Sufficiently powerful quantum computers, if built, could theoretically break the mathematical problems RSA and current elliptic curve cryptography rely on — a threat that remains years to decades away by most credible estimates, but significant enough that standards bodies have already begun the multi-year process of preparing replacements.
What's already happening
NIST finalized its first set of standardized post-quantum cryptographic algorithms in 2024, and major browsers and CAs have begun early experimentation with hybrid key exchange (combining a traditional algorithm with a post-quantum one) in TLS connections — a cautious, gradual approach rather than an abrupt protocol change.
Why "harvest now, decrypt later" matters even before quantum computers exist
The specific concern driving early action isn't that today's encrypted traffic is breakable now — it's that an adversary could record encrypted traffic today and decrypt it retroactively once quantum computing capability eventually catches up, which matters most for data with a long confidentiality shelf life (government, healthcare, and similar records) even though it's a lower priority for most ordinary website traffic.
Which specific algorithms NIST actually standardized
NIST's 2024 finalized standards included ML-KEM, based on the CRYSTALS-Kyber submission, for key encapsulation and ML-DSA, based on CRYSTALS-Dilithium, for digital signatures, chosen after a multi-year, multi-round public competition and cryptanalysis process involving submissions and attempted attacks from cryptographers worldwide — a deliberately open, adversarial vetting process modeled on how NIST previously selected AES.
What hybrid key exchange actually looks like in practice today
Current experimental deployments combine a traditional key exchange algorithm like ECDHE with a post-quantum candidate simultaneously within the same TLS handshake, deriving the actual session key from both combined — meaning the connection remains secure even if one of the two algorithms is later found to be flawed, a cautious, defense-in-depth approach favored during this transitional period.
Why lattice-based cryptography specifically became the leading approach
The selected NIST standards are primarily based on lattice-based cryptography, a mathematical approach believed to remain hard even for quantum computers, chosen after extensive cryptanalysis during NIST's multi-round selection process found lattice-based approaches offered the best balance of security confidence, key size, and computational performance among the various post-quantum candidate approaches submitted.
What organizations with long-term confidentiality needs are already doing
Government agencies, financial institutions, and other organizations handling data with decades-long confidentiality requirements have generally been the earliest to begin piloting post-quantum or hybrid key exchange in production systems, reflecting that their specific threat model, protecting today's data against a future decryption capability, gives them a much more immediate practical incentive than the average website operator currently has.
What ordinary site owners should actually do about this today
For the overwhelming majority of website operators, no action is currently required — post-quantum migration is presently a concern for browser vendors, major CAs, and organizations with unusually long data-confidentiality requirements, with any eventual mainstream requirement expected to arrive gradually and with substantial advance notice, following the same pattern as past major TLS transitions.
Why 'harvest now, decrypt later' specifically changes the urgency calculus for some organizations
The harvest now, decrypt later concern means an organization's actual urgency around post-quantum migration should depend heavily on how long the data it's currently transmitting needs to remain confidential — a website serving public content has essentially no urgency, while an organization transmitting data that must remain secret for decades has a meaningfully different, more pressing risk calculus even though quantum computers capable of the relevant attacks don't yet exist.
A final grounding thought amid genuine uncertainty
While the exact timeline for cryptographically relevant quantum computing remains genuinely uncertain even among experts, the industry's current proactive posture, informed directly by lessons from SHA-1's successful early transition discussed elsewhere in this section, reflects a deliberate choice to prepare well ahead of certainty rather than risk repeating the more reactive patterns that characterized several earlier vulnerabilities in this history.
The industry's early, proactive post-quantum preparation reflects lessons learned directly from SHA-1's successful, similarly proactive transition.