Why is quantum resistance worth the storage cost when classical attacks remain computationally infeasible today?

Your question hinges on a subtle but critical timing issue: the threat isn't today, it's the data harvested today being decrypted tomorrow.

The core argument for quantum-resistant cryptography now, despite classical attacks remaining impractical today, rests on what security experts call the "harvest now, decrypt later" scenario. Adversaries can record encrypted communications—financial records, diplomatic cables, medical data—that are worthless to them today. But once sufficiently powerful quantum computers exist, [Shor's algorithm will efficiently break the discrete logarithms and factorizations that underpin RSA and elliptic-curve cryptography] [AG-2024.05-2225]. Data encrypted with classical systems in 2024 becomes readable in 2035 or 2040, even though the encryption was state-of-the-art when deployed.

This is why the storage cost matters: sensitive information with long confidentiality requirements—state secrets, medical histories, financial instruments—has value for decades. [Quantum computers powerful enough to threaten current cryptography are likely to be available in a couple of years] [AG-2024.05-2225], though estimates vary. The cost of migrating to post-quantum algorithms *now* is a one-time pain; the cost of retroactively protecting data already stolen is impossible.

In contrast, [lattice-based cryptography like Kyber and Dilithium is considered safe against both quantum and classical attacks] [AG-2024.05-2225], offering a path forward without waiting for the quantum threat to materialize into actual attacks. Industries like blockchain are facing similar pressures: [both Shor's and Grover's algorithms threaten the public-key cryptography and hash functions that provide blockchain security] [AG-2024.02-1291], forcing redesigns sooner rather than later.

The archives provided don't directly address the trade-off between storage overhead and security timeline in quantitative terms.