You encountered HNDL briefly in Lesson 0.2. This lesson goes inside the mechanism. In Lesson 0.2 you learned that Shor's algorithm breaks RSA and ECC, but that a cryptographically-relevant quantum computer doesn't exist yet. So why act now? Because adversaries don't have to wait for a quantum computer to steal your data. They only need one to read it. That gap, between capture and decryption, is the Harvest Now, Decrypt Later threat.
Unit 0 progress
By the end of this lesson you will be able to
Describe the three acts of the HNDL attack model
Apply the Mosca inequality to assess migration urgency
Identify which categories of data carry the highest HNDL risk
Explain why NIST finalized post-quantum standards before a quantum threat materialized
Part 1 — How HNDL works: a three-act threat
HNDL isn't a future attack. It's a present collection strategy. The attack unfolds in stages that may be separated by a decade or more.
1
Harvest
Adversary intercepts and stores encrypted network traffic at scale. No decryption needed yet, just capture and archive.
2
Wait
Adversary stores the ciphertext. Years pass. Quantum computing matures.
3
Decrypt
A cryptographically-relevant quantum computer is used to decrypt the harvested data. Your 2025 communications become readable in 2033.
This is what makes HNDL different from almost every other security threat. Most attacks require the adversary to act while the target is vulnerable. HNDL separates the attack into two phases: exploitation happens today, harm lands in the future. You may never know your 2025 data was decrypted in 2033.
Part 2 — The Mosca inequality: quantifying your urgency
Michele Mosca, a quantum computing researcher at the University of Waterloo, formalized the risk into a simple inequality. It has three variables. If the left side exceeds the right side, you have a problem that already started.
X
Years your data must stay confidential
+
Y
Years your migration will take
>
Z
Years until a cryptographically-relevant quantum computer exists
Part 3 — Who is actually doing this?
HNDL is not a theoretical concern. The U.S. National Security Agency, CISA, and allied intelligence services have stated publicly that state-level adversaries are collecting encrypted data today in anticipation of future quantum capability. In 2022, the NSA issued guidance explicitly citing HNDL as a reason to begin migration immediately.
The categories of data most at risk from HNDL:
Anything with a long confidentiality requirement (classified or sensitive government data, health records, legal documents, long-term intellectual property)
Authentication infrastructure (private keys, signing keys, CA private keys)
Historical financial or contractual data
The categories of data with lower HNDL risk:
Real-time transactions where the value is time-bound (a one-time payment authorization)
Short-lived session tokens
Ephemeral data with no long-term value
Even here, the infrastructure protecting that data, the PKI underneath it, has a long lifespan and is still at risk.
Part 4 — Identifying your organization's HNDL exposure
Understanding the HNDL threat in the abstract is one thing. Applying it to the specific data and systems you are responsible for is another. This part gives you a practical framework for identifying where your organization's HNDL exposure is highest.
The two questions that govern exposure are straightforward: How long does this data need to stay confidential? And how long until a cryptographically-relevant quantum computer likely exists? If the answer to the first question exceeds or approaches the answer to the second, the data is at risk from HNDL today.
Data type
Typical confidentiality horizon
HNDL risk level
Health records
Patient lifetime (50+ years)
Critical
Defense / classified data
Decades or permanent
Critical
Legal & attorney-client communications
Case duration + decades
High
Intellectual property
Product lifecycle (5–20 years)
High
Financial records (regulated)
Regulatory retention (7–20 years)
High
Authentication infrastructure (CA keys)
Certificate program lifetime
High
Corporate email archives
Variable (often 7+ years)
Medium
Payment card transactions
Settlement period (days)
Low
Session tokens
Session duration (minutes–hours)
Low
Use this table as a conversation starter when mapping your organization's data to HNDL risk. The goal is not a perfect inventory at this stage, that comes in Unit 3. The goal is to develop an instinct for which systems and data sets are most exposed before you begin the detailed migration work.
Part 5 — What HNDL means for migration timing
HNDL changes the migration calculus in one critical way: the urgency is not tied to when a quantum computer arrives. It is tied to when your current data was last encrypted. Data encrypted today with RSA-2048 is vulnerable to retrospective decryption. Every day you delay migration extends the harvest window.
This is why NIST finalized three post-quantum standards in August 2024 rather than waiting for a quantum threat to materialize. The standards needed to exist before the threat arrived, because migration takes years, and the data at risk is being generated now.
Comprehension check
Question 1 of 3
In the HNDL threat model, when does the adversary actually need a quantum computer?
Question 2 of 3
In the Mosca inequality, if X = 15 years and Z = 12 years, what does this tell you about your migration timeline?