EMVCo Says Card Payments Are Decades From a Quantum Threat, but Its Authors Counted IBM’s Logical Qubits as Physical Ones

24 Aug 2026 – EMVCo, the technical body that manages the EMV specifications for chip payment cards and terminals, has published a position paper concluding that quantum computers pose no immediate threat to the RSA and elliptic-curve signatures used in EMV chips. Its authors also wrote that a cryptographically relevant quantum computer, or CRQC, may not be built for decades, if ever.

EMVCo’s Security Working Group, the SWG, wrote the 12-page paper, Update on Quantum Computing and EMV Chip Cryptography. EMVCo shared it with its Associates on 21 January 2026 and published it with minor revisions on 24 August. It is the second in a series of SWG position papers on quantum computing. The next one is to set out EMVCo’s mitigation plan if its early-warning milestones indicate that a quantum threat will materialize.

EMVCo is owned by American Express, Discover, JCB, Mastercard, UnionPay and Visa. It does not mandate the use of its specifications, according to EMVCo, and leaves the business rules for them to the networks that own it. More than 15.6 billion EMV chip cards were in circulation at the end of 2025, and more than 97% of card-present transactions worldwide used EMV chip technology, EMVCo reported in its second-quarter 2026 newsletter.

What EMVCo Concluded About Online and Offline Authentication

The SWG divided EMV cryptography into two parts. Online authorization, used for most card payments, relies on a cryptogram that the card computes with Triple DES or AES keys it shares with its issuer. EMVCo’s first quantum position statement concluded that AES-128 is quantum resistant, and the authors of the second treat symmetric cryptography as outside the quantum threat.

Public-key cryptography is used for offline data authentication, in which a terminal verifies a card’s signature without contacting the issuer. Contact and contactless cards use RSA for those signatures today. Book C-8, EMVCo’s newest contactless kernel, uses elliptic-curve cryptography to establish the session keys for its secure channel, the authors wrote. Offline transactions make up less than one percent of transactions in most countries, according to the paper.

The authors argued that harvest-now-decrypt-later attacks, in which encrypted data is recorded now for decryption once a CRQC exists, do not apply to EMV chip transactions because chip authentication requires no long-term confidentiality. They wrote that criminals get better returns from zero-day vulnerabilities and bribery than from harvesting ciphertext, and that a CRQC would cost more to build and run than any criminal enterprise could justify.

The paper noted that NIST IR 8547 proposes that U.S. government agencies stop using RSA and ECC by 2035, with similar timelines in the EU and UK, and attributed those dates to governments’ exposure to harvesting. Governments and commercial firms accept different levels of residual risk, the authors wrote, so each can reach its own conclusion from the same analysis.

For internet traffic, the authors recommended hybrid key exchange with ML-KEM through routine patching, listing support in Chrome, Firefox, Cloudflare, Google’s servers and OpenSSL 3.5. They wrote that TLS cannot move to quantum-resistant digital signatures without major, expensive disruption.

The Nine Milestones EMVCo Will Watch

In place of a migration date, the SWG listed milestones it calls “canaries in the mine,” chosen to give at least ten years of warning before a CRQC exists. Ten years is the minimum time EMV terminal infrastructure needs to implement mitigations, the authors wrote, and cards can be adapted on a slightly shorter cycle. Any canary that fires would prompt EMVCo to reassess its quantum readiness timeline.

Assuming superconducting transmon qubits, the paper lists nine canaries:

• A public quantum computing industry earning more than $1 billion a year in net profit, measured on NASDAQ-listed companies that sell quantum computing services
• A supercomputer in the petaflops range performing high-rate data capture in real time
• A fault-tolerant logical qubit lasting more than an hour
• A fault-tolerant gate between two logical qubits
• Entanglement of 1,000 physical qubits, each with another qubit
• Two entangled fault-tolerant logical qubits
• A true proof of concept of Shor’s algorithm, factoring a small number such as 21 without feeding in the period
• A successful demonstration of magic state distillation
• Robust, parallel quantum communication at scale using room-temperature flying qubits

For trapped-ion and neutral-atom machines, the main canary is a dramatic reduction in clock speed, the paper said. The authors called the factoring of 21 a possible exception to the ten-year warning. They also wrote that it would be premature for the commercial world to contemplate a sunset date for 2048-bit RSA before that milestone, and that “there has been no progress at all on the EMVCo SWG alarms.”

