Harvest Now, Decrypt Later — Quantum-Safe: Threat and Standards

The quantum computer that can break today’s public-key encryption is not here yet. That is true, but it is not enough to make today’s secrets safe. An adversary does not need to decrypt traffic at the moment it is captured. If the data is valuable for long enough, the adversary can record the encrypted traffic now, store it cheaply, and wait for a future machine that can open it. For secrets that must remain private for years or decades, the risk has already begun.

The threat is about time, not just technology

Most people hear about quantum risk and ask a sensible first question: when will the dangerous quantum computer exist? That question matters, but it is not the only clock running. A second clock is attached to the data itself: how long must this information stay confidential?

Harvest now, decrypt later is the attack that connects those two clocks. It means an attacker records encrypted data today, even though they cannot read it today, because they believe the data will still be valuable when better code-breaking tools arrive.

This is why the absence of a cryptographically relevant quantum computer is not a complete defence. The machine can arrive later. The recording can happen now.

⚠️

The key shift. The right question is not only whether the data is safe today, but whether it still must be secret when quantum decryption becomes practical.

The recording attack, step by step

Encrypted data crosses networks all the time: web sessions, virtual private network tunnels, application programming interface calls, backups moving to cloud storage, and replication traffic between data centres. Anyone who can observe the path may be able to copy the ciphertext, which is the scrambled form of the data.

That observer might be a hostile network provider, an intelligence service with access to a cable landing point, a compromised router, a malicious insider, or a criminal group already inside part of the network. They do not need to break the encryption in real time. They only need to keep a useful recording.

Later, if a large enough quantum computer exists, the attacker can use it against the vulnerable public-key part of the recorded session. If that succeeds, they may recover the keys needed to read the session contents. The data was private when sent, but not permanently private.

An observer copies encrypted traffic today and decrypts it once quantum computers arrive.

What data is worth harvesting

The attack is most serious for information with a long confidentiality lifetime. A lunch order from yesterday is not worth storing for twenty years. A genome, a classified report, a merger negotiation, or a root credential may be.

The most exposed data is not merely sensitive; it is sensitive for a long time. Some of it cannot be changed after exposure. You can reset a password, rotate a certificate, or reissue a payment card. You cannot reissue a person’s fingerprint, face, iris, or DNA sequence.

This is why the first inventory question should not be technical. It should be about the secret itself: if someone reads this in ten, twenty, or fifty years, is there still harm?

Health records may need privacy for a lifetime.
Government and military information may remain classified for decades, often in the range of 25 to 75 years.
Biometric and genomic data can remain sensitive forever because the person cannot replace it.
Trade secrets, source code, formulas, and design files may matter across a product lifetime and beyond.
Financial, tax, identity, legal, diplomatic, and merger communications can remain damaging for many years.

⚠️

The cruel case. Long-lived secrets that cannot be changed after exposure are the highest-priority harvest-now targets.

The most exposed data stays sensitive for decades and often cannot be reissued.

Mosca’s arithmetic makes the deadline concrete

Cryptographer Michele Mosca proposed a simple way to reason about whether an organisation is already late. It uses three durations, not a detailed prediction model.

The first duration is the shelf life of the data: how many years the information must remain secret. The second is the migration time: how many years the organisation needs to discover, replace, test, and deploy quantum-safe cryptography across its systems. The third is the threat timeline: how many years remain before a quantum computer can break today’s vulnerable public-key cryptography.

The rule is simple: if shelf life plus migration time is greater than the threat timeline, you already have a problem. Some data will still be sensitive, and some systems will still be using vulnerable cryptography, when the threat arrives.

📌

Mosca’s inequality. If shelf life plus migration time is greater than the threat timeline, the organisation is already exposed.

If shelf life plus migration time exceeds the threat timeline, you are already late.

A worked example shows why waiting is risky

Suppose the quantum threat is estimated to be 15 years away. That sounds distant. Now suppose a class of data must remain secret for 10 years, and a realistic migration across the organisation will take 6 years.

The shelf life is 10 years. The migration time is 6 years. Together they make 16 years. Because 16 is greater than the 15-year threat timeline, the organisation is already one year behind. Even though the dangerous computer is not expected tomorrow, the combination of long-lived data and slow migration has crossed the line.

The uncertain number is the threat timeline. No one knows the exact date of a cryptographically relevant quantum computer. Public estimates commonly range from the early-to-mid 2030s onward, and the National Institute of Standards and Technology, or NIST, transition guidance points toward deprecating vulnerable algorithms around 2030 and disallowing them after 2035.

