Breaking RSA Using Shor's Algorithm

In lattice surgery, a logical qubit covers $2(d + 1)^2$ physical qubits where d is the code distance (see Figure 8). Assuming we push the limits and use a code distance of 27 at $n = 2048$, each logical qubit will cover 1568 physical qubits. Therefore the total physical qubit count is the number of logical qubits $226 · 63$ times 1568; approximately 23 million qubits. 

Attentive readers will note that this number disagrees with the estimate in the title of the paper. This is because, throughout this section, we have been sloppily rounding quantities up and choosing fixed parameters in order to keep things simple. The estimate in the title is produced by the ancillary file "estimate costs.py", which does not make these simplifications. (In particular, "estimate costs.py" realizes that the level 1 code distance used during distillation can be reduced from 17 to 15 when n = 2048 and this adjusts the layout in several fortuitous ways).