Mosca's Inequality: Turning Data Shelf-Life into a Migration Priority

The awkward feature of the quantum threat is that it demands action before its cause exists. A cryptographically relevant quantum computer is not here, its arrival date is genuinely uncertain, and yet waiting for certainty guarantees a specific, avoidable failure: data encrypted and intercepted today can be stored and decrypted the moment the capability appears. Mosca (2018) cut through this with a deceptively simple inequality that compares three time intervals instead of forecasting a date. It turns a debate about when quantum computers will arrive into an arithmetic anyone can perform on their own data, and for a large class of long-lived secrets the arithmetic delivers an uncomfortable verdict: the deadline to have started has already passed.

Three durations, one inequality

Mosca's framing rests on three time intervals, all measured from today. The first is the security shelf-life, written x: how many years a given piece of data must remain confidential. The second is the migration time, written y: how many years it will take an organization to replace its vulnerable cryptography with quantum-resistant alternatives across all its systems. The third is the collapse time, written z: how many years until a quantum computer capable of breaking the deployed public-key cryptography exists.

The claim is that you are exposed whenever the shelf-life plus the migration time exceeds the collapse time — that is, whenever x plus y is greater than z. The intuition is a scheduling one: if it takes y years to become safe, you must finish y years before the threat lands, at time z minus y; but data created now must stay secret for x years, so anything created after time z minus y that must live longer than the remaining gap is at risk. When x plus y exceeds z, there is no way to have protected that data in time.

The power of the formulation is that it never requires knowing z precisely. It requires only comparing durations, and it converts the unanswerable question 'when will quantum arrive' into the answerable one 'do our shelf-life and migration time already consume the available runway.'

Harvest-now, decrypt-later makes shelf-life binding

The inequality has real teeth only because of a specific attacker behaviour: an adversary can record encrypted traffic today and store it until a quantum computer can decrypt it. This harvest-now-decrypt-later strategy means the relevant clock for confidentiality started when the data was first transmitted, not when the quantum computer arrives. Data intercepted today with a value that persists for decades is already, in effect, on a countdown that the defender cannot pause.

This is why the shelf-life term x is the binding variable for confidentiality. For data whose secrecy requirement is short — a session token valid for minutes, an ephemeral key rotated hourly — x is tiny, the inequality is comfortably satisfied in the safe direction, and there is little urgency. For data whose secrecy must persist for decades — state secrets, health and genomic records, long-term intellectual property — x is large enough that even an optimistic z leaves the inequality on the exposed side today.

Authentication and integrity are a partial exception worth noting precisely: a signature that only needs to be valid at the moment of verification is not threatened retroactively by harvest-now-decrypt-later in the same way, because there is nothing to harvest and decrypt later. Confidentiality of long-lived data is the sharp edge of the timing problem, and shelf-life is its measure.

From an inequality to a priority ranking

Because x varies enormously across data types while y and z are roughly common to an organization, the inequality naturally sorts assets into a migration priority order: rank by shelf-life, longest first. The assets that must stay secret longest are the ones for which the inequality tips into the exposed region earliest, so they are the ones to migrate first. This converts a single yes-or-no timing question into an actionable, ordered program.

The ranking is not merely conceptual; it is how a migration is sequenced under finite resources. An organization cannot re-encrypt everything at once, so it applies quantum-resistant protection first to the long-shelf-life data that harvest-now-decrypt-later most endangers, then works down toward the short-lived data that the inequality shows is not yet urgent. The shelf-life axis is the scheduling key.

This also disciplines the common objection that migration is expensive and the threat uncertain. The response is that you do not migrate everything on an uncertain date; you migrate the specific, identifiable subset whose shelf-life makes it exposed under any plausible collapse time, and you do it in shelf-life order. The cost is bounded and the priority is defensible.

Handling the uncertainty in z

The collapse time z is the genuinely uncertain term, and the disciplined way to use it is as a conservative bound, not a forecast. Resource estimates give a plausible range for when a machine of sufficient scale and quality could exist; the inequality should be evaluated with a conservative — that is, early — value of z drawn from that range, because being wrong in the safe direction (migrating too early) costs money, while being wrong in the exposed direction (migrating too late) costs the data irrecoverably. The asymmetry of the consequences justifies the conservatism.

