Executive Order 14412 (June 22, 2026) names harvest-now-decrypt-later (HNDL) as the threat that makes post-quantum migration urgent: adversaries recording encrypted traffic today in order to decrypt it once a cryptographically relevant quantum computer exists. This technical note asks whether HNDL matters for the telemetry that moves between a pipeline control center and its field sites. It first notes that much SCADA traffic (Modbus, DNP3) still crosses links unencrypted, which is a present-day exposure regardless of quantum computing. It then locates the quantum-vulnerable public-key operations in typical pipeline telemetry paths (IPsec/IKEv2 WAN VPNs, TLS under IEC 62351-3, OPC UA secure channels, cellular and satellite backhaul, and DNP3 Secure Authentication's asymmetric update-key change), applies Mosca's inequality to classify telemetry by how long it stays sensitive, and distinguishes the HNDL confidentiality risk from the separate long-term risk to signing keys and roots of trust. Using parameter sizes from FIPS 203 and FIPS 204, it quantifies the bandwidth cost on narrowband OT links: an ML-KEM-768 key exchange moves 2,272 bytes versus 64 bytes for X25519 (about 36 times more), taking about 1.89 seconds at 9,600 bps; an ML-DSA-65 public key plus signature is 5,261 bytes (about 4.38 seconds at 9,600 bps). It closes with six prioritized actions: close cleartext gaps, prefer hybrid key exchange, use AES-256 on long-lived links, reduce what is worth harvesting, rank links by data shelf life, and question vendors and carriers on ML-KEM support. Calculations are reproducible from an open script. Issue 02 (October 2026 slot) of Quantum-Safe Pipeline Notes, a monthly technical blog on post-quantum cryptography and OT security for U.S. pipelines. Uses public sources only; views are the author's own and do not represent any employer or client.
Executive Order 14412 (June 22, 2026) names harvest-now-decrypt-later (HNDL) as the threat that makes post-quantum migration urgent: adversaries recording encrypted traffic today in order to decrypt it once a cryptographically relevant quantum computer exists. This technical note asks whether HNDL matters for the telemetry that moves between a pipeline control center and its field sites. It first notes that much SCADA traffic (Modbus, DNP3) still crosses links unencrypted, which is a present-day exposure regardless of quantum computing. It then locates the quantum-vulnerable public-key operations in typical pipeline telemetry paths (IPsec/IKEv2 WAN VPNs, TLS under IEC 62351-3, OPC UA secure channels, cellular and satellite backhaul, and DNP3 Secure Authentication's asymmetric update-key change), applies Mosca's inequality to classify telemetry by how long it stays sensitive, and distinguishes the HNDL confidentiality risk from the separate long-term risk to signing keys and roots of trust. Using parameter sizes from FIPS 203 and FIPS 204, it quantifies the bandwidth cost on narrowband OT links: an ML-KEM-768 key exchange moves 2,272 bytes versus 64 bytes for X25519 (about 36 times more), taking about 1.89 seconds at 9,600 bps; an ML-DSA-65 public key plus signature is 5,261 bytes (about 4.38 seconds at 9,600 bps). It closes with six prioritized actions: close cleartext gaps, prefer hybrid key exchange, use AES-256 on long-lived links, reduce what is worth harvesting, rank links by data shelf life, and question vendors and carriers on ML-KEM support. Calculations are reproducible from an open script. Issue 02 (October 2026 slot) of Quantum-Safe Pipeline Notes, a monthly technical blog on post-quantum cryptography and OT security for U.S. pipelines. Uses public sources only; views are the author's own and do not represent any employer or client.
Quantum computers capable of breaking RSA-2048 are projected to emerge by 2030 ± 3 years. Analysis of more than 100 primary sources indicates that 98–100% of healthcare records and 95–100% of government-classified data encrypted today are likely to face retroactive decryption under the Harvest Now, Decrypt Later (HNDL) attack model, in which adversaries collect encrypted data today and decrypt it once cryptographically relevant quantum computers become available. This paper introduces a formal time-dependent risk model that quantifies exposure as a function of data confidentiality lifetime (Ld) and attacker decryption horizon (Ha). Using the vulnerability condition Ld > Ha, we evaluate sector-specific quantum risk across healthcare, finance, government, and cloud environments, demonstrating that long-lived sensitive data faces near-certain compromise under classical public-key cryptography. The study analyzes NIST’s finalized post-quantum cryptography standards (FIPS 203–205: ML-KEM, ML-DSA, and SLH-DSA) and presents a unified five-phase migration framework addressing technical, operational, regulatory, and supply-chain constraints. Drawing on real-world deployments—including Apple iMessage PQ3, Google Chrome, Cloudflare, IBM Quantum Safe, and the U.S. Federal Government—the paper provides actionable guidance for organizations seeking to achieve 90% or greater post-quantum cryptography migration by 2030. The window for protecting long-lived data is now—not when quantum computers arrive.
