Harvest Now, Decrypt Later: Why 2027 Is the Year VPNs Go Post-Quantum

There is a category of attack that does not need to succeed today to be worth running. You record encrypted traffic now, store it, and wait. If the encryption protecting it can be broken in five or ten years, everything you captured becomes readable the moment that day arrives. Nothing about the recording looks like an attack, because it is just passive collection. The damage is deferred, not avoided.

Security researchers call this "harvest now, decrypt later," and it is the single most important reason the encryption inside your VPN is changing. This article explains what is actually at risk, what post-quantum cryptography does about it, how far the industry has already moved, and what an honest answer looks like for a WireGuard-based service like Phantom VPN.

The attack that has already started

The premise is simple. A well-resourced adversary, a national intelligence agency being the obvious example, taps a fibre link or a cloud provider and copies encrypted traffic in bulk. They cannot read it. That is fine. They archive it.

The bet is that a cryptographically relevant quantum computer will eventually exist: a machine large and stable enough to run Shor's algorithm at scale. Shor's algorithm breaks the math behind the public-key cryptography that secures almost all internet traffic, including the key exchange most VPNs rely on. When that machine arrives, the archive unlocks retroactively.

Nobody can tell you the exact year a quantum computer breaks current cryptography. Estimates range from "later this decade" to "not for a long time," and honest experts disagree. But the deadline for harvest-now-decrypt-later is not the arrival of the quantum computer. It is today, because the recording is happening today.

Why today's VPN key exchange is on the clock

When your device connects to a VPN node, the two sides run a handshake to agree on a secret key that encrypts the session. WireGuard, the protocol behind Phantom VPN and most modern VPN apps, does this with a key exchange built on Curve25519, an elliptic-curve algorithm usually written as X25519.

X25519 is excellent against classical computers. It is fast, small, and has no known practical weakness on the hardware we use now. The problem is specific and narrow: elliptic-curve key exchange is exactly the kind of math Shor's algorithm dismantles. A sufficiently powerful quantum computer that captured your handshake could derive the session key and decrypt the traffic that followed.

Two clarifications matter here, because this topic attracts more fear than it deserves.

First, the symmetric encryption that protects the bulk of your data, AES and ChaCha20, is not broken by quantum computers in any practical sense. Quantum search theoretically weakens symmetric keys, but doubling the key size restores the margin, and modern ciphers already use large keys. The exposed link is the public-key key exchange, not the cipher.

Second, this is not a live break. There is no quantum computer today that can do this. The risk is entirely about the future reading of traffic recorded now. That is a real risk for long-lived secrets and a non-issue for things that stop mattering in an hour.

What "post-quantum" actually means

Post-quantum cryptography, often shortened to PQC, is a family of algorithms designed to resist both classical and quantum attacks. They run on ordinary computers today. The name refers to the threat they defend against, not the hardware they need.

In August 2024, after an eight-year public competition, the US National Institute of Standards and Technology (NIST) finalised the first standards. These are now the reference point the whole industry is building against.

For a VPN, the one that matters most is ML-KEM (FIPS 203). It is a key-encapsulation mechanism: a modern, quantum-resistant way for two sides to agree on a shared secret. It is the direct replacement for the vulnerable step in the handshake. The signature standards matter more for authenticating software and certificates than for the confidentiality of your tunnel.

The industry already moved, quietly

If this still sounds theoretical, look at what has already shipped in tools you may use every day. The migration is well underway, and it happened without most people noticing.

A pattern runs through all of these: hybrid key exchange. Rather than replacing the classical algorithm outright, they run the trusted classical one (X25519) and a post-quantum one (ML-KEM) together, and combine both results into the session key. An attacker has to break both to win. That protects you against a future quantum computer and against the chance that a relatively young post-quantum algorithm turns out to have a flaw. It is the cautious, correct way to migrate, and it is why you will see "hybrid" attached to almost every serious deployment.

How WireGuard goes post-quantum

WireGuard is deliberately minimal, and its handshake uses X25519. So how does a WireGuard-based VPN become quantum-resistant without abandoning the protocol that makes it fast and auditable?

The answer uses a feature WireGuard already has: an optional pre-shared key that gets mixed into the handshake alongside the normal key exchange. If that pre-shared key is itself established using a post-quantum key-encapsulation mechanism, then the final session key depends on post-quantum secret material, even though the base handshake is still X25519.

That is exactly the approach Mullvad ships. Its app negotiates a pre-shared key using post-quantum KEMs, including ML-KEM, and feeds it into the WireGuard tunnel. The result is a standard WireGuard session that a harvested-traffic attacker cannot unlock later, because the secret they would need to reconstruct never depended on elliptic-curve math alone.

There is a cost, and it is worth being straight about it. Post-quantum keys and ciphertexts are larger than their classical equivalents. ML-KEM adds roughly a kilobyte to the exchange. Some KEMs, such as Classic McEliece, have very large public keys, which is why they are exchanged rarely rather than on every connection. In practice this means a slightly heavier handshake and a little more engineering care, not a slower tunnel once you are connected.

What this means for Phantom VPN, honestly

Phantom VPN runs WireGuard over the decentralized Sentinel network. That gives you a real structural advantage that has nothing to do with quantum computing: there is no company-owned fleet where every user's sessions meet, so there is no single place to tap that sees everyone at once. Harvesting has to happen link by link rather than in one privileged location.

But we are not going to tell you that decentralization makes post-quantum irrelevant, because it does not. Standard WireGuard key exchange is X25519, the same algorithm this article describes as being on the clock, and that is true across the industry, not just here. The decentralized model shrinks the blast radius of bulk collection. It does not, by itself, make a recorded handshake safe from a future quantum computer.

So here is the honest position. Post-quantum key exchange for WireGuard, using hybrid ML-KEM to establish the tunnel secret, is the direction every serious WireGuard VPN is moving, and it is on our roadmap for the same reason it is on theirs. If a provider tells you their VPN is already "quantum-proof," ask them the specific question that actually matters: is the key exchange hybrid post-quantum, and which KEM. Anything vaguer than that is marketing.

What you can do right now

You do not have to wait for the industry to finish migrating to reduce your exposure. A few things help today.

The quiet part of this story is the reassuring part. The cryptography community saw this coming a decade out, ran a careful public competition, and shipped standards before the threat became urgent. In 2027 the remaining work is deployment, not discovery. The tools are ready. The job now is putting them everywhere your traffic goes, and a VPN is one of the most important places on that list.