⚛️ quantum physics

Cost of Delay for Post-Quantum Migration: Putting Classical and Harvest-Now-Decrypt-Later Risk on One Ordered List

This paper proposes a unified framework that converts both classical security risks and Post-Quantum "Harvest-Now-Decrypt-Later" threats into a single currency-based "cost of delay" metric, enabling organizations to optimally prioritize and sequence cryptographic migration tasks against existing security backlogs.

Original authors: Animesh Shaw

Published 2026-10-08

📖 4 min read🧠 Deep dive

CC BY 4.0

Original authors: Animesh Shaw

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a vault where the most valuable secrets of our digital world are kept. For decades, the locks on these vaults have relied on mathematical puzzles that are easy to create but nearly impossible to solve without the right key. However, a new kind of machine is on the horizon—a quantum computer so powerful it could crack these puzzles in moments, rendering the current locks useless. The danger is not just that these machines will arrive in the future; it is that enemies can be recording encrypted data today, storing it in vast digital warehouses, and waiting to unlock it once the quantum machines arrive. This is known as "harvest now, decrypt later." Organizations face a difficult choice: they have a backlog of ordinary security problems to fix, like broken doors or weak windows, and they must also prepare for this future quantum threat. But they have no common way to measure which problem is more urgent. Is it more important to fix a leaky roof today or to reinforce the vault against a future storm?

An independent researcher named Animesh Shaw has developed a new method to answer this question by translating both threats into a single, familiar language: the cost of delay. Instead of using abstract scores or separate lists, the method calculates exactly how much money an organization loses for every year it waits to fix a specific piece of data. For ordinary security risks, this is a standard calculation based on how likely a breach is and how much damage it would cause. For the quantum threat, the calculation is more subtle. It measures the rate at which waiting allows an enemy to record more data that will eventually be decrypted. The key innovation is that these two calculations are not simply added together. The model recognizes that if a classical hacker steals the data first, the quantum enemy has nothing left to steal. By accounting for this competition, the method produces a single, precise annual cost for delaying action on any specific asset.

To test this approach, the researcher applied it to four different types of public systems: a national identity platform, a core banking system, a medical record system, and a demonstration online store. The study did not use real, private data from these organizations but rather built models based on public documentation and reasonable assumptions about how these systems work. The results revealed a clear pattern. For data that is short-lived or changes frequently, the ordinary security risks usually dominate the list of priorities. However, for data that must remain secret for decades and is transmitted over networks where it can be easily recorded, the quantum threat becomes the primary driver of urgency. In one specific case involving a national identity system, the new method moved a type of registration packet from sixth place on the priority list to the very top, a shift that would not have happened if only traditional security risks were considered.

The study also explored how much the final ranking depends on uncertain guesses, such as exactly when the powerful quantum computer will arrive. The analysis showed that for most systems, the order of priorities is surprisingly stable. The biggest factors driving the cost of delay are not the arrival date of the quantum machine, but rather the value of the data and how much of it is generated and transmitted each year. While the quantum threat is real and serious, it does not completely overturn the standard way organizations prioritize their security work, except for a specific class of long-lived, quiet, and recordable data. For these specific assets, the cost of waiting is so high that they must be addressed immediately, regardless of other pressing issues.

The researcher verified the method through rigorous mathematical proofs and computer simulations, ensuring the logic holds up under different scenarios. The findings suggest that while organizations should not panic and abandon their current security plans, they must identify and protect their long-term secrets with a new sense of urgency. The method provides a clear, quantitative way to decide which data needs the strongest protection right now, ensuring that limited resources are spent where they will prevent the most irreversible loss. It turns a complex, futuristic dilemma into a practical financial decision, allowing leaders to see clearly which digital assets are most at risk of being stolen today and decrypted tomorrow.

Technical Summary: Cost of Delay for Post-Quantum Migration

Problem Statement
Organizations face a critical decision-making gap when prioritizing security work: they must choose between migrating assets to post-quantum cryptography (PQC) and addressing a backlog of classical security findings. Currently, these two threats lack a common unit of measurement. Classical risk is typically quantified as an annualized loss expectancy (currency per year), while existing post-quantum scoring models (e.g., QARS) are dimensionless, quantum-only metrics. Consequently, decision-makers have no principled way to determine whether a specific PQC migration is more urgent than a classical vulnerability fix, or how to sequence these tasks within a single resource-constrained backlog. Furthermore, existing models often fail to account for the "competing risks" nature of the problem, where a classical breach might occur before a quantum computer arrives, potentially double-counting risk or misrepresenting the urgency of deferral.

Methodology
The paper proposes a unified Cost of Delay (CoD) framework that expresses both classical and "Harvest-Now-Decrypt-Later" (HNDL) risks in the same unit: currency per year ($/year).

