G+D Joins European Project to Develop Quantum-Safe ID Cards
A security firm based in Munich, Giesecke+Devrient announced it’s joined uPQComing, a European research consortium focused on developing quantum-safe identity cards. G+D’s role involves integrating post-quantum cryptography onto the small, low-power chips used in ID documents and testing prototypes within a Java Card operating system. This initiative is early-stage development work funded through a research grant, not a product ready for immediate use.
G+D’s Specific Contributions
Indeed, G+D is one of several industry and academic partners in uPQComing, an acronym for “Enhancing Cyber-Resilience for the upcoming Post-Quantum era.” The project receives funding from the Chips Joint Undertaking, which is an EU program. G+D’s responsibilities include developing quantum-resistant protocols, adapting existing authentication mechanisms, and constructing crypto-agile architectures that allow for future algorithm updates.
A key challenge lies in the limited memory and processing power of ID card chips. Post-quantum cryptographic (PQC) algorithms typically demand more resources than current cryptographic methods. G+D is exploring hybrid schemes that combine classical and post-quantum techniques during the transition phase. These prototypes are integrating into a Java Card chip operating system and researchers are assessing them for security, performance, and interoperability.
The company hasn’t specified which algorithms it is employing. If the work aligns with NIST’s standardized PQC, it would involve the FIPS 203, 204, and 205 families, finalized in 2024. G+D’s announcement doesn’t confirm this, so the “quantum-safe” designation currently indicates intent only.
Context and Implications
Von Mitschke-Collande, G+D’s Group Chief Digital Officer, linked this work to a previous feasibility study conducted with Bundesdruckerei on the German national ID card:
“The feasibility study and proof of concept for the German national ID card, conducted together with Bundesdruckerei, have shown that post-quantum cryptography is already practical for highly secure identity documents.”
This was a proof of concept, and no production ID card in Europe currently utilizes PQC. The uPQComing project is a research endeavor to establish foundational knowledge. The threat it aims to mitigate, a quantum computer capable of compromising current public-key cryptography, doesn’t exist yet. The impetus behind “harvest-now-decrypt-later” strategies is the concern that malicious actors could today collect data with a long lifespan, such as identity records, and decrypt it years in the future.
G+D, along with the consortium, also frames this project as a strategic move to enhance European sovereignty. The company hasn’t provided a timeline for when these developments might lead to a deployed document, the extent of its funding share, or the specific roles of other partners.