What happens to your encrypted data when quantum computers arrive

This is not a post about when quantum computers will arrive. That question has a range of estimates from "five years" to "never for the relevant threat model," and the experts disagree. This is a post about a threat that exists today, regardless of when quantum compute matures: harvest now, decrypt later.

The threat that already exists

Governments and well-resourced adversaries collect encrypted network traffic. They do this now, with classical computers, storing the ciphertext. Their expectation: when a capable quantum computer exists, Shor's algorithm runs against the key exchange and the historical traffic is decrypted.

The window for this attack is any communication that was encrypted with a classical key exchange (X25519, ECDH, RSA) and that needs to remain private for longer than the time until a capable quantum computer exists. For communications that only need to be private for 48 hours, this is not your problem. For communications that might be sensitive for 10 or 20 years — legal records, medical data, sensitive business negotiations — this is already your problem.

What post-quantum actually means

NIST finalised its post-quantum cryptography standards in 2024. The relevant one for key exchange is ML-KEM — also known as CRYSTALS-Kyber — a Key Encapsulation Mechanism based on the hardness of the Learning With Errors problem. Unlike ECDH, Kyber's security does not depend on the discrete logarithm problem, which Shor's algorithm solves efficiently.

Kyber-1024 is the highest security level: NIST Level 5, targeting security equivalent to AES-256 against both classical and quantum attack.

Why hybrid, not pure post-quantum

A pure Kyber deployment trades the classical security of X25519 for post-quantum security of Kyber. If there's an as-yet-unknown attack on Kyber's lattice structure — a real concern for any new primitive — you've traded a known strong guarantee for an unknown one.

The hybrid approach combines both: run X25519 and Kyber-1024 in parallel, combine the shared secrets via HKDF, and use the result as the session key. An attacker needs to break both simultaneously. This is strictly harder than breaking either alone.

This is the approach in UV (UltraViolet), the zero-trust communications platform I built. The key exchange extends X3DH with a parallel Kyber-1024 encapsulation:

const x25519Shared = x25519.sharedSecret(
  ephemeralPrivate,
  recipientIdentityPublic
);

const { ciphertext, sharedSecret: kyberShared } =
  kyber1024.encapsulate(recipientKyberPublicKey);

// Hybrid: both must be broken to break the session
const sessionKey = hkdf(
  sha512,
  concat(x25519Shared, kyberShared),
  salt,
  info,
  32
);

The Kyber ciphertext travels alongside the classical ephemeral public key in the initial handshake. The recipient decapsulates to recover the Kyber shared secret and performs the same HKDF derivation to arrive at an identical session key.

The test strategy

Every cryptographic primitive in UV has its own test file with cross-compatibility checks: generate a key pair, encapsulate, decapsulate, verify the shared secrets match. For the hybrid, there's an additional test that verifies that a corrupted Kyber ciphertext produces a different decapsulated secret, preventing the HKDF from arriving at the same session key.

This sounds obvious but it's worth testing explicitly: the failure mode for a KEM with a corrupted ciphertext should be "different secret" (silent failure, session setup fails) not "error thrown" (observable failure, timing attack). Kyber's spec requires the former, but testing it confirms your implementation actually delivers it.

What this doesn't solve

Post-quantum key exchange addresses one attack vector: the key exchange itself. It doesn't protect against a compromised endpoint. It doesn't protect against metadata analysis — who communicated with whom, when, and how often — even if the content is perfectly encrypted. It doesn't protect against weak implementations of the symmetric cipher protecting the data after key exchange.

The 148 tests in UV's test suite cover the full stack: the primitives individually, the hybrid key exchange, the Double Ratchet message encryption, and the six-stage Channel Integrity Check protocol that validates channel properties independently of encryption. Quantum resistance is one layer in a defence-in-depth architecture, not a complete solution.

When you should care

If you're building a messaging system where messages need to remain private for more than a few years: now. If you're building a system that stores encrypted sensitive data (health records, legal documents, financial records): now. If you're building consumer web authentication that doesn't persist beyond a session: the threat model probably doesn't apply.

The cost of adding Kyber-1024 to an existing X25519 implementation is modest — it's additive, not a replacement. The cost of retrofitting quantum resistance into a deployed protocol that has accumulated historical traffic is very high. Get it right at design time.