Quantum Error Correction Explained: What It Means for the Q-Day Timeline

In December 2024, Google published a paper in Nature announcing that its Willow chip had demonstrated below-threshold quantum error correction. Press coverage ranged from “step toward quantum supremacy” to “timeline for breaking encryption just moved forward.” Neither framing is accurate. To understand what the result actually means for security planning, you first need to understand what quantum error correction is, why it is the central unsolved engineering challenge on the path to a cryptographically relevant quantum computer, and how far current hardware sits from the capability needed to break RSA-2048.

The answer is: further than most coverage suggested. The Google Willow result is scientifically significant. It is not a signal that Q-Day is imminent. The Global Risk Institute's 2024 Quantum Threat Timeline Report, surveying expert opinion across the field, placed the probability of a cryptographically relevant quantum computer within ten years at 14 to 34 percent. That wide range reflects genuine uncertainty about the pace of the engineering work that remains. Quantum error correction is the core of that uncertainty.

This article explains the error correction problem from first principles, what the Willow result demonstrated and what it did not, and what the remaining gap means for migration planning.

Why Quantum Computers Make Errors and Why This Matters

Classical computers operate at error rates below 10-20 per gate operation under normal conditions. A silicon transistor is either on or off; thermal noise at room temperature is not enough to flip it. Quantum bits (qubits), whether implemented as superconducting circuits, trapped ions, or photons, are physical systems subject to thermal noise, electromagnetic interference, and decoherence: the loss of quantum superposition through interaction with the environment.

Current state-of-the-art superconducting qubit gate error rates sit in the range of 0.1% to 0.01% per two-qubit gate operation, or 10-3 to 10-4. That sounds small. It is not, at the circuit depths required for useful quantum computation. Shor's algorithm for factoring an n-bit integer requires on the order of n3 to n4 gate operations. For RSA-2048, that implies billions of gate operations. A circuit with a gate error rate of 10-3 and 109 gates will suffer approximately 106 errors. The output is nonsense.

This is not a problem that faster hardware solves. It is a fundamental physics problem. The solution is quantum error correction.

What Quantum Error Correction Does

QEC encodes one logical qubit across multiple physical qubits. The encoding is chosen so that common error patterns affect only a subset of physical qubits in a detectable way, without directly revealing the logical state being protected. Quantum information can be spread across entangled physical qubits in a way that allows error detection without direct measurement of the logical information. Direct measurement would collapse the quantum state and destroy the computation.

The mechanism for detecting errors without measuring the logical qubit is called syndrome measurement. It involves measuring parity checks on groups of physical qubits to identify which qubits suffered errors. A classical decoder then determines the corrective operation to apply. Peter Shor described the first quantum error-correcting code in 1995; Calderbank and Shor (1996) formalised the stabiliser code framework that underlies most practical QEC schemes today.

The Threshold Theorem

The threshold theorem establishes that if the physical error rate per gate is below a critical value, adding more physical qubits per logical qubit reduces the logical error rate exponentially. Below the threshold, every additional layer of error correction improves the computation. Above it, more qubits make things worse. The theorem was established by Kitaev (original preprint 1997, published in Annals of Physics 2003) and Knill, Laflamme, and Zurek (Science, 1998).

For the surface code, the threshold is approximately 1% per gate (10-2). Current hardware, including Google Willow, achieves error rates well below this threshold in two-qubit gate operations. That is why the Willow result matters.

The Surface Code

The surface code, developed in detail by Fowler et al. in Physical Review A 86 (2012), is the leading QEC approach for near-term hardware because it requires only nearest-neighbour qubit interactions on a two-dimensional grid, which is compatible with current superconducting qubit fabrication. A distance-d surface code encodes one logical qubit in approximately 2d2 physical qubits (including ancilla qubits for syndrome measurement). Increasing d reduces the logical error rate: the logical error rate scales roughly as (p/pthreshold)d/2, where p is the physical error rate. The larger the code distance, the better the protection, provided the physical error rate stays below threshold.

Google Willow: What the December 2024 Result Means

Google's Willow chip, reported in Nature in December 2024, demonstrated that as the surface code distance increased from d=3 to d=5 to d=7, the logical error rate decreased. This is the first unambiguous experimental demonstration of the threshold theorem in a large-scale superconducting system. The result validates the surface code approach on real hardware at meaningful scale and confirms that below-threshold operation is achievable with current fabrication methods.

That is a genuine milestone. The field had been targeting this experimental demonstration for years. It resolves an open question about whether the theoretical promise of the surface code could be realised in practice at the code distances needed for useful error suppression.

Willow is a 105-qubit research chip. The distances demonstrated (d=3, 5, 7) achieve logical error rates far above what would be required to run Shor's algorithm on RSA-2048. The qubit count is orders of magnitude below what would be required for that computation. Below-threshold demonstration is a necessary condition for a fault-tolerant quantum computer. It is not a sufficient one.

The Distance Required for RSA-2048

Webber, Elfving, Weidt, and Hensinger (AVS Quantum Science 4, 013801, 2022) estimated the resources required to factor an RSA-2048 key using a surface code quantum computer, assuming optimistic hardware parameters: cycle time of 1 microsecond, physical error rate of 10-3, and full connectivity within logical blocks. Their estimate was on the order of 20 million physical qubits and a runtime of approximately 8 hours under those optimistic assumptions.

