💻 Quantum
Today’s Best Quantum Error Code Uses 1,500 Qubits to Protect One. A Finnish Lab Says It Needs 30.
IQM’s “barbell codes” claim constant qubit overhead regardless of distance, collapsing the RSA-2048 resource estimate from 20 million physical qubits to under 600,000 and potentially moving the encryption-breaking timeline up a decade.
Thirty. That is how many physical qubits IQM Quantum Computers claims it needs to protect a single logical qubit from errors, using a new error-correcting code family called “barbell codes.” The reigning champion, the surface code, needs 200 to 1,500 physical qubits to do the same job, depending on the code distance and the noise environment of the processor, which means the gap between the two approaches is not a modest engineering optimization but a structural divergence in how much silicon you need to buy and cool to near absolute zero before a quantum computer can do anything useful. That changes everything.
Published on arXiv June 4 by eight IQM researchers, the paper claims barbell codes achieve logical error rates up to 1,000 times lower than the surface code using up to eight times fewer physical qubits. But the consequential detail is buried in a property neither headline captures: the hardware complexity of barbell codes stays constant as you increase the code distance, while surface code overhead grows quadratically. At low distances, barbell codes are merely better. At high distances, the ones you actually need for useful computation, the advantage compounds into a decisive engineering edge.
Error Correction’s Crushing Tax
Every quantum computer pays an error-correction tax because physical qubits are extraordinarily fragile. They fail at rates around one mistake per thousand operations, so engineers spread quantum information across many physical qubits and run continuous correction cycles, burning the vast majority of their hardware budget on redundancy rather than computation, which is why a machine with 1,000 physical qubits might deliver fewer than 10 usable logical ones. Developed in the late 1990s and refined over two decades, the surface code has become the industry’s default approach to quantum error correction because it works on simple, nearest-neighbor hardware connectivity that existing chips can actually build. Google’s Willow chip demonstrated a distance-7 surface code using 101 physical qubits at a 0.143% per-cycle error rate. It was the first clear proof that adding qubits actually helps rather than just adding noise.
But the surface code encodes one logical qubit using roughly d² physical qubits, where d is the code distance, which measures how many errors the code can detect and correct. A distance-7 code uses about 100 qubits, which is roughly what Google’s Willow has today. A distance-27 code, needed for cryptographically relevant computation at today’s noise levels, uses about 1,460 per logical qubit. You need thousands of logical qubits for any algorithm that matters, and that is how you get to 20 million.
A Calculation Nobody Has Run
Breaking RSA-2048 encryption, the kind that protects most of the internet, has a canonical resource estimate: a 2019 paper by Craig Gidney (Google) and Martin Ekerå (KTH/Swedish Armed Forces) calculated approximately 20 million noisy physical qubits running for 8 hours, assuming a surface code cycle time of 1 microsecond and a physical error rate of 10&supmin;³.
Nobody, as far as I can find, has run that estimate through barbell codes. So I did.
Gidney and Ekerå require approximately 6,189 logical qubits for 2048-bit factoring. At today’s noise levels (10&supmin;³), each needs a code distance around 27, roughly 1,460 physical qubits per logical qubit, and once you add routing overhead, ancilla qubits, and the physical wiring that lets distant logical qubits talk to each other during a computation, you reach about 3,200 physical per logical, or approximately 20 million total. Scale check: today’s largest quantum computer has about 1,200 qubits. Twenty million would require roughly 17,000 times that.
Two things change simultaneously when you swap in barbell codes. First, IQM’s Constellation processor targets a physical error rate of 10&supmin;⁴, ten times better than the surface code baseline. At that noise level, the surface code already improves: you only need distance 11 instead of 27, dropping to about 240 physical qubits per logical qubit, or roughly 2.2 million total. Better hardware alone buys you 10x.
But replace the surface code with barbell codes at the same 10&supmin;⁴ noise, and the arithmetic enters a different regime entirely. The paper’s simulations show fewer than 30 data qubits per logical qubit achieving per-cycle error rates below 10&supmin;¹², sustained for several trillion error-correction cycles, which means the code can protect quantum information for hours of continuous computation without a single uncorrectable failure propagating through the logical layer. Adding syndrome-measurement qubits and routing overhead, a conservative 2–3x multiplier, you get roughly 370,000 to 560,000 total physical qubits.
| Scenario | Physical error rate | Code type | Qubits per logical | Total for RSA-2048 | Reduction |
|---|---|---|---|---|---|
| Gidney/Ekerå baseline | 10&supmin;³ | Surface code (d≈27) | ~3,200 | ~20,000,000 | 1× (baseline) |
| Better hardware only | 10&supmin;⁴ | Surface code (d≈11) | ~360 | ~2,200,000 | ~9× |
| Better hardware + barbell codes | 10&supmin;⁴ | Barbell code (<30 data) | ~60–90 | ~370,000–560,000 | ~35–55× |
Combined, better hardware and better error-correcting codes working simultaneously yield a 35–55× reduction from the canonical 20-million-qubit estimate. That is the difference between needing a quantum computer nobody knows how to build and needing one that fits on IBM’s published roadmap within a decade.
