What Is Harvest Now, Decrypt Later (HNDL)?

Why do hackers steal encrypted data they can’t read?

Because even if it takes a decade to decrypt, that data will be valuable someday. That’s the premise behind harvest now, decrypt later (HNDL), a type of cyberattack in which bad actors capture encrypted traffic, store it, and wait for the day when quantum computers can break the encryption protecting it.

Most coverage of harvest now, decrypt later focuses on static data: files, emails, and financial records. But another type of traffic is just as sensitive, and often less protected: network authentication traffic. If hackers intercept network traffic and expose credentials, they can make dangerous lateral moves that compromise your entire organization.

In this article, we’ll explore HNDL in more detail, including what it is, how it works, and why it matters now. We’ll also share who’s most at risk, why authentication security deserves your attention, and how to protect your organization.

What Is Harvest Now, Decrypt Later?

Harvest now, decrypt later is an attack strategy in which bad actors intercept and store encrypted data that’s currently unreadable, knowing that future quantum computing breakthroughs will allow them to unlock it eventually.

HNDL attacks commonly target long-lived sensitive data, including financial data, medical records, and government documents.

Note: This is more than a theoretical future threat: HNDL attacks are happening now, and quantum attacks will break modern encryption standards within a matter of years.

How Harvest Now, Decrypt Later Attacks Work

HNDL follows a simple three-step sequence:

1. Harvest: Bad actors intercept encrypted traffic, often at a network chokepoint, an internet exchange or an access point (AP).
2. Store: Since they can’t break the encryption yet, attackers store the captured ciphertext and wait.
3. Decrypt: Once quantum computing advances enough to break current encryption standards, attackers will decrypt the traffic and data, mining for credentials, intellectual property, and sensitive data in personal and professional accounts.

The key to HNDL attacks is patience, because encrypted data remains unreadable until quantum computing advances. But if attackers simply store the data and wait, their patience will likely be rewarded.

Governments have already taken the quantum computing threat seriously — and have been doing so for years.

Current Regulatory Standards for Post-Quantum Cryptography

In September 2022, the National Security Agency (NSA) published the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). It requires traditional networking equipment to run on quantum-resistant algorithms by 2030. Browsers, cloud services, and operating systems must follow by 2033.

In August 2023, the NSA, the Cybersecurity and Infrastructure Security Agency (CISA), and the National Institute of Standards and Technology (NIST) issued a joint advisory urging organizations to start migrating to post-quantum cryptography (PQC) immediately.

Finally, in August 2024, NIST released three official encryption standards:

• FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)
• FIPS 204, Module-Lattice-Based Digital Signature Standard (ML-DSA)
• FIPS 205, Stateless Hash-Based Digital Signature Algorithm (SLH-DSA)

These post-quantum cryptography standards included code, instructions, and intended uses. Upon publishing, NIST warned that quantum computing could break current encryption methods within a decade, so organizations should implement these standards immediately.

Because of the rapid approach of quantum threats, governments will continue to develop new standards and initiatives at an equally rapid pace.

Why Harvest Now, Decrypt Later Matters Right Now

Although hackers can’t decrypt sensitive encrypted data yet, they’re already stealing it. Further, security systems don’t always detect silent network interceptions, especially when data remains locked. That means hackers can intercept encrypted data without your knowledge — and once they steal it, you have no control over what they do with it.

Note: Even though hackers don’t get immediate value from stolen data today, it’s vital to stop HNDL attacks now.

What’s more, there are three specific forces currently accelerating the threat of quantum computing advancements.

The first force is mathematics. The quantum algorithm to break encryption already exists. Published in 1994, Shor’s algorithm solves both integer factorization and the discrete logarithm problem in polynomial time, which breaks Rivest-Shamir-Adleman (RSA) encryption and elliptic-curve cryptography (ECC). The only thing preventing this is the lack of a sufficiently powerful quantum computer to run the algorithm. But that’s coming sooner than you think.

The second force is standards momentum. Since the launch of CNSA 2.0 in 2022, governments have steadily released new guidelines, standards, and post-quantum encryption algorithms designed to protect data from quantum threats. NIST’s draft transition roadmap, IR 8547, proposes deprecating 112-bit-strength RSA and elliptic-curve cryptography after 2030 and disallowing all quantum-vulnerable signature and key-establishment schemes after 2035. The European Quantum Act is in progress now through 2027, and in the United States, recent executive orders, if upheld, require federal agencies to act now.

The third force is automation. Already, AI agents can sit at the network edge and continuously intercept sessions. As agentic AI advances, HNDL attacks will harvest and store massive quantities of sensitive network traffic, waiting patiently for the payout from future quantum hardware advancements.

Who and What Is at Risk?

HNDL attacks seek data that will still be valuable years from now. Primary targets include:

• Government networks and defense: Strict regulations require encrypted communications and supply-chain data to stay confidential for decades. HNDL compromises government communications, diplomatic communications, and other sensitive data.
• Financial services: Bad actors can derive significant strategic value from years-old transaction records, long-term contracts, and forgotten or unchanged credentials.
• Healthcare: Patient data is highly sensitive and strictly regulated, with lifelong value for hackers and serious implications for affected healthcare organizations.
• Telecommunications: Telecom infrastructure is an ideal opportunity for bad actors to intercept enormous volumes of usable traffic.

But one risk factor is industry-agnostic. All organizations that authenticate users over network connections, including Wi-Fi, virtual private networks (VPNs), and Remote Authentication Dial-In User Service (RADIUS), are vulnerable to HNDL attacks.