Timeline and Cost Estimates in the Paper

The authors based their timeline on public qubit counts. They took Google’s 53-qubit processor from 2019, its 105-qubit Willow chip from 2024 and a 2029 figure of 200 qubits that they attributed to IBM’s roadmap. From those three data points, they concluded that physical qubit numbers double every five years. At that rate, they wrote, reaching the 900,000 physical qubits that Google’s Craig Gidney estimated in 2025 for factoring RSA-2048 would take 12 doublings, or 60 years from 2029.

They set aside public claims of machines with more than 1,000 qubits because no performance evidence had been published. On cost, the paper treated Rigetti’s 9-qubit system, offered for just under $1 million, as about $100,000 per qubit and extrapolated a minimum of $90 billion for 900,000 qubits. Elsewhere the authors called a CRQC cost on the order of a trillion dollars a reasonable hypothesis, “regardless of whether it becomes feasible in 10 years, 20 years or 30 years’ time.” They cited a 2025 paper that Sam Jaques of the University of Waterloo wrote for EMVCo.

The paper also described engineering hurdles. The authors wrote that dilution refrigerator volume and control wiring appear to limit Google’s current setup to about 105 qubits. Links between modules using “flying qubits” have topped out at kilohertz speeds, they added. According to the paper, error correction does not correct correlated errors. The authors linked the error bursts Google observed on its chip about once an hour to cosmic rays.

The authors argued that no quantum algorithm delivering an advantage over classical computing “has been unequivocally identified for commercial use,” and that investor fatigue could bring a “quantum winter” before a CRQC is built. They cited the German Federal Office for Information Security, BSI, which they said assesses 2040 as a reasonable estimate. Through a news report, they also cited a 2021 FAQ in which the U.S. National Security Agency said it did not know when or even if a CRQC would exist. Their conclusion was that large fault-tolerant CRQCs are “at least two decades away.”

EMVCo’s Earlier Statements on Quantum Computing

EMVCo first published a paper on quantum computing in 2016, SWG chair Michael Ward wrote in a June 2025 Insight post. Its first public security position statement on the topic appeared in early 2025. In the same post, Ward wrote that EMVCo did not expect quantum computing to start threatening EMV infrastructure until “at least 2040.”

After its November 2025 technical meeting in Vienna, EMVCo wrote that it expected no practical threat to EMV infrastructure before 2040, “maybe never.” The chair of EMVCo’s Board of Managers, Tabitha Odom, repeated that position in January 2026, and EMVCo scheduled a virtual Special Interest Meeting on EMV resilience to quantum computing for 24 March 2026.

Through Specification Bulletin 243, EMVCo added elliptic-curve cryptography to its contact chip specification in October 2021, citing NIST’s announcement that it would not support EMV’s longest RSA key length, 1,984 bits, after 2030. In October 2022 it published Book C-8, a contactless kernel with a secure channel for privacy and ECC for card authentication. Mastercard announced the first cards for the new kernel that month, describing EMVCo’s new contactless specifications as “designed to protect against attacks from both traditional and quantum computers.”

My Analysis

Card issuers, acquirers and terminal makers should plan their card estates to the 2030–2035 dates in the G7 and EU roadmaps, not to EMVCo’s 2040. The authors reached their 60-year timeline by counting IBM’s logical qubits as physical ones. They give no evidence that their canaries would provide the ten years of warning they say terminals need.

I spend a lot of time arguing against the quantum panic industry, which I call Q-FUD, and some of this paper is the kind of corrective I’d normally welcome. The refrigeration, wiring, decoding and helium-3 problems its authors list are real. But “maybe never,” a 60-year extrapolation and a trillion-dollar price tag push the paper into the mirror error, quantum denialism. A body whose specifications protect 15.6 billion cards shouldn’t publish those claims on this evidence.

