Harvest Now, Decrypt Later (HNDL): What It Is, Who Is Exposed and What to Do Now

Harvest now, decrypt later (HNDL), also called store now, decrypt later, is an attack in which an adversary records encrypted traffic or copies encrypted data today and keeps it until a cryptographically relevant quantum computer can break the public-key cryptography that protected it. Any data that must stay confidential beyond the arrival of such a machine is already exposed, which is why post-quantum migration starts with the data that has the longest confidentiality life.

To see where your own exposure sits, start with a cryptographic inventory and the free Quantum Risk Score.

Imagine someone stealing your safe today, knowing they cannot open it now but confident they will have the tools in ten years. That is what harvest now, decrypt later means for encrypted data.

---

Table of Contents

1. How a Harvest Now, Decrypt Later Attack Works
2. What Is Exposed, and What Is Not
3. Who Is Exposed: Data Shelf Life by Sector
4. Mosca's Theorem: When You Are Already Late
5. When Could a Quantum Computer Break RSA?
6. What to Do Now
7. How DuoKey Helps
8. FAQ

---

How a Harvest Now, Decrypt Later Attack Works

The attack has three steps, and only the last one needs a quantum computer.

1. Harvest. The adversary collects ciphertext: traffic captured on a network link or at an interconnection point, a stolen database or backup, exfiltrated files, or archived VPN and TLS sessions. Nothing has to be decrypted at this stage, so the theft can look like a failed or harmless breach.
2. Store. Storage is cheap. Encrypted data with a long useful life (state secrets, health records, intellectual property, credentials that are never rotated) is worth keeping for years.
3. Decrypt. Once a cryptographically relevant quantum computer (CRQC) exists, Shor's algorithm solves the problems behind RSA, elliptic-curve cryptography and Diffie-Hellman. The adversary recovers the key-exchange secret or the wrapped key from the recorded data, derives the session or data key, and reads everything it protected.

What makes the threat different from ordinary attacks is that it is silent and retroactive. You will not know when the data was taken, and the damage happens years later, when nothing can be done about it.

---

What Is Exposed, and What Is Not

HNDL targets confidentiality protected by public-key key establishment. In practice:

Forward secrecy does not help here. ECDHE protects past sessions against a later theft of the server's private key, but a quantum computer attacks the ephemeral key exchange in the recorded handshake directly.

---

Who Is Exposed: Data Shelf Life by Sector

The question is not whether data is sensitive, but how long it must stay confidential. Typical examples:

If your organization holds any of these, some of its encrypted traffic is already worth harvesting.

---

Mosca's Theorem: When You Are Already Late

Michele Mosca, a researcher at the University of Waterloo, framed the timing question as a simple inequality:

X + Y > Z

• X: how many years the data must stay confidential (its shelf life)
• Y: how many years it will take you to migrate the systems that protect it to post-quantum cryptography
• Z: how many years until a cryptographically relevant quantum computer exists

If X + Y is greater than Z, data encrypted today is already exposed to harvest now, decrypt later.

A worked example: a bank holds client data that must stay confidential for 10 years (X = 10) and estimates its migration at 6 years (Y = 6). Even if a CRQC is 15 years away (Z = 15), the bank is already one year late, because 10 + 6 = 16. The only variables it controls are Y (migrate faster, starting with key exchange) and, sometimes, X (keep less data for less time).

---

When Could a Quantum Computer Break RSA?

Nobody knows the date, and credible estimates vary. What matters for planning is the direction of travel:

• Resource estimates keep falling. In 2019, Gidney and Ekerå estimated that factoring RSA-2048 would take about 20 million noisy qubits. In May 2025, Gidney estimated fewer than one million noisy qubits, running for less than a week.
• Regulators have set dates anyway. NIST's draft transition plan, IR 8547, proposes deprecating quantum-vulnerable algorithms at 112-bit security after 2030 and disallowing them after 2035. The EU targets 2030 for high-risk systems and the UK NCSC 2031 for the highest-priority migrations; both aim for completion by 2035. See our PQC migration roadmap for the full table.
• Agencies treat HNDL as a present risk. The joint CISA, NSA and NIST factsheet Quantum-Readiness: Migration to Post-Quantum Cryptography (August 2023) warns that data with a long secrecy lifetime may already be targeted, and asks organizations to start planning now.

