TECHNICAL RESOURCE — MODELLED ANALYSIS
A Modelled Assessment of Quantum Decryption Risk Across India's Critical Sectors.
This is a modelled analysis — a structured assessment of Harvest-Now-Decrypt-Later (HNDL) risk across India's regulated sectors, based on public regulatory data, published intelligence assessments, and NIST/CERT-In guidance. Not based on primary survey research.
- Modelled Against PMLA, RBI, DPDP Act & Clinical Retention Norms
- RSA-2048 & ECC vs. Quantum Decryption Horizon
- Transparent Methodology & Public Source Attribution
Contents & Sector Breakdown
What This Document Covers
A structured examination of Harvest-Now-Decrypt-Later exposure across India's financial, health, and national critical infrastructure.
Methodology & Data Sources
Exposure estimates are derived from three public data sources:
- Regulatory Retention Norms: Statutory retention requirements for each data classification (RBI directions, PMLA guidelines, DPDP Act obligations, Clinical Establishments Act retention rules).
- Cryptographic Lifecycles: RSA-2048 and ECC security lifecycle transition estimates from NIST (SP 800-131A Rev 2), NCSC UK, BSI Germany (TR-02102-1), and ANSSI France.
- Q-Day Threat Horizons: Timeline projections from NSA CNSA 2.0 guidance, GCHQ published assessments, and ANSSI quantum threat advisories.
- Scope Note: The analysis does not include proprietary or primary survey sampling from Indian enterprises.
BFSI Sector Exposure — Modelled Analysis
KYC and AML Records: 10–40 year statutory retention under the Prevention of Money Laundering Act (PMLA) and RBI directions.
- Cryptographic Safety Horizon: RSA-2048 estimated safe window extends only to 2032–2034 (per NIST guidance).
- Exposure Gap: For financial records created today, the exposure window spans 6 to 26 years after RSA-2048 is broken.
- High-Value Transaction Flow: UPI transaction volume at risk represents ₹45 billion daily (per RBI Annual Report 2025–26).
- Assessment: HNDL risk is acute — intercepted transactions and customer KYC archives harvested in 2024–2026 will retain full regulatory and market sensitivity when quantum cryptanalysis becomes operational.
Healthcare Sector Exposure — Modelled Analysis
Patient Medical Records: Mandatory retention under the Clinical Establishments Act requires typically 5–7 years minimum, but clinical histories are practically permanent for chronic and oncology care.
- Genomic & Biomarker Data: Permanent, lifelong sensitivity spanning generations.
- DPDP Act Alignment: No fixed statutory retention ceiling — data must be retained "as long as necessary for the stated purpose", extending breach liability indefinitely.
- Assessment: Healthcare records exhibit the longest HNDL exposure window of any evaluated domain — a genomic dataset or diagnostic record encrypted today has effectively infinite sensitivity and irreversible breach impact.
Defense and CII Exposure — Modelled Analysis
Tactical Communications and C2 Data: Classified retention mandates with operational relevance windows spanning 10 to 20+ years for strategic military doctrine and defense procurement.
- Nation-State Adversary Timelines: Sophisticated foreign adversaries operating on 15-year intelligence planning cycles already maintain persistent infrastructure for bulk internet backbone and satellite uplink traffic harvesting.
- Assessment: The threat is not theoretical — it represents the documented collection doctrine of tier-one state intelligence agencies per verified open-source intelligence reporting.
The Harvest-Now-Decrypt-Later Asymmetry
All three sectors have data-sensitivity windows that extend far beyond the estimated RSA-2048 safety horizon:
- Data encrypted today with RSA-2048 or ECDH P-256 and intercepted by an adversary will become decryptable long before that data loses its operational or economic value.
- The HNDL Asymmetry: Adversaries harvest encrypted ciphertexts today at near-zero marginal storage cost; decryption becomes feasible at a future date they do not control but can patiently wait for.
- Required Mitigation: Immediate migration to hybrid key encapsulation mechanisms (FIPS 203 ML-KEM-768 paired with classical ECDH) to prevent retroactive interception of current traffic.
SECTOR EXPOSURE MATRIX
Data Sensitivity vs. Cryptographic Lifetime
Comparison of regulatory retention requirements, algorithmic safety windows, and resultant exposure horizons across sectors.
| Sector / Data Class | Governing Mandate | Retention Window | Current Cipher | Quantum Horizon | Net Exposure Window |
|---|---|---|---|---|---|
| BFSI: KYC & AML Archives | PMLA / RBI Master Directives | 10–40 years | RSA-2048 / ECDHE | 2032–2034 | 6–26 years exposed |
| BFSI: UPI / Core Banking Channels | RBI Q-SAFE / NPCI Circulars | 8–10 years | TLS 1.2/1.3 ECDHE-RSA | 2032–2034 | Immediate harvest threat |
| Healthcare: Genomic & EHR | DPDP Act SDF / Clinical Est. Act | Permanent / Lifelong | RSA-2048 / AES-128 | 2032–2034 | Permanent exposure |
| Defense: C2 & Enclave Uplinks | NCIIPC / MoD Directives | 15–25 years | Legacy PKI / IPsec ECC | 2030–2033 | Active adversary harvest |
| Power: SCADA / Substation ICS | CEA Cyber Regulations 2024 | 15–20 yr hardware life | IEC 62351 TLS 1.2 | 2032–2034 | Firmware replace cycle |
Related Technical Intelligence
Explore Related Research & Specifications
PQC Migration Blueprint
Engineering roadmap for discovering and migrating legacy algorithms to NIST standards.
Read Blueprint →NIST Standards Guide
Deep technical reference for finalized FIPS 203, 204, and 205 algorithms and parameter sizes.
Read NIST Guide →Banking Sector Case Study
Modelled quantum exposure and CBOM inventory for a tier-1 Indian scheduled commercial bank.
Read Case Study →NEXT STEP
Ready to Apply This to Your Environment?
A scoping call maps the relevant standards and specifications to your specific infrastructure and regulatory obligations.