Harvest Now, Decrypt Later: Are We Ready for Q-Day?

Just caught the news on The Hacker News about the "Harvest Now, Decrypt Later" (HNDL) threat. It’s not just sci-fi anymore; if you have long-term sensitive data (PHI, IP, proprietary secrets), state-sponsored actors are likely banking on Shor's algorithm breaking your current RSA/ECC keys in the next decade.

Most of us are focused on zero-days, but this is a slow-burn vulnerability. The webinar mentioned highlights that we need to inventory our exposure to classical encryption now.

Auditing Exposure I started auditing our external perimeter for RSA key exchange usage. If you rely purely on RSA key transport (instead of ECDHE or DHE), you're in trouble when quantum computing scales.

Here is a quick Python snippet to help identify if your endpoints are negotiating potentially vulnerable classical ciphers:

import ssl
import socket

def check_cipher_vulnerability(hostname, port=443):
    context = ssl.create_default_context()
    context.set_ciphers('DEFAULT:@SECLEVEL=0') # Allow weak ciphers for testing
    with socket.create_connection((hostname, port)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            cipher = ssock.cipher()
            # Check for RSA key exchange (vulnerable to quantum attacks)
            if 'RSA' in cipher[0]:
                return f"[ALERT] {hostname} using vulnerable {cipher}"
            return f"[OK] {hostname} using {cipher}"

print(check_cipher_vulnerability("example.com"))

How is everyone else handling the crypto-agility migration? Are you waiting for NIST to finalize the standards fully (ML-KEM, ML-DSA), or are you testing hybrid implementations now?