What EMVCo Gets Right About Card Cryptography

The paper’s central technical claim is correct. In an online transaction, the card computes a cryptogram with a key derived for that card and that transaction, and the issuer verifies it before authorizing the payment. Shor’s algorithm doesn’t apply to symmetric keys, and Grover’s algorithm offers at best a quadratic speedup that parallelizes badly. NIST’s published position is that current applications can keep using AES-128. A harvested cryptogram gives an attacker nothing to decrypt later.

EMVCo is probably right that the first CRQCs will belong to states. In my own estimate, breaking one RSA-2048 key on a first-generation machine would cost $2–5 million, so its owner will use it only on keys worth more than that. EMVCo’s advice on internet-facing systems is sound as well. Hybrid ML-KEM key exchange already ships in browsers, CDNs and OpenSSL 3.5, and adopting it through routine patching protects 3-D Secure and e-commerce traffic from harvesting today.

Waiting for milestones before committing to a cutover is a legitimate approach in principle. The paper’s DES example is a good one. Michael Wiener presented a design for a $1 million DES key-search machine at the Crypto ’93 conference. The Electronic Frontier Foundation’s $250,000 Deep Crack followed, and the two put a price on breaking DES and moved the industry off single DES.

IBM’s 2029 Figure Counts Logical Qubits

The 60-year timeline comes from three data points. Two are Google’s processors, 53 qubits in 2019 and 105 in 2024. The third is 200 qubits for 2029, taken from IBM’s roadmap. From the three, the authors concluded that “physical qubit numbers are doubling every 5 years.” Their closing section lists “the projected 200 qubit IBM machine” with Willow as examples of noisy intermediate-scale (NISQ) computers.

IBM describes its 2029 machine, Starling, as the world’s first large-scale fault-tolerant quantum computer and specifies it at 200 logical qubits running 100 million gates. A logical qubit is an error-corrected unit built from many physical qubits. IBM’s Matthias Steffen told IEEE Spectrum that the architecture will likely need several hundred physical qubits for every ten logical ones. The magazine reported that IBM hadn’t finalized the exact number. At Steffen’s ratio, Starling’s 200 logical qubits need thousands of physical ones.

I don’t think counting physical qubits is a good way to forecast a CRQC, because error rates, connectivity and decoding speed decide as much as the count does. But the method is EMVCo’s, so I reran it with physical qubits at all three points. The rerun tests EMVCo’s arithmetic and isn’t my forecast. With 4,000 physical qubits for Starling, a conservative reading of Steffen’s ratio, the count doubles about every 19 months instead of every five years. At that pace it passes Gidney’s 900,000 around 2041 and the sub-100,000 estimates published this year around 2036. With 10,000, the same crossings come around 2038 and 2033.

Any count from 2,000 to 10,000 puts both crossings between 2033 and 2046, and no single doubling rate fits 53 qubits in 2019, 105 in 2024 and thousands in 2029. The output moves by years with a number IBM hasn’t published. The 60 years come from one misclassified data point.

The authors also applied two standards of evidence. They set aside demonstrated machines with more than 1,000 physical qubits for lack of published performance data, while they used IBM’s roadmap target as their 2029 data point. Starling hasn’t been built, and IBM states its target in logical qubits.

Counting physical qubits also misses the transmon result a CRQC depends on most. Google’s Willow paper showed error correction below threshold, with the logical error rate falling by a factor of 2.14 each time the code distance grew by two. That is the scaling a CRQC needs, and Google demonstrated it on a transmon chip in 2024.

BSI Puts a CRQC About 15 Years Away, Possibly Ten

The 2040 date comes from BSI. Version 2.2 of BSI’s study, dated August 2025 and released in December, found a CRQC realistic by 2040. In its German summary, BSI wrote that break-even error correction on three platforms in 2024–2025 points to a shorter timeframe, and that reaching a CRQC in about 15 years looked realistic as of 2025. It added that new developments in qLDPC codes could shorten that to about ten years.

