“Harvest now, decrypt later” (HNDL) describes an attack strategy in which an adversary intercepts and stores encrypted data today, expecting to decrypt it once quantum computers can break the key exchange that protected it. It is the main reason post-quantum migration is urgent, even though no cryptographically relevant quantum computer exists yet.
How the attack works
- Collect. The attacker records encrypted traffic, such as VPN tunnels, TLS sessions or messaging, or exfiltrates encrypted archives and backups.
- Store. Storage is cheap; the data is kept indefinitely.
- Decrypt. When a CRQC becomes available, Shor's algorithm recovers the private keys or shared secrets from the recorded RSA or (EC)DH handshakes, and the bulk data is decrypted.
Nothing about the attack is visible to the victim at the time of collection. The confidentiality failure happens years later, outside the victim's control.
Who is at risk
Any organisation whose data must stay confidential beyond the time it takes to build a CRQC. That clearly includes government and defence communications, but also:
- financial records and transaction histories;
- health and genomic data, which stays sensitive for a lifetime;
- intellectual property, research and M&A information;
- critical-infrastructure designs and operational data;
- identity data and long-lived credentials.
Measuring your exposure: Mosca's inequality
Michele Mosca's widely used rule of thumb puts the risk in three numbers:
x + y > z
x: how long your data must remain confidential. y: how long it will take to migrate your systems. z: how long until a CRQC exists.
If x + y is greater than z, data you are protecting today will be exposed. Large organisations often need five to ten years for a full cryptographic migration, so even conservative estimates for z leave little margin. Try the ElvasAI Quantum Risk Assessment to calculate yours.
Why signatures are different
HNDL is a confidentiality threat. Signature forgery is not retroactive: a forged signature only matters once forgery is possible. However, devices and roots of trust deployed today, such as firmware keys burnt into silicon, may be impossible to change later. That is why CNSA 2.0 asks for software and firmware signing to move to quantum-resistant algorithms first.
Defending against HNDL
- Hybrid key exchange now. Add ML-KEM to VPN and TLS key exchange so recorded sessions cannot be decrypted later. QVPN and QGate do this without changes to applications.
- Prioritise long-lived data. Start with links that carry the data with the largest x.
- Find the gaps. Use a cryptographic inventory (QScan) to locate every quantum-vulnerable key exchange.