Treating z as a distribution rather than a point also lets the inequality be read probabilistically: for a given asset, the question becomes the probability that z falls below the shelf-life plus migration time, and that probability rises with the shelf-life. For the longest-lived secrets it is high enough under any reasonable distribution that the decision is effectively forced. For short-lived data it is low enough to defer. The uncertainty widens the margin of safety one should demand; it does not license waiting.

The synthesis is that the inequality does not need a resolved timeline to be decision-useful. It needs a conservative lower bound on z, an honest estimate of the migration time y, and an inventory of assets by shelf-life x — all of which are within an organization's own knowledge or control.

A migration program the inequality implies

The operational program follows directly from the model. First, inventory the cryptography and the data it protects, tagging each asset with its shelf-life. Second, rank assets by shelf-life to obtain the migration order. Third, protect the long-shelf-life data first, preferring hybrid schemes that combine a classical and a post-quantum algorithm so security holds if either survives — this shrinks the effective migration risk while the post-quantum standards mature. Fourth, make the change durable by gating it, so that new systems cannot silently reintroduce a vulnerable, non-agile configuration.

The migration time y is not a fixed constant; it is something the program actively shrinks. Crypto-agility — the ability to swap algorithms without re-architecting — reduces y for every future transition, which is why building agility is itself a migration action rather than a separate project. A smaller y moves the latest-safe-start deadline later and widens the set of assets that can be protected in time.

The final discipline is to treat the inequality as a living calculation. As resource estimates tighten z, as the inventory reveals new long-lived assets, and as agility lowers y, the ranking and the urgency update. The model is not a one-time verdict but a recurring comparison that keeps the migration proportionate to the evolving threat.

The verdict for long-lived data

Put the pieces together and the model yields a clear, defensible position. For data whose confidentiality must persist for many years, the shelf-life term alone is large enough that, combined with any realistic migration time and any conservative collapse time, the inequality sits on the exposed side today. Harvest-now-decrypt-later means that data is already on a clock the defender cannot stop. The only available action that improves the outcome is to start migrating now and to shrink the migration time through agility.

For short-lived data the same arithmetic counsels calm: the shelf-life is so small that the inequality is comfortably satisfied in the safe direction, and resources are better spent on the long-lived assets. The model's virtue is precisely this discrimination — it neither cries wolf about everything nor dismisses the threat, but assigns urgency in proportion to shelf-life.

The one-sentence summary is the inequality itself, read as an instruction: if the years your data must stay secret plus the years your migration will take exceed the years until quantum capability, act now — and for your longest-lived secrets, that condition is almost certainly already met.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

asset_crypto:
  require_tag: data_shelf_life_years    # x, per data class
  migration_order: descending_shelf_life
  exposed_rule: x_plus_y_gt_z           # evaluate with conservative z
  long_lived_action: hybridize_now      # classical + PQC
agility:
  target: reduce_migration_time_y
  gate: no_hardcoded_algorithm_ids
audit:
  conservative_z_source: cited_resource_estimate

Glossary

Security shelf-life (x)

The number of years a piece of data must remain confidential; the binding variable under harvest-now-decrypt-later.

Migration time (y)

The number of years to replace vulnerable cryptography across all systems with quantum-resistant alternatives.

Collapse time (z)

The number of years until a quantum computer capable of breaking the deployed public-key cryptography exists; the uncertain term, used conservatively.

Mosca's inequality

The condition x + y > z, which signals that some data cannot be protected in time and migration must already be underway.

Harvest-now-decrypt-later

Recording encrypted data today to decrypt once quantum capability arrives; it starts the confidentiality clock at interception, not at collapse time.

Crypto-agility

The ability to change cryptographic algorithms without re-architecting, which reduces the migration time y for every future transition.

References

1. Mosca, Cybersecurity in an era with quantum computers: will we be ready? (IEEE Security & Privacy, 2018; arXiv:1512.06466)
2. Gidney & Ekerå, How to factor 2048-bit RSA integers in 8 hours using 20 million noisy qubits (Quantum, 2021; arXiv:1905.09749)
3. Shor, Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer (SIAM J. Comput., 1997)
4. Grover, A Fast Quantum Mechanical Algorithm for Database Search (STOC, 1996)
5. Fowler, Mariantoni, Martinis & Cleland, Surface codes: Towards practical large-scale quantum computation (Phys. Rev. A, 2012; arXiv:1208.0928)