Q-Day is a probability, not a date
You cannot schedule Q-Day — the day a cryptographically-relevant quantum computer breaks ECDSA has no fixed date; it is a probability distribution, not a calendar entry. But the deadlines to be ready are fixed and binding: the EU's 2030 post-quantum target, NIST's schedule to retire ECDSA by 2035, and — because of harvest-now-decrypt-later — the lifetime of every document you sign today. So XDC plans to the deadlines it controls, not to a date it can't.
Why Q-Day has no date
"Q-Day" is shorthand for the moment a cryptographically-relevant quantum computer (CRQC) can run Shor's algorithm at the scale needed to recover a private key from a public one. The honest answer to "when?" is that nobody knows — and anyone who gives you a single year is selling certainty that doesn't exist. What we have instead is a distribution of expert estimates that clusters in the early-to-mid 2030s and, crucially, keeps shifting earlier as the algorithms improve. The most-cited recent example: the estimated qubit count to factor RSA-2048 fell roughly 20× between 2019 and 2025 — a software result, not a hardware one. (We unpack that in Reading the 2025 Gidney result.)
Treating a moving probability as a fixed deadline is the trap. You can't build a migration plan around a date that doesn't exist — so you build it around the dates that do.
The deadlines that are fixed
While Q-Day floats, the readiness deadlines are concrete, regulatory, and already on the calendar:
Notice that the last one isn't set by a regulator — it's set by your own data. A signed letter of credit can be contested in court decades after issuance, and the ECDSA signature is the proof. That makes document lifetime, not Q-Day, the binding constraint.
Mosca's inequality
Michele Mosca gave the quantum transition its planning rule, and it needs no precise Q-Day to be useful. If the time your data must stay secure (X) plus the time it takes to migrate (Y) is greater than the time until a CRQC arrives (Z), you are already late.
X (document lifetime, 20–30 yrs) + Y (migration, 4–7 yrs) > Z (Q-Day, ~8–12 yrs out). X alone can exceed most Q-Day estimates — so the inequality is already breached for documents being signed right now.
What XDC plans to
Because the threat date is uncertain but the readiness dates are not, XDC's XDSS-PQ standard is built as a hybrid — classical ECDSA and NIST-selected post-quantum signatures coexist through the transition, so nothing breaks on cutover and signatures stay verifiable throughout. The roadmap is paced to the deadlines above (consensus migration targeted for 2030, the EU window), not to a guess about when a quantum computer will arrive. The full plan lives in the technical deep-dive, the XDSS-PQ specification, and the live Q-Day countdown.
Frequently asked
When is Q-Day?
There is no fixed date. Q-Day is a probability distribution, not a calendar entry. Commonly-cited estimates land in the early-to-mid 2030s, but they are estimates that keep moving earlier as algorithms improve — not a scheduled event.
If Q-Day has no date, what deadline should a blockchain plan to?
The fixed, binding ones: the EU's 2030 migration target, NIST's plan to deprecate ECDSA by 2030 and retire it by 2035 (IR 8547), and — because of harvest-now-decrypt-later — the lifetime of the documents you sign today. A 30-year document signed now must stay unforgeable into the 2050s.
What is Mosca's inequality?
If the time your data must stay secure (X) plus the time to migrate (Y) exceeds the time until a quantum computer arrives (Z), you are already late. For 30-year trade documents, X alone can exceed most Q-Day estimates, which is why migration must begin before any working attack exists.
Sources
- NIST Post-Quantum Cryptography — FIPS 203/204 and the IR 8547 transition timeline (deprecate ECDSA 2030, retire 2035). csrc.nist.gov/projects/post-quantum-cryptography
- Gidney, C. "How to factor 2048-bit RSA integers with less than a million noisy qubits." 2025 — the falling-estimate trajectory. arxiv.org/abs/2505.15917
- XDC — Quantum threats to XDC (CRQC timeline, Mosca's theorem, harvest-now-decrypt-later) and the live Q-Day countdown.