Harvest now, decrypt later (HNDL)
A threat model in which an adversary captures encrypted traffic or stored ciphertext today, planning to decrypt it once a cryptographically relevant quantum computer (CRQC) exists. The dominant practical motivator for the post-quantum cryptography migration.
The mechanism
An adversary capable of capturing encrypted data today — through network intercept, storage compromise, or insider access — can store that data indefinitely. When a CRQC arrives (most credible estimates put this between 2030 and 2040), the adversary can decrypt the captured ciphertext at leisure. The risk window starts now, not at CRQC arrival.
Which data is at risk
Data with multi-decade sensitivity: healthcare records, legal privilege, intellectual property, defence and intelligence, financial-market activity. For organisations holding such data, "we'll migrate to PQ when standards are stable" is no longer a defensible position post-August 2024 (when NIST finalised FIPS 203 and 204).
Why the timeline matters more than it sounds
The naive analysis ("CRQC in 2035, data sensitive until 2045, that's 10 years of risk") understates the problem. Once a CRQC exists, bulk decryption proceeds at the rate the adversary chooses to apply compute. The first to be decrypted are the highest-priority targets — meaning the most sensitive data is decrypted first.
The hybrid construction
Pure post-quantum encryption depends entirely on lattice problems (or hash-based, code-based, etc.) being hard. A new attack on lattices could emerge. Hybrid construction — composing a PQ algorithm with a classical one such that both must fall — provides defence in depth. AES Key Wrap + ML-KEM-1024 is SkyeConnex's hybrid: a quantum break against ML-KEM still leaves AES standing.
What CCCS and CNSA 2.0 require
Canada's Cyber Centre PQC migration guidance (2025 update) and the NSA's CNSA 2.0 profile both reference the finalised FIPS standards. Procurement teams responsible for sensitive data should now ask vendors not "will you support PQ?" but "are you shipping FIPS 203 and FIPS 204 in production today, on customer data?"
SkyeConnex's posture
On the Sovereign tier, every Data Encryption Key is wrapped with AES Key Wrap composed with ML-KEM-1024 (FIPS 203). Every signed report and integrity certificate is co-signed with ML-DSA-87 (FIPS 204). Both halves of the PQ migration in production today. Read the full analysis →
Related terms
See also
Posts that mention Harvest now, decrypt later (HNDL)
FIPS 203 and FIPS 204 explained: what NIST's PQ standards mean for procurement
NIST finalised both post-quantum standards in August 2024. ML-KEM-1024 (FIPS 203) and ML-DSA-87 (FIPS 204). Here's what procurement teams sh…
Read → Cryptography · 6 min readPost-quantum cryptography: SkyeConnex already ships both halves
ML-KEM-1024 (FIPS 203) addresses the key-encapsulation half of post-quantum migration. ML-DSA-87 (FIPS 204) addresses the signature half. Sk…
Read → Cryptography · 7 min readQuantum 'harvest now, decrypt later': the timeline that actually matters
'We'll worry about quantum when it happens' is the wrong frame. Adversaries are harvesting encrypted traffic today, betting on decryption to…
Read →