One way to think about when to migrate cryptography is "if the number of years x for which data must be kept secret plus the number of years y the migration to new cryptography takes exceeds the number of years z until a quantum computer able to break the cryptography appears, there is already a danger" (Mosca's inequality). With x = 10 years, y = 5 years and z assumed to be 12 years, which of the following is the correct judgment?

Answer: C. x + y exceeds z by 3 years, so there is already no time to spare

x + y = 10 + 5 = 15 years, which exceeds z = 12 years by 3 years. Even if the migration starts now, it finishes 5 years later, and data sent with the old cryptography in the meantime must be kept secret for 10 years from when they are sent. For example, data sent 4 years from now must be protected until 14 years from now, yet they may be broken after 12 years, so data sent with the old cryptography after 2 years from now will have too short a protection period. Because the estimate of z is highly uncertain, fields handling long-term secrets in particular are advised to start migrating early.

• A. About 7 years is z − y, the value obtained without considering the period x for which data must stay secret.
• B. About 2 years is z − x, the value obtained without considering the migration period y.
• C. Correct. x + y = 15 exceeds z = 12, so the migration must start immediately.