Harvest now, decrypt later: why encrypted data is already at risk from quantum computers
Short answer: "Harvest now, decrypt later" describes an attacker who copies encrypted data today, stores it, and waits until a large enough quantum computer can break the public key cryptography that protected it. The data does not need to be decrypted now to be at risk now. That is why governments ask organisations to move to post-quantum cryptography years before such a machine exists.
Most internet encryption uses two layers. A public key method such as RSA or elliptic curve Diffie Hellman agrees a shared secret, and a symmetric cipher such as AES then encrypts the actual data with that secret. A sufficiently large quantum computer running Shor's algorithm could recover the secret from the recorded key exchange, and with it the data. Symmetric ciphers are much less exposed; the main defence there is using adequately long keys.
The risk depends on how long the data must stay secret. If information will still matter in ten or fifteen years, such as health records, state secrets, long term contracts or intellectual property, then traffic captured today could become readable within its useful life. Short lived data, such as a one time login code, matters far less.
The answer is to change the key exchange, not to wait. NIST published FIPS 203 in August 2024, which standardises ML-KEM, a key encapsulation mechanism designed to resist quantum attack. Our guide to ML-KEM, ML-DSA and SLH-DSA explains what each standard does. Many deployments use a hybrid approach that combines a classical exchange with ML-KEM, so the connection stays secure if either one holds.
Official timelines reflect this. NIST's draft report IR 8547 proposes deprecating quantum vulnerable public key algorithms at the 112 bit security level after 2030 and disallowing them after 2035; we covered it in our report on the draft. The UK's NCSC sets milestones of 2028 for discovery and planning, 2031 for priority migrations and 2035 for completing migration.