What is Mosca's inequality?
Mosca's inequality is a simple planning rule, set out by the University of Waterloo researcher Michele Mosca, for deciding whether quantum computing is already a problem for some of your data. It compares three spans of time. If the time your data must stay secret, plus the time it will take you to migrate, is longer than the time until a capable quantum computer exists, then data you protect today is already at risk.
The three numbers
- X: how long the data must stay confidential, from now. For a bank, mortgage files and identity records can mean decades.
- Y: how long it will take to move the systems protecting that data to post-quantum cryptography, including suppliers and testing.
- Z: how long until a quantum computer can break today's public-key cryptography. Nobody knows this number.
If X + Y is greater than Z, data protected today is at risk under that assumption.
Why you don't need to know Z
The rule's strength is that it doesn't need a forecast. Instead of guessing Z, you ask whether X + Y could run past the earliest credible estimate. For long-lived data and slow migrations, the answer is often yes even under cautious assumptions, which is the case for starting now. The reason the danger is real today is harvest now, decrypt later: data recorded today can be decrypted once the machine exists.
What about signatures?
The inequality is about confidentiality. Signatures can't be harvested in the same way, because forgery is only possible once a capable machine exists. For them, the question is simpler: will replacing the signing and checking systems (Y) take longer than the time until that machine exists (Z)? Because card networks, terminals and certificate chains change slowly, Y is often long.
Try your own numbers
The Mosca calculator runs the test against three timeline scenarios at once, and the banking guide uses it to decide what to fix first.
Common confusions
- "It predicts when quantum computers will arrive." No. Z is an input you test, not something the rule tells you.
- "It only matters once Z is known." No. Its point is that you can act without knowing Z.
- "X is how long we keep the data." Not quite. It's how long the data must stay secret, which can be longer or shorter than the retention period.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- Peer-reviewed paperCybersecurity in an era with quantum computers: will we be ready?Michele Mosca, IEEE Security & Privacy, 2018
- Government guidanceNIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography StandardsNIST, 2024