BSI presented 2040 as the date by which a CRQC looks realistic. EMVCo uses the same year as a floor. Ward’s Insight post says EMVCo doesn’t expect quantum computing to threaten EMV infrastructure “until at least 2040,” and the Vienna post says “before 2040 – maybe never.”

The NSA citation has the same problem. The paper cites a news report on the NSA’s 2021 FAQ, which says the agency doesn’t know when or even if a CRQC will exist. A year later the NSA published CNSA 2.0, with adoption dates for national security systems running to 2033. The NSA set those dates without knowing when or whether a CRQC would arrive. EMVCo cites the same uncertainty as a reason to wait.

Canary Milestones Already Met on Other Platforms

The paper says there has been “no progress at all” on its alarms. Two capabilities on its list had already been demonstrated, on platforms the authors excluded by assuming transmon qubits. In July 2025, QuEra, Harvard and MIT reported in Nature magic state distillation performed entirely on logical qubits, distilling five noisy magic states into a better one on a neutral-atom machine. Magic states supply the non-Clifford gates Shor’s algorithm consumes, which is why I track them as a separate capability. That result appeared six months before EMVCo shared its draft.

Entangling gates between logical qubits are older still. Harvard and QuEra’s logical quantum processor, reported in Nature in December 2023, ran gates between error-correction-encoded logical qubits on a reconfigurable atom array. The paper lists a fault-tolerant gate between two logical qubits as a canary and doesn’t mention this work.

The transmon assumption also contradicts the paper’s own source. The summary chapter of BSI’s version 2.2 says Rydberg atoms, the neutral-atom platform, caught up with superconducting qubits in 2025. The paper ranks neutral atoms third and calls them silicon based, when they are individual atoms held in optical tweezers. Its authors also write that qubits must operate at liquid-helium temperatures or colder, while trapped-ion and neutral-atom machines laser-cool their atoms inside room-temperature vacuum systems.

What the Paper Gets Wrong About Willow and Factoring 21

The authors write that Google kept a logical qubit coherent for one second. The Willow paper reports a logical lifetime of 291 microseconds, 2.4 times that of the best physical qubit. The one-second figure is consistent with a different experiment in the same paper, real-time decoding on a distance-5 code for a million cycles of 1.1 microseconds each, at an average decoder latency of 63 microseconds. Real-time decoding at scale is a hard engineering problem, which I track as Capability D.2, and Google showed it working on a transmon chip.

The authors also linked the error bursts Google saw about once an hour to cosmic rays. They wrote that error correction can’t correct such correlated errors and that going deep underground is the only effective shield. The Willow paper gave no definitive cause for the bursts, as EMVCo’s authors note. Google researchers reported in Physical Review Letters in 2024 that gap engineering the qubits “removes the threat of high-energy impacts” to error correction in superconducting qubit arrays. Builders of large machines still have to deal with correlated errors, and Google has published one way to do it without going underground.

For the factoring canary, the authors cite a post by Gidney. Gidney shows that the circuit for factoring 21 costs more than a hundred times the one used to factor 15. He concludes that “factoring isn’t yet a good benchmark for tracking the progress of quantum computers.” The source EMVCo cites argues against using that canary to measure progress.

2026 Developments Missing From EMVCo’s August Revision

EMVCo calls the August version a minor revision of the January draft, and its references stop in December 2025. Between January and August 2026 the resource estimates moved:

• In February, Iceberg Quantum’s Pinnacle Architecture preprint put RSA-2048 at under 100,000 physical qubits for a run of about a month, using qLDPC codes that need non-local connectivity and decoding no one has demonstrated at that scale. I covered its caveats in my analysis of Pinnacle.
• On 25 March, Google set 2029 as the year to complete its own post-quantum migration, a step I wrote about the same day.
• At the end of March, Google Quantum AI published resource estimates for breaking secp256k1, the 256-bit elliptic curve Bitcoin uses, with fewer than 500,000 physical qubits in minutes, which I analyzed on publication.

Google’s estimate concerns elliptic curves, which EMV has been adopting since 2021.

