Q-Day And Mosca's Inequality: How To Tell If You Are Already Late

“When will quantum computers break encryption?” is the question every board asks, and it has no reliable answer. The more useful question is whether your organisation would be ready if it happened within the range of dates experts consider plausible. Michele Mosca, a quantum computing researcher, gave a compact way to test that, and NIST repeats it in its draft transition guidance.¹

This article defines the terms people use for the threat, explains Mosca’s inequality, and shows what current expert opinion says about the timing. The calculator lets you try your own numbers.

CRQC And Q-Day

Agencies use the term cryptographically relevant quantum computer, or CRQC, for a quantum computer able to break today’s public-key cryptography in practice. NIST’s November 2024 draft states that no such machine exists,¹ and the expert survey published in March 2026 still treats one as a future event.² Q-Day is an informal, media-friendly name for the day one does.

The phrase “Q-Day” suggests a single public moment, and that picture can mislead. The first machine capable of breaking a key might be run in secret, and early machines could take days or weeks per key before later ones are faster. For planning, it is safer to think of a window that opens gradually than of a date that will be announced.

Mosca’s Inequality

The test uses three numbers, each measured in years from today:

• X is the shelf life: how long the data you protect today must stay confidential.
• Y is the migration time: how long it will take to move the relevant systems to quantum-resistant cryptography.
• Z is the threat timeline: how long until a CRQC exists.

If X plus Y is greater than Z, the migration finishes too late. Data still being encrypted with the old algorithms towards the end of the migration will need to stay secret beyond the point when a CRQC can read it. If X alone is greater than Z, even data encrypted today is exposed. NIST puts it this way: organisations must start transitioning before X plus Y exceeds Z, so even a quantum computer a decade away means starting the migration today.¹

The value of the inequality is that it does not need a precise Z. If X plus Y is already 20 years for some systems, the conclusion holds whether Z is 10 or 15 years away. It also shows where you have influence. Y shrinks when systems are built so that algorithms can be swapped easily, and starting early means the migration ends sooner even if Y stays the same. X is set by how long disclosure would cause harm. Deleting stored data does not shorten it, because an attacker may already hold a copy; what helps is sending less long-lived sensitive data over quantum-vulnerable channels in the first place.

Estimating Y Honestly

Organisations tend to underestimate migration time. NIST observes that past cryptographic migrations have taken more than a decade and expects this one, which is more complex, to take at least as long.¹ The UK National Cyber Security Centre’s timeline spreads the work across a decade: discovery and an initial plan by 2028, priority migrations by 2031 and completion by 2035.³ A large organisation that has not yet built a cryptographic inventory should be wary of assuming a Y of only a few years.

What Experts Say About Z

A widely cited source on Z is the Quantum Threat Timeline Report from the Global Risk Institute and evolutionQ, written by Michele Mosca and Marco Piani. The 2025 edition, published on 9 March 2026, surveyed 26 experts. It describes a CRQC within 10 years as quite possible (28 to 49 percent) and within 15 years as likely (51 to 70 percent), and says the experts see the timeline as having accelerated compared with earlier editions.²

These are expert opinions, not measurements, and the ranges are wide. They are not the only signal, though. Engineering estimates of the machine needed have also fallen sharply in recent years, as described in How Many Qubits To Break RSA and Elliptic Curves Fall First.

For historical context, Mosca’s own 2015 paper estimated a one in two chance of breaking RSA-2048 by 2031.⁴ Governments plan on similar horizons. US National Security Memorandum 10 sets 2035 as the primary target for reducing quantum risk as far as feasible.¹

Using The Test In Practice

Apply the inequality per system or per data class, not once for the whole organisation. Estimate X from retention rules and business value. Estimate Y from what the system depends on: vendor support for post-quantum algorithms, hardware refresh cycles, certificate infrastructure and partner connections. Then compare against a range for Z rather than a single number. Systems where X plus Y exceeds even the latest date in that range are exposed in every scenario and go to the front of the queue. Systems that only exceed the earliest date come next. The harvest risk that makes X so important is explained in Harvest Now, Decrypt Later.