Harvest now, decrypt later: the reason the clock is already running
Encrypted data recorded today can be decrypted years from now once a quantum computer exists. That turns a future capability into a present-day exposure for anything with a long shelf life.
The single most important idea in post-quantum planning is that the attack does not have to happen in real time. An adversary who can observe your network records the encrypted traffic and the key-exchange messages, then archives them. Storage is cheap and patience is free. When a cryptographically relevant quantum computer becomes available, they replay the archive and recover the keys retroactively, and every message sent under those keys becomes readable.
Whose data is actually at risk
Not everything needs protecting for decades. The useful test is a simple inequality usually credited to Michele Mosca. Let X be how many years a secret must remain confidential, Y the years it will take you to migrate to post-quantum cryptography, and Z the years until a quantum computer can break today's algorithms. If X plus Y is greater than Z, the data is still sensitive at the moment it becomes decryptable, so it is already at risk.
- High shelf life (act first): health and genetic records, biometric identifiers, state and trade secrets, long-term contracts, source code and signing keys.
- Low shelf life (lower priority): session cookies, one-time tokens, ephemeral messages whose value expires in minutes or days.
Sort by shelf life, not by system
The instinct is to migrate the busiest systems first. Harvest-now-decrypt-later says to migrate the longest-lived secrets first, because those are the ones for which retroactive decryption still causes damage. Data lifetime, not traffic volume, sets the order.
Why signatures are different
Harvest-now-decrypt-later applies to confidentiality: to key exchange and encryption. It does not apply the same way to digital signatures, because a forged signature is only useful once the quantum computer exists; you cannot forge a document retroactively into the past. That is why the first concrete migration step almost everyone takes is protecting key exchange (typically by moving TLS to a hybrid post-quantum handshake) while signature migration follows on a somewhat less frantic schedule.
For the full threat model and the maths of the exposure window, see the in-depth guide, Harvest now, decrypt later.