Your Encryption Has an Expiration Date — and Quantum Computers Are About to Cash It In
Quantum computers that can break RSA encryption do not exist yet. The best estimates put them somewhere between five and fifteen years away, depending on who you ask and how optimistic they are about error correction. Some researchers, pointing to the rapid pace of error correction breakthroughs over the past eighteen months, think the window is narrower — maybe three to eight years for a machine capable of running Shor’s algorithm against real-world key sizes. Others, pointing to the engineering challenges of scaling qubit counts while maintaining coherence, think it is still more than a decade away. The uncertainty is itself part of the problem: nobody knows exactly when the break will happen, which makes it easy to convince yourself that it’s a tomorrow problem.
But here is the thing nobody in cybersecurity wants to say too loudly: by the time a cryptographically relevant quantum computer exists, the data it can decrypt will already have been stolen.
This is the “harvest now, decrypt later” attack. It works like this: an adversary with long-term strategic interests — a nation-state, most likely — intercepts encrypted traffic today and stores it. TLS sessions, VPN traffic, encrypted backups, financial transaction logs. All of it sits in a data center somewhere, waiting. When quantum computers mature to the point where they can run Shor’s algorithm against real-world key sizes, that stored data gets decrypted. Secrets that had a shelf life of decades — diplomatic cables, intellectual property, financial records — become readable overnight.
The data you encrypted in 2024 could be decrypted in 2034. If any of that data still matters in 2034, you have a problem. For governments, defense contractors, financial institutions, and healthcare organizations, the answer is “almost all of it.”
NIST Has Done Its Part. Now It’s Your Turn.
In August 2024, NIST finalized its first set of post-quantum cryptography standards: CRYSTALS-Kyber for general encryption, and CRYSTALS-Dilithium, FALCON, and SPHINCS+ for digital signatures. These algorithms are designed to resist attacks from both classical and quantum computers. They are not theoretical. They are published, standardized, and slowly making their way into production systems.
Apple shipped PQ3, a post-quantum cryptographic protocol, in iMessage starting with iOS 17.4 in early 2024. Signal added a post-quantum key exchange mechanism to its protocol in late 2023. Google has been running post-quantum TLS experiments in Chrome since 2016 and enabled Kyber-based hybrid key exchange by default in Chrome 124. Cloudflare has offered post-quantum TLS to all customers since 2023. AWS Key Management Service added post-quantum hybrid key exchange in 2024.
These are the early movers. They represent maybe five percent of the total surface area that needs to be migrated. The other 95 percent — internal corporate networks, legacy financial systems, government databases, embedded devices in critical infrastructure — is still running RSA and ECC as if quantum computers are a distant hypothetical.
The US government has set a deadline: federal systems must complete PQC migration by 2030 for most systems, with a hard deadline of 2035 for everything else. The National Security Memorandum on quantum computing, signed in 2022, kicked off the timeline. NSA’s Commercial National Security Algorithm Suite 2.0, released in 2022, codified the transition requirements. The deadlines sound generous until you consider how long it takes to migrate encryption in a large organization.
The Migration Takes Longer Than You Think
Replacing RSA with Kyber sounds like a library swap. It is not. Kyber-1024 public keys are about 1.5 kilobytes. RSA-2048 public keys are about 260 bytes. Kyber ciphertexts are roughly 1.5 kilobytes. RSA ciphertexts are 256 bytes. This size difference breaks things — protocols with fixed-size packet structures, embedded devices with 128KB of RAM, network paths where an extra kilobyte per handshake adds up to real latency costs.
Then there is the protocol compatibility problem. TLS 1.3 supports post-quantum key exchange, but only if both ends of the connection support it. If your organization communicates with external partners, vendors, or customers who have not upgraded, you either maintain backward compatibility — which introduces downgrade attack risk — or you break the connection. Neither option is good.
Certificate authorities need to support post-quantum certificate chains. Hardware security modules need firmware updates that may require physical access. IoT devices deployed in the field with 15-year expected lifetimes need to be patched or replaced. Mainframes running COBOL applications that have not been touched since 1998 need to speak Kyber. None of this is impossible. All of it takes time, budget, and organizational will.
The rule of thumb among cryptographers is that a full PQC migration takes five to seven years from the moment an organization starts taking it seriously. Most organizations have not started.
Harvest Now, Decrypt Later Is Already Happening
The intelligence community takes this threat seriously because they are the ones doing it. Documents disclosed in various leaks and public testimony over the years have confirmed that signals intelligence agencies routinely capture and store encrypted traffic for future analysis. The logic has always been straightforward: storage is cheap, and you never know when decryption capabilities will improve.
