On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks

Abstract: Harvest-now, decrypt-later (HN-DL) attacks threaten today's encrypted communications by archiving ciphertext until a quantum computer can break the underlying key exchange. This paper reframes HN-DL as an economic problem, quantifying adversary costs across Transport Layer Security (TLS) 1.2, TLS 1.3, QUIC, and Secure Shell (SSH) with an open-source testbed that reproduces the full attack sequence. Our model shows that retaining intercepted traffic is economically trivial, shifting the defensive question from whether an adversary can archive to how much decryption will cost. We evaluate protocol configuration strategies that act along two independent cost axes: storage overhead and quantum workload. Beyond the ongoing migration to post-quantum cryptography, these strategies provide defense in depth with current infrastructure. Encrypted Client Hello forces indiscriminate bulk collection, inflating the archive the adversary must retain, while aggressive rekeying and larger key exchange parameters multiply the quantum computations required to recover plaintext. Because storage inflation penalizes both sides while quantum cost inflation targets the adversary alone, rekeying and key size selection offer the strongest defensive levers.

• The paper demonstrates deterministic retrospective decryption across TLS 1.2, TLS 1.3, QUIC, and SSH, including KeyUpdate and PSK resumption cascades, using an open-source end-to-end testbed.
• The paper finds that storing intercepted traffic is economically feasible, with a 1% global harvest costing about $1.1 billion annually under cloud pricing and far less with state-operated tape storage.
• The paper shows that frequent ephemeral rekeying is the most effective defense because it multiplies adversarial quantum work with minimal storage overhead, while padding increases costs for defenders too.

Overview and contributions

This paper reframes harvest-now, decrypt-later (HN-DL) attacks as an economic problem rather than a binary cryptographic event, quantifying adversary costs across TLS 1.2, TLS 1.3, QUIC, and SSH. The authors from Universidad Carlos III de Madrid make three principal contributions: an open-source testbed that reproduces the full HN-DL attack sequence end-to-end against all four protocols; a per-protocol storage overhead model that maps retention requirements to state intelligence budgets; and a quantitative evaluation of defense-in-depth strategies that inflate adversary costs along two independent axes — storage overhead ($\alpha$) and quantum workload ($E \times T_q$). The central claim is stark: once interception capability exists, retaining intercepted traffic is economically trivial, so the defensive question shifts from whether an adversary can archive to how much decryption will cost.

Threat model and protocol analysis

The threat model assumes a state-level actor performing passive bulk interception, multi-decade tiered storage, and deferred cryptanalysis on a cryptographically relevant quantum computer (CRQC). The paper anchors urgency in Mosca's inequality $x + y > z$, noting expert surveys place Q-Day in 2030–2040 with roughly 50% probability of breaking RSA-2048 within 15 years.

The testbed chains patched OpenSSL 3.6.0 and OpenSSH 9.9p2 traffic generation, tshark capture, and Python key derivation over loopback, meaning every measured byte count is a strict lower bound on real-world storage burden. Simulated quantum recovery is implemented by logging ephemeral private keys at the source level; derivation modules must reconstruct all session secrets from the PCAP plus this simulated quantum output, verified byte-for-byte against ground-truth keylogs and by tshark decryption.

The empirical results confirm deterministic retrospective decryption across all attack paths:

Protocol / Mode	Forward secrecy	Quantum HN-DL	Recovery scope
TLS 1.2 (RSA)	No	Vulnerable	All sessions per key
TLS 1.2 (DHE/ECDHE)	Yes	Vulnerable	Per session
TLS 1.3 (1-RTT)	Yes	Vulnerable	Per session
TLS 1.3 (KeyUpdate)	Yes	Vulnerable	Per session (deterministic chain)
TLS 1.3 (0-RTT)	No	Vulnerable	Per PSK chain
QUIC (ECDHE)	Yes	Vulnerable	Per session
SSH (ECDH)	Yes	Vulnerable	Per exchange

Two findings deserve emphasis. First, TLS 1.3's KeyUpdate derives each new traffic secret via a single HKDF expansion with no fresh randomness, so recovering the initial ephemeral secret exposes every subsequent epoch ($E = 1$ regardless of session length). Second, the paper empirically demonstrates that a single ECDHE compromise unravels the entire pure-PSK resumption cascade: breaking one handshake recovers the Resumption Master Secret and every derived ticket PSK, retroactively exposing all downstream 0-RTT and pure-PSK sessions. QUIC's transport-layer encryption of the handshake provides no supplementary protection. SSH alone supports true in-band ephemeral rekeying, confining exposure to a single epoch.

Storage economics

The per-session storage model decomposes captured bytes into a fixed handshake transcript $H$ (incompressible, since key schedules bind to a hash of the exact transcript), session setup $C$, payload $P$, per-record framing $\omega$ (22 B for TLS 1.3, ~28.5 B for SSH), and transport headers. The asymptotic overhead ratio is $\alpha_\infty = 1 + \omega/M < 1.003$ for TCP-based protocols under maximum packing, and ≈1.02 for QUIC due to its ~1,350 B datagram constraint. The model validates against 32 loopback captures with residuals $|\Delta\alpha| \leq 0.01$. Notably, an optimally efficient adversary stripping AEAD tags and constant headers gains at most $E \times T_q$0 in $E \times T_q$1 — no strategically meaningful advantage. Conversely, small payloads ($E \times T_q$2 KB) push $E \times T_q$3 from 3.5× (TLS 1.2 RSA) to 8.5× (SSH), penalizing precisely the sessions most likely to carry credentials and tokens.

