Context
- As India’s financial system becomes increasingly digital, regulators are preparing for the longer-term cybersecurity risks posed by quantum computing.
- In 2026, the RBI constituted the Q-SAFE Expert Committee, while India’s National Quantum Mission advanced a roadmap for transition towards quantum-safe cryptography.
Why Quantum Computing Threatens Current Cryptography
- Classical computers use bits represented as 0 or 1, while quantum computers use qubits, which exploit properties such as superposition and entanglement.
- Quantum computers are not faster for every task, but sufficiently powerful systems can solve some mathematical problems far more efficiently than classical computers.
- RSA and Elliptic-Curve Cryptography (ECC) secure much of today’s digital communication by relying on difficult mathematical problems such as integer factorisation and discrete logarithms.
- A sufficiently powerful fault-tolerant quantum computer, using Shor’s algorithm, could solve these problems much more efficiently and weaken these forms of public-key cryptography.
- This would threaten key exchange, digital signatures, authentication and secure financial communication.
- The risk is therefore not that quantum computers would directly “hack” banks, but that they could undermine the cryptographic foundation of digital banking.
Harvest Now, Decrypt Later and the Need for PQC
- Harvest Now, Decrypt Later (HNDL) refers to attackers collecting encrypted data today and storing it for possible decryption once capable quantum computers emerge.
- This is especially important for financial, identity and government data that must remain confidential for many years.
- The principal defence is Post-Quantum Cryptography (PQC) — algorithms designed to remain secure against both classical and quantum attacks.
- Banks also need crypto-agility, or the ability to replace cryptographic algorithms without rebuilding entire IT systems.
- Early preparation is essential because banking infrastructure spans legacy systems, cloud platforms, payment networks and third-party vendors.
India’s Quantum-Safe Financial Roadmap
- The RBI established the Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE) Expert Committee in 2026 to examine quantum-related risks and opportunities for finance.
- India’s quantum-safe roadmap envisages foundational preparedness by 2027, high-priority Critical Information Infrastructure migration by end-2028, and full PQC adoption for CII by end-2029.
- Banks should begin with a cryptographic inventory, identify long-lived sensitive data, test PQC and hybrid solutions, and coordinate with technology vendors.
- SEBI has also strengthened cyber preparedness through an IT Resilience Index for Market Infrastructure Institutions.
- India therefore faces a dual challenge: building domestic quantum capability while making digital finance quantum-resilient.
Global Shift towards Quantum-Safe Security
- In 2024, the US National Institute of Standards and Technology (NIST) finalised its first three PQC standards: ML-KEM, ML-DSA and SLH-DSA.
- The European Union has called for PQC transition to begin by end-2026, with high-risk systems protected by 2030.
- These developments show that migration must begin before cryptographically relevant quantum computers become available.
FAQs
Q1. Why is quantum computing a threat to banking security?
A sufficiently powerful fault-tolerant quantum computer could weaken widely used public-key cryptography.
Q2. What is Harvest Now, Decrypt Later?
It is the strategy of storing encrypted data today for possible quantum decryption in the future.
Q3. What is Post-Quantum Cryptography?
PQC uses algorithms designed to resist attacks from both classical and quantum computers.
Q4. What is crypto-agility?
It is the ability to replace cryptographic algorithms quickly without redesigning entire systems.
Q5. What is India’s quantum-safe target for critical infrastructure?
India envisages foundational preparedness by 2027, high-priority migration by end-2028 and full PQC adoption for CII by end-2029.
