IDEMIA adds post-quantum cryptography to a payment card platform
IDEMIA says its card platform passed an EMVCo evaluation. Banks can develop cards with new cryptographic capabilities while existing payment applications continue to work.
Reading tools for text size, copying, printing and your reading list
What the card supplier built
A bank can issue a card today that a customer will carry for years. By the time payment networks adopt a new security method, that card may still need to work with the same terminal at the corner shop. IDEMIA is offering banks a way to put some of the required hardware in the wallet ahead of that change.[1]
IDEMIA Secure Transactions says EMVCo certified its Java Card platform, the software environment for applications on a secure chip. The supplier designed a chip with a hardware accelerator for post-quantum cryptography. Card applications can call routines in its Sphere library. Existing payment applications can keep using the methods they already support.[1]
IDEMIA announced the platform on October 29. An important detail is missing from its release. EMVCo issues a numbered certificate for an evaluated platform, and the release does not give the certificate number or exact version. That makes it difficult to tell which security functions the evaluation covered.[1][2][3]
From chip capability to a change at checkout
- Platform
The supplier reports support for additional algorithms and a certified Java Card platform.
- Specification
Payment rules must define when the card and terminal can use a new method.
- Rollout
A named issuer and interoperability results would establish what actually reaches customers.
What an offline terminal would need
Consider an offline purchase. A terminal needs rules for recognizing a card’s proof of authenticity without asking the bank to verify it on the spot. Putting a new cryptographic routine on the card supplies one piece. The payment network still has to specify the messages, and the card and terminal must both understand them. IDEMIA names no bank or retailer already using the new method.[1][4]
EMVCo distinguishes the authentication of a chip transaction from the long-term secrecy of stored data. Reading an old payment exchange later is a different attack from impersonating a chip during a new transaction. The organization’s chip guidance is specific to that payment context.[4]
From the laboratory to a purchase
The next evidence would come from both ends of a purchase. A published certificate for the specific platform would document what was evaluated. An issuing bank could then identify the card and terminals it tested together, including whether the transaction completed within its normal time window. That would connect the chip’s new capability to an experience a shopper could actually have.[3]