A Scenario-Based Evaluation of CRQC+AI Vulnerability Spectrum for TLS 1.3 Cryptographic Dependencies

1. Introduction

• December 31, 2030 and December 31, 2031 are the stated federal PQC deadlines for key establishment and digital signatures, respectively.These deadlines cover federal high-value assets and high-impact systems, excluding National Security Systems. The paper recommends replaceable PQC within crypto-agile hybrid frameworks rather than treating PQC deployment alone as sufficient.Source: §1 · pp. 2, 3, 5
• HHL faces intrinsic LWE matrix-density and conditioning hurdles; geometric simplification remains a falsifiable hypothesis, with no demonstrated PQC-breaking mechanism.HHL is treated as a polynomial-acceleration effort rather than an established break. The broader investigation includes quantum-accelerated AI and AI-enhanced quantum methods, quantum annealing, variational quantum eigensolvers, and side-channel approaches.Source: §1 · pp. 3–4
• The primary contribution is a reproducible scenario instrument estimating attack runtimes and 50% likelihood crossovers, with explicit rules for parameter recalibration.Explicit parameters, pseudocode, sensitivity analysis, and falsification criteria support external scrutiny. Future observations that follow or deviate from modeled curves inform revisions to specific parameters.Source: §1 · p. 4
• Shor threats to RSA/ECC are mechanism-backed; lattice risks require an unproven structural collapse, while hash-based and symmetric risks remain hypothesis-only.The paper claims no known break of current standardized PQC algorithms. Evidence-tier promotion and demotion triggers specify conditions for changing confidence, not predictions that those conditions will occur.Source: §1 · pp. 4–5

1.1 Scope and Exclusions

• The instrument measures TLS 1.3 primitive erosion, not estate-level migration readiness, and its best-case conclusions do not transfer directly to other protocols.It covers RSA-2048, ML-KEM768/1024, ML-DSA-44, SLH-DSA, and AES-256. TLS offers ephemeral, rotatable keys, negotiated algorithms, and short-lived certificates; organizational architecture, inventory, rotation authority, and change control remain outside scope.Source: §1.1 · pp. 5–6

1.2 Approach and Instrument Map

• Three linked instruments derive a hardware budget, generate runtime and feasibility curves, and express lattice and hash contingencies in explicit cryptanalytic units.The channel model tracks qubit count, gate fidelity, code efficiency, and decoder latency; capability curves use hardware and AGI-gated software exponentials. Shared dimension-collapse assumptions make agreement among instruments consistency, not independent corroboration.Source: §1.2 · p. 6

2.1 Harrow-Hassidim-Lloyd Background

• Unmodified HHL does not break LWE: dense, poorly conditioned matrices, noisy decoding, and coordinate-by-coordinate secret recovery defeat its exponential-speedup assumptions.Improved hardware cannot remove these structural obstacles; HHL and LCHS are confined to polynomial acceleration of an inner linear-algebra step. A 2024 polynomial-time quantum LWE claim was withdrawn after a bug was identified.Source: §2.1 · pp. 6–7

2.2 Low-Dimensional Geometric Algebra Background

• Geometric quantum optimization, quantum learning, and AI-guided representation searches remain speculative routes to discovering exploitable lattice structure, not evidence that such structure exists.Optimizers require structure supplied by the unknown embedding because they lack demonstrated scaling advantages on unstructured problems. Quantum learning additionally faces trainability and classical-simulation limits, with no demonstrated standardized-PQC application.Source: §2.2.1 · p. 7, §2.2.4 · p. 8, §2.2.5 · p. 8

2.2.5 Parameterized Geometry as an Attack Vector

• β → β(1 − ρ), with ρ ∈ [0, 1), parameterizes conjectured geometric reduction of lattice hardness, not a demonstrated standardized-PQC attack.The hypothesis requires an efficiently computable low-dimensional embedding that exposes useful structure, but no construction achieves positive ρ against standardized LWE lattices. The paper quantifies the collapse required for its modeled 2032–2035 lattice crossovers rather than asserting attainability.Source: §2.2.2 · pp. 7–8, §2.2.5 · p. 8, §2.2.3 · p. 8

2.3.1 Key Aspects of Quantum Annealing

• Quantum annealing seeks low-energy Ising/QUBO solutions, but exponentially closing spectral gaps can force exponential runtime despite tunneling advantages on thin barriers.Adiabatic evolution must be slow relative to the inverse square of the minimum spectral gap. Specialized superconducting annealers, including D-Wave systems, target optimization rather than arbitrary quantum algorithms.Source: §2.3.1 · p. 9, §2.3.2 · p. 10

2.3.3 Applications of Quantum Annealing

• Annealing’s optimization benefits are instance-specific, while machine-learning demonstrations remain small and classical methods dominate standard benchmarks.Hardware embedding consumes qubits, while sparse connectivity and analog noise constrain scale. Learning uses annealers as optimizers or approximate samplers with unknown, instance-dependent effective temperatures; any cryptanalytic contribution would support pipeline components rather than constitute a standalone capability.Source: §2.3.3 · p. 10, §2.3.3.2 · pp. 10–11

2.3 Quantum Annealing Background

• Quantum annealing has demonstrated no scaling advantage over classical factoring or lattice attacks near cryptographic parameters and is not a standalone break.Small factoring demonstrations require substantial classical preprocessing, while lattice formulations remain existence results rather than scaling evidence. Defensive applications include intrusion-detection feature selection, resource placement, and vulnerability analysis.Source: §2.3 · p. 8, §2.3.3.2 · p. 11

