We usually judge the security of a message by how strong its encryption is today. That is a mistake of perspective. If someone can copy the encrypted message and keep it, the real question becomes: how long must it stay unreadable? Because decryption may come later, once the machine exists. Security is then measured as a duration, not as a strength.
1 The deferred risk
Steal now, read later.
Harvest Now, Decrypt Later
Decryption need not be immediate
The strategy, known as "Harvest Now, Decrypt Later", consists in capturing encrypted data today, unreadable today, storing it, and waiting for the computing power that will open it. The risk is therefore deferred: it does not materialise at the moment of the theft, but years later. That is what makes it invisible. You do not know you are exposed, because nothing, in the moment, signals it.
2 The shelf-life of a secret
Not all secrets have the same life expectancy.
The shelf-life
How long must it stay secret?
Every piece of data has a "confidentiality lifespan": the time during which its disclosure would be harmful. A password: a few months. A medical record: decades. A state secret: 25 to 75 years. Genetic or biometric data: a lifetime, because it identifies you forever, you and your descendants. The longer this duration, the greater the deferred risk: data that must stay secret for thirty years has all the time it needs to meet the arrival of the machine.
State secret
25 to 75 years
of confidentiality required, depending on sensitivity.
Genetic data
lifetime
immutable, it also identifies your kin.
3 Mosca's theorem
Three durations, one inequality.
X + Y > Z
The calculation that tells you whether you are already lost
The cryptographer Michele Mosca summed up the risk in a single inequality. Let X be the time data must stay secret, Y the time needed to migrate to quantum-resistant encryption, and Z the time before the machine exists. If X + Y > Z, it is already too late: data encrypted today will be readable before the end of its useful life. Example: data to be protected for 25 years (X), a 10-year migration (Y), a machine expected in 15 years (Z). We have 35 > 15: the data is exposed for twenty years. The only way to satisfy the inequality is to reduce Y, that is, to migrate now.
4 What falls, what holds
Not all encryption is threatened in the same way.
Shor versus Grover
Public-key falls, symmetric holds
Shor's algorithm (1994) would break public-key encryption (RSA, elliptic curves), the kind that protects key exchange behind the web: there, enlarging the key is not enough, you have to change the algorithm. Grover's algorithm, by contrast, only halves the robustness of symmetric encryption (AES) and hash functions: you simply protect against it by doubling the key size (AES-256). The remedy exists: in 2024 the NIST published the first post-quantum cryptography standards meant to replace the vulnerable public-key.
5 Takeaways
To remember.
✓
The risk is deferred: encrypted data stolen today can be decrypted years later.
✓
The security of a secret is measured by its required confidentiality lifespan, not by the instantaneous strength of the encryption.
✓
Mosca's theorem: if X (shelf-life of the secret) + Y (migration) > Z (time before the machine), the data is already lost.
✓
Public-key (RSA, ECC) is vulnerable; symmetric (AES-256) holds. The post-quantum remedy exists, but you have to migrate in time.
This notion sheds light on an analysis
First published: 24 June 2026