Elliptic Curves Need Fewer Quantum Resources to Break Than RSA-2048

EMVCo began moving EMV from RSA to elliptic curves for a classical reason. It cites NIST guidance under which EMV’s longest RSA key won’t be supported after 2030, and ECC gives equivalent classical security with much smaller keys. EMVCo’s Book C-8 uses ECC, including the P-256 curve, for its secure channel and for card authentication.

Against a quantum computer, a 256-bit curve is the easier target. Google’s estimate needs about half the physical qubits of Gidney’s RSA-2048 estimate and 70 to 90 times fewer Toffoli gates, and its runtime is minutes instead of days. The figures are for secp256k1, so they don’t apply exactly to P-256, though both are 256-bit curves attacked with the same elliptic-curve version of Shor’s algorithm. I explained the pattern in How ECC Became the Easiest Quantum Target.

The paper’s resource and cost figures are all for RSA-2048. It gives no elliptic-curve estimate, though its introduction names ECC-256 as a target and says C-8 relies on ECC. If ECC falls first, the countdown for EMV’s newest kernel starts earlier than the paper’s RSA figures indicate. EMV still needs ECC to replace RSA before the 2030 limit in NIST’s guidance, so EMVCo should treat ECC as a bridge and start designing the post-quantum step now.

HNDL and Forgery Exposure in EMV Beyond the Cryptogram

EMVCo is right about harvesting and cryptograms, and it leaves out three exposures elsewhere in the chip.

The first is the cardholder’s PIN. When a terminal verifies a PIN offline in enciphered form, it encrypts the PIN under an RSA public key on the card, certified through the same issuer and CA chain that offline data authentication uses, as BankAxept’s EMV certificate authority documentation and FS-ISAC’s review of post-quantum card provisioning describe. A shimmer that records that exchange today captures the ciphertext and the public key a CRQC needs to open it.

EMVCo’s own 2021 ECC FAQ lists terminal PIN protection among the jobs of EMV chip cryptography, and Specification Bulletin 308, listed in its second-quarter newsletter, gives the industry room to sunset plaintext offline PIN. A PIN stays valid until someone changes it, long after the transaction ends. The exposure is narrow, because an attacker needs a device on the card interface to record the exchange. Even so, the PIN has to stay secret for as long as it is valid, contrary to the paper’s claim that harvest-now-decrypt-later attacks don’t apply to EMV chip transactions.

The second is C-8’s secure channel. It keeps the card number and other card data away from eavesdroppers, using session keys derived from an elliptic-curve key exchange. C-8 sets up the channel at the start of each transaction, before the terminal decides whether to approve offline or go online. EMVCo’s one-percent figure for offline transactions therefore doesn’t measure this exposure.

A recording of a C-8 transaction made today becomes readable once 256-bit curves fall. The loss is privacy, since whoever holds the recordings can then link card numbers to times and places. Mastercard’s 2022 description of the C-8 specifications as protected against quantum attacks can only apply to the AES parts of the design. The privacy channel depends on ECC.

The third is forgery, the threat I call Trust Now, Forge Later. Offline data authentication depends on certification authority public keys stored in terminals and issuer certificates stored on cards for years. Anyone who recovered a scheme’s CA private key with a CRQC could issue certificates for counterfeit cards that pass offline authentication wherever terminals approve transactions without contacting the issuer, including the transit gates EMVCo’s own Insight post names as the main use case.

A forged card still fails wherever the issuer checks the symmetric cryptogram online, so this exposure is limited to offline approvals. It lasts until the schemes withdraw the compromised CA key or turn off offline approval. FS-ISAC’s review lists sending every transaction to the issuer for authorization as a mitigation, at the price of EMV’s offline option. Offline transactions may be under one percent of volume, but the fraudster chooses the channel.

The paper’s scope is the chip. Its “decades away” message will be read across the card business, including parts where the cryptography is asymmetric. Terminals and ATMs that receive their symmetric keys through remote key loading under ANSI X9 TR-34 get them wrapped with factoring-based public-key cryptography. A recorded TR-34 session is a harvesting target for the keys it delivers, for as long as those keys stay in use.