2.4.1 How VQE Works

• VQE estimates ground-state energies through hybrid optimization, but has no established reduction from factoring, discrete logarithms, or lattice problems.A quantum circuit measures Hamiltonian terms while a classical optimizer updates its parameters. Exponentially vanishing gradients can make variational training impractical at cryptographic scale.Source: §2.4.1 · pp. 11–12, §2.4 · p. 11

2.4.2 Key Advantages of VQE

• VQE’s shallow hybrid circuits, relative noise resilience, and flexible ansätze suit near-term hardware, but do not establish cryptanalytic capability.Error mitigation can extend its reach on noisy devices. Shallow circuits, heuristic optimization, and trainability limits also restrict the deep, structured computation required for cryptanalytic attacks.Source: §2.4.2 · p. 12

3.1 Current Timeline Projections

• Model-generated risk bands span linear and exponential CRQC+AI extrapolations, with the upper bound assuming a meaningful probability of AGI by end-2028.The section favors a spectrum of algorithm-specific risks over a single Q-Day. Mosca-based migration reasoning combines confidentiality duration and migration time with HNDL exposure, without requiring a known quantum-break date.Source: §3.1 · pp. 12–13

3.1.1 Historical Analogues for the PQC Transition: the 2008 Financial Crisis and Y2K

• $2.0 to $3.3 trillion in GDP-at-risk is modeled for a single-day quantum-enabled attack on one top-five U.S. bank’s Fedwire access.Estimated direct costs are roughly $730 billion to $1.95 trillion; these are scenario-specific exposure estimates, not comprehensive economic totals. The authors therefore favor the 2008 financial crisis as an analogue for systemic contagion, retaining Y2K chiefly for its deadline-driven remediation lesson.Source: §3.1.1 · pp. 13, 14, 16
• 25 to 30% public recognition of PQC threats contrasts with Y2K’s >85% public concern, making regulation the primary pre-breach remediation driver.Figure 4A uses auditable, illustrative reconstructions rather than measured time series; unlike Y2K’s fixed deadline, its 2031 PQC date approximates regulatory deadlines, with classical RSA/ECC disallowed in 2035. Even its projected publicly disclosed 2032 breach does not complete migration by 2035; disclosure is unlikely for state-actor breaches, and covert breaches produce no modeled response uplift.Source: Figure 4A · p. 14, §3.1.1 · p. 15
• 2.5% of enterprise IT budgets may be consumed by PQC migration, according to Moody’s; commercial market forecasts do not measure total migration costs.Y2K remediation cost an estimated $300B to $500B+ globally, whereas the commercial PQC market forecast grows from approximately $1.9B in 2025 to $12.4B by 2035. These measure different quantities, and migration additionally entails inventory discovery, redevelopment, certificate replacement, testing, compliance, hardware refresh, and deployment.Source: §3.1.1 · p. 16

3.1.2 RSA/ECC Vulnerability Spectrum

• In May 2025, Google proposed reducing its 2021 estimate of 20 million qubits for breaking RSA-2048 by 20X [82], then published further reductions in March 2026 [20].As of 2023, RSA/ECC Q-Day was projected for the mid-to-late 2030s; Google moved its PQC-transition deadline from 2030 to 2029 in March 2026. Estimates include less than 100,000 physical qubits for RSA-2048 [84] and 1,193 logical qubits for ECC-256, which are not directly comparable because physical counts include error-correction overhead.Source: §3.1.2 · pp. 17–18

3.1.3 PQC Vulnerability Spectrum for Lattice-Based PQC

• 2^256 classical and 2^232 quantum operations are estimated for Kyber-1024 at BKZ block size β ≈ 877; earlier-break arguments must reduce c or β.The core-SVP model uses cost ≈ 2^(c·β), with c = 0.292 for classical sieving and c = 0.265 for quantum sieving. NIST has made no formal lattice-PQC threat-date prediction; expectations of decades-long durability are described as informal.Source: §3.1.3 · p. 19
• Lattice attack estimates omit full-attack overhead and idealize QRAM, while existing human cryptanalysis limits how much additional exponent erosion can plausibly be attributed to AGI.The quantum sieving exponent 0.2563 predates the assumed 2028 AGI onset (Bonnetain, Chailloux, Schrottenloher and Shen, EUROCRYPT 2023), leaving the model’s collapse parameter to carry an earlier break. Reduced-QRAM algorithms qualify the memory-cost objection, but a cited lower bound permits no quantum speedup without QRAM under its assumptions (Cho, Hhan, Kim, Lee and Shen, IACR ePrint 2024/1700); omitted reduction calls also raise actual work above core-SVP estimates.Source: §3.1.3 · p. 20

3.2.1 AI Improvements for CRQC+AI

• Frontier AI software-vulnerability discovery illustrates enabling progress, not demonstrated cryptanalytic advances against standardized PQC.Other examples include AI-assisted improvement of AI models [94] and OpenAI’s reported disproof of an 80-year-old Erdős conjecture concerning the planar unit distance problem. These examples support the discussion of potential capabilities rather than establish a PQC break.Source: §3.2.1 · pp. 20–21, §3.1.3 · p. 20

3.2.2 Quantum Computing Improvements for CRQC+AI

• Rose’s Law provides only a loose progress envelope, not cryptanalytic resource counts; the hardware driver instead uses platform-agnostic, fault-tolerant logical capacity.Rose’s Law concerns annealer qubits, which do not directly establish resources for Shor, Grover, or lattice sieving. Surveyed enabling advances mostly affect practical cryptanalysis indirectly and sometimes remain early-stage; the paper nevertheless rejects linear-growth assumptions as grounds for ignoring migration mandates and crypto-agility.Source: §3.2.2 · pp. 21–22

