Problem A Is Still RSA

NVIDIA’s press release on its record quantum simulation at Jülich names the fields it expects to benefit. Drug discovery comes first. Cryptography never appears.

The simulation is serious work. NVIDIA and Jülich researchers modeled a magic-state preparation protocol spanning 104 physical qubits on 8,192 GH200 GPUs of JUPITER, Europe’s first exascale machine. The protocol starts in a distance-3 color code and grows into a distance-7 hybrid of color and surface codes, checking for faults on the way. The noise model carries coherent phase errors and leakage, with selected qubits given a third energy level, physics that a model of random bit flips leaves out. The quantum state alone filled 512 TiB of GPU memory.

The technique has a name, and a 2025 Google paper explains why it matters to anyone holding an RSA key. Craig Gidney cut his estimate for factoring RSA-2048 from 20 million noisy qubits to under a million, and magic state cultivation is one of the reductions he credits. Magic states are what a fault-tolerant quantum computer consumes to run the operations its error correction cannot perform cheaply, and his estimate feeds them into 6.5 billion Toffoli gates. NVIDIA pointed eight thousand GPUs at a load-bearing assumption of the leading estimate for breaking RSA. Then it talked about medicine.

Four days earlier, Google reported in Science that cultivation works on its Willow chip, cutting magic-state errors about 40-fold. Willow grafted a distance-3 color code into a distance-5 surface code. JUPITER modeled a larger configuration, with leakage written into the noise model. Two companies tested the same component of the leading RSA attack estimate in one week, one on a chip and one on an exascale machine. NVIDIA’s release mentions neither Google nor Willow.

Problem A

ENIAC’s service log recorded its first real job as “Problem A”, dated December 10, 1945. The problem came from Los Alamos. It tested Teller’s approach to the Super, the hydrogen bomb, and used about 95% of the machine’s control capacity. The physicists simplified the calculation to lower its classification, and the program remains classified today.

Two months later the Army let the press in. At the public unveiling on February 15, 1946, ENIAC computed the trajectory of an artillery shell in 20 seconds, faster than the 30 seconds the shell took to fly. The bomb was the first problem. The shell was the demonstration.

Britain buried its machine outright. Colossus was working at Bletchley Park by the end of 1943, breaking the Lorenz cipher of the German Army High Command. After the war Churchill had most of the machines broken up. Two went to GCHQ, which kept them running against Soviet codes. The official silence about Bletchley lasted until 1974.

The founding machines of electronic computing were a codebreaking engine and a weapons calculator. The public story of each left its first job out.

The line runs to Jülich. Forschungszentrum Jülich was founded in 1956 as an atomic research facility and spent its first decades on nuclear energy. JUPITER cost about €500 million to build and run for six years, half from the EuroHPC Joint Undertaking and half from the federal research ministry and North Rhine-Westphalia. Its booster runs on 24,000 NVIDIA GH200 superchips. Chancellor Merz inaugurated it in September 2025 as Europe’s chance to catch up. A year later a record set on that public machine went out under the headline “NVIDIA Runs Record Simulation,” with a link to Huang’s GTC keynote in Berlin.

Nothing is hidden this time. Gidney published his estimate openly, and Google keeps a public chart of the falling cost of quantum factoring. The silence sits in the press release, the document a board member or an investor actually reads.

Magic

Sergey Bravyi and Alexei Kitaev supplied the name in a paper submitted in 2004. Their protocols consume several noisy copies of a quantum state to produce one cleaner copy, and they work only along certain directions the authors called magic. Above a threshold of about 65% polarization, the purification converges on a pure state, which they named a magic state. Clifford operations, which error-correcting codes handle comfortably, become universal once magic states are added. The field described the process with the alchemist’s word: distillation.

Distillation is expensive. Factories for it took up a large share of the machine in earlier estimates, and Gidney’s 2025 paper gets part of its savings by allocating less space to them. In 2024 Gidney, Noah Shutty and Cody Jones proposed something closer to a garden. Cultivation plants one rough state in a small patch of the chip and checks it repeatedly. Any attempt that fails a check is thrown away, and survivors grow into a larger code. On Willow about 8% of attempts passed every check.

Alchemy gave way to agronomy. Defenders already use a farming word for the threat: harvest now, decrypt later.

The Falling Line

Peter Shor published his factoring algorithm in 1994. For years nobody could say how large the machine had to be, and only around 2009 did estimates become precise enough to count qubits. Since then the number has only gone down.

Google notes that the 2012 and 2019 figures rest on the same physical assumptions, and Gidney’s 2025 estimate kept them. Pinnacle replaces surface codes with quantum LDPC codes. Gidney has questioned whether the classical decoding that reads its error checks can keep up at the speed it assumes.

