How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits

The resource estimate cited on Shor's algorithm and in the cryptography stub. Under the paper's assumptions — planar nearest-neighbor superconducting qubits, physical error rate 10^−3, 1 microsecond surface-code cycle, 10 microsecond reaction time — factoring a 2048-bit RSA integer takes about 20 million noisy qubits and about 8 hours. The abstract circuit costs are stated separately in the paper. This is an estimate, not an experiment.