Why the Internet Is Swapping Its Encryption Before Quantum Computers Exist

Imagine someone photographing every sealed envelope that passes through a sorting office, then putting the pictures in a drawer. They cannot open any of them today. They are betting that one day they will own a tool that can.

That bet has a name in security circles: harvest now, decrypt later. Cloudflare describes it as encrypted traffic being harvested today and decrypted after "Q-day", the day quantum computers can break widely used cryptography such as RSA-2048.

So the strange part is the timing. The locks are being changed years before the burglar has the tool, because secrets that must stay secret for a long time cannot wait for the tool to arrive.

The Danger That Does Not Exist Yet

Start with what is not true. NIST describes the machines that worry cryptographers as something that "may be years or decades away".

They could still, in time, defeat many of the cryptographic systems in everyday use. Even so, the UK's National Cyber Security Centre says the work of moving to new cryptography should start, or carry on, now.

That is the whole argument. The threat is not here, but the preparation takes long enough that waiting for it would be too late.

Why a Photograph Is Enough

Think of a safe deposit box that a thief cannot open today. If the thief can copy the box and carry it home, a better drill next decade still works.

Encrypted traffic behaves the same way. Cloudflare explains that anything protected today with a Diffie-Hellman key exchange can be stored now and unlocked later, once a quantum computer exists.

The method at risk is not obscure. Cloudflare writes that X25519, a key-agreement method of the Diffie-Hellman kind, falls entirely to Shor's algorithm when run on a quantum machine.

The Replacement Locks

In August 2024, NIST released its first three finalized post-quantum encryption standards. FIPS 203, based on an algorithm called ML-KEM, is meant to be the main standard for everyday encryption.

FIPS 204 (ML-DSA) is the main standard for protecting digital signatures. FIPS 205 (SLH-DSA) is a second signature standard that serves as a fallback if ML-DSA proves vulnerable.

Dustin Moody, the NIST mathematician who leads the project, told organisations: "Go ahead and start using these three."

Did You Know?

NIST has already chosen a spare. In March 2025 it selected a fifth algorithm called HQC, because, in Moody's words, "we want to have a backup standard that is based on a different math approach than ML-KEM."

The idea is simple: if one family of maths turns out to have a crack in it, there is another kind of lock on the shelf.

Already Happening

This is not only a plan on paper. Cloudflare reported that, in the last week of October 2025, the majority of human-initiated traffic with Cloudflare was using post-quantum encryption, which it describes as mitigating store-now, decrypt-later attacks.

Cloudflare's approach is a hybrid. It combines the classic X25519 key exchange with ML-KEM-768, so that X25519 still gives ordinary, non-quantum protection if ML-KEM were ever broken, and ML-KEM is designed to hold up against quantum attacks.

The Slow Part Is Signatures

Not everything moves at the same speed. Cloudflare says upgrading the signature schemes used in secure web connections is on the face of it less urgent, because an attack on signatures only becomes possible once quantum computers can crack RSA or ECDSA.

It also says migrating to post-quantum signatures is much more difficult. So the first locks being swapped protect the secrets that could be recorded today, and the harder swaps follow.

A Calendar Instead of a Panic

The UK's National Cyber Security Centre has laid the work out as a calendar. By 2028, organisations should complete the discovery and assessment phase and have an initial migration plan.

By 2031, it asks for the highest-priority migration activities to be complete. Its end point is 2035, the year it sets for finishing the whole move to post-quantum cryptography.

NIST has its own date: it says it plans, by 2035, to phase out and finally drop quantum-vulnerable algorithms from its standards. The NCSC puts the choice bluntly: "It will not be possible to avoid PQC migration."

Knowlegic Perspective

Most technology stories begin when something arrives. This one begins before it does, which makes it unusual and a little uncomfortable. Nobody can point to the day the quantum computer switches on, so the only evidence of progress is paperwork, standards and quiet software updates.

That is also why it is easy to ignore. Replacing locks that nobody has yet tried to pick feels like an expense with no event attached.

But the calendars, the hybrid designs and the spare algorithm all describe the same habit: treat a long-lived secret as already in the drawer of someone patient.

The locks are being changed before the burglar exists, because the secrets cannot wait for the tool to arrive.

Sources & References

• NIST Releases First 3 Finalized Post-Quantum Encryption Standards, NIST (2024)
• NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption, NIST (2025)
• Post-Quantum Cryptography PQC, NIST (2026)
• Timelines for migration to post-quantum cryptography, UK National Cyber Security Centre (2025)
• State of the post-quantum Internet in 2025, Cloudflare (2025)