Mosca's equation is a shelf-life argument, and Stein uses it as the triage tool [1]. The interesting part is where the buckets land inside a carrier. Subscriber voice, browsing and streaming are worthless within hours [3]. Subscriber identity mappings, billing records and call metadata stay sensitive for years [2]. Some core traffic leaks internal topology, and exposing certain interfaces can damage operator-to-operator relationships [5]. Credit card data in subscriber traffic stays sensitive for years too, but Stein hands that to the browser or the app rather than the network [4]. Anything that can reveal a personal or system password goes to the top [6].
That ordering matters because it decides what a harvest-now-decrypt-later collector actually gets. Traffic with an hours-long lifetime is not worth storing against a future decrypt. Identity mappings and billing records are.
The work order Stein gives is four steps and one deferral. Inventory every use of public-key crypto first: 5G SBA interfaces, IKE for IPsec links, DNSSEC, encrypted APIs [7]. Then move everything on TLS to hybrid key exchange, including SBA, SEPP, web portals and OSS/BSS APIs [8]. Then IPsec: backhaul, inter-DC, LTE roaming [9]. Then remaining public-key protocols, including proprietary ones [10]. Only after key exchange is covered does authentication of long-lived connections come up, because those can absorb the large public keys of the standardized PQC signature schemes [11]. Software authentication of short-lived connections waits [12]. Hardware authentication and attestation wait on vendors [13]. Ordinary subscribers need nothing from the operator, though enterprise and government customers may [14].
If only one deployment lands this year, Stein puts it at hybrid ML-KEM, X25519 with ML-KEM, with crypto-agile fallback to HQC, on TLS-protected SBA and management-plane interfaces [15]. He calls that the single easiest and most impactful measure available [16].
The procurement side is where this gets usable. Worse than "we don't yet support PQC," per Stein, is "we are waiting for the standards to stabilize" [17]. His counter is that not all RFCs are final, but PQC is being standardized faster than any major telecom innovation, and crypto-agility rather than delay is the way to future-proof [18]. The next two answers he flags are "cryptographically relevant quantum computers are still not here" and "our encryption is based on symmetric encryption and so is quantum safe" [19]. He reads both as either misunderstanding or deliberate deception [20]. The second one is checkable in a meeting: 5G subscriber authentication does rest largely on symmetric keys, but the PKI around it does not [21], so a vendor invoking symmetric crypto is describing one layer and being silent about the one that breaks.
Note what the two lists share. All four suspicious sentences are timing arguments rather than capability statements, and the only real test is whether a vendor can produce an artifact to back one up. Ask for the crypto inventory and the hybrid key exchange status on a named TLS interface and the answers become falsifiable, because those are steps one and two of the sequence Stein lays out [7][8]. That is why the inventory is first: it converts vendor assurance into a list you can audit.
Stein also flags an operational failure mode, and it has nothing to do with the math: a missed interface is the likely point of failure [22]. Which is a restatement of the inventory problem. If step one is incomplete, steps two through four inherit the gap and nobody finds it until something outside the inventory is still negotiating a classical-only key exchange.
