Harvest Now, Decrypt Later: Why the Quantum Threat Starts Today

By Taylor Thomas · 2026-08-30

The most misleading true statement in security today is that no known quantum computer can break modern encryption. It is true, and it protects less than it seems to, because the attack that matters does not require the computer to exist yet. Record encrypted traffic now; decrypt it when the machine arrives. Recording is cheap, passive, and invisible, and some of what crosses a VPN or TLS session must stay secret longer than the machine may take. That is harvest now, decrypt later, and it moves the quantum threat’s start date from the future to whenever your data began transiting paths someone else can capture.

What a Recorded Handshake Is Worth

The exposure is precise, and it lives in the handshake. When a TLS session or an IKEv2 tunnel comes up, the peers run a public-key exchange — finite-field or elliptic-curve Diffie-Hellman, whose public values travel on the wire; legacy TLS sessions keyed by RSA key transport, a mode removed from TLS 1.3, carry the encrypted secret instead — followed by bulk traffic under symmetric keys derived from that exchange. A sufficiently capable quantum computer running Shor’s algorithm breaks precisely that public-key math, in every one of those forms. Solve the recorded exchange and, for a session whose keys rest on that exchange alone — many deployed TLS and IKEv2 sessions today, and nearly everything recorded before hybrid exchanges shipped — the session keys follow; the ciphertext recorded alongside opens with them.

Symmetric cryptography survives. Grover’s algorithm roughly halves the effective strength of a symmetric key, and AES-256 absorbs that with room to spare. So the bulk cipher is not the problem — the keys it used are, because they descend from an exchange the capture preserves.

Forward secrecy deserves its own sentence, because it is the control engineers most often believe covers this. It does not — not in its classical form. Ephemeral (EC)DH exchange protects past sessions against a future compromise of a long-term key — but the ephemeral public values sit in the recorded handshake, made of exactly the math Shor’s algorithm breaks. Against a quantum adversary, classical forward secrecy converts one master unlock into per-session work.

The Deadline Math

Michele Mosca’s widely cited inequality frames the timing without requiring anyone to predict it. Call x the years your data must stay secret, y the years your migration will take, and z the years until a cryptographically relevant quantum computer exists. If x + y > z, some of your data spends part of its required secrecy lifetime exposed — and you will not learn z until it is history. Nobody can name z; estimates range from under a decade to never. The planning insight is that z is the only variable you do not control. A record that must stay sealed for twenty-five years, behind a migration that takes five, is betting that z exceeds thirty. That is not a bet a security architecture should make silently.

The Asymmetry That Sets Priorities

Harvest now, decrypt later threatens confidentiality retroactively — but not the authentication of sessions that already completed. A handshake signature is verified at session time: the peer checked it, the handshake completed, the moment passed. An adversary who can forge that signature in fifteen years cannot reach back and change a verification that already happened. Authentication must migrate before the machine exists; confidentiality had to migrate before the recording started. That asymmetry is why key exchange leads the migration for data in transit while most signature migration follows on its own clock, and why the traffic you encrypt this year matters more than the certificate you rotate this year. The mirror-image exception: a signature on firmware or code shipped today will be verified far in the future by long-lived devices, so code signing also migrates early — NIST standardized stateful hash-based signatures (SP 800-208) for exactly that role, and NSA’s CNSA 2.0 guidance sequences software and firmware signing first.

Starting the Migration Now

The algorithms are standardized; the migration is not. NIST has published final post-quantum FIPS standards — ML-KEM (FIPS 203) for key establishment, ML-DSA and SLH-DSA (FIPS 204 and 205) for signatures. The IETF has standardized multiple key exchanges for IKEv2 (RFC 9370); the TLS 1.3 hybrid groups pairing a classical curve with ML-KEM are deployed at internet scale while their defining documents complete standardization. Hybrid means that against passive capture, a correctly combined session with independent secrets falls only if both exchanges are broken. That hybrid pattern is the practical deployment shape, and quantum-safe VPNs covers how it lands in tunnels. The work that cannot be bought is the inventory: find every place public-key cryptography protects data in motion, classify each flow by secrecy lifetime, and let x set the order — the flows carrying decade-scale secrets migrate first. Favor platforms where the algorithm is configuration, not hardware, and be skeptical of exotic detours; QKD vs PQC explains why standards-based cryptography is the road for nearly everyone.

This is now exam material, not futurism — post-quantum cryptography appears by name in the SCOR 350-701 exam topics’ cryptography objective, alongside the PKI and IPsec machinery it amends. The engineers who understand the handshake deeply are the ones who will migrate it calmly. The first lesson is free.

Frequently Asked Questions

Is harvest now, decrypt later actually happening?

Recording encrypted traffic is passive, so it leaves no evidence on the wire and no breach to detect — which means the question cannot be answered by observation. Security agencies and standards bodies plan on capability rather than proof: an adversary with long-term interest in your data and the storage to keep ciphertext loses nothing by collecting now. For defenders the honest position is that any long-lived secret crossing an untrusted path today should be assumed recordable.

Doesn't forward secrecy protect my traffic from this?

Not while the ephemeral exchange is classical (EC)DH — which is what deployed sessions overwhelmingly use today. Forward secrecy protects past sessions against a future compromise of a long-term private key, but the public values of the ephemeral exchange are in the recorded handshake, and Shor's algorithm solves exactly the math protecting them. A quantum adversary re-derives each session's keys from the capture — classical forward secrecy just makes that per-session work instead of one master unlock. What closes the gap is an independent quantum-resistant secret in the key schedule: a hybrid exchange with a post-quantum component, or a high-entropy preshared key mixed in.

Which data is actually at risk, and which is not?

Risk tracks secrecy lifetime. Data that must stay confidential for years — designs, health and legal records, government traffic, long-lived credentials and keys — is exposed, because a recording made today may still matter when decryption arrives. Data that goes stale in minutes or days — a one-time code, a session serving only public content — effectively is not. That classification, not fear, is what should set your migration order.