Messages that Waited 30 Years: Preparing for Quantum Computing

In February 1943, a small team of US Army codebreakers at Arlington Hall in Virginia began working through a backlog of encrypted Soviet diplomatic cables. The messages had been intercepted and filed away for years. Nobody could read them. Soviet cryptographers used one-time pads, which are mathematically unbreakable when used correctly. 

The key phrase is "when used correctly." Under wartime pressure, Soviet manufacturers had duplicated some pad pages, and reused pages are a fatal flaw for one-time pads. It took American analysts years of painstaking work to find the duplicates and pry the messages open, and the effort, later known as VENONA, continued until 1980. Cables sent in 1944 were still giving up secrets in the 1970s. Along the way they exposed Klaus Fuchs, the Rosenbergs, and a network of agents inside the Manhattan Project. 

VENONA is a story about spies, but it is also a story about a property of encrypted data that we tend to forget: ciphertext is patient. The Soviets believed their messages were secure the day they sent them, and they were right. But they didn't account for an adversary willing to store those messages indefinitely and wait for a weakness to become exploitable. 

That same bet is being placed today, at much larger scale. The industry calls it "harvest now, decrypt later": record encrypted traffic you cannot currently read, store it cheaply, and wait for the mathematics to catch up. Most attackers cannot afford that trade. National intelligence services, with long horizons and large budgets, treat it as standard practice. This time, however, the anticipated weakness is a new kind of computer. 

How Your Encrypted Traffic Works 

To understand the danger of “harvest now, decrypt later,” it helps to know what happens when two systems set up an encrypted connection, whether that's your browser talking to a bank or two data centers linked by an encrypted tunnel. 

Modern systems use two kinds of cryptography together. Symmetric encryption, like AES, uses the same key to encrypt and decrypt. It is fast and, as far as anyone knows, extremely durable. Its weakness is logistical: both sides need the same secret key, and you can't just send it over the network in the clear. 

That delivery problem is solved by asymmetric cryptography, such as RSA and elliptic-curve key exchange. These algorithms let two parties who have never met agree on a shared secret over a public channel. Every secure connection starts with a brief asymmetric handshake whose only job is to establish a fresh symmetric session key. Everything after the handshake, which is to say all your actual data, is encrypted with that session key. 

It's an elegant division of labor, and it has a structural consequence: the security of the entire session hangs on the handshake. An adversary who records a connection captures both the handshake and the encrypted data that follows. If they can ever break that handshake, even decades from now, the session key falls out of it, and with the session key they can decrypt the whole recorded conversation. Nothing needs to be attacked "live"; the recording just needs to last long enough. 

Where Quantum Computers Come In 

Quantum computers are often described as machines that try every answer at once. That description is wrong. A quantum computer speeds up a small set of problems with particular mathematical structure and leaves everything else about as hard as it was. 

Unfortunately for the handshake, one of those problems is the one asymmetric cryptography depends on. In 1994, mathematician Peter Shor showed that a sufficiently large quantum computer could factor huge numbers and solve related problems efficiently. The fact that those problems are hard to solve is the entire security basis of RSA, Diffie-Hellman, and elliptic-curve cryptography. Shor's algorithm removes that foundation. 

The impact on our current cryptographic standards is uneven. Symmetric encryption largely survives: quantum attacks weaken AES modestly, and the fix is simply longer keys, which we already use. What breaks is the asymmetric handshake, the very step an eavesdropper needs to unlock a recorded session. 

No machine capable of running Shor's algorithm at meaningful scale exists today, and credible estimates for when one will range from a decade to considerably longer. But the harvest-now-decrypt-later math doesn't care about the exact date. What matters is whether data you transmit today will still be sensitive when that machine arrives. Medical records, financial data, intellectual property, and government material routinely carry secrecy lifetimes of twenty years or more. If your data needs to stay confidential into the 2040s, the relevant deadline is today, when the recording can be made. 

The Current Status of Quantum Computing

Given all this, it's fair to ask what quantum computers have actually factored to date. The answer is smaller than most people expect. Run Shor's algorithm fair and square on real quantum hardware and the records are numbers like 15, 21, and 35. Even those demonstrations leaned on shortcuts: the circuits were hand-tailored by researchers who already knew the answer, and one influential critique showed that most published quantum factoring milestones simplify the problem so aggressively that the experiment amounts to flipping coins. 