3.2.3 Quantum Algorithm Improvements for CRQC+AI

• AI-assisted quantum-algorithm discovery is presented as a plausible research accelerator, while demonstrated autonomous algorithm improvements cited here concern classical sorting.The surveyed work includes AI-enhanced lattice reduction and prospective quantum optimization approaches such as decoded quantum interferometry [130]. These motivate exploration rather than establish a demonstrated quantum cryptanalytic breakthrough.Source: §3.2.3 · p. 22

3.2.4 Side-Channel Attacks; 3.2.5 Key Recovery Attacks; 3.2.6 Hybrid Attacks

• Before 2035, implementation compromise is assessed as more probable than a structural lattice break, requires no quantum computer, and remains outside model costing.Surveyed implementation attacks include randomness faults and masked ML-KEM chosen-ciphertext attacks. Key-recovery and hybrid research includes Oracle MLWE neighborhood search, hybrid-adaptive-LDPC attacks on ML-KEM, and primal hybrid attacks against sparse LWE.Source: §3.2.4 · p. 23, §3.2.5 · p. 23, §3.2.6 · p. 23

3.3 An Acceleration-Factor Model for AI-Compressed Timelines; 3.3.1 What the Acceleration Factor Scales, and What It Does Not

• AI accelerates identifiable engineering tasks, not Shor’s complexity, fault-tolerance thresholds, or coherence limits; named, anchored parameters make that boundary auditable.Eligible tasks include decoding, gate calibration, materials search, code discovery, and circuit optimization. Engineering factors A_i govern hardware readiness, whereas R governs cryptanalytic research; the model accelerates fault-tolerant Shor rather than creating standalone breaks through quantum annealing or variational methods.Source: §3.3.1 · p. 23, §3.3 · p. 23, §3.3.4 · p. 26

3.3.2 Four Channels and Their Baselines; 3.3.3 Empirical Anchors for the Acceleration Factors

• Four independently calibrated engineering channels use published baselines and measured machine-learning gains, defaulting to no acceleration where measurements are absent.RSA-2048 estimates moved from roughly twenty million physical qubits for about eight hours in 2019 [79] to under one million qubits for under a week in 2025 [82], making the target movable. Magic-state distillation remains within code-efficiency and logical-qubit channels unless a demonstration establishes it as an independent bottleneck.Source: §3.3.2 · pp. 24–25, §3.3.3 · p. 25

3.3.4 From Channels to a Distribution Over the Crossover Date

• Channel times follow τ_i = ln(F_i)/(A_i · r_i), with the slowest channel setting crossover and parameter ranges producing arrival probabilities rather than one Q-Day.Setting every A_i to one gives the lower bound; high acceleration ranges combined with aggressive resource estimates give the upper bound, while nonzero arrival probability within the secrecy horizon motivates migration under Mosca’s inequality. Baseline rates average front-loaded roadmaps, and coupling between qubit counts and code efficiency makes independent-channel treatment conservative for the binding channel.Source: §3.3.4 · pp. 25–26
• 2032, 2031, and 2029 are approximate worked-example CRQC crossover years under no, central, and high acceleration, respectively, with raw logical-qubit availability binding.The central and high acceleration factors are A_1 = 1.3 and A_1 = 2.0. Direct evidence for accelerating raw qubit scaling is weakest; demonstrated improvements can instead advance readiness indirectly by reducing required qubit counts.Source: §3.3.4 · p. 26

3.3.5 Falsification Conditions and Tracking Indicators

• Outcome validation remains prospective despite reproducible curves and external concordance; annual, channel-specific recalibration makes projections testable and revisable.As of July 2026, concordance with five independent forecasts, standards timelines, and roadmaps provides support rather than proof; five indicators offer earlier tests, while historical sieving-exponent improvement is about seven times too slow to reach the modeled floor by 2033. Annual updates re-estimate F_i, r_i, or A_i, recompute the crossover distribution, and publish versioned reruns that preserve previous projections as calibration data.Source: §3.3.5 · pp. 27–28

4. Using AI to Project the Advancement of CRQC+AI Vulnerabilities

• Four tracks vary AGI-driven software capability from none to high, combining it with hardware growth in a single author-controlled, reproducible model.Claude Fable 5 assists drafting and visualization; authors control assumptions and calculations. Runtime curves share R0 and support within-scheme trends and crossover timing, not absolute cross-scheme attack-cost comparisons.Source: §4 · p. 29

4.1 RSA-2048 Estimates of CRQC+AI Vulnerability: Mechanism-Backed Tier

• RSA-2048 modeling concerns certificate authentication and legacy exposure, not TLS 1.3 key transport; ECDHE and ECDSA are its direct key-exchange and authentication mechanisms.RSA certificate signatures use RSASSA-PSS; TLS 1.3 removed RSA key transport.Source: §4.1 · p. 29

4.2 ML-KEM Kyber-768/1024 Estimates of CRQC+AI Vulnerability (FIPS 203): Contingency Tier

• Hybrid ML-KEM-768 requires defeating both lattice cryptography and X25519, while standalone ML-KEM-1024 represents the CNSA 2.0-required strength level.Hybrid and standalone TLS specifications remain Internet-Drafts rather than final RFCs. CNSA 2.0 does not impose a blanket prohibition on hybrid key establishment.Source: §4.2 · pp. 31–32

