If companies migrate to post-quantum encryption now, can old RSA-encrypted chats still be decrypted later by quantum computers?

# Yes—this is a critical security problem called "harvest now, decrypt later," and it's why migration is urgent.

Here's the threat: adversaries can record encrypted traffic today and store it. Later, when quantum computers become powerful enough, they can run Shor's algorithm to break RSA and extract the plaintext [AG-2024.05-2225]. The mathematical vulnerability isn't hypothetical—Shor's algorithm *can* effectively compute the discrete logarithms that RSA security depends on, but only on a sufficiently powerful quantum computer [AG-2024.05-2225].

The key risk is retroactivity. If you migrate your *future* communications to post-quantum encryption (like lattice-based schemes such as Kyber or Dilithium [AG-2024.05-2225]), that doesn't automatically protect conversations you encrypted yesterday with RSA. Those old ciphertexts remain vulnerable to a future quantum adversary with the computational resources to attack them.

This is why security experts now recommend a two-part strategy:

1. Migrate forward: Use post-quantum cryptography (which resists both classical and quantum attacks [AG-2024.02-1740]) for all *new* communications starting now.

2. Protect the past: Reencrypt old, sensitive data—especially material with long-term value (state secrets, medical records, financial data)—using post-quantum schemes before quantum computers arrive.

The window for this isn't infinite: estimates vary, but quantum computers capable of breaking RSA are expected within years, not decades [AG-2024.05-2225]. That's why governments and industry are accelerating post-quantum standardization right now [AG-2024.05-2225].