Real time payment gateways handle authorization and clearing traffic for card and account based ecosystems under strict latency and availability targets. Most deployed gateways still rely on RSA and elliptic curve cryptography, which become vulnerable once large scale quantum computers can run Shor's algorithm. Simply swapping these algorithms for NIST standard post quantum schemes is not enough, because gateways must still meet service level agreements, maintain Payment Card Industry Data Security Standard (PCI DSS) compliance, and interoperate with acquirers and issuers that migrate at different speeds. This paper presents a Post Quantum Cryptography Migration Framework that gives an end to end architectural view of gateway, acquirer, and issuer communication paths. The framework introduces a crypto abstraction layer with pluggable algorithm providers, supports hybrid classical plus post quantum modes during transition, and uses policy driven selection of key encapsulation and signature schemes such as Kyber and Dilithium. It also defines a phased migration process from asset discovery and quantum risk assessment through controlled hybrid rollout to post quantum only operation. To validate the approach, we implement a gateway testbed that replays a PaySim transaction workload and measure the impact of post quantum schemes on authorization latency and derived throughput under classical only, hybrid, and PQC only modes. The experiments show that, with careful configuration and connection management, post quantum protection can be integrated into real time payment processing with performance overhead kept within operational limits.
Real time payment gateways handle authorization and clearing traffic for card and account based ecosystems under strict latency and availability targets. Most deployed gateways still rely on RSA and elliptic curve cryptography, which become vulnerable once large scale quantum computers can run Shor's algorithm. Simply swapping these algorithms for NIST standard post quantum schemes is not enough, because gateways must still meet service level agreements, maintain Payment Card Industry Data Security Standard (PCI DSS) compliance, and interoperate with acquirers and issuers that migrate at different speeds. This paper presents a Post Quantum Cryptography Migration Framework that gives an end to end architectural view of gateway, acquirer, and issuer communication paths. The framework introduces a crypto abstraction layer with pluggable algorithm providers, supports hybrid classical plus post quantum modes during transition, and uses policy driven selection of key encapsulation and signature schemes such as Kyber and Dilithium. It also defines a phased migration process from asset discovery and quantum risk assessment through controlled hybrid rollout to post quantum only operation. To validate the approach, we implement a gateway testbed that replays a PaySim transaction workload and measure the impact of post quantum schemes on authorization latency and derived throughput under classical only, hybrid, and PQC only modes. The experiments show that, with careful configuration and connection management, post quantum protection can be integrated into real time payment processing with performance overhead kept within operational limits.
The imminent arrival of cryptographically relevant quantum computers poses an existential threat to the RSA, ECC, and ECDH primitives that underpin virtually every real-time payment gateway in operation today. This paper presents PQPG-MF, a structured six-phase migration framework designed to guide financial institutions and payment service providers through a comprehensive, risk-managed transition to NIST-standardised post-quantum cryptography (PQC) algorithms — specifically ML-KEM, ML-DSA, and SLH-DSA. The framework integrates hybrid classical/post-quantum cryptography during the transitional period, cryptographic agility engineering, hardware security module (HSM) compatibility planning, and regulatory compliance alignment covering PCI DSS v4.0 and ISO 27001:2022. We evaluate the framework against three reference architectures — a high-throughput card network gateway, an open-banking API hub, and a central bank digital currency (CBDC) node — demonstrating feasibility across diverse latency, throughput, and compliance constraints. Performance benchmarks reveal that ML-KEM-768 introduces handshake overhead of 1.4–2.1 ms over baseline TLS 1.3 in production-grade deployments, within the tolerance of real-time payment SLAs. Our threat modelling analysis using the HARVEST NOW, DECRYPT LATER attack vector underscores the urgency of migration even before large-scale quantum computers are available. The PQPG-MF framework provides actionable guidance supported by tooling recommendations, governance considerations, and a phased roadmap adaptable to institutions of varying scale.
