Mint Explainer: As banks brace for quantum attacks, is India moving too slowly?

Mint

2 days ago

Banks and financial institutions worldwide are gearing up for the day when quantum computers become stable enough to potentially break traditional encryption, which could cause massive data breaches, falsified transactions, identity theft, and large-scale market manipulation.
To guard against this, major players such as JPMorgan, Mastercard, Barclays, Citigroup and Wells Fargo are adopting quantum-resistant or post-quantum cryptography (PQC) encryption that's designed to resist such attacks.
JPMorgan, for instance, has launched a quantum-secured, crypto-agile network (Q-CAN) in Singapore using quantum key distribution (QKD), in which encryption keys are encoded in light particles. Since merely observing a quantum particle changes it irreversibly, any hacking attempt disrupts the signal, exposing the tampering.
The bank is also aligning its systems with the latest National Institute of Standards and Technology (NIST) standards. In March it collaborated with Honeywell-owned Quantinuum and national labs to generate certified quantum-based random numbers to strengthen cryptographic systems.
Also read: India quantum startups win record grants; move closer to real-world applications
Last November, Banque de France and the Monetary Authority of Singapore tested quantum-resistant algorithms to encrypt and sign emails across conventional internet systems. They now plan to expand PQC trials to cross-border payment networks.
Meanwhile, Mastercard has tested NIST candidate algorithms and explored QKD integration in its global network, despite challenges with compatible hardware. If vendor support continues, Mastercard expects QKD could be ready for deployment within five years.
Why the tearing hurry?
One may ask: shouldn't financial institutions wait until quantum computers are stable and market-ready, especially since some experts see this happening within 10 years, while others say it will take until 2035-2040?
In the computers we use in homes and offices today, two bits can represent one of four possible states—00, 01, 10, or 11—but only one at a time. In contrast, two quantum bits (qubits) in a quantum computer can represent all four states simultaneously, thanks to superposition and entanglement properties, effectively functioning like four classical computers in one.
For now, though, while a quantum computer's power grows exponentially when you add more qubits, this also induces more errors. Still, the reason for developing quantum-resistant cryptography quickly is the fear that hackers can steal and store data now, and wait until Q-Day (when quantum computers surpass classical computers) to decrypt it using a quantum machine. This form of attack is known as 'harvest now, decrypt later'.
Traditional encryption at risk
Banks, stock exchanges, insurance firms and fintech platforms depend on public-key cryptography to secure transactions, protect user identities, and maintain the integrity of their operations. They typically use a combination of encryption methods to ensure security, combining the strengths of both symmetric and asymmetric cryptography.
Symmetric encryption uses a single key to encrypt and decrypt data. It's fast and efficient, and thus often used for securing large amounts of data. For instance, it's used when your phone encrypts stored files and by HTTPS websites after conducting an initial handshake. However, the challenge is safely sharing the key between sender and receiver. Asymmetric encryption, on the other hand, uses two keys: a public key to encrypt data and a private key to decrypt it.
Advanced Encryption Standard (AES) and Data Encryption Standard (DES) are both symmetric encryption algorithms. Storing data such as customer records or transaction logs relies heavily on AES, especially AES-256, due to its strong security and speed.
RSA and ECC on the other hand are examples of asymmetric encryption algorithms. RSA stands for Rivest-Shamir-Adleman, named after its three inventors. It's one of the most widely used encryption methods and secures data using a pair of keys, one public and one private. ECC stands for Elliptic Curve Cryptography, which also uses key pairs but relies on mathematical curves for encryption.
Quantum computers, using Grover's algorithm, can find the encryption key used with AES much faster than a classical computer. With Shor's algorithm – quantum algorithm developed by American mathematician Peter Shor in 1994 – a quantum computer can effectively break asymmetric encryption such as RSA and ECC.
Also read: Three govt arms join forces to shield India in the quantum computing era
Classical computers can take more than 1,024 years to break such algorithms, but quantum computers could do so in a matter of hours using Shor's algorithm. It is estimated that quantum computers could break RSA-2048 in a few hours or less, once they have around 4,000 qubits. (Currently, IBM's Condor has 1,121 qubits; it is targeting a 100,000-qubit system by 2033).
