Harvest now, decrypt later: why post-quantum migration starts now

Nearly all secure communication on the internet - TLS, VPNs, secure email, software updates, digital signatures - depends on RSA and elliptic-curve cryptography. Their security rests on mathematical problems that classical computers cannot solve in any practical time. A sufficiently large, error-corrected quantum computer running Shor's algorithm solves them efficiently. When that machine exists, every key exchanged with those algorithms can be recovered - including the ones exchanged today.

The threat model

"Harvest now, decrypt later" is the practice of recording encrypted traffic today and storing it until a quantum computer can decrypt it. For most web traffic this does not matter; the data is stale within hours. For anything with a long confidentiality life - medical records, intellectual property, government communications, financial data, personal information subject to regulation - it means that data encrypted now with quantum-vulnerable algorithms should be considered exposed on the day a capable machine exists. The relevant question is not "when will quantum computers arrive" but "how long must this data stay secret, plus how long will migration take" - and for many organizations the sum already exceeds any credible estimate.

The standards are ready

In 2024, NIST published the first finalized post-quantum cryptography standards after an eight-year public competition:

Major browsers, operating systems, and cloud providers have begun deploying hybrid key exchange - classical and post-quantum combined - so that a connection is secure as long as either algorithm holds. Government deadlines for migration of national-security and federal systems are set, and regulated industries are following.

Quantum key distribution

Quantum key distribution (QKD) uses the physics of photons to exchange keys such that eavesdropping is detectable. It provides strong guarantees over dedicated fiber or free-space links and is used for specific high-value point-to-point connections. It does not replace post-quantum algorithms for general networks, authentication, or software signatures. We advise clients to treat QKD as a specialized tool for particular links and PQC as the broad solution.

A phased migration plan

1. Inventory. Discover where public-key cryptography is used: TLS endpoints, VPNs, PKI and certificates, code and firmware signing, SSH, hardware security modules, IoT devices, and third-party SaaS. Most organizations find far more than they expected, and most of it undocumented.
2. Prioritize. Rank by data lifetime, exposure, and difficulty to change. Long-lived confidential data over public networks goes first; devices that cannot be updated in the field need a plan before they are deployed.
3. Deploy hybrid. Roll out hybrid ML-KEM key exchange at the network edge and in VPNs - it is supported in current TLS stacks and adds negligible latency - then move to PKI and signatures, which take longer because certificates, HSMs, and partners are involved.
4. Build crypto-agility. Put algorithms behind configuration and well-defined interfaces so the next transition does not require touching every application. The lesson of the SHA-1 and TLS 1.0 retirements is that the hard part was never the new algorithm; it was finding and changing every place the old one was hard-coded.
5. Test and govern. Verify performance, interoperability with partners, and compliance; monitor for new guidance; keep the inventory current.

What SubNeta delivers

We run the cryptographic inventory with automated discovery and manual validation, produce a ranked migration roadmap tied to your data classifications and regulatory deadlines, and implement the hybrid rollout - edge, VPN, PKI, signing - with zero-downtime cutovers. The result is a security posture that survives the arrival of a quantum computer, whenever it comes, and an architecture that can change algorithms again without another multi-year program.