The threat in one paragraph
Most of the encryption that protects data in transit, in web traffic, VPNs and messaging, relies on public-key algorithms such as RSA and elliptic-curve cryptography. A sufficiently powerful quantum computer, running Shor's algorithm, could break them. An attacker doesn't need that computer today. They can record encrypted traffic or copy encrypted files now, store them, and decrypt them years from now when the capability exists. That is "harvest now, decrypt later".
Are you exposed? A simple test
Cryptographers often use a rule of thumb attributed to Michele Mosca. Add together:
- X — how many years your data must remain secret;
- Y — how many years it will take you to migrate to quantum-safe cryptography.
If X + Y is greater than the number of years until a cryptographically relevant quantum computer exists, data you send today is already at risk. Nobody knows that last number precisely, which is exactly why long-lived data deserves attention now.
| Data type | Typical secrecy needed | Risk from harvesting |
|---|---|---|
| Health and genetic records | A lifetime | High |
| Government and defence communications | Decades | High |
| Intellectual property, M&A, trade secrets | 5–20 years | High |
| Financial records and long-term contracts | 7–10+ years | Medium to high |
| Session data, short-lived tokens | Minutes to days | Low |
What is and isn't affected
- Public-key cryptography is the main concern. Key exchange (as used in TLS) and encryption based on RSA or elliptic curves are vulnerable to harvesting.
- Digital signatures need replacing too, on a different clock. A signature can't be "harvested" and broken retroactively in the same way, but systems that verify signatures for years, such as firmware updates and long-lived certificates, still need new algorithms before quantum attacks become practical.
- Symmetric encryption holds up better. Algorithms like AES are much less affected; using 256-bit keys keeps a comfortable margin.
The replacement algorithms already exist
On 13 August 2024, the US National Institute of Standards and Technology (NIST) published its first three finalised post-quantum standards:1
| Standard | Algorithm | Used for |
|---|---|---|
| FIPS 203 | ML-KEM (from CRYSTALS-Kyber) | Key exchange and general encryption |
| FIPS 204 | ML-DSA (from CRYSTALS-Dilithium) | Digital signatures |
| FIPS 205 | SLH-DSA (from SPHINCS+) | Hash-based signatures, a backup built on different maths |
These run on ordinary computers. Moving to them is a software and infrastructure project, not a hardware purchase.
The UK timeline
In March 2025, the UK's National Cyber Security Centre (NCSC) published target dates for migration:2
- By 2028: define migration goals, complete discovery and assessment of your cryptography, and build an initial plan, including your supplier dependencies.
- By 2031: complete your highest-priority migrations and prepare your infrastructure for post-quantum cryptography.
- By 2035: complete migration of all your systems, services and products.
In the US, NIST's draft transition guidance (IR 8547) proposes deprecating widely used RSA and elliptic-curve algorithms by 2030 and disallowing them by 2035.3 Regulated sectors and government suppliers should expect these dates to shape procurement requirements.
What to do first
- Inventory your cryptography. You can't migrate what you can't see. Find every certificate, key, protocol and library, including those inside third-party products.
- Classify data by how long it must stay secret. This tells you where harvesting risk is highest.
- Prioritise key exchange for long-lived data. Protect the traffic and archives an attacker would most want to store.
- Adopt hybrid modes first. Combining a classical algorithm with ML-KEM (for example, X25519 + ML-KEM in TLS) protects you against quantum attacks without betting everything on the new algorithm.
- Talk to your suppliers. Ask for their post-quantum roadmaps now; many of your dependencies are in their hands.
- Build for crypto-agility. Make the next algorithm change a configuration update, not a rebuild. We explain how in our guide to crypto-agility.