It reduces factoring and discrete logarithms to finding the period of a function, which the quantum Fourier transform does efficiently. Elliptic curves need fewer logical qubits than RSA at comparable classical security, so P-256 is expected to fall no later than RSA-3072.
Resource estimates keep falling: in 2019 Gidney and Ekerå estimated that RSA-2048 could be factored in about 8 hours with 20 million noisy qubits; in May 2025 Gidney estimated less than a week with fewer than one million noisy qubits (assuming a 0.1% gate error rate and a 1 μs surface-code cycle). Today's devices have far fewer and noisier qubits, but the trend drives the 2030–2035 migration deadlines.