Harvest-Now-Decrypt-Later (HNDL): Defending Long-Dated Enterprise Assets

1. Adversary Doctrine: Petabyte-Scale Harvesting Economics

State intelligence agencies operate with decades-long planning horizons. The economic cost of capturing and storing encrypted enterprise traffic has plummeted over the past decade:

• Storage Commodity Costs: High-density tape libraries and object storage allow archiving raw ciphertext at less than $0.001 per gigabyte per month.
• Targeted Interception Chokepoints: Traffic traversing major Internet Exchange Points (IXPs), cloud interconnects, and inter-datacenter fiber links is passively tapped via optical splitters without disrupting line-rate latency.
• Automated Metadata Indexing: Intercepted packets are classified by domain, TLS Server Name Indication (SNI), certificates, and target institution, creating an indexed catalog awaiting future quantum cryptanalytic compute.

Adversaries do not need to break encryption in real time; they need only wait until quantum factorization costs fall below the intelligence value of the stored data.

2. The Exposure Calculus of Long-Dated Enterprise Assets

Most enterprise security architectures mistakenly treat data confidentiality as an ephemeral requirement. In reality, data value persists far longer than cryptographic algorithm longevity:

3. Cryptographic Decay Curves: Classical Diffie-Hellman vs. Shor's Algorithm

When an enterprise exchanges keys using classical Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman (ECDH), the shared secret $K$ is computed as:

An adversary observing public keys $A = g^a$ and $B = g^b$ records these values alongside the encrypted payload. On a classical computer, extracting $a$ or $b$ requires solving the discrete logarithm problem—computationally infeasible ($\sim 2^{128}$ operations for secp256r1).

However, Shor's quantum algorithm evaluates modular exponentiation across quantum superpositions:

With approximately 4,000 logical qubits operating under fault-tolerant quantum error correction, an adversary will reconstruct the private exponent $a$ in mere seconds. Every historic session key derived from that exchange is instantly compromised, retroactively decrypting the entire recorded session.

4. Mathematical Architecture of Hybrid Dual-Key Encapsulation

To defeat HNDL attacks immediately without waiting for global classical deprecation, Crypto Service Suite implements a hybrid key encapsulation mechanism (X25519 + ML-KEM-768). Its combiner is specific to this library: it is neither the RFC 10024 TLS 1.3 key exchange nor X-Wing, so it does not interoperate with them. For TLS, use X25519MLKEM768 as specified in RFC 10024.

The hybrid scheme executes two concurrent key encapsulations:

1. Classical Component: Elliptic curve key exchange using X25519 generating shared secret $ss_{\text{classical}}$.
2. Post-Quantum Component: Module-LWE lattice encapsulation using ML-KEM-768 generating shared secret $ss_{\text{pqc}}$.

The final symmetric key $K_{\text{session}}$ is derived using an extract-and-expand Key Derivation Function (HKDF-SHA256):

where $\text{lp}$ prefixes each value with its 4-byte big-endian length and $\texttt{label}$ is crypto-service/hybrid-kem/v2/x25519-ml-kem-768. Binding both ciphertexts and public keys means a substituted ciphertext or key changes the derived secret.

The design goal: an adversary must break both the classical elliptic-curve problem and the post-quantum lattice problem to recover the session key. If a quantum computer breaks X25519, ML-KEM-768 still protects the key; if lattice cryptanalysis advances unexpectedly, X25519 still provides classical security. This relies on correct implementations of both components; crypto-lib uses @noble/curves and @noble/post-quantum, and the latter is not independently audited and does not guarantee constant-time execution.

5. Defending Data-at-Rest: Retroactive Decryption of Database Backups

HNDL is not restricted to network packets. Offsite database backups, Amazon S3 glacier snapshots, and disaster recovery archives represent prime targets for physical and logical theft.

A common mitigation pattern is envelope key re-wrapping. Crypto Service Suite does not automate it today; you can build it from crypto-lib primitives:

• Existing data stays encrypted under its original data encryption keys (DEKs).
• The DEKs, or the key encryption key (KEK) that wraps them, are re-wrapped under a key established with a hybrid X25519 + ML-KEM-768 KEM.
• Record in the backup metadata which algorithms and parameters were used, so the inventory can be audited without decrypting customer data.

6. Implementation Patterns Using Crypto Service Suite

Establishing a hybrid X25519 + ML-KEM-768 shared secret with `@sebastienrousseau/crypto-lib`:

import {
  hybridKemKeygen,
  hybridKemEncapsulate,
  hybridKemDecapsulate,
} from "@sebastienrousseau/crypto-lib";
// 1. Alice generates an X25519 + ML-KEM-768 key pair
const alice = hybridKemKeygen(768);
// 2. Bob encapsulates a shared secret to Alice's public keys
const sent = hybridKemEncapsulate(768, alice.x25519PublicKey, alice.mlKemPublicKey);
// 3. Alice decapsulates with her private keys
const received = hybridKemDecapsulate(
768,
alice.x25519PrivateKey,
alice.mlKemSecretKey,
sent.x25519EphemeralPublic,
sent.mlKemCiphertext,
);
// received.sharedSecret === sent.sharedSecret

7. Executive Takeaways & Priority Remediation Checklist

1. Audit Traffic Egress Points: Identify all internet-facing endpoints transporting data with a confidentiality lifespan of $>5\text{ years}$.
2. Upgrade Internal API Gateways: Mandate hybrid post-quantum key exchange (X25519 + ML-KEM-768) on all microservice service mesh boundaries.
3. Re-wrap Long-Term Database Secrets: Ensure encrypted database backups and offline cold storage vaults are protected with post-quantum Key Encryption Keys.
4. Deploy Sovereign CaaS: Centralize cryptographic operations within private network boundaries using `@sebastienrousseau/crypto-server`.