Even if the number of qubits doubled every year from here on out, it would be 15+ years until we had enough working space to run Shor's algorithm on modern cryptographic key sizes.
Back of the envelope:
- It takes 9n error-corrected qubits to break an n-bit ECDH key [1]
- Each error-corrected qubit requires ~2500 physical qubits [2][3]
- Typical ECDH key size is 256 bits [4]
- This year would be the year of ~64 physical qubit machines. [5][6][7]
- log_2(256 * 9 * 2500 / 64) ~= 16.4 years
Note that every one of the quantities in the estimate is subject to future research. E.g. the error corrected qubit size is smaller when using lattice surgery, but not enough to really move the needle on the time estimate.
Back of the envelope:
- It takes 9n error-corrected qubits to break an n-bit ECDH key [1]
- Each error-corrected qubit requires ~2500 physical qubits [2][3]
- Typical ECDH key size is 256 bits [4]
- This year would be the year of ~64 physical qubit machines. [5][6][7]
- log_2(256 * 9 * 2500 / 64) ~= 16.4 years
Note that every one of the quantities in the estimate is subject to future research. E.g. the error corrected qubit size is smaller when using lattice surgery, but not enough to really move the needle on the time estimate.
[1]: https://arxiv.org/abs/1706.06752
[2]: See section VI of https://arxiv.org/abs/1805.03662
[3]: https://docs.google.com/presentation/d/e/2PACX-1vReeRxH80Ruu...
[4]: https://crypto.stackexchange.com/a/47337/7860
[5]: https://ai.googleblog.com/2018/03/a-preview-of-bristlecone-g...
[6]: https://www-03.ibm.com/press/us/en/pressrelease/53374.wss
[7]: https://newsroom.intel.com/press-kits/quantum-computing/#49-...