Rafael J. Vicente, Jaime Gómez García, Juan P. Brito, Yorlandy Lobaina, Jaime S. Buruaga, Daniel Gómez Aguado, Miguel Ángel Sánchez Serrano, Simón Ovsyannikov, Salah Gherdaoui, Jean-Sébastien Pegon, Marco Cofano, Vicente Martín
quant-phSubmitted Apr 14, 2026• Announced Apr 15, 2026• 0 citations
The emergence of Cryptographically Relevant Quantum Computers (CRQCs) presents a critical threat to classical cryptographic systems, particularly widely adopted protocols such as RSA, Diffie-Hellman (DH), and Elliptic Curve Cryptography (ECC). Given their extensive use in the financial sector, the advent of quantum adversaries compels banking institutions to proactively develop and adopt quantum-safe communication mechanisms. This paper introduces a hybrid quantum-safe architecture, orchestrated via Software-Defined Networking (SDN) key distribution. The proposed framework enables the early integration of Classical Cryptography (CC), Quantum Key Distribution (QKD), and Post-Quantum Cryptography (PQC) within a Dynamic Multipoint Virtual Private Network (DMVPN) environment, providing highly scalable, full-mesh, site-to-site encrypted communications for enterprise networks. This is particularly relevant at a time when PQC algorithms have not yet been incorporated into finalized IPsec standards. The architecture has been validated across a five-node testbed comprising three physical nodes within a campus network in Madrid and two private-cloud nodes located in the north of Spain and Mexico. The deployment leverages a heterogeneous mix of physical and virtual devices, diverse technology providers, Discrete Variable QKD (DV-QKD) and Continuous Variable QKD (CV-QKD) implementations, and mutually incompatible key-delivery interfaces (ETSI004, ETSI014 and Cisco SKIP), demonstrating flexibility, scalability, and interoperability across environments. Through this framework, we demonstrate that quantum-safe communication in financial networks is not only technically feasible but also scalable, interoperable, and resilient. The proposed architecture establishes a robust, flexible, and future-proof foundation for secure financial communications in the era of quantum computing.
The emergence of Cryptographically Relevant Quantum Computers (CRQCs) presents a critical threat to classical cryptographic systems, particularly widely adopted protocols such as RSA, Diffie-Hellman (DH), and Elliptic Curve Cryptography (ECC). Given their extensive use in the financial sector, the advent of quantum adversaries compels banking institutions to proactively develop and adopt quantum-safe communication mechanisms. This paper introduces a hybrid quantum-safe architecture, orchestrated via Software-Defined Networking (SDN) key distribution. The proposed framework enables the early integration of Classical Cryptography (CC), Quantum Key Distribution (QKD), and Post-Quantum Cryptography (PQC) within a Dynamic Multipoint Virtual Private Network (DMVPN) environment, providing highly scalable, full-mesh, site-to-site encrypted communications for enterprise networks. This is particularly relevant at a time when PQC algorithms have not yet been incorporated into finalized IPsec standards. The architecture has been validated across a five-node testbed comprising three physical nodes within a campus network in Madrid and two private-cloud nodes located in the north of Spain and Mexico. The deployment leverages a heterogeneous mix of physical and virtual devices, diverse technology providers, Discrete Variable QKD (DV-QKD) and Continuous Variable QKD (CV-QKD) implementations, and mutually incompatible key-delivery interfaces (ETSI004, ETSI014 and Cisco SKIP), demonstrating flexibility, scalability, and interoperability across environments. Through this framework, we demonstrate that quantum-safe communication in financial networks is not only technically feasible but also scalable, interoperable, and resilient. The proposed architecture establishes a robust, flexible, and future-proof foundation for secure financial communications in the era of quantum computing.