Scaling to ITU's estimated 8.8 ZB/year global traffic, the cost table is unambiguous:

Harvest fraction	Annual volume	Annual cost (cloud upper bound)
1%	88 EB	$1.1B
10%	880 EB	$11B
100%	8,800 EB	$107B

Even full global capture (~$E \times T_q$412.16/TB-year). Dedicated state actors using LTO-9 tape at $5.25/TB raw media CapEx, with >50-year BaFe media lifespan and near-zero energy draw, face substantially lower and more stable costs. Monte Carlo simulation (10,000 draws) with log-normal payloads, ±30% price uncertainty, 20–30% annual traffic growth, and storage price change spanning −10% to +20% annually confirms the scale: cumulative 10-year cost of a 1% harvest reaches O(10¹⁰–10¹¹) USD even under pessimistic draws. The authors are explicit that upstream interception infrastructure costs are excluded and remain operationally significant; the model isolates only the retention phase.

The implication is direct: forward secrecy does not reduce the storage burden at all — it converts a single-key compromise into per-session quantum work, which is exactly where the defensive leverage lies.

Defense-in-depth along two asymmetric cost axes

The paper's central analytical insight is the asymmetry between the two cost axes. Inflating $E \times T_q$5 requires every extra byte to traverse real network infrastructure, so the defender pays continuous bandwidth and egress costs while the adversary absorbs inflated volume passively at marginal cost. Inflating $E \times T_q$6 or $E \times T_q$7 forces fresh quantum work on the adversary with negligible wire overhead. Quantum-axis inflation is therefore the superior defensive lever.

ECH degrades triage. Encrypted Client Hello conceals the SNI and, when combined with CDN/Anycast coalescence, decouples the true destination from transport metadata. This prevents zero-cost deterministic triage, forcing adversaries into probabilistic encrypted-traffic-analysis classifiers with false positives inflating archives and false negatives missing targets. ECH cannot prevent archiving an entire CDN, but it protects small-volume cohorts from cheap algorithmic harvesting.

Legacy elimination. Disabling TLS 1.2 RSA key transport removes the unbounded "all sessions per key" surface at zero performance cost; disabling 0-RTT eliminates the resumption-cascade exposure at one round trip; short ticket lifetimes, mandatory psk_dhe_ke mode, and STEK rotation bound PSK cascades.

Rekeying multiplies quantum work. Each independent DH exchange forces a fresh Shor run at ~2–3 KB wire cost. For partial-decryption adversaries targeting $E \times T_q$8 bytes, the effective multiplier is $E \times T_q$9, collapsing to 1 whenever $x + y > z$0 — protecting credential-scale targets requires $x + y > z$1, where handshake overhead rivals the payload. Empirically, OpenSSH's RekeyLimit counts transport bytes including padding, so a nominal 64 KB limit yields an effective payload threshold of ~127 KB. At a 5 MB payload, the most aggressive limit achieves $x + y > z$2 with only a 2.1% storage penalty. Combined with larger group parameters (Shor gate complexity grows superlinearly with key size), even assuming an aggressive future $x + y > z$3 hour on P-256, a 64 KB rekey interval extends full transcript decryption from one hour to nearly two days. TLS 1.3 can approximate this scaling only via PSK-DHE resumption across new connections — validated experimentally at $x + y > z$4 exactly — but the per-interval TCP handshake makes rapid rotation prohibitive in practice.

Padding is self-harming. Maximum theoretical padding inflates $x + y > z$5 from 30× to 1,300× for 100-byte sessions, but because every padded byte traverses real infrastructure, the mechanism structurally favors the party with lower marginal cost per byte. The paper correctly demotes it to an academic upper bound.

Limitations and open questions

The paper concedes several boundaries plainly. The model excludes upstream interception costs entirely — gaining sustained access via backbone taps, ISP cooperation, or data-center presence is a substantial operational prerequisite left unquantified. The storage taxonomy assumes a passive network adversary with sustained access to full sessions; metadata-only retention, statistical sampling, and active endpoint compromise fall outside the model. The loopback testbed eliminates MTU fragmentation, so real-network validation remains open. The $x + y > z$6 multiplier collapses to 1 against prefix-targeting adversaries unless rekey intervals shrink to impractical levels. Most consequentially, TLS 1.3 and QUIC — carrying over 93% and ~45% of relevant traffic respectively — remain locked at $x + y > z$7 until the Extended Key Update drafts reach production, leaving the quantum cost axis unreachable for the majority of Internet traffic today. Finally, the paper identifies an unstudied economic effect of partial PQC deployment: since key exchange parameters are negotiated in cleartext, an adversary can discard quantum-resistant sessions and concentrate harvesting on the shrinking classical remainder.

Conclusion

This paper demonstrates empirically that retrospective decryption is deterministic once the relevant key collapses, and quantitatively that retention is economically trivial for a capable adversary — O(10⁹) USD annually for a 1% global harvest under conservative cloud pricing, less still with sunk tape CapEx. Its durable contribution is the two-axis cost decomposition: storage inflation penalizes both parties, while quantum-workload inflation via rekeying and parameter selection targets the adversary alone at negligible defender cost. The measures evaluated do not cure HN-DL; permanent defense requires completing ML-KEM migration, and the accumulated pre-quantum archive remains an unavoidable liability that grows daily. The most pressing open problem is operationalizing in-band ephemeral rekeying for TLS 1.3 and QUIC before the classical remainder of Internet traffic becomes the adversary's cheapest target.