Short answer: "Harvest now, decrypt later" is an attack where someone copies encrypted data today and stores it until a future quantum computer can break the encryption. It matters now because data that must stay secret for 10 to 20 years can be recorded today. NIST's post-quantum standards (FIPS 203, 204 and 205, published August 2024) are the recommended defence.
A large, error-corrected quantum computer does not exist yet. The risk to your encrypted data still does, and the reason is timing.
How the attack works
The attack is simple. Someone copies encrypted traffic or files today. They cannot read them, so they store them. Years later, if a quantum computer can break the public-key cryptography that protected the exchange, the stored data opens up. The copying is cheap and quiet. Nothing on your side looks different while it happens.
This changes how you should think about the deadline. The question is not "when will a quantum computer arrive?" The question is "how long does this data need to stay secret, and how long would a migration take?" If the first number is larger than the second plus the time until such a machine exists, you already have a problem.
What a quantum computer would break, and what it would not
Public-key systems such as RSA and elliptic curve cryptography protect key exchange and digital signatures. Shor's algorithm, published in 1994, shows that a sufficiently large quantum computer could factor large numbers and solve the discrete logarithm problem efficiently. That is the maths behind RSA and elliptic curve schemes.
Symmetric encryption such as AES is affected much less. Grover's algorithm gives a quadratic speedup for searching, which in practice means key lengths should be long enough to leave a margin. The main exposure is in how keys get agreed and how identities get proven, not in the bulk encryption itself.
Who has long-lived data
Some data loses its value fast. A session token from last Tuesday is not worth stealing for a decade. Other data stays sensitive for decades:
- Medical records and genetic data.
- Legal files, contracts and settlement terms.
- Financial history and customer identity records.
- Business secrets, designs and source code.
- Personal data that GDPR requires you to protect for as long as you hold it.
If you hold any of these, the harvest-now risk applies to you.
The fix now exists
In August 2024 NIST approved its first three post-quantum standards. FIPS 203 defines ML-KEM, a key-encapsulation mechanism for establishing shared keys. FIPS 204 defines ML-DSA, a module-lattice-based signature scheme. FIPS 205 defines SLH-DSA, a stateless hash-based signature scheme. NIST's process to select these algorithms ran for years and drew on public scrutiny from cryptographers worldwide. The standards give vendors something concrete to build to, which is what makes migration practical rather than theoretical.
What to do this year
- List where public-key cryptography is used. TLS, VPNs, SSH, code signing, backups, certificates and identity systems.
- Rank data by how long it must stay confidential. Start with the longest-lived data that crosses networks you do not control.
- Ask suppliers for their post-quantum roadmap. Ask specifically about hybrid modes that combine a classical method with a post-quantum one. Hybrid keeps today's protection while adding the new layer.
- Design for crypto-agility. Systems should let you swap algorithms without a rebuild. This is the cheapest insurance you can buy.
- Do not wait for a perfect answer. Inventory and planning cost little and need no quantum hardware.
Why this matters for Ireland
Irish banks, hospitals, data centres, law firms and public bodies all hold data with long lives. Ireland also hosts a large share of Europe's cloud and data infrastructure, so the choices made here affect many organisations elsewhere. Preparing now is cheaper than a rushed migration later.
At Quantum Ireland we are developing ideas around quantum computing and quantum security for Ireland. These are our own views, written from Clonmel, Tipperary, and they are not a government position. If you are planning a migration in an Irish business, start with the inventory. It is the step every later decision depends on.
FAQ
What does "harvest now, decrypt later" mean?
An attacker records encrypted traffic or files today, even though they cannot read them. They keep them until a quantum computer powerful enough to break the public-key cryptography exists, then decrypt them.
Does a quantum computer that can do this exist today?
No. A large, error-corrected quantum computer capable of breaking RSA or elliptic curve cryptography does not exist yet. The risk is that data recorded now may still be sensitive when one does.
Is AES encryption affected?
Much less than public-key systems. Grover's algorithm gives a quadratic speedup against symmetric keys, so longer keys give a safety margin. The main exposure is in key exchange and digital signatures.
What are the NIST post-quantum standards?
FIPS 203 (ML-KEM, key establishment), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, hash-based signatures), approved by the US Secretary of Commerce in August 2024.
What should an organisation do first?
Build an inventory of where public-key cryptography is used, rank data by how long it must stay confidential, and ask suppliers for their post-quantum roadmap.
All field notes