“Harvest now, decrypt later”: why post-quantum keys matter today
No quantum computer can break today’s encryption yet. Even so, attackers may already be collecting encrypted data to decrypt it later. This page explains the idea behind it and what Friendstime does for the text of private chats, without promising more than is proven.
The idea: record today, read tomorrow
Anyone who intercepts encrypted messages today can store them, even if they cannot read them yet. If one day a powerful quantum computer manages to break the key exchange method, such recordings could be decrypted after the fact. Experts call this “harvest now, decrypt later”. It mainly concerns content that should stay confidential for many years.
What would be vulnerable and what less so
Classic key exchange methods such as RSA rest on mathematical problems that a sufficiently large quantum computer could solve, as far as we know today. Symmetric encryption such as AES-256 is considered much less at risk according to current knowledge. That is why experts focus on key exchange: the US standards institute NIST has standardised ML-KEM for this, a method designed to withstand quantum computers too.
What Friendstime does for chat text
On Friendstime, the key for the text of private chats is exchanged with ML-KEM-768, the middle of the three ML-KEM levels; AES-256-GCM then encrypts the content. The server only stores the encrypted text. If an account does not have an ML-KEM key yet, RSA-OAEP is used, a classic method without post-quantum protection. A combination of both methods does not currently exist.
Groups, attachments and metadata
In chat groups, too, each member receives the key for the text via ML-KEM-768 once all members use a current app or the web messenger. Voice messages, pictures, videos and files in one-to-one chats are protected with ML-KEM-768 and AES-256-GCM when both accounts have a key; we do not promise this for group chats. Calls are currently encrypted in transit only (end-to-end encryption for picture and sound is in a test phase). And the server has to know who writes to whom and when in order to deliver messages.
An honest assessment
Post-quantum methods are young, and ML-KEM is still being studied. There has been no independent audit of Friendstime’s encryption so far, and Friendstime does not promise absolute security. What you can do yourself: choose a strong password used only here, switch on two-factor sign-in and do not send truly confidential things as attachments.
Try it yourself
Signing up takes a minute and is free.
Frequently asked questions
What does “harvest now, decrypt later” mean?
Attackers store encrypted data today in order to decrypt it later, should a quantum computer be able to break the key exchange.
Which chats does Friendstime protect with ML-KEM-768?
The text of private chats when both accounts have an ML-KEM key, and the text of chat groups once all members are up to date. Without such a key, RSA-OAEP is used.
Are my photos post-quantum protected too?
In one-to-one chats yes, when both accounts have a key: the key is exchanged with ML-KEM-768 and the content is encrypted with AES-256-GCM. We do not promise this for group chats; Calls are currently encrypted in transit only (end-to-end encryption for picture and sound is in a test phase).
Does Friendstime combine ML-KEM with a classic method?
No. Key exchange currently uses ML-KEM-768 or RSA-OAEP, not a combination of both.