As the era of quantum computing approaches, the fundamental cryptographic primitives securing global communications face a paradigm shift. With the National Institute of Standards and Technology (NIST) finalizing new standards, the industry must urgently address the vulnerabilities of legacy systems. The imminent advent of CRQCs (Cryptographically Relevant Quantum Computers) poses an existential threat to the Public Key Infrastructure (PKI) underpinning the global digital economy. Classical algorithms such as RSA and ECC (Elliptic Curve Cryptography) are vulnerable to polynomial-time cryptanalysis via Shor’s algorithm. This study investigates the HNDL (Harvest Now, Decrypt Later) threat model and evaluates the resilience of NIST-standardized PQC (Post-Quantum Cryptography) algorithms: ML-KEM and ML-DSA. Utilizing a high-performance Fortinet networking environment, we experimentally validate that "Hybrid Mode" IPsec VPNs can achieve quantum resistance with negligible performance degradation, offering a viable migration path for enterprise infrastructure. Specifically, we benchmark the trade-offs between PQC’s larger key sizes and network latency, demonstrating that the overhead remains within acceptable operational thresholds. Implementing hybrid protocols provides a critical transition mechanism, allowing organizations to secure long-term data confidentiality against retrospective decryption while preserving interoperability with legacy systems.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
The conventional cryptographic systems that underpin the world's financial infrastructure are under grave threat as quantum computing spreads. The financial industry must immediately investigate quantum-safe alternatives, as widely used public-key algorithms such as RSA and Elliptic Curve Cryptography (ECC) are theoretically susceptible to Shor's quantum algorithm, while symmetric schemes face reduced security margins under Grover's algorithm. The Systematic Literature Review (SLR) presented in this paper was carried out in compliance with PRISMA 2020 guidelines. Web of Science, Scopus, and Google Scholar were searched using Boolean keywords to find articles published between 2013 and 2025. 53 high-quality studies were chosen from an original corpus of N = 1,654 publications utilizing the Mixed Methods Appraisal Tool (MMAT), systematic screening, and eligibility evaluation. Three main paradigms for quantum cryptography were found: Post-Quantum Cryptography (PQC), which includes the NIST-standardised lattice-based algorithms CRYSTALS-Kyber and CRYSTALS-Dilithium (NIST, 2022); Quantum Key Distribution (QKD), which offers information-theoretic security through the BB84, E91, and CV-QKD protocols; and hybrid quantum-classical architectures that combine near-term deployment with long-term quantum resilience. The operational viability of quantum-secure financial communication has been confirmed through real-world deployments by JPMorgan Chase, HSBC, CaixaBank, and Danske Bank. Given the 'harvest now, decrypt later' (HNDL) threat paradigm, the evidence clearly shows that upgrading to quantum-safe cryptography is an essential operational necessity. Complementary approaches with different trade-offs in cost, scalability, and implementation maturity include QKD, PQC, and hybrid frameworks. To protect the integrity of international financial systems, financial regulators and institutions must coordinate faster adoption roadmaps aligned with NIST PQC standardisation timelines.
Open Banking exposes regulated financial capabilities through standardized open APIs to third-party providers (TPPs). While the ecosystem is protected today by TLS, mutual TLS (mTLS), OAuth 2.0/OIDC, JWT, and the FAPI profiles, the emergence of cryptographically relevant quantum computers (CRQC) introduces a "harvest-now, decrypt-later" risk that threatens long-lived financial confidentiality, non-repudiation, and systemic integrity. This paper proposes a hybrid security architecture that fuses Quantum Key Distribution (QKD) with Post-Quantum Cryptography (PQC) to secure inter-organizational open-banking communications across data centers, metro fiber, and cloud backbones. We map each integration point in an end-to-end Open Banking flow—PSU device, TPP platform, ASPSP/bank API gateway, consent management, clearing/settlement rails, observability, and audit—to concrete cryptographic mechanisms, define deterministic fallback behavior, and present deployable key-management patterns. We provide a threat model, protocol bindings to FAPI 1.0/2.0, performance and cost models, and a migration blueprint that preserves compliance while enabling quantum-safe resilience.
The rise of quantum computing introduces a profound threat to existing digital security frameworks, particularly those that underpin modern payment systems. Current cryptographic standards, such as RSA, ECC, and ECDSA are susceptible to being broken by quantum algorithms like Shor's and Grover's, jeopardizing the confidentiality, authenticity, and integrity of transactions across financial networks. This study presents a comprehensive investigation into the design, feasibility, and architecture of a universal quantum-safe payment platform capable of processing all types of digital transactions, ranging from mobile money and bank transfers to blockchain-based and card payments through existing delivery channels on a decentralized infrastructure. The research synthesizes current developments in post-quantum cryptography (PQC), including lattice-based, hash-based, and code-based algorithms, and evaluates their suitability for real-time financial systems. The proposed platform incorporates a permissioned distributed ledger, API-level compatibility with legacy financial protocols, and an identity-governed, modular architecture that enables cryptographic agility and policy compliance. Through architectural modeling and critical analysis, this research provides a forward-looking blueprint for building quantum-resilient financial infrastructure. It concludes that while performance and governance hurdles remain, quantum-safe payment networks are both technically feasible and urgently necessary. This work aims to equip stakeholders, especially fintech firms, banks, and regulatory bodies, with a detailed roadmap for transitioning to secure, interoperable, and scalable payment systems in the quantum era.
The rapid advancement of quantum computing introduces unprecedented security threats to modern cloud and edge computing infrastructures. Classical public-key cryptographic algorithms such as RSA, Diffie–Hellman, and Elliptic Curve Cryptography (ECC) are fundamentally vulnerable to quantum attacks enabled by Shor’s algorithm. As a result, the confidentiality, integrity, and authenticity of data stored and processed in distributed systems are at serious risk.Post-quantum cryptography (PQC) aims to develop cryptographic algorithms that are resistant to both classical and quantum adversaries. This paper presents a comprehensive quantum-resilient cryptographic framework designed specifically for post-quantum cloud and edge computing environments. The framework integrates post-quantum cryptographic primitives, hybrid cryptographic approaches, crypto-agile architectures, and secure key management mechanisms. The proposed framework addresses performance constraints, scalability requirements, and deployment challenges in heterogeneous environments. A detailed discussion of security threats, architectural components, performance considerations, and future research directions is provided. The proposed approach enables longterm security and supports a smooth transition toward quantum-safe distributed computing systems.