post-quantum readiness

Quantum Risk

Mosca inequality applied to the live cryptographic inventory: data lifetime plus migration time versus the modelled arrival of a cryptographically relevant quantum computer. Adjust the model inputs to recalculate.

crqc arrival estimate

2038.5

50% confidence midpoint · simulated

assets failing mosca

5/9

lifetime + migration > arrival

certificates in scope

1,437

discovered · observed

quantum-safe systems

hybrid ML-KEM deployed

model inputs

Arrival recalculation

logical qubit scaling rate38% / yr

Derived from published roadmaps across five hardware programmes.

error-correction progress index52

Surface-code overhead reduction relative to the 2025 baseline.

assumed migration duration6 yrs

Enterprise-wide cryptographic replacement, including partner mTLS renegotiation.

cumulative break probability

At the current inputs, a cryptographically relevant machine is more likely than not by 2038.5. Any data that must stay confidential past 2033 needs migration to begin now.

inventory

Cryptographic assets by Mosca shortfall

System	Algorithm	Certs	Data life	Migration	Shortfall
Document archive encryptionRecords Management	AES-256 + RSA transport2048	47	25y	planned	+18.5y
Internal PKI rootIdentity Services	RSA4096	3	20y	planned	+13.5y
Code-signing chainPlatform Engineering	RSA4096	9	15y	not started	+8.5y
PCI Card Vault HSM wrappingData Protection	RSA3072	14	12y	not started	+5.5y
Interbank Settlement TLSPayments Platform	RSA2048	219	9y	planned	+2.5y
Customer messaging E2EEDigital Channels	ML-KEM-768 hybrid768	22	3y	complete	clear
Partner API mTLSIntegration Services	RSA2048	128	6y	not started	clear
Retail Banking Portal TLSIdentity Services	ECDSA256	611	2y	in progress	clear
Branch VPN concentratorsNetwork Engineering	ECDH256	384	1y	in progress	clear

CQ-01 · Payments Platform

Interbank Settlement TLS

critical

algorithm

RSA 2048

certificates

219

data lifetime

9 yrs

exposure

critical

harvest-now-decrypt-later window

protected to 2035

Traffic captured today stays sensitive until 2035, which is after the 2038.5 arrival midpoint. Migration is planned — this asset fails the inequality under current inputs.