Harvest Now, Decrypt Later: An Honest Accounting

The argument for migrating to post-quantum cryptography now — before any cryptographically relevant quantum computer (CRQC) is known to exist — rests on three premises. Each is contestable, all three are roughly correct, and the strength of the case depends on the strength of the weakest one. They are worth stating in full before we get to the analogy.

1. Bulk recording is cheap. An adversary with the budget of a mid-sized intelligence service can record and warehouse the encrypted traffic of a major IXP indefinitely. The capability is not in dispute; the operating costs are public for any cloud provider's storage tier and the wire-rate capture hardware is commercial.
2. Some traffic stays valuable for decades. Sealed indictments, sealed pharmaceutical IP, infrastructure credentials, contract negotiations, the entire body of human medical records, and a long tail of state secrets retain decryption value for thirty or more years. The shorter the residual operational lifetime of the data, the weaker this premise; for ephemeral chat it does not apply at all.
3. A CRQC is plausible within the data's residual lifetime. The 2024 NIST timeline assumed CRQC arrival somewhere between 2030 and 2045. The technical literature is not unanimous on this and the doubters are not cranks; their argument is that scaling logical qubit counts past the threshold for breaking RSA-2048 or ECC-256 via Shor's algorithm requires several orders of magnitude of error correction overhead that current physical qubit fidelity does not support. The migration argument depends on this premise being more likely than not, not on certainty.

If all three hold, the migration is a strict win. If any one fails, the case weakens but does not collapse, because the cost of migration — for a competent operator using the new NIST standards — is now small.

The Term and Its History

The phrase “harvest now, decrypt later” appears to have first circulated inside the U.S. and allied signals-intelligence communities in the late 2000s, before becoming a published term in academic and industry post-quantum literature around 2014–2016. By 2021 it was the standard label for the threat model in NIST and ETSI documents and in Cloudflare's, Google's, and Apple's public communications about their PQ migrations. The Wikipedia article gives the term's documentary trail and the related vocabulary: Y2Q (analogous to Y2K) and Q-Day (the day a CRQC becomes operational). We use “harvest now, decrypt later” throughout this essay because it is the term every working cryptographer recognizes.

The Schappeller Reading

Karl Schappeller's 1928 monograph Raumkraft — a 35-page text published by Herold Verlag in Munich and authored on Schappeller's behalf by his collaborators Franz Wetzel and Louis Gföllner — argues that the æther around the Earth is not merely a transport medium for waves we generate but a storehouse of pre-existing structure from which energy can be drawn at the right kind of cavity. The framework is one of the most compactly stated unified pictures in early-twentieth-century speculative physics, and its most consequential English exposition came a generation later in Cyril W. Davson's The Physics of the Primary State of Matter (1955).

Schappeller discovered that it [the Earth] was the obvious source and storehouse of all available energy, in addition to being a conductor.Cyril W. Davson, summarising Schappeller in The Physics of the Primary State of Matter, 1955

The HNDL adversary treats the public internet exactly as Schappeller treated the æther. The traffic is not intercepted as a message addressed to the adversary; it is treated as an already-extant reservoir from which value can be extracted at a later date by the right kind of device. The shift in framing matters because it changes what counts as a defence. If the threat is interception of in-flight traffic, the defence is to make in-flight traffic stronger. If the threat is the storehouse, the defence is to make the contents of the storehouse useless to whoever owns it — not at the moment of capture, but at every later moment as well. We have not found a tighter single sentence for the modern threat model in any cryptography textbook of the last forty years.

What “Useless to the Storehouse” Requires

Three properties, in order of decreasing standardization in 2026:

• Hybrid key exchange today. A hybrid key exchange combines a classical KEM (X25519 in current practice) with a post-quantum KEM (ML-KEM, the NIST-standardized form of Kyber, in FIPS 203 since 13 August 2024). The combined session key is derived from both, so an adversary must break both primitives to recover the session. The classical half guards against unforeseen weaknesses in the lattice assumption; the post-quantum half guards against the storehouse threat. The IETF's draft-ietf-tls-hybrid-design specifies this for TLS 1.3, and Cloudflare's 2024 update reports that a meaningful and growing fraction of TLS sessions to its edge already negotiate the X25519MLKEM768 hybrid.
• Post-quantum signatures on long-lived artefacts. Signatures over software updates, code-signing certificates, certificate-transparency logs, and DNSSEC zones must verify decades after the signing key has been rotated. The standardized choices are now FIPS 204 (ML-DSA, formerly Dilithium, lattice-based) and FIPS 205 (SLH-DSA, formerly SPHINCS+, hash-based). The hash-based scheme survives any cryptanalytic break of lattice assumptions; the lattice scheme is more compact. Production systems should ship both.
• Aggressive migration at the long tail. Every device that finishes its PQ migration today is a device whose subsequent traffic is not contributing to anyone's storehouse. The marginal value of each migration is small, but the integral over a global fleet is the entire defence.

What VRIL Recommends and What VRIL Ships

VRIL LABS's flagship cryptographic product is VRIL-KEM, an MLWE-based key-encapsulation mechanism on the n=4096, q=12289, k=7 lattice, targeting 384-bit quantum security at NIST Level 5+. The construction stitches together seven Fibonacci-weighted CVKDF layers (the same seven-layer cascade that anchors VRIL-ZIP's entropy-pipeline staging), with each layer derivable independently from a domain-separated transcript. The IND-CCA2 reduction is mechanised in EasyCrypt; the AVX2-optimised reference implementation reaches 2.4 ms keygen on a single core. The construction is intentionally hybrid-friendly: an X25519+VRIL-KEM hybrid follows the same composition pattern as the IETF's X25519MLKEM768 draft, swapping the lattice half for the larger-margin VRIL-KEM construction without disturbing the classical half. The case for shipping a non-standard PQ KEM at all rests entirely on the storehouse threat model: a defender who is being recorded for thirty years has a margin requirement that the standard parameter sets meet but do not exceed.

Hash-based signatures live in a different operational regime. SLH-DSA (FIPS 205) is the standardised choice for code-signing and ledger roots; the parameter sets are large (16–48 kB depending on level) and the overhead is real, but for use cases where a signature is verified far more often than it is generated, and where the post-quantum margin must be unconditional on lattice security, the size is the right thing to pay for. The ML-KEM standard parameter sets remain the right choice for the wide ecosystem of TLS 1.3 deployments where the storehouse-margin question is less acute and the operational benefit of standardisation dominates; the cryptographic case is not zero-sum.

The Honest Footnote

The Schappeller analogy is not the argument for post-quantum migration. The argument for migration is the three-premise case at the top of this essay. The analogy is the vocabulary — and it happens to be precise vocabulary. Storehouse versus conductor separates the modern HNDL threat model from the older interception threat model in a single word, and we have found, across years of customer conversations, that operators who have not previously thought about the threat model adopt it more quickly when it is presented this way than when it is presented in the standard threat-actor language.

That is the full claim. Schappeller was not a cryptographer and the 1928 monograph is not a security document, but the distinction between treating a medium as a transmission channel and treating it as a reservoir is older than computing, and it is still the distinction that organizes the post-quantum migration. Anyone still running TLS 1.3 with non-hybrid key exchange in 2026 is — in the strict sense, with no pejorative intended — donating their session traffic to whichever storehouse can hold it the longest.