If their algorithm works, they need a 1860 (372*5) qubit computer to break 2048 bit RSA.
IBM expects to get there by 2025. [1]
[0] https://en.wikipedia.org/wiki/Five-qubit_error_correcting_co...
For example, using the surface code, a back of the envelope estimate would be that you need a code distance of d = ln(number_of_operations). Each logical qubit will use 2d^2 physical qubits. So for a million operations you'd need around 400 physical qubits per logical qubit and for a trillion operations you'd need around 1500 physical qubits per logical qubit. So, way more than 5.
(A major practical obstacle to using almost-anything-that-isn't-the-surface-code is that the surface code has forgiving connectivity and maximum-allowed-physical-noise requirements.)
Shor's algorithm requires performing a modular exponentiation under superposition. For an n bit modulus this requires 2n or 3n qubits of storage, plus let's say 50% overhead for routing and gates. You end up needing 5n to 10n logical qubits for an n bit number. So to factor a 2048 bit number you'd need on the order of ten thousand logical qubits. Improving that to a few hundred logical qubits would be a big improvement. Also, there's fewer operations so the code distance can be lower.
...but don't forget that "if the paper is correct" bit.
Expectations of a Moore's law type improvement rate are going to be left wanting.
More realistically [1], you'd have a factor of around 1,600 for a distance-27 code.
Which is to say that Osprey has 433 qubits, so should be capable of 86 fault tolerant error corrected qubits, so they should be able to factor (not bothering with the math) AT LEAST ONE NUMBER using Shor's algorithm, and yet they cannot.
1) If the paper is right, they are claiming they need 300ish physical qubits that can sustain about 1000 gates before decohering. No need for scalable error correction.
2) Independently of the veracity of the paper, if you actually need logical error corrected (and fault tolerant) qubits, you need error correcting codes with much more severe overhead than the 5-qubit code. The 5-qubit code is a pedagogical example, not something that would actually work under realistic conditions. And even the 5-qubit code needs quite a few extra ancillary qubits for fault tolerance (which is more expensive than simple error correction).
E.g. forge email (most dkim keys are 1024 bit rsa). Break ssh (depends on key algo chose). Break pgp (depending on settings). Mitm https connections, Etc.
(I don't think my contacts aren't going to know what SSH or PGP is, if that helps.)
For the vast majority of HTTPS (say, for example, Google or Hacker News) RSA is not used to agree the encryption. So although quantum computers would be a threat for other reasons, breaking RSA in particular doesn't just "remove HTTPS".
However, RSA is used to prove the identity of the server for most web sites even with a newer key agreement. So if an adversary can get on path between you and the server, they could get in the middle and masquerade successfully as the server - arranging key agreement with you, and then providing a convincing fake proof of identity, if they do so live.
In TLS 1.2 optionally, and to a greater extent in older versions (which are no longer used by popular web browsers) you can also use RSA to agree the encryption, and for sites using that breaking RSA would allow an adversary to interpose in real time, or to decrypt communication after the fact, but I'd be astonished if anywhere important still does that when talking a halfway modern browser.
> If only someone archived it in a data center in the desert.
Uh oh
https://en.wikipedia.org/wiki/Utah_Data_Center
Good think I declared moral bankruptcy this year, all that is the old me :-)