# EMV Chip Cards and PQC **Source**: https://quantumsequrity.com/blog/emv-chip-cards-pqc **Category**: Industry & Use Cases --- [← Back to Blog](../../blog.html) Industry & Use Cases # EMV Chip Cards and PQC 12 min read The chip on every modern credit card is a small, single-purpose computer with a long history. EMV (originally Europay, Mastercard, Visa, now governed by EMVCo with additional members including American Express, Discover, JCB, and UnionPay) is the global standard for chip-based card payments. Around four billion EMV chip cards are in circulation worldwide. They have hardware security boundaries, embedded cryptographic algorithms, and PKI hierarchies that connect every transaction back to the card brand's root certificate authority. The cryptography inside EMV chip cards has been remarkably stable. RSA-2048 and RSA-4096 do most of the heavy lifting for offline data authentication. Triple DES (3DES) and AES handle session-level confidentiality and integrity. The card brand root CAs are operated to the highest commercial CA standards. All of this works. None of it is post-quantum secure. The payment industry now has a 5 to 8 year window to migrate before quantum computers reach a scale where the existing cryptography breaks. ## What Lives Inside an EMV Chip An EMV chip card is built around a secure microcontroller, often called a Smart Card Integrated Circuit (SCIC). The chip has: - 32-bit ARM core (typically Cortex-M33 in newer cards) - 256 KB to 1 MB of flash memory - 16 KB to 64 KB of RAM - Hardware accelerators for AES, RSA, and ECC - Tamper-resistant packaging and various physical security features - A Java Card or MULTOS application platform that runs the EMV application The card runs in two power modes: contact (powered through the chip pads) and contactless (powered through the antenna via ISO 14443). Both modes execute the same EMV application logic but with different timing constraints. The cryptographic keys on the card include: - Card private key (used for offline data authentication via DDA) - Card master key (shared with the issuer, used for session key derivation) - PIN encryption keys - Application-specific keys (loyalty, transit, etc.) ## EMV PKI Hierarchy The EMV PKI is one of the largest and most stable certificate hierarchies in the world. Each card brand operates its own root CA: - Visa CA - Mastercard CA - American Express CA - JCB CA - Discover CA - UnionPay CA Each issuer that issues cards under a brand operates an issuer CA, signed by the brand root. Each card carries an Issuer Public Key Certificate (signed by the brand root) and an ICC Public Key Certificate (signed by the issuer). When a terminal performs offline data authentication, it loads the brand root public key from the terminal's CA store, validates the issuer certificate against the brand root, and validates the ICC certificate against the issuer. This chain of trust is what makes offline EMV transactions possible without contacting the issuer for every authentication step. For PQC, every key in this hierarchy needs to migrate. The brand root keys are RSA today; they need to be supplemented with ML-DSA-65 or ML-DSA-87 keys. The issuer keys also need migration. The card chip keys need migration. This is a coordinated migration affecting every EMV-issuing bank in the world. ## EMVCo's PQC Roadmap EMVCo published a "Post-Quantum Cryptography Position Paper" in 2022 that outlined the migration approach. The current direction includes: 1. Crypto-agility framework added to EMV specifications to support new algorithms 2. Hybrid signature options (classical + post-quantum) for transition 3. ML-DSA as the primary post-quantum signature algorithm 4. Migration planning aligned with NIST and CNSA 2.0 timelines EMVCo's specifications are evolving. Newer versions of the EMV Contact Specifications and Contactless Specifications include hooks for PQC. Production card profiles using PQC are expected to appear from 2027 onwards. ## RSA-2048 and RSA-4096 in Current EMV EMV today supports several RSA key sizes for the card brand root: - RSA-1408, RSA-1536, RSA-1984: Legacy, deprecated - RSA-2048: Common in current deployments - RSA-3072: Available, used by some brands - RSA-4096: Newest, used for high-assurance deployments NIST guidance is that RSA-2048 should be retired by 2030, and RSA-3072 has post-quantum security equivalent to AES-128 (which itself drops to about 64 bits of effective security under Grover's algorithm). RSA-4096 