4.4 Estimates of CRQC+AI Vulnerability for SLH-DSA (FIPS 205) and AES-256 (FIPS 197)

• SLH-DSA and AES-256 have no mechanism-backed or contingency-backed exposure in this model; their Appendix C curves are hypothesis-only stress cases.SLH-DSA has no lattice to collapse; depth-limited Grover costs remain near classical levels, reached by the modeled hardware budget only around 2045. Its approximately 2036 (Track 3) and 2041 (Track 2) crossovers instead require hypothesized novel attacks.Source: §4.4 · pp. 35, 37

4.5 Cryptanalytic Cost Model and the Dimension-Collapse Contingency

• The separate cost-model restatement tests (0.265 − ∆) · β · (1 − ρ) ≤ B(t), rather than independently corroborating the capability curves.∆ erodes the exponent, ρ reduces effective lattice dimension, and B(t) is the base-2 logarithm of affordable quantum operations. The bound 0.265 − ∆ ≥ 0.2075 reflects a family-specific sieve-memory resource floor, not a proven optimal time exponent.Source: §4.4 · p. 35
• ρ ≥ 0.66 for standalone Kyber-1024 and ρ ≥ 0.52 for hybrid Kyber-768 are required under the illustrative budget B(2033) = 80 bits.Exponent erosion alone cannot meet the 2033 budget, and operation-count budgets exclude required sieve memory. The no-AGI baseline places all lattice and hash breaks beyond the horizon.Source: §4.4 · pp. 36–37
• About seven times the historical quantum-sieving improvement rate would be needed to reach the conjectured exponent floor by 2033, still insufficient without dimension collapse.The reported exponent declined from about 0.2653 in 2015 to 0.2563 in 2023 (Laarhoven; Chailloux and Loyer, ASIACRYPT 2021; Bonnetain, Chailloux, Schrottenloher and Shen, EUROCRYPT 2023). Extrapolating that historical rate reaches the floor only around 2074.Source: §4.4 · p. 36, Figure 8C · p. 37

4.3 ML-DSA-44 Estimates of CRQC+AI Vulnerability (FIPS 204): Contingency Tier

• ρ ≥ 0.17 is required for the illustrative ML-DSA-44 crossover in 2036, using β around 420 and B(2036) ≈ 92 bits.The curves assume an undiscovered effective-dimension-collapse mechanism; no such mechanism is currently known.Source: §4.3 · p. 35, §4.4 · p. 37

4.4 Estimates of CRQC+AI Vulnerability for SLH-DSA (FIPS 205) and AES-256 (FIPS 197)

• Memory constraints push contingency crossovers later, while omitted costs and AGI-gated attribution limit the cost model.Structural collapse must reduce memory requirements as well as block size, so stated collapse magnitudes understate the hypothesis’s demands. Unpriced effects include dual attacks, multi-target amortization, decapsulation-failure attacks, embedding discovery, and pre-AGI classical progress; folding that progress into the AGI-gated driver at 0.04 per year overstates AGI’s explanatory weight.Source: §4.4 · p. 38
• 0.265 versus 0.292 sieving exponents yield different required collapse fractions, reflecting idealized QRAM versus more realistic memory-access and circuit-depth costs.Raising the exponent changes required ρ from 0.5170 to 0.5616 for ML-KEM-768, 0.6558 to 0.6876 for ML-KEM-1024, and 0.1734 to 0.2498 for ML-DSA-44—roughly 44% relatively for ML-DSA-44. Fractions follow ρ = 1 − B/(c·β), using β = 625/877/420 respectively and budgets B = 80 for ML-KEM in 2033 and 92 for ML-DSA-44 in 2036.Source: §4.4 · p. 38

4.6 Progress Timeframes for CRQCs and AI

• Approximately 2030 under Track 3 and 2032 under hardware-only Track 0 mark modeled RSA-2048 crossovers; lattice exposure primarily requires AGI-driven scenarios.Kyber-768/1024 crossovers occur approximately in 2032 under Track 3 and 2035 under Track 2; ML-DSA-44 crossovers occur approximately in 2033 and 2036, respectively. The shared Kyber crossover reflects equal modeled couplings, not equal hardness; the marginal Kyber-1024 Track 1 crossover occurs at 2045.9.Source: Figure 9 · p. 38, §4.6 · p. 39
• A two-year delay to assumed 2028 AGI onset shifts Track 2 and Track 3 crossovers roughly 1.5–2 years later, leaving hardware-driven RSA Track 0 unchanged.Mechanism-backed risk applies only to RSA and ECC through Shor’s algorithm; other crossovers remain conditional scenarios, not forecasts. SLH-DSA and AES-256 appear only as hypothesis-only bands without dated crossovers, with AES-256 the most resistant primitive evaluated.Source: §4.6 · p. 39

4.6.1 Hardware-Driven CRQC Scaling and Early RSA/ECC Exposure

• The early hardware-driven phase assumes mainstream hybrid quantum-classical adoption, while HHL and low-dimensional geometric research explores—but does not establish—lattice vulnerabilities.Hybrid frameworks are presented as a source of advancing quantum-computing capability, rather than evidence of a demonstrated lattice attack.Source: §4.6.1 · pp. 39–40

4.6.2 RSA/ECC Collapse and Possible First Lattice (Track 3) Breaks

• 2048.8 is ML-KEM-1024’s hardware-only Track 0 median crossover, with effectively zero exposure probability by 2035; lattice compromise requires an unproven geometric collapse.A discovered embedding would enable attempts at quantum-geometric proof-of-concept attacks and possible industry reassessment, but the compromise phase does not occur without nonzero collapse ρ. Small-scale HHL demonstrations do not establish practical exponential advantage against dense, ill-conditioned, cryptographic-size LWE problems.Source: §4.6.2 · p. 40

