# The Quantum Threat Is Now: Why Post-Quantum Cryptography Starts With Credentials
The era of harvesting encrypted data for future decryption has already begun. As quantum computing advances toward practical viability, organizations face an immediate crisis: data captured today could be decrypted within the next 15 years by attackers who are storing encrypted credentials and communications right now. The target is not tomorrow's data—it's the credentials protecting your organization today.
## The Quantum Threat and Shor's Algorithm
The foundation of modern internet security rests on two assumptions: that factoring large numbers is computationally hard, and that computing discrete logarithms is equally difficult. These assumptions underpin RSA encryption and elliptic curve cryptography (ECC)—the bedrock of public-key cryptography used to establish trust between systems and protect data encryption keys.
In 1994, mathematician Peter Shor proved mathematically that a sufficiently powerful quantum computer could efficiently factor large numbers and solve discrete logarithms. For three decades, this remained theoretical—a future threat with no practical timeline. That has changed.
According to the Global Risk Institute's 2025 Quantum Threat Timeline report, 51-70% of surveyed security specialists now believe a cryptographically relevant quantum computer (CRQC) will be available within 15 years. This shift from theoretical to imminent fundamentally changes the security calculus for any organization handling sensitive data protected by public-key cryptography.
The mathematics is unambiguous:
This distinction matters profoundly: public-key cryptography is what enables two systems to authenticate each other and agree on encryption keys. Once that trust layer is broken, attackers can decrypt everything protected by those keys.
## Harvest Now, Decrypt Later: Why the Future Is Already Here
The timeline becomes urgent with a single tactical realization: an attacker can capture encrypted data today and store it indefinitely, then decrypt it when quantum computers become available. This is not speculation—it is documented practice.
Known as "Harvest Now, Decrypt Later" (HNFL), this strategy transforms quantum computing from a distant threat into an active attack vector. Sophisticated threat actors—state-sponsored groups, criminal syndicates, and espionage networks—are already employing this tactic against high-value targets.
The consequence is stark: any sensitive data intercepted and encrypted with current algorithms should be treated as already exposed. The only variable is the timeline until decryption.
## Why Credentials Carry Exceptional Risk
Not all encrypted data carries equal risk in a post-quantum future. The critical distinction lies in lifespan and persistence:
| Data Type | Typical Lifespan | Quantum Risk |
|-----------|-----------------|-------------|
| Session tokens | Hours to days | Low |
| User passwords | Months to years | Medium |
| API keys | Years to indefinite | CRITICAL |
| Service account credentials | Years to indefinite | CRITICAL |
| TLS certificates | 1-3 years | High |
| Long-term secrets | Indefinite | CRITICAL |
Credentials—particularly machine credentials—represent the highest-value targets for harvest-and-hold attacks. These include:
The problem is compounded by scale. Modern enterprises operate sprawling networks of NHIs, many undocumented, unmanaged, and unrotated. These long-lived secrets are ideal targets for adversaries operating on a 10-15 year timeline. While a session token expires within hours, making harvest-decrypt impractical, a service account credential harvested today could unlock a system for years after Q-day.
## Government Deadlines: The Race to Q-Day
Governments worldwide are setting hard deadlines for cryptographic transition:
NSA Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)
NIST Interagency Report 8547
These deadlines create a cascading urgency. Enterprises require 5-15 years for a complete cryptographic migration—and that assumes they know what cryptography they're using. The discovery and inventory phase alone can consume 1-2 years in large organizations.
The math is unforgiving: If you have not yet begun your quantum migration, your organization is already behind schedule.
## Starting a Credentials-First Migration
Organizations cannot migrate everything simultaneously. The solution is tactical prioritization: begin with credentials.
A credentials-first approach to quantum migration requires the following steps:
1. Inventory Existing Cryptography
- Document all systems using RSA and ECC
- Identify Non-Human Identities and their cryptographic dependencies
- Map credential lifespans and rotation practices
- Classify by exposure and persistence
2. Prioritize Machine Credentials
- Service accounts with system-level access
- API keys for critical integrations
- Database credentials
- Automation and orchestration accounts
3. Rotate and Re-Credential
- Replace long-lived secrets with quantum-resistant alternatives
- Implement shorter rotation windows where possible
- Use asymmetric authentication (keys) over passwords where practical
- Enforce hardware-backed key storage
4. Establish Cryptographic Agility
- Build systems capable of supporting multiple cryptographic algorithms simultaneously
- Enable seamless algorithm substitution as standards mature
- Test failover and rollback procedures
5. Plan for Legacy Systems
- Identify systems that cannot be easily updated
- Develop bridging strategies and lifecycle plans
- Assess third-party dependencies and vendor timelines
## Technical Landscape: Post-Quantum Standards
NIST has standardized post-quantum cryptographic algorithms, with implementations already available:
These algorithms are not theoretical—they are production-ready and increasingly integrated into cryptographic libraries and enterprise infrastructure.
---
## HackWire Analysis
The quantum threat is often presented as a future problem requiring future solutions. This framing is dangerous and wrong.
The "Harvest Now, Decrypt Later" tactic makes current data a present-day target. An adversary capturing your API credentials today—through a supply chain compromise, a data breach, or even passive interception—can hold that encrypted material for a decade, then decrypt it when quantum computers arrive. By that time, the service account may still be active, the secrets still valid, the damage already done.
What makes this urgent is the 5-15 year migration timeline. Organizations that delay starting their quantum migration now will find themselves unable to complete it before 2030-2035 deadlines arrive. Government contractors, financial institutions, and healthcare providers will face regulatory penalties. Others will simply miss the window entirely, operating with deprecated cryptography in an era when quantum decryption is practical.
The real-world impact is not speculative. An attacker need not wait for quantum computers to exploit this gap—they simply need to trust that the timeline works in their favor. This is already happening. State-sponsored groups are actively collecting encrypted communications, harvesting credentials, and storing them. Threat actors understand the math.
The credentials-first approach is strategically sound because it reflects threat reality: your machine credentials are your highest-value targets, they persist longest, and they unlock the deepest access. Start there. Inventory your NHIs, rotate your long-lived secrets, and plan for quantum-resistant alternatives. The attacks targeting today's data are already underway. Your migration must catch up.
— HackWire Editorial
---
## Related Coverage