What harvest-now-decrypt-later means

The written lesson

Harvest-now-decrypt-later (HNDL) — also called store-now-decrypt-later — describes an adversary strategy, not a technology. An adversary captures ciphertext and any key-establishment or wrapping artifacts needed for later recovery. If a capable quantum computer exists while that information still needs to be secret, and the captured protection path is vulnerable, later decryption may expose it.

This is what makes HNDL easy to under-prioritize: an adversary can retain relevant encrypted data today without a current decryption alert. Exposure begins at capture if the needed ciphertext and key-establishment artifacts are available. Whether one record is at risk depends on its remaining confidentiality need, the captured artifacts, and the hypothetical future attack horizon. A ten-year lifetime is lower than a multi-decade lifetime but is not automatically safe.

HNDL (store-now-decrypt-later, catch-now-decrypt-later)

Three names for the same adversary strategy: capture protected data now, decrypt it once a CRQC exists.

CRQC (cryptographically relevant quantum computer)

A quantum computer capable of running Shor's algorithm at a scale that breaks the key sizes deployed in practice today. None exists yet, and this course does not predict when one will.

Confidentiality vs. forgery

HNDL concerns ciphertext confidentiality. Long-lived signature authenticity and archival verification are distinct, related migration problems.

An adversary does not need privileged access to do this. Publicly routable internet traffic, data held by any third party, and durable copies such as backups and logs are all realistic capture targets long before any CRQC exists. Module 2 treats where capture is actually plausible as its own variable, in detail.

For a deeper walkthrough of this exposure model, see Harvest-Now-Decrypt-Later Exposure. The rest of this course builds a repeatable way to answer, for any specific piece of data: is it exposed to HNDL, and if so, how urgently does that matter.

Define the adversary before labeling a flow: what can they observe now, which artifacts can they retain, and which future capability is being considered? Passive collection of a classical key exchange and associated ciphertext is an HNDL scenario. A plaintext breach or a future forged firmware image is a serious but different scenario; it calls for a different control and clock.