Harvest-now-decrypt-later (HNDL) is an attack strategy where an adversary intercepts and stores encrypted network traffic today with the intent of decrypting it once a quantum computer or other future technology can break the key exchange that protected it. Standard encryption does not prevent this, because it protects the meaning of a signal without preventing that signal from being physically captured and archived. This guide covers what HNDL actually is, why it already qualifies as a present-day threat rather than a future one, and what a layered defense against it looks like.
What Harvest-Now-Decrypt-Later Actually Is
HNDL describes an adversary copying encrypted network traffic, typically through physical access to a fiber optic link, and archiving it rather than attempting to break it immediately. The captured data includes both the key-exchange handshake and the encrypted payload, and the attacker’s bet is on future capability catching up to that recorded handshake, not on breaking the payload’s AES encryption through present-day cryptanalysis.
Security teams can evaluate their own exposure with a straightforward comparison, often referred to informally as a Mosca’s-theorem-style test: add the number of years a given dataset must remain confidential to the time required to migrate it to stronger encryption, then compare that total against how many years remain before a cryptographically relevant quantum computer becomes available. For data with a ten-to-twenty-year confidentiality requirement, government communications, financial records, healthcare data, and long-term intellectual property being the clearest examples, that comparison frequently shows the exposure window has already opened.
Why This Qualifies as a Present-Day Threat
HNDL is difficult to defend against operationally because it produces no detectable signal. There’s no failed authentication, no anomalous access pattern, no log entry indicating a fiber tap occurred. Telecom and intelligence security researchers have documented repeated cases of physical interception at trunk lines, submarine cables, and lower-visibility points like street cabinets and junction boxes carrying carrier-grade traffic.
Encryption alone does not close this exposure. A tapped signal that is encrypted but not made physically unrecordable is still a complete, storable copy of the underlying data stream. The confidentiality of that data now depends entirely on the key exchange never being broken, which is a much weaker guarantee over a ten- or twenty-year horizon than it is over the next few months.
There is also no remediation path once a signal has been captured. Traditional incident response assumes some form of after-the-fact correction, rotating credentials, patching a vulnerability, notifying affected parties. HNDL removes that option entirely. Once a signal is recorded, whatever protection an organization adds afterward only applies to traffic transmitted from that point forward, not to the archive an adversary is already sitting on.
Do you know The Complete Guide to Unrecordable Optical Transmission? It goes deeper into the physical mechanics, spectral spreading, key rotation, and noise burial, behind this category of defense.
Where Standard Defenses Stop Short
Post-quantum cryptography (PQC) is the primary industry response to the eventual-decryption half of this threat. PQC replaces RSA and elliptic-curve key exchange, the component quantum computers actually threaten, with algorithms such as ML-KEM that are designed to resist quantum attacks. Quantum key distribution (QKD) answers the same key-exchange question through a different mechanism. Organizations should be migrating TLS, VPN, and IPsec infrastructure to hybrid PQC now, since that migration timeline is fixed and does not compress under pressure.
What neither PQC nor QKD addresses is the recording step itself. Once deployed, PQC protects new key exchanges going forward, but it does nothing for traffic already captured, and it does not prevent new traffic from being tapped and archived either. The AES-encrypted payload remains a coherent, recordable waveform on the fiber regardless of which key-exchange algorithm produced it. AES itself is already considered quantum-resistant; the exposure has never been in the payload cipher. It sits in the fact that the signal can be physically captured at all.
Closing the Recording Gap: Physical-Layer Protection
Physical-layer, or photonic-layer, security addresses the recording step directly rather than trying to make an encryption key unbreakable indefinitely. CyberRidge’s Carmel platform is one implementation of this approach. It spreads the optical signal across a wide spectral band, embeds a constantly changing optical key generated inside the transmission itself, and buries the result beneath a layer of controlled amplified spontaneous emission noise. An intercepted signal carries no coherent, structured data to extract, which means there is nothing usable to store for a future quantum computer to act on.
