• Post-quantum cryptography (PQC): Preparatory work completed to equip the next generation of identity cards with chips that are secure against attacks by quantum computers, a world first
• ‘Decisive step for the future security of digital identities’
• Technical basis developed by Bundesdruckerei, Giesecke+Devrient (G+D), Federal Office for Information Security (BSI) and Infineon is unique to date
• Early implementation of hybrid PQC important as identity cards are valid for ten years

Since its introduction in 2010, it has been considered one of the most secure official documents in the world: the German identity card with integrated online ID function. To ensure that it remains secure in the future, new identity cards must be protected against attacks by quantum computers – this applies to the hardware and software of all identity cards issued in the coming years. The official documents are valid for ten years. Bundesdruckerei GmbH and G+D have developed a technical basis for this in recent months that is unique worldwide. The federal technology company and the international security technology company initiated the development of the demonstrator together with the BSI and implemented it on special chips from semiconductor manufacturer Infineon.

The migration of the German identity card will then take place in two phases: first, the identity card data will be protected against forgery using a quantum-resistant signature procedure. This will be followed by a complete switch to quantum-secure technology.

The proof-of-concept study is one of the world’s first functional implementations of an identity card with classic cryptography and post-quantum cryptography, which complies with the current recommendations for quantum-secure algorithms. ‘Bundesdruckerei and G+D are the first in Germany to demonstrate that highly secure, quantum-resistant cryptography, such as encryption and authentication, is possible on ID chips – this is a decisive step towards future-proofing digital identities,’ says Dr Kim Nguyen, Senior Vice President Innovations at Bundesdruckerei.

‘The question is no longer whether quantum computers will break current cryptographic methods, but when this so-called Q-Day will come. Companies are already testing the use of quantum computers in areas such as materials and drug research,’ says Gabriel von Mitschke-Collande, Member of the Management Board and Group CDO at G+D. “We must act now to protect our digital infrastructure. The transition to quantum-resistant encryption methods is not an option, but a necessity. We are therefore delighted that, together with Bundesdruckerei, we have identified a sustainable way to combine the innovative potential of quantum computers with the appropriate security technology.”

Quantum computer technology has made great strides in many areas in recent years, but true scalability has not yet been achieved and remains a major challenge. Powerful, error-correcting quantum computers could solve certain mathematical problems, such as calculating discrete logarithms or prime factorisation, much faster than classical computers. However, this performance also has a downside: quantum computers have the potential to crack established cryptographic methods, or more precisely, some key negotiation and signature methods. This makes them an increasingly real threat to the security of IT systems and data. In particular, sensitive personal data in sovereign ID documents must be protected against possible quantum attacks in the future – using post-quantum cryptography (PQC). An EU roadmap envisages implementation for critical, high-risk applications by 2030.

“Equipping ID card chips with post-quantum cryptography is extremely important, because we must expect powerful quantum computers capable of breaking current cryptographic methods to be available from 2030 onwards. By then at the latest, it must be possible to issue quantum-secure ID cards. We can be proud that Germany is playing a pioneering role in the future-proofing of sovereign documents,” emphasises BSI President Claudia Plattner. The BSI researches and documents the development status of quantum computers in a regularly updated study.

G+D has many years of experience with PQC on hardware security elements through its participation in the Aquorypt and Quoryptan funding projects of the Federal Ministry of Research, Technology and Space. The implementation of PQC on the ID card chip was technologically challenging in terms of meeting the new security requirements and minimising the footprint of the resource-intensive PQC algorithms. With the proof of concept for the quantum-secure ID card, the companies have paved the way for securely integrating PQC procedures into the ID card. The Infineon chips used in the proof of concept offer a new chip design that facilitates fast and side-channel-resistant software implementation of PQC algorithms.

Bundesdruckerei has also been working on post-quantum cryptography and quantum computing for years. Together with Infineon and the Fraunhofer Institute for Applied and Integrated Security (AISEC), Bundesdruckerei developed the world’s first demonstrator for an electronic passport in 2022 that also meets the high security requirements for the era of quantum computing.