Harvest now, decrypt later is an attack strategy in which an adversary collects encrypted data today and stores it until a future quantum computer can break the encryption that protects it. The attacker does not need a quantum computer now. It only needs access to the data now, and patience. That is why the quantum threat is already a present-day problem for any data that must stay confidential for years.
The term appears in federal guidance. A 2023 fact sheet from CISA, NSA, and NIST warned that threat actors could be targeting data that needs protection far into the future, using what it called a catch now, break later or harvest now, decrypt later operation. This article explains how the attack works, which data is exposed today, and how organizations should prioritize their response.
How Harvest Now, Decrypt Later Works
Most encrypted communication today relies on public-key algorithms such as RSA and elliptic curve cryptography to agree on the keys that protect data in transit. A sufficiently powerful quantum computer, which the federal guidance calls a cryptographically relevant quantum computer, could break those algorithms. Once the key exchange is broken, every session recorded under it can be decrypted.
The attack therefore has two stages separated by years. In the first, an adversary intercepts encrypted traffic or steals encrypted files, which is possible with today’s tools. In the second, years later, it uses a quantum computer to recover the keys and read the data. Nothing about the first stage looks different from ordinary data theft. The organization may never know that the data was taken, and if it does, it may assume encryption made the loss harmless.
Why Key Establishment Is the Weak Point
The exposure is concentrated in key establishment, the step where two systems agree on a shared secret. If that step uses a quantum-vulnerable algorithm, recorded traffic becomes readable once the algorithm falls. Digital signatures face a different quantum risk: forgery in the future rather than exposure of past data. This is why federal timelines put key establishment first. Executive Order 14412 requires federal high value assets and high impact systems to use post-quantum key establishment by December 31, 2030, a year before the deadline for digital signatures.
Which Data Is at Risk Today
Not all encrypted data is equally exposed. The question for each data set is how long it must stay confidential, compared with how long it will take to move its protection to quantum-resistant cryptography and how long until a capable quantum computer exists. A framework often credited to researcher Michele Mosca puts it simply: if the data’s required confidentiality period plus the time needed to migrate is longer than the time until a quantum computer can break current encryption, the data is already at risk.
Nobody knows exactly when that machine will exist. The useful part of the test is the first two terms, which an organization can estimate today. Data that must stay secret for a long time, protected by systems that will take years to migrate, is the exposure.
The Shelf-Life Test Applied
| Data type | How long it must stay confidential | Harvest now, decrypt later exposure |
|---|---|---|
| Health records | For the life of the patient and beyond | High |
| Identity and financial account data | As long as the person or account exists | High |
| Trade secrets, designs, and source code | As long as they confer advantage | High |
| Controlled unclassified and defense-related information | For the duration of the program or contract and often longer | High |
| Legal, merger, and negotiation records | Years, until the matter is closed or public | Medium to high |
| Long-lived keys and certificates | For their validity period, and anything they protected | Medium to high |
| Short-lived session data and one-time codes | Minutes to days | Low |
| Information that will soon be public | Until publication | Low |
The table shows that most regulated industries hold some high-exposure data. That is why the CISA, NSA, and NIST guidance tells organizations to prioritize high impact systems, industrial control systems, and systems with long-term confidentiality needs. For a hospital, a bank, a defense contractor, or a cloud provider serving federal agencies, the high-exposure categories are often the core of the business.
What Is Less Exposed
The risk centers on public-key cryptography. Symmetric encryption, such as AES protecting data at rest, is considered far less affected by known quantum attacks, and NIST has said it does not expect to transition away from its symmetric standards as part of the post-quantum migration. The practical caution is that symmetric keys are often exchanged or wrapped using public-key methods. If the key that protects stored data was ever transmitted under a quantum-vulnerable key exchange, the stored data inherits that exposure.
How to Reduce Harvest Now, Decrypt Later Exposure
The CISA, NSA, and NIST fact sheet recommends four starting actions: build a quantum-readiness roadmap, inventory cryptography, assess risk, and engage technology vendors. Applied to harvest now, decrypt later specifically, those actions translate into five steps.
Step 1: Inventory Where Public-Key Cryptography Protects Long-Lived Data
Start from the data, not the algorithms. Identify the systems that hold or transmit the high-exposure categories above, then record which protocols and algorithms protect them in transit and how their keys are exchanged. Elevate’s guide to building a cryptographic inventory [INTERNAL LINK: cryptographic inventory article, add URL after publication] covers the fields worth capturing and how to keep the inventory current.
