← Back to Blog Education

Mosca's Theorem: Worked Examples for Every Industry (Healthcare, Finance, Legal, Defense)

8 min read

The Theorem

Formulated by Dr. Michele Mosca (IQC Waterloo) and published as IACR ePrint 2015/1075 in November 2015:

If X + Y > Z, migration to Post Quantum Cryptography should already have started.

X = years data must remain confidential.
Y = years required to fully migrate.
Z = years until a Cryptographically Relevant Quantum Computer exists.

Worked Examples

Healthcare

X = 50+ years (HIPAA patient lifetime + heirs).
Y = 5 years (large hospital system).
Z = 10-20 years (GRI 2025: 28-49% 10-year probability).
X + Y = 55 > Z. Clearly past migration threshold.

Finance

X = 7-25 years (regulatory retention, loan lifecycle).
Y = 3-5 years.
Z = 10-20.
X + Y = 10-30 > Z typically. At or past threshold.

Legal (Attorney-Client)

X = indefinite (privilege survives client death in most jurisdictions).
Y = 2-3 years (small firm) to 5 years (large firm).
Z = 10-20.
X + Y = infinity > Z. Past threshold.

Defense/Classified

X = 25-75 years (classification schedules).
Y = 3-7 years per CNSA 2.0 timeline.
Z = 10-20.
X + Y = 28-82 > Z. Clearly past threshold. NSA CNSA 2.0 2035 deadline aligns.

Insurance

X = 30-50 years (life, annuities, long-tail claims).
Y = 3-5 years.
Z = 10-20.
X + Y = 33-55 > Z. Past threshold.

Pharma

X = 25+ years (clinical trial data, NDA).
Y = 3-5 years.
Z = 10-20.
X + Y = 28-30 > Z typically. Past threshold.

Small Business (Typical SaaS Customer)

X = 5-7 years (typical contract + regulatory tail).
Y = 1 year (using vendor PQC features).
Z = 10-20.
X + Y = 6-8 < Z usually. Breathing room, but not much.

Journalism (Source Protection)

X = indefinite (source identity may be lifetime-sensitive).
Y = 1-2 years (migrating to Signal/PQC tools).
Z = 10-20.
X + Y = infinity > Z. Past threshold.

The Insight

Y is the variable most under your control. You cannot reduce X (data lifetime is a compliance reality) or increase Z (you cannot delay the physics). You can only start Y earlier. This is why every major security organization pushes for urgent migration.

Frequently Asked Questions

Who is Michele Mosca?

Mathematician at the Institute for Quantum Computing, University of Waterloo. Co-founder and deputy director of IQC, co-founder of evolutionQ. Formulated the X+Y>Z theorem in IACR ePrint 2015/1075.

Is the theorem a proof?

It is a decision rule rather than a mathematical proof. It formalizes the intuition that if confidentiality horizon plus migration time exceeds CRQC horizon, you are already losing data every day.

How do I estimate Z?

Use expert survey data. Global Risk Institute 2025 puts 10-year CRQC probability at 28-49%. Plan for the higher end of that range unless your risk tolerance justifies optimism.

What if I'm unsure about X?

Use the longest reasonable retention period for your regulated asset class. HIPAA for healthcare, FDA 21 CFR Part 11 for pharma, ABA rules for legal, etc. Err on the longer side.

Sources

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/moscas-theorem-worked-examples.