Post-quantum cryptography, Layer 1 encryption, MACsec, quantum key distribution, and photonic layer security each address a different part of the harvest now, decrypt later problem. This comparison shows what a fiber tap still records under each one.
The best protection against harvest now, decrypt later (HNDL) on wide area network (WAN) fiber pairs post-quantum cryptography for the key exchange with a physical-layer control that stops the transmitted signal from being harvested. Encryption makes intercepted traffic unreadable today, and post-quantum key exchange makes it harder to open later. Neither stops an attacker from keeping a copy.
This page compares five defenses by two questions: what does the defense protect, and what does a tap on the fiber still capture?
How Harvest Now, Decrypt Later Works
HNDL is an attack in which encrypted traffic is recorded from WAN fiber today and opened later, once the key exchange behind it can be broken. The key exchange is the handshake where both ends agree on a session key, usually through RSA or elliptic-curve Diffie-Hellman (ECDH).
A future quantum computer running Shor’s algorithm is expected to break that handshake, as Utimaco’s overview of public key cryptography describes. An attacker who recorded both the handshake and the encrypted payload can then recover the session key and read everything that was captured.
How Fiber Gets Tapped
WAN fiber means the long-haul links between sites, cities, and data centers. These links run over infrastructure an organization does not fully control.
Single-mode fiber loses light when it is bent tighter than a radius of roughly 6.5 to 7.5 centimeters, according to Timbercon’s fiber glossary. A clip-on coupler can capture that light. In a 2007 demonstration reported by The Register, a tap recovered a voice call with no added noise on the line.
A tap of this kind causes no outage and no alert. Any defense therefore has to assume the copy exists.
Read more: 3 Mistakes Security Teams Make That Leave Fiber Data Exposed covers where teams most often misjudge fiber exposure.
The Five Defenses and What a Tap Captures
MACsec and IPsec
MACsec and IPsec come built into most routers and switches and encrypt traffic at Layer 2 and the IP layer. They stop anyone from reading exfiltrated data in real time. The tap still copies ciphertext bit for bit.
Optical Layer 1 Encryption
Optical Layer 1 encryption puts the encryptor at the transponder and encrypts all traffic on the wavelength at once, regardless of protocol, with very little added latency. Its keys still come from a key exchange, so the handshake weakness remains until that exchange moves to post-quantum cryptography or quantum key distribution. The tap still records an encrypted waveform.
Post-Quantum Cryptography
Post-quantum cryptography (PQC) replaces RSA and ECDH with quantum-resistant algorithms. The lead algorithm is ML-KEM, which NIST published as FIPS 203 in August 2024. It rolls out through software updates and closes the key-exchange weakness for later sessions. The payload those sessions carry is just as recordable as before.
Quantum Key Distribution
Quantum key distribution (QKD) uses single photons to share keys, so an eavesdropper on the key channel can be detected. The NSA does not recommend QKD for national security systems, and terrestrial fiber QKD is limited to around 100 kilometers. Data encrypted with a QKD key still crosses the fiber as ordinary ciphertext.
Photonic Layer Security
Photonic layer security (PLS) is a category of Layer 1 protection that secures the transmitted optical signal instead of only encrypting the data riding on it. A PLS system spreads the signal across a wide spectral band, applies a continuously changing optical key, and places it below the fiber’s background noise. An attempted tap captures no identifiable signal, so a future key-exchange break has nothing to open.
It is the only category in this comparison where a tap does not record usable ciphertext.
What the Timelines Mean for Traffic Sent Today
A PQC migration is necessary, but traffic sent while it is underway stays exposed. Executive Order 14412 sets December 31, 2030 for post-quantum key establishment on high-value US federal systems and covered contractors.
The Global Risk Institute’s 2025 Quantum Threat Timeline Report puts the odds of a quantum computer that can break today’s key exchange within ten years at 28 to 49 percent.
Algorithm strength is also not fixed once data is captured, and Shor’s algorithm is the precedent for that. Classical cryptanalysis keeps advancing too, and AI-assisted research is now part of that progress. No published result has broken AES-256, which is widely used commercially, but attacks that have broken reduced-round versions of AES-128 are expected to weaken the full AES-256.