has a longer practical lifetime but is still vulnerable to a sufficiently large quantum computer. The migration plan is to add ML-DSA keys alongside the existing RSA keys. New card profiles will carry both an RSA certificate (for backward compatibility with older terminals) and an ML-DSA certificate (for PQC-aware terminals). This is a hybrid approach similar to other industries. For more on hybrid migration, see [hybrid encryption](hybrid-encryption.html). ## The Storage Problem EMV cards have very limited storage. A typical Java Card has 256 KB to 1 MB of flash, of which much is consumed by the operating system, the Java Card runtime, the EMV application, and various secondary applications (payment networks, transit, loyalty). Adding ML-DSA-65 keys and certificates roughly multiplies the cryptographic storage by 5 to 10 times compared to RSA-2048. ML-DSA-65 public keys are 2 KB. ML-DSA-65 signatures are 3.3 KB. A typical certificate carries a public key, a signature from the issuer, and metadata. For new card platforms with more flash (1 MB or more), this is workable. For lower-cost card platforms with 256 KB, it requires careful application design and possibly dropping classical RSA support over time to free space. ## Compute and Latency Smart card cryptographic accelerators today are tuned for RSA. RSA-2048 signature verification on a modern smart card takes 30 to 100 milliseconds. ML-DSA-65 verification, in pure software on the same chip, would take longer (estimates range from 50 to 300 milliseconds depending on implementation). Hardware acceleration for ML-DSA exists in some chip designs and is becoming common in new chip generations. With acceleration, ML-DSA verification can match or exceed RSA verification speed. For contactless transactions where the budget is roughly 500 milliseconds, the cryptographic latency is a real constraint. EMVCo is working on optimized cryptographic profiles that minimize the post-quantum work in the contactless flow. For more on ML-KEM specifics, see [ML-KEM explained](ml-kem-explained.html). For the contactless context, see [NFC payments PQC](nfc-payments-pqc.html). ## Issuer Key Management Migration The EMV ecosystem includes thousands of card-issuing banks. Each bank operates its own issuer keys, used to sign card certificates and to derive session keys for online authentication. Issuer key migration to PQC is a meaningful operational project for each bank. It involves: 1. Generating new ML-DSA key pairs in HSMs 2. Getting the new public keys signed by the brand root CA 3. Updating card personalization processes to use the new keys 4. Updating issuer authorization systems (HSMs, decision engines) to support PQC verification 5. Coordinating with payment networks for switchover Major banks have started this migration planning. Smaller banks typically rely on third-party issuer processors (Worldpay, FIS, Fiserv, etc.) who handle the migration on their behalf. ## Card Pre-Personalization Before a card is shipped to a cardholder, it goes through pre-personalization (loading the OS, EMV application, and brand root certificates) and personalization (loading the card's private keys, the cardholder's name, the card number, and other personalized data). For PQC, both stages need updates. Pre-personalization needs to load PQC root certificates into the card's CA store. Personalization needs to generate PQC key pairs on the card (or load externally generated keys, depending on the platform's security model) and create PQC issuer-signed certificates. The card personalization industry is dominated by a few major vendors (Thales, IDEMIA, G+D, etc.). All are tracking PQC and updating their personalization platforms. Production PQC personalization is expected from 2027 onwards. ## Terminal-Side Updates Terminals have to verify card certificates. For PQC, terminals need: - Updated CA store with PQC brand root keys - Cryptographic library supporting ML-DSA verification - Updated EMV application logic to handle PQC certificate chains - Possibly updated hardware (older terminals may lack the compute for ML-DSA verification within the time budget) Terminal updates are typically delivered via: - Firmware updates pushed by acquirers - Configuration updates that add new CA keys without firmware changes - Hardware refresh cycles for older terminals The terminal update process is well-established and works reliably for adding new RSA keys. Adding new ML-DSA keys works similarly, but the