Authentication: The Lesser-Known Target of HNDL Attacks

Every time a device joins a network connection, like Wi-Fi or a VPN, the authentication process requires an exchange of information. If intercepted, hackers don’t just get sensitive data — they can harvest credentials, too.

RADIUS leverages User Datagram Protocol (UDP) via port 1812, with roughly a 4,096-byte packet ceiling. Once quantum decryption arrives, hackers can intercept RADIUS sessions protected by older cipher suites. TLS 1.3 removes the static RSA and Diffie-Hellman key exchange mechanisms that made earlier sessions decryptable.

Password-based authentication is still extremely vulnerable. Once hackers can harvest both session data and credentials, an exposed password (for example, an Active Directory password) could allow lateral movement across applications. Organizations can avoid this quantum threat with certificate-based methods such as 802.1X authentication with Extensible Authentication Protocol-Transport Layer Security (EAP-TLS).

Even post-quantum certificates pose challenges for secure authentication. With RSA, certificates and key chains are roughly 4 KB. But with ML-DSA, that rises to 22 KB — far more than legacy RADIUS was designed to carry. Oversized handshakes can easily fragment, and a single lost fragment can break authentication. RADIUS over TLS (RadSec) encrypts the RADIUS client-to-server channel and, with the RFC 7930 extension, lifts the RADIUS message limit from 4,096 to 65,535 octets so oversized post-quantum handshakes fit without fragmenting.

Credential harvesting is a serious future threat, but EAP-TLS, RadSec, and post-quantum algorithms provide the foundation for stronger protection against it.

How to Protect Encrypted Data From HNDL Attacks

No single fix closes every gap. For practical HNDL protection, follow these best practices:

1. Inventory your cryptography: Many organizations find outdated standards such as RSA-2048, or even old SHA-1, still running somewhere.
2. Move authentication off UDP: UDP creates packet-size ceilings and other security concerns; RadSec is the modern solution.
3. Standardize on TLS 1.3 with hybrid post-quantum key exchange: Older TLS 1.1 and 1.2 cipher suites leave harvested sessions exposed, and TLS 1.3 on its own still relies on a classical key exchange, so enable a hybrid group such as X25519MLKEM768 to keep recorded sessions safe.
4. Replace passwords with certificates: With EAP-TLS, there are no reusable secrets or exposed credentials.
5. Build in crypto agility: Crypto agility, the ability to replace cryptographic algorithms without disrupting live systems, will keep you protected when post-quantum cryptography continuously deprecates algorithms.
6. Adopt standards before mandated deadlines: Current standards offer protection now. With the looming threat of Q-Day (the future day quantum attacks break encryption), there’s no reason to wait.
7. Communicate with third-party vendors: Post-quantum cryptography preparations are incomplete without buy-in from your vendors and partners. Make sure they’re committed to addressing quantum threats with post-quantum cryptographic algorithms.

Move to Quantum-Safe Network Authentication Now

Most attention to post-quantum cryptography goes toward encryption and signing. While that’s important, don’t ignore authentication, the element that connects a harvestable session to your network.

To improve authentication without a massive infrastructure overhaul, you need two key elements:

• A RADIUS path that can withstand post-quantum handshakes
• A public key infrastructure (PKI) that safely issues the certificates behind it

JoinNow Cloud RADIUS uses secure RADIUS communication to protect authentication traffic between the network and authentication server. JoinNow Dynamic PKI issues protected certificates, not passwords, which protects Active Directory secrets that could be used for lateral movement. And the JoinNow Platform already supports PQC enrollment, allowing you to issue certificates protected with quantum-resistant algorithms today.

Together, Cloud RADIUS and Dynamic PKI build a network authentication path that protects you from current and post-quantum harvesting and decryption.

Schedule a demo to see how quantum-safe network authentication fits your existing infrastructure.

---

Frequently Asked Questions

Is harvest now, decrypt later happening right now?

Yes. HNDL attacks are a current threat because they don't require a working quantum computer; hackers can harvest and store data now, then decrypt later. That's why government advisories urge organizations to adopt post-quantum cryptography standards now — before quantum computers arrive.

How long until quantum computers break encryption?

Most experts estimate that cryptographically relevant quantum computers (CRQCs) could break public key cryptography between 2030 and 2035, in an event known as Q-Day (Quantum Day), the Quantum Apocalypse, or Y2Q (a reference to Y2K). However, since HNDL attacks already harvest data that quantum computers could soon exploit, organizations should prepare now.

Can I protect data that’s already been harvested?

No. Once traffic is captured, it's stored as-is for later use. You cannot retroactively strengthen the encryption that protected it. The best way to protect your data is to prevent the HNDL attacks that intercept and harvest data. Move sensitive sessions onto protocols and infrastructure that can carry post-quantum cryptography: RADIUS over TLS (RadSec), TLS 1.3 negotiated with a hybrid post-quantum group such as X25519MLKEM768, and a PKI that can issue post-quantum certificates for certificate-based authentication.

How is HNDL different from a normal data breach?

In a typical breach, security systems discover the infiltration, reset accounts, and patch vulnerabilities. But with HNDL, many organizations never discover the breach because the data remains locked behind advanced encryption. Since hackers can't meaningfully use the encrypted traffic or data until quantum computing breaks modern encryption, HNDL exposures can remain hidden for years.

What encryption protects against harvest now, decrypt later?

Transport Layer Security 1.3 (TLS 1.3) paired with a post-quantum key exchange is the strongest defense available today. TLS 1.3 removes the static key-exchange methods that allowed post-capture decryption of older sessions, but its classical elliptic-curve key exchange is still quantum-vulnerable — NIST's finalized Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) standard, FIPS 203, is what makes a recorded handshake resistant to future decryption.