What stops attackers from stealing private keys during migration if they gain quantum capability first?

Your question assumes a critical vulnerability window: the period between when an adversary gains quantum capability and when defenses are deployed. The preprints provided don't directly address private key theft during migration, but they illuminate why this is a real threat and what's being done about it.

The core problem

The threat is real because of what's called the "harvest now, decrypt later" attack [AG-2024.02-1291]. An attacker can record encrypted communications and transactions today, then use a future quantum computer to break the encryption retroactively. This is especially dangerous for private keys, which—unlike ephemeral session keys—have lasting value.

During migration to quantum-safe cryptography, there's a window where both old and new systems coexist. If an adversary already possesses quantum capability at this point, they could theoretically intercept keys being migrated or exploit systems still using vulnerable schemes.

What actually stops them

The preprints suggest three overlapping defenses:

1. Lattice-based replacement schemes. The most promising approach is switching to cryptography that's hard for quantum *and* classical computers alike. Kyber and Dilithium are standardized examples [AG-2024.05-2225]. The key insight: these schemes rely on the hardness of finding short vectors in high-dimensional lattices, a problem that quantum computers (so far) don't appear to solve faster than classical ones.

2. Cryptographic agility and rapid deployment. Post-quantum standards are being actively standardized and adopted by governments and industry [AG-2024.05-2225]. Organizations that migrate quickly—before quantum threats materialize—minimize the window of vulnerability. The U.S. and EU are already mandating adoption timelines.

3. Hardware-level isolation during migration. For blockchain systems undergoing transition, one approach is to secure the migration process itself using quantum-resistant signing schemes for the new keys, so even if old keys are compromised, the new ones are protected [AG-2024.02-1291].

The honest gap

However, the preprints do *not* address what you'd do if an attacker *already has* quantum capability during an active migration—i.e., they're intercepting keys in real time. This remains a genuine policy and operational challenge that isn't solved by the technical literature provided.