That is four orders of magnitude off the qubit count in fourteen years. Real machines grew roughly a hundredfold over the same stretch. One line falls while the other climbs.

Every point on the falling line is a stack of assumptions about components nobody had built. Cultivation was one of those in the 2025 estimate. This month it ran on a chip at small scale and was modeled on an exascale machine under noise that includes leakage. The counterweight belongs in the record as well. The Willow paper notes that RSA-2048 needs magic states with errors near one in ten billion, roughly a million times cleaner than Willow produced. What moved this week was one assumption, from paper toward measurement.

The assumptions do not only move one way. The 2024 cultivation paper benchmarked its larger circuit on a stand-in, with S gates in place of T gates, so that a fast Clifford simulator could run it. Its headline figure, an error of 2 in a billion, came from that stand-in. In December 2025 a team at the Chinese Academy of Sciences ran the real circuit, 200 billion shots on 16 NVIDIA H800 GPUs over 20 days, and found the logical error rate nearly an order of magnitude above the published value. In September, researchers at Oxford and Imperial College showed why: the circuit catches fewer combinations of faults than designed, and three faults can slip past every check where the stand-in needs five. They warn that this “raises concerns for resource estimates” that rely on cultivation. A second group confirmed that count by exact calculation. Gidney’s RSA estimate takes cultivated states at an error of 1 in 10 million from the same paper’s curves and feeds them into a distillation stage that squares the error. An error ten times worse at that stage would cost failed runs and factory time, not an order of magnitude of qubits. The correction narrows a margin. It does not move the line.

The press release and the engineering post part ways on measurement. The release says the simulation validates an approach needing 90% fewer physical qubits and shortens the path to viable quantum computers by years, and it measures the work against an earlier noiseless 50-qubit run at Jülich. The engineering post describes a detailed reference simulation and a yardstick for testing cheaper approximations. Its numbers describe the simulation itself, such as memory per GPU and agreement with tensor-network methods at small scale. It reports no logical error rate for the cultivated state and no acceptance rate, and it calls connecting the simulation to the quality and cost of logical operations a longer-term objective. Sixteen GPUs produced that number for the distance-5 circuit. The 8,192 on JUPITER have not reported one.

Coverage of the announcement cites the engineering post as the technical report behind the release, and the 90% figure appears nowhere in it. The nearest published number is the 2024 paper’s claim of an order of magnitude fewer qubit·rounds than distillation, a measure of space and time together rather than of qubits. It gives the GPU count as 8,192 in three places and 8,912 in a fourth.

Fifteen to Thirty Years

NVIDIA’s own timeline has moved faster than anyone’s qubits. At CES in January 2025, Jensen Huang told analysts that 15 years until very useful quantum computers would be on the early side and 30 on the late side. Pure-play quantum stocks lost roughly a third of their value in a day. Two months later he opened NVIDIA’s first Quantum Day by joking that he had invited his guests to explain why he was wrong, and announced the Boston research center that later served as the development platform for the JUPITER run. Twenty-one months separate “15 to 30 years” from “shortening the path by years.”

The Rising Line

Defenders started their curve in an odd week. The NSA announced Suite B, its public elliptic-curve suite for protecting classified information, on February 16, 2005. Six days later Physical Review A published Bravyi and Kitaev’s magic-state paper. The curves and an ingredient of the machine that breaks them entered the record in the same week.

Ten years later the agency told partners and vendors that had not yet moved to Suite B not to spend significantly on it and to prepare for quantum-resistant algorithms instead. Michele Mosca turned the race into an inequality in 2018: when the years data must stay secret plus the years a migration takes exceed the years until a capable quantum computer exists, the data is exposed. NIST finalized its first three post-quantum standards in August 2024. Executive Order 14412, signed on June 22, 2026, names the risk of adversaries collecting information now to decrypt later, and sets deadlines for post-quantum key establishment and digital signatures.

The rising line is measurable on European critical infrastructure. Of 1,484 public endpoints in NIS2 sectors, 42.3% negotiate post-quantum key exchange, according to the [PQ]probe NIS2 Monitor. They gain about two points a month, which projects to full migration in 2028. Key exchange answers the harvest, and vendors can switch it on by default. Signatures answer the day the machine arrives, and they move at the pace of certificate authorities and hardware.

Faster Than the Shell

The ENIAC demonstration impressed reporters for one reason. The machine finished the trajectory before the shell landed. Mosca’s inequality asks whether a migration lands before the machine does. The attack line has fallen four orders of magnitude in fourteen years. This month one of its load-bearing assumptions ran on Google’s Willow chip and was modeled on JUPITER, weeks after academic work explained why it falls short of its published figure and how to repair it. NVIDIA showed the public drug discovery.

Problem A is still RSA.