4.6.4 Possible Hash-Based Signature Exposure and First Symmetric-Layer Threat

• Scalable HHL- and LCHS-based CRQC+AI cryptanalysis requires realized geometric simplification; deployed lattice-PQC compromise remains conditional on that breakthrough.If compromises occurred, the scenario anticipates expedited NIST and global standards revisions followed by swift industry adoption.Source: §4.6.4 · p. 40

4.6.5 Residual Symmetric-Layer Exposure and Post-AGI Outlook

• Table 4 contextualizes scenario ranges against published timelines, hardware roadmaps, and migration mandates without claiming forecast status or greater precision than expert surveys.The model is intended for revision as evidence accumulates, with an explicit revision rule in Section 3.3.5. The post-AGI outlook calls for dynamic cryptographic agility and hybrid practices to sustain resilience.Source: §4.6.5 · p. 41, Table 4 · p. 41

Limitations

• Crossover dates depend on chosen, unmeasured hardware and software sensitivities; reproducibility means regenerating scenarios, not validating forecasts.The assumed 2028 AGI onset is the most consequential input for software-driven crossovers. Substantially later AGI would delay those crossovers by approximately the same amount.Source: §5 · pp. 41–42
• The runtime axis is a normalized index, not physical runtime; the model fixes the quantum algorithm rather than discovering new cryptanalysis.It asks how much engineering and AI-assisted progress would enable earlier compromise. Evidence tiers remain qualitatively distinct, and lattice, hash-based, and symmetric crossovers do not represent known attacks.Source: §5 · p. 42

How this model could be wrong

• Without durable AI-driven cryptanalytic improvement, effectively zero software couplings leave lattice, hash-based, and symmetric tracks uncrossed within the horizon.Only mechanism-backed RSA and ECC exposure remains under this condition.Source: §5 · p. 42
• Without effective-dimension-collapse or a comparable structural lattice advance, the contingency tier is void.This condition keeps ρ at zero in the cost model. Continued inapplicability of Harrow-Hassidim-Lloyd and related quantum linear-algebra methods to noisy LWE bounded-distance decoding removes a central hypothesized mechanism.Source: §5 · p. 42
• Stalled quantum hardware scaling delays even the RSA crossover, while inadequate fault-tolerant error correction lengthens mechanism-backed timelines regardless of algorithmic progress.As r_hw approaches one, the hardware driver flattens and the RSA crossover moves out by years.Source: §5 · p. 42
• Observable failure conditions and milestone tracking support targeted parameter updates and successive, versioned model reruns.Hardware milestones, error-rate trends, decoder latency, and resource-estimate changes update specific acceleration factors. The corresponding curves should be disregarded when their stated failure conditions hold.Source: §5 · pp. 41–42

6.1 Crypto-Agility as a Control Objective

• Crypto-agility is a governance capability comprising cryptographic inventory, asset ownership, rotation authority, change control, exception handling, and evidence retention.An agile deployment must enumerate its primitives, identify authorized owners, execute controlled rotations, and retain evidence. Migration authority belongs to the cryptographic-inventory owner, not the protocol.Source: §6.1 · pp. 42–43

6.2 Sector Data-Lifetime Spectrum (Mosca’s X and Y)

• Mosca’s X + Y > Z requires sector-specific secrecy horizons and migration durations; the paper models Z but does not populate X or Y.Representative X values reflect national-security declassification, enduring attorney-client privilege, health-data confidentiality, and payment-data retention; Y uses engineering estimates incorporating 10 to 20-plus-year operational-technology and embedded-system lifecycles. Sector differences argue against a uniform migration timeline.Source: §6.2 · p. 43

6.3 Sovereignty and Jurisdiction

• Divergent sovereign requirements make crypto-agility a present legal necessity: organizations must change algorithms, trust anchors, and key custody on externally imposed timelines.CNSA 2.0 specifies standalone ML-KEM-1024 for United States national-security systems, contrasting with widely deployed ECDHE–ML-KEM hybrids and differing European and Australian positions. This rationale requires no unproven cryptanalytic mechanism.Source: §6.3 · p. 43

6.4 Issuers, Trust Anchors and Certificate Lifecycle

• Post-quantum certificate chains require capable issuers, compatible path validation, and trust-anchor distribution reaching long-lived clients; these dependencies require separate migration planning.CA keys and embedded trust anchors last years to decades, with update cycles outside relying parties’ control; certificate-chain migration typically lags negotiated key exchange. This present ecosystem exposure lies outside the primitive-erosion instrument.Source: §6.4 · pp. 43–44

6.5 Interoperability and Negotiation

• Hybrid exchanges require both endpoints’ support and preference; incompatible middleboxes, resumption caches, or libraries can cause negotiation failures or silent downgrades to classical exchange.The draft-ietf-tls-ecdhe-mlkem example combines ML-KEM with elliptic-curve exchange. The model assumes end-to-end post-quantum or hybrid negotiation, leaving interoperability and downgrade resistance outside scope as distinct deployment controls.Source: §6.5 · p. 44

6.6 Entropy and Key Provenance

• Every modeled guarantee depends on sound entropy; weak randomness and uncontrolled key provenance create implementation exposures independently of quantum advances.Entropy quality, constrained-device seeding, and key-generation location, module, and assurance require separate attention outside the instrument. Keys generated or held outside operator control widen retroactive-decryption exposure, with provenance also bearing on harvest-now, forge-later risks.Source: §6.6 · p. 44

