Sign inGet started

The Threat

Harvest Now, Decrypt Later

7 min

The obvious question is "when will a quantum computer be able to break this?" It turns out to be the wrong question, and the reason is a piece of arithmetic anyone can do.

Harvest now, decrypt later
todaytraffic captured and storedmigration windowyou deploy PQCCRQC existsthe archive is decryptedyour data still needs to be secret across this whole span
The deadline is not the day a cryptographically relevant quantum computer arrives. It is that day minus how long your data must stay secret — and traffic captured today is already sitting in storage.

The sum

Three numbers.

x — how many years your data must stay secret. y — how many years it will take you to change your locks. z — how many years until a codebreaking quantum computer exists.

If x + y is bigger than z, you are already too late.

Why? Because somebody can record your encrypted traffic today, put it on a shelf, and decrypt it the day the machine arrives. Nothing about that plan requires the machine to exist yet. It only requires cheap storage, and storage has never been cheaper.

A worked example

Medical records need to stay private for, say, 25 years. A big organisation realistically takes 5 to 10 years to change every system, every vendor, every device in the field.

That is 30 to 35 years of exposure. Almost nobody's guess for z is that far away.

The deadline, for that organisation, passed some time ago.

What is actually at risk

Not everything. Two things have to be true.

It has to stay secret for a long time. Medical records, genetic data, state secrets, legal files, industrial designs. A login token that expires in an hour does not care.

It has to have crossed a network somebody could tap. If it never left the building, nobody recorded it.

Signatures are a different shape of problem. Forging one in 2035 does not let you go back and fake last year's software update — the damage is not retroactive. But long-lived signing keys, especially the root certificates your browser trusts, do need replacing before the machine arrives.

x

Years your data must stay secret

y

Years to change your locks

z

Years until the machine. If x + y > z, start now.

Worth remembering

  • If your secrecy period plus your migration time exceeds the wait, you are already behind.
  • Traffic recorded today can be decrypted later; the attacker does not need the machine yet.
  • Long-lived secrets sent over a network are the exposed category.
  • Signatures are less exposed after the fact, but long-lived signing keys still need doing early.