What the Timeline Looks Like Now
IBM’s quantum roadmap targets Blue Jay by 2033: a fault-tolerant system with about 2,000 logical qubits and roughly 100,000 physical qubits, built on bivariate bicycle codes (IBM’s own LDPC variant, which also claims approximately 90% overhead reduction over surface code). If barbell-code performance holds and 10&supmin;⁴ hardware materializes, RSA-2048 factoring would require 4–6 times more qubits than Blue Jay, perhaps 2–3 additional doubling periods at quantum computing’s current scaling pace of roughly 2–3 years per doubling, placing the timeline somewhere around 2037–2042.
Without barbell codes, sticking with the surface code at current noise levels, you need 200 times more qubits than Blue Jay, which translates to seven or eight doublings. That pushes the timeline to 2048–2057, if it happens at all. The difference between those two scenarios is a full generation of cryptographic planning.
Why You Should Be Skeptical
IQM’s barbell codes are simulated results, not experimental demonstrations. Nobody has built a barbell-code logical qubit and tested it against thermal noise, cosmic rays, or crosstalk in a cryostat running at 15 millikelvin. Those 1,000x and 8x improvement figures are “up to” numbers, best-case instances of a specific code family running on a bespoke processor topology called Constellation, with 12-qubit connectivity that no other company uses, since Google’s Willow runs a 4-connectivity square grid and IBM’s processors use 3-connectivity heavy-hex. Barbell codes are designed for hardware that does not yet exist at the distances needed for the claims to matter, and the codes may not port to architectures anyone else is building.
IQM is also going public through a SPAC merger with Real Asset Acquisition Corp. (Nasdaq: RAAQ), which means the company is preparing to sell shares to public investors at the same time it is publishing performance claims that, if validated, would represent one of the most consequential advances in quantum computing this decade. That does not make the paper wrong. But it makes the timing conspicuous and the “up to” framing worth scrutinizing with extra care.
The competitive landscape makes the outcome less certain than any single paper implies. IBM’s bivariate bicycle codes, published in Nature in 2024, also target massive overhead reduction through LDPC techniques. Microsoft is pursuing topological qubits through its Majorana program. A separate team using reconfigurable atomic qubits recently estimated RSA-2048 could be factored with as few as 102,000 qubits. Barbell codes are a strong contender in a crowded field, not a guaranteed winner.
What We Do Not Know
This analysis assumes 10&supmin;⁴ physical error rates, 10 times better than today’s best superconducting platforms. If hardware stalls at 5×10&supmin;⁴, barbell code performance degrades, and the paper provides no data for intermediate noise levels. The routing overhead factor used here (2–3x) comes from surface-code architectural studies; barbell codes may differ depending on their gate-operation topology, which the paper addresses only for multi-Pauli measurements, not arbitrary logical gates. Independent replication outside IQM has not been published. And the Gidney/Ekerå estimate itself assumes algorithmic optimizations that have not been experimentally validated at scale.
The Bottom Line
For thirty years, the quantum threat to encryption has lived in the realm of “eventually.” The canonical estimates said “20 million qubits” in a tone that meant “relax.” IQM’s barbell codes do not break encryption, and they do not even exist in hardware yet. But the math they introduce — constant overhead per logical qubit, regardless of code distance — compresses the resource gap by 35–55x when combined with plausible near-term hardware improvements, which is enough to pull the most credible threat timeline forward from the mid-2050s, when most cryptographic planners assumed they could safely ignore the problem, into the late 2030s, when many of today’s TLS certificates and VPN tunnels will still be in active service.
If you manage cryptographic infrastructure for an enterprise, a bank, or a government agency, the planning horizon for post-quantum migration just shortened. NIST finalized its first three post-quantum encryption standards in August 2024 (ML-KEM, ML-DSA, SLH-DSA), and most organizations have barely started migrating. Barbell-code math suggests the buffer may be a decade thinner than assumed. Audit your TLS certificate chains. Inventory every system that still depends on RSA or ECDSA. Begin your migration plan now. Not because 30 qubits broke RSA, but because 30 qubits rewrote the math on when someone else will.