Ten Years of Lead Time Requires Starting by 2030

Mosca’s inequality says to start migrating when the time data must stay secure plus the time migration takes exceeds the time until a CRQC. For EMV cryptograms the first term is close to zero. EMVCo’s own figure for the second is ten years for terminals. If BSI is right that a CRQC is realistic by 2040, EMV’s terminal migration has to start by 2030 at the latest. It has to start earlier if the 2026 estimates and Google’s 2029 target are any guide.

The authors don’t show that their canaries would give that warning. They concede that their most concrete canary, factoring 21, may not give ten years, yet they make it the condition for even contemplating an RSA sunset date. Every canary on the list is a public milestone, and the organizations most likely to build an early CRQC have no obligation to publish. Google’s ECDLP whitepaper warns that an early CRQC might first be detected on a blockchain rather than announced. In card payments, the first signal could be counterfeit cards passing offline authentication.

In its type-approval work, EMVCo plans for terminals that stay in service for many years. TTA Bulletin 293, listed in the same newsletter, says EMVCo aims to ensure that kernels with Letters of Approval valid before January 2031 can process transactions after 2038. EMVCo wouldn’t set that goal unless it expected some terminals approved this decade to still be running then. It approves terminals today without post-quantum requirements.

The engineering work is the reason to start early. FIPS 204 specifies ML-DSA-44, the smallest ML-DSA parameter set, with 1,312-byte public keys and 2,420-byte signatures. In EMV’s RSA-based offline authentication, DDA and CDA, the terminal receives two certificates and the card’s own signature. Moving that design to ML-DSA-44 means about 9.9 KB of keys and signatures, against under 1 KB with today’s longest EMV RSA keys. At ISO/IEC 14443’s base rate of 106 kbit/s, 9.9 KB takes about 0.75 seconds to transfer, longer than the half second Mastercard targets for the whole contactless interaction.

SLH-DSA signatures start at 7,856 bytes. C-8 authenticates the card through its elliptic-curve key exchange and a MAC instead of a card signature, so its post-quantum version needs a post-quantum key exchange such as ML-KEM as well as post-quantum certificates. EMVCo’s Vienna meeting already discussed raising contactless bit rates. Card memory, command sizes, transfer rates and certificate formats all need redesign and testing, and that takes years.

The Cost and Investment Arguments

Rigetti’s Novera price that the paper uses covers the quantum processing unit alone, without the dilution refrigerator or control electronics, so it says little about the cost of a million-qubit system.

For the trillion-dollar figure, the authors cite Jaques’s paper. Jaques divided Rigetti’s 2023 R&D spending by the number of qubits on its device to get about $640,000 per qubit. Multiplied by the 20 million qubits of a 2019 resource estimate, that came to $12.8 trillion. He called the result a back-of-the-envelope estimate with an extremely wide margin of error. He also noted that the 2019 estimate was likely out of date and said he expected costs to decrease significantly. EMVCo cites it for a cost that holds whether a CRQC arrives in 10, 20 or 30 years. At Jaques’s $640,000 per qubit, the 900,000 qubits EMVCo uses elsewhere in its paper would cost about $580 billion.

My own estimate puts the capital cost of a first-generation superconducting CRQC at $500 million to over $1 billion. That is a national-program budget, well below a significant share of anyone’s GDP.

The money raised in 2025 and 2026 doesn’t look like the start of a quantum winter. Venture investment in quantum computing reached a record $3.9 billion in 2025, government commitments exceed $60 billion, and Quantinuum’s Nasdaq listing in June raised $1.68 billion, according to PitchBook data reported by Fortune. A winter could still come. A CRQC doesn’t need a profitable quantum industry, though, because governments fund cryptanalysis for what it reveals. The authors measure their profit canary only on NASDAQ-listed companies that sell quantum computing services. It can’t see Google, IBM or state programs, the organizations most likely to build an early CRQC, because none of them reports quantum profits.

