Cryptography after the quantum apocalypse: Will today's payment security methods still be relevant in 10 years?

[Professor]

Abstract: When we talk about the future of cybersecurity, we often imagine new types of attacks and defenses. But there's one threat that's fundamentally different from anything we know. It comes not from hooded hackers, but from the laws of quantum physics, and it challenges the very foundations of modern digital security. We're talking about quantum computers and their ability to crack most cryptography used today. This article offers a calm, measured look at this "quantum future." Rather than spread panic, we'll try to understand what will actually change in the world of payment security, what technologies will replace current ones, and whether the world is ready for this transition.

Introduction: Keys That Can't Be Picked... Yet​

All modern internet security — from HTTPS connections to card transactions — rests on two pillars: asymmetric and symmetric cryptography.

• Asymmetric (public keys): This is the basis of trust. When you connect to a bank's website, your browser uses the bank's public key to establish a secure connection. Security here is based on the difficulty of mathematical problems, such as the factorization problem (RSA) or the discrete logarithm problem (ECC). For a typical computer, solving these problems would take time comparable to the age of the universe.
• Symmetric (shared secret keys): Once trust is established, data is encrypted using fast symmetric algorithms (AES-256). These are considered quantum-resistant, but depend on the strength of the first step — the asymmetric one.

A quantum computer, using the laws of superposition and quantum entanglement, can solve these "unsolvable" mathematical problems exponentially faster. For the world of payments, this means that it will theoretically be possible to:

1. Forge a bank's digital signature.
2. Decrypt the private key from the public key.
3. Gain access to encrypted historical data if it has been intercepted and stored.

This is the "quantum apocalypse" — the moment known as Q-day, when a quantum computer powerful enough to crack RSA-2048 or ECC becomes a reality. The question isn't whether, but when.

1. Chronicle of the Expected Apocalypse: Is Time Running Out?​

It's important to understand: we're not talking about tomorrow. Experts' estimates vary.

• Optimists (and possibly quantum marketers): 5-10 years.
• Realists from cybersecurity agencies (NIST, ENISA): 10-20 years.
• Skeptics: 30 years and more.

However, there are two nuances that force us to act now:

1. Harvest Now, Decrypt Later: An attacker can already intercept and archive encrypted data (e.g., payment gateway traffic) today, waiting for a quantum computer to decrypt it. Today's secret transactions could become public knowledge in 10 years.
2. A long migration cycle: Transitioning to new cryptographic standards is a colossal, multi-year undertaking for the entire global IT infrastructure: from the chips in bank cards to the software on servers and communication protocols. It needs to start early.

2. New Defenders: Who Will Replace RSA and ECC?​

The world is not standing still. A global search for and standardization of post-quantum cryptography (PQC) — algorithms resistant to both conventional and quantum attacks — is already underway. The US National Institute of Standards and Technology (NIST) is playing a leading role here, having already selected the first sets of candidates.

These algorithms are based on other complex mathematical problems that a quantum computer will be just as difficult to solve as a classical one. Among the favorites:

• Lattice-based cryptography: Considered the most promising direction. Finding the shortest vector in a multidimensional lattice appears challenging even for Shor's quantum algorithm. The Kyber (for encryption) and Dilithium (for digital signatures) algorithms have already been selected by NIST for standardization.
• Code-based cryptography: Based on the difficulty of decoding random linear codes. The Classic McEliece algorithm also passed the NIST selection.
• Multivariate Cryptography: Based on the difficulty of solving systems of nonlinear equations.

Important: These algorithms are not magic. They often require more computing resources and generate longer keys and signatures, which can be a challenge for resource-constrained devices such as bank cards or IoT sensors.

3. The Future of Payments: How will the chain of trust change in 10 years?​

In a decade, the payments world will likely take a hybrid approach and look like this:

1. Protocol and infrastructure level: Major payment systems (VISA, Mastercard), TLS certificate providers, and browser developers will implement support for post-quantum algorithms. They will likely be used in conjunction with classic algorithms (e.g., RSA + Kyber). This will provide protection against both current and future threats. This "hybrid" regime is a bridge to the complete dominance of PQC.
2. Bank and processing level: Bank and payment gateway servers will be updated to support the new algorithms. The most sensitive data (card issuance keys, root certificates) will be reissued using PQC. This will require a major hardware upgrade, but this is a planned process, similar to the transition from SHA-1 to SHA-2.
3. Client Device Level: The most interesting part.
   • Bank cards (EMV): Current chips are very limited in resources. Implementing PQC will require a new generation of microprocessors with greater memory and computing power. This will occur within the natural card replacement cycle (every 3-5 years), but will require coordination between banks, chip suppliers (NXP, Infineon), and payment systems. We will likely see the first PQC-ready cards this decade.
   • Smartphones and apps: This is simpler. They have sufficient processing power, and software updates through app stores will allow for the rapid implementation of new encryption libraries. Apple Pay and Google Pay will be updated seamlessly.
   • Online banking: Browsers and mobile apps will receive updates supporting the new algorithms. For the user, everything will remain the same: the green lock in the address bar, only the underlying math will be different.
4. Blockchain and cryptocurrencies: This is a separate risk area. Cryptocurrencies like Bitcoin use ECDSA (elliptic curve signatures). Hacking this signature would allow funds to be stolen from any wallet. Blockchain communities would have to implement incredibly complex hard forks to switch to PQC signatures, which could cause splits. This is one of the most pressing issues in this field.

4. Transition Challenges: What Could Go Wrong?​

The path to post-quantum security will not be smooth.

• Compatibility and complexity: The world must transition in sync. An old ATM that doesn't understand the new card signature will disrupt payment acceptance.
• New vulnerabilities: PQC algorithms are young. They may be vulnerable to flaws that are unseen today. It takes time to test them in real-world conditions.
• Cost: Global infrastructure replacement will cost billions of dollars. This will be a financial burden for small businesses and developing countries.
• Geopolitics: Different countries may promote their own national PQC standards, which will create fragmentation of the internet and payment systems.

Conclusion: Not an apocalypse, but a great migration​

In 10 years, today's security methods (RSA, ECC) in their pure form will likely no longer be considered secure for new systems. But they won't disappear instantly. They will live on in hybrid systems, maintaining backward compatibility with older hardware until it is naturally decommissioned.

Will the world of payments be fundamentally different for users in 10 years? No. Payments will remain fast and convenient. Customers will still be able to tap their phones at terminals or enter their CVV in online stores.

But for the industry, this is a titanic, yet manageable, task of replacing the foundation. This is not an apocalypse, but a Great Cryptographic Migration — a large-scale, planned engineering project, preparations for which are already underway.

Our duty is not to fear the quantum future, but to calmly and methodically prepare for it. And when Q-Day arrives, we will greet it not with vulnerable systems, but with new, robust digital locks that will protect our financial lives in the next era. This is evolution, not revolution. And its success depends on our ability to collaborate and plan now.