Dr. Sarah ChenWhy Qubits Fail: Decoherence and Gate Errors
A quantum bit (qubit) stores information in a superposition of 0 and 1. This superposition is extremely fragile. Any interaction with the environment, including thermal vibrations, electromagnetic interference, or stray photons, can collapse the superposition or flip the qubit's state. This process is called decoherence.
In superconducting qubit systems like those used by IBM and Google, coherence times are typically measured in microseconds to milliseconds. A quantum computation that requires millions of gate operations takes far longer than a qubit can maintain its state without error. Trapped ion qubits have longer coherence times (seconds to minutes), but slower gate speeds. Every physical qubit in every modality produces errors at a measurable rate. This is not a temporary engineering limitation. Quantum mechanics guarantees that qubits will decohere.
What Quantum Error Correction Does
Quantum error correction (QEC) encodes a single logical qubit across many physical qubits. The redundancy allows the system to detect and correct errors without measuring the logical qubit's state directly (which would destroy the superposition). The encoded logical qubit can then sustain much lower error rates than any individual physical qubit.
This is conceptually similar to classical error-correcting codes used in storage and communication, but quantum error correction must handle a broader class of errors. Classical bits can only flip (0 to 1 or 1 to 0). Qubits can experience bit-flip errors, phase-flip errors, or both simultaneously. QEC codes must detect and correct all of these without learning the qubit's actual value.
The most widely studied QEC approach for near-term hardware is the surface code, developed primarily by Alexei Kitaev and refined extensively since the early 2000s. The surface code arranges physical qubits in a 2D grid, with data qubits and measurement (ancilla) qubits alternating. Measuring the ancilla qubits reveals error syndromes without disturbing the logical information.
The 1,000:1 Physical-to-Logical Qubit Ratio
How many physical qubits does one surface code logical qubit require? The answer depends on the physical error rate and the target logical error rate. The relationship is not linear: it scales with the code distance d, where the logical error rate scales as (p/p_th)^((d+1)/2), where p is the physical error rate and p_th is the surface code threshold (approximately 1% for depolarizing noise).
For current superconducting qubits with physical error rates around 0.1% to 0.3%, achieving a logical error rate suitable for deep cryptographic circuits (say, 10^-15 per gate) requires a code distance of roughly 30 to 50. A surface code at distance d requires approximately 2d^2 physical qubits. At distance 30, that is 1,800 physical qubits per logical qubit. At distance 50, that is 5,000 physical qubits per logical qubit.
The commonly cited 1,000:1 ratio is a rough round number that is approximately correct for physical error rates near 0.1% and modest circuit depths. For the deep circuits required by Shor's algorithm at cryptographic key sizes, the overhead is likely higher. A 1,000-qubit physical machine today supports at most one logical qubit, and that logical qubit would not have sufficient quality for the computation required to break ECDSA-256.
The Threshold Theorem
The threshold theorem is the foundational theoretical result for quantum error correction. It states that if the physical error rate per gate is below a certain threshold value, it is possible to perform arbitrarily long quantum computations by using enough error correction overhead. Below the threshold, adding more physical qubits to the error correction code exponentially suppresses the logical error rate. Above the threshold, adding physical qubits makes things worse.
The threshold value depends on the error correction code and the noise model. For the surface code under depolarizing noise, the threshold is approximately 1%. For more realistic noise models including correlated errors and measurement errors, effective thresholds are lower, typically around 0.1% to 0.5% for practical implementations.
Google's Willow chip demonstrated below-threshold operation in late 2024, showing experimentally that increasing the surface code distance from d=3 to d=5 to d=7 reduced the logical error rate exponentially rather than increasing it. This was the first clear experimental demonstration of this scaling behavior. It does not mean Willow can run cryptographic algorithms. It means Willow crossed an important proof-of-concept threshold for error correction scaling.
What "Fault-Tolerant" Actually Means
Fault-tolerant quantum computing means running a quantum computation such that errors in individual components (physical qubits, gates, or measurements) do not propagate to corrupt the final logical result. Fault tolerance requires not just error correction but careful circuit design that prevents errors from spreading through the computation before they can be corrected.
A fault-tolerant quantum computer is not simply any quantum computer with error correction. It is a machine that can execute the full universal gate set on logical qubits with logical error rates low enough that arbitrarily deep circuits produce reliable results. Current quantum computers are not fault-tolerant in this sense. IBM, Google, and IonQ all describe their current machines as "noisy intermediate-scale quantum" (NISQ) devices, meaning they can run short quantum circuits but cannot execute deep fault-tolerant computations.