Effect on Issuers, Acquirers and Terminal Makers

EMVCo doesn’t mandate anything. The networks write their mandates on top of its specifications, and card makers, terminal vendors and payment HSM vendors build to them. Until EMVCo specifies post-quantum offline authentication, nobody can certify a post-quantum EMV card or terminal. Terminals bought in the meantime ship with classical kernels, and whether they can take post-quantum ones later depends on their memory, processing power and recertification.

The banks that issue and acquire cards have earlier dates in front of them. The G7 Cyber Expert Group’s roadmap for the financial sector points to 2030–2032 for critical systems and 2035 for the whole sector. The group says its statement sets no regulatory expectations and is meant to inform senior leaders. The EU’s coordinated roadmap expects high-risk use cases to migrate by the end of 2030. PCI DSS requirement 12.3.3, required after 31 March 2025, asks for a documented strategy for anticipated changes in cryptographic vulnerabilities, without setting a migration date. A bank that writes EMVCo’s “before 2040 – maybe never” into that strategy will have to explain to its supervisor why it prefers EMVCo’s date to the deadlines already on the table.

Executives looking for a reason to defer post-quantum spending will quote “maybe never” from the body that writes the chip specifications. Few of them will be thinking about offline data authentication when they do.

Why EMVCo Takes This Position

I don’t think the paper’s authors are acting in bad faith. Several incentives point the same way, and they help explain the result.

• EMVCo is owned by the six card networks. If it said the quantum threat to offline authentication was near, the networks would face pressure to mandate card reissuance, terminal replacement and recertification. Issuers, acquirers and merchants would pay most of those costs.
• EMVCo is five years into a migration from RSA to ECC. Calling the quantum threat close would invite the question of why issuers and terminal vendors are investing in a curve that a CRQC breaks more cheaply than RSA.
• EMVCo hasn’t published a post-quantum specification for EMV cards. FS-ISAC’s review says “it is not known if EMV is able to accommodate quantum-safe certificates,” a gap I covered in my February analysis of payments. Declaring urgency without a fix is uncomfortable for a standards body.
• “Harvest-now-decrypt-later does not apply to EMV chip transactions” gives the industry a ready answer when supervisors ask about card infrastructure.

Institutional habit plays a part too. EMVCo reviews RSA key lengths annually and adjusts them as researchers publish new classical factoring records, each a small, measurable step beyond the last. The DES analogy shows the mindset: migrate once someone demonstrates an affordable attack. Deep Crack was built by a civil liberties group that announced it. A CRQC’s first owner is more likely to be an intelligence agency that keeps it secret.

Whatever its incentives, EMVCo is right about the symmetric cryptograms.

What EMVCo Should Put in Its Third Paper

EMVCo’s third paper is meant to set out mitigations for offline transactions in case the canaries fire. My recommendation is to stop waiting for the canaries before touching the terminals. Without setting a final cutover date, EMVCo can still write post-quantum readiness into kernel and terminal type approval now, covering message buffers and certificate formats sized for ML-DSA, higher contactless bit rates, certification authority key storage large enough for post-quantum public keys, and kernels that can change signature and key-exchange algorithms through a software update.

EMVCo already aims to keep kernels approved before 2031 working past 2038, so it accepts that today’s terminals will still be in the field inside BSI’s window. The third paper should also give a start date for post-quantum offline authentication, derived from EMVCo’s own ten-year lead time.

Issuers, acquirers and processors don’t need to wait for it. Extend the cryptographic inventory PCI DSS 12.3.3 already requires to the whole card estate, and separate the symmetric cryptograms from offline authentication, CA keys, PIN encipherment, TR-34 key loading and TLS. Put crypto-agility requirements into every terminal and HSM tender, and ask each network for its post-quantum roadmap for CA keys.

In 1998, the Electronic Frontier Foundation built Deep Crack for $250,000 and told the world what it cost. That is the kind of moment EMVCo’s authors are waiting for. Nobody is likely to publish the bill for the first CRQC. In card payments, the first public evidence of one could be a counterfeit card that passes offline authentication at a transit gate.

From the author