The decision
The cost of waiting
Data captured today can be decrypted later — the timeline is unknown, which is exactly why waiting for certainty is the expensive choice.
5 min read
What you'll be able to do
- Explain harvest-now-decrypt-later risk without predicting when a capable quantum computer will exist.
- Apply the Mosca heuristic as a planning tool, not a measurement.
- State which post-quantum standards are final today and which are still drafts.
Some data captured on the wire today can be decrypted later, once a sufficiently capable quantum computer exists. No such machine exists today, and this course will not predict when one will. That uncertainty is not a reason to wait — it is the reason waiting is expensive.
- X — secrecy lifetime
- How many years this data must stay confidential. A contract clause: months. A patient record or a state secret: decades.
- Y — migration time
- How many years your organization actually needs to find, prioritize, fund, and migrate the systems that protect this data.
- Z — time to a capable machine
- Unknown. No one can measure it, and anyone who gives you a confident date is guessing.
The heuristic: if X plus Y is larger than Z, you are already exposed, because the data will still matter when the capability eventually arrives. Treat this as a planning heuristic, not a measurement: the value is in comparing data sets against each other, not in producing a date.
| Body | Status | What it means for you |
|---|---|---|
| NIST FIPS 203, 204, 205 (ML-KEM, ML-DSA, SLH-DSA) | Final — published August 2024 | The waiting for standards objection no longer applies to core encryption and signing. |
| HQC (backup key-establishment algorithm) | Selected March 2025, not yet standardized | A backup exists if ML-KEM is ever weakened. Do not deploy it as a primary choice yet. |
| A FALCON-based signature standard | Drafted, not final | Expect a smaller-signature option later; do not plan around it today. |
| NIST IR 8547 (deprecating classical algorithms) | Initial public draft | Proposes deprecating 112-bit classical public-key algorithms after 2030 and disallowing them after 2035 — a signal, not yet a rule. |
| NSA CNSA 2.0 | Published requirement, milestones into the early 2030s | Binds US national security systems and their vendors, including a hash-based signing requirement for firmware. Most enterprises meet it indirectly, through customers and supply chains. |
One migration is already happening without anyone deciding it: hybrid key exchange, combining a classical and a post-quantum mechanism such as X25519MLKEM768, is now the default in major browsers and widely deployed on servers and CDNs. That protects data in transit. Authentication is a different story: it is still classical almost everywhere, because replacing what proves identity is a harder, slower change than replacing what protects a session key.
Marking a lesson complete only updates this browser.