# 1.1 The “Harvest Now, Decrypt Later” (HNDL) Threat

Formally introduced in 1994, Shor’s Algorithm demonstrated that sufficiently powerful quantum computers can solve integer factorization and discrete logarithm problems in polynomial time—computational primitives that underpin the security of RSA and elliptic curve cryptography (ECC). The implications for blockchain infrastructure are both concrete and severe.

Ethereum and Bitcoin rely on secp256k1-based ECDSA for transaction signatures. A cryptographically relevant quantum computer (CRQC) capable of executing Shor’s Algorithm would reduce the cost of private key extraction from computationally infeasible (classical) to feasible (quantum), effectively rendering all exposed on-chain public keys derivable into private keys. Ethereum’s BLS12-381 consensus signatures and RSA-2048-based TLS infrastructure face equivalent exposure. Protocol-level key rotation is not viable; once committed, public keys remain permanently vulnerable.

HNDL attacks exploit this permanence in an asymmetric and temporally distributed manner: adversaries collect encrypted blockchain data and wallet public keys at low cost today, and decrypt them retroactively once CRQCs become operational. Unlike traditional infrastructure—which benefits from key rotation and forward secrecy—the immutable nature of blockchain records transforms a core strength into a structural vulnerability.

The timeline for CRQC threats has been established by multiple authoritative institutions:

* **NIST PQC Project:** Finalized ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) in 2024, based on an assessed urgent transition window of 10–15 years.
* **NSA CNSA 2.0 (2022):** Mandates full transition to PQC for national security systems by 2035.
* **UK NCSC:** Issued coordinated guidance for critical infrastructure operators to transition to PQC.
* **EU NIS2 / DORA:** Mandates cybersecurity risk management for financial institutions, including quantum preparedness.

Hardware-based, quantum-generated entropy constitutes the minimum trust foundation for any post-quantum security service claiming verifiable randomness. Software-based PRNGs are insufficient for institutional-grade PQC key generation; only physical entropy sources satisfy the requirements defined in NIST SP 800-90B.

*Figure 1.A — Web3 Cryptographic Vulnerability Matrix*

<table data-header-hidden><thead><tr><th width="114.55560302734375"></th><th width="159.00006103515625"></th><th width="180.444580078125">Text</th><th width="186.7777099609375"></th><th width="101.3333740234375"></th></tr></thead><tbody><tr><td>Algorithm</td><td>Use Case</td><td>Quantum Threat</td><td>NIST PQC Alternative</td><td>Urgency</td></tr><tr><td>ECDSA-256</td><td>BTC / ETH Transactions</td><td>Shor (Key Recovery)</td><td>ML-DSA (FIPS 204)</td><td>Critical</td></tr><tr><td>RSA-2048</td><td>TLS, PKI, Node Communication</td><td>Shor (Factorization)</td><td>ML-KEM (FIPS 203)</td><td>Critical</td></tr><tr><td>BLS12-381</td><td>ETH Consensus (PoS)</td><td>Shor (Discrete Log)</td><td>ML-DSA / SLH-DSA</td><td>Critical</td></tr><tr><td>SHA-256</td><td>BTC PoW, Merkle Trees</td><td>Grover (Partial)</td><td>SHA-3 / 확장 출력</td><td>Moderate</td></tr><tr><td>Ed25519</td><td>Solana, Cosmos, Polkadot</td><td>Shor (Key Recovery)</td><td>ML-DSA (FIPS 204)</td><td>Critical</td></tr></tbody></table>

*\[1] NIST SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation (2018).*\
*\[2] NSA CNSA 2.0 Advisory, September 2022.*\
*\[3] NIST FIPS 204: ML-DSA Standard, August 2024.*


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://railquant.gitbook.io/quantarail/1.-strategic-context-quantum-threats-and-the-liquidity-crisis-in-depin/1.1-the-harvest-now-decrypt-later-hndl-threat.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.