The Harvest Now, Decrypt Later Problem
Understanding why your encrypted data is at risk today
Nation-state actors and sophisticated adversaries are intercepting and storing encrypted traffic today. The timing of a cryptographically relevant quantum computer remains uncertain, but when one arrives, data encrypted with current RSA/ECC algorithms could be retroactively decrypted.
Sensitive contracts, financial data, medical records, government communications: all retroactively exposed. The threat is not future: it is happening now.
Data Intercepted
Encrypted traffic captured and stored by adversaries
Act Now
Critical window to migrate before quantum threat materialises
Standards Deadlines
NIST recommends deprecating classical algorithms by 2030 and disallowing by 2035
Data Exposed
All RSA/ECC encrypted data becomes readable
What's Changing
New cryptographic standards are here
NIST finalised three post-quantum standards in August 2024:
- FIPS 203ML-KEM for key encapsulation (replacing key exchange)
- FIPS 204ML-DSA for digital signatures
- FIPS 205SLH-DSA for stateless hash-based signatures
These replace RSA and ECC in all new deployments. The recommended approach: run PQC alongside classical crypto during the transition period.
Who Must Act Now
Priority sectors for quantum-safe migration
Financial Services
Regulatory pressure and long-lived sensitive data require proactive quantum readiness.
Healthcare
Patient records with 20+ year retention policies must remain confidential through the quantum transition.
Government & Public Sector
National security and classified data demand immediate attention to quantum threats.
Legal
Attorney-client privilege, contracts, and e-signatures require long-term cryptographic integrity.
Critical Infrastructure
Energy, telecoms, and transport systems must maintain security across decades of operation.
Document Management
ECM platforms with long-term archival requirements need future-proof encryption.
The Regulatory Landscape
Compliance requirements are evolving
EU Cyber Resilience Act
Mandatory cybersecurity requirements for products with digital elements. PQC readiness is increasingly relevant.
NIS2 Directive
Requires "state of the art" security measures: PQC is increasingly interpreted as meeting this threshold.
ENISA Recommendations
Published PQC migration guidance recommending hybrid approaches and early preparation.
UK NCSC Guidance
"Prepare, don't panic": but preparation means concrete technical steps, not just awareness.
eIDAS 2.0
Qualified electronic signatures must remain secure over their validity period: PQC signatures are essential.
US Executive Order (NSM-10)
Requires federal agencies to inventory cryptographic systems and prepare migration plans.