I don't share his "optimism". The steps from 1 to 2 qbits at 2 nines reliability to a million physical qbits at 5 nines reliability to provide the necessary count of logical qbits for a non trivial shor, is enormous.
I see nothing like moores law pace of change. My neg says we're still 10+ years off.
> To clarify — if, before the 2028 presidential election, a fully fault-tolerant Shor’s algorithm was used even just to factor 15 into 3×5, I would view the “live possibility” here as having come to pass.
Now that might sound a bit disappointing, as factoring 15 only requires 7 logical qubits and ~20 entangling gates, but
- Usable logical qubits were a pipe dream only a few years ago.
- He's partly coming from the perspective that Nature might somehow make quantum computing impossible by destroying quantum information before it gets 'big enough' to do real quantum computing. Even showing fault tolerance on small scales would be enough to falsify this.
One other thing, your numbers are too pessimistic. Multiple technologies have demonstrated 100+ qubits at 3 nines. Factoring cryptographically relevant numbers needs ~1,000,000 qubits at ~3 nines [1]. So like he says, many of the core technological and scientific challenges have been solved, and progress is now largely (though not entirely) a matter of scaling.
The qbit count jumping from 15 to 21 is instructive, it's said to be a non linear jump. And remember rsa2048 is now routine.
But your points are well made. I threw "useful" into the mix but he's saying any functionality, would be a significant milestone.
Perhaps I misunderstood but I find cohorts of 3 nines reliability not very reassuring. Either you need significantly more "gates" or you need repeated calculation and as gate count rises with factoring complexity I believe the same holds for digits of reliability.
I'm not in QC or cryptography btw. Amongst cryptographers that I know, I get mixed responses. Most dislike aspects of hybrid, but most also see the deep seated paranoia of future technology capabilities applying to masses of data collected and held now. Storage is cheap. Few say they think anything like as soon as "a few years" applies to even state actors backed QC attacks on real world RSA.
Of course 3 nines of reliability in directly processing information is not very useful; after ~1000 operations you would be very likely to have an error. But quantum computers do not process information that is stored in single qubits. They use quantum error correction to turn many mediocre qubits (i.e. 3 nines) into a smaller number of very good (like 18 nines) error-corrected logical qubits. These error correcting codes work fine with 3 or 4 nines. In fact I'm not aware of any platform that plans to scale by reaching 5 nines. Everyone is aiming for the 3-4 nines regime.
Incidentally, quantum error correction is the reason why you need 1 million qubits to factor as RSA number. Shor's algorithm only needs Few thousand, but error correction adds lot of overhead.
I don't share his "optimism". The steps from 1 to 2 qbits at 2 nines reliability to a million physical qbits at 5 nines reliability to provide the necessary count of logical qbits for a non trivial shor, is enormous.
I see nothing like moores law pace of change. My neg says we're still 10+ years off.
From the comments section, Scott says
> To clarify — if, before the 2028 presidential election, a fully fault-tolerant Shor’s algorithm was used even just to factor 15 into 3×5, I would view the “live possibility” here as having come to pass.
Now that might sound a bit disappointing, as factoring 15 only requires 7 logical qubits and ~20 entangling gates, but
- Usable logical qubits were a pipe dream only a few years ago.
- He's partly coming from the perspective that Nature might somehow make quantum computing impossible by destroying quantum information before it gets 'big enough' to do real quantum computing. Even showing fault tolerance on small scales would be enough to falsify this.
One other thing, your numbers are too pessimistic. Multiple technologies have demonstrated 100+ qubits at 3 nines. Factoring cryptographically relevant numbers needs ~1,000,000 qubits at ~3 nines [1]. So like he says, many of the core technological and scientific challenges have been solved, and progress is now largely (though not entirely) a matter of scaling.
[1] https://arxiv.org/abs/2505.15917
The qbit count jumping from 15 to 21 is instructive, it's said to be a non linear jump. And remember rsa2048 is now routine.
But your points are well made. I threw "useful" into the mix but he's saying any functionality, would be a significant milestone.
Perhaps I misunderstood but I find cohorts of 3 nines reliability not very reassuring. Either you need significantly more "gates" or you need repeated calculation and as gate count rises with factoring complexity I believe the same holds for digits of reliability.
I'm not in QC or cryptography btw. Amongst cryptographers that I know, I get mixed responses. Most dislike aspects of hybrid, but most also see the deep seated paranoia of future technology capabilities applying to masses of data collected and held now. Storage is cheap. Few say they think anything like as soon as "a few years" applies to even state actors backed QC attacks on real world RSA.
Of course 3 nines of reliability in directly processing information is not very useful; after ~1000 operations you would be very likely to have an error. But quantum computers do not process information that is stored in single qubits. They use quantum error correction to turn many mediocre qubits (i.e. 3 nines) into a smaller number of very good (like 18 nines) error-corrected logical qubits. These error correcting codes work fine with 3 or 4 nines. In fact I'm not aware of any platform that plans to scale by reaching 5 nines. Everyone is aiming for the 3-4 nines regime.
Incidentally, quantum error correction is the reason why you need 1 million qubits to factor as RSA number. Shor's algorithm only needs Few thousand, but error correction adds lot of overhead.