The attack doesn't need quantum hardware yet
"Harvest now, decrypt later" describes a passive attack that's already executable with today's technology: an adversary records encrypted traffic now — TLS sessions, VPN traffic, stored backups — and simply holds onto the ciphertext, waiting until a cryptographically relevant quantum computer exists to decrypt the RSA or ECDH key exchange that protected it. The recording requires no quantum computer at all; only the eventual decryption does.
The harvest-now-decrypt-later timeline
- 1
Today: record
An adversary passively captures and stores RSA/ECDH-protected ciphertext — no quantum computer needed for this step.
- 2
Years pass
The ciphertext sits in storage. Classically, it remains unbreakable the entire time.
- 3
Eventually: a capable quantum computer exists
Once a sufficiently large, low-error quantum computer runs Shor's algorithm, the key exchange that protected the recording is broken.
- 4
Retroactive decryption
Everything harvested years earlier is decrypted at once — the delay never protected it.
Who this actually threatens
This risk is proportional to how long data needs to stay confidential. State secrets, medical records, trade secrets, and long-term personal data are exposed today if intercepted today, because they still need protection years or decades from now. A single ephemeral session that's operationally irrelevant a week later carries far less exposure — though it's worth noting exactly which key exchange protected it, since forward-secret ECDHE sessions are still individually vulnerable to this specific harvesting risk even though each session used a fresh key.
Why this drives migration timing, not just eventual planning
This is the practical argument organizations use for starting PQC migration — specifically hybrid key exchange, combining a classical algorithm like ECDH with a post-quantum algorithm like ML-KEM in the same handshake — well before a quantum computer capable of Shor's algorithm exists, rather than waiting for one to appear. Data harvested today under purely classical protection is already, in effect, on a countdown.