Payments, custody, and trading with zero-downtime PQC migration
Banking runs on 20-year-old cryptographic infrastructure: RSA-2048, ECDSA-P256, TLS 1.2 with NIST curves. Q-Day (NSA/NIST estimated 2030-2035) retroactively breaks these algorithms. Today's transactions, audit logs, custody wallets — all can be decrypted later. PCI-DSS 4.0 (March 2025) and CNSA 2.0 already mandate starting the migration. Stopping for a big rewrite is not an option: migration must be progressive and observable.
Three scenarios where PosQuantum acts
Tier-1 payment gateway PQC migration
European PSP processing 1.2B transactions/year (Visa/MC/SEPA). Stack: Java + Spring + SWIFT connectors + Thales HSM. 142 microservices with mutual TLS.
Big-bang migration would break SLA. PCI-DSS 4.0 requires crypto-transition plan by 2027.
Crypto-Agility Hub: negotiation layer that chooses between RSA/ECDSA/ML-DSA-65 per peer. Migration Scanner runs in CI/CD and identifies hard-coded RSA calls. PQSL Spring Middleware rolled out in 3 sprints — 8% of services per sprint, automatic rollback if latency climbs >15%.
Crypto-asset custody (MiCA)
€4B in custody for institutional clients. MiCA (effective 30-Dec-2024) requires qualified-signature cold-storage.
HD wallets (BIP32) sign with ECDSA-secp256k1 — breakable post-Q-Day. An attacker harvesting transactions today can extract seeds and drain wallets in 2035.
PQSL HybridSignature (Ed25519 + Dilithium3) for out-of-band transaction signing. HD root keys wrapped in ML-KEM-1024 in HSM. Approval logs with Dilithium3 via PUCE Archive for 10 years (MiCA retention).
Algorithmic trading platform (latency-critical)
Broker/market-maker co-located at LD4 (London) and FR2 (Frankfurt). Latency SLA < 200 µs (exchange → execution).
TLS 1.3 with X25519 quantum-breakable. Harvesting FIX messages enables strategy reverse-engineering once decrypted.
PQSL Secure Channel with hybrid handshake (X25519 + ML-KEM-512) — 512 chosen to minimise handshake overhead (~12% vs pure X25519). ChaCha20-Poly1305 for payload. Real benchmarks: PQSL ≤ 8 µs handshake overhead, 0 µs steady-state.
Reference architecture
1. Edge PQC
Load-balancer + PQSL middleware terminate classical TLS and re-handshake with PQC-hybrid upstream.
2. Agility layer
Crypto-Agility Hub negotiates algorithm per peer (RSA | ECDSA | ML-DSA-65 | hybrid).
3. HSM integration
Private keys stay in HSM; PQSL calls PKCS#11 for signing — never exports.
4. Migration scanner
CI bot flags legacy-crypto usage in pull-requests — blocks merge if new code introduces RSA/ECDSA unjustified.
5. Compliance reports
Automatic PCI-DSS 4.0 + DORA export from PQSL logs.
Applicable PosQuantum products
Regulatory compliance covered
PQC plan for PCI-DSS 4.0 and DORA without stopping operations?
Free stack analysis: Migration Scanner runs 7 days read-only and delivers prioritised roadmap. No surprises.