Mathematical Formulation:
- Classical Term ( $CoD_c$ ): Defined as the Annualized Loss Expectancy ( $\lambda V$ ), where $\lambda$ is the classical disclosure hazard rate and $V$ is the asset value.
- Quantum Term ( $CoD_q$ ): Defined as the rate at which deferring migration commits irreversible HNDL loss. This is calculated as $r \cdot h \cdot I(\kappa, L)$ $r \cdot h \cdot I (κ, L)$ , where:
  - $r$ is the annual turnover (new value flowing per year).
  - $h$ is the fraction of traffic recordable by an adversary.
  - $L$ is the required confidentiality lifetime.
  - $I(\kappa, L)$ is an integral representing the probability that a Cryptographically Relevant Quantum Computer (CRQC) arrives within the asset's lifetime and before a classical breach occurs.
- Coupling: The model uses a competing-risks framework where the classical hazard ( $\lambda$ ) and CRQC arrival time ( $T_q$ ) are independent random variables. The quantum term is gated by the probability that the data has not already been disclosed classically, preventing double counting.
- CRQC Arrival Law: The model fits a Weibull distribution to expert survey anchors (from the 2025 Quantum Threat Timeline Report) to estimate the probability density of CRQC arrival, creating both optimistic and pessimistic scenarios.
Verification and Analysis:
- Mathematical Proofs: Twelve propositions are proved regarding the model's properties, including unit invariance, the non-additive nature of the coupling, and the existence of a dominance threshold.
- Numerical Verification: The implementation is validated against Monte Carlo simulations, adaptive quadrature, and an independent JavaScript implementation.
- Case Studies: The method is applied to four public systems (MOSIP, Apache Fineract, OpenMRS, and a demo web shop) using parameters derived from public documentation.
- Statistical Analysis: Input uncertainty is propagated via perturbation (re-drawing parameters from ordinal bands) to assess the stability of rankings. Variance decomposition (Sobol' indices) identifies drivers of uncertainty.

Key Contributions

Unified Currency: A formulation expressing both classical and quantum risks as a single cost of delay in currency per year, eliminating the need for arbitrary weighting or normalization constants.
Competing-Risks Coupling: A mathematical proof that coupling the quantum term with the classical hazard removes double counting. The paper proves the resulting metric is not a weighted sum of separate classical and quantum scores.
Dominance Threshold ( $\lambda^*$ ): The derivation of a specific threshold for the classical hazard rate. Below this threshold, the quantum term dominates the total cost of delay, regardless of the asset's monetary value. This identifies a specific class of assets (low classical hazard, long lifetime, recordable, high turnover) where PQC migration is uniquely urgent.
Scheduling Optimality: Application of Smith's rule to prove that ranking assets by this unified Cost of Delay is optimal for sequencing work under constant loss rates. The paper quantifies the "price" of keeping classical and quantum work in separate queues.
Empirical Verification: A rigorous statistical analysis of four systems, demonstrating that for long-lived assets, the quantum term can decisively reorder priorities, whereas for medium-lifetime systems, the reordering is often less significant than analyst disagreement (input noise).

Results

Reordering Impact: In the MOSIP (national identity) case study, the inclusion of the quantum term moved "registration packets" from rank 6 (classical-only) to rank 1. In 55% of 4,000 perturbed simulations, this asset remained in the top two, whereas it was never in the top two under classical-only ranking.
Signal-to-Noise: For MOSIP, the quantum term reordered pairs of assets more frequently than input uncertainty did (signal-to-noise ratio of 1.36). For other systems (Fineract, OpenMRS, Boutique), the reordering was often less than the noise introduced by differing analyst judgments.
Variance Drivers: Sensitivity analysis revealed that asset value ( $V$ ) and annual turnover ( $\tau$ ) explain 73–91% of the uncertainty in the quantum term. The specific arrival date of the CRQC explains only 3–17% of the variance, particularly for assets with lifetimes exceeding 30 years where the arrival probability has saturated.
Scheduling Efficiency: Simulations showed that a single backlog ranked by the unified Cost of Delay is within 5–10% of the exact optimum (derived via dynamic programming), whereas maintaining separate classical and quantum queues increases committed loss by 27–150%.
Comparison to QARS: The unified CoD model produced different rankings than the Quantum-Adjusted Risk Score (QARS), particularly because QARS does not account for classical hazards and treats value in discrete bands rather than continuous currency.

Significance and Claims
The paper modestly claims to provide a construction and verification of a new prioritization method, rather than a new mathematical theory or a validated empirical outcome.

Practical Utility: It offers a principled way to integrate PQC migration into existing risk registers without siloing the problem. It explicitly identifies where the quantum threat changes the priority list (long-lived, quiet, recordable data) and where it does not.
Decision Support: The model does not produce a single "calibrated score" but rather reports how rankings change under different assumptions (e.g., CRQC arrival dates, discount rates), allowing decision-makers to see the boundaries of uncertainty.
Limitations: The author explicitly states that the parameters are assumed from public documentation, not elicited from practitioners, and the results are illustrative. The model assumes confidentiality is the primary risk (ignoring integrity/availability) and assumes independence between classical and quantum adversaries. The arrival law is an interpolation of two data points, extrapolated beyond 15 years.
Conclusion: The quantum term decisively changes the priority list only for specific classes of long-lived data. For most medium-lifetime systems, the quantum term changes the magnitude of the risk but not necessarily the order beyond the noise of input uncertainty. The primary value is the ability to compare disparate threats on a single, economically grounded timeline.

Technical Summary: Cost of Delay for Post-Quantum Migration

More like this