Quantum computers capable of breaking today’s public-key encryption don’t exist yet. The data an attacker steals and stores today, to decrypt once they do, is already being collected — which is why post-quantum planning is a today problem, not a someday one.
“Harvest now, decrypt later” describes a strategy, not a prediction: an adversary…
NIST finalized its first set of post-quantum cryptography standards in August 2024 — ML-KEM…
Most organizations cannot currently answer “where do we use RSA or ECC, and for what”…
“Harvest now, decrypt later” describes a strategy, not a prediction: an adversary intercepts and stores encrypted traffic or exfiltrated data today, betting that a sufficiently capable quantum computer will eventually be able to break the RSA or elliptic-curve encryption protecting it. For data with a long confidentiality shelf life — health records, government communications, trade secrets, anything that still matters in ten or fifteen years — that bet doesn’t need quantum computing to arrive soon to be worth making now.
NIST finalized its first set of post-quantum cryptography standards in August 2024 — ML-KEM (key encapsulation, derived from CRYSTALS-Kyber) for encryption and ML-DSA (digital signatures, derived from CRYSTALS-Dilithium) chief among them. That finalization matters because it moves post-quantum cryptography from “candidate algorithms being evaluated” to “standards vendors can actually build against” — browsers, cloud providers, and security libraries are rolling in support on a real, if staggered, timeline.
Most guidance converges on hybrid approaches first: running classical and post-quantum algorithms together during a transition period, so a flaw discovered in the newer post-quantum algorithms doesn’t leave systems with no proven fallback. Full migration to post-quantum-only cryptography follows once hybrid approaches have matured in production and vendor support is broad enough that it’s not a bespoke engineering effort for every system.
No — the realistic first step is a cryptographic inventory and a prioritized plan based on data sensitivity and confidentiality lifespan, not an immediate wholesale migration. Systems protecting long-lived sensitive data deserve earlier attention than systems protecting short-lived or already-public data.
No — post-quantum cryptography refers to classical algorithms (like ML-KEM and ML-DSA) designed to resist attacks from quantum computers, run on today’s ordinary hardware. Quantum encryption (quantum key distribution) is a different, much less widely deployed approach that requires specialized hardware.
The urgency is specific to data with a long confidentiality shelf life being harvested today, not to an imminent quantum breakthrough. For data that only needs to stay confidential for a year or two, the urgency is genuinely low; for data that needs to stay confidential for a decade or more, the harvesting risk is active today regardless of when a capable quantum computer actually arrives.