The attack doesn't need quantum hardware yet
"Harvest now, decrypt later" describes a passive attack that's already executable with today's technology: an adversary records encrypted traffic now — TLS sessions, VPN traffic, stored backups — and simply holds onto the ciphertext, waiting until a cryptographically relevant quantum computer exists to decrypt the RSA or ECDH key exchange that protected it. The recording requires no quantum computer at all; only the eventual decryption does.
The harvest-now-decrypt-later timeline
- 1
Today: record
An adversary passively captures and stores RSA/ECDH-protected ciphertext — no quantum computer needed for this step.
- 2
Years pass
The ciphertext sits in storage. Classically, it remains unbreakable the entire time.
- 3
Eventually: a capable quantum computer exists
Once a sufficiently large, low-error quantum computer runs Shor's algorithm, the key exchange that protected the recording is broken.
- 4
Retroactive decryption
Everything harvested years earlier is decrypted at once — the delay never protected it.
Who this actually threatens
This risk is proportional to how long data needs to stay confidential. State secrets, medical records, trade secrets, and long-term personal data are exposed today if intercepted today, because they still need protection years or decades from now. A single ephemeral session that's operationally irrelevant a week later carries far less exposure — though it's worth noting exactly which key exchange protected it, since forward-secret ECDHE sessions are still individually vulnerable to this specific harvesting risk even though each session used a fresh key.
Why this drives migration timing, not just eventual planning
This is the practical argument organizations use for starting PQC migration — specifically hybrid key exchange, combining a classical algorithm like ECDH with a post-quantum algorithm like ML-KEM in the same handshake — well before a quantum computer capable of Shor's algorithm exists, rather than waiting for one to appear. Data harvested today under purely classical protection is already, in effect, on a countdown.
Mosca's theorem: turning urgency into a number
Cybersecurity researcher Michele Mosca gave this urgency a simple inequality. Call X the number of years your data must stay confidential, Y the number of years your migration to PQC will take, and Z the number of years until a cryptographically relevant quantum computer exists. If X + Y > Z, you're already too late — the migration won't finish before the data's required confidentiality window collides with a capable quantum computer, even though that computer doesn't exist yet today.
Worked example: data that must stay secret for 10 more years (X = 10), a migration estimated to take 5 years (Y = 5), and a quantum computer not expected for 20 years (Z = 20). X + Y = 15, which is less than Z = 20 — this organization has 5 years of margin before it needs to have finished migrating.
Practice
An organization's data must stay confidential for 15 more years (X), its PQC migration is estimated to take 8 years (Y), and a cryptographically relevant quantum computer is projected in 20 years (Z). By how many years does X + Y exceed Z?