💻 computer science

On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks

This paper reframes Harvest-Now, Decrypt-Later attacks as an economic challenge, demonstrating through a testbed that while archiving intercepted traffic is trivial, defenders can effectively raise the adversary's decryption costs by optimizing protocol configurations like rekeying and key size selection, rather than solely relying on post-quantum migration.

Original authors: Javier Blanco-Romero, Florina Almenares Mendoza, Carlos García Rubio, Celeste Campo, Daniel Díaz Sánchez

Published 2026-03-03

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Javier Blanco-Romero, Florina Almenares Mendoza, Carlos García Rubio, Celeste Campo, Daniel Díaz Sánchez

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are sending a secret letter to a friend today. You lock it in a strong box (encryption) that only your friend's key can open.

The "Harvest-Now, Decrypt-Later" (HN-DL) Attack is a scenario where a spy (the adversary) steals your locked box today, but they don't have the key yet. They just put the box in a giant warehouse and wait. They are betting that in 10 or 20 years, they will invent a "Master Key" (a quantum computer) that can open any box, no matter how strong.

This paper asks a very practical question: Is it actually worth it for the spy to fill up their warehouse with your locked boxes?

Here is the breakdown of the paper's findings, explained with everyday analogies:

1. The Warehouse is Cheap (Storage is Trivial)

The paper's biggest surprise is that storage is cheap.

The Analogy: Imagine the spy wants to steal every email, video call, and bank transaction ever made. In the past, storing that much data would have cost billions of dollars. But today, hard drives and magnetic tapes are so cheap that filling a warehouse with the entire internet's traffic is like buying a few extra boxes of cereal.
The Finding: The authors calculated that even if a government wanted to save 1% of all global internet traffic for 10 years, it would cost them about $10 billion. While that sounds like a lot of money, for a major nation-state, it's a manageable expense.
The Conclusion: The spy doesn't need to be smart about what they steal; they can just steal everything because the "warehouse rent" is too low to stop them.

2. The Real Cost is the "Master Key" (Computation is Hard)

Since the warehouse is cheap, the spy's real problem is the Master Key.

The Analogy: Imagine the spy has a warehouse full of 1 million locked boxes. They have a machine (the quantum computer) that can open one box in an hour. But if they have to open 1 million boxes, that machine will take 1 million hours to run.
The Finding: The paper shows that the spy's cost isn't the storage; it's the time and energy needed to break the locks later.
The Defense: If you can make the spy open more locks for every single conversation, you make the attack too expensive to be worth it.

3. How to Make the Spy's Job Harder (The Defense Strategies)

The paper suggests three ways to make the spy's life miserable, using two different "axes" of defense:

A. The "Confusing Label" Strategy (Encrypted Client Hello)

The Problem: Usually, when you start a connection, your computer shouts out your destination (e.g., "I am talking to health-records.gov") in plain text. The spy sees this and decides, "Oh, that's valuable, I'll save that box."
The Fix: Encrypted Client Hello (ECH) hides the destination. It's like putting the address label inside a sealed envelope that only the post office can read.
The Result: The spy can no longer easily pick out the "valuable" boxes. They have to save everything (bulk collection), which is even more expensive and messy for them.

B. The "Changing Locks" Strategy (Rekeying)

The Problem: In many systems (like TLS 1.3), once the spy breaks the first lock (the initial handshake), they can open every box in that entire conversation. It's like having one master key that opens every room in a hotel.
The Fix: Rekeying is like changing the locks on the doors every few minutes while you are still inside the room.
The Result: If the spy breaks the first lock, they can only open the first few minutes of the conversation. To get the rest, they have to use their expensive "Master Key" machine again and again.
The Catch: The paper found that SSH (a protocol used for remote servers) already does this well. But TLS 1.3 (used for most websites) and QUIC (used by Google/Cloudflare) do not do this yet. They only change the lock once at the start. The paper argues we need to update these protocols to change locks mid-stream, forcing the spy to pay the "computation tax" over and over.

