up:: Quantum Computing MOC

Quantum Annealing and the D-Wave Question

Quantum annealing is a special-purpose analog form of quantum computing that solves optimization problems by physically settling a system of qubits into the lowest-energy configuration of an objective function, and because an annealer such as D-Wave’s is not a universal gate-model computer, it cannot run Shor’s algorithm and therefore cannot break RSA or elliptic-curve cryptography no matter how many qubits it has. The reason this note exists is that D-Wave’s qubit counts run into the thousands while the gate-model machines that actually threaten cryptography have far fewer, so a recurring genre of headline implies a cryptographic breakthrough that the physics does not support. An annealer’s qubits and a gate-model machine’s qubits are different things doing different work, and the annealer’s are not the kind that runs the algorithm that breaks encryption.

The short version:

1. A quantum annealer is an analog optimizer. It encodes a problem as an energy landscape and finds a low-energy solution, expressed as an Ising or QUBO problem, rather than executing a sequence of logic gates.
2. It’s not a universal quantum computer. Without arbitrary gate operations it can’t run Shor’s algorithm or Grover’s algorithm, so it can’t factor the way a cryptographic attack needs.
3. Annealer qubit counts don’t compare to gate-model logical qubits. D-Wave’s thousands of annealing qubits are not thousands of the error-corrected gate-model qubits a CRQC requires.
4. The “annealer factored a number” and “annealer is close to RSA” claims recur, and they rest on tiny numbers, special structure, or classical lattice tricks bolted onto quantum hardware, none of which scale to real key sizes.
5. Quantum annealing has real, narrow value in optimization and materials simulation. That value is unrelated to cryptography, so a genuine annealing result is not a quantum-cryptography result.

Think of the difference like a marble maze versus a programmable robot arm. A quantum annealer is a maze you tilt and shake so a marble rolls to the lowest point, and if you build the maze so the lowest point is your answer, the marble finds it. A gate-model computer is a robot arm you program with a precise sequence of moves to do any task you can specify, including the specific sequence that factors a number. You can add more marbles and bigger mazes forever and never get the arm’s programmable precision, and only the arm can carry out Shor’s recipe. D-Wave builds extraordinary mazes. Breaking encryption needs the arm.

What is quantum annealing?

Quantum annealing is a computing method that solves a problem by encoding it into an energy landscape and letting a quantum system relax into the landscape’s lowest point, which represents the best solution. You cast your problem so that the lowest-energy state of a set of qubits corresponds to the answer you want, set the biases and couplings between the qubits to define that landscape, and the annealer seeks the minimum. D-Wave’s own documentation describes the processor as using quantum annealing to seek the minimum of an energy landscape defined by the biases and couplings applied to its qubits.

The problems it accepts are a specific mathematical form: an Ising model or, equivalently, a QUBO (Quadratic Unconstrained Binary Optimization) problem. Both express a cost function over binary variables, and the annealer returns low-energy assignments of those variables in order of increasing energy. That makes annealing a natural fit for optimization and sampling, where you’re searching a huge space of combinations for a good configuration.

Source: D-Wave, “What is Quantum Annealing?” D-Wave Quantum documentation, D-Wave docs.

Source: D-Wave, “QUBOs and Ising Models,” D-Wave Quantum documentation, D-Wave QUBO/Ising.

The key word is analog. An annealer doesn’t apply discrete logic operations one after another. It evolves a physical system continuously toward a ground state, which is a fundamentally different mode of computation from the step-by-step gate execution that a cryptographic algorithm is written in.

How is annealing different from gate-model quantum computing?

The difference is universality: a gate-model computer can run any quantum algorithm, and an annealer can only minimize an energy function. This is the distinction that decides whether a machine can threaten cryptography, so it’s worth being precise about.

1. Gate-model (circuit-model) machines apply a programmable sequence of quantum gates to qubits, in the same spirit as a classical processor running instructions. Any quantum algorithm, including Shor’s, is written as such a circuit. IBM, Google, IonQ, and Quantinuum build gate-model machines.
2. Annealers have no arbitrary gate operations. They control the system through tunable biases on each qubit and coupling strengths between qubits, which shape the energy landscape but can’t express an arbitrary algorithm. The annealer’s job is to find a minimum, not to execute a recipe.
3. The consequence for algorithms. Shor’s algorithm is a specific circuit built around the quantum Fourier transform, and there’s no way to express that circuit on a machine that only minimizes energy functions. The same holds for Grover’s search. An annealer lacks the operations both algorithms require.