larger keys increase the size of CA store updates. For more on terminal-side topics, see [POS systems PQC](pos-systems-pqc.html). ## ATM Networks and PQC ATMs use EMV chip cards for authentication, and ATM networks have their own PKI for protecting cash dispensing operations. The cryptographic patterns are similar to POS terminals: EMV chip authentication on the card side, plus additional cryptography for PIN entry, transaction encryption to the ATM processor, and remote key loading. PCI PIN Security Requirements govern PIN handling in ATMs. PQC migration here follows the broader payment industry timeline, with new ATMs supporting PQC EMV by 2027 and existing ATMs being updated through normal firmware refresh cycles. ## Card Issuance Volumes and Migration Pace The EMV industry issues roughly 1 to 2 billion new cards per year. The natural replacement cycle (cards expire every 3 to 5 years) means most cards in circulation are less than 5 years old. This is good for PQC migration: a 5-year migration window roughly aligns with the natural card refresh cycle. The plan most major issuers are following: - 2024 to 2026: Pilot PQC card profiles with select customer segments - 2026 to 2028: Begin issuing PQC-capable cards as default for new issuance - 2028 to 2030: All new card issuance is PQC-capable - 2030 to 2033: Existing classical-only cards expire and are replaced with PQC cards By 2033, the global EMV card base should be predominantly PQC-capable. This aligns with CNSA 2.0 mandates and with NIST's published PQC migration timeline. For more on the broader migration, see [the NIST FIPS guide](nist-fips-guide.html). ## Card Brand Coordination The five major card brands (Visa, Mastercard, American Express, Discover, JCB, plus UnionPay regionally) coordinate through EMVCo on standards but compete in the market. Each brand operates its own root CA and issues its own technical bulletins. For PQC, this means each brand has its own internal migration timeline and its own set of approved cryptographic profiles. Operators (issuers, acquirers, terminal vendors) often need to support multiple brand-specific configurations simultaneously. The work is straightforward but it adds operational overhead. Industry working groups like the X9 financial services standards body, the European Payments Council, and various regional payment forums help coordinate the migration so that brands stay broadly aligned. Without this coordination, the migration would risk fragmenting into incompatible brand-specific PQC profiles. ## Smart Card Operating Systems Underneath the EMV application is a smart card operating system, typically Java Card or MULTOS. These platforms have their own cryptographic libraries that the EMV application uses. PQC migration affects the platform layer as well as the EMV application. Java Card 3.x adds support for additional cryptographic algorithms including hooks for PQC primitives. MULTOS has been adding PQC support in newer revisions. The platform vendors (Oracle for Java Card, MULTOS Consortium for MULTOS) coordinate PQC additions with the smart card chip vendors who implement the cryptographic accelerators. A new card chip designed in 2025 typically has hardware-level acceleration for ML-KEM and ML-DSA, plus the platform software to expose these algorithms to applications. Older chips lack this hardware and rely on software implementations that are slower and more energy-intensive. ## Side-Channel Resistance and Card-Level Attacks Smart card chips operate in a hostile environment from a side-channel perspective. The card sits in an untrusted reader controlled by the terminal operator, which can range from a legitimate merchant to an attacker with access to chip-level instrumentation. Power analysis, electromagnetic analysis, fault injection, and laser-based attacks are all documented techniques against smart card chips. Card chip vendors have decades of experience hardening RSA implementations against these attacks. The countermeasures are mature. ML-DSA, ML-KEM, and SLH-DSA are newer. Side-channel research against lattice-based schemes is an active area, with new attacks and new countermeasures published every few months. Recent academic work has demonstrated attacks against early ML-KEM implementations, including timing attacks against rejection sampling and electromagnetic attacks against polynomial multiplication. Card chip vendors are working through these findings and updating their hardware-accelerated