Post-quantum encryption is the deadline nobody is preparing for

by Omar Schneider

The strange thing about quantum risk: the harvest-now-decrypt-later attack means data stolen TODAY is already exposed to a computer that does not exist yet. Migration to post-quantum standards takes years, and most companies have not started. The machines may be a decade away; the deadline is not. Anyone here actually working on a migration?

favorite 20 comment 8 visibility 451

Comments

Ava Engel 1 month ago

Quantum researcher here - I'd split "nobody is preparing" in two, because half is already false. The transport layer migrated: hybrid X25519+ML-KEM-768 has been the default key exchange in Chrome and the big CDNs for a year+ - your browser went post-quantum without asking. What nobody's touched is data at rest with a 15-year shelf-life, plus PKI/firmware roots you can't rotate over a weekend - that's the real harvest-now exposure. The crypto isn't the bottleneck (FIPS 203/204/205 were final in 2024); it's a cryptographic INVENTORY problem, and you can't migrate what you can't find. The machine itself is a decade+ out: Shor wants thousands of error-corrected logical qubits, best labs sit at ~48-96. Deadline = your data's shelf-life, not the hardware.

Daniel Cohen 1 month ago

The framing worth keeping: harvest-now is the only quantum attack that's real today, and it's real precisely because it doesn't need the computer to exist yet. Everything else about "quantum breaking crypto" is a decade of press releases away. So migrate the long-lived secrets now, and ignore the countdown clocks - the clock that matters isn't the hardware's, it's how many years your data still has to stay secret.

Milan Gruber 1 month ago

Payments PM here, so let me add the case that scares me most under Ava's "can't rotate over a weekend": card rails. A payment cert chain isn't one key - it's HSMs, scheme root CAs, EMV keys baked into chips, and terminals in the field on 5-7 year refresh cycles. You don't upgrade that, you age it out. And the near-term forcing function isn't the quantum computer, it's regulatory: Sept 21 2026, NIST moves all FIPS 140-2 modules to Historical, so new federal procurement wants 140-3 - and HSM vendors are only shipping PQC firmware in 2025-26. ~13% of orgs are in production. Rails are the easy, commoditising part; it's the trust layer - roots, HSMs, identity - that's slow and political, and that's exactly what harvest-now targets. Inventory it now.

Aisha Khan 1 month ago

Milan's right about the hardware, but the operational failure mode is subtler: a payment flow is only as post-quantum as its weakest hop. You migrate your edge, your PSP migrates theirs, but the acquirer, the card network, the fraud vendor and that one legacy settlement file each rotate on their own schedule - and a hybrid handshake silently falls back to classical the moment one partner can't negotiate it. So "we migrated" is meaningless without knowing which downgrade paths are still open across every integration you don't control. The inventory Ava mentioned isn't just your keys; it's every counterparty's timeline.

Pilar Costa 1 month ago

The error-correction milestones this year were genuinely impressive. Still a lab story, but a much better lab story than 3 years ago.

Camille Petrov 1 month ago

Milan's NIST date is the real mechanism, and it's worth saying why out loud: harvest-now-decrypt-later has no deadline a budget owner respects. "Someone might read this in 2035" loses every quarterly fight to a bug on fire today. At-rest data and PKI roots only move when there's a mandate with an audit and a date attached - risk awareness has never once rewired a cert chain. So the question isn't "which PQC algorithm", it's what you require. Mandate a one-time migration to ML-KEM and you freeze today's choice into a decade of terminals; the least-bad requirement is crypto-agility itself - prove you can rotate an algorithm without re-architecting, plus a real inventory. Agility survives the next parameter break; a named winner survives only until it breaks.

Marco Wojcik 1 month ago

My rule for quantum news: if the article mentions Bitcoin in the first paragraph, close the tab.

Ingrid Engel 1 month ago

Quantum threads here are refreshingly hype-free. Appreciated.