C. The "Filling the Box with Air" Strategy (Padding)

The Idea: You could try to make the boxes bigger by stuffing them with fake air (padding) so the spy has to store more junk.
The Problem: This is a bad idea. If you make the box bigger, you (the defender) have to pay for the extra space to ship it across the internet. The spy just pays for the warehouse, which is cheap.
The Verdict: This hurts you more than it hurts them. It's like trying to stop a thief by making your house bigger; the thief just pays a little more rent, but you pay for the construction.

4. The Big Takeaway

The paper concludes that we are in a race against time.

The Past: We used to think, "If we encrypt it, it's safe."
The Reality: If the data is sensitive for a long time (like medical records, state secrets, or financial data), it is already compromised. The spy is likely already hoarding the encrypted data, waiting for their quantum computer to arrive.
The Solution: We cannot just "wait" for new quantum-proof technology. We must immediately:
1. Stop using old, weak locks (like TLS 1.2 with RSA).
2. Start using "changing locks" (rekeying) to force the spy to do more math.
3. Migrate to Post-Quantum Cryptography (new types of locks that even quantum computers can't break).

In short: The spy can afford to buy the warehouse. The only thing that stops them is if we make the math required to open the boxes so difficult and repetitive that it becomes too expensive for them to bother. We need to stop giving them "one key to rule them all" and start giving them a million different keys to break.

1. Problem Statement

The paper addresses the Harvest-Now, Decrypt-Later (HN-DL) threat, where adversaries intercept and archive encrypted communications today, intending to decrypt them once Cryptographically Relevant Quantum Computers (CRQCs) become available.

The Core Question: While the cryptographic vulnerability (Shor's algorithm breaking RSA/ECC) is well-known, the economic feasibility of mass archiving encrypted traffic has not been rigorously quantified.
The Gap: Existing models (e.g., Mosca's inequality) focus on timelines but lack a quantitative framework for the adversary's operational costs (storage and computation) across different protocols (TLS 1.2, TLS 1.3, QUIC, SSH).
The Premise: The authors argue that storage costs have collapsed, making the "Harvest" phase economically trivial for state actors. The defensive challenge has shifted from "can they store it?" to "how much will it cost them to decrypt it?"

2. Methodology

The authors developed a comprehensive, open-source simulation pipeline to model the HN-DL attack lifecycle:

Testbed Construction: A Python orchestrator using patched OpenSSL 3.6.0, OpenSSH 9.9p2, and tshark to generate and capture traffic over a loopback interface. This eliminates network noise (packet loss, retransmissions) to establish a strict lower bound on storage requirements.
Attack Simulation: The system simulates a quantum adversary by extracting ephemeral private keys (solving the Elliptic Curve Discrete Logarithm Problem) and using them to retroactively derive all session keys and decrypt application data.
Cost Modeling:
- Storage Model: A byte-level accounting model ( $S(P)$ ) calculating the storage footprint based on handshake overhead, framing penalties, and transport headers.
- Economic Simulation: A Monte Carlo simulation ( $N=10,000$ draws) incorporating log-normal payload distributions, variable storage costs (cloud vs. tape), and traffic growth rates to project long-term retention costs over 5–15 years.
- Defense Evaluation: Analyzing protocol configurations (rekeying, key sizes, padding) to determine their impact on the adversary's cost axes: Storage Overhead ( $\alpha$ ) and Quantum Workload ( $E \times T_q$ ).

