Frequently asked questions about quantum security

Harvest now, decrypt later (HNDL) is an attack strategy in which adversaries intercept and store encrypted data today, then decrypt it once a capable quantum computer exists. It makes quantum risk a present-day problem: any data that must stay confidential for years is already exposed, whatever the arrival date of the hardware. See the threat overview for how this plays out across confidentiality and trust.

No. Quantum computers threaten public-key (asymmetric) cryptography such as RSA and elliptic-curve, which secure key exchange and digital signatures. Symmetric encryption such as AES-256 is far less affected and is considered quantum-resistant at adequate key sizes. The urgent exposure is in the asymmetric algorithms that protect almost all internet traffic.

Shor’s algorithm, published by Peter Shor in 1994, is the quantum algorithm that can factor large integers and solve the discrete-logarithm problem efficiently. Those problems are what make RSA and elliptic-curve cryptography secure against classical computers, so a large enough quantum computer running Shor’s algorithm breaks both.

No such computer exists yet, and the hardware required is still years away. But resource estimates are falling fast: in May 2025, Google Quantum AI researcher Craig Gidney estimated that fewer than one million noisy qubits could factor a 2048-bit RSA key in under a week (arXiv:2505.15917), roughly a 20-fold reduction from his 2019 figure of 20 million qubits. The direction of travel is one way.

Q-Day is the point at which a cryptographically relevant quantum computer can break the public-key cryptography protecting today’s data and communications. The Global Risk Institute’s Quantum Threat Timeline Report, which surveys more than 30 experts, places the most likely window in the 2030s, with conservative forecasts reaching into the 2040s.

No, for two reasons. First, harvest-now-decrypt-later means data stolen today is already at risk. Second, migrating cryptography across a large organization takes years, often well over a decade for complex estates, so starting at Q-Day is starting too late. Google has set itself a 2029 deadline to complete its own migration and urged the industry to match it.

Several markets already treat quantum-safe migration as a compliance obligation. NIST finalized its first quantum-resistant standards (FIPS 203, 204, 205) in August 2024. The EU’s DORA requires cryptographic operational resilience for financial entities. The US NSA’s CNSA 2.0 and NIST draft guidance set dated migration and deprecation targets through the 2030s. See the regulatory landscape for a market-by-market view.

They are the first finalized quantum-resistant cryptographic standards, published by the US National Institute of Standards and Technology (NIST) in August 2024. FIPS 203 covers key encapsulation, and FIPS 204 and 205 cover digital signatures. They are the baseline algorithms most migration programs are standardizing on.

Because the exposure is in the cryptography your systems already depend on, not in any quantum technology you would buy. Any organization that stores long-lived sensitive data or relies on digital signatures, TLS, or PKI is exposed. Financial services, healthcare, government, and critical infrastructure are first in line because they combine long data lifetimes with heavy regulation.

Crypto-agility is the ability to replace cryptographic algorithms across your systems without re-architecting the systems that depend on them. It is the practical goal of a quantum-safe program, because you cannot predict exactly which algorithms will be mandated or broken. It starts with a complete inventory of where cryptography lives.

It varies with size and complexity. A small enterprise may complete migration in three to five years, a mid-market organization in eight to twelve, and a large or complex estate can need well over a decade. Because that timeline runs against both regulatory deadlines and the harvest-now window, most programs are already behind if they have not started.

They describe the same thing: cryptographic algorithms designed to withstand attack by a quantum computer. Post-quantum cryptography (PQC) is the term used in much of the research and standards literature. Quantum-resistant is the plainer, equivalent term, and the one Horizen Labs uses. Both refer to algorithms such as those in NIST’s FIPS 203, 204, and 205.

A CBOM is a structured inventory of every cryptographic asset in a system: the algorithms, key lengths, certificates, libraries, and protocols in use, and where. It is the reference a migration program works from, the cryptographic equivalent of a software bill of materials (SBOM). You cannot migrate cryptography you have not inventoried.

Start by understanding your exposure before committing to a migration plan. That means inventorying where vulnerable algorithms live, prioritizing by how long your data must stay confidential, and identifying the systems hardest to change. A cryptographic exposure assessment produces that picture and tells your board where to act first.

It is a structured review that identifies where an organization’s most sensitive data depends on quantum-vulnerable cryptography and prioritizes what to address first. A human-led assessment captures architectural context that automated scanners miss, and produces a board-ready snapshot rather than a raw tool output. It is the usual first step before a full inventory and migration plan.