Toppan and NICT Create Smart Card System with Post-Quantum Cryptography

Through its various newsletters, Reconnaissance International has followed the development of quantum computing and the troubling prospect of its application to undermine current cryptographic methods of authenticating people, products, and communications (see ABN March 2022, and IDN February 2022).

In this article, we report on one of the preparations for migration to post-quantum cryptography, that will be difficult to decipher even after quantum computers come into practical use.

Communications and cryptographic experts believe that there is a real risk that the cryptosystems that are widely used today will be vulnerable to attacks from quantum computers, a field in which R&D is moving at pace.

Communications and security provider Toppan and Japan’s National Institute of Information and Communications Technology (NICT) have now announced the launch of PQC CARD®, which they claim is the world’s first smart card equipped with post- quantum cryptography.

PQC CARD uses CRYSTALS-Dilithium, a next-generation digital signature algorithm selected as a potential standard technology by the US National Institute of Standards and Technology (NIST) in July this year (see IDN July 2022).

PQC CARD was developed in collaboration with ISARA Corporation, a company specialising in crypto-agile and quantum- safe security solutions that develops cutting-edge post-quantum cryptography technologies.

Toppan and the NICT say they will take advantage of this technology to advance development of quantum secure cloud technology that enables the secure communication, storage, and use of highly sensitive information.

Going beyond smart card security, the two organisations will also target the establishment of safe and secure social infrastructure based on the creation of fundamental technologies that ensure security for day-to-day internet-based activities, including email, online shopping, cashless transactions, and online banking.

Toppan also predicts that users will not have to replace hardware. Reader/writers, communication protocols, and the like for existing smart cards, using current cryptography methods, can continue to be used in the same way with PQC CARD, without compromising authentication speed and performance.

Part of the research was supported by two Japanese government programmes: the Cabinet Office’s Cross-Ministerial Strategic Innovation Promotion Program (SIP) ‘Photonics and Quantum Technology for Society 5.0’, and the Ministry of Internal Affairs and Communications’ Research and Development for ‘Construction of a Global Quantum Cryptography Network’.

Healthcare pilot

Between August and October of this year, an assessment of the PQC CARD was conducted to authenticate healthcare professionals and control access in medical settings and to identify technical challenges.

PQC CARDs were used as HPKI (Healthcare Public Key Infrastructure) cards, the accreditation carried by healthcare professionals.

Two-factor authentication for browsing electronic medical records was performed by combining smart card authentication with biometric authentication in the form of facial recognition. The encryption used for communication between the browser and the server was updated to CRYSTALS-Dilithium and its functioning was assessed. The pilot test evaluated improvements in the quantum resistance of the system overall and its effectiveness.

The result of the pilot confirmed that only people with the proper authorisation were able to access electronic medical records in accordance with their access rights. The test also confirmed improvement of quantum resistance and the effectiveness of medical record data overall and identified the challenges to be addressed for practical implementation.

Comparison between existing and post-quantum cryptography (© Toppan).

Plans for the future

Toppan aims to launch full-scale provision of PQC CARD and related systems in 2030, with limited practical use in sectors such as healthcare and finance in 2025. In collaboration with the NICT, Toppan will leverage the technology developed to drive the practical use of quantum secure cloud technology that enables the secure communication, storage, and use of highly sensitive information.

The two organisations also intend to apply and expand the adoption of post-quantum cryptography beyond smart cards, as a fundamental technology for security on the internet. In addition to the aforementioned email, online shopping, cashless transactions, and online banking, applications include IoT systems and connected cars, for which technology is being established using existing cryptography methods.