3. Key Contributions

Economic Reframing: The paper reframes HN-DL as an economic problem, demonstrating that for state-level actors, the cost of storing petabyte-scale archives is negligible compared to the computational cost of future decryption.
Protocol-Specific Vulnerability Taxonomy: The authors provide a detailed breakdown of how different protocols handle forward secrecy and key derivation, identifying specific failure modes:
- TLS 1.2 (RSA): Single key compromise exposes all sessions.
- TLS 1.3 & QUIC: Forward secrecy protects against single key compromise, but the deterministic KeyUpdate chain means breaking one session's ECDHE exposes all subsequent 0-RTT and pure-PSK resumption sessions.
- SSH: Supports true in-band rekeying, isolating sessions into independent quantum problems.
Quantification of Defense Strategies:
- Storage Inflation ( $\alpha$ ): Analyzed record padding. Found that while padding increases storage, it penalizes the defender (bandwidth costs) and the adversary equally, making it a weak defense.
- Quantum Friction ( $E \times T_q$ ): Analyzed rekeying and key size. Found that increasing the frequency of Diffie-Hellman exchanges (rekeying) or using larger parameters multiplies the quantum work required ( $E$ ) with negligible bandwidth overhead, making this the most effective defense.
Open-Source Artifacts: Release of a simulation pipeline that reproduces the full attack sequence against TLS 1.2, TLS 1.3, QUIC, and SSH.

4. Key Results

Storage is Trivial: Even under conservative commercial cloud pricing ($12.16/TB-year), storing a 1% selective harvest of global encrypted traffic costs approximately $1.1 billion annually. For state actors using dedicated tape libraries (LTO-9), costs are even lower (CapEx only, ~$5.25/TB).
Protocol Overhead ( $\alpha$ ):
- For large transfers, the overhead ratio $\alpha$ converges to $\approx 1.03$ (TLS/SSH) or $1.05$ (QUIC).
- For small, high-value sessions (e.g., API calls, credentials), $\alpha$ can be as high as $3.9\times$ (SSH) or $8.5\times$ , but these represent a tiny fraction of total volume.
The Quantum Cost Multiplier ( $E$ ):
- TLS 1.3/QUIC: Currently limited to $E=1$ for the duration of a connection because KeyUpdate is deterministic. Breaking the initial handshake breaks the entire session.
- SSH: Supports mid-stream rekeying. A 64 KB rekey interval on a 5 MB session forces the adversary to solve 37 independent quantum problems ( $E=37$ ), extending decryption time from hours to days.
- Rekeying Efficiency: SSH rekeying imposes a negligible storage penalty (~2.1% for a 5 MB session) while linearly scaling the quantum workload.
ECH Impact: Encrypted Client Hello (ECH) forces adversaries to abandon cheap metadata-based triage (SNI/IP filtering) and resort to expensive, noisy traffic analysis, effectively forcing bulk collection.

5. Significance and Implications

Defense-in-Depth Strategy: The paper argues that while Post-Quantum Cryptography (PQC) is the ultimate solution, current infrastructure must adopt structural defenses immediately.
- Primary Lever: Aggressive Rekeying and Larger Key Parameters. These target the adversary's scarcest resource (quantum compute time) without burdening the network.
- Secondary Lever: ECH to degrade metadata triage.
- Avoid: Relying on record padding, which is economically self-harming for defenders.
Protocol Gaps: The authors identify a critical gap in TLS 1.3 and QUIC: the lack of in-band ephemeral rekeying. Unlike SSH, these protocols cannot force a new quantum problem mid-stream without a full connection restart. The paper advocates for the adoption of Extended Key Update drafts to fix this.
Urgency: For data with long confidentiality lifespans (healthcare, state secrets), the "harvest window" is already open. The cost of storage is low enough that adversaries are likely already archiving traffic. Immediate migration to PQC and the implementation of rekeying strategies are necessary to raise the decryption cost beyond feasible limits.

Conclusion

The paper concludes that HN-DL is not a speculative risk but a present economic reality. The most effective immediate defense is not just storing more data (padding), but multiplying the computational cost for the adversary through frequent rekeying and larger key sizes. While PQC migration is essential, structural protocol changes (like SSH-style rekeying for TLS) are required to protect the "in-between" period before PQC is fully deployed.