In a post-quantum world, that logic becomes devastatingly effective. The encrypted traffic being captured today — diplomatic communications between allied nations, proprietary research data moving between corporate offices, financial transaction records traveling between banks — will be decrypted wholesale when quantum computers reach the necessary scale. The only defense is to upgrade the encryption before the data gets captured.
This creates an urgency paradox: the threat feels abstract and distant because the quantum computers don’t exist yet, but the window to prevent retroactive decryption closes every day that unencrypted traffic can be intercepted. Once RSA-protected data leaves your network, you have lost the ability to protect it. A PQC migration that finishes in 2032 protects against quantum decryption that happens in 2035, but it does nothing for the data harvested in 2026.
What a Real Migration Plan Looks Like
The practical steps are not secret. They are just time-consuming.
First, inventory your cryptographic assets. Every certificate, every SSH key, every TLS endpoint, every stored encrypted object. Most organizations cannot produce this inventory on demand, which is itself a sign that they are not ready. You cannot migrate what you cannot find.
Second, prioritize by data sensitivity and exposure. Public-facing TLS endpoints that carry customer data go first. Internal service-to-service communication goes next. Stored encrypted data — backups, database encryption, archived files — goes last, both because it is harder to migrate and because the threat model is different (stored data has already been captured; the migration only protects future captures).
Third, test hybrid mode before going all-in. Most PQC implementations today use hybrid key exchange: classical (RSA/ECC) combined with post-quantum (Kyber) in the same handshake. If Kyber turns out to have a vulnerability — and new cryptographic algorithms have a history of doing exactly that — the classical component provides a fallback. Hybrid mode adds overhead but buys insurance against the possibility that the standard you just migrated to turns out to be broken.
Fourth, plan for cryptographic agility. The NIST standards are version 1.0. There will be updates, replacements, and deprecations. If your migration consists of hard-coding Kyber into every protocol and hoping the standard never changes, you will be doing this all over again in five years. Build abstraction layers that let you swap algorithms without touching application code.
The cryptographic community has learned this lesson repeatedly. MD5 was fine until it wasn’t. SHA-1 was fine until it wasn’t. TLS 1.0 and 1.1 were fine until POODLE and BEAST made them liabilities. Every widely deployed cryptographic algorithm eventually gets replaced, and the organizations that treated their encryption as a configurable layer rather than a baked-in assumption were the ones that survived the transition without a crisis. The same principle applies to PQC — invest in agility now, or budget for another full migration in five to ten years when NIST releases version 2.0.
The Cost of Waiting
The uncomfortable math is this: every year you delay starting PQC migration is a year of encrypted traffic that future quantum computers will be able to read. If your organization handles data with a confidentiality horizon longer than a decade — and that describes most large enterprises, governments, and financial institutions — the migration clock started when NIST published the standards in 2024. It did not start when the first cryptographically relevant quantum computer boots up. By then, the harvesting has already happened.
The organizations that are already migrating — Apple, Google, Signal, Cloudflare — are not doing it because they expect a quantum computer to break RSA next Tuesday. They are doing it because they understand that the cost of migrating now, when there is time to do it carefully, is a fraction of the cost of migrating in a panic when the threat materializes.
The competitive angle is worth noting. Apple’s PQ3 protocol, deployed across a billion devices, is not just a security upgrade — it is a market signal. When iMessage is quantum-resistant and your company’s internal messaging tool is not, procurement departments and security auditors will eventually notice. The same dynamic played out with TLS 1.3, with zero-trust architecture, with multi-factor authentication. Early adoption becomes table stakes, and late adopters pay a premium to catch up.
The timeline is also being compressed by regulation. The EU’s Cyber Resilience Act, which entered force in 2025, requires products with digital elements to meet cybersecurity standards throughout their lifecycle — and those standards will evolve to include quantum resistance. The EU Agency for Cybersecurity (ENISA) published its PQC migration recommendations in 2024. Financial regulators in the US and UK are increasingly asking regulated entities about their cryptographic migration plans. The compliance pressure is building from multiple directions simultaneously.
None of this is a reason to panic. It is a reason to start. The migration is a multi-year engineering project, not a security incident response. Organizations that begin now will do it methodically, with testing, fallbacks, and cryptographic agility built in from the start. Organizations that wait will do it under a regulatory deadline or a breach disclosure, and they will make the kind of mistakes that come from rushing.
The rest of the industry is still treating PQC as a compliance checkbox they will check sometime around 2029. The gap between those two postures, measured in stolen ciphertext, could turn out to be the most expensive security debt in computing history.
