Harvest Now, Decrypt Later: Why Today's Encrypted Data Is Tomorrow's Breach
An adversary captures your encrypted traffic today, stores it, and waits for a quantum computer to break it. The attack works against data you already sent.
Harvest now, decrypt later is a simple attack with a long fuse. An adversary captures your encrypted traffic today, stores it, and waits. They can’t read it yet — they’re betting that a future quantum computer will break the encryption protecting it, at which point the stored data becomes readable in bulk.
That bet is the subject of episode 96, where Kevin Kane, co-founder and CEO of American Binary, joined us to talk post-quantum encryption. The episode title says it plainly: they don’t need to hack you now. They just need to wait.
The uncomfortable part is that the attack works against data you already sent. Encryption you trusted last year, last week, or this morning is only as durable as the math behind it. If that math falls, every copy an attacker quietly saved falls with it.
Why Diffie-Hellman and RSA are the weak point
Nearly all encrypted internet traffic depends on public-key cryptography to set up a secure session. Two algorithms do most of that work: RSA and the Diffie-Hellman key exchange, the way two parties who’ve never met agree on a shared secret over a public network.
Kane described how central this one mechanism is: “There is a particular key exchange called the Diffie-Hellman key exchange, and it guides everything on the internet. Every email, every WhatsApp message, every VTC connection that’s encrypted uses this key exchange.”
That concentration is why the quantum threat is systemic. RSA and Diffie-Hellman both rest on math problems — factoring large numbers, computing discrete logarithms — that are hard for today’s computers and easy for a large enough quantum computer running Shor’s algorithm. The symmetric encryption protecting the message contents, like AES, is far more resilient. The break happens at the handshake that sets everything up.
How long until Q-Day?
No one can name the date. The industry calls the moment a quantum computer can break current public-key encryption “Q-Day,” and credible estimates range from a handful of years to more than a decade. Kane is careful about timing without pretending to predict it: “The time was not here, and it wasn’t here two years ago. It’s starting to come here now, but two years later, it’s going to super be here.”
For defenders, the exact date is the wrong thing to fixate on. Harvest now, decrypt later turns the timeline into a subtraction problem: take the number of years your data must stay secret, add the years it’ll take to migrate your systems, and compare that sum to the years until Q-Day. If secrecy plus migration runs past Q-Day, the data is already exposed. You don’t get to wait for certainty, because the harvesting is happening now.
Which data is already at risk
The risk scales with how long the information must stay secret. A session token that expires in an hour is worthless to an attacker who can only decrypt it in 2032. The highest-risk categories share one trait — a long secrecy lifetime:
- Health and genetic records, still sensitive decades later.
- Financial, insurance, and tax data, useful for fraud long after capture.
- Government, defense, and diplomatic communications.
- Source code, designs, and trade secrets.
- Long-lived keys and certificates — the material that protects other systems.
That last category is the quiet multiplier, and the same logic that makes device-bound credentials harder to steal applies: the longer a secret lives and the more it protects, the more it’s worth harvesting today. A useful filter: if a breach of this data in 2035 would still hurt, treat it as a target in 2026.
What to do now: crypto agility
The replacement algorithms exist and are standardized. In August 2024, NIST finalized its first three post-quantum standards: FIPS 203 (ML-KEM) for key exchange, plus FIPS 204 and 205 for signatures. The NSA’s CNSA 2.0 calls for quantum-resistant national security systems by 2035, with VPNs and routers moving by 2030 and browsers and cloud services by 2033. Those are the runway, not the deadline. A practical migration starts well before them:
- Inventory your cryptography — every TLS endpoint, VPN, code-signing path, and internal service auth. Most teams badly underestimate this surface.
- Rank by data shelf life. Migrate long-secrecy data first; a marketing site can wait, a health-records pipeline cannot.
- Build crypto agility — architect so algorithms can be swapped like rotating a certificate, not like replatforming.
- Start hybrid — pair a classical algorithm with a post-quantum one so a break in either doesn’t expose the session.
Kane’s company spent years on the unglamorous part: making a new key exchange work in the real world, complete with private peer review and formal verification. His hard-won lesson is why this can’t be a last-minute scramble: “There’s such a long road on learning what’s going wrong with software that is new, doesn’t exist in the wild, except for what you built.” New cryptography fails in ways no one has documented yet. Organizations that wait for Q-Day to start will be debugging the unknown under the worst possible pressure. The proven algorithms are ready — the scarce resource is the time to deploy them well.