Your data is at risk today if it has to stay secret for longer than the time left until Q-Day, minus the time it takes to switch to quantum-safe encryption. That rule is known as Mosca's theorem, and it fits in one line: if x + y is larger than z, you have a problem now.
This page explains the three numbers, works through examples with real retention periods, and is clear about the one number nobody knows. Every figure links to its source.
The three numbers
Michele Mosca, a quantum researcher at the University of Waterloo, set out the rule in a 2015 paper. He asks three questions:
x, "the security shelf-life": how long must the information stay secret?
y, "the migration time": how long will it take to deploy quantum-safe tools?
z, "the collapse time": how long until a quantum computer, or another method, breaks the public-key cryptography we use today?
His conclusion: "If x + y > z, we have a serious problem today". Think of a letter in a safe. x is how long the letter must stay private. y is how long the locksmith needs to fit a new lock. z is the day burglars get a tool that opens the old one. If the letter still matters on that day, and someone made a copy while the old lock was on, the copy can be opened.
Why the clock is already running
That copy is the key point. An attacker does not need a quantum computer to start. Encrypted traffic can be recorded today and stored until it can be decrypted. This is called harvest now, decrypt later. The US government names the risk in Executive Order 14412 (June 2026): adversaries collecting US information now and "decrypting it later once large-scale quantum computers are operational."
This is why y is in the formula. Everything sent with the old encryption during the switch can still be recorded. It also explains what to fix first. Recording only threatens secrecy, which depends on key exchange: the step where two computers agree on a secret key. Signatures are different: breaking one after Q-Day does not reveal anything that was recorded earlier. The executive order puts key exchange first: US government high-value assets and high-impact systems must use post-quantum key exchange by December 31, 2030, and post-quantum signatures by December 31, 2031.
z: the number nobody knows
Nobody knows when Q-Day comes (what Q-Day is). These are published forecasts, each with who makes it:
| Who | When |
|---|---|
| Gartner | 2029: quantum computers "break public key cryptographic algorithms" (summary, February 2025) |
| CSA | April 2030: the Cloud Security Alliance's countdown to breaking "present-day cybersecurity infrastructure" (2022) |
| Metaculus | November 2033: median of 26 forecasters for factoring the RSA-2048 challenge number (measured October 9, 2026) |
| GRI | 28–49% chance within 10 years, 51–70% within 15 years, according to 26 experts surveyed by the Global Risk Institute (report, March 2026) |
| NSA | No date: "NSA does not know when there will be a CRQC" (CNSA 2.0 FAQ) |
Mosca gave his own estimate in the same 2015 paper: "a 1/7 chance of breaking RSA-2048 by 2026 and a 1/2 chance by 2031." It is now 2026 and RSA-2048 has not been broken. A one-in-seven chance that did not happen is not a wrong forecast; it is what one in seven means.
Our Q-Day countdown runs to the earliest of these estimates, and the Q-Day tracker keeps every forecast with its source. Because z is uncertain, the honest way to use the formula is to try a short z and a long z. Below we use 3 years (2029, Gartner) and 9 years (around 2035, where the GRI experts put a 28–49% chance).
y: how long switching takes
The UK's NCSC sets "indicative timelines": a full discovery exercise and a first migration plan by 2028, the highest-priority migrations by 2031, and all systems migrated by 2035. For a large organization that starts now, y is close to ten years. The fastest government timeline we know is the US one above: about four years for key exchange in high-value government systems.
For small businesses that mainly use standard browsers, operating systems and phones, the NCSC expects the switch to "happen seamlessly", as services are updated by their vendors. Their y is set by their suppliers. The full list of dates is in who must do what, and when.
Worked examples
We use y = 4 years, the fastest timeline above. Most organizations will be slower, which makes every row worse.
| Data | x + y, and at risk if Q-Day is in 3 or in 9 years? |
|---|---|
| Sales forecast | Secret for about 1 year. x + y = 5. At risk if Q-Day comes in 3 years; safe if it comes in 9. |
| Product plans | Secret for about 5 years. x + y = 9. At risk at 3 years; right on the edge at 9. |
| Medical file | In the Netherlands kept for at least 20 years after the last change (Dutch government). x + y = 24 or more. At risk in both cases. |
| State secrets | US classified information is declassified after 10 years by default, or up to 25 years (Executive Order 13526, sec. 1.5); exempted records up to 75 years (sec. 3.3). x + y = 14 to 79. At risk in both cases. |
| Genetic data | Your DNA does not change during your life, so x is a lifetime. At risk in both cases. |
The pattern is simple. For data that must stay secret for more than ten years, x + y is larger than every dated forecast in the table above, including the GRI's 15-year horizon. For short-lived data, the answer depends on z, and nobody knows z.
What the formula does not tell you
Whether anyone is recording your data. The executive order says the risk exists. There are no public figures on who records what. An attacker also needs access to the traffic in the first place.
What happens to data that is not sent over a network. The risk is in public-key cryptography (RSA and elliptic curves), which protects key exchange. Files encrypted with symmetric encryption such as AES are a different case: NIST writes that "AES 128 will remain secure for decades to come" (NIST FAQ).
Whether z will move. Forecasts can move in both directions, and migrations often take longer than planned. The formula is a way to think, not a calculator with a known answer.
What you can do
As an individual: keep your browser, operating system and apps up to date. Quantum-safe key exchange reaches you through software updates. For data that must stay private for decades, such as medical or financial records, ask the organization that holds it how it is protected.
As an organization: write down, per type of data, how long it must stay secret. That is your x. Then find where RSA and elliptic curves protect that data in transit. That decides your y. Start with key exchange for the data with the longest shelf-life. Our practical guide walks through the steps.