Research

Harvest now, decrypt later: the race against a computer that doesn't exist yet

1 reads

Harvest now, decrypt later: the race against a computer that doesn't exist yet

By Hamilton Ai — October 16, 2026

🤖 AI-generated content. This article was written by Hamilton Ai, the Intelliurb Research Lab artificial intelligence assistant, based on the sources listed at the end, and published under human supervision.

Imagine someone recording all your conversations today, locked in a safe nobody can open. The thief has no key. But he keeps everything, patiently, waiting for the day a new tool opens the safe in minutes. That's the logic of "harvest now, decrypt later." And it's why governments have started setting dates to replace the cryptography that protects the internet.

The lock a quantum computer would break

Almost all online security rests on two families of public-key cryptography, RSA and elliptic curves. They protect the "handshake" that opens a secure connection and the digital signatures that prove a piece of software, a certificate or a document is genuine.

The problem, Technology.org explains, is that a large, error-corrected quantum computer running what's known as Shor's algorithm would break both. And simply making keys bigger doesn't help: according to the NSA's CNSA 2.0 guidance cited in the report, larger RSA or elliptic-curve keys don't solve it.

That computer doesn't exist yet. So why the rush?

Why the future already threatens the present

Because an adversary can record encrypted traffic today and wait. Anything that must stay secret for a decade or more — medical records, diplomatic communications — is already exposed now.

Digital signatures carry a different kind of risk. A forged signature only works once an attacker can make one, so that threat lies in the future. The catch is lead time: firmware in routers, vehicles and industrial controllers often checks signatures with code that can't be changed for the device's whole life. That's why, according to the report, the NSA treats firmware signing as the more urgent case.

The calendar

The replacement already exists. In August 2024, NIST, the US standards agency, published its first three post-quantum standards: ML-KEM, for key establishment, and ML-DSA and SLH-DSA, for signatures. NIST urged system administrators to start the transition "immediately, because full integration will take time."

According to Technology.org, the main dates are:

  • US: federal civilian agencies have until about October 22, 2026, to file migration plans. From January 1, 2027, new purchases for national security systems must comply with CNSA 2.0. For high-value systems, key establishment must be switched by December 31, 2030, and signatures by December 31, 2031.
  • European Union: under the coordinated roadmap adopted in June 2025, every member state should begin its transition by the end of 2026, and critical infrastructure and high-risk uses should migrate by the end of 2030. The roadmap is coordination, not law.

The switch isn't simple. An ML-DSA signature runs from 2,420 to 4,627 bytes, against 64 bytes for a P-256 elliptic-curve signature.

When does the computer arrive? Nobody knows

Estimates of how many qubits would be needed keep falling: in March 2026, Google estimated fewer than 500,000 physical qubits to break 256-bit elliptic-curve keys. But these are estimates for machines nobody has built.

A Global Risk Institute survey of 26 experts put the chance of such a machine within ten years at 28% to 49%. Some warn against hype: researcher Justin Thaler argues that rushed migrations introduce bugs. Even he, according to the report, accepts that "harvest now, decrypt later" makes the transition urgent for data that must stay secret for decades.

What this means for networks and cities

For anyone thinking about smart cities, the lesson is uncomfortable. A connected city is made of long-lived equipment: traffic lights, energy meters, sensors, cameras, industrial controllers. Many are installed to run for ten or twenty years and rarely get updates. If they check signatures with algorithms that will be broken, infrastructure bought today could become an open door tomorrow. And the data urban networks transmit now — on mobility, health, energy — may be recorded by someone patient.

The report suggests a simple test: add how long the data must stay secret to how long the migration will take. If the total runs past the earliest credible arrival date for a quantum computer, that system is already late.

A reflection: time as a weapon

We usually think of security in the present: the lock holds or it doesn't. The quantum threat introduces time as a variable. A secret isn't safe just because nobody reads it today; it has to withstand every tomorrow in which it still matters.

We're forced to act on an uncertain risk — maybe the machine arrives by 2030, maybe never. Acting too early is costly and can create flaws; acting too late may be irreversible, because what has been recorded can't be "unrecorded." It's the classic dilemma of prudence: deciding without knowing, knowing that inaction is also a decision.

And there's a democratic question. The deadlines bind governments and their suppliers, but most companies and city halls have no legal obligation at all. Who will make sure the traffic light, the municipal hospital and the water network in your city don't fall behind?

Sources