7. Conclusion

• 2030 is the earliest projected RSA-related financial-loss onset; PQC exposure could begin in 2032, conditional on an undemonstrated structural advance against lattices.RSA/ECC exposure is mechanism-backed by Shor’s algorithm, whereas the PQC dates are conditional scenario outputs. AGI+CRQC+AI could accelerate and generalize attacks, with potential financial losses difficult to bound.Source: §7 · pp. 44–45
• Compromised encryption keys could expose live communications, stored sensitive data, and historical backups.Access to backup encryption keys could also permit alteration of historical data that is not actively monitored.Source: §7 · p. 45
• Compromised keys could enable message interception and alteration, impersonation, service disruption, IoT takeover, and smart-contract manipulation.Service disruption could follow malicious data injection, while IoT compromise could create privacy or physical-security risks. Obtaining transaction-signing private keys could enable smart-contract manipulation and financial fraud.Source: §7 · p. 45
• The durable contribution is a reproducible, parameterized scenario instrument with auditable update mechanics for translating future observations into revised risk timelines.Parameters can be varied, rerun, and recalibrated against emerging milestones, complementing resource-estimation studies and expert-elicitation surveys. No new empirical data were created or analyzed; figures derive from the disclosed parameterized model.Source: §7 · pp. 45–46
• PQC migration should trigger crypto-agile deployment, supported by research and NIST-advocated hybrid cryptographic approaches, rather than be treated as the final migration.Layered TLS risk-scoring models can help organizations prioritize their most exposed connections during the transition.Source: §7 · p. 45
• All authors disclose employment or consulting relationships with EnQuanta, creating financial interests related to the crypto-agile and hybrid approaches discussed.EnQuanta develops commercial post-quantum and crypto-agile cryptographic products and services.Source: §7 · p. 46

Appendix A. Reproducibility of the Combined Hardware and Software Capability Model

• A single combined hardware and software capability model generates the runtime and feasibility curves from explicit equations and parameters.It produces Figures 6A/6B through 8A/8B, Figure 9, and Appendix C Figures C1A/C1B and C2A/C2B.Source: Appendix A · p. 47
• AI accelerates engineering and attack discovery and optimization without changing Shor’s polynomial scaling, lowering the fault-tolerant error-correction threshold, or removing coherence limits.The model holds the quantum algorithm fixed.Source: Appendix A · p. 47
• The capability model complements the separate channel model in Section 3.3 and cost model in Section 4.5, which bound the same question rather than generate the curves.Source: Appendix A · p. 47

Appendix A.1. Governing Equations

• Cryptanalytic capability C(a, k, t) measures attack-runtime reduction in base-10 orders of magnitude by summing weighted hardware and software contributions.C(a, k, t) = α(a) · D_hw(t) + β(a, k) · D_sw(k, t). Hardware sensitivity α is large for RSA and near zero for lattice, hash, and symmetric schemes; β represents sensitivity to track-specific software attacks.Source: Appendix A.1 · p. 47
• Hardware progress accelerates in every track, including Track 0, independently of AGI, with its exponent clamped to zero before 2026.D_hw(t) = A · (r_hw^(t − t0) − 1) / (r_hw − 1), with A = 0.34, r_hw = 1.20, and t0 = 2026.Source: Appendix A.1 · p. 47
• Software progress combines a small human-progress term with track-specific AGI gains beginning in 2028; the AGI exponent is clamped to zero before onset.D_sw(k, t) = 0.04 · (t − t0) + B_k · (r_k^(t − tAGI) − 1) / (r_k − 1), with tAGI = 2028.Source: Appendix A.1 · p. 47
• The runtime index R(a, k, t) = R0 − C(a, k, t) tracks within-scheme progress, not relative attack costs across schemes.R0 = 10 on the base-10 log-seconds axis is a common visual baseline for all five schemes, not a per-scheme empirical runtime estimate.Source: Appendix A.1 · p. 47
• 50% modeled feasibility occurs in the first year runtime reaches the one-month threshold, equivalently when capability reaches approximately 3.585.P(a, k, t) = 100 / (1 + exp(−(MON − R(a, k, t)) / 0.85)), where MON = log10(2.6 × 10^6) ≈ 6.415. Every crossover year emerges from these equations rather than prior or external figures.Source: Appendix A.1 · p. 47

Appendix A.2. Parameters and Their Sources

• 50% crossover occurs at capability C ≈ 3.585 orders of magnitude on a normalized axis, not at a predicted physical one-month attack runtime.Constants are t0 = 2026, tAGI = 2028, R0 = log10(10^10) = 10, MON = log10(2.6 × 10^6) ≈ 6.415, and logistic width 0.85. The axis spans Seconds to Centuries in base-10 log seconds; R0 is a shared visual baseline, not a per-scheme 2026 attack-runtime estimate.Source: Appendix A.2 · pp. 47–48
• Roughly 20% annual accumulation of effective quantum resources drives every track, using hardware parameters A = 0.34 and r_hw = 1.20.This accelerating hardware driver is the granular counterpart of the paper’s Rose’s-Law growth and channel models.Source: Appendix A.2 · p. 48
• 0.04 per year is the pre-AGI human-progress slope, supplemented by track-specific AGI-gated software growth.The (r_k, B_k) rate-and-ceiling pairs are Track 0 (1.01, 0.00), Track 1 (1.10, 0.16), Track 2 (1.17, 0.26), and Track 3 (1.30, 0.30). Track 3’s rate of 1.30 produces its sharply convex collapse.Source: Appendix A.2 · p. 48
• Algorithm-specific hardware sensitivities α and software-attack sensitivities β are scenario parameters, not measured constants.With β listed for Tracks 0–3: RSA-2048 has α = 0.92, β = (0, 1.15, 1.75, 2.55); Kyber-1024 has α = 0.05, β = (0, 0.06, 0.95, 1.45); ML-DSA-44 has α = 0.04, β = (0, 0.05, 0.78, 1.18); SLH-DSA has α = 0.03 and all β = 0; AES-256 has α = 0.020 and all β = 0, consistent with their hypothesis-only treatment. Hybrid X25519 + Kyber-768 uses the same lattice couplings and fails only when both components fail, so its crossovers match Kyber because X25519 falls earlier.Source: Appendix A.2 · p. 48
• ±25% sensitivity ranges contain no RSA–lattice ordering inversions; lattice-first crossover requires couplings far outside the published values.An inversion requires lattice hardware coupling above RSA’s 0.92, implying greater Shor sensitivity than RSA. Alternatively, Track 3 requires ML-KEM1024 software coupling around 4.48 versus its published 1.45—roughly triple, and 1.76× RSA’s 2.55.Source: Appendix A.2 · p. 48
• 2032.5, 2031.4, 2030.5, and 2029.9 are RSA2048’s modeled 50% crossover years for Tracks 0–3, respectively.Kyber-1024 crosses in 2045.9, 2035.0, and 2032.3 on Tracks 1–3; ML-DSA-44 crosses in 2035.9 and 2032.9 on Tracks 2–3. SLH-DSA, AES-256, and the remaining tracks show no feasible break within the 2046 horizon.Source: Appendix A.2 · p. 48

