Harvest-now, decrypt-later: why you cannot wait to migrate

Harvest-now, decrypt-later (HNDL) is the post-quantum threat most firms still underestimate. The attack is simple, and it is already happening: an adversary records encrypted traffic and stored ciphertext today, then waits. When a cryptographically relevant quantum computer arrives, that harvested data is decrypted — even though it was "secure" at the time it was sent.

What is at risk

Anything protected by RSA, ECDSA or Diffie-Hellman. That is not a niche list — it is the default for TLS, VPNs, SSH, email, code signing, databases and disk encryption across essentially every enterprise. The data at greatest risk is the data with the longest shelf life: financial records, personal data, source code, intellectual property, and anything subject to a seven-year retention rule.

The timeline is fixed

NIST has set the dates. Today's public-key algorithms are deprecated by 2030 and disallowed after 2035. The replacements — ML-KEM (FIPS 203) for encryption, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures — are standardised and available now. The constraint is not the algorithms; it is the time it takes to find and replace every vulnerable asset.

Why you cannot wait

Because the harvest has no migration window. If a quantum computer arrives in 2030, the data you encrypted in 2026 is already lost — the migration you run in 2029 protects only the data you encrypt after that point. Every year of delay is a year of ciphertext sitting in an adversary's storage, waiting.

What to do first

The first step is not migration — it is inventory. You cannot replace what you cannot find. A deterministic cryptographic inventory locates every RSA, ECDSA and Diffie-Hellman instance across your estate, flags the long-lived data, and maps each asset to its quantum-safe replacement. That inventory is exactly what the HKMA calls the longest-lead-time item in its PACT framework — and it is the foundation everything else depends on.