Enterprise Document Encryption Isn’t Ready for the Quantum Era
Most enterprises think of “document encryption” as a solved problem. Files are encrypted at rest, storage systems have keys, cloud providers advertise AES-256, and everyone moves on. The problem: virtually every layer of that stack is quantum-vulnerable in a way that will only become visible once it’s too late to fix retroactively.
Why “Encrypted at Rest” Isn’t Enough
Nearly every enterprise document platform — SharePoint, Google Drive, Box, Dropbox Business, corporate file shares — uses the same architectural pattern:
- Documents are encrypted with a symmetric algorithm (usually AES-256).
- The AES keys are wrapped (encrypted) using RSA or ECC via a Key Management Service.
- The wrapped keys are stored alongside — or accessible from — the encrypted documents.
AES-256 is quantum-resistant enough that Grover’s algorithm only halves its effective security (still 128-bit, considered adequate). But the RSA/ECC key wrapping is the weak link. An attacker who exfiltrates encrypted documents and the wrapped keys today can, once a cryptographically relevant quantum computer exists, unwrap the AES keys and decrypt everything.
This is Store Now, Decrypt Later (full breakdown here) applied to your document estate. And unlike TLS traffic, documents don’t have a session expiry — they sit in backups, snapshots, and archived tenants for years.
The Long-Retention Problem
Which documents actually need to stay confidential for 10+ years? More than most security teams initially assume:
- Contracts and NDAs — often binding for 10–20 years, with confidentiality clauses that outlast the contract itself
- HR files — retention obligations of 7–30 years depending on jurisdiction (pensions, employment law)
- IP filings and R&D documentation — patent lifetime plus commercial exploitation
- M&A due diligence — sensitive for the entire strategic horizon of the merger
- Board materials, audit workpapers, whistleblower reports — often permanent retention
- Source code and design documents — commercially sensitive for the product lifetime
If any of these are stored with classical key wrapping today, they’re exposed to SNDL. And the exposure window opened the day they were encrypted, not the day the quantum computer arrives.
What Quantum-Safe Document Encryption Actually Requires
Three things need to change simultaneously — swapping just one isn’t enough:
1. Post-quantum key encapsulation. The symmetric keys wrapping documents must be encapsulated using ML-KEM (FIPS 203) or equivalent, not RSA/ECC. Ideally in hybrid mode during transition (why hybrid matters).
2. Post-quantum signatures for access control. Access decisions — “user X may open document Y” — are enforced via signed tokens or certificates. If those signatures are RS256 or ECDSA, an attacker with future quantum capability can forge access permissions retroactively. ML-DSA (FIPS 204) closes this.
3. Architecture that avoids central decryption honeypots. Traditional platforms decrypt documents server-side on access, meaning the server holds the plaintext-capable keys. A truly future-proof design keeps decryption capability at the endpoint, with the server never seeing decryptable material — combining the audit and policy benefits of a centralized vault with the blast-radius reduction of client-side encryption.
Most enterprise document platforms fail all three tests today. Migrating them individually is the multi-year rebuild that makes Mosca’s Y (see the theorem in action) impossible to hit.
Where This Lands in Practice
The document-security problem breaks into three practical use cases, and the PQVault product family maps directly onto them:
- PQVault Files — quantum-safe encryption for individual files and documents, deployable without ripping out existing storage. This is the fastest way to protect the long-retention documents (contracts, IP, HR files) that create SNDL exposure today.
- PQVault Drive — quantum-safe cloud storage encryption for teams, replacing the classical key-wrapping model in shared workspaces. Data stays encrypted with post-quantum algorithms end-to-end, so cloud provider compromise or lawful-access requests don’t expose plaintext.
- PQVault Spaces — quantum-safe collaboration environments for working with external partners, auditors, legal counsel, or M&A counterparties. The typical “share a folder via link” workflow is one of the highest-risk SNDL surfaces in most enterprises; PQVault Spaces closes it without forcing partners to install new infrastructure.
The point isn’t to encrypt every document with the strongest possible algorithm. It’s to make sure that the documents that will still matter in 15 years are protected with cryptography that will still hold in 15 years. Classical file encryption doesn’t clear that bar. It’s time the document layer caught up with the rest of the security stack.
Not sure which of your document workflows are exposed to SNDL? Book a document-security review.
