Harvest now, decrypt later: why post-quantum planning starts today

Most security risks are about what an attacker can do today. Quantum computing is unusual: the damage is done today, and the bill arrives later.

The threat in one sentence

An adversary who records your encrypted traffic now can store it and decrypt it once a sufficiently powerful quantum computer exists. Security teams call this "harvest now, decrypt later", and it changes the question from when will quantum computers arrive? to how long does our data need to stay secret?

Why today's encryption is exposed

Almost all of the public-key cryptography that protects the internet rests on two hard mathematical problems: factoring large numbers (RSA) and computing discrete logarithms (Diffie-Hellman and elliptic-curve cryptography). In 1994, Peter Shor showed that a large, fault-tolerant quantum computer could solve both efficiently.

That puts two everyday functions at risk:

• Key exchange, which protects data in transit: TLS, VPNs and SSH.
• Digital signatures, which prove who signed code, documents and certificates.

Symmetric encryption such as AES is far less affected. The best known quantum attack, Grover's algorithm, offers at most a quadratic speed-up, which is why AES-256 is generally considered a sound long-term choice.

The standards are here

In August 2024, NIST published its first three post-quantum cryptography standards:

• FIPS 203 (ML-KEM) for key establishment, derived from CRYSTALS-Kyber.
• FIPS 204 (ML-DSA) for digital signatures, derived from CRYSTALS-Dilithium.
• FIPS 205 (SLH-DSA), a hash-based signature scheme derived from SPHINCS+.

In March 2025, NIST also selected HQC as a backup key-establishment algorithm built on different mathematics. NIST's draft transition guidance (IR 8547) proposes deprecating today's quantum-vulnerable algorithms after 2030 and disallowing them after 2035.

Adoption has already begun. Major browsers and content delivery networks support hybrid key exchange that pairs a classical algorithm with ML-KEM, and a growing share of web traffic already uses it.

A simple test: Mosca's inequality

Michele Mosca's rule of thumb asks three questions:

1. X: How many years must this data stay confidential?
2. Y: How many years will it take us to migrate?
3. Z: How many years until a cryptographically relevant quantum computer exists?

If X plus Y is greater than Z, you are already exposed. Nobody knows Z precisely, but X and Y are within your control, and for many organizations they add up to more than a decade.

Medical records, government and defense information, intellectual property, legal files and long-lived identity data all need to stay confidential for many years. They are the first candidates for migration.

Where to start

Migration is a program, not a patch. Organizations that move smoothly tend to follow the same sequence.

1. Build a cryptographic inventory

You cannot replace what you cannot find. Catalogue where public-key cryptography is used: TLS endpoints, VPNs, SSH, code signing, certificates and PKI, databases, backups, hardware security modules, IoT devices and third-party services. Record the libraries and versions involved.

2. Rank by data lifetime and exposure

Prioritize systems that carry long-lived sensitive data across networks you do not control. A public marketing site and a link carrying patient records do not deserve the same urgency.

3. Build crypto-agility

Hard-coded algorithms are what make migrations slow. Centralize cryptographic configuration, prefer libraries that already support ML-KEM and ML-DSA, and design so that the next algorithm change is a configuration update rather than a rewrite.

4. Bring vendors into scope

Much of your cryptography lives in products you buy. Ask suppliers for their post-quantum roadmap, and add post-quantum support to your procurement requirements.

5. Start with hybrid deployments

Hybrid schemes combine a classical algorithm with a post-quantum one, so a connection stays secure as long as either holds. They are the practical bridge while the new algorithms mature in production.

The bottom line

Quantum risk is not a future problem with a future deadline. For data that must stay secret for years, the exposure window is already open. The good news is that the standards exist, tooling is maturing, and the first steps of inventory, prioritization and crypto-agility pay off whatever the timeline turns out to be.

Axrok's post-quantum security engagement covers exactly this path, from cryptographic inventory to a migration roadmap. If you want to know where your exposure sits, talk to us.