IDEMIA Achieves First EMVCo Certification for Quantum-Safe Cards
IDEMIA Secure Transactions has secured EMVCo certification for a Java Card platform that integrates post-quantum cryptography with crypto-agility. The company states this is an industry first for payment cards. The certification applies to an in-house designed secure chip, which features a hardware post-quantum accelerator and access to IDEMIA’s Sphere PQC library. For banks issuing cards intended for long-term use, this certified pathway to quantum-resistant payments represents a tangible industry advancement, moving beyond mere discussion.
Details of EMVCo Certification
EMVCo establishes the standards that ensure the security and interoperability of card payments globally. According to IDEMIA, the certified platform operates on an IST-designed secure chip, enabling applications to access post-quantum algorithms via the Sphere library. This library is optimized for the limited memory and processing capabilities of a payment card. The platform maintains compatibility with current payment applications as it offers new algorithms for future payment standard adaptations.
The company confirms the following features:
- Certified by EMVCo, the governing body for secure card payment standards.
- A Java Card platform built on an IST-designed secure chip.
- A hardware post-quantum accelerator integrated into the chip.
- Access to the IDEMIA Sphere PQC library and crypto-agility services.
- Support for FIDO authentication, digital identity credentials, and loyalty programs, which can be loaded at issuance or later.
- Continued compatibility with existing payment applications.
IDEMIA positions this achievement as a foundation for quantum-resistant offline payments. The company asserts that crypto-agility allows a card’s security to adjust to evolving standards and regulatory requirements, thereby reducing reliance on any single algorithm. IDEMIA claims to be the first vendor to receive EMVCo certification for a PQC payment-card platform, a claim supported by its press release.
Significance of Timing and Remaining Questions
The impetus for such cards stems from defined migration timelines. NIST‘s planning guidance, outlined in IR 8547, suggests deprecating classical public-key algorithms by 2030 and prohibiting their use by 2035. This provides a shrinking timeframe for issuers to replace cards that typically remain in use for several years. The post-quantum signature and key-establishment standards referenced by these deadlines are found in NIST FIPS 203, 204, and 205.
Several aspects remain unconfirmed. IDEMIA hasn’t publicly disclosed the specific PQC standard or hybrid construction utilized by the platform, making it unclear whether it employs ML-KEM, ML-DSA, or a proprietary scheme. Though the card itself is certified, it is only one component in a larger system that includes terminals, acquirers, and payment schemes. This certification alone does not render the entire payment ecosystem quantum-safe. The readiness and security claims should be considered IDEMIA’s until independent test data becomes available.
For further information on how PQC deadlines are impacting the crypto sector, refer to our ongoing QNews post-quantum coverage.