Security leadership asks why the team is starting post-quantum cryptography planning now for VPN and TLS traffic whose contents must stay confidential for 15 years, even though no cryptographically relevant quantum computer exists today. Which explanation is correct?
Select an answer to reveal the explanation.
Short Explanation
Imagine someone photocopying your locked diary today, betting they'll get the key in ten years. That's harvest now, decrypt later — and if your secret still matters in ten years, the clock is already running. The trap is thinking AES is the problem; it's the public-key exchange that a future quantum computer threatens.
Full Explanation
Harvest now, decrypt later describes adversaries that capture and store encrypted traffic today, expecting a future cryptographically relevant quantum computer to break the public-key algorithms that protected it. Shor's algorithm would defeat RSA and elliptic-curve Diffie-Hellman, which most VPN and TLS sessions use to agree on session keys; once the key exchange is broken, the recorded symmetric keys and therefore the data are exposed. Data with a long confidentiality lifetime is at risk now, which is why migration to NIST-standardized post-quantum algorithms such as ML-KEM for key establishment and ML-DSA for signatures, often in hybrid mode, is planned years ahead. The claim that quantum computers break AES-256 in real time is false; Grover's algorithm at most reduces the effective strength of symmetric keys, and AES-256 is regarded as remaining adequate. Classical computers are not producing SHA-256 collisions, and hashing is not the primary quantum concern. NIST has not mandated quantum key distribution hardware; its effort standardizes post-quantum algorithms that run on conventional systems. Exam caveat: the threat targets asymmetric key exchange and signatures, not symmetric bulk ciphers. Operational check: inventory where long-lived sensitive data relies on RSA or ECDH key exchange and prioritize those paths for post-quantum or hybrid migration.