Source: A. Marchenkova, “What’s the difference between quantum annealing and universal gate quantum computer?” Marchenkova.

Source: D-Wave, “What is Quantum Annealing?” D-Wave docs.

There’s active research into whether annealing hardware can be extended toward universality, but that’s a research direction, not the machines in the field today. The annealers you read about in the qubit-count headlines are optimizers, and optimizers can’t run the algorithm that breaks encryption.

Can a quantum annealer break RSA or run Shor’s algorithm?

No. A quantum annealer cannot run Shor’s algorithm, so it cannot break RSA or ECC the way a cryptographic attack requires, and adding qubits doesn’t change that because the limitation is architectural rather than one of scale. Shor’s algorithm needs a long, precise sequence of coherent gate operations, and an annealer has neither the gate operations nor the sustained coherence to execute one. The anneal itself lasts microseconds and runs without error correction, which is the opposite of the deep, error-corrected circuit Shor’s requires.

The subtler trap is not “run Shor’s on an annealer” but “recast factoring as an optimization problem the annealer can minimize.” You can, in principle, write factoring as a QUBO, and this is where the recycled claims come from. The problem is that the QUBO for factoring a large number grows explosively in the number of qubits and the precision of couplings required, so it works only for tiny numbers and doesn’t scale toward cryptographic key sizes. Casting factoring as optimization throws away the exponential speedup that makes Shor’s algorithm dangerous, leaving you with a hard search that a classical computer does at least as well.

So the machine that threatens cryptography is a large, error-corrected, gate-model CRQC, and its resource requirements are the ones tracked in resource estimation. A quantum annealer, at any qubit count, is a different machine entirely, built for a different job, rather than a smaller step toward that one.

Why don’t annealer qubit counts compare to gate-model qubits?

Because they measure different physical objects, and the comparison people reach for, “D-Wave has 5,000 qubits and Google has 100, so D-Wave is 50 times closer to breaking encryption,” is comparing quantities that don’t share a unit. An annealer’s qubit is a physical element that participates in shaping an energy landscape, connected to its neighbors through a fixed coupling graph. It doesn’t need the individual gate-level control, deep coherence, or error correction that a gate-model computation demands, so it’s genuinely easier to build many of them.

A gate-model machine’s threat to cryptography is measured in logical qubits, which are error-corrected qubits each built from many physical ones, and a CRQC needs thousands of logical qubits and therefore millions of physical ones. That’s the honest scale of the problem, and it’s why raw counts mislead in general, a point benchmarking makes for gate-model machines too. An annealer’s thousands of qubits are not thousands of logical gate-model qubits, and they don’t move the CRQC timeline at all.

The table names the two machines against the axes that actually decide cryptographic relevance.

	Quantum annealer (D-Wave)	Gate-model computer (IBM, Google)
What it does	Minimizes an Ising / QUBO energy function (optimization, sampling)	Runs arbitrary quantum circuits, any quantum algorithm
Can it run Shor’s algorithm?	No, it has no arbitrary gate operations	Yes, given enough error-corrected qubits
The qubit that matters	Analog annealing qubits, thousands available	Error-corrected logical qubits, very few available
Error correction	None during the microsecond anneal	Required, and the reason a CRQC needs millions of physical qubits
Cryptographic threat	None, its qubits are the wrong kind	This is the machine a CRQC is

What about the headlines that an annealer factored a number or is close to RSA?

Those claims recur every couple of years, and each time they rest on a small number, special structure, or a classical algorithm dressed in quantum hardware, none of which threatens real keys. Reading them correctly is exactly the hype-calibration skill this section is built to teach.

1. Tiny “factored” numbers via QUBO. Demonstrations have factored small integers by casting factoring as an optimization the annealer minimizes. The numbers are minuscule against a 2048-bit RSA key, and the resource cost grows so fast that the method doesn’t scale, so it’s a proof of concept for the encoding rather than a step toward RSA.
2. The Schnorr lattice claim (2022 to 2023). A widely circulated paper claimed a quantum-assisted method (Schnorr’s classical lattice technique with QAOA on a small gate-model device) could threaten RSA-2048. It factored only a 48-bit integer on real hardware, and Scott Aaronson’s rebuttal, “Cargo Cult Quantum Factoring,” made the core point that Schnorr is not Shor, and the classical lattice step is where any factoring would happen, if it worked, which it doesn’t scale to.
3. Genuine annealing results, misread. D-Wave reported a peer-reviewed quantum-advantage result in Science in March 2025 for simulating a magnetic spin-glass system faster than a classical supercomputer, a materials-science claim that drew its own classical rebuttals. It’s an optimization and simulation result and has nothing to do with cryptography, so a real annealing milestone still isn’t a step toward breaking encryption.

