NIST Finalises Post-Quantum Standards to Counter Harvest-Now-Decrypt-Later Threats

Organisations managing long-term sensitive data face an immediate security threat from “harvest-now-decrypt-later” (HNDL) tactics. Adversaries are reportedly capturing encrypted communications today to decrypt them retroactively once cryptographically relevant quantum computers become available.

While a functional quantum computer capable of breaking current encryption may be years away, the risk to data with long confidentiality requirements—such as medical records, trade secrets, or classified government material—is already present. Once ciphertext is captured and stored, its security is entirely dependent on the future resilience of the underlying algorithm.

NIST Finalises Post-Quantum Standards

The National Institute of Standards and Technology (NIST) has moved to address these vulnerabilities by finalising three Federal Information Processing Standards (FIPS). These standards include ML-KEM for key encapsulation, and ML-DSA and SLH-DSA for digital signatures, providing two different mathematical approaches to ensure cryptographic diversity.

A fourth standard, FN-DSA, based on the FALCON algorithm, is expected to be released later this year. These developments provide the formal framework required for organisations to begin their transition away from quantum-vulnerable algorithms.

The transition timeline is increasingly urgent. According to NIST, RSA-2048 and ECC P-256 are scheduled for deprecation by 2030, with a complete removal from NIST standards by 2035.

Global Regulatory Timelines

National security and defence sectors are facing even tighter windows. The US National Security Agency (NSA) requires national security systems to adopt quantum-resistant cryptography for all new acquisitions starting in 2027.

In the United Kingdom, the National Cyber Security Centre (NCSC) has outlined a three-phase transition structure. This involves identifying cryptographic services and building migration plans through 2028, executing high-priority upgrades between 2028 and 2031, and completing full migration across all systems by 2035.

Calculating Exposure with Mosca’s Theorem

To determine the urgency of migration, security professionals often use a framework known as Mosca’s theorem. This method weighs three critical variables: the time required for migration (X), the duration for which data must remain confidential (Y), and the estimated time until a cryptographically relevant quantum computer exists (Z).

If the sum of migration time and data shelf life (X + Y) exceeds the time until a quantum threat arrives (Z), the organisation is already exposed. For sectors like healthcare or finance, where data must remain protected for decades, the risk of HNDL is often already realised.

Transitioning to Crypto-Agility

Effective migration requires more than simply updating individual algorithms. Experts suggest that the primary architectural goal should be “crypto-agility”—the ability to swap cryptographic algorithms without rebuilding entire infrastructure components.

The migration process should begin with a comprehensive cryptographic discovery phase to inventory where vulnerable algorithms like RSA and ECC are currently utilised. These may be embedded in TLS configurations, VPN tunnels, code signing processes, or third-party libraries that an organisation does not directly control.

Prioritisation should be based on data sensitivity and exposure time rather than implementation ease. Systems holding data with multi-decade confidentiality requirements, alongside public-facing TLS endpoints, should be the primary focus for early remediation. Organisations are also advised to begin requesting post-quantum cryptography (PQC) roadmaps from all critical vendors to avoid unforeseen dependencies during the transition.