For HNDL, Z is not the date a quantum computer is announced. It is the date by which data you send today must still be secret.

---

What to Do Now

1. Inventory where public-key key exchange is used. TLS endpoints, VPNs, SSH, key wrapping, file and email encryption, partner links. Keep the result as a CBOM (cryptographic bill of materials) per application.
2. Classify by shelf life. Tag the systems that carry data with a long confidentiality life. These move first, regardless of how easy they are.
3. Turn on hybrid post-quantum key exchange. ML-KEM (FIPS 203) combined with X25519 in TLS 1.3 (X25519MLKEM768) protects new sessions against HNDL without changing certificates. OpenSSL 3.5 offers it by default. See our ML-KEM key management guide and the F5 BIG-IP and FortiGate IPsec guides.
4. Fix the key hierarchy. Move key transport and key wrapping away from RSA, and check that stored data keys are wrapped with AES-256 or ML-KEM, not with a classical public key.
5. Reduce what can be harvested. Shorter data retention and fewer copies lower X in Mosca's inequality.
6. Put it on a roadmap with dates. A PQC migration roadmap turns these steps into owners and deadlines; a PQC readiness assessment measures where you start.

---

How DuoKey Helps

• Measure your HNDL exposure. The free Quantum Risk Score scores a domain's observable posture on four signals, one of which is harvest exposure (forward secrecy, data lifespan and endpoints carrying long-retention data). It needs no access to internal systems.
• Find quantum-vulnerable cryptography. DuoKey's PQC Scanner scans filesystems, source code and live TLS endpoints and produces a CycloneDX CBOM that flags RSA and ECC as quantum-vulnerable, with a recommended migration for each component. DuoKey CPM keeps that inventory current.
• Generate and hold post-quantum keys. DuoKey KMS can create hybrid ML-KEM keys in a vault that supports them, and DuoKey's agentic tools can move FortiGate IPsec VPNs and F5 BIG-IP TLS profiles to ML-KEM key exchange.
• Make the algorithm a policy. The Crypto Agility Plane lets applications declare what they protect rather than which algorithm they use, so moving from classical to hybrid or PQC-only is a policy change. See what crypto-agility means in practice.

Book a demo

---

FAQ

Q: What does harvest now, decrypt later mean?

It is an attack strategy in which an adversary collects encrypted data today and stores it until a quantum computer can break the public-key cryptography that protected it. The data is not readable when stolen, but becomes readable years later.

Q: Is store now, decrypt later the same thing?

Yes. Harvest now, decrypt later (HNDL), store now, decrypt later (SNDL) and "capture now, decrypt later" describe the same attack.

Q: Does forward secrecy protect against harvest now, decrypt later?

No. Forward secrecy protects past sessions if a long-term private key is stolen later. A quantum computer instead breaks the ephemeral ECDH or DH exchange recorded in each handshake. Only post-quantum or hybrid key exchange, such as ML-KEM, closes the gap.

Q: Is data encrypted with AES-256 safe?

AES-256 itself is considered quantum-resistant. The risk is how the AES key was established or wrapped: if it was exchanged or wrapped with RSA or ECC, recording that exchange exposes the key.

Q: Which data should we protect first?

Data that must stay confidential the longest, carried over links that use classical key exchange: for example health, identity, financial, defence and intellectual-property data. Mosca's inequality (X + Y > Z) helps rank it.

Q: Does post-quantum cryptography stop harvest now, decrypt later?

For data encrypted after you switch, yes: hybrid or pure ML-KEM key exchange protects new sessions. It cannot protect data that was already recorded under classical key exchange, which is why the migration should start with long-lived data now.

---

References

• Michele Mosca: Cybersecurity in an era with quantum computers: will we be ready? (IACR ePrint 2015/1075)
• Craig Gidney: How to factor 2048 bit RSA integers with less than a million noisy qubits (arXiv 2505.15917)
• NIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography Standards
• NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
• CISA, NSA, NIST: Quantum-Readiness: Migration to Post-Quantum Cryptography
• NCSC: Timelines for migration to post-quantum cryptography