Step 2: Prioritize Key Establishment for That Data
Once the inventory shows where long-lived data crosses quantum-vulnerable key exchanges, those paths go first. This matches the federal sequence, where key establishment has an earlier deadline than signatures. NIST’s FIPS 203 standard, ML-KEM, is the published post-quantum key establishment mechanism, and hybrid approaches that combine it with a classical algorithm let organizations add quantum resistance without dropping validated cryptography.
Step 3: Reduce What Can Be Harvested
Data that is not retained or transmitted cannot be harvested. Retention limits, data minimization, and removing unnecessary copies of sensitive data reduce exposure regardless of cryptography. They are also the cheapest controls available, and they support privacy obligations at the same time.
Step 4: Ask Vendors for Their Roadmaps
Much of an organization’s encryption in transit is provided by vendors: cloud platforms, network equipment, managed file transfer, and SaaS applications. Ask each for its post-quantum roadmap, including when it will support post-quantum or hybrid key establishment and whether those modules will be validated. The answers show which exposures the organization can fix itself and which depend on others.
Step 5: Tie It to Your Compliance Obligations
For federal cloud providers and defense contractors, post-quantum planning is becoming a compliance matter. Executive Order 14412 sets 2030 and 2031 deadlines for federal systems and directs a rule for covered contractors, and FedRAMP’s proposed RFC-0035 addresses how providers can add post-quantum cryptography at agency request. Elevate covers the FedRAMP side in its overview of the FedRAMP Consolidated Rules for 2026 and supports cloud providers through its FedRAMP services. To discuss where long-lived data sits in your environment, talk to an Elevate advisor.
Conclusion
Harvest now, decrypt later turns a future technology into a present risk. An adversary does not need a quantum computer to steal encrypted data today; it only needs to wait. Data whose confidentiality must outlast the arrival of a capable quantum computer is already exposed if it travels under quantum-vulnerable key exchange.
The response starts with knowing which data has a long shelf life and where public-key cryptography protects it, then moving those paths to post-quantum key establishment first, reducing what can be harvested, and pressing vendors for their roadmaps. To review where your long-lived data is exposed, book a call with an Elevate advisor.
Key Takeaways
Harvest now, decrypt later means encrypted data stolen today can be read once quantum computers can break current public-key cryptography.
- The attack needs no quantum computer today. Collection happens now with ordinary tools; decryption happens later.
- Federal agencies have warned about it. A 2023 CISA, NSA, and NIST fact sheet named the threat and urged early planning.
- Shelf life decides exposure. Data that must stay confidential longer than the time to migrate plus the time to a capable quantum computer is already at risk.
- Key establishment is the weak point. That is why federal deadlines move key establishment to post-quantum algorithms a year before signatures.
- Symmetric encryption is less affected. The caution is that symmetric keys exchanged under vulnerable public-key methods inherit the exposure.
- Start with an inventory and data minimization. Knowing where long-lived data travels, and keeping less of it, are the first and cheapest steps.
Frequently Asked Questions
What is harvest now, decrypt later?
Harvest now, decrypt later is an attack strategy in which an adversary collects encrypted data today and stores it until a future quantum computer can break the encryption that protects it. The attacker needs access to the data now but not a quantum computer. Federal guidance from CISA, NSA, and NIST also calls it catch now, break later. It makes the quantum threat a present-day risk for data that must stay confidential for years.
Is harvest now, decrypt later happening today?
The collection stage requires only ordinary interception or data theft, which is possible today. CISA, NSA, and NIST warned in 2023 that threat actors could be targeting data now for future decryption. Because stolen encrypted data looks like any other data loss, organizations usually cannot tell whether a given theft was intended for later decryption.
What data is most at risk from harvest now, decrypt later?
Data that must stay confidential for many years is most at risk. That includes health records, identity and financial data, trade secrets and source code, controlled and defense-related information, and long-lived keys. Short-lived data such as one-time codes or information that will soon be public carries little exposure.
Does harvest now, decrypt later affect symmetric encryption like AES?
Symmetric encryption is considered far less affected by known quantum attacks, and NIST does not expect to move away from its symmetric standards as part of the post-quantum transition. The exposure arises when symmetric keys are exchanged or wrapped with quantum-vulnerable public-key methods. In that case, stored data inherits the weakness of the key exchange.
How do organizations protect against harvest now, decrypt later?
Organizations should inventory where public-key cryptography protects long-lived data, move key establishment on those paths to post-quantum or hybrid mechanisms such as FIPS 203 ML-KEM, and reduce how much sensitive data they retain and transmit. They should also ask vendors for post-quantum roadmaps. Federal agencies face a December 31, 2030 deadline for post-quantum key establishment on their most sensitive systems.