Quantum Security Readiness Calculator

Mosca's theorem: if retention time (x) + migration time (y) > time to a quantum computer (z), you are already too late; gap = x + y − z. Mosca's inequality compares the life of your secrets plus the time you need to change algorithms against the arrival of a quantum computer. Because Shor's algorithm breaks RSA, DH and ECC outright — while Grover only halves symmetric strength — the exposure is concentrated in key exchange and signatures.

Traffic recorded today can be decrypted the moment Shor becomes practical, so anything with a ten-year confidentiality requirement needs hybrid key exchange in production now, not when the hardware ships.

This calculator takes 5 inputs: Years your data must stay confidential, Years needed to migrate your estate, Years until a cryptographically relevant quantum computer, Estate already using post-quantum or hybrid crypto, Traffic protected only by RSA or ECC. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Key exchange, because captured traffic is the retroactive risk. Hybrid X25519+ML-KEM is already deployed in major browsers and TLS libraries. Signatures can follow later — a forged signature needs the quantum computer to exist at the time of the attack.

Effectively yes. Grover's algorithm reduces it to a 128-bit search, which remains infeasible, and the huge circuit depth involved makes even that speed-up largely theoretical. Symmetric cryptography needs no replacement, only larger keys.