Harvest now, decrypt later: why quantum is already your problem

Most discussions about quantum computing and cryptography sound like science fiction: some day, a powerful machine will break the encryption protecting the internet. The uncomfortable part is that the attack doesn't have to wait for that day.

The attack in one sentence

Record encrypted data now, store it, and decrypt it later, once a sufficiently powerful quantum computer exists. Security agencies call it "harvest now, decrypt later" (or "store now, decrypt later").

Storage is cheap and patient. A copied database dump, an old backup or intercepted traffic costs almost nothing to keep for ten years.

What exactly breaks

Modern encryption usually combines two things: a fast symmetric cipher such as AES to encrypt the data, and a public-key mechanism such as RSA or elliptic curves (ECDH, X25519) to agree on the key. Shor's algorithm, run on a large enough quantum computer, would solve the math problems behind RSA and elliptic curves. AES-256 remains robust; the weak link is the key exchange that protects it.

Break the key exchange, and every piece of data protected by it opens up, including data stolen years earlier.

Are you concerned? Three questions

• How long must your data stay confidential? Health, financial and customer records often need 10 years or more.
• How long would it take you to change your cryptography? Inventory, testing and rollout usually take years.
• When will a quantum computer break RSA and elliptic curves? Nobody knows precisely; estimates vary widely.

If the first two added together exceed the third, your data is already exposed. This is Mosca's inequality, and you can test your own numbers in our Lab in 30 seconds.

What to do now

• Map where your sensitive data lives and how it is encrypted.
• Prioritise the data with the longest confidentiality requirement.
• Adopt hybrid encryption: a classical algorithm and a post-quantum one (such as ML-KEM, standardized by NIST in 2024) combined, so that breaking one is not enough.
• Start early: cryptographic migrations are measured in years, not weeks.

Data stolen tomorrow can be protected tomorrow. Data stolen yesterday can't. The cheapest moment to act is before anyone has copied it.