PQC - Harvest Now, Decrypt Later (HNDL)

Last updated on 
Share

Also referred to as "Store Now, Decrypt Later" is a strategic threat model where adversaries intercept and archive encrypted data today with the intention of decrypting it once a Cryptographically Relevant Quantum Computer (CRQC) becomes available. While a powerful quantum computer capable of breaking modern encryption does not yet exist, HNDL creates a present-day risk for any data that must remain confidential for a long period.

The Two-Phase Attack Model

The HNDL strategy operates in two distinct temporal phases:

  • Phase 1: The Harvest (Present Day): Adversaries use their position in the network to intercept and capture encrypted traffic. This phase requires no cryptanalytic capability, only the ability to monitor network traffic and sufficient storage capacity. Strategic actors, such as nation-states, are believed to be already collecting vast amounts of data, including classified government communications, medical records, and corporate intellectual property.
  • Phase 2: The Decryption (Future): Once a CRQC is developed—estimated by some experts to be as early as 2029 to 2034—adversaries will use Shor’s Algorithm to factor the large integers or solve the discrete logarithms that protect today’s asymmetric encryption (like RSA and ECC). This allows for the bulk decryption of archived data, leading to a retroactive compromise of confidentiality.

The Vulnerability: Asymmetric Cryptography

The primary targets of HNDL are public-key (asymmetric) algorithms used for key exchange and digital signatures.

  • Total Break: Algorithms such as RSA, Diffie-Hellman, and Elliptic Curve Cryptography (ECC) are fundamentally vulnerable to Shor's algorithm, which reduces their security strength to zero once a CRQC is available.
  • Symmetric Resilience: Symmetric algorithms like AES-256 and hash functions like SHA-384 are considered "quantum-resistant". While Grover’s algorithm effectively halves the bit-strength of symmetric keys, a 256-bit key still provides 128 bits of security, which is sufficient to resist quantum attacks for the foreseeable future.

Calculating Urgency: Mosca’s Theorem

To determine if an organization is already at risk from HNDL, experts use Mosca’s Risk Equation (X+Y>Z):

  • X (Shelf-life): The number of years the data must remain confidential (e.g., 50 years for a medical record).
  • Y (Migration Time): The number of years it takes to transition the entire infrastructure to Post-Quantum Cryptography (PQC).
  • Z (Threat Timeline): The number of years until a CRQC is available.

If the time your data must stay secret (X) plus the time to migrate (Y) is greater than the time until a quantum computer arrives (Z), then confidentiality has already been lost to an adversary harvesting data today.

Feasibility of Large-Scale Harvesting

Documented incidents of BGP (Border Gateway Protocol) route manipulation illustrate how adversaries can reroute and capture massive amounts of global internet traffic.

  • In 2020, traffic for major tech companies like Google and Amazon was rerouted through Russian infrastructure for an hour.
  • In 2019, European mobile network traffic was redirected through China Telecom for over two hours. These incidents demonstrate that the technical prerequisites for HNDL—network position and capture capability—are already being exercised.

Permanent Exposure in Blockchains

Blockchain and Distributed Ledger Technologies (DLT) are particularly susceptible to HNDL. Because blockchains create permanent, public records of encrypted transactions, the data is not just transmitted but "put on a digital shelf" forever. This exposure is irreversible; even if the network migrates to post-quantum signatures later, the historical records remain available for future decryption.

Mitigation: Implementing PQC Today

The only defense against HNDL is to move to Post-Quantum Cryptography (PQC).

  • Hybrid Key Exchange: Current best practices involve using hybrid protocols (e.g., X25519MLKEM768) in TLS 1.3. This combines a classical key with a post-quantum key, ensuring that the data intercepted today cannot be decrypted by either a classical computer or a future quantum computer.
  • Priority for Long-Lived Assets: Organizations are urged to prioritize the migration of data with long confidentiality requirements (lifespans of 10+ years) to ensure they are protected before "Q-Day".