How Carmel Compares With Nokia and Adva
CyberRidge builds Carmel as a PLS platform. Nokia and Adva are two established vendors of Layer 1 optical encryption, so they make a fair comparison.
The table below lists how each approach handles protection, key handling, deployment, and what a tap captures on the link.
| Attribute | Carmel (CyberRidge) | Nokia 1830 PSS | Adva ConnectGuard |
|---|---|---|---|
| Protection approach | Photonic layer security on the transmitted signal | AES-256 encrypting transponders | Layer 1 encryption on the FSP 3000 platform |
| Key handling | Continuously changing optical key | Keys distributed from a central security management server | Hybrid key exchange combining McEliece PQC algorithms with Diffie-Hellman |
| What a tap captures | Optical noise | Ciphertext | Ciphertext |
| Deployment | Matched pair of units, one at each end of a link, alongside existing DWDM equipment | Transponder-based, within the optical transport platform | Within the FSP 3000 optical platform |
| Reach | 100 kilometers unamplified; EDFA and Raman compatible for longer spans | Not stated in the sources cited | Not stated in the sources cited |
Sources for the vendor entries: Nokia’s secure optical transport page, Adva’s protected optical transport page, and Lightwave’s report on ConnectGuard.
The read-out is that Nokia and Adva both deliver Layer 1 encryption with key management, and Adva adds a hybrid post-quantum key exchange. The difference is what a tap ends up holding. Under Nokia and Adva it holds ciphertext, and under Carmel it holds optical noise.
Carmel works beneath the cryptography a network already runs, so PQC and MACsec can keep running over a Carmel-protected link. It covers WAN fiber only, not LAN or Wi-Fi traffic.
Matching the Defense to How Long Data Must Stay Private
The right combination depends on how long the data on each WAN link must stay confidential. Short-lived traffic is well served by MACsec or Layer 1 encryption plus a PQC migration on schedule.
Intellectual property, government contracts, and medical records stay sensitive longer than the migration window, so those links need protection against advancing quantum decryption. That is where a PLS layer on the same fiber as the payload makes sense.
A phased rollout of a PLS layer takes about four weeks and runs with no downtime. Critical traffic moves over after validation is demonstrated.
Watch the video on why harvest now, decrypt later puts encrypted fiber data at risk for a short walkthrough of the same problem.
Summary of the Decision
- List the WAN links that carry data which must stay confidential for ten years or more.
- For each link, record what a tap would capture today. For encrypted links the answer is ciphertext.
- Schedule the PQC migration against the Executive Order 14412 dates for any federal exposure.
- For long-lived links, evaluate a PLS layer in addition to PQC.
FAQ
Q: What is harvest now, decrypt later?
A: It is an attack in which encrypted traffic is recorded today and opened later, once the key exchange behind it can be broken by a quantum computer.
Q: Can a fiber optic cable be tapped without anyone noticing?
A: Yes. Bending the cable lets light leak into a clip-on coupler, and the link keeps running with no outage and no alert.
Q: Does post-quantum cryptography stop harvest now, decrypt later attacks?
A: Only partly. PQC protects the key exchange for future sessions, but it does not stop a tap from recording the encrypted payload, and traffic recorded before a migration finishes stays exposed.
Q: Is Layer 1 optical encryption enough to protect fiber from HNDL?
A: No. Layer 1 encryptors apply AES-256 to the payload on the wavelength, but the result is still ciphertext that a tap can copy and store.
Q: What is Carmel and how does it protect fiber?
A: Carmel is a photonic layer security platform from CyberRidge. It spreads the optical signal across a wide band and places it below the fiber’s background noise, so a tap captures no identifiable signal.
Q: Does Carmel replace PQC or MACsec?
A: No. Carmel works beneath the cryptography a network already runs. PQC still handles the key exchange, signatures, and authentication.
Q: How long does it take to deploy Carmel?
A: The standard rollout takes about four weeks in phases. Carmel first runs in parallel with existing traffic, then carries non-critical traffic during validation, and finally carries critical traffic.
Q: Does Carmel protect LAN or Wi-Fi traffic?
A: No. Carmel protects data in transit on WAN fiber only. Traffic inside a building or between personal devices does not cross the exposed spans where HNDL is a risk.