Skip to content
—
QuantascanAlpha

Harvest now, decrypt later

Why the quantum threat matters today even though no dangerous quantum computer exists yet.

4 min readUpdated 2026-06-20

On this page▾

A common objection to worrying about quantum computers is: "They don't exist yet, so why care now?" The answer is a strategy called harvest now, decrypt later — and it's the reason the quantum clock is already ticking.

The idea

The attack is simple to state:

  1. Harvest now. Record encrypted or signed data today and store it.
  2. Decrypt later. Wait until a capable quantum computer exists, then break the stored data retroactively.

The attacker doesn't need a quantum computer today. They only need patience and storage, both of which are cheap. Anything you protect with quantum-vulnerable cryptography now could be exposed the moment the hardware catches up.

Why blockchains are especially exposed

For most systems, "harvest now, decrypt later" requires actively intercepting and storing traffic. For a blockchain, the harvesting is already done for free — by the blockchain itself.

A public ledger is, by design:

  • Public — anyone can read every transaction, and
  • Permanent — nothing is ever deleted.

So every public key that has ever been exposed on-chain is sitting in the ledger forever. With ECDSA, an exposed public key is all Shor's algorithm needs to recover the private key. The attacker's "harvest" step was completed the day the key was first used.

You can't un-expose a key

This is the crux. Once a public key is on a public, immutable ledger, you cannot take it back. If it's a quantum-vulnerable key, then the future arrival of quantum computers puts those past funds at risk — and there's no way to retroactively hide what's already recorded.

That asymmetry is why preparing early is the only real defence. Moving value to quantum-resistant addresses before capable quantum computers exist means the keys that protect it were never vulnerable in the first place. Wait until the threat is here, and the exposed keys are already harvested.

QRL's answer

QRL's entire design is a response to this timing problem: use post-quantum signatures — XMSS and ML-DSA-87 — from the start, so there's no quantum-vulnerable window to harvest. It's insurance bought before the storm, not after.

Where to go next

FAQ about Harvest now, decrypt later

Common questions about this page
What is 'harvest now, decrypt later'?
It's an attack strategy where an adversary records encrypted or signed data today and stores it, planning to break it later once quantum computers are capable. The data is captured now; the decryption happens in the future.
Why does it matter for blockchains?
Blockchain ledgers are public and permanent. Every exposed public key is recorded forever, so an attacker doesn't need to capture anything secret — it's already there, waiting. Once quantum computers mature, previously safe keys become vulnerable retroactively.
Doesn't this mean it's already too late?
Not for funds you move to quantum-resistant addresses before capable quantum computers arrive. The point of migrating early is to ensure your value is protected by post-quantum signatures well ahead of the threat.
← Back to Learn