Mosca's Theorem: Quantum Crypto Risk Panels

Threat Timeline

Data shelf-life X 15 yr

PQC migration time Y 5 yr

Years to Q-day Z 10 yr

Harvest rate 3.6 pkt/yr

Playback speed 1.0×

Mosca Risk Verdict

—

X + Y vs Z

Live Readouts

Elapsed year

0.0 / 10

Packets harvested

Exposed at Q-day

PQC-safe packets

Legend

RSA/ECC — vulnerable, still stored PQC-protected — quantum-safe Exposed the moment Q-day hits Expired before Q-day — no longer sensitive

How it works

An adversary doesn't need a quantum computer today to threaten today's traffic — they only need a hard drive. This is the "harvest now, decrypt later" attack: intercept and store RSA/ECC-encrypted data now, then decrypt it retroactively once a cryptographically-relevant quantum computer exists.

Mosca's theorem gives the exact condition for risk. Let:

X = shelf-life  — years the data must stay confidential
Y = migration   — years needed to deploy post-quantum crypto
Z = Q-day       — years until a quantum computer can break it

Risk exists if:  X + Y  >  Z

This 2D build swaps the 3D vault-with-flying-packets scene for three linked data panels: a Mosca timeline bar that draws X, Y and Z as literal number-line segments so the inequality is a geometric fact you can see; a stacked area chart of packet population computed analytically (harvested, safe, vulnerable, exposed, expired all have closed-form solutions in the harvest rate and the three timeline years — no per-packet simulation loop needed); and a risk heatmap sweeping shelf-life against Q-day for the current migration time, so you can see the whole risk surface at once, not just one scenario. Drag directly on the timeline to scrub time, or drag on the heatmap to pick new (X, Z) values.

The real numbers are sobering: Gidney & Ekerå (2019) estimate ~20 million noisy physical qubits and about 8 hours of runtime to factor a 2048-bit RSA key with Shor's algorithm — a resource level well beyond today's processors but not beyond a multi-decade roadmap. NIST finalized its post-quantum standards (ML-KEM for key exchange, ML-DSA for signatures) in 2024 precisely so organizations can start the migration clock (Y) before Q-day (Z) arrives, which is the only lever this simulation lets you actually control.

Harvesting…

Mosca Timeline — drag to scrub

Packet Population Over Time

Risk Heatmap — shelf-life × Q-day (drag to pick)