Industry & Era
Harvest Now, Decrypt Later
A security concern where encrypted data is collected today with the intention of decrypting it once sufficiently powerful quantum computers exist.
Definition
'Harvest now, decrypt later' describes a forward-looking security threat: adversaries intercept and store currently-encrypted data today, anticipating that future quantum computers running Shor's Algorithm could eventually break the encryption protecting it, even though no such quantum computer exists yet.
In depth
Harvest now, decrypt later is an attack strategy in which an adversary records encrypted data today, even though they cannot read it, and stores it until a future quantum computer can break the encryption. The attack costs only storage and network access, which nation-states have in abundance, and it targets data whose confidentiality must last many years. If a quantum computer capable of running Shor's algorithm arrives in 2035, a conversation encrypted with RSA or elliptic-curve key exchange in 2025 could be read then.
The risk depends on how long the data must stay secret. Mosca's inequality captures this: if the secrecy lifetime X plus the time Y needed to migrate to quantum-safe systems exceeds the time Z until a capable quantum computer exists, the data is at risk. Health records, state secrets, trade secrets, financial contracts, and identity data can need protection for 25 years or more. Forward secrecy, which protects past sessions from later key compromise, does not help against this threat, because the key exchange itself can be broken by a quantum computer.
The remedy is to move key exchange to post-quantum algorithms now. Browsers and servers have deployed hybrid key exchange, combining X25519 with the post-quantum ML-KEM, with Chrome enabling it by default in 2024 and Cloudflare reporting a large and growing share of traffic protected. Signatures are less urgent because they cannot be harvested in the same way, though long-lived signatures need attention. Government agencies, including the U.S. NSA and the UK NCSC, have set migration timelines, and organizations are advised to inventory their cryptography and prioritize data with long confidentiality lifetimes.
Technical Definition
This concern is the primary justification for organizations to migrate to post-quantum cryptography standards now, well ahead of when large-scale fault-tolerant quantum computers are expected, particularly for data with long required confidentiality lifetimes.
Visual Explanation: An Analogy
Think of it like a thief stealing a locked safe today, confident that a much better lock-picking tool will eventually be invented — they're willing to wait years to open it, as long as the contents remain valuable when that tool arrives.
Key facts
| Item | Detail |
|---|---|
| Threat model | Record encrypted data now, decrypt it with a future quantum computer |
| Affected | RSA, Diffie-Hellman, and elliptic-curve key exchange |
| Mosca's inequality | Risk exists if secrecy lifetime plus migration time exceeds time to a capable quantum computer |
| Mitigation | Post-quantum key exchange such as ML-KEM, deployed in hybrid mode |
| Deployment | Chrome enabled hybrid ML-KEM by default in 2024 |
Where the idea comes from
The concern was raised by security researchers in the 2010s as Shor's algorithm resource estimates improved, and became a stated concern of intelligence agencies and standards bodies, which issued advisories from 2015 onward.
Real-World Use Cases
- The primary driver behind government and financial institution post-quantum cryptography migration timelines
- Particularly relevant for data needing decades-long confidentiality, like state secrets or long-term medical records
How it differs from related ideas
- Harvest now, decrypt later targets confidentiality of stored data, while forging signatures requires a quantum computer at the time of the attack.
- It differs from an immediate break because the attacker needs only storage today.
- Symmetric encryption such as AES-256 is not significantly affected.
Frequently asked questions
What is harvest now, decrypt later?
An attack in which encrypted data is collected today to be decrypted once quantum computers can break the encryption.
Who is at risk?
Anyone whose data must remain secret for many years, such as governments, hospitals, banks, and companies with trade secrets.
How can it be prevented?
By switching key exchange to post-quantum algorithms now, and encrypting long-lived data with quantum-resistant methods.
Related Terms
Keep exploring
- Algorithm: Shor's Algorithm
- Algorithm: BB84 Quantum Key Distribution
- Hardware: Google Willow
- Industry: Quantum Computing for Cybersecurity
- Industry: Quantum Computing and the Public Sector
- Industry: Quantum Computing for Finance