Appendix A.3. Procedure to Regenerate the Figures (Pseudocode)

• 2026 anchors hardware growth, with A = 0.34 and r_hw = 1.20 controlling the accumulated hardware driver.For e = max(t - t0, 0), D_hw(t) = A * (r_hw^e - 1) / (r_hw - 1).Source: Appendix A.3 · pp. 48–49
• Algorithm-specific hardware and software couplings determine capability, which reduces a clamped runtime index and feeds a logistic feasibility score.Runtime is clamp(R0 - capability, -0.4, R0), with R0 = log10(1e10). Feasibility is 100 / (1 + exp(-(MON - runtime)/0.85)), where MON = log10(2.6e6) represents one-month feasibility.Source: Appendix A.3 · pp. 48–49
• 2028 marks the modeled AGI onset, after which four software tracks add distinct growth terms to a shared linear software component.The shared component is 0.04 * max(t - 2026, 0); each track adds B * (r^e - 1) / (r - 1), with e = max(t - 2028, 0). Track (r, B) pairs are 0:(1.01,0.00), 1:(1.10,0.16), 2:(1.17,0.26), and 3:(1.30,0.30), with per-algorithm couplings specified in Appendix A.2.Source: Appendix A.3 · pp. 48–49
• 600 steps spanning 2026–2046 locate the first year an algorithm-and-track feasibility score reaches 50, returning NONE if no crossover occurs within the horizon.The crossover routine evaluates each algorithm-and-track combination separately.Source: Appendix A.3 · p. 49
• 40,000 Monte Carlo samples reproduce deterministic crossover years exactly and Table 7 percentiles within about 0.2 years using the released scripts.The release includes the capability model, Monte Carlo code for Table 7 and Figure A2, and figure-generation scripts. A fixed base seed of 20260731, offset by cell index, enables independent regeneration of each algorithm-and-track cell.Source: Appendix A.3 · p. 49
• Figures 4A and 4B are stylized reconstructions, not measured series; Figure 5 qubit estimates are approximate reads pending the Global Risk Institute source table.The release notes explicitly mark these qualifications.Source: Appendix A.3 · p. 49

Appendix A.4. Sensitivity Analysis

• Hardware drives RSA-2048 crossovers, whereas lattice, hash, and symmetric crossover timing depends primarily on software couplings, track rates, and ceilings.Schemes cross near 3.585 orders of capability gain; RSA’s hardware coupling α = 0.92 produces crossovers under every track with a roughly 2.5-year spread. Other schemes remain essentially immovable under Tracks 0–1, except Kyber-1024 Track 1 at 2045.9; RSA Track 0 responds only to hardware amplitude, acceleration rate, and coupling.Source: Appendix A.4 · pp. 49–50
• Setting AES-256’s software couplings to zero restores an unbroken control because its modeled Track 2 and Track 3 breaks lack an established cryptanalytic mechanism.The speculative AES-256 inputs are α = 0.020 and β = 0.155 for Track 2 and 0.210 for Track 3.Source: Appendix A.4 · p. 49
• About 3.6 years bounds the crossover shift from any single parameter variation in widened sensitivity tests of RSA-2048 Track 0 and Kyber-1024 Track 3.The stress ranges are roughly twice Appendix A.5’s calibrated Monte Carlo ranges; these tests isolate individual effects rather than parameter interactions. Failure ordering instead depends on Appendix A.2’s coupling-inversion threshold, which lies outside even these widened ranges.Source: Figure A1 · p. 50, Appendix A.4 · p. 50
• Roughly 1.8 years of delay affects software-driven crossovers when AGI onset slips from 2028 to 2030; RSA Track 0 remains at 2032.5.Kyber-1024 Track 3 moves from 2032.3 to 2034.1, and AES-256 Track 3 from 2038.6 to 2040.4. AGI onset dominates Kyber-1024 Track 3 sensitivity, followed by software coupling β and track ceiling B_k.Source: Appendix A.4 · pp. 49–50
• 2035.3 replaces 2032.5 for the RSA Track 0 crossover when the hardware rate falls to 1.05, while software-driven crossovers barely move.Reducing all software couplings by 20% instead delays lattice, hash-based, and symmetric crossovers by roughly 0.6 to 1.0 years.Source: Appendix A.4 · p. 50
• 2041.8 replaces 2038.6 for AES-256 Track 3 when its rate drops from 1.30 to the Track 2 value of 1.17.The Track 3 rate is the sole source of its sharply convex collapse; lowering it delays crossovers and removes that curvature.Source: Appendix A.4 · pp. 49–50

