Mosca's inequality calculator

Mosca's inequality is the simplest test for when to start post-quantum migration. It compares three numbers: how long your data must stay secret (X), how long it will take to migrate the systems protecting it (Y), and how long until a quantum computer could break today's public-key cryptography (Z). If X plus Y is larger than Z, data you protect today is at risk under that timeline.

Nobody knows Z. So this calculator doesn't ask you to guess one number. It asks for three scenarios and shows what each would mean. Mosca's inequality is a planning heuristic, not a probability model: it can't tell you how likely a quantum computer is within Z years. Treat the results as a way to test assumptions, not a forecast.

Nothing you enter is stored or sent anywhere; the calculation runs in your browser.

How to read the result

• At risk under this scenario means your assumed confidentiality lifetime and migration lead time together exceed your assumed time to a cryptographically relevant quantum computer. Data protected today with vulnerable public-key cryptography, if recorded, could become readable while it still matters, provided an attacker can exploit that cryptography and recover the secrets. It's a planning signal, not a prediction that a specific system or dataset will be compromised.
• On the edge means X plus Y equals Z exactly: no margin at all.
• Margin means the scenario leaves time to spare, but only if your X and Y estimates hold.

How the numbers work

All three numbers count years from the same starting point: this year, taken from your device's clock. The test is whether X + Y is greater than Z.

• Finish-by year = this year + Z − X. New protection needs to be in place by then, so that data protected from that point stays secret until the assumed quantum computer arrives.
• Start-by year = this year + Z − X − Y: the finish-by year minus your migration lead time. If it's in the past, the scenario says you should already have started.

Both assume X is the remaining confidentiality lifetime of data you protect from now on, and that migration must be complete before that lifetime overlaps the assumed threat. A start-by year can be in the past even when the assumed quantum computer is years away; that's the point of the test.

If even your later scenario shows a risk, the answer doesn't depend on predicting the future. That's the argument most risk committees find persuasive.

What the calculator doesn't tell you

• It covers confidentiality. It models the risk that data encrypted today could be decrypted later. Digital signatures are a different problem: a capable quantum computer could undermine vulnerable signature schemes, while replacing signing keys, certificates, verification software and trust relationships may take years. Assess those with a separate inventory and migration plan.
• Z is not known. Published resource estimates, such as Craig Gidney's 2025 estimate for 2048-bit RSA, describe what a machine would need under stated assumptions. They don't say when one will exist.
• X and Y are estimates too. Retention rules give a floor for X. Y is usually longer than a first guess, because suppliers and partners have to move as well.
• It isn't a risk assessment. It's a way to start one. The banking guide's prioritisation chapter shows how to apply the test item by item.