Post-Quantum and Harvest Now, Decrypt Later

Most encryption in use today is computationally secure. It holds because breaking it costs more compute than an attacker can afford, using the best method currently known.

That is a bet with two open variables: what compute becomes available, and what methods become known. Neither is fixed, and neither is under your control.

Threshold secret sharing does not make that bet. This page explains the difference and states precisely what Untrace does and does not claim.

What is harvest now, decrypt later?

Copy the ciphertext today. Store it. Decrypt it when you can.

The strategy needs no breakthrough to begin, only the expectation of one. Storage costs almost nothing, so an adversary can hold an exfiltrated archive indefinitely at negligible expense while decryption capability improves around it.

This matters when the value of the data outlives the cipher protecting it. Onboarding documents, identity records, medical files, and legal archives stay sensitive for decades. A cipher chosen today has to survive that entire window, along with every advance in cryptanalysis and hardware inside it.

Records exfiltrated in breaches years ago are sitting in archives right now, waiting for exactly this.

What would a quantum computer actually break?

The threat is specific rather than universal. Two algorithms matter.

Shor's algorithm breaks the hard problems behind public-key cryptography: integer factorization and discrete logarithms. A sufficiently large fault-tolerant quantum computer would defeat these outright, not merely weaken them.

Grover's algorithm gives a quadratic speedup on unstructured search, which affects symmetric ciphers and hashes but does not break them.

The practical reading: symmetric encryption at 256 bits is expected to remain sound. Public-key cryptography as deployed today is not.

But "expected to remain sound" is still a forecast about compute, and it says nothing about future cryptanalysis of AES itself. It is a strong bet. It is a bet.

Why is Shamir's Secret Sharing different?

Shamir's Secret Sharing is information-theoretically secure, which is a stronger property than computational security and is not a bet at all.

A secret is encoded as the constant term of a random polynomial of degree K minus 1 over a finite field. Each share is one point on that curve. Recovering the polynomial requires K points, via Lagrange interpolation.

With K minus 1 shares, the situation is not "hard to solve." It is underdetermined. For every possible value of the secret, there exists exactly one polynomial of that degree passing through the shares you hold and through that value. Every candidate secret remains exactly as likely as it was before you saw any shares.

The shares carry no information about the secret. Not encrypted information. None.

This is why the usual attacker resources do not apply:

• More compute does not help. There is nothing to search for.
• A quantum computer does not help. Shor and Grover both attack computational problems, and there is no computational problem here.
• Future cryptanalysis does not help. There is no algorithm to weaken.
• Infinite time does not help. The missing information was never written down.

This is the same property that makes a one-time pad unbreakable, applied to key custody instead of to messages.

How Untrace layers the two

Untrace does not rely on either primitive alone. The pipeline is described fully in Sharding Data Layer; the security-relevant structure is:

File
  -> AES-256-GCM or XChaCha20-Poly1305        (computational, 128-bit PQ margin)
       -> encrypted payload, symmetric key K
            -> K split by Shamir's Secret Sharing    (information-theoretic)
                 -> N key shares, threshold K
            -> encrypted payload erasure-coded
                 -> N payload shards, threshold K
  -> each node receives one key share + one payload shard

The consequence for a harvest-now-decrypt-later adversary is the part that matters:

Stealing the ciphertext is not enough, no matter how long they wait.

The symmetric key is not stored anywhere as an object that future compute can attack. It does not exist in one piece at rest. It exists as N points, held by N independent operators, and below K of them the key is information-theoretically undetermined. An adversary who exfiltrates the complete encrypted payload and waits fifty years for a quantum computer still has nothing to point it at.

To recover the file, they must compromise K independent nodes and hold your signing authority. That is an access-control and operations problem, in the present, against separate targets. It is not a cryptanalysis problem they can solve later at their leisure.

What Untrace claims, stated precisely

Being exact here matters more than sounding strong.

The claim:

Below the reconstruction threshold, the key shares held by a set of compromised nodes are information-theoretically secure. No quantity of computation, quantum or classical, recovers the encryption key from fewer than K shares, because the information required is not present in them.

What follows from it:

• A pure ciphertext harvest has no future decryption path, regardless of advances in compute.
• Compromising fewer than K nodes yields no partial progress toward the file. There is no gradual erosion.
• The payload cipher's post-quantum margin, roughly 128 bits under Grover against AES-256, is a second layer rather than the only one.

What does not follow from it, and is not claimed:

• Untrace is not "quantum-proof." That phrase describes a system, and a system includes signatures, transport, and node software. Untrace's wallet signatures use conventional elliptic-curve cryptography today and would need migration to post-quantum signature schemes on the same timeline as everyone else. Those signatures gate access, not the confidentiality of already-harvested shards.
• Sub-threshold security is not endpoint security. A compromised device at reconstruction time sees plaintext.
• An attacker who does compromise K independent nodes and obtain signing authority can reconstruct the file. The architecture raises the cost of that path to a coordinated, cross-jurisdiction, cross-stack compromise. It does not eliminate it.

The honest summary: Untrace moves the confidentiality of stored data off a long-horizon cryptographic bet and onto a present-tense, multi-party compromise requirement. That is a categorical improvement for data that must stay private for decades. It is not a claim of absolute security, and treating it as one would repeat exactly the mistake this page is about.

Next

• Why Encryption Is Not Enough for the broader threat model.
• Shamir Secret Sharing (SSS) for the mathematics and threshold parameters.
• Untrace Compared to Other Storage for how this scores against alternatives.