. babbush2026quantum. The space-efficient and balanced architectures use the $\mathsf{lp}^{3, 7}_{20}$ memory.