IDEMIA Secure Transactions wins first EMVCo certification for a post-quantum card platform
IDEMIA Secure Transactions says its Java Card platform, with a PQC hardware accelerator and ML-KEM/ML-DSA library, is the first EMVCo-certified one of its kind.
IDEMIA Secure Transactions (IST), the payments and connectivity division of IDEMIA Group, says it has become the first company to obtain EMVCo certification for a payment card platform that gives card applications access to post-quantum cryptography and crypto-agility services. The company announced the certification on October 29, pitching it as a way for banks to start issuing cards now that can adapt as quantum-safe payment standards arrive.
What was announced
EMVCo is the global body that sets standards for secure, interoperable card payments. According to IST, the certified product is a Java Card platform running on a secure chip that IST designed itself, with a dedicated post-quantum hardware accelerator. Alongside today's cryptographic algorithms, the platform gives applications access to the IDEMIA Sphere PQC library, tuned for the limited resources of a payment card, plus crypto-agility services that let the card's security mechanisms change as standards, threats and regulations evolve.
IST says the library supports the NIST-standardized algorithms ML-KEM for key establishment and ML-DSA for digital signatures. The platform runs existing EMV payment applications unchanged, and the company says it lays the groundwork for quantum-resistant offline payments. The same card can also host other secure services, such as FIDO authentication, digital identity credentials or loyalty programs, loaded at issuance or later.
The technical details
Cards are a hard place to deploy new cryptography. IST notes that, unlike centrally managed IT systems, cards stay in circulation for several years on very constrained hardware and must work with a large, mixed base of payment terminals. Quantum Computing Report points out that lattice-based schemes use much larger keys and signatures than RSA or elliptic-curve cryptography, which puts pressure on contactless transaction times; offloading the heavy arithmetic to a hardware accelerator is IST's answer to that constraint.
IDEMIA's library page lists ML-DSA, SLH-DSA and LMS signatures and ML-KEM key agreement, with an embedded version hardened against side-channel and fault attacks, and says future standards such as FN-DSA and HQC will be added.
Why it matters
"Post-quantum security is not a challenge banks can afford to address only when quantum computers become capable of breaking today's cryptography," said Marc Bertin, CTO of IDEMIA Secure Transactions. Because a card issued today may still be in a wallet years from now, issuers that want quantum-safe options need the hardware in the field before payment schemes switch algorithms.
What to watch
The certification covers the card platform, not a post-quantum payment standard: actual PQC-based transactions will depend on how card schemes update their specifications and on whether terminals can handle larger cryptographic payloads without slowing tap-to-pay. Issuer deployments would be the next signal.
Sources
Facts on this page come from the sources below, retrieved by DesignQuantum.
- IDEMIA Secure Transactions Enables Banks to Prepare Cards for the Quantum Era with Industry-First Certification (IDEMIA) idemia.com
- Quantum-ready cryptographic libraries (IDEMIA) idemia.com
- IDEMIA Secure Transactions Achieves Industry-First EMVCo Certification for Post-Quantum Payment Cards (Quantum Computing Report) quantumcomputingreport.com