Cat qubits provide appealing building blocks for quantum computing. They exhibit a tunable noise bias yielding an exponential suppression of bit-flips with the average photon number and a protection against the remaining phase errors can be ensured by a simple repetition code. We here quantify the cost of a repetition code and provide a valuable guidance for the choice of a large scale architecture using cat qubits by realizing a performance analysis based on the computation of discrete logarithms on an elliptic curve with Shor's algorithm. By focusing on a 2D grid of cat qubits with neighboring connectivity, we propose to implement two-qubit gates via lattice surgery and Toffoli gates with off-line fault-tolerant preparation of magic states through projective measurements and subsequent gate teleportations. All-to-all connectivity between logical qubits is ensured by routing qubits. Assuming a ratio between single-photon and two-photon losses of
10−5 and a cycle time of 500 nanoseconds, we show concretely that such an architecture can compute
256-bit elliptic curve logarithm in
9 hours with 126133 cat qubits. We give the details of the realization of Shor's algorithm so that the proposed performance analysis can be easily reused to guide the choice of architecture for others platforms.
We present a 1D repetition code based on the so-called cat qubits as a viable approach toward hardwareefficient universal and fault-tolerant quantum computation.The cat qubits that are stabilized by a twophoton driven-dissipative process exhibit a tunable noise bias where the effective bit-flip errors are exponentially suppressed with the average number of photons.We propose a realization of a set of gates on the cat qubits that preserve such a noise bias.Combining these base qubit operations, we build, at the level of the repetition cat qubit, a universal set of fully protected logical gates.This set includes single-qubit preparations and measurements, NOT, controlled-NOT, and controlled-controlled-NOT (Toffoli) gates.Remarkably, this construction avoids the costly magic state preparation, distillation, and injection.Finally, all required operations on the cat qubits could be performed with slight modifications of existing experimental setups.
One of the strengths of our recently proposed Walking Cat Architecture for a trapped-ion quantum computer is that it is straightforward to extend and optimize for a specific application. As a proof-of-concept, here we present such optimizations for solving the
256-bit elliptic curve discrete logarithm problem (ECDLP) on
secp256k1, which is the elliptic curve used by blockchain technologies such as Bitcoin, using Shor's algorithm. We optimize the circuits from Schrottenloher's recent work and arrive at a logical quantum circuit for solving the ECDLP using about
1450 qubits and
40⋅106 Toffoli gates, with a rigorous lower bound on the logical-level success probability that holds with confidence at least
1−2−128. Using our compilation toolchain with manual optimization of the logical layout and integrated routing, we produce estimates for the logical measurement depth and the required number of physical qubits by compiling all components to measurement schedules that obey the architectural constraints. A key ingredient is a fast CCZ magic-state factory and a depth-one CCZ state injection, reducing the execution time of CCZ gates by a factor of
31. We increase the logical-measurement parallelism using non-overlapping cat-based measurements in parallel, and we leverage the recently proposed logical CliNR protocol to speed up Clifford operations. To reduce the qubit overhead, we introduce a more efficient loss correction protocol, design a layout that allows us to recycle the CliNR ancilla qubits, and provision reusable cat-state resources according to the circuit's peak measurement parallelism. All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture can solve the ECDLP on
secp256k1 in approximately 25.7 days using 19,397 physical qubits with an estimated success probability of
63%.
We estimate and analyze the error rates and the resource overheads of the repetition cat qubit approach to universal and fault-tolerant quantum computation. The cat qubits stabilized by two-photon dissipation exhibit an extremely biased noise where the bit-flip error rate is exponentially suppressed with the mean number of photons. In a recent work we suggested that the remaining phase-flip error channel could be suppressed using a one-dimensional repetition code. Indeed, using only bias-preserving gates on the cat qubits, it is possible to build a universal set of fault-tolerant logical gates at the level of the repetition cat qubit. In this paper we perform Monte Carlo simulations of all the circuits implementing the protected logical gates, using a circuit-level error model. Furthermore, we analyze two different approaches to implement a fault-tolerant Toffoli gate on repetition cat qubits. These numerical simulations indicate that very low logical error rates could be achieved with a reasonable resource overhead, and with parameters that are within the reach of near-term circuit QED experiments.
We use Shor's algorithm for the computation of elliptic curve private keys as a case study for resource estimates in the silicon-photonics-inspired active-volume architecture. Here, a fault-tolerant surface-code quantum computer consists of modules with a logarithmic number of non-local inter-module connections, modifying the algorithmic cost function compared to 2D-local architectures. We find that the non-local connections reduce the cost per key by a factor of 300-700 depending on the operating regime. At 10% threshold, assuming a 10-
μs code cycle and non-local connections, one key can be generated every 10 minutes using 6000 modules with 1152 physical qubits each. By contrast, a device with strict 2D-local connectivity requires more qubits and produces one key every 38 hours. We also find simple architecture-independent algorithmic modifications that reduce the Toffoli count per key by up to a factor of 5. These modifications involve reusing the stored state for multiple keys and spreading the cost of the modular division operation over multiple parallel instances of the algorithm.
We present an end-to-end resource estimation of Shor's algorithm on superconducting cat qubits, from its mathematical description to the allocation and scheduling of physical qubits on a chip layout. We review modern versions of Shor's algorithm for RSA, ECDLP and FFDLP, and make their logical circuits and trade-offs explicit. We compile the dominant subroutines down to physical-qubit operations on two architectures: one based on repetition cat codes and one on LDPC cat codes. We design a parity-Cnot gate for cat qubits, extend a multi-target Cnot gate to the LDPC-cat architecture, and adapt an active injection procedure to cat qubits. Building on these primitives, we adapt to cat qubits the adder from Gidney's 2025 resource estimate for factoring RSA-2048. We combine our adder compilation and a coarser estimate for the phaseup with the factory designs and lookup compilation from the FeMoco resource estimation of Kroell et al. Together, these lead to chip layouts and schedules for factoring RSA-2048.
Assuming a 1
μs error-correction cycle time, a 10
μs reaction time, circuit-level phase-flip noise with probability
pZ=5×10−4 and no bit-flips, factoring RSA-2048, the configuration we compile in full, requires about 23 000 cat qubits and 3.14 days. Reusing the compiled operations, solving ECDLP on secp256k1 requires at most 30 000 cat qubits and 1 hour, and FFDLP-512, which we propose as an intermediate benchmark, about 6 700 cat qubits and 21 minutes. Trading space for time, RSA-2048 runs in 1.25 hours on about 611 000 cat qubits. The no-bit-flip requirement (a bit-flip time of about 100 years) can be relaxed to a bit-flip time of about one hour by adding a concatenation layer with a distance-3 bit-flip code, in which case RSA-2048 needs about 45 000 cat qubits.