Harvest Now, Decrypt Later (HNDL): What It Is and How to Defend Against It

Harvest Now, Decrypt Later at a Glance

• What is exposed: anything protected by RSA, Diffie-Hellman or elliptic-curve key exchange or key wrapping: TLS and VPN sessions recorded off the network, email and files encrypted to RSA or elliptic-curve keys (for example with PGP or S/MIME), and backups whose keys were wrapped that way.
• What is not: data encrypted only with a symmetric key, such as AES-256 with a key derived from a strong password. Quantum computers give only a quadratic speedup against it, and NIST's draft transition report keeps AES-256 in its highest security category.
• Who has warned about it: CISA, NSA and NIST in a joint 2023 factsheet; Signal named it as the reason it added post-quantum keys to its protocol the same year.
• How much time there is: no one knows. The best published estimate for breaking RSA-2048 fell from 20 million noisy qubits (2019) to under one million (2025).
• What to do: use hybrid post-quantum key exchange for connections, re-encrypt long-lived data whose keys depend on RSA or elliptic curves, and start with the data that must stay secret the longest.

How a Harvest Now, Decrypt Later Attack Works

1. Record. An adversary copies encrypted traffic as it crosses a network, or copies encrypted files and backups from storage it can reach. Nothing has to be decrypted at this stage.
2. Store. The data is kept until it can be read. Storage is cheap compared with the value of secrets that stay sensitive for decades.
3. Break the key exchange. Once a large enough quantum computer exists, Shor's algorithm recovers the private keys behind RSA, Diffie-Hellman and elliptic-curve public keys, and with them the session or file keys of the recorded data.
4. Decrypt. With those keys, the attacker decrypts the recordings. The symmetric cipher, usually AES, never has to be broken.

The recording happens now, and nothing done later can protect data that has already been copied. That is why harvest now, decrypt later is a reason to act before a quantum computer exists, not after.

Who Has Warned About It

In August 2023, CISA, NSA and NIST published a joint factsheet, Quantum-Readiness: Migration to Post-Quantum Cryptography. It tells organizations to plan early because threat actors could be targeting data with a long secrecy lifetime "using a catch now, break later or harvest now, decrypt later operation", and it names RSA, ECDH and ECDSA as the algorithms that will need to be replaced.

In September 2023, Signal announced PQXDH, which adds the post-quantum CRYSTALS-Kyber key encapsulation mechanism to its X25519-based key agreement. Its announcement describes the threat by name: a future quantum computer could compute a private key from a public key, "known as Harvest Now, Decrypt Later (HNDL)".

These warnings describe what an adversary could do with recorded data. They do not name a specific program, and this guide does not speculate about one.

What Data Is at Risk

Harvest now, decrypt later matters for data that will still be sensitive when a quantum computer arrives. Legal retention rules show how long that can be:

• Health information (US): HIPAA protects a person's health information during their life and for 50 years after death (45 CFR 160.103).
• Classified information (US): automatic declassification comes at 25 years, agencies can exempt information to 50 years, and some can stay classified beyond 75 years with approval (Executive Order 13526, Sec. 3.3).
• Trade secrets: valuable for as long as they stay secret, with no fixed end.
• Genetic data: sensitive for a person's lifetime and, through relatives, beyond it.

Other long-lived targets include diplomatic and defense communications, legal advice and litigation strategy, pharmaceutical and engineering research, merger negotiations, and the private messages of public figures.

When Could Quantum Computers Do This?

No one can say exactly when a cryptographically relevant quantum computer will exist. The deadlines below are set years ahead of any working machine because migrating takes years, and because harvested data is exposed from the day it is recorded.

Mosca's Inequality: Do You Need to Act Now?

In 2015, Michele Mosca of the University of Waterloo's Institute for Quantum Computing framed the question in a simple inequality with three numbers:

• X: how many years the data must stay secret.
• Y: how many years it will take to migrate your systems to post-quantum cryptography.
• Z: how many years until a cryptographically relevant quantum computer exists.

If X + Y > Z, data protected today will still need protection after it can be broken, so migration should already be under way.

A hospital keeps records that must stay confidential for decades (X = 50) and needs five years to migrate (Y = 5). Even if a quantum computer is 30 years away (Z = 30), 55 is greater than 30. A company with trade secrets that matter for ten years (X = 10) and a two-year migration (Y = 2) is safe only if Z is more than 12, and no one can promise that. Y is the one number you control: starting earlier is the only way to shrink the gap.

Why Bigger RSA Keys Do Not Help

Shor's algorithm breaks RSA in polynomial time, so a longer key adds only a modest amount of quantum work. The same holds for every elliptic curve, including those behind ECDH, ECDSA, X25519 and Ed25519: there is no quantum-resistant curve. The fix is a different kind of mathematics, which is what NIST's post-quantum standards provide.

What Harvest Now, Decrypt Later Does Not Affect

• Symmetric encryption: AES-256 stays strong. A file or volume encrypted only under a key derived from a password, as with VeraCrypt or a 7-Zip archive, has no public-key step for Shor's algorithm to attack; its strength rests on the password.
• Hash functions: SHA-2 and SHA-3 remain in use; quantum attacks give only limited speedups against them.
• Signatures, in a different way: a recorded signature cannot be decrypted, but once a quantum computer exists, an attacker could forge new signatures with keys derived from public keys. Signatures that must be trusted for a long time, on firmware, documents or certificates, need post-quantum signatures before then.

