How much quantum computing progress would trigger urgent migration before standardized post-quantum schemes deploy widely?

Your question sits at the intersection of cryptographic timeline and quantum hardware maturity—a genuine policy concern, but one the provided preprints don't directly address.

Here's what we can extract:

The threat model is real but distant. Shor's algorithm can break RSA and elliptic-curve cryptography in principle [AG-2024.05-2225], but this requires a quantum computer of industrial scale. Current machines are nowhere near that threshold [AG-2024.01-2022]: "The maturity of currently-available quantum computers is not yet at a level such that they can be used in production for large-scale, industrially-relevant problems, and they are not believed to currently pose security risks." Crucially, the analysis found that "these methods do not appear likely to change the required resources for cryptanalysis on currently-used cryptosystems"—meaning even with error mitigation tricks, we're still years away from a cryptanalytically relevant quantum computer.

Migration incentives exist in high-stakes domains now. Critical infrastructure operators face a "harvest now, decrypt later" risk: adversaries collecting encrypted traffic today could break it once quantum computers arrive, exposing decades-old secrets [AG-2024.01-1401]. This asymmetry creates urgency for power grids and financial systems *independent* of when standardized post-quantum schemes finish standardization. Blockchain systems face similar pressures [AG-2024.02-1291].

Standardization is moving, but no trigger threshold is named. The preprints discuss NIST standardization efforts and industry adoption [AG-2024.05-2225], but none propose a specific quantum capability threshold (e.g., "10,000 logical qubits") that would force immediate migration.

The preprints don't specify what quantum computing milestone would trigger urgent action before post-quantum standards are widely deployed.