Harvest now, decrypt later

An attacker can save encrypted traffic and wait for a quantum computer able to break the key exchange. Here is who should worry and what is changing.

Encrypted data can be copied even when it cannot be read. An attacker who taps network traffic or steals a database can keep the scrambled files for years. If the math protecting them later falls, the old files open. Security people call this harvest now, decrypt later, and it is why governments began moving to new encryption before any quantum computer could break the old kind.

The part a quantum computer would break

Internet connections usually use two kinds of cryptography together. Public-key cryptography lets two devices agree on a shared key across an open network. Symmetric encryption such as AES then scrambles the data with that key.

The NCSC, the UK’s cyber security agency, explains that current public-key systems rely on math problems such as factoring large numbers. A large, general-purpose quantum computer would make those problems easy to solve. Experts call this hypothetical machine a cryptographically relevant quantum computer.

So the attack runs like this:

1. Someone records the encrypted conversation, including the key agreement.
2. Years later, they run the key agreement through a quantum computer and recover the shared key.
3. They use that key to decrypt the recording.

Current state of quantum computers

The NCSC says that quantum computers that exist now are not a threat to public-key cryptography, and that many engineering, physical and mathematical challenges remain. NIST says that advanced quantum computers remain a strong possibility, and that some experts predict a capable device within a decade. Both statements can be true. Nobody can give you a date.

People with the most at stake

The NCSC notes that storing old data costs money, so the attack is likely worthwhile only for very high-value information. The relevant test is how long your secret needs to stay secret. State secrets and long-term medical or financial records may need protection for decades. A restaurant receipt does not.

Few ordinary people are targets for this kind of collection. If you are a journalist, an activist, or someone with a powerful adversary, you already have more immediate threats, and you may benefit from specialist advice.

New standards and products

NIST released its first three finalized post-quantum standards in 2024. FIPS 203 covers general encryption, and FIPS 204 and FIPS 205 cover digital signatures. NIST encouraged administrators to begin moving to them as soon as possible.

Apple added PQ3 to iMessage in 2024 and cited this attack as a reason. Apple’s design pairs elliptic curve cryptography with post-quantum encryption, so an attacker would have to defeat both. It also changes keys on an ongoing basis.

Digital signatures face a different problem. A forged signature requires a quantum computer at the time of the attack, so it cannot be done retroactively against a recorded conversation. Apple makes this point when it explains why PQ3 protects the key setup first.

Your photos

Photos at rest are a separate case. As the iPhone encryption guide explains, the NCSC says symmetric algorithms like AES can continue to be used with suitable key sizes. The exposed part is data sent or synced with keys that were agreed using older public-key methods.

For a practical improvement, focus on what is likely this year. A strong passcode, two-factor authentication and Advanced Data Protection all help against attackers who exist now.