Factoring Hardness as a Bayesian Prior: A Decision-Theoretic Model of Post-Quantum Cryptography Migration Timing

In the paper's words

The urgency of post-quantum cryptography (PQC) migration is usually justified by the anticipated capability of quantum computers to factor integers, yet that threat rests on an unproven complexity-theoretic conjecture: that integer factoring is not in BPP, the class of decision problems solvable in bounded-error probabilistic polynomial time. This paper treats that conjecture as an explicit Bayesian prior rather than a settled fact, and embeds it in a decision-theoretic model of migration timing for RSA-2048. We adopt a two-hypothesis mixture: under hypothesis H_BPP a cryptographically relevant breakthrough arrives with annual hazard h_BPP = 0.10; under H_HARD the hazard is h_HARD = 0.01; the prior weight is π = Pr(H_BPP).

The abstract, verbatim, and its opening sentence is the claim. Every line below is quoted from the text.

Numbers it reports

1. With migration cost normalized to $C_m = 1$, breach loss $L$, and discount rate $r = 0.05$, we derive a closed-form loss threshold $L^{\ast}(\pi) = 1 + r/\bar{h}$ above which immediate migration is optimal, where $\bar{h}$ is the mixture hazard.

   from Abstract

2. At the baseline $\pi = 0.2$ the mixed hazard is $\bar{h} = 0.028$ and $L^{\ast} \approx 2.785714$: any asset whose compromise costs more than $2.79$ migration-cost units justifies migrating immediately.

   from Abstract

3. If a classical algorithm ever factored RSA-2048 efficiently, quantum computers would be irrelevant to the RSA threat; if factoring is hard classically, the quantum threat is real but its arrival time is governed by engineering timelines.

   from 1. Introduction

4. We construct a minimal decision-theoretic model in which the probability mass assigned to a fast-breakthrough regime is a first-class parameter $\pi$, and we compute migration recommendations for RSA-2048 assets as a function of $\pi$, the breach loss $L$, the migration cost $C_m$, and the discount rate $r$.

   from 1. Introduction

5. Two labeled alternative scenarios, reconciled from independent draft parameterizations: a discrete two-point cost scenario and a continuous two-hazard Poisson model in which the optimal migration time $T^{\ast}$ solves a first-order condition numerically (Sections 3.4 and 4.4).

   from 1. Introduction

6. The organization holds RSA-2048 assets whose compromise would cause loss $L$, expressed in units of the migration cost $C_m$ (so $C_m = 1$ by normalization).

   from 3.1 Model primitives (main model)

How it is done

1. With migration cost normalized to $C_m = 1$, breach loss $L$, and discount rate $r = 0.05$, we derive a closed-form loss threshold $L^{\ast}(\pi) = 1 + r/\bar{h}$ above which immediate migration is optimal, where $\bar{h}$ is the mixture hazard.

   from Abstract

2. The deployment of post-quantum cryptography is one of the largest planned cryptographic transitions, and its urgency is almost always argued from the anticipated capability of quantum computers to factor integers in polynomial time via Shor's algorithm.

   from 1. Introduction

3. The most directly relevant work is the PMMP framework of [2], which addresses the problem that organizations must plan migration to quantum-resilient cryptographic measures (PQC), notes that this is difficult, and states that — to the authors' knowledge — no generalized approach existed that manages such a complex migration while explicitly integrating into organizations' steering mechanisms and control systems; PMMP presents a risk-based process for this purpose.

   from 2. Background and Related Work

4. Time is measured in years.

   from 3.1 Model primitives (main model)

What would falsify it

The paper's text states no explicit falsification criterion; the limits below are what it says about where the claim stops.

Where the claim stops

1. But the security relevance of that argument depends on a logical structure that is rarely made explicit: quantum factoring threatens RSA-2048 only if classical polynomial-time factoring is impossible, i.e., only if FACTORING $\notin$ BPP, where BPP is the class of decision problems solvable in bounded-error probabilistic polynomial time.

   from 1. Introduction

2. Every statement below is restricted to what the supplied bibliography entry supports; where an entry's summary is thin, we say so.

   from 2. Background and Related Work

3. The Tetris analysis of [1] proves that Tetris clearing and survival remain NP-hard even when the piece set is restricted to a single tetromino type, for every tetromino type except the O piece.

   from 2. Background and Related Work

Where to read

1. Abstract245 words · 1 min
2. 1. Introduction454 words · 2 min
3. 2. Background and Related Work1,165 words · 5 min
4. 3. Methods717 words · 3 min
5. 4. Analysis459 words · 2 min