Store-Now-Decrypt-Later

An attack strategy where an adversary captures encrypted data today and stores it until a crqc exists to decrypt it. Also called "harvest now, decrypt later" (HNDL).

The threat model assumes nation-state actors (or anyone with storage budget) are already recording encrypted network traffic, encrypted files, and key exchanges. Once a CRQC arrives, they can retroactively decrypt everything captured with classical public-key cryptography.

Why it matters now

This is the reason post-quantum migration is urgent even though CRQCs don't exist yet. Data encrypted today with ECDH-based key exchange will be readable once the key exchange can be broken. The sensitivity window isn't "when will CRQCs exist" but "how long does this data need to stay secret."

For data with long confidentiality requirements — medical records, state secrets, financial data, attorney-client communications — the store-now-decrypt-later threat is already active. If CRQCs arrive in 2029 (crqc-timeline), data captured in 2024 has been exposed for 5 years.

Mitigation

Switch to ml-kem for key exchange so captured ciphertexts can't be decrypted even with a CRQC. For file encryption, tools like age added PQ recipients in version 1.3.0. For TLS, Chrome already ships ML-KEM in hybrid mode.

Symmetric encryption (AES, ChaCha20) is not vulnerable to this attack — Grover's algorithm doesn't practically threaten 128-bit keys. The vulnerability is specifically in the key exchange step that establishes the symmetric key.