Harvest Now, Decrypt Later

• Harvest Now, Decrypt Later is a threat model describing how adversaries store encrypted data now to decrypt later using quantum algorithms like Shor’s and Grover’s.
• Risk quantification in HNDL integrates cryptographic vulnerabilities, operational exposure, and temporal hazards to estimate future decryption likelihood.
• Defensive strategies include adopting post-quantum cryptography, hybrid handshakes, and dynamic rekeying to mitigate retrospective quantum attacks.

Harvest Now, Decrypt Later (HNDL) refers to an adversarial threat model in which encrypted data is intercepted and archived today, with the intention of being decrypted in the future when advanced quantum computing capabilities become available. This scenario fundamentally challenges the long-term confidentiality of currently encrypted communications, especially those secured by public-key algorithms (e.g., RSA, Diffie-Hellman, ECC) vulnerable to quantum algorithms such as Shor’s. The increasing standardization and partial adoption of post-quantum cryptographic (PQC) schemes highlights the urgency of developing system-level strategies, risk metrics, and architectures to contain and ultimately deny HNDL attacks.

1. Formal Threat Definition and Quantum Adversary Model

The HNDL adversary is characterized by a two-phase attack. In the Collection Phase ($t=0$), the adversary archives encrypted traffic, storing ciphertexts generated under classical or hybrid schemes. In the Decryption Phase ($t=T$)—when a cryptanalytically relevant quantum computer (CRQC) becomes operational—they apply quantum algorithms (notably Shor’s for factoring/discrete log, Grover’s for exhaustive search) to recover long-term or session keys from archived material, enabling retrospective plaintext recovery. Formally, an HNDL-resistant encryption scheme $\Pi$ must satisfy:

$$\text{Adv}_{\mathrm{HNDL},\Pi}(\lambda) = \Pr[\mathcal{A}_{\mathrm{HNDL}}(C) = m] - 1/|M| \;\; \text{is negligible in }\lambda,$$

for all polynomial-time adversaries $\mathcal{A}$ with access to stored ciphertexts, even when granted quantum resources at decryption time (Bertino et al., 5 May 2026).

Two key quantum advantages arise:

• Shor’s Algorithm: breaks RSA/ECC/DH in polynomial time (e.g., breaking RSA-2048 in $O(n^3 \log n \log\log n)$ steps, where $n$ is modulus size) (Le et al., 1 Sep 2025).
• Grover’s Algorithm: reduces brute-force search of $k$-bit symmetric keys to $O(2^{k/2})$ quantum operations, halving effective key strength (Le et al., 1 Sep 2025).

The practical upshot is that any data encrypted using classical PKC is at risk of future decryption, with symmetric-key data (notably AES-128) downgraded in quantifiable bit strength.

2. Quantifying HNDL Exposure: Risk Metrics and Probability

A rigorous operational foundation for quantifying HNDL exposure integrates cryptographic vulnerability, operational exposure, and temporal hazard. The compromise probability $P_{\mathrm{HNDL}}$ for a given asset or organization is factorized as follows (Rufino et al., 21 May 2026):

$t=T$0

where:

• $t=T$1: probability a quantum computer arrives before the data loses value (logistic CDF in practice)
• $t=T$2: fraction of asset surface quantum-vulnerable (e.g., % of servers using RSA/ECC)
• $t=T$3: operational exposure (fraction externally accessible)
• $t=T$4, $t=T$5: structural exponents for asset concentration and attack-surface saturation
• $t=T$6: defense–attack intensity ratio (remediation rate over attack effort)

This structure is justified by modeling attack and defense as competing exponential processes, ensuring that the marginal sensitivity to vulnerability and exposure is endogenous and non-additive. Scoring frameworks that sum V and E cannot reproduce this interaction, as their cross-partial is always zero, whereas for $t=T$7 it is strictly negative up to saturation.

Time-based exposure in enterprise governance is often computed as:

$t=T$8

Meaning confidentiality duration plus migration time must not exceed anticipated quantum adversary arrival (Zelenovic et al., 15 May 2026).

3. Systemic and Protocol Defenses Against HNDL

Multiple architectures and protocol strategies have been developed to defend against HNDL, mapped roughly into the following categories:

a) Cryptographic Primitive Choices

• PQC (Post-Quantum Cryptography): Lattice-based KEMs (e.g., ML-KEM, CRYSTALS-Kyber) and signatures (ML-DSA/Dilithium, SLH-DSA/SPHINCS+), securing key establishment and authentication even if all classical PKC is later broken (Rathi et al., 22 Oct 2025).
• Hybrid Handshakes: Derive session keys from both classical (e.g., X25519) and PQC secrets so that security persists as long as one remains secure (Zuane et al., 27 May 2026, Rathi et al., 22 Oct 2025).
• Symmetric-only with Increased Key Size: Doubling symmetric key lengths or using AES-256+ to mitigate Grover’s quadratic speedup (Bertino et al., 5 May 2026).