Larger numbers have been factored on quantum devices, if you allow some cheating. Special-purpose machines called quantum annealers hold the hardware record at 8,219,999, a genuine computation but one that doesn't use Shor's algorithm, gets exponentially harder as the numbers grow, and poses no threat to real key sizes. Every few years a paper claims a dramatic leap, most famously a widely publicized claim in early 2023 that RSA-scale numbers could fall to a few hundred qubits, and each has so far collapsed under scrutiny. There is even a nice irony at the top of the leaderboard: the largest number ever factored with Shor's algorithm, the twelve-digit 549,755,813,701, was factored on a classical supercomputer simulating a quantum one across 2,048 GPUs. 

For perspective, your laptop can instantly factor any number a quantum computer has ever handled, honestly or otherwise, while the classical factoring record stands at an 829-bit RSA number that consumed tens of millions of processor-hours in 2020. The scoreboard is that lopsided. What keeps cryptographers attentive is the trend in the engineering estimates. In 2019, breaking a standard 2048-bit RSA key was projected to require some twenty million noisy qubits running for eight hours; by 2025, better algorithms and error correction had pushed one credible estimate below a million. Today's largest machines have on the order of a thousand physical qubits, so the gap remains wide. But it is closing from both directions, and the harvest-now-decrypt-later arithmetic only needs it to close once. 

Preparing for Quantum Computing: We’ve Already Started

The good news is that this problem was seen coming. In 2016, the US National Institute of Standards and Technology launched a global competition to develop asymmetric algorithms based on mathematical problems that quantum computers can’t solve rapidly. After eight years of public cryptanalysis, NIST published the first finished standards in 2024, with names like ML-KEM and ML-DSA, and added a backup algorithm in 2025. These algorithms rest on unfamiliar-sounding foundations, mostly problems involving geometric structures called lattices. You don’t need to understand a word of that, any more than you need to understand elliptic curves to use online banking today.

Two things are worth knowing: 

1. These are not research projects now; they're standards.

2. They run fine on ordinary computers; the quantum part is only the threat. Adoption is already underway: major browsers have switched their handshakes to a hybrid of classical and post-quantum key exchange, so there is a good chance you used one to load this page. 

Key Takeaways: Making a Plan

For most organizations, the sensible response is measured: 

1. Know where cryptography lives in your environment, especially long-lived tunnels and VPNs that carry sensitive traffic.  

2. Identify which data has a secrecy lifetime long enough to matter.  

3. Ask your vendors, including us, what their post-quantum timelines look like. Migrations like this historically take a decade, which is precisely why the time to start is while the threat is still a theory. 

The Soviet cryptographers of 1944 were using the strongest encryption on Earth, and it still ended up readable, because someone kept the ciphertext and waited. The defense against that kind of patience is making sure the ciphertext you send now stays unreadable no matter how long somebody keeps it.  

Discover the hidden attack paths that threat actors could use to exfiltrate data from your environment with a free Workload Attack Path Assessment.

References 

Ars Technica, "RSA’s demise from quantum attacks is very much exaggerated, expert says," January 2023, https://arstechnica.com/information-technology/2023/01/fear-not-rsa-encryption-wont-fall-to-quantum-computing-anytime-soon/.

arXiv, "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer," August 30, 1995, https://arxiv.org/abs/quant-ph/9508027.

arXiv, "Quantum Annealing: Optimisation, Sampling, and Many-Body Dynamics," May 2026, https://arxiv.org/pdf/2605.06857.

NIST, "NIST Releases First 3 Finalized Post-Quantum Encryption Standards," August 13, 2024, https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards.

NIST, "NIST PQC Standardization Process: HQC Announced as a 4th Round Selection," March 11, 2025, https://www.nist.gov/news-events/news/2025/03/nist-pqc-standardization-process-hqc-announced-4th-round-selection.

NIST CSRC, "Announcing Request for Nominations for Public-Key Post-Quantum Cryptographic Algorithms," December 20, 2016, https://csrc.nist.gov/news/2016/public-key-post-quantum-cryptographic-algorithms.

NSA, "Venona Documents," https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Venona/.

NSF, "Quantum Computing: Expanding What's Possible," January 21, 2026, https://www.nsf.gov/science-matters/quantum-computing-expanding-whats-possible.

PBS NOVA Online, "Read Venona Intercepts," January 2002, https://www.pbs.org/wgbh/nova/venona/intercepts.html.

QuEra, "What Is Shor's Algorithm? Factoring & Applications," https://www.quera.com/glossary/shors-algorithm.