Harvest Now, Decrypt Later
The most urgent quantum risk is not in the future — it is happening today. Adversaries can record your encrypted traffic now and decrypt it years later, the moment a quantum computer becomes capable. For long-lived secrets, the deadline has effectively already passed.
The attack that needs no quantum computer (yet)
Harvest now, decrypt later (HNDL) — also called store now, decrypt later — is a patient, low-cost strategy. A well-resourced adversary intercepts and archives encrypted data today: VPN sessions, TLS-protected transfers, database backups, signal intercepts. The data is unreadable now, but storage is cheap and the adversary is willing to wait. When a cryptographically relevant quantum computer (CRQC) finally arrives, all of that hoarded ciphertext — protected by RSA or elliptic-curve key exchange — can be decrypted retroactively.
The crucial insight is that the attacker needs no quantum computer today. They only need cheap storage and a long time horizon. This decouples the threat from the CRQC timeline: the harvesting is already economical and, for capable adversaries, already underway.
Mosca's inequality: are you already too late?
Michele Mosca framed the urgency as a simple inequality. Define three quantities:
- X — how many years your data must stay secret (the secrecy lifetime).
- Y — how many years it will take you to migrate your systems to PQC.
- Z — how many years until a CRQC exists.
The theorem: if X + Y > Z, you are already exposed. Any data with a secrecy requirement longer than the time remaining after migration will be compromised — because by the time you finish migrating, harvested data will still be within its secrecy window when the CRQC arrives.
A worked example
Suppose your organization handles records that must remain confidential for X = 15 years (think medical histories or classified material). A realistic enterprise PQC migration — discovery, testing, rollout across thousands of systems — takes Y = 6 years. And suppose a CRQC plausibly arrives in Z = 12 years.
Then X + Y = 15 + 6 = 21, which is greater than Z = 12. The data you encrypt today will still need protection (for 15 years) long after the CRQC appears (in 12 years) and well past when you finished migrating (in 6 years). You are already too late for that data. Even a conservative Z does not save you, because X alone (15) already exceeds Z (12). The only mitigation is to start migrating immediately and to re-encrypt or re-key the most sensitive long-lived data with PQC as fast as possible.
| Variable | Meaning | Example |
|---|---|---|
| X | Required secrecy lifetime of data | 15 years |
| Y | Migration time to PQC | 6 years |
| Z | Years until a CRQC | 12 years |
| X + Y vs Z | 21 > 12 | Already exposed |
Which data is most at risk?
HNDL does not threaten everything equally. The danger scales with secrecy lifetime. Prioritize data that must stay confidential for a decade or more:
- Health records — protected by law for a lifetime.
- Government and military secrets — classification often spans decades.
- Intellectual property and trade secrets — designs, formulas, source code with long commercial value.
- Root keys and long-lived credentials — CA roots, code-signing keys, device identities baked into hardware.
- Financial and legal records — long regulatory retention requirements.
By contrast, ephemeral data — a one-time session token, a stock quote — has a secrecy lifetime measured in seconds and is essentially immune to HNDL.
Why waiting is the wrong bet
The instinct to "wait until the threat is real" fails on two counts. First, the harvesting is happening now, so the clock on your long-lived data is already running. Second, migration is slow: inventorying cryptography, testing PQC, and rolling it out across an enterprise is a multi-year program (the Y term), and it cannot be compressed at the last minute. The rational response is to begin migration today, starting with your highest-X data.
Migration Strategy →
How to plan and sequence the move to PQC.
Standardization & Deadlines →
Milestones and mandated dates.
Standards & references
- NIST IR 8547 — transition to PQC standards, with deprecation and disallow dates that anchor your Z estimate.
- NSA CNSA 2.0 advisory — mandated quantum-safe algorithms and adoption timelines for national security systems.
- ETSI Quantum-Safe Cryptography — migration guidance and quantum-safe standards work.
