The Harvest Now, Decrypt Later Attack
TODAY (no CRQC):
Adversary ──► [records TLS handshakes + encrypted data] ──► stores on disk
FUTURE (CRQC exists):
Adversary ──► [runs Shor's on recorded ECDHE key shares]
──► [recovers session keys]
──► [decrypts all stored traffic]
This is not hypothetical. Nation-state actors are assumed to be doing this now.
CISA and NSA have both explicitly warned about HNDL in public advisories.
The window of exposure = (years until CRQC) - (years until you deploy PQC).
If you start migration in 2028 and CRQC arrives in 2030: two years of exposure.