Reducing the cost of factoring

This talk will discuss techniques that were used in the paper "How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits" to reduce the estimated spacetime cost of factoring integers using a quantum computer by over two orders of magnitude. Most of savings come from classical circuit optimization techniques that have been adjusted to work around limitations imposed by the quantum domain. Identifying these cost reductions now, rather than when large scale fault tolerant quantum computers are already available, gives the security industry and cryptographic community time to react and to decide how to budget and prioritize efforts to move away from cryptosystems vulnerable to quantum attack.