Harvest Now, Decrypt Later: Why Quantum Security Planning Starts Today

The quantum threat to encryption is often framed as a future event. The operational risk is present. An adversary can collect encrypted traffic or stolen archives today and defer decryption until the capability matures. For information that must remain confidential for many years, such as personnel, health, legal, intellectual property or defense related records, the exposure begins at collection, not at decryption.

The standards now exist

In August 2024 the U.S. National Institute of Standards and Technology published its first post quantum cryptography standards: FIPS 203 (Module Lattice Based Key Encapsulation Mechanism Standard), FIPS 204 (Module Lattice Based Digital Signature Standard) and FIPS 205 (Stateless Hash Based Digital Signature Standard). Standards availability converts the question from whether to migrate into how and in what order.

A practical first phase

• Inventory cryptography: identify where public key algorithms protect data, identities and connections, including in vendor products and embedded systems.

• Classify by confidentiality lifetime: rank data by how long it must remain secret, and by how long migration will take.

• Prioritize: begin with long lived sensitive data and with systems that are slow to change.

• Require crypto agility: write algorithm replacement capability into architecture standards and procurement requirements.

• Engage suppliers: ask vendors for their post quantum roadmaps and record the answers.

Candid risks and constraints

• Timing of capable quantum computers is uncertain; planning should not depend on a forecast date.

• Larger keys and signatures can affect performance and bandwidth; test before wide deployment.

• Hybrid approaches that combine classical and post quantum algorithms may be appropriate during transition; the choice depends on regulatory and mission context.

• Federal and defense clients should confirm current agency guidance and deadlines directly with the issuing authorities.

What to do next

Commission a cryptographic inventory for one high value system. The result gives leadership a factual basis for sequencing and budget. To discuss scope, submit a consultation request on the Get Started page.