Harvest now, decrypt later means an attacker records encrypted traffic today and waits for a quantum computer that can break the key exchange. It matters for data that must stay secret for many years. For data that is worthless in a month, it is a low priority.
The attack in one paragraph
An attacker with network access copies encrypted sessions or stolen ciphertext. Today that copy is unreadable. If a large quantum computer ever exists, public-key schemes such as RSA and elliptic curve key exchange could be broken, and the recorded sessions could then be decrypted. CISA says such a machine does not yet exist, and also says organizations "must begin preparing now."
The risk is a bet on timing. You do not need to believe it will happen soon. You only need to ask whether your data will still matter when it might.
Sort data by shelf life
The useful question is not "are we exposed?" but "how long must this stay secret?" A rough sort:
- Days to months: session cookies, one-time codes, short-lived tokens, most telemetry. Low concern.
- A few years: contracts under negotiation, pricing, non-public product plans. Medium concern.
- Ten years or more: health records, source code and trade secrets, government and defense material, identity records, long-term financial records. High concern.
Add one more input: how long a migration will take you. If moving a system to new algorithms takes four years and the data must stay secret for ten, the clock starts well before any quantum machine appears.
Where the exposure sits
HNDL targets key exchange and public-key encryption, because that is what protects the session key. Look at:
- TLS between your users and your services, and between internal services.
- VPNs and site-to-site tunnels.
- SSH to production.
- Encrypted backups and archives that wrap keys with RSA or elliptic curves.
- Messaging and email encryption that uses public-key wrapping.
NIST's IR 8547 draft says that to reduce the harvest now, decrypt later risk on network communications, application-specific guidance may require or recommend moving to quantum-resistant key establishment before classical schemes are generally disallowed.
What does not need urgent action
Digital signatures cannot be harvested in the same way. A signature checked today is not retroactively forged by a future machine, though long-lived signatures and trust anchors have their own timeline. Symmetric encryption such as AES is far less affected, which is covered in a separate post.
What to do first
- List the data stores and channels that carry long-lived secrets.
- Mark which use public-key key exchange or key wrapping.
- Start with those. Prefer protocols where a post-quantum key exchange is already available as a software update.
- Record the rest in an inventory with an owner and a target date.
Safeguard's SBOM and dependency scanning can show which cryptographic libraries your software ships, which is a good first input to that inventory. There is also a free scan at gold.safeguard.sh/scan.
Quick check
Do short-lived session tokens need post-quantum protection because of harvest now, decrypt later?
Usually not as a priority. If the token is useless by the time a quantum computer exists, recording it gains an attacker nothing. The data behind the session may still matter, so judge the data, not the token.
Has anyone confirmed that a quantum computer can break RSA today?
No. CISA states that quantum decryption capable of breaking modern public-key encryption does not yet exist.
Sources
Last reviewed: 19 October 2026.