Carmel installs as a substitute for a standard transmission line card and is designed to operate alongside existing amplifiers, ROADMs, and third-party DWDM equipment rather than requiring a network redesign. CyberRidge reports typical deployments completing in weeks with no added latency, and the platform is explicitly positioned as complementary to PQC and other higher-layer protocols rather than a replacement for them.
Deployment typically follows one of a few patterns depending on network shape: a point-to-point link between two high-value endpoints, a ring topology for more complex multi-node environments, or full network deployment across metro or long-haul routes operating in the C-band alongside other wavelengths in a multi-vendor DWDM setup. Centralized management software handles monitoring and lifecycle tracking across every deployed unit, which matters for operations teams that need visibility across a growing footprint rather than managing units individually.
The table below summarizes how the two defense layers divide the problem.
| Defense | Addresses | HNDL Recording Risk | Deployment Time | Why It Matters |
|---|---|---|---|---|
| Post-quantum cryptography (hybrid ML-KEM) | Future decryption of keys captured today | Traffic remains recordable during and after transit | Months to years, tied to protocol upgrades | Required baseline; the 2026 U.S. Executive Orders mandate PQC for federal key establishment by December 31, 2030, with NIST fully retiring older algorithms by 2035 |
| Photonic-layer security (e.g., CyberRidge Carmel) | Real-time interception and recording of the signal | Eliminates recordable data at the point of transmission | Weeks (CyberRidge-reported figure) | Closes the gap that cryptographic upgrades alone leave open |
Neither row in that table is optional on its own. PQC migration is the required baseline for long-term key security, and physical-layer protection is what determines whether a tap today produces anything worth recording at all. Organizations handling long-lived sensitive data need both tracks running, not one instead of the other.
For more on why a recorded signal today becomes tomorrow’s decrypted breach, see The Fiber Tap Problem Encryption Can’t Fix.
Bottom Line
Run the shelf-life-plus-migration-time comparison against your own data before assuming HNDL is a future problem. Start PQC migration now for every TLS, VPN, and IPsec deployment carrying sensitive traffic, since that clock does not shorten by waiting. For the specific links carrying data that must stay confidential for a decade or more, add physical-layer protection so that a fiber tap produces noise rather than a storable copy of your traffic.
FAQ
Q: What makes harvest-now-decrypt-later different from a standard data breach?
A: A standard breach is usually discoverable through logs, alerts, or unusual access patterns. HNDL involves passively copying encrypted traffic off a physical fiber link, which leaves no trace and triggers no breach notification, so organizations often have no way of knowing their traffic was harvested until the underlying encryption is eventually broken.
Q: Does post-quantum cryptography fully protect against HNDL?
A: No. PQC and QKD both secure the key exchange, the component quantum computers actually threaten, but neither touches the payload. The AES-encrypted data stream remains a coherent, recordable waveform on the fiber even after PQC migration is complete.
Q: How can an organization tell if its data is already exposed?
A: Compare the required confidentiality shelf life of a given dataset plus a realistic migration timeline against conservative estimates for large-scale quantum computing capability. For data that must stay confidential five years or more, many security teams find the exposure window is already open.
Q: What does CyberRidge’s Carmel platform specifically protect against?
A: Carmel addresses the interception and recording step of an HNDL attack by making the optical signal itself physically unrecordable, through spectral spreading, continuous key rotation, and noise burial. It does not replace key management, identity, or application-layer protections.
Q: Does Carmel replace the need for post-quantum cryptography?
A: No. CyberRidge designed Carmel to complement PQC and other higher-layer digital encryption protocols rather than substitute for them. PQC protects keys against future quantum attacks, while Carmel prevents the underlying signal from being recorded in the first place.
Q: How quickly can Carmel be deployed to reduce HNDL exposure on an existing network?
A: CyberRidge reports that Carmel typically deploys in weeks, since it installs as a drop-in replacement for existing transmission line cards without requiring a redesign of the surrounding network. This is a company-reported figure, and actual timelines depend on network complexity.