IDEMIA Secure Transactions is the first company to gain EMVCo certification for a payment card platform incorporating post-quantum cryptography and crypto-agility services, establishing a foundation for banks preparing for future quantum computing threats. Unlike typical IT systems, these cards are designed to function for years within the limited hardware of a payment card and maintain compatibility with existing payment infrastructure.
“Post-quantum security is not a challenge banks can afford to address only when quantum computers become capable of breaking today’s cryptography,” says Marc Bertin, CTO of IDEMIA Secure Transactions. The certified platform combines a hardware post-quantum accelerator with the IDEMIA Sphere PQC library, offering a path to quantum-resistant offline payments and adaptable security.
EMVCo Certification Enables Quantum-Safe Payment Card Platform
IDEMIA Secure Transactions’ newly certified Java Card platform incorporates a hardware post-quantum accelerator, a dedicated circuit designed to speed up the complex calculations required for quantum-resistant cryptography within the limited space of a payment card. This certification from EMVCo confirms the platform’s adherence to global standards for secure payment processing, a critical step for widespread adoption of post-quantum security measures. The platform’s design allows it to run existing payment applications alongside these new algorithms, enabling a phased transition as payment standards evolve and quantum computing threats materialize.
The certified platform also features the IDEMIA Sphere PQC library, which supports algorithms standardized by the National Institute of Standards and Technology (NIST), including ML-KEM for key establishment and ML-DSA for digital signatures. This library is optimized for the constrained environment of a payment card, a significant technical hurdle given the limited processing power and memory available on these devices.
Beyond securing payment transactions, the platform’s crypto-agility capabilities allow the card’s security mechanisms to adapt to changing standards, threats and regulatory requirements. This adaptability minimizes the risk of technological lock-in, ensuring the card remains secure and functional even as the cryptographic landscape shifts.
The solution also extends post-quantum security to use cases beyond payments, supporting applications like digital identity and authentication services, and offering the flexibility to add new capabilities throughout the card’s lifecycle. By combining these advanced capabilities with expertise in payment technologies, IDEMIA Secure Transactions is positioning itself to strengthen the long-term resilience of the payment industry against emerging cyber threats.
Post-quantum security is not a challenge banks can afford to address only when quantum computers become capable of breaking today’s cryptography. The decisions they make today will determine how prepared their payment infrastructure will be in the years ahead. Our role at IDEMIA Secure Transactions is to make this transition both secure and seamless for consumers, while providing financial institutions the flexibility to prepare for it without disrupting the payment experiences their customers rely on today.
IDEMIA Sphere PQC Library & Crypto-Agility for Future Security
The IDEMIA Secure Transactions platform is the first to integrate standardized post-quantum algorithms directly into a certified payment card operating system, a step beyond simply demonstrating the feasibility of post-quantum cryptography. This adaptability is important given the evolving nature of quantum computing threats and the ongoing standardization efforts in post-quantum cryptography. IDEMIA Group, a global technology leader with over 10,700 employees, positions this technology as a means of strengthening long-term resilience against emerging cyber threats.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