- Resources — full standards register
先收集、后解密
最紧迫的量子风险不在未来，而在今天就已发生：对手可以现在录下你的加密流量，待量子计算机具备能力，再于数年后将其解密。对于需要长期保密的数据，截止期实际上早已过去。
一种暂时不需要量子计算机的攻击
先收集、后解密（Harvest Now, Decrypt Later, HNDL），又称先存储、后解密，是一种耐心且低成本的策略：资源充足的对手在今天截获并归档加密数据——包括 VPN 会话、受 TLS 保护的传输、数据库备份、信号截获——这些数据当下不可读，但存储廉价，而对手愿意等待。当密码相关量子计算机（CRQC）最终到来，所有这些囤积的密文，凡由 RSA 或椭圆曲线密钥交换保护的，都可被追溯解密。
关键洞见在于：攻击者今天并不需要量子计算机，只需廉价存储和足够长的时间跨度。这使威胁与 CRQC 时间线解耦——收集行为如今已具经济性，对有能力的对手而言，早已在进行之中。
Mosca 不等式 你是否已经太迟
Michele Mosca 用一个简单的不等式刻画了紧迫性。定义三个量：
- X——数据必须保密多少年，即保密寿命。
- Y——将系统迁移到 PQC 需要多少年。
- Z——距离 CRQC 出现还有多少年。
定理：若 X + Y > Z，你已经暴露。凡保密需求长于迁移完成后剩余时间的数据都将被攻破，因为等你迁移完成时，被收集的数据在 CRQC 到来时仍处于保密窗口之内。
一个算例
假设你的机构处理必须保密 X = 15 年的记录，例如病史或涉密材料；一次现实的企业 PQC 迁移——包括梳理、测试、在数千套系统上铺开——需要 Y = 6 年；再假设 CRQC 较可能在 Z = 12 年后到来。
那么 X + Y = 15 + 6 = 21，大于 Z = 12。你今天加密的数据，在 CRQC 出现的 12 年后（远晚于你完成迁移的 6 年后）仍需保护 15 年，对这批数据而言你已经太迟。即便取更保守的 Z 也救不了你，因为仅 X 一项（15）就已超过 Z（12）。唯一的缓解办法是立刻启动迁移，并尽快用 PQC 对最敏感的长期数据重新加密或重新派发密钥。
| 变量 | 含义 | 示例 |
|---|---|---|
| X | 数据所需保密寿命 | 15 年 |
| Y | 迁移到 PQC 的时间 | 6 年 |
| Z | 距 CRQC 出现的年数 | 12 年 |
| X + Y 对比 Z | 21 > 12 | 已经暴露 |
哪些数据风险最高
HNDL 并非对一切等量齐观，危险程度随保密寿命上升，应优先处理需保密十年以上的数据：
- 健康记录——法律要求终身保护。
- 政府与军事机密——密级常跨越数十年。
- 知识产权与商业秘密——设计、配方、源码，具有长期商业价值。
- 根密钥与长期凭据——CA 根证书、代码签名密钥、烧录进硬件的设备身份。
- 金融与法律记录——监管留存要求漫长。
相比之下，短暂数据（如一次性会话令牌、一条股票报价）保密寿命以秒计，基本对 HNDL 免疫。
为何等待是错误的赌注
「等威胁成真再说」的本能在两点上站不住脚。其一，收集此刻正在发生，你长期数据的倒计时早已开始。其二，迁移很慢——梳理密码资产、测试 PQC、在全企业铺开，是一个多年期工程（即 Y 项），无法在最后关头压缩。理性的应对是今天就启动迁移，从 X 值最高的数据入手。
标准与参考
- NIST IR 8547 — 向 PQC 标准过渡 含可校准 Z 值的弃用与禁用日期。
- NSA CNSA 2.0 咨询通告 — 面向国家安全系统的量子安全算法及采用时间线。
- ETSI 量子安全密码 — 迁移指南与量子安全标准工作。
- 资源链接 — 完整标准登记册