I’m researching strategies to detect the “Harvest Now, Decrypt Later” attack, also known as “store now, decrypt later” or “retrospective decryption.”

This surveillance approach involves acquiring and storing currently unreadable encrypted data, anticipating future breakthroughs in decryption technology that would render it readable. The hypothetical date for such decryption advancements is often referred to as Y2Q (a nod to Y2K).

Specifically, I’m interested in exploring AI and machine learning models that can identify signs of this attack.

Are there any existing models or techniques that can help detect instances of data harvesting with the intention of future decryption?

New contributor
Mallikarjunarao Kosuri is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 3
    You cannot detect intent. You would have to find a way to detect someone saving data. You can't detect that. Your idea doesn't seem to work.
    – schroeder
    Commented Jul 9 at 17:15
  • 1
    @user71659 but you cannot tell if it is stored for the purposes of later decryption ... all you will determine is that an IPS or DPI device is doing ... IPS or DPI things...
    – schroeder
    Commented Jul 9 at 17:45
  • 1
    @schroeder Off the top of my head, public key exchanges are of specific interest to a quantum attack, you want to save those with high certainty. If you notice funny latency behavior of re-keying packets, then it could be a sign.
    – user71659
    Commented Jul 9 at 17:52
  • 1
    One more way to identify traffic diversion to unknown geolocation, most of the load balancers do have this support my.f5.com/manage/s/article/K000134487 Commented Jul 9 at 18:01
  • 1
    ... you can detect traffic diversion, but you would not know why they did it... so your ML model is not to detect your goal, but possible diversion
    – schroeder
    Commented Jul 9 at 18:07


You must log in to answer this question.

Browse other questions tagged .