Telecommunication infrastructures rely on cryptographic protocols designed for long-term confidentiality, yet data exchanged today faces future exposure when adversaries acquire quantum or large-scale computational capabilities. This harvest-now, decrypt-later (HNDL) threat transforms persistent communication records into time-dependent vulnerabilities. We model HNDL as a temporal cybersecurity risk, formalizing the adversarial process of deferred decryption and quantifying its impact across sectors with varying confidentiality requirements. Our framework evaluates how delayed post-quantum cryptography (PQC) migration amplifies exposure and how hybrid key exchange and forward-secure mechanisms mitigate it. Results show that high-retention sectors such as satellite and health networks face exposure windows extending decades under delayed PQC adoption, while hybrid and forward-secure approaches reduce this risk horizon by over two-thirds. We demonstrate that temporal exposure is a measurable function of data longevity and migration readiness, introducing a network-centric model linking quantum vulnerability to communication performance and governance. Our findings underscore the urgent need for crypto-agile infrastructures that maintain confidentiality as a continuous assurance process throughout the quantum transition.
The advent of cryptographically relevant quantum computers (CRQCs) poses a fundamental threat to public-key cryptography securing modern digital communications. The most immediate danger is not direct decryption but the harvest-now-decrypt-later (HNDL) attack, wherein adversaries passively collect and archive encrypted traffic today for retrospective decryption once a CRQC becomes operational. This threat is structurally difficult to counter because the collection phase generates no host- or account-level signals detectable by conventional intrusion-detection systems.Simultaneously, migration to NIST-standardized post-quantum cryptography (PQC) specifically ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) introduces new vulnerabilities, including chosen-ciphertext side-channel attacks, fault-injection attacks, and protocol downgrade attacks arising during hybrid deployment periods.Existing security tooling addresses cryptographic inventory, encrypted-traffic anomaly detection, and PQC readiness as isolated problems, leaving a critical operational gap. To address this, we propose QCAD (Quantum Cryptographic Attack Detection), a unified multi-plane detection framework integrating four complementary detection planes: (A) flow-metadata behavioral analytics targeting HNDL collection indicators; (B) host- and protocol-level telemetry for PQC implementation flaws and downgrade attacks; (C) continuous crypto-agility monitoring with per-asset Mosca-inequality risk scoring; and (D) quantum-vulnerable deception canaries. These planes feed a unified correlation layer that maps observations to MITRE ATT&CK techniques and produces risk-ranked alerts.Evaluation against synthetic HNDL and PQC-attack benchmarks demonstrates that cross-plane fusion achieves a recall of 0.97 at a 5% false-positive rate (F1 = 0.90, ROC-AUC = 0.99), substantially outperforming any individual plane, confirming that no single observable captures all attack families.A key boundary condition remains: HNDL detection is inherently a probabilistic behavioral-inference problem, and interception occurring on transit infrastructure beyond the defender's perimeter may remain undetectable regardless of sensor deployment.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.
Abstract A cryptographically relevant quantum computer (CRQC) would break the public-key algorithms that protect most digital communication, but the risk does not begin when such a machine is switched on. Under the harvest-now-decrypt-later (HNDL) threat model, an adversary records encrypted traffic now and decrypts it once a CRQC exists, so any data whose confidentiality must outlast the machine’s arrival is exposed from the moment it is transmitted. This scoping review maps documented data-confidentiality lifetimes, charted by data category, against post-quantum migration readiness, documented by custodian sector, and applies Mosca’s inequality to reason about which data categories are most exposed. Following the Arksey and O’Malley framework, Joanna Briggs Institute guidance, and the PRISMA Extension for Scoping Reviews, 42 sources spanning peer-reviewed literature, standards bodies, government documents, and labeled grey literature were charted. Documented confidentiality lifetimes reach decades or are effectively perpetual for national-security records, health and genomic data, biometric identifiers, and privileged legal communications, and span years to decades for financial records. Migration-readiness evidence is uneven: most developed for government and defense and for cross-industry surveys, partial for finance and telecommunications, and largely absent for health care, genomics, and the legal sector. Reasoning through Mosca’s inequality, data categories with multi-decade or indefinite confidentiality requirements are, by that logic, already exposed to HNDL, because credible expert estimates place a meaningful probability of a CRQC within the same horizon; these exposure assessments are reasoned inferences rather than measurements. The central finding is a structural mismatch between long confidentiality obligations and immature migration, compounded by a readiness evidence gap that is itself a risk.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.