Source: S. Aaronson, “Cargo Cult Quantum Factoring,” January 4, 2023, Aaronson.

Source: B. Schneier, “Breaking RSA with a Quantum Computer,” January 2023, Schneier.

Source: D-Wave, “Beyond Classical, D-Wave First to Demonstrate Quantum Supremacy on a Useful, Real-World Problem,” Science, March 12, 2025, D-Wave newsroom.

The pattern to internalize is that a cryptographic break would show up as a large gate-model machine running Shor’s algorithm against a real key, not as an optimizer factoring a two-digit number or a lattice trick that only ever factors toy inputs. When the headline is annealing, the cryptography answer is almost always “unrelated.”

Common misconceptions

1. “D-Wave has thousands of qubits, so it’s closest to breaking encryption.” Annealer qubits are analog optimization elements, not the error-corrected logical qubits a CRQC needs. The counts don’t compare, and D-Wave’s are the wrong kind for cryptanalysis.
2. “An annealer can run Shor’s algorithm if you program it right.” Shor’s is a gate-model circuit, and an annealer has no arbitrary gate operations. There’s no way to express Shor’s on a machine that only minimizes energy functions.
3. “An annealer factored a number, so RSA is at risk.” Those demonstrations factor tiny integers by casting factoring as a QUBO, and the cost explodes with size, so the method doesn’t scale toward a real RSA key.
4. “Annealing is just a slower gate-model computer.” It’s a different architecture, not a slow version of the same thing. It optimizes energy landscapes, which is genuinely useful and genuinely unable to run general quantum algorithms.
5. “A D-Wave quantum-advantage result means encryption is closer to breaking.” D-Wave’s 2025 advantage claim was a materials-simulation result, unrelated to cryptography. A real annealing milestone is still not a cryptography milestone.
6. “The Schnorr paper showed a quantum computer can break RSA-2048.” It factored a 48-bit integer and leaned on a classical lattice method, and expert rebuttals showed it doesn’t scale. Schnorr’s technique is not Shor’s algorithm.

Questions people ask

Can D-Wave’s quantum computer break RSA? No. D-Wave builds quantum annealers, which optimize energy functions and cannot run Shor’s algorithm, so they can’t break RSA or ECC at any qubit count. Breaking those needs a large error-corrected gate-model machine, which is a different architecture.

Why does D-Wave have so many more qubits than IBM or Google? Because annealer qubits are analog optimization elements that don’t need individual gate control or error correction, so they’re far easier to build in bulk. Gate-model machines are counted in error-corrected logical qubits, which are extraordinarily hard to build, which is why they number in the tens while annealer qubits number in the thousands.

Is quantum annealing useless then? Not at all. It’s a real tool for optimization, sampling, and certain simulation problems, and D-Wave has demonstrated advantages in those narrow domains. It’s just unrelated to cryptography, so its usefulness doesn’t translate into a quantum threat to encryption.

Someone showed an annealer factoring a number, doesn’t that count? Only for tiny numbers, by recasting factoring as an optimization problem. The resource cost grows so fast that it never reaches cryptographic key sizes, so it demonstrates the encoding trick rather than a path to breaking RSA.

What was the Schnorr / QAOA RSA-2048 claim about? A 2022 paper claimed a quantum-assisted lattice method could threaten RSA-2048, but it factored only a 48-bit integer and relied on a classical technique that experts showed doesn’t scale. The consensus rebuttal is that Schnorr’s method is not Shor’s algorithm and the claim doesn’t hold.

So which quantum computer should I actually worry about for cryptography? The large, error-corrected, gate-model CRQC that can run Shor’s algorithm against a real key. Its progress is tracked through resource estimation and hardware roadmaps, not through annealer qubit counts, and it doesn’t exist yet.

How do I tell an annealing headline from a real cryptography threat? Ask whether the machine is a gate-model computer running Shor’s algorithm against a real key. If it’s an annealer optimizing a problem, or a lattice trick factoring a toy number, it’s not a cryptography result. This is the core move in reading quantum progress.

---

Everything here is the map, given freely. When your team needs the qubit-count headlines translated into an honest read of where the cryptographic threat actually stands, and a plan built on that read rather than on the hype, that’s the work I do, and there’s an alignment briefing for it.

Last verified 2026-07-14 · Maintained by Addie LaMarr, LaMarr Labs.