Harvest now, decrypt later (HNDL) on WAN fiber: a comparison of MACsec, IPsec, optical Layer 1 encryption, post-quantum cryptography (PQC), quantum key distribution (QKD) and photonic layer security (PLS), focused on what a fiber tap still records under each. Brand site: https://www.cyber-ridge.com/
You get a plain comparison of five defenses and the question that separates them: can the attacker still keep a copy of the traffic?
Key points covered:
- A fiber tap needs only a bend in the cable. Single-mode fiber leaks light below a bend radius of roughly 6.5 to 7.5 centimeters, and a clip-on coupler captures it with no outage and no alert.
- MACsec, IPsec and Layer 1 encryption produce ciphertext, and the tap copies that ciphertext.
- PQC (ML-KEM, FIPS 203) and QKD protect the key exchange. The recorded payload still exists after both.
- Executive Order 14412 sets December 31, 2030 for post-quantum key establishment on high-value US federal systems. The Global Risk Institute puts the chance of a key-exchange-breaking quantum computer within ten years at 28 to 49 percent.
- PLS spreads the signal across a wide band below the fiber's background noise, so a tap captures optical noise.
CyberRidge's Carmel is a PLS platform. The video sets it next to Layer 1 encryption from Nokia and Adva. Carmel installs as a matched pair of units alongside existing DWDM equipment, reaches 100 kilometers unamplified, and supports EDFA and Raman amplifiers for longer spans. It protects WAN fiber only, not LAN or Wi-Fi traffic.
Sources:
NIST FIPS 203 https://www.nist.gov/node/1877716 |
Executive Order 14412 https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/ |
Global Risk Institute https://globalriskinstitute.org/publication/quantum-threat-timeline-report-2025b/
#HarvestNowDecryptLater #HNDL #PostQuantum #PQC #FiberSecurity #FiberOptics #MACsec #QKD #QuantumSafe #OpticalNetworking #NetworkSecurity #Cybersecurity #WANSecurity #PhotonicSecurity #Layer1Encryption
