By Alexander Jones, International Banker
On February 7, the European Union Agency for Law Enforcement Cooperation—or Europol, as it is more commonly known—hosted a Quantum Safe Financial Forum (QSFF) event, during which an urgent call to action was issued. “Modern cryptography is fundamental to securing the financial ecosystem,” the forum stated. “The emergence of quantum computers capable of breaking current cryptographic methods presents a challenge to the entire financial ecosystem. Addressing this challenge requires a transition to post-quantum cryptography (PQC).” Given the speed at which quantum computing’s power is advancing, that transition cannot come soon enough.
PQC is focused on creating cryptographic systems that are sufficiently robust to combat the growing threats that quantum computing poses. This technological advance, it is feared, will soon be able to compromise established encryption methods, such as ECC (elliptic-curve cryptography) and RSA (Rivest-Shamir-Adleman), which represent the foundations of digital security across the world—whether for protecting online banking details, healthcare patient data or sensitive military communications. And it will be able to do so much more quickly than classical computers. These encryption methods are essential for securing the integrity and confidentiality of sensitive data, obfuscating data into an unreadable format that can only be decrypted with the appropriate key.
“Encryption algorithms protect confidential electronic information, from email messages to medical records and financial statements, from unauthorized viewers. For decades, these algorithms have proved strong enough to defend against attacks using conventional computers that attempt to defeat the encryption,” noted the National Institute of Standards and Technology (NIST), a US government agency that has been leading the charge to develop robust PQC defences in recent years. Nonetheless, the race is already well and truly on to develop quantum-computing capabilities that can perform tasks that are beyond the powers of conventional computers—including breaking encrypted systems.
“You might think quantum computing is the real existential threat to RSA and ECC. And you’d be right—Shor’s algorithm running on a sufficiently powerful quantum computer would obliterate both,” according to Damien Fortune, the founder and chief executive officer of cryptography firm SENTRIQS, in reference to the quantum algorithm developed by mathematician Peter Shor, which researchers from Massachusetts Institute of Technology (MIT) and the University of Innsbruck implemented in a quantum computer to demonstrate that quantum computing could break the world’s most widely used cryptographic methods successfully.
“But here’s the twist: AI is acting as a bridge to quantum advantage. While we wait for quantum machines to mature, AI is making today’s classical attacks faster, more scalable, and more effective. Some researchers are even developing quantum-inspired AI models to simulate the behaviour of quantum algorithms like Shor’s or Grover’s using classical hardware,” Fortune also warned, writing in a recent piece for AI-focused news publication Unite.AI. “In effect, AI is shortening the timeline for these cryptographic schemes to become obsolete—even before quantum supremacy arrives.”
The consequences of this incoming danger could be disastrous, with AI-powered quantum computers nefariously compromising vast quantities of sensitive electronic data. “For the financial industry, the advent of quantum computers poses a risk to customer confidentiality and peer communications, authentication processes, and trust in digital signatures, which enable dynamic legal agreements,” the QSFF also warned. “Quantum computers capable of posing such threats are expected to be available within the next 10 to 15 years, though this timeline could accelerate due to intense interest from both the public and private sectors.”
With such concerns in mind, then, the shift to quantum-resistant PQC-encryption solutions is now accelerating through higher expenditures into research and development (R&D) by the private sector, more financing being issued by governments and a greater number of partnerships developing with PQC specialists. “To counter this looming threat, we need encryption methods that can stave off cyberattacks by both the conventional computers we know today and the quantum computers of tomorrow,” the NIST added. “These new methods are called post-quantum encryption algorithms.”
In August 2024, the NIST confirmed that it had finalised its principal set of algorithms for withstanding cyberattacks from a quantum computer, with CRYSTALS-Kyber the primary mechanism and CRYSTALS-Dilithium, FALCON and SPHINCS+ providing options for digital signatures with different performance characteristics and security assumptions.
“Commerce bureaus are doing their part to ensure U.S. competitiveness in quantum, including the National Institute of Standards and Technology, which is at the forefront of this whole-of-government effort,” Deputy Secretary of Commerce Don Graves said at the time. “NIST is providing invaluable expertise to develop innovative solutions to our quantum challenges, including security measures like post-quantum cryptography that organizations can start to implement to secure our post-quantum future. As this decade-long endeavour continues, we look forward to continuing Commerce’s legacy of leadership in this vital space.”
Indeed, government agencies are increasingly concerned about the geopolitical risks that quantum computing could pose by breaking common encryption methods. “How would you react if you knew that all your constituents’ information is now readable and available to the highest bidder? Since the proliferation of the Internet and digitization of government services, agencies and governments have feared this scenario,” cybersecurity firm Cloudflare wrote in a piece for Government Technology, a publication covering information technology’s role in state and local governments. “Given the potential risks, there is an urgent need to accelerate the adoption of post-quantum cryptographic solutions to ensure data remains secure in the quantum era.”
Companies are also developing comprehensive plans to deal with this potentially devastating threat. “PQC provides a new generation of cryptographic algorithms designed to withstand attacks by future quantum computers. The NIST recently finalised standards for PQC, paving the way for its widespread adoption,” Google explains on its website, noting that the tech giant is taking proactive steps to secure its customer data against the potential threats of future quantum computers. “Our commitment is to safeguard your sensitive information, not just for today, but for the years ahead. We’re also dedicated to sharing our knowledge and expertise, advising both our customers and the wider industry on best practices for navigating the transition to a quantum-safe future.”
In its urgent call to action, meanwhile, the QSFF has recommended adopting a common approach to support companies and policymakers in the transition to a quantum-safe financial sector, thus preventing undue complexities and cost issues. As such, the QSFF has suggested taking the following actions:
- Financial institutions and policymakers should prioritise the transition to quantum-safe cryptography and actively support its implementation.
- Promote coordination among different stakeholders regarding their planning, roadmaps and concrete implementations of the transition to PQC and establish common goals and a shared view of the requirements to achieve them.
- Disregard calls for additional legislation; instead, establish a voluntary framework between regulators and the private sector to set PQC guidelines and achieve standardisation across institutions.
- Enhance cryptography-management practices with a forward-looking framework.
- Promote collaboration and knowledge sharing and foster a cohesive approach across jurisdictions at the global scale, including encouraging private- and public-sector industries to join forces to conduct quantum-safe experiments, projects, points of contact (POCs) and any other relevant initiatives.
Given its increasing urgency, then, it should be of little surprise that the PQC market is touted to experience spectacular growth over the coming years. According to projections, its market size will grow from $302.5 million in 2024 to $1.88 billion by 2029 at a compound annual growth rate (CAGR) of 44.2 percent for the forecast period. That’s according to a September 2024 report from Research and Markets, which specified long-term fiscal and healthcare-related data as among the highest priorities for organisations to secure from quantum decryption in the future.
Customer information in the banking, financial services and insurance (BFSI) sector is also subject to stringent regulations such as the GDPR (General Data Protection Regulation), which requires the use of advanced encryption to ensure regulatory compliance. As such, the report noted that financial institutions must rely on PQC because financial data is “the most valuable and has become very attractive to cybercriminals”, making it a must-guard item to retain customer trust.
“Very early adoption of PQC can bring competitive military advantages associated with [a] commitment to information security and privacy,” the report also stated. “Further, technology partner relationships can help ease an organisation’s migration to quantum-safe cryptography through technology collaborations. For all these reasons, there has been an increasing need for PQC to be used in sensitive data protection to stay compliant.”