Cryptographic Temporal Drift: The Bet We're Making Without Knowing We're Making It

On August 13, 2024, the U.S. National Institute of Standards and Technology finalized the first three post-quantum cryptography standards — FIPS 203, 204, and 205 — ending an eight-year competition that began in 2016. Within months the migration was real: Google and Cloudflare had already begun shipping hybrid connections that run the classical algorithm X25519 and the new lattice-based ML-KEM-768 side by side, so that if either is broken, the other still holds. In a companion report, NIST set a deadline — its Interagency Report 8547 calls for RSA and elliptic-curve cryptography to be disallowed across federal standards by 2035.

This is sensible. Quantum computers capable of breaking classical public-key cryptography do not yet exist; they may never; they may also arrive in the 2030s. The cost of being wrong — waking to find every encrypted archive of the last two decades readable — is high enough that even a modest probability justifies expensive preparation. But buried inside the sensible migration is a bet almost no one names out loud. It is a bet about time itself, and it can be wrong in either direction. This is cryptographic temporal drift: the slow, rolling wager, placed on everyone's behalf, about which of two clocks fires first.

Two clocks running at unknown speeds

The migration is, in effect, a race between two countdowns. Clock A ticks toward the moment a sufficiently capable quantum computer breaks the classical algorithm you use right now — RSA, or elliptic-curve, or their relatives. Clock B ticks toward the moment a classical cryptanalytic attack breaks the post-quantum algorithm you are migrating to — ML-KEM, SLH-DSA, or their relatives.

Nobody knows how fast either clock is running. The classical algorithms have absorbed decades of attack and held. The post-quantum ones are far younger, have accumulated far less cryptanalytic pressure, and are being deployed at confidence levels below what RSA enjoyed in 2010. The history of cryptography is, in large part, the history of confident algorithms broken suddenly by mathematics no one saw coming. The migration bets that Clock A fires before Clock B. Most informed observers think that is probably right. The distance between probably right and definitely right is where the drift lives.

Mosca's inequality: the bet, formalized

The quantum-security researcher Michele Mosca, of the University of Waterloo, reduced the whole problem to one line. Let X be how long your data must stay secret (its shelf life), Y how long your migration will take, and Z how long until a cryptographically relevant quantum computer exists. If X + Y > Z, you are already too late: data you encrypt today, using time you don't have, will still be sensitive when the machine that reads it arrives.

Mosca's inequality is why the migration cannot wait for certainty about Z. It also names the adversary's move, which has a name of its own: harvest now, decrypt later. An opponent does not need a quantum computer today to attack you today. They need only to copy your encrypted traffic now and store it, betting that Z arrives before X runs out. For anything that must stay secret into the 2030s — state secrets, medical records, the long-lived roots of trust — the attack has, in effect, already begun. The ciphertext is being collected while you read this.

The hedge that will come off in the dark

The hybrid construction — running both algorithms at once — is good design. It hedges the bet. But hybrids are bigger, slower, and more complex to implement correctly, and complexity is the enemy of security. Over time the pressure to simplify will grow: first for performance-critical paths, then more broadly, until the industry settles on whichever algorithm is deemed safer and quietly drops the other.

Here is the uncomfortable question: who decides when to drop the hedge, and on what evidence? The answer today is nobody in particular. The decisions will be made incrementally, by many teams, on incomplete information about attacks on both algorithms. There will be no announcement. One day, widely deployed systems will simply stop running the classical algorithm in parallel, and the industry will have placed the bet unhedged — a drift toward single-algorithm deployment that no one explicitly chose.

Three ways to be wrong

The bet can fail in three ways. The first, and only one widely discussed: a quantum computer breaks the classical algorithm before migration finishes. Pre-migration data becomes readable; new data is safe. The damage is bounded by how much old ciphertext attackers harvested — which is exactly why harvest-now-decrypt-later is the quiet emergency.

The second, rarely discussed: a classical attack breaks the post-quantum algorithm before any quantum computer exists. The industry has collectively decided this is less likely, so systems that already dropped the hedge are suddenly bare. The probability is not zero; lattice cryptography is young.

The third, least discussed: both algorithms harbor serious weaknesses, and the hybrid was the only thing protecting anyone. Everyone who simplified early is in trouble. It is dismissed as paranoia precisely because it is the hardest to reason about.

The honest framing

What the drift framing buys you is a shift in category: from a single engineering decision to a rolling bet whose odds move every year as evidence accumulates about both algorithms and about quantum progress. The right response is not to place the bet once and walk away; it is to keep the ability to change strategy if the evidence shifts. The industry, so far, is not preserving that ability well — hybrids are already spoken of as temporary. This is the same structure the series calls the Cryptographic Time Bomb (#58): a deadline with no calendar, which is exactly the kind institutions defer until it is too late.

The world is running a slow, half-coordinated, half-improvised migration between two cryptographic regimes, on probabilistic reasoning about a threat that may or may not arrive, deploying algorithms younger than the ones they replace, treating the hedges that protect against being wrong as transitional. It may be the best we can do. But it is a bet — placed on behalf of everyone who uses encryption, most of whom have no idea it is being placed — and whether it was right will not be knowable until long after it has been locked in.

This is article #34 in The IUBIRE Framework series. Cryptographic Temporal Drift was articulated by IUBIRE V3 in artifact #3270 — "The Great Cryptographic Wager: ML-KEM-768 vs X25519" — and its siblings (April 2026). Real-world data: NIST FIPS 203/204/205 (13 August 2024) and NIST IR 8547 (RSA/ECC deprecation by 2035); Michele Mosca's inequality (X + Y > Z); the "harvest now, decrypt later" threat model.

Next in series: The Creator's Dilemma (#35)