If a thief steals your locked safe today knowing they cannot crack the dial for another five years, did they rob you right now, or will they rob you later?
I argue they already took the money. Spies call this asymmetric trick "Harvest Now, Decrypt Later." Hostile groups scoop up mountains of scrambled government and corporate chatter every day, dumping petabytes of unreadable noise into cold storage. They cannot read your grocery list today, let alone your diplomatic cables.
But they do not care. They sit and wait for a machine with enough quantum muscle to turn all that ancient scrambled gibberish back into plain text. This is not some wild sci-fi scenario.
Back on February 1, 1943, the U.S. Army Signal Intelligence Service launched Project VENONA.
They spent decades patiently picking apart Soviet messages because Moscow made the lazy mistake of reusing one-time pads. In 1940 at Bletchley Park, Alan Turing and his crew built clattering electromechanical Bombes to crush the German Enigma cipher.
The lesson is simple and ruthless: static ciphers always fall when better math meets newer hardware.
So, what breaks our modern locks? The weird physics of superposition and entanglement. On November 20, 1994, Bell Labs mathematician Peter Shor dropped Shor’s algorithm on the world.
He proved that a quantum computer can find discrete logarithms and factor giant composite numbers in polynomial time. That sounds academic until you realize that basic math puzzle holds up almost every bank transfer, email login, and military handshake on the planet.
To make matters sharper, on May 23, 2019, Craig Gidney from Google and Martin Ekerå from KTH Royal Institute of Technology calculated the real cost of cracking 2,048-bit RSA keys. Their answer?
Around twenty million noisy physical qubits running surface-code error correction could tear down that math in about eight hours.
Our favorite public-key math has an expiration date, written down in pencil.
Do we pack our bags and give up? Absolutely not! The fix is already here, even if it brings its own messy luggage. On August 13, 2024, the National Institute of Standards and Technology in Gaithersburg, Maryland, led by mathematician Dustin Moody, published the world's official post-quantum standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).
Good news: the lattice math inside ML-KEM-768 keeps quantum snoops out. Bad news: it is delightfully chubby.
Classic X25519 elliptic-curve key swaps zip across the wire with tidy 32-byte public keys. ML-KEM-768 demands an 1,184-byte public key and an 1,088-byte ciphertext.
That is a thirty-fold jump in size! Shove those giant parameters into standard network packets with a 1,500-byte maximum transmission unit, and your routers start coughing.
Packets fragment.
Handshakes stall.
Latency creeps up. You cannot just swap these algorithms in like fresh AA batteries and walk away whistling.
That brings us to the real fight: crypto-agility. How do you feed giant new keys to existing networks without chucking millions of dollars of perfectly functional routers straight into a dumpster? You cheat the pipes.
You decouple the key delivery from the data payload.
Bethesda-based Quantum XChange built their Phio TX architecture around this exact realization.
Instead of forcing fat post-quantum keys through the same cramped, in-band channels as your live web traffic, their system routes symmetric keys out-of-band across a dedicated control plane.
It hands fresh keys directly to standard IPsec and MACsec encryptors.
That means zero packet bloat, zero fragmentation tantrums, and zero rip-and-replace headaches.
Engineers can mix quantum random number generation, shiny new NIST standards, and classic pre-shared keys all in one soup. If an algorithm cracks tomorrow, you swap it out in software without disturbing a single fiber strand.
Uncle Sam is finally taking notice, and the timeline is moving fast. Former National Cyber Director Chris Inglis helped lay the groundwork for National Security Memorandum 10 (NSM-10), issued on May 4, 2022, which ordered agencies to systematically prepare for quantum-resistant crypto. Congress backed that up on December 21, 2022, by signing the Quantum Computing Cybersecurity Preparedness Act into law (Public Law 117-260).
Then the Office of Management and Budget landed Memorandum M-23-02 on November 18, 2022, requiring agencies to build running inventories of their vulnerable cryptographic systems to set up zero-trust defenses through 2030 and 2035. The math works, the standards exist, and the tools are ready.
All we have to do now is roll up our sleeves and deploy them before the other side boots up their machines.
Have thoughts on this article?
Send your feedback. Spotted a factual error or typo? Use this form to let us know. We use your feedback to improve our reporting. Thank you!