b) Information-Theoretic and Multi-Path Schemes

• Fragmentation Across Independent Channels: Key shares distributed over multiple disjoint Tor circuits (Mallick et al., 20 May 2026) or over physically diverse communication media (Mallick et al., 7 May 2026), so an adversary must simultaneously compromise all channels and defeat all relevant cryptography.
• Proof-of-Work Wrapping: Imposes per-decryption computational cost linear in number of files decrypted, making mass HNDL attacks economically prohibitive (e.g., ArchiveSafe’s DBKE) (Sabry et al., 2020).
• Shamir Secret Sharing / Threshold Schemes: Purely information-theoretic resistance as long as not all shares are compromised (Bertino et al., 5 May 2026).

c) Protocol-Level and Key-Management Controls

• Frequent Rekeying: Divides payload into many short intervals, each protected by a fresh ephemeral key, multiplying the number of Shor instances needed for mass decryption (Blanco-Romero et al., 1 Mar 2026).
• Lifecycle Controls: Mandated cryptoperiods, proactive key rotation, and strict key separation in distributed KDSs to minimize the plaintext lifetime exposed to any future quantum attack (Bertino et al., 5 May 2026).

4. Empirical Internet and Sectoral Readiness

A comprehensive measurement of real-world TLS deployments (32,011 domains) reveals significant gaps (Dubey et al., 15 Jun 2026):

• Only 49.3% of domains deploy hybrid key exchange (X25519+ML-KEM-768), with the remainder still using vulnerable classical groups (X25519, P-256, RSA).
• 0% adoption of hybrid or post-quantum certificate signatures; all authentication remains vulnerable to Shor’s algorithm.
• Critical sectors (banking, government, defense, telecom, energy) show negligible PQC adoption and persist in supporting legacy TLS 1.2.

Sectoral “quantum risk heatmaps” systematically identify high HNDL exposure for essential infrastructure. The absence of coordinated certificate migration leaves authentication as the single point of quantum failure, invalidating even well-deployed PQ key exchange.

5. Economic Feasibility and Attack Cost Structure

Long-term archiving of large volumes of encrypted traffic is economically trivial for nation-state adversaries ($t=T$9$\Pi$010¹¹ over a decade for 1–10% global traffic harvest at current storage costs) (Blanco-Romero et al., 1 Mar 2026). The true defensive leverage lies in inflating the quantum computation required for decryption ($\Pi$1 key-recoveries per session) by:

• Minimizing session length or increasing rekeying frequency (e.g., SSH’s in-band rekeying at kilobyte granularity)
• Using larger key parameters, which scale quantum run time super-linearly

Storage-side countermeasures (padding, ECH, bulk collection) penalize both defenders and attackers, whereas raising the quantum workload per recovered session uniquely targets HNDL adversaries.

6. Migration Governance, Prioritization, and Operationalization

Effective HNDL countermeasures at the organizational scale require structured governance strategies:

• Discovery-First Inventory: Evidence-based cryptographic inventorying through static/dynamic analysis and dependency mapping to determine the full surface of quantum-vulnerable assets (Zelenovic et al., 15 May 2026).
• Time-Based Exposure Registers: Dynamically prioritize assets using confidential shelf-life, migration feasibility, and quantum threat horizon to sequence PQ/hybrid migrations (e.g., Quantum Exposure Register) (Zelenovic et al., 15 May 2026).
• Crypto-Agile Architecture: Abstract cryptographic modules to support pluggable algorithm swaps, hybrid handshakes, and rapid key/certificate rotations (Zelenovic et al., 15 May 2026, Le et al., 1 Sep 2025).
• Vendor and Supply-Chain Coordination: Mandate cryptographic transparency (SBOMs), PQ roadmaps, and attestation check-points in procurement.

Critical guidance includes prioritizing migration for highest-sensitivity and longest-shelf-life data, establishing proactive crypto-agility, and aligning rekey intervals and asset management lifecycles with the evolving quantum threat (Le et al., 1 Sep 2025).

7. Limitations, Open Challenges, and Future Directions

Several technical and operational challenges remain:

• Parameter Selection: Sizing lattice-based cryptographic parameters and session key intervals for 30+ year confidentiality windows under conservative quantum scaling forecasts (Joseph et al., 2020).
• Authentication Migration Lag: Real-world infrastructure lags in PQ certificate adoption, leaving authentication and trust roots vulnerable even when hybrid session keying is deployed (Dubey et al., 15 Jun 2026).
• Physical, Network, and Governance Diversity: Effective deployment of multi-path and threshold schemes hinges on empirical path independence, supply-chain diversity, and overall governance robustness (Mallick et al., 7 May 2026, Mallick et al., 20 May 2026).
• Side-Channel and Implementation Security: PQC primitives must be hardened against side-channel/fault injection; certified TVLA and DRBG hardening are necessities for SL-4/high assurance contexts (Baseri et al., 25 Feb 2026, Rathi et al., 22 Oct 2025).
• Post-Quantum Forward Secrecy: Ensuring that ephemeral key establishment and rapid key rotation become standard protocol behaviors across all critical infrastructure (Bertino et al., 5 May 2026).

A comprehensive, system-level transition—encompassing cryptographic, architectural, operational, and governance facets—is essential to close the Harvest Now, Decrypt Later vector. Until such migration is universal, retrospective quantum decryption will remain a present and material risk to the confidentiality and integrity of the world’s digital assets.