Harvest Now, Decrypt Later: The Internet's Slow Race Against Quantum

01 THE ADVERSARY'S ARITHMETIC

Harvest now, decrypt later is not a metaphor; it is a rational strategy with a simple expected-value calculation. Recording encrypted traffic costs close to nothing — storage prices fall every year, and bulk interception is mature. The record only pays off if two things hold: someone eventually builds a cryptographically relevant quantum computer, and the recorded material is still sensitive when they do. For state-scale adversaries recording state-scale targets, both assumptions are cheap to make. Diplomatic cables have shelf lives measured in decades; the same is true of industrial secrets, pharmaceutical pipelines and intercepted keys.

This inverts the usual security intuition. Defenders protect against attacks they can watch succeed or fail. HNDL's damage is deferred and invisible: nothing breaks today, which is exactly why the threat is easy to defer on busy security agendas.

02 WHAT IS ACTUALLY EXPOSED

The exposed surface splits into two classes with different clocks. Confidentiality exposure is the famous one: TLS sessions, VPN tunnels and archived traffic captured today can be decrypted retroactively by a future factoring-capable machine, because RSA and elliptic-curve key agreement protect them. Authenticity exposure is quieter and arguably worse: digital signatures protect firmware updates, operating system boot chains and software distribution. A future signature forgery does not merely read old data — it can make malicious updates appear legitimate on hardware still in the field.

The shelf life of the secret, not the strength of the key, sets each deadline. Session traffic that is worthless in a week can migrate slowly. Long-lived secrets — key-encryption keys, signing roots, archival data — are already late, because anything captured before their migration is exposed in perpetuity.

03 SHOR'S ALGORITHM SETS THE CLOCK

The mechanism behind the threat has been understood since 1994: Shor's algorithm factors integers and solves discrete logarithms in polynomial time on a sufficiently large quantum computer, breaking RSA and elliptic-curve cryptography wholesale rather than incrementally. The engineering requirement is not a lab demo with hundreds of noisy physical qubits but an error-corrected machine running thousands of logical qubits — a gap that remains large and honestly unforecastable.

That uncertainty is asymmetric, though. For the defender, a late arrival is a reprieve; for the strategist, an early arrival is catastrophe — and the cost of being wrong in each direction is wildly different. This is why sober planning treats the timeline as a distribution, not a date, and why 'the machine is twenty years away' has never been a valid migration argument for data with a twenty-year shelf life.

04 THE STANDARDS ARRIVED

The replacement algorithms are no longer speculative. NIST's post-quantum program, opened in 2016, selected its algorithms in 2022 and published the standards in August 2024: FIPS 203 specifies ML-KEM, a lattice-based key-encapsulation mechanism derived from CRYSTALS-Kyber; FIPS 204 specifies ML-DSA for digital signatures from Dilithium; FIPS 205 adds SLH-DSA, a hash-based signature scheme with different trust assumptions. Deployments typically run these in hybrid mode alongside classical algorithms, so security holds if either side of the pair survives.

The important property of the lattice schemes is performance: key sizes are larger than elliptic curves, but handshake overhead is small enough that major CDNs shipped them to real users at scale — the migration is an engineering project, not a research problem.

05 THE MIGRATION IS A LOGISTICS PROJECT

Adoption data shows the easy half moving fast. Cloudflare reported post-quantum key agreement on under 5 percent of human web traffic in early 2024, above a third by late 2024, and a majority during 2025 — an adoption curve driven by a handful of browser and CDN operators coordinating a protocol switch.

The hard half is the inventory nobody controls centrally: embedded controllers with fifteen-year lifespans, industrial equipment, medical devices, cars, and the enterprise crypto inventory that most organizations cannot fully enumerate. Every published migration guide lands on the same unglamorous first step — build a cryptographic inventory — because a migration cannot be scheduled for systems no one knows exist. Crypto-agility, the ability to swap algorithms without re-architecting, is the actual deliverable; the algorithms are almost a detail.

06 WHAT TO WATCH

Three signals will track the race. First, federal and regulated-industry deadlines: guidance to deprecate classical public-key cryptography around 2030 gives procurement a forcing function, and compliance calendars migrate faster than goodwill. Second, browser-and-CDN completion: when the interactive web is effectively fully post-quantum, the residual harvest surface narrows to the long-lived and embedded. Third, logical-qubit milestones: each credible error-correction result moves the perceived deadline, and perceived deadlines move budgets before real ones do.

The durable conclusion is independent of when the machine arrives. Anything with a decade's shelf life is already in scope, the standards exist, the fast half of the internet has shown the migration is deployable at scale — and the cost of migrating late is the one bill that can be retroactive by a decade.