Quote from: HeRetiK on June 22, 2020, 04:19:49 PM

Quote from: Cnut237 on June 22, 2020, 02:26:06 PM

Quote from: HeRetiK on June 22, 2020, 10:41:07 AM

Processing power of quantum computers may increase more rapidly relative to classical computers but it does not in terms of qbits gained. Quantum computers still need to increase their processing power by a factor of 20-30 before things get interesting.

20 to 30x is only an extra 4 or 5 qubits, though (2^4=16, 2^5=32).

No, I mean literally in terms of qubits. Google latest quantum chip is at 72 qubits (up from 54 qubits last year). The estimates I found on how many qubits are required to break ECDSA are conflicting, but most sources place it at 1500-3000 qubits.

Quote from: Cnut237 on June 22, 2020, 02:26:06 PM

I suppose what I'm trying to say is that it's very difficult to estimate when a QC that is capable of cracking bitcoin might become available, and that we can't use the development history of classical computers as a guideline. The challenges to building a workable, reliable large-scale QC do remain immense, but we are all aware that work is continuing at pace, and a QC threat to bitcoin may be with us soon than we might envisage. I do think it's important that making bitcoin quantum-safe be considered as a problem to resolve now, rather than at some indefinite point in the future.

Agreed.

The lowest number of physical qubits in order to break secp256k1 ECDSA is more than 10⁶ - yes, one million - and this is assuming at least 10 times better error rate, than the current record one. The 1-3k number is for perfect logical qbits. Additionally 10¹¹ Toffoli gates are needed. All this has to work in perfect sync without errors.

But I highly doubt it would ever work. Before spitting out a solution, the system would have to simultaneously represent 2²⁵⁶ states. Obviously all and every physical disturbance would destroy the state, and render the computation futile. A neutrino is enough to turn this billions dollars equipment useless.