← Back to Blog Industry

ATM Networks and Post-Quantum Cryptography

11 min read

When you walk up to an ATM and tap in your PIN, a chain of cryptographic operations races across a private banking network in milliseconds. Your PIN is encrypted inside a hardware module the second the keypad reads it, then it is wrapped, unwrapped, and re-encrypted at every node it crosses on the way to the issuing bank. The math that protects this PIN was designed in the 1980s, hardened in the 1990s, and standardized under the ANSI X9 series. Most of it still relies on RSA, 3DES, and AES with classical key exchange. None of those will hold up against a sufficiently powerful quantum computer.

This article walks through how ATM cryptography actually works today, what the ANSI X9 standards require, and how networks like Visa, Mastercard, Interac, and the regional ACH switches will need to migrate to post-quantum cryptography before the harvest-now-decrypt-later threat catches up to retained transaction logs.

How an ATM Transaction Is Encrypted

An ATM does not store your account balance. When you insert a card and type a PIN, the device acts as a secure terminal that talks to your issuing bank through a switch operator like Visa, Mastercard, or a national network like Interac in Canada or RuPay in India.

The first cryptographic event is the formation of a "PIN block." The ATM combines your typed PIN with your primary account number using one of the four ANSI X9.8 PIN block formats. Format 0, 1, 3, or 4. Format 4 is the modern choice and uses AES. Older formats use 3DES.

The PIN block is encrypted under a key that lives only inside a tamper-resistant hardware security module (HSM) bolted to the ATM itself. This is called the "PIN encryption key" (PEK) or "terminal master key" (TMK). The encrypted PIN block then travels across the bank network. At every hop, an HSM at the switch unwraps the PIN block and re-wraps it under the next link's key. This is called "translation" and it is the reason ATMs need certified HSMs at every node.

Two more keys participate. The "message authentication code key" (MAC key) signs the rest of the transaction so a man-in-the-middle cannot tamper with the amount. The "key encryption key" (KEK) is used to load fresh PEKs and MAC keys to the ATM during nightly key ceremonies. KEKs themselves are loaded by physical key custodians using split knowledge and dual control.

The ANSI X9 Standards That Govern Everything

The American National Standards Institute X9 committee writes the rules that ATM cryptography must follow. The relevant documents are:

ANSI X9.8 defines the four PIN block formats.
ANSI X9.24 defines key management, including derived unique key per transaction (DUKPT) and the rules for key separation, rotation, and destruction.
ANSI X9.52 historically defined Triple DES key wrapping, now deprecated.
ANSI X9.143 defines TR-31 key blocks for moving keys between HSMs.

PCI PIN, the security standard managed by the PCI Security Standards Council, references X9.24 directly and forbids 1DES (single DES) since 2007 and 3DES for new deployments since 2017. AES-128 minimum is mandatory for new ATM key hierarchies. Read more in our NIST FIPS guide.

The ATM industry runs on these standards. They are not voluntary. A switch operator that does not pass its annual PCI PIN audit gets disconnected.

Where Public-Key Cryptography Enters

Symmetric keys (AES, 3DES) protect the PIN blocks themselves. Public-key cryptography (RSA, ECC) protects the loading of those symmetric keys.

When a brand-new ATM ships from the factory or returns from service, it has no live keys. The technician initiates a "remote key load" using ANSI X9.24-2 or X9.139. The ATM and the host bank perform a key exchange using RSA-2048 or RSA-4096 keys baked into the ATM's HSM at manufacture. The host signs the new key under its private RSA key and the ATM verifies it with the host's certificate.

This is exactly the ceremony that Shor's algorithm threatens. A quantum computer running Shor's algorithm could factor RSA-2048 in hours, recover the host's private key, and forge new key-loading messages. An attacker who recorded the encrypted key-load traffic today could decrypt it after Q-Day and recover every PEK ever loaded into that ATM. Read more in Why RSA-2048 Will Break and Harvest Now, Decrypt Later.

EMV chip authentication, which protects card-present transactions, also uses RSA. The card carries a static signature signed by the issuer's RSA private key. The terminal verifies the signature using the issuer's certificate signed by the scheme RSA root (Visa root, Mastercard root, etc.). EMV uses RSA key sizes from 1024 to 1984 bits, all of which Shor's algorithm breaks.

What Quantum Computers Mean for Captured Traffic

ATM networks log every encrypted message for compliance. Banks retain transaction logs for seven to ten years under various financial regulations. PINs encrypted under 3DES or AES with RSA-protected keys sit in those archives.

Today the math says no one can decrypt them. After Q-Day, Shor's algorithm against the RSA key wrapping returns the symmetric AES or 3DES PEK. Once you have the PEK you can decrypt every PIN block that was ever wrapped under it. Your PIN does not change very often, and reset PINs are rare. A 2026 PIN recovered in 2035 is still likely valid in 2035.

The only mitigation is to migrate the public-key portion of the key ladder to post-quantum cryptography before any quantum computer can run Shor at scale. NIST published its first post-quantum standards in August 2024 as FIPS 203, FIPS 204, and FIPS 205. Read more in our NIST FIPS guide.

Migrating ATM Networks to PQC

The ATM ecosystem cannot upgrade overnight. There are roughly 470,000 ATMs in the US alone and over 3 million worldwide. Each one has an HSM with firmware that implements ANSI X9.24 against specific algorithm OIDs. Replacing the cryptography means:

Updating the ATM HSM firmware to support ML-KEM (FIPS 203) and ML-DSA (FIPS 204). Most major HSM vendors (Thales, Utimaco, Futurex, Atalla) shipped FIPS 203 and 204 support starting in 2025.
Updating the host HSM firmware at every switch operator and issuing bank to perform PQC key-loading ceremonies.
Re-issuing ATM device certificates signed under post-quantum CAs. This is the long pole because device certificates are baked in at manufacturing.
Updating PCI PIN and ANSI X9.24 to reference the new algorithms. The X9F1 working group started revising X9.24 to include ML-KEM in 2025.
Hybrid mode during transition. During the migration window, key-loading uses both RSA and ML-KEM in parallel so a failure of either algorithm does not break the ATM. Read more in Hybrid Encryption.

