Countering 'Harvest Now, Decrypt Later' with Post-Quantum Cryptography (PQC)

  countering-harvest-now-decrypt-later-with-post-quantum-cryptography-pqc.html
  Science and Technology on Fri, Jun 05th, 2026 by whitehouse.gov
      Locale: UNITED STATES

The Strategic Necessity of Quantum-Resistant Cryptography

The primary driver behind NSPM–11 is the mitigation of the "Harvest Now, Decrypt Later" (HNDL) strategy employed by adversarial nation-states. This tactic involves the interception and storage of encrypted sensitive data today with the intent of decrypting it once quantum computing technology reaches the necessary maturity.

To counter this, NSPM–11 mandates the adoption of Post-Quantum Cryptography (PQC), utilizing algorithms that are computationally infeasible for both classical and quantum computers to break. The memorandum aligns with the standards finalized by the National Institute of Standards and Technology (NIST), specifically focusing on lattice-based cryptography.

Core Mandates and Implementation Requirements

Implementation Timeline and Milestones

The memorandum outlines specific requirements for federal agencies, the Department of Defense, and the Intelligence Community to ensure a synchronized migration. The following table details the primary obligations imposed by the directive

• Phase 1 (Immediate - Q3 2026): Finalization of the Quantum Transition Inventory. Agencies must report the exact location of all vulnerable cryptographic endpoints.

• Phase 2 (2026–2027): Deployment of "Hybrid Mode" encryption. Systems must utilize both classical and quantum-resistant algorithms simultaneously to ensure stability during the transition.

• Phase 3 (2028): Mandatory decommissioning of the most vulnerable classical algorithms in National Security Systems (NSS).

• Phase 4 (2030): Full transition to quantum-resistant standards across all federal civilian and military networks.

Organizational Responsibilities

NSPM–11 establishes a rigid timeline for the transition to ensure that critical infrastructure is protected before a CRQC becomes operational. The milestones are categorized by urgency and system criticality

• National Institute of Standards and Technology (NIST): Responsible for the continuous evaluation and updating of PQC algorithms as new quantum threats emerge.

• Cybersecurity and Infrastructure Security Agency (CISA): Tasked with providing technical assistance to civilian agencies and coordinating with the private sector.

• Office of Management and Budget (OMB): Authorized to oversee the funding and budgetary allocations necessary for the large-scale hardware and software overhauls required by the transition.

• Department of Defense (DoD): Responsible for securing tactical communications and weapon systems against quantum-enabled decryption.

Global Security and Industrial Base Implications

The memorandum delineates the roles of several key government bodies to prevent overlap and ensure accountability

Beyond federal agency compliance, NSPM–11 emphasizes the resilience of the National Industrial Base. Because the U.S. government relies heavily on private contractors for critical infrastructure, the memorandum effectively forces a market shift toward PQC.

Furthermore, the document highlights the necessity of international coordination. Since global finance and diplomatic communications rely on shared cryptographic standards, the U.S. aims to lead the international transition to avoid "cryptographic fragmentation," where different nations use incompatible quantum-resistant protocols, thereby hindering secure collaboration.