The controllable number is migration time. Discovery, vendor upgrades, protocol changes, testing, exception handling, and rollout all take longer than executives usually expect. Every year spent waiting becomes a year added to the exposure window.

Threat timeline: 15 years.
Data shelf life: 10 years.
Migration time: 6 years.
10 plus 6 equals 16, which is greater than 15.
Result: the programme is already late for that data class.

Signatures fail differently from confidentiality

Harvest now, decrypt later is mainly a confidentiality problem. The attacker records encrypted material now and reads it later. Digital signatures have a different failure mode because a signature is about trust and authenticity, not secrecy.

A recorded signed message from today is not automatically changed into a forged message later. The danger is that, once the signing algorithm is breakable, an attacker may create new signatures that look valid under old trust rules. That matters for things expected to remain verifiable for decades.

Long-lived firmware-signing keys, root certificate authorities, signed legal records, archival documents, software update systems, and identity credentials all need attention. They may not be harvest-now confidentiality targets, but their trust can still collapse if they rely on algorithms that become forgeable at Q-day.

Confidentiality fails by leaking recorded secrets; authenticity fails by forging trust.

The decisions this changes

For a leader, this topic changes prioritisation. The first question is not which algorithm is fashionable, or which vendor has the most polished roadmap. The first question is where long-lived confidential data moves, where it is stored, and which systems protect it with quantum-vulnerable public-key cryptography.

For a practitioner, it changes the starting point. A quantum-safe programme begins with discovery: protocols, certificates, libraries, hardware security modules, key management systems, application dependencies, vendor products, and data flows. Without that map, migration time is a guess.

For an architect, it changes design pressure. Systems should become crypto-agile, meaning they can change cryptographic algorithms and parameters without redesigning the whole application. Crypto-agility does not solve the quantum problem by itself, but it reduces the time needed to respond.

Rank data by confidentiality lifetime, not only by current business sensitivity.
Prioritise traffic that carries long-lived or unchangeable secrets.
Track where Transport Layer Security, virtual private networks, and key exchange are used.
Use hybrid quantum-safe key exchange where it is mature and supported, especially for sensitive channels.
Reduce migration time through inventory, testing, standards alignment, and crypto-agile engineering.

What to carry forward

Harvest now, decrypt later turns quantum risk from a future event into a present planning problem. The decryption waits, but the collection can already be happening.

The practical response is not panic. It is disciplined triage. Find the secrets that must outlive the current cryptography, understand the systems that carry and protect them, and shorten the migration path before the threat timeline closes.

The most important number you control is not the date of Q-day. It is how long your organisation needs to move.

✅

Useful posture. Treat the quantum timeline as uncertain but the migration work as immediate.

Key takeaways

Harvest now, decrypt later means encrypted data can be recorded today and decrypted in the future when quantum attacks become practical.
The data most at risk is information that must remain confidential for years or decades.
Unchangeable secrets such as biometrics and genomes deserve early attention because exposure cannot be undone.
Mosca’s inequality says that if data shelf life plus migration time exceeds the quantum threat timeline, the organisation is already late.
Digital signatures face a different risk: future forgery can undermine long-lived trust even if there is no secret to decrypt.
The main controllable lever is migration time, reduced through discovery, prioritisation, crypto-agility, and early deployment planning.

Glossary

Harvest now, decrypt later: An attack in which an adversary records encrypted data now and waits to decrypt it when stronger future capabilities become available.
Ciphertext: Data in its encrypted, unreadable form.
Q-day: The informal name for the point when a cryptographically relevant quantum computer can break widely used vulnerable public-key cryptography.
Cryptographically relevant quantum computer: A quantum computer large and reliable enough to attack real-world cryptographic systems rather than only toy examples.
Public-key cryptography: Cryptography that uses a public value and a private value for tasks such as key exchange, encryption, and digital signatures.
Mosca’s inequality: The rule that an organisation is already exposed if data shelf life plus migration time is greater than the time until the quantum threat arrives.
Crypto-agility: The ability to replace or adjust cryptographic algorithms, keys, and parameters without rebuilding the entire system.
Transport Layer Security: The protocol, commonly called TLS, that protects much of the encrypted traffic used by websites and internet services.
Digital signature: A cryptographic proof that a message, document, or software package was created or approved by the holder of a signing key.