Podcast
Root Causes 256: What Is Harvest and Decrypt?


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
November 16, 2022
As we prepare for the reality of quantum computers breaking RSA and ECC, a keenly important concept to understand is "Harvest and Decrypt." The practical impact of Harvest and Decrypt is that for secrets with a reasonable lifespan, the quantum computer threat is much closer than you might think, including as early as today. In this episode we explain why that's the case and how this attack is likely to roll out.
Podcast Transcript
Lightly edited for flow and brevity.
So, in the world of post-quantum cryptography, there’s an idea called harvest and decrypt. Why don’t you get us started? So, what’s the basic idea here, Jason?
That’s probably something you could consider quantum apocalypse. If it’s down to a month, if it’s down to a day, well, you are talking about an incredibly high speed of decryption and factorization. I’m thinking though that if we get it under a year - -
Probably depending on how important the communication is - -
First of all, they want to be able to counter any kind of attacks but I think this is a very offensive first world, Tim, and that’s the crazy thing about this is it’s an offensive first world which is I want to get to the state of being able to decrypt RSA and ECC first so that I have an advantage. And I think every nation state is looking at that right now.
So, what to do is this. I think like the guys and girls out there who are doing really, really big secrets. Important secrets. Military and nation state, super-duper big high finance. They are already taking inventory of secrets that they know would be of value to the bad guys.
And I think in any risk mitigation scenario, just assume all of your communication has been recorded and therefore, take inventory of what are the most important secrets you are transmitting within your enterprise that whether it’s intellectual properties, some kind of trade secrets that you would never-ever over the next five to ten years want to get into somebody’s hands. That’s a smaller list than just your average every day, everything you are doing cryptographically. So, take inventory of signed documents. Take inventory of anything that’s encrypted outside of AES. Like very, very, very specifically using AES and RSA especially in terms of things that are communicated between systems. I’m not talking about just the average chatter between IoT devices or browser sessions of human beings to say your CRM. I’m talking about what are the big secrets you have that are transmitted in that way. Take that inventory and at least you know where your crown jewels are. Everybody should have that list. Don’t assume that those secrets are going to be in safe hands in the next five to ten years.
And then, I guess the other thing is we’ve talked in the past in previous episodes about how it’s going to take your industry and your vendors and things are gonna take some time to get there but don’t be a laggard on this one. As soon as you can start putting that post quantum crypto in place, you, at least for those secrets and communications, once it’s in place, you are knocking out that scenario and so when the time comes you don’t want to be the last kid on the block to move over to these new algorithms. That’s something you are gonna want to move on pretty quickly.
And if after part of your inventory work you determine that you have secrets that you have encrypted with those particular algorithms that are going to live or be dangerous to get in other people’s hands within the next five to ten years, then perhaps it is time to start looking at using hybrid certificates with post-quantum algorithms against those high-level secrets sooner than later. Don’t wait until everything is absolutely in place and all the answers are answered. If you have secrets that are that important, the time to start acting is right now.

