Harvest Now, Decrypt Later: Why Today's Encrypted Data Is Tomorrow's Breach

What Is "Harvest Now, Decrypt Later"?

Harvest now, decrypt later is a simple attack with a long fuse. An adversary captures your encrypted traffic today, stores it, and waits. They cannot read it yet. They are betting that a future quantum computer will break the encryption protecting it, at which point the stored data becomes readable in bulk.

That bet is the whole point of episode 96 of The Security Podcast of Silicon Valley, where host Jon McLachlan (co-founder of YSecurity and Cyberbase.ai) sat down with Kevin Kane, co-founder and CEO of American Binary, a network security company focused on post-quantum encryption. The episode's title says it plainly: they don't need to hack you now. They just need to wait.

The uncomfortable part is that the attack works against data you already sent. Encryption you trusted last year, last week, or this morning is only as durable as the math behind it. If that math falls, every copy an attacker quietly saved falls with it. The question is not whether your data is encrypted. It is how long that encryption has to hold.

Why Diffie-Hellman and RSA Are the Weak Point

Nearly all encrypted internet traffic depends on public-key cryptography to set up a secure session. Two algorithms do most of that work: RSA and the Diffie-Hellman key exchange. They are how two parties that have never met agree on a shared secret over a public network.

Kane described how central this one mechanism is. "There is a particular key exchange called the Diffie-Hellman key exchange, and it guides everything on the internet," he said. "Every email, every WhatsApp message, every VTC connection that's encrypted uses this key exchange."

That concentration is exactly why the quantum threat is systemic rather than niche. RSA and Diffie-Hellman both rest on math problems, factoring large numbers and computing discrete logarithms, that are hard for today's computers and easy for a large enough quantum computer running Shor's algorithm. The symmetric encryption that protects the actual message contents, like AES, is far more resilient. The break happens at the key exchange, the handshake that sets everything up.

So the weak point is not the lock on the message. It is the moment two parties agree on the key. Break that one step with a quantum computer and the recorded session opens.

How Long Until Quantum Computers Break Encryption?

No one can name the date. The industry calls the moment a quantum computer can break current public-key encryption "Q-Day," and credible estimates range from a handful of years to more than a decade. Kane is careful about timing without pretending to predict it. "The time was not here, and it wasn't here two years ago," he said. "It's starting to come here now, but two years later, it's going to super be here. And four years later, super be here."

For defenders, the exact date is the wrong thing to fixate on. Harvest now, decrypt later turns the timeline into a subtraction problem. Take the number of years your data must stay secret, add the years it will take you to migrate your systems, and compare that sum to the years until Q-Day. If the secrecy plus migration time runs past Q-Day, the data is already exposed. You do not get to wait for certainty, because the harvesting is happening now and the decryption is the part that waits.

That is the trap in the episode title. The attacker's patience is the threat. Your encryption has an expiration date you did not choose.

Which Data Is Already at Risk

Not all data is equally exposed. A session token that expires in an hour is worthless to an attacker who can only decrypt it in 2032. The risk scales with how long the information has to stay secret.

The highest-risk categories share one trait: a long secrecy lifetime.

• Health and genetic records. Still sensitive decades after they are created.

• Financial, insurance, and tax data. Useful for fraud and extortion long after capture.

• Government, defense, and diplomatic communications. State secrets that must hold for a generation.

• Source code, designs, and trade secrets. Competitive and security value that does not expire on a schedule.

• Long-lived keys and certificates. The cryptographic material that protects other systems, including the credentials behind authentication.

That last category is the quiet multiplier. If an attacker eventually recovers the keys that protect your other systems, the damage compounds. The same logic that makes device-bound credentials harder to steal applies here: the longer a secret lives and the more it protects, the more it is worth harvesting today.

A useful filter: if a breach of this data in 2035 would still hurt, treat it as a harvest now, decrypt later target in 2026.

What to Do Now: Post-Quantum Migration and Crypto Agility

The good news is that the replacement algorithms exist and are standardized. In August 2024, NIST finalized its first three post-quantum standards: FIPS 203 (ML-KEM) for key exchange, the direct replacement for RSA and Diffie-Hellman style key establishment, plus FIPS 204 and FIPS 205 for digital signatures. The U.S. National Security Agency has set its own timeline through CNSA 2.0, which calls for quantum-resistant national security systems by 2035, with VPNs and routers moving to the new algorithms by 2030 and browsers, servers, and cloud services by 2033.

Those dates are the runway, not the deadline. A practical migration starts well before them:

1. Inventory your cryptography. Find every place you use public-key encryption: TLS endpoints, VPNs, code signing, email, internal service-to-service auth. Most teams underestimate this surface badly.

2. Rank by data shelf life. Migrate the systems carrying long-secrecy data first. A public marketing site can wait. A health records pipeline cannot.

3. Build crypto agility. Architect so algorithms can be swapped without rebuilding the system around them. The goal is to change cryptography the way you rotate a certificate, not the way you replatform.

4. Start hybrid where you can. Many implementations now pair a classical algorithm with a post-quantum one, so a break in either does not expose the session.

This is a different shape of problem from the perimeter thinking many teams grew up on. As with the shift to zero trust and microsegmentation, the fix is not one product you buy once. It is an architectural property you build so you can keep moving as the ground shifts.

The Practitioner View: Building Post-Quantum From Scratch

It is one thing to recommend post-quantum algorithms and another to ship them. Kane's company spent years on the unglamorous part: making a new key exchange actually work in the real world.

American Binary developed a key exchange that Kane says has "completed private peer review and formal verification" rather than living only in a research paper. He named the reviewers as cryptographers Dr. Thomas Shrimpton, a professor at the University of Florida, and Dr. Joseph Kiniry of the verification firm Galois, and said the review used "modern tools that were not available two years ago." The company also added a heavyweight advisor: Whitfield Diffie, co-inventor of the Diffie-Hellman key exchange and a 2015 Turing Award winner, joined American Binary's advisory board.

The harder lesson was operational. Kane described chasing a failure for years before finding its root. "We were having a problem handshaking, which led us to developing a lot of solutions around our key exchange. But we didn't know that that was the issue," he said. "There's such a long road on learning what's going wrong with software that is new, doesn't exist in the wild, except for what you built."

That is the real reason post-quantum migration cannot be a last-minute scramble. New cryptography fails in ways no one has documented yet, because no one has run it at scale before. Organizations that wait for Q-Day to start will be debugging the unknown under the worst possible pressure. The same instinct that makes practitioners cautious about betting on unproven emerging technologies cuts the other way here: the proven algorithms are ready, and the scarce resource is the time to deploy them well.

Listen to the Full Episode

In episode 96 of The Security Podcast of Silicon Valley, Kevin Kane, co-founder and CEO of American Binary, returns to talk with Jon McLachlan about why the quantum threat is a waiting game and what it takes to build encryption meant to survive it.

Kane walks through the role the Diffie-Hellman key exchange plays in everyday internet traffic, the peer review and formal verification behind his company's post-quantum work, and why he thinks the next few years decide who is ready. He is candid about the slow, frustrating reality of building cryptography that does not exist anywhere else yet.

It is a useful listen for anyone responsible for data that has to stay secret well into the 2030s and beyond.