EMV is harder. The card is a passive token. You cannot push firmware updates to a chip card already in a wallet. The migration path the EMVCo consortium published in 2025 calls for new card programs to use ML-DSA-44 hybrid signatures starting around 2028, with classical RSA cards continuing to be supported until at least 2035.

NACHA, Federal Reserve, and the Regulator Direction

The Federal Reserve does not run ATM networks directly, but its FedNow instant payments service shares cryptographic infrastructure with the broader banking industry. NACHA, the trade association that runs ACH, has the same migration timeline. Both authorities published statements in 2024 and 2025 echoing the NIST timeline: classical algorithms must be retired before any cryptographically relevant quantum computer arrives.

The deadline most often cited is 2035 for full migration of public-key cryptography in financial infrastructure, which aligns with NSA CNSA 2.0 and the OMB memorandum M-23-02 for federal systems.

Hardware Security Module Vendor Status

The major HSM vendors that supply ATM operators have all shipped post-quantum support over the 2024 and 2025 windows. Thales (formerly Gemalto) shipped FIPS 203 and 204 support in their payShield 10K product line. Utimaco added ML-KEM and ML-DSA to their Atalla product family. Futurex added PQC support to their Excrypt platform. Atos shipped on the Trustway Proteccio. IBM, which historically dominated mainframe-attached HSMs through the IBM 4769 product, added PQC support in their CCA crypto coprocessor firmware.

For an ATM operator, the practical question is which HSM in the network is the slowest to receive vendor firmware updates. The answer is usually the in-branch ATM HSM itself, which has tighter physical and certification constraints than a back-office HSM. Most operators expect a multi-year rollout where back-office HSMs receive PQC support first, switch HSMs second, and ATM-attached HSMs last.

Compatibility Testing and Certification

ANSI X9F1 working group is updating ANSI X9.24 to reference ML-KEM and ML-DSA. The PCI Security Standards Council is updating PCI PIN to follow. Both updates went through public comment periods in 2025 and are expected to publish in 2026. Once the standards reference the new algorithms, ATM operators can begin formal certification of PQC-enabled HSMs against PCI PIN.

What Customers Should Worry About

If you are a consumer using an ATM, you cannot migrate the cryptography. The bank does that. What you can do is:

Treat your PIN as something that may eventually leak from old logs. Change it periodically.
Prefer chip-card transactions over magnetic stripe (mag stripe has no encryption at all).
Use issuers that have publicly committed to a PQC migration roadmap. Most large card brands now disclose their post-quantum plans in their annual security reports.

If you are a bank IT operator, the relevant questions are: which HSMs in our network support FIPS 203 and FIPS 204 today, what is our switch operator's migration plan, and have we run a tabletop exercise on a hybrid key-loading ceremony.

How QNSQY Fits In

QNSQY is a post-quantum cryptography tool for protecting data. It uses the NIST-standardized algorithms ML-KEM-512, ML-KEM-768, and ML-KEM-1024 in hybrid with X25519 for key encapsulation, and ML-DSA-44, ML-DSA-65, and ML-DSA-87 in hybrid with Ed25519 for signatures. Data is encrypted under AES-256-GCM with keys derived through Argon2id. The file format is the .qs polyglot container.

QNSQY is not an HSM and does not directly replace ATM key ladders. But banks and ATM operators that need to encrypt key ceremony backups, archived transaction logs, or HSM configuration exports can use QNSQY to wrap that data in a format that survives Q-Day. Read more in Encrypt Before Cloud Upload.

FAQ

Can a quantum computer steal my PIN over the wire today? No. There is no quantum computer in 2026 that can run Shor's algorithm against RSA-2048 in any useful time. The threat is to recorded traffic that an adversary archives now and decrypts decades from now.

Are ATMs already running ML-KEM? HSM firmware that supports ML-KEM and ML-DSA started shipping in 2025 from the major vendors. ATM rollouts begin in 2026 to 2028. By 2030 most major switch operators expect to have completed hybrid migration.

Will my chip card stop working after PQC migration? No. The migration runs in hybrid mode for years. Classical RSA cards continue to be accepted alongside new ML-DSA cards.

What about contactless and mobile wallets? Apple Pay, Google Pay, and Samsung Pay use device attestation that already includes hybrid PQC schemes in their roadmaps. Apple in particular announced PQ3 for iMessage in 2024 and has said similar work applies to wallet attestations.

How does QNSQY relate to PCI PIN? QNSQY is not certified under PCI PIN. It is a general-purpose post-quantum cryptography tool. Use it for log archives and data backups, not for live PIN translation.

Sources

ANSI X9.24-1, "Retail Financial Services Symmetric Key Management Part 1: Using Symmetric Techniques" : https://x9.org
ANSI X9.143, "Interoperable Secure Key Block Specification" : https://x9.org
NIST FIPS 203 (ML-KEM), August 2024 : https://csrc.nist.gov/pubs/fips/203/final
NIST FIPS 204 (ML-DSA), August 2024 : https://csrc.nist.gov/pubs/fips/204/final
Federal Reserve, "FedNow Service Operating Procedures" : https://www.federalreserve.gov

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY