A screenshot went viral yesterday. The claim: a researcher used a "home-built QPU stack" to factor RSA1024-1, calling it an "alarming sign that RSA-1024 will soon be broken."
It isn't. Here's exactly why, and why the distinction matters more than the headline.
Corrected 21 September 2026. An earlier version of this post misstated the factorization history of 2^1024 - 1, cited a resource-estimate paper that is about elliptic curves rather than RSA, gave qubit counts without sources, speculated about the author's intent, and described an internal module as a product. Each of those is fixed below, and the post was off the site until it was.
The Number That Was Actually Factored
RSA1024-1 is not an RSA modulus. It is 2^1024 − 1.
These are fundamentally different objects:
RSA-1024 modulus |
2^1024 − 1 |
|
|---|---|---|
| Structure | Product of exactly two large primes p × q |
Mersenne-style composite with many small factors |
| Why hard to factor | No known subexponential classical algorithm for generic semiprimes | Not hard: classical algorithms handle it in seconds |
| Relation to RSA security | IS the RSA security assumption | Has zero relation to RSA security |
2^1024 − 1 is highly composite. It is exactly the product of the first ten Fermat numbers, F0 through F9, and every one of them has been factored: Euler found the first factor of F5 in 1732, and F9 fell to a special number field sieve effort in 1990. The full factorization has been known ever since. Running Shor's algorithm on 2^1024 − 1 is the cryptographic equivalent of announcing you've "broken" a safe by opening it with the combination written on a Post-it note taped to the door.
A classical Python script can verify this:
from sympy import factorint
n = 2**1024 - 1
print(factorint(n, limit=10000))
# Partial on purpose: trial division to 10^4 only, so it leaves a large cofactor.
# The full factorization of 2**1024 - 1 is known because the number is the product
# of the first ten Fermat numbers, not because factoring is easy: the last of them
# (F9) took a special number field sieve effort in 1990.
This tells us nothing about the hardness of factoring RSA moduli.
Why Shor's Algorithm Can't Do This at Home (Yet)
Even granting the benefit of the doubt and assuming a genuine quantum computation was attempted: the resource requirements for running Shor's algorithm on an actual RSA-1024 modulus are well-established in the literature.
Beauregard (2003) established the asymptotic gate count. Roetteler et al. (2017) did the same accounting for elliptic curves rather than RSA. The published numbers for RSA:
- About 2,051 logical qubits for a 1024-bit modulus: Beauregard's circuit uses 2n+3 qubits.
- 20 million noisy physical qubits and about 8 hours for RSA-2048 (Gidney and Ekera, 2019, arXiv:1905.09749).
- The 2025 revision: under 1 million noisy physical qubits (Gidney, arXiv:2505.15917). The gap between logical and physical qubits is error correction.
- One caveat: those figures are for RSA-2048. RSA-1024 is smaller, and still far beyond any hardware that exists
The largest publicly disclosed processors today hold low thousands of physical qubits, with error rates still far from what fault tolerance at this scale needs. A "home-built QPU stack" capable of this computation does not exist. If it did, it would be the single most significant physics achievement in human history, not a gist.github.com link.
The Bell Inequality Line Is a Red Flag
The terminal screenshot shows:
[WARN] Bell inequality violated within tolerance
This warning does not appear in Shor's algorithm implementations. Bell inequality tests (CHSH, GHZ) are used to verify entanglement in quantum hardware characterization, and they measure whether two-qubit correlations exceed the classical bound of 2 in the CHSH formulation. They are a diagnostic for proving your qubits are genuinely quantum.
Seeing this warning in the middle of a period-finding computation is like seeing a "tire pressure nominal" alert during a CPU benchmark. It doesn't belong there. Its presence suggests either:
a) The terminal output is synthetic, or
b) Someone assembled a script that calls disparate quantum subroutines without understanding what each one does
Neither interpretation supports the claim.
The Author Is a Real Cryptographer, Which Is the Point
JP Aumasson (@veorq) is not a crank. He co-designed BLAKE2 and SipHash and wrote Serious Cryptography (No Starch Press). He knows exactly what 2^1024 − 1 is.
We do not know the intent, and we are not going to guess at it. What the spread shows is how far a claim about a number travels before anyone reads the number. Most of the replies argued about the claim rather than the math.
The correct response is not outrage. It's precision.
What Real Quantum Threat Modeling Looks Like
The genuine quantum threat to RSA and ECC is real, well-documented, and time-bounded, but the clock runs differently than viral screenshots suggest.
Harvest Now, Decrypt Later (HNDL): Adversaries are storing encrypted traffic today under the assumption they will decrypt it when cryptographically-relevant quantum computers (CRQCs) arrive. For long-lifecycle secrets (state communications, medical records, decade-scale infrastructure keys), the threat window opens now, not when the breaking machine exists.
NIST's answer: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), all final as of August 2024. In the United States, Executive Order 14412 (June 2026) requires federal high value assets and high impact systems to use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. The EU's coordinated roadmap asks Member States to finish their high-risk use cases by the end of 2030.
The actual migration risk isn't a QPU breakthrough. It's organizations that haven't started their cryptographic inventory, and won't know they're vulnerable until it's a forensic exercise.
At Matrix CR Studio an assessment is three steps: an inventory of the cryptography an organization runs, an exposure ranking, and a migration plan. Each step is sealed as a signed receipt, and the whole file can be checked offline with a free checker.
The threat is a machine of the size in those published estimates, years away rather than weeks, built at a scale no home lab reaches.
Summary
| Claim | Reality |
|---|---|
Factored RSA1024-1 |
Factored 2^1024 − 1, a trivially composite number |
| Alarming for RSA-1024 | Has zero bearing on RSA security |
| Home-built QPU stack | RSA-1024 requires ~2M to 20M physical qubits; no such machine exists |
| Bell inequality warning in Shor's algo | Wrong context: that diagnostic doesn't appear in period-finding code |
RSA-1024 will eventually be broken by quantum computers. That is real, documented, and the basis of a decade of NIST standardization work. It will not happen via a GitHub gist, and it will not be announced on a timeline set by reposts rather than by a paper the physics community can read.
When the breakthrough happens, you will know it because every cryptographer in the world is reading the preprint at the same time.
Until then: migrate to post-quantum standards. Start your cryptographic inventory now. Don't trust viral terminal screenshots.
Matrix CR Studio builds post-quantum migration evidence: the inventory, the exposure ranking and the plan, sealed as receipts anyone can check. Research inquiries: [email protected]