Breaking RSA Using Shor's Algorithm

In order to perform the $0.2n_en^2 + 0.0003n_en^2 \; lg \; n$ Toffoli gates our implementation uses to factor an $n = 2048$ bit RSA integer, we need to distill approximately 3 billion CCZ states. Using a level 1 code distance 17 and a level 2 code distance of 27, this corresponds to a total distillation error of 6.4%. 

This quantity is computed by considering the initial error rate of injecting physical T states, topological error within the factory, and the likelihood of the various stages of distillation producing a false negative.