Purpose

• Joint sampling captures interactions missed by one-at-a-time analysis and estimates P(T ≤ year), supplying the capability-horizon input for Mosca’s inequality.Within this framework, any nonzero probability mass inside the secrecy horizon makes migration and crypto-agility rational today.Source: Appendix A.5 · p. 51

Sampling

• 40,000 independent draws per algorithm-and-track cell jointly sample parameter ranges, using deterministic cell-specific seeds and censoring crossovers beyond 2060.Most inputs are sampled uniformly; Tracks 1–3 instead draw AGI onset from a triangular distribution spanning 2027–2031, with mode 2028. Track 0 has no software driver or AGI dependence.Source: Appendix A.5 · p. 51

Results

• Approximately 0.52 and 0.98 are Kyber-1024’s modeled crossover probabilities by 2033 and 2035 under Track 3, respectively.Kyber-1024 spans roughly 2032 to 2035 under Track 3 and 2034 to 2038 under Track 2, where P(≤2035) ≈ 0.28; ML-DSA-44 follows about a year later. Lattice median crossovers remain in the late 2040s under Tracks 0 and 1.Source: Appendix A.5 · p. 51
• About one year bounds median shifts from Appendix A.2 point estimates; joint uncertainty modestly widens crossover bands without changing qualitative ordering.AGI onset remains the dominant source of variance for every software-driven crossover.Source: Appendix A.5 · p. 51

Interpretation

• The Monte Carlo propagates uncertainty in chosen, unmeasured couplings rather than adding evidence, and changing input ranges shifts its probability curves.Hash-based and symmetric primitives are excluded because their hypothesized crossover mechanisms lack a cryptanalytic basis; assigning probabilities would misrepresent modeling assumptions as calibrated likelihoods.Source: Appendix A.5 · pp. 51–52

Results

• About 95% probability of a feasible RSA-2048 attack by 2035 is modeled even under no-AGI Track 0, whose median crossover is near 2033.The mechanism-backed RSA exposure is therefore robust to the modeled AGI question.Source: Table 7 · p. 51, Appendix A.5 · p. 51, Figure A2 · p. 52

Appendix B. Notation and Symbols

• Table 8 collects symbols across the three model components and disambiguates the two distinct uses of β.These components appear in Section 3.3 (acceleration-factor framing), Section 4.5 (cost model), and Appendix A (capability model).Source: Appendix B · p. 52, Table 8 · p. 53

• No known quantum, classical, or algorithmic attack threatens SLH-DSA or AES-256 within the modeled horizon.Source: Appendix C · p. 53
• Track 2 and Track 3 crossovers exist only if advanced AI discovers a presently unknown class of structural attack.Source: Appendix C · p. 53
• These cases carry the weakest evidential status, remain separate from mechanism-backed and contingency-backed projections, and inherit Section 5’s falsifiability conditions.They are retained because Figure 9 includes them and because ruling primitives out contributes to the analysis’s due-diligence basis.Source: Appendix C · p. 53

Appendix C.1. SLH-DSA Estimates of CRQC+AI Vulnerability (FIPS 205)

• SLH-DSA has no lattice structure for collapse parameter ρ to affect, and its conservative parameters already account for Grover-type exposure.Its vulnerability treatment is therefore explicitly hypothesis-only.Source: Appendix C.1 · p. 53
• Earlier dated Track 2 and Track 3 projections relied on an unsupported hypothetical novel attack and are withdrawn in favor of an undated hypothesis-only treatment.Source: Appendix C.1 · p. 53
• Zero software coupling is assigned to SLH-DSA, with no crossover reported within the modeling horizon.Figures C1A and C1B evaluate attack runtime and modeled feasibility across vulnerability tracks under four assumption scenarios.Source: Appendix C.1 · pp. 53–54

Appendix C.2. AES-256 Estimates of CRQC+AI Vulnerability (FIPS 197)

• 128-bit effective security under Grover leaves AES-256 without a feasible break on any track within the projection horizon under the hypothesis-only treatment.No known quantum, classical, or algorithmic attack breaks AES-256.Source: Appendix C.2 · pp. 54, 57
• Dated Track 2 and Track 3 estimates are withdrawn because they depended entirely on speculative assumptions; AES-256 is assigned zero software coupling.The replacement treatment is undated, rather than a forecast of when AES-256 will break.Source: Appendix C.2 · pp. 54–55
• 128-bit quantum security is the stated threshold that only AES-256 meets among AES key lengths, supporting its CNSA 2.0 recommendation.The appendix also identifies AES-256 as an approved NIST security function.Source: Appendix C.2 · p. 56
• Grover’s sequential computation and poor parallelization constrain its quadratic search advantage, making the nominal halving of AES security a conservative threat estimate.The appendix states that realistic circuit-depth limits leave AES-256 close to its full classical strength. Track 0 and Track 1 consequently show no feasible baseline or AGI-enhanced brute-force break.Source: Appendix C.2 · p. 56
• Speculative AES-256 crossovers assume an undiscovered AGI-enabled structural attack and treat side-channel or implementation compromise as equivalent to breaking the cipher.Unlike Shor-backed RSA/ECC projections, these assumptions lack a current cryptanalytic basis. Lattice crossovers instead require conjectured effective-dimension collapse; HHL supplies at most polynomial acceleration to an inner step.Source: Appendix C.2 · p. 57