In 2021 the Bipartisan Policy Center, a think tank in Washington, DC, estimated that a quantum attack could cause trillions of dollars in economic losses if financial systems remained unprotected. The World Economic Forum has listed quantum attacks on encryption as one of the top 10 cybersecurity threats. By 2029, Gartner predicts that 'advances in quantum computing will make asymmetric cryptography unsafe and by 2034 fully breakable".
How are Indian financial institutions preparing for this?
In a December 2024 white paper titled 'Securing the Indian Banking Sector in the Age of Quantum Computing', the Reserve Bank Innovation Hub (RBIH) said Indian banks can stay protected from quantum attacks by leveraging the expertise of technology companies and research institutions, adopting a phased approach, and prioritising critical infrastructure.
The 2025 Thales Data Threat Report revealed that 68% of respondents in India believe quantum computers could eventually break current or future encryption algorithms, exposing data once considered secure. About 55% of respondent organisations in India said they were prototyping or evaluating PQC solutions, and 49% said they were assessing their encryption strategies.
Only 40% said they were placing their trust in telecom or cloud providers to manage the transition. About 56% identified key distribution vulnerabilities, where quantum advancements could undermine the secure exchange of encryption keys. In addition, 58% highlighted the 'harvest now, decrypt later' threat.
Also read: What Microsoft's quantum computing breakthrough means for the world
Chief information security officers (CISOs) and chief technology officers (CTOs) in India's banking, financial services, and insurance (BFSI) sector have a moderate understanding of quantum computing, with 'an average PQC readiness score of just 2.4 out of 5", highlighting 'a lack of preparedness", according to a 14 May report by the ISB Institute of Data Science titled 'Quantum Resilient Banking: Strategies for a Secure Transition'.
The report found that that 57.5% of respondents believed quantum computing would pose a significant threat within three years. Yet, while common security measures such as firewalls and endpoint protection are widely implemented, advanced techniques such as intrusion detection systems and vulnerability management tools remain underutilised, the report added.
India, which launched its National Quantum Mission (NQM) in 2023 with an outlay of ₹6,003 crore, is promoting a cohort of startups with the aim of jumpstarting India's capabilities in quantum technologies. With NQM, India plans to develop quantum computers with 50-100 qubits in about five years, and 1,000 qubits and beyond in eight years.
While QNu Labs in Bengaluru is focused on developing quantum-safe networks to enable secure communications, QPiAI India, also based in Bengaluru, has already built a 25-qubit superconducting quantum computer. Others such as Chennai-based Quantica Computacao are developing quantum cryptographic tools to help protect banking transactions. Further, the all female-founded Qkrishi Quantum and the Indian Institute of Information Technology-Kottayam (IIIT-K) have partnered to conduct research in quantum finance.
Easier said than done
The post-quantum cryptography market was valued at $356.4 million in 2023 and is forecast to touch $17.69 billion by 2034, according to ResearchandMarkets.
The market encompasses a variety of approaches including lattice-based, hash-based, and multivariate cryptography. Authors of the RBIH note, for instance, specifically recommend lattice-based cryptographic techniques, which offer 'a promising defence against emerging quantum risks... [as they are] designed to be resistant to both classical and quantum attacks." QNu Labs recommends Quantum Random Number Generators (QRNGs) since they 'exploit quantum phenomena to create truly random numbers, a crucial element in strong encryption".
Implementing new cryptographic standards could take 10 to 15 years owing to major operational hurdles, though rapid adoption by some tech firms will speed up protections for many users, according to a note by Moody's. While saying the scale of the transition was hard to quantify, it likened the task to the years-long effort to fix the Y2K bug, and moving from fossil fuels to renewables.
Also read | Google's Willow: Quantum computing's next big leap?
The note also cautioned that performance slowdowns are expected, as quantum-resistant algorithms require larger key sizes and heavier computation. Integrating these standards will demand significant IT expertise and pose technical challenges across legacy systems.
A recent note by Infosys unit EdgeVerve Systems cautioned that banks "must address the operational complexities of transitioning to new algorithms, such as managing data retention policies, replacing legacy cryptographic methods, and updating existing infrastructure". It concluded that without a well-defined road map, banks risked falling behind in securing their systems against quantum threats.