Post-quantum cryptography sounds like a problem for a decade from now, until you realise that fibre and encryption infrastructure being installed in Australia today will still be carrying traffic when cryptographically-relevant quantum computers arrive. The risk isn't hypothetical because the compute doesn't exist yet — it's live today, because an adversary can capture and store encrypted traffic now and decrypt it later.
Harvest-Now-Decrypt-Later: Why the Timeline Doesn't Matter as Much as It Seems
Current public-key cryptography (RSA, elliptic curve) relies on mathematical problems believed to be intractable for classical computers but theoretically breakable by a sufficiently powerful quantum computer running Shor's algorithm. No such machine exists today at the scale needed to break real-world key sizes. But an adversary doesn't need one today — they need one before the confidentiality window on the data closes. Government records, health data, and long-lived infrastructure control system traffic captured today could remain sensitive for decades, meaning the interception can happen now, with decryption deferred until quantum capability catches up.
What Actually Changes: Software, Not Physical Infrastructure
Post-quantum cryptography (PQC) is fundamentally a change to key-exchange and digital-signature algorithms — NIST has standardised several PQC algorithm families (CRYSTALS-Kyber for key encapsulation, CRYSTALS-Dilithium for signatures, among others). This is a firmware and software-level change, not a fibre or physical-layer change: the same optical infrastructure, the same copper cabling, continues to carry traffic — what changes is the cryptographic handshake protecting that traffic. This is genuinely good news for Australian infrastructure owners, since it means the transition doesn't require ripping out physical network infrastructure, provided the network hardware is crypto-agile.
- Specify crypto-agile hardware in new procurement — firewalls, VPN concentrators and encryption appliances capable of a firmware-level algorithm update rather than hardware baked to today's algorithm set.
- Inventory systems carrying long-confidentiality-window data (health records, critical infrastructure control traffic, government data) and prioritise these for early PQC migration over lower-sensitivity systems.
- Review key-management architecture now — PQC algorithms often have different key sizes and performance characteristics than current algorithms, which can affect systems with tight latency or storage budgets.
- Track procurement language in Australian government and critical infrastructure tenders, which are increasingly starting to reference PQC-readiness as a supplier qualification criterion.
Design takeaway: The practical action for most Australian infrastructure owners today isn't deploying PQC immediately — it's ensuring new hardware procurement specifies crypto-agility, so the eventual algorithm transition is a firmware update rather than a forklift hardware replacement.
Sequencing a Sensible Response
A pragmatic Australian infrastructure roadmap starts with a data-sensitivity and confidentiality-window inventory (what data would still matter if decrypted in 10-15 years), moves to crypto-agility requirements in all new network and security hardware procurement, and only then to active PQC algorithm deployment on the highest-priority systems as vendor support matures — treating this as a multi-year procurement and architecture discipline rather than a single project with a fixed delivery date.
Frequently Asked Questions
What is harvest-now-decrypt-later and why does it matter today?
It describes an adversary capturing and storing encrypted traffic now, with the intention of decrypting it once a sufficiently powerful quantum computer exists. Data with a long confidentiality shelf life — government records, health data, infrastructure control system traffic — is at risk today even though the decryption capability doesn't yet exist, because the interception can happen now and the decryption later.
Does quantum-safe networking mean replacing all existing fibre infrastructure?
No. Post-quantum cryptography is primarily a software and protocol-level change — new key-exchange and signature algorithms — not a physical layer change. The fibre and hardware stay the same; what changes is the cryptographic algorithms running on top, provided the hardware is crypto-agile enough to support an algorithm update.
What does crypto-agile hardware mean in a procurement specification?
It means specifying network and security hardware (firewalls, VPN concentrators, encryption appliances) capable of a firmware-level cryptographic algorithm update rather than hardware locked to today's algorithms, so a future shift to NIST-standardised post-quantum algorithms doesn't require a full hardware replacement cycle.