Less optimistic assumptions push the estimate higher. Realistic cycle times closer to 10 microseconds, memory overhead for magic state distillation (discussed below), and error rates at the less favourable end of current hardware performance push estimates toward hundreds of millions of physical qubits. The total system count is the operationally relevant figure. Current hardware is at 105 physical qubits on the leading research chip. The gap is not one generation of engineering progress.

The Magic State Distillation Bottleneck

The surface code is a stabiliser code. Stabiliser codes implement Clifford gates (Hadamard, CNOT, Phase) fault-tolerantly. Shor's algorithm requires non-Clifford gates, specifically the T gate, which cannot be implemented directly within the stabiliser framework without introducing errors.

The solution is magic state distillation, introduced by Bravyi and Kitaev in Physical Review A 71 (2005). Magic states are special quantum states that, when consumed through a specific circuit, implement the T gate fault-tolerantly. Generating a single high-fidelity magic state requires hundreds to thousands of noisy input states and a distillation circuit that itself consumes significant physical qubit resources. Magic state distillation accounts for a substantial fraction of the total physical qubit count in resource estimates for Shor's algorithm.

Magic state distillation has not been demonstrated at anything approaching the scale or fidelity needed for RSA factoring. It remains an unsolved engineering challenge independent of the surface code error correction results. Both problems must be solved, and the distillation overhead is included in the 20 million physical qubit estimate from Gidney and Ekera (arXiv:1905.09749, 2021); Webber et al. give different estimates under different hardware assumptions.

Current Hardware: Where IBM Condor Fits

IBM announced the Condor processor in late 2023, a 1,121-superconducting-qubit system described as a research milestone in qubit count. Condor is a physical qubit count achievement. It is not a fault-tolerant system. The qubits are not encoded into logical qubits with full surface code error correction. Physical qubit count alone is not a useful indicator of progress toward RSA-breaking capability.

The relevant measure is the number of high-fidelity logical qubits achievable with surface code error correction, which is a function of physical qubit count, gate error rate, connectivity, and cycle time. At current physical error rates and surface code overheads, a 1,121-qubit processor might support a small number of high-fidelity logical qubits at modest code distances. It would not support the hundreds of logical qubits required for meaningful Shor's algorithm computation. The distinction between physical and logical qubit counts is the most important number in any quantum hardware announcement for security planning purposes.

What This Means for the Q-Day Timeline

The Global Risk Institute Quantum Threat Timeline Report (2024 edition) placed the probability of a cryptographically relevant quantum computer within 10 years at 14 to 34 percent. The 2024 figures reflect genuine expert disagreement about the pace of QEC and hardware engineering progress. The wide range is the honest answer to what is genuinely an uncertain question.

Q-Day is not a fixed date calculable from current hardware. It depends on engineering breakthroughs across at least five distinct challenge areas: physical qubit fidelity, qubit count and connectivity, classical control electronics, magic state distillation efficiency at scale, and manufacturing yield. Each represents an unsolved engineering challenge. Announcing progress on one does not compress the timeline proportionally.

The 14 to 34 percent probability within ten years corresponds roughly to a 2033 to 2035 probability-weighted planning window. This is a risk distribution, not a prediction. The appropriate response is to treat migration as a risk management problem with a meaningful probability of consequence within the planning horizon, not to wait for a more precise estimate that the current state of the field cannot provide.

The Harvest Now Decrypt Later Implication

The gap between current hardware and a CRQC does not eliminate the Harvest Now Decrypt Later (HNDL) threat. Adversaries with long-term data collection capabilities can capture encrypted traffic today and store it for decryption once a cryptographically relevant quantum computer is operational. Data with a confidentiality requirement extending beyond ten years sits within the GRI 14 to 34 percent risk window. The urgency of migrating key exchange mechanisms does not depend on Q-Day being imminent. It depends on the data lifetime. NSM-10, signed on 4 May 2022, identified HNDL as the primary driver for migration urgency in the US government context. See Logical Qubit and Q-Day Timeline Calculation for a worked analysis of how hardware benchmarks translate to timeline estimates.

The Honest Summary: Significant Progress, Large Gap Remaining

Below-threshold error correction is now demonstrated experimentally. Google Willow confirmed that the surface code approach is physically valid at code distances where error suppression is meaningful. That is a genuine scientific result and it moves the field forward.

The gap between this result and a fault-tolerant quantum computer capable of breaking RSA-2048 is still measured in orders of magnitude. Qubit counts need to increase by roughly five orders of magnitude. Magic state distillation at the required fidelity and scale has not been demonstrated. Sustained fault-tolerant operation over the hours required to factor RSA-2048 has not been demonstrated. No public hardware roadmap from any vendor shows a credible path to that capability within five years.

The operational conclusion: the QEC challenge does not make PQC migration less urgent. It confirms that migration can be executed in an orderly way with appropriate lead time, provided planning starts now. An organisation beginning PQC migration in 2026 has a realistic window to complete it before the risk window becomes probability-weighted. That window will not stay open indefinitely. For guidance on structuring a migration plan, see PQC Migration Strategy and Roadmap for Security Leaders and Calculate Your Organisation's HNDL Exposure.

QSECDEF's advisory programme supports organisations building quantum threat timelines into their security strategy. Expert Membership provides access to structured briefings and migration planning support for security teams working through this question now.