Encryption Under Pressure From a Technology That Does Not Yet Exist at Scale
Fault-tolerant quantum computers capable of breaking widely used encryption standards remain years, if not decades, away from practical deployment. Yet intelligence agencies, standards bodies, and cybersecurity researchers across multiple countries have concluded that the threat to encrypted communications is already active and growing.
The strategy at the center of these concerns is known as "harvest now, decrypt later." State-level actors and sophisticated cybercriminal organizations are believed to be intercepting and storing encrypted network traffic with the expectation that sufficiently powerful quantum computers will eventually be able to decode it. Sensitive government communications, financial records, and personal data collected now could become readable in a future where the technical barriers to quantum decryption have been overcome.
Standards Bodies Move to Get Ahead of the Curve
The United States National Institute of Standards and Technology (NIST) finalized its first set of post-quantum cryptographic standards in 2024, following a multi-year evaluation process involving submissions from research teams around the world. The selected algorithms are designed to resist attacks from both classical and quantum computers.
Several governments, including those of the United States, the United Kingdom, and members of the European Union, have issued guidance urging critical infrastructure operators and government agencies to begin migrating toward these new standards. The migration process is broadly described as complex and time-consuming, given the depth to which legacy cryptographic protocols are embedded in global digital infrastructure.
A Long Transition on a Shrinking Timeline
Cryptographers point out that transitions between major encryption standards have historically taken well over a decade to complete across large organizations and public networks. The concern is that the gap between when quantum computers become capable enough to threaten current encryption and when post-quantum standards achieve widespread adoption could leave a significant window of exposure.
The defense and intelligence communities in several countries have already begun internal migrations. Private sector adoption, however, remains uneven, with smaller organizations often lacking the resources or awareness to prioritize the shift.
Remaining Questions
How quickly will nation-state quantum computing programs advance beyond what is publicly disclosed? When will post-quantum standards achieve meaningful adoption across private-sector infrastructure? And how much encrypted data has already been harvested with future decryption in mind?
Sources: U.S. National Institute of Standards and Technology (NIST), UK National Cyber Security Centre (NCSC), European Union Agency for Cybersecurity (ENISA), U.S. Cybersecurity and Infrastructure Security Agency (CISA)
This article is based on a verified primary source. The text was editorially reviewed and fact-checked prior to publication.
