Mosca's Theorem, Explained
Cryptographer Michele Mosca proposed a simple decision rule for prioritizing post-quantum migration: if X (how long your data must remain confidential) plus Y (how long it will take you to migrate to quantum-safe cryptography) exceeds Z (how many years remain until a cryptographically relevant quantum computer exists), your data is already at risk today — not at some point in the future. The insight is that migration doesn't start when the quantum threat arrives; it has to finish before then, and an adversary recording your traffic today only needs the decryption capability to exist before your data's shelf life expires.
Why "Z" Is Genuinely Uncertain
Unlike X and Y, which an organization can estimate from its own operations, Z depends on the pace of quantum hardware research — a field where expert predictions vary by decades. Surveys of quantum computing researchers consistently show a wide spread of estimates, and public predictions have been wrong in both directions before. This is precisely why NIST, CISA, and other bodies recommend acting on migration now rather than waiting for consensus on Z: the cost of migrating early and being "wrong" about the timeline is manageable, while the cost of a long-retention dataset being harvested today and decrypted in ten or twenty years is not recoverable after the fact.
What Changes the Calculation
| Factor | Effect |
|---|---|
| Longer data retention (X) | Directly increases risk — decades-long retention (health records, national security, genomic data) is the highest-risk category |
| Slower migration (Y) | Directly increases risk — see the Migration Cost Estimator for a rough Y estimate specific to your environment |
| Already using hybrid or pure PQC | Eliminates HNDL risk for that specific system — the recorded ciphertext isn't vulnerable to a future quantum computer in the first place |
| Shorter-lived data | Reduces urgency — data that's worthless in two years carries little HNDL risk even under pessimistic Z estimates |
If this calculation flags risk, the next steps are concrete: find where classical algorithms protect long-lived data with the CBOM Generator, and consider hybrid key exchange as an interim step that removes HNDL exposure immediately, without waiting for a full migration.