As soon as possible, but not before the cipher is well chosen. And that should depend on actual implementation experience.