Harvest Now, Decrypt Later: The Quantum Harvesting Threat

Harvest Now, Decrypt Later (HNDL) is a threat strategy in which an adversary records encrypted data it cannot yet read, stores it, and waits to decrypt it once a sufficiently powerful quantum computer becomes available. It matters because it collapses the comfortable assumption that a strong cipher protects data for its entire useful life. Even if no quantum computer can yet break widely deployed public-key cryptography, data with a long confidentiality lifetime is already exposed the moment it crosses a network an attacker is watching.

What Is Harvest Now, Decrypt Later

The strategy, also called store-now-decrypt-later or retrospective decryption, has two phases separated in time. First, an adversary captures ciphertext, most cheaply by recording traffic that uses public-key key exchange such as RSA or elliptic-curve Diffie-Hellman. Second, at some future point when a cryptographically relevant quantum computer exists, it uses Shor's algorithm to recover the session keys from the captured handshake and decrypt everything that followed. The victim receives no signal that anything has happened, because the interception is passive. Common targets include recorded TLS, IPsec VPN, and SSH sessions, where capturing a single key-exchange handshake is enough to later reconstruct every symmetric key and read the entire session.

Why the Strategy Works

The threat exploits an asymmetry in cost and timing:

• Capturing ciphertext is cheap and passive. Bulk recording of network traffic requires no code execution on the target and leaves no trace on victim systems.
• Storage is inexpensive and patient. An adversary can warehouse intercepted data for years at negligible cost.
• Some data stays sensitive for a long time. Diplomatic cables, health records, genetic data, financial and legal files, trade secrets, and long-term credentials remain valuable well beyond the moment they were sent.

Put together, an attacker does not need a quantum computer to exist at the time of capture. They only need it to exist before the data's value expires.

Which Data Is Most at Risk

Not all data carries equal exposure. The determining factor is the required confidentiality lifetime, how long the information must stay secret. Short-lived data, such as a one-time notification, is at little risk because it will be worthless by the time decryption is feasible. High-risk categories are those whose secrecy must endure, including:

• Government and military communications and classified archives
• Personal health, biometric, and genetic information
• Intellectual property, source code, and trade secrets
• Long-term keys, root credentials, and certificate private keys

As a rule of thumb, if disclosure would still cause harm many years after transmission, the data warrants priority protection.

Mosca's Inequality

A useful way to reason about urgency is Mosca's inequality, which compares three time spans.

if  X + Y > Z  then you have a problem
  X = years your data must remain confidential (shelf-life)
  Y = years needed to migrate systems to post-quantum crypto
  Z = years until a cryptographically relevant quantum computer exists

If the time your data must stay secret plus the time your migration will take exceeds the time until a capable quantum computer arrives, then some of your data is already at risk. Because Z is deeply uncertain and both X and Y are often large, the prudent reading is to begin migration well before a quantum computer is demonstrated.

Defending Against Harvesting

Since the harvesting has likely already begun for high-value traffic, defense centers on removing the future decryption capability. Crucially, protection must be in place before capture, not merely before a quantum computer arrives, because data recorded while it was still only classically protected stays vulnerable retroactively.

1. Migrate key establishment first. Deploy post-quantum cryptography such as ML-KEM for key exchange, since that is precisely what HNDL targets. Signatures are less urgent, because forging a signature retroactively provides no benefit.
2. Use hybrid key exchange. Combining a classical algorithm with a post-quantum KEM protects captured traffic as long as either component resists attack.
3. Prioritize by data lifetime. Apply Mosca's inequality to rank systems, protecting long-lived secrets before short-lived ones.
4. Maintain forward secrecy. Ephemeral key exchange limits how much data a single compromised key can expose, though it does not by itself defeat a quantum adversary, which is why the underlying algorithm must also change.
5. Build crypto-agility. Structure systems so algorithms can be swapped without re-architecting, as described in crypto-agility and migrating to post-quantum cryptography.

Key Takeaways

• Harvest Now, Decrypt Later captures encrypted data cheaply and passively to decrypt it after quantum computers mature.
• It works because interception and storage are inexpensive while some data stays sensitive for many years.
• The most exposed data has a long required confidentiality lifetime, such as health, government, and intellectual-property records.
• Mosca's inequality (X + Y > Z) shows that long data lifetimes and slow migration make action worthwhile ahead of any quantum breakthrough.
• The core defense is migrating key establishment to post-quantum and hybrid schemes, prioritized by how long each dataset must stay secret.