Contemporary real-time payment processing systems rely on classical asymmetric cryptographic primitives — RSA, Elliptic Curve Diffie-Hellman (ECDH), and ECDSA — that will become computationally vulnerable with the advent of cryptographically relevant quantum computers (CRQCs). This paper introduces NGCMF (Next-Generation Cryptographic Migration Framework), a comprehensive, seven-layer methodology engineered to guide payment processors, card networks, and financial institutions through a structured, auditable transition to NIST-standardised post-quantum cryptography (PQC). NGCMF spans the full cryptographic lifecycle: from automated cryptographic asset discovery and quantum risk classification, through hybrid classical/PQC architecture design and phased production rollout, to long-term cryptographic agility governance. The framework addresses the HARVEST NOW, DECRYPT LATER (HNDL) threat model — wherein adversaries archive encrypted transaction data today for future quantum decryption — as a primary migration driver, alongside conventional forward-secrecy and integrity requirements. We instantiate NGCMF across four real-world payment system archetypes: an ISO 8583 card network switch, an open-banking REST API hub, a CBDC settlement node, and a cross-border SWIFT MX messaging gateway. Performance evaluations demonstrate that ML-KEM-768 (FIPS 203) introduces TLS 1.3 handshake overhead of 1.4–2.3 ms, within real-time SLA tolerances, while ML-DSA (FIPS 204) requires HSM horizontal scaling for high-frequency signing workloads. Regulatory mapping confirms alignment with PCI DSS v4.0, ISO 27001:2022, EU DORA, and NIST SP 800-57 Part 1 Rev. 5. The NGCMF provides financial institutions with a practitioner-oriented, standards-grounded roadmap for achieving quantum-resilient payment infrastructure within a 12–18 month deployment horizon.
The impressively fast development of quantum computing is a serious threat to classical public-key cryptography, and algorithms such as Shor's and Grover's will render RSA and elliptic curve systems essentially useless as soon as a cryptanalytically relevant quantum computer becomes available. Although it is still some way off before such machines are available, the harvest-now-encrypt-later threat highlights the need for proactive defense. In response, the National Institute of Standards and Technology (NIST) published the first post-quantum cryptography standards in 2024, including ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) for digital signatures and SLH-DSA (SPHINCS+) as a stateless hash-based alternative. This paper is a summary of the evolving post-quantum landscape, starting with the standards and their underlying security and then moving on to migration policies such as CNSA 2.0 and CISA, NSA and NIST guidance. It also looks at integration patterns for important protocols such as TLS, IPsec, SSH, and code signing. A performance, interoperability and overhead evaluation methodology is presented with results showing that hybrid deployment and crypto-agile architectures make PQC adoption a viable option. The paper concludes by providing a governance-oriented roadmap, where inventory, prioritization and pilot deployments are identified as near-term actions, with open questions remaining on performance optimization, implementation security and algorithm resilience over time.
Quantum computing poses an existential threat to classical public-key cryptography, particularly RSA and elliptic-curve systems, which form the backbone of secure communication, authentication, and digital trust. Once scalable quantum computers emerge, algorithms such as Shor’s will be capable of breaking these schemes, jeopardizing confidentiality and integrity across the internet and enterprise systems. Post-quantum cryptography (PQC) offers a viable defense, providing quantum-resistant algorithms that can be implemented on today’s hardware and protocols. Recent standardization milestones—including NIST’s approval of ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) for signatures, and the selection of HQC as a complementary KEM—mark a turning point for practical adoption. This paper surveys the quantum threat model, algorithm families, performance trade-offs, and integration patterns such as hybrid modes and crypto-agile architectures. It further outlines a phased migration roadmap for enterprises, emphasizing harvest-now-decrypt-later risks and compliance imperatives. By bridging technical, operational, and policy perspectives, the study provides actionable guidance to prepare organizations for a secure and quantum-resilient future.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.