Post-quantum concepts

Two quantum algorithms matter, and they do very different amounts of damage. Conflating them is the most common source of bad migration plans.

HNDL is the reason post-quantum migration is urgent before any quantum computer exists. An adversary records your encrypted traffic today, stores it cheaply, and decrypts it years later once a cryptographically relevant quantum computer becomes available.

If the data inside is still confidential at that point — health records, financial data, state secrets, long-lived credentials, source code — the breach happened the day it was harvested, not the day it was decrypted. Nothing was "hacked" today, and that is precisely what makes it easy to under-prioritize.

Three conditions have to hold at once for a flow to be genuinely HNDL-exposed, and all three are needed — which is why algorithm counts alone are a poor prioritization signal:

1. 1The cryptography is quantum-vulnerable — a Shor-breakable key establishment protects the flow.
2. 2The traffic is harvestable — a passive collector can actually capture it. Internet-exposed beats partner-exposed beats internal-only; not harvestable means never HNDL-relevant, no matter how weak the algorithm.
3. 3The data still matters later — its confidentiality lifetime extends past the point where the cryptography becomes breakable.

The third condition has a standard formulation: act now if X + Y > Z.

Read it as a race. If the years your data must remain secret plus the years it takes you to migrate exceed the years until a CRQC, then traffic harvested today will still matter when it becomes breakable — the exposure already exists, even though the decryption capability does not.

Practical rule of thumb, independent of any product: if your data confidentiality lifetime exceeds roughly 5–10 years, start migrating now.

NIST standardized the first post-quantum replacements in August 2024. RelixQ names concrete targets rather than telling you to "use PQC".

The Mosca inequality gives a per-data-flow answer to "when?". Mandates give a calendar answer. For most organizations the harvest-now horizon binds earlier than any regulator does.

Mapping RelixQ output onto these frameworks is covered in Standards and compliance.

That stance has two practical consequences you will meet on every screen and in every export. First, claims are typed: proven (a reproducible classical break in a local sandbox), modeled (a dated exposure window or a cited cost estimate, nothing executed), or observed (a read-only negotiation fact). Second, absent data is shown as absent: a scope that has never been scanned reads Not yet assessed, never 100 and never green.