Willow's 99.99% magic states sit a million times short of cracking RSA keys

The Quantum AI team at Google said in a paper that appeared Thursday in Science that on its Willow chip, it trimmed errors in “magic states” by about 40 times.

These states still need to become about a million times more accurate before quantum code-breaking is viable.

Willow cuts magic-state errors 40-fold

Google says the method, dubbed magic state cultivation, attained 99.99% logical fidelity on the Willow processor.

Quantum computing is feasible thanks to magic states. Basic operations are handled by error correction, but these states are like fuel for the tougher ones that exceed classical computing.

Google cites estimates that the process of producing them could consume up to 95% of a machine’s capacity, leaving scant room for actual work.

A 40-fold cut makes a dent but doesn’t remove the bottleneck, and Google said cultivation needs to be demonstrated on a far bigger scale before it can be put to practical use.

In 2024, Craig Gidney, Noah Shutty and Cody Jones devised the method at Google by taking a prior theoretical idea and refining it. Cultivation acts like a filter.

A state with noise enters a confined region of the chip, where coordinated measurements hunt for errors. Attempts that don’t work get discarded, and the ones that do are retained.

Research scientist Emma Rosenfeld repeatedly got outcomes that seemed implausible. After digging for months, the team finally found that temperature variations and lab noise from equipment drift had warped their benchmark.

The remedy was to grant the system more control, and the team also conceived the idea of employing cultivation as a fresh way to benchmark itself.

Moving a purified state from a distance-3 color code to a distance-5 surface code, a step called “grafting,” is another thing Google has shown. These are two ways to structure error correction. In the future, machines may need to combine both error correction methods to stay reliable without bloating the hardware.

Factoring RSA-2048 needs errors near one in 10 billion

A 99.99% fidelity rate means there is about one error in every 10,000. To factor an RSA-2048 key, the paper says, you would need magic states with errors of about 1 in 10 billion, which is a million-fold difference.

Craig Gidney estimated in 2025 that RSA-2048 could be broken with less than a million noisy qubits. Cultivation is one of the ingredients in this estimate. On Thursday, Bitcoin traded near $82,165.

Fewer than 500,000 physical qubits would be needed to crack Bitcoin’s 256-bit elliptic-curve cryptography, according to a Google Quantum AI study, a figure ~80% lower than earlier estimates.

According to the study, an adequately powerful machine could reroute a live transaction in about nine minutes, with a 41% success rate.

Per estimates from Coinbase and Project Eleven, wallets with public keys already on the blockchain hold about 7 million BTC. That’s about a third of the entire BTC supply, a pool that swelled with Bitcoin’s Taproot upgrade.

Willow has 105 physical qubits, nowhere near the half million that the math for the attack requires.

Google’s schedule for post-quantum cryptography is in 2029.

Bitcoin, for now, has just one proposal, BIP 360, for quantum-safe addresses, and no plan to move everyone over.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.