PQC implementations to incorporate the latest mitigations. The implication for EMV is that the first generation of PQC-capable card chips will likely have less side-channel maturity than the RSA hardware they replace. EMVCo and the major chip vendors (NXP, Infineon, ST Microelectronics, Samsung) are coordinating on side-channel test methodologies that will form part of the security evaluation for PQC-capable chips. Common Criteria EAL5+ or EAL6+ certification for these chips will require evidence of side-channel resistance against the latest published attacks. For deployments with the highest assurance requirements (national ID cards, government employee credentials, payment cards in high-fraud regions), early PQC chips may not yet meet the side-channel bar that legacy RSA implementations clear. Card programs with these requirements should plan for the side-channel maturity timeline and avoid deploying first-generation PQC chips in highest-risk applications until the side-channel research has stabilized. ## Frequently Asked Questions **When will my credit card need to be replaced for PQC?** Probably during your normal card replacement cycle starting around 2027. Banks will issue new cards with hybrid PQC support. Existing cards continue to work until they expire. **Will my contactless tap still work?** Yes. The terminal will negotiate PQC capability with the card. PQC-capable cards on PQC-capable terminals will use PQC; everything else falls back to classical EMV. The user experience is unchanged. **Is RSA-4096 enough?** RSA-4096 has more long-term resistance than RSA-2048, but it is still vulnerable to a sufficiently large quantum computer. NIST guidance is to migrate to ML-DSA rather than rely on increasing RSA key sizes indefinitely. The migration window for RSA is roughly 2030 to 2035. **Does PQC slow down checkout?** For most users, no. Modern smart card hardware accelerators handle PQC at competitive speeds. Older smart card hardware running PQC in software may be slower, but the differences are within the contactless time budget. **What about my mobile wallet (Apple Pay, Google Pay)?** Mobile wallets emulate EMV cards. They will migrate to PQC alongside physical cards, with the advantage that mobile platforms can update their cryptography via OS patches more easily than physical cards can. **What happens at countries that have not yet rolled out PQC terminals?** Cards will continue to support classical EMV alongside PQC during the transition. A traveler with a PQC-capable card visiting a country with only classical terminals will use the classical EMV path. The card's hybrid certificate carries both algorithm options. Backward compatibility is a core design goal of the EMVCo PQC migration. **Does PQC affect the contactless transaction limit (no-PIN limit)?** Not directly. The transaction amount limit for contactless without PIN is set by the issuer and the card brand, currently varying by country (around 100 to 200 USD or local equivalent in most markets). The cryptographic protocol changes but the policy limit is independent. PQC-capable cards on PQC-capable terminals execute the same contactless flow with stronger underlying signatures, with the same policy limits applied. ## Sources - EMVCo Specifications and Bulletins, https://www.emvco.com/document-search/?action=search_documents - EMVCo Post-Quantum Cryptography Position Paper, https://www.emvco.com/wp-content/uploads/documents/EMVCo-PQC-Position-Paper.pdf - ISO/IEC 7816, "Identification cards - Integrated circuit cards", https://www.iso.org/standard/54550.html - NIST FIPS 204, "Module-Lattice-Based Digital Signature Standard", https://csrc.nist.gov/pubs/fips/204/final - NIST SP 800-208, "Recommendation for Stateful Hash-Based Signature Schemes", https://csrc.nist.gov/pubs/sp/800/208/final - PCI PIN Security Requirements v3.1, https://www.pcisecuritystandards.org/document_library/?category=pinsecurity - Common Criteria. "Smart Card Protection Profile (BSI-PP-0084)." https://www.commoncriteriaportal.org/ ## Related Articles - [What is Post-Quantum Cryptography?](what-is-post-quantum-cryptography.html) - [NFC Payments PQC](nfc-payments-pqc.html) - [PQC for Financial Services](pqc-financial-services.html) - [Hybrid Encryption](hybrid-encryption.html) - [Harvest Now Decrypt Later](harvest-now-decrypt-later.html) --- ### Protect Your Data Before Q-Day Arrives QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats. [Try QNSQY](../../pricing.html)