How to Defend Against Harvest Now, Decrypt Later

Data in transit

• Use hybrid post-quantum key exchange in TLS. X25519MLKEM768 is on by default in Chrome and Edge 131 and later, Firefox 132 and later on desktop, and Safari 26 (Cloudflare's support list). Servers need it too, for example through OpenSSL 3.5 or later or a provider that offers it.
• Update SSH. OpenSSH 10.0 uses the hybrid mlkem768x25519-sha256 by default for key agreement.
• Ask your VPN and messaging vendors whether their key exchange is post-quantum, and when it will be.

Data at rest

• Inventory what is exposed. List files, archives and backups whose keys are exchanged or wrapped with RSA or elliptic curves, such as PGP or S/MIME encryption and cloud key-wrapping. Password-only AES encryption is a smaller worry.
• Re-encrypt long-lived data with post-quantum key establishment, starting with the data that must stay secret the longest.
• Encrypt before you upload. Encrypt files on your own device with a post-quantum tool, then store the result in any cloud. QNSQY does this with hybrid ML-KEM and X25519 by default (ML-KEM-512 on the Free plan, ML-KEM-768 on Pro, ML-KEM-1024 on Business).

Plan by data lifetime

Use Mosca's inequality to rank systems by how long their data must stay secret, and move the longest-lived ones first. For a full starting plan, see what post-quantum cryptography is and how to start and the step-by-step hybrid migration strategy.

Deadlines for Moving Off Quantum-Vulnerable Cryptography

These dates were checked against the sources above on 19 October 2026. Draft documents can still change.

The Irreversibility Problem

Most breaches can be contained after the fact: passwords are changed, systems rebuilt, credentials reissued. Harvest now, decrypt later offers no such remedy. Once encrypted data has been copied, switching to post-quantum cryptography tomorrow does not protect that copy. Only data that was already protected when it was recorded, by post-quantum key establishment or by symmetric encryption alone, is safe from this attack.

Frequently Asked Questions

What does harvest now, decrypt later mean?

It is an attack in which encrypted data is recorded today and kept until a quantum computer can break the public-key cryptography that protected it. The data is not read when it is taken; it is read years later.

Is harvest now, decrypt later happening today?

CISA, NSA and NIST warned in 2023 that threat actors could already be collecting data this way. The recording step needs no quantum computer, so it can happen now; only the decryption has to wait.

Is AES-256 safe from harvest now, decrypt later?

Yes, as a cipher. Grover's algorithm gives only a quadratic speedup, and NIST's draft transition report keeps AES-256 in its highest security category. The risk is the RSA or elliptic-curve key exchange that usually delivers the AES key.

Does TLS 1.3 protect against harvest now, decrypt later?

Only when the connection uses post-quantum key exchange. Chrome and Edge 131 and later, Firefox 132 and later on desktop, and Safari 26 offer the hybrid X25519MLKEM768 by default; a TLS 1.3 connection that uses plain X25519 or ECDHE can still be recorded and decrypted later.

What should I re-encrypt first?

Data that must stay secret for many years and whose keys were exchanged or wrapped with RSA or elliptic curves: archives, backups, health, legal and research records, and files encrypted to RSA or elliptic-curve keys.

When will quantum computers be able to break RSA-2048?

No one knows. The best published estimate fell from 20 million noisy qubits in 2019 to under one million in 2025, running for less than a week. Deadlines are set years ahead because migration itself takes years.

Sources

1. CISA, NSA and NIST: Quantum-Readiness: Migration to Post-Quantum Cryptography (21 August 2023)
2. Signal: Quantum Resistance and the Signal Protocol (19 September 2023)
3. NIST IR 8105: Report on Post-Quantum Cryptography (April 2016)
4. Craig Gidney: How to factor 2048 bit RSA integers with less than a million noisy qubits (arXiv 2505.15917, 2025)
5. Michele Mosca: Cybersecurity in an era with quantum computers: will we be ready? (IACR ePrint 2015/1075)
6. Google: Meet Willow, our state-of-the-art quantum chip (9 December 2024)
7. HHS: Health Information of Deceased Individuals (45 CFR 160.103)
8. Executive Order 13526: Classified National Security Information (2009), Sec. 3.3
9. Executive Order 14412, Federal Register (June 2026)
10. OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography
11. NSA: Announcing the Commercial National Security Algorithm Suite 2.0
12. NIST IR 8547 (initial public draft): Transition to Post-Quantum Cryptography Standards
13. UK NCSC: Timelines for migration to post-quantum cryptography
14. EU: Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography
15. Cloudflare: Post-quantum cryptography support (browsers and operating systems)
16. OpenSSH 10.0 release notes

Related Articles

• What Is Post-Quantum Cryptography?
• Harvest Now, Decrypt Later for Non-Technical Readers
• HNDL: An Enterprise Threat Model
• Why Backup Archives Are at Risk
• When Will Quantum Computers Break Encryption?
• Why Hybrid Encryption Matters