The cost model, and where every number comes from

Quantum break cost of factoring

For an n-bit RSA modulus, Gidney and Ekerå give the abstract-circuit cost as 3n + 0.002·n·lg(n) logical qubits and 0.3n³ + 0.0005·n³·lg(n) Toffoli gates. The engine evaluates exactly these formulas, which is why it reproduces their numbers at RSA-2048 rather than approximating them.

The engine scales between key sizes using the ratio of these circuit costs at the key's own equivalent modulus size, rather than multiplying a logical count by a guessed error-correction ratio. That is what makes the 2048-bit case reproduce both published figures exactly.

Classical security equivalences

NIST SP 800-57 Part 1 Rev. 5 gives the equivalence classes the engine maps keys onto. An elliptic-curve key is translated to the RSA modulus of equal classical strength, so P-256 is assessed as though it were RSA-3072. That translation is a documented simplification: the true elliptic-curve circuit has a different constant factor than the RSA one.

The compliance clock

NIST IR 8547 sets two dates that the engine treats as hard reference points: 112-bit-strength public keys are deprecated after 2030 and all quantum-vulnerable public key algorithms are disallowed after 2035. A certificate whose validity window extends past its date cannot be re-issued unchanged once the standard lands, which is what the lifetime-compliance factor measures.