Mosca's theorem

Mosca's theorem, also called Mosca's inequality, is a rule of thumb for judging the urgency of post-quantum migration. It states that if X is how long your data must stay secure, Y is how long it takes to migrate systems to Post-quantum cryptography, and Z is the time until a Cryptographically relevant quantum computer exists, then you needed to start migrating already when X plus Y exceeds Z.

#Reading the inequality

When X + Y is greater than Z, secrets that must remain confidential are effectively already exposed, because data captured today can be held under Harvest now, decrypt later until Q-Day arrives. Published by Michele Mosca, the formulation reframes an uncertain future date (Z) into a present-day planning decision driven mostly by values an organization controls (X and Y).

#Why it drives migration plans

Because the migration time Y for large systems is measured in years, the inequality can hold today even under conservative estimates of Z. This is the core reason standards bodies urge inventory and planning now rather than waiting for a demonstrated quantum computer; the argument underpins much of the guidance behind PKI migration to post-quantum.