The path from NISQ to fault-tolerant quantum computing requires crossing several simultaneous thresholds: physical error rates below the surface code threshold, sufficient qubit count to implement multiple logical qubits, fast enough classical control systems to decode error syndromes in real time, and reliable qubit connectivity for the target algorithm. None of these individually is sufficient.
Current Best Estimates for Fault-Tolerant Qubit Overhead
Microsoft's approach to quantum computing uses topological qubits based on Majorana zero modes rather than the surface code. Microsoft has claimed that topological qubits should require roughly 100:1 physical-to-logical overhead rather than 1,000:1, because Majorana-based qubits have intrinsically lower error rates due to their non-local encoding of quantum information. Microsoft's March 2025 Majorana 1 chip announcement claimed 8 topological qubits with measured error rates. Independent researchers noted that the verification methodology had limitations, and the demonstrated error rates were not yet competitive with the best superconducting or trapped ion results.
Google's 2021 paper by Gidney and Eker estimated that breaking RSA-2048 would require 20 million noisy physical qubits running for 8 hours using surface code error correction. More optimistic estimates with better hardware assume the task could be done with 4 million physical qubits. Even the optimistic figure is 30,000 times larger than IBM's current Heron r2 chip.
For ECDSA-256, the qubit requirements are lower than for RSA-2048 because elliptic curve discrete logarithm computations require fewer bits. But the estimates still run to millions of physical qubits for a practically feasible attack. The qubit count needed to break Bitcoin's ECDSA keys remains far beyond any announced roadmap within a five-year horizon.
Why This Is the Most Important Concept for Quantum Threat Timelines
Understanding error correction overhead is the single most important factor for reading quantum computing threat timelines accurately. Media coverage of quantum computing focuses almost exclusively on physical qubit counts. Announcements of "1,000-qubit chips" or "the world's most powerful quantum computer" are essentially meaningless without the corresponding logical qubit analysis.
The correct question is not "how many qubits does this machine have?" but "how many fault-tolerant logical qubits can this machine implement for cryptographically relevant circuit depths?" For every machine announced through 2025, the answer to the second question is zero or one. The cryptographic threat timeline is gated by progress in error correction and fault tolerance, not by raw qubit announcements. The quantum threat to blockchain is real, but its timing depends on fault-tolerant hardware, not NISQ demonstrations.
Blockchain projects using post-quantum signature schemes are protected regardless of how quickly error correction improves. The migration window is open now. It narrows as quantum hardware advances.
Frequently Asked Questions
How many physical qubits does one logical qubit require?
Under the surface code with current physical error rates of 0.1% to 0.3%, one logical qubit requires roughly 1,000 to 5,000 physical qubits to achieve error rates suitable for deep quantum circuits. The exact ratio depends on the physical error rate, the target logical error rate, and the depth of the computation being run.
What is the surface code?
The surface code is a quantum error correction scheme that arranges physical qubits in a 2D grid and uses parity measurements to detect errors without collapsing the logical qubit's quantum state. It is the leading candidate for near-term fault-tolerant quantum computing because it requires only nearest-neighbor qubit connectivity, which matches well with superconducting chip architectures.
What is the threshold theorem in quantum error correction?
The threshold theorem states that if physical gate error rates are below a certain value (around 0.1% to 1% depending on the code and noise model), then using more physical qubits in an error correction scheme exponentially reduces the logical error rate. Below the threshold, more qubits mean better results. Above the threshold, more qubits make things worse.
Does a 1,000-qubit quantum computer have 1,000 logical qubits?
No. A 1,000-physical-qubit machine at current error rates can implement at most one logical qubit with surface code protection. The 1,000:1 physical-to-logical ratio means that 1,000 physical qubits provide approximately one fault-tolerant logical qubit. Running Shor's algorithm against ECDSA-256 requires thousands of fault-tolerant logical qubits.
When will fault-tolerant quantum computers exist?
Most credible estimates place fault-tolerant machines capable of cryptographic attacks in the 2030s, with significant uncertainty in either direction. The timeline depends on achieving physical error rates below 0.1%, scaling to millions of physical qubits, and solving the classical control system challenges for real-time error decoding. No organization has published a concrete roadmap reaching these thresholds within five years.
