Post-Quantum Cryptography and India’s Digital Public Infrastructure

India's Digital Public Infrastructure (DPIP) now faces a looming threat: the potential breach of cryptographic security by quantum computers yet to be built. Aadhaar verifications, UPI transactions, and DigiLocker uploads all rely on classical cryptography, rendering them vulnerable to a future attack. The consequences are immediate, impacting the daily lives of a billion net-consumers who depend on this infrastructure for various services, from subsidies to land records.

At a data center in Delhi, engineers faced a stark realization when discussing the implications of a quantum computer running Shor's algorithm at scale, highlighting the urgent need for a transition to post-quantum cryptography.

The scale of the challenge is unique for India, as the changes must be implemented across a digital infrastructure serving 1.4 billion people. Encrypted data and biometric templates, which can be "harvested now and decrypted later," are particularly at risk, necessitating an immediate response. The Department of Science and Technology has outlined a roadmap: foundational infrastructure by 2027, migration to quantum-safe systems by 2028, system readiness by 2029, and enterprise-level adoption by 2033.

Transitioning to post-quantum cryptography will require a hybrid approach, combining classical and new algorithms until performance and interoperability issues are resolved. Crypto-agility, enabling systems to adapt to new algorithms without disrupting existing business processes, is crucial. Prioritization of critical systems, such as the Aadhaar infrastructure and the Unique Identification Authority of India, is essential.

Testing and certification of libraries and hardware security modules (HSMs) under real-world conditions will ensure readiness.

Performance challenges are significant, as post-quantum algorithms like those based on lattice cryptography are more resource-intensive than current standards like RSA-2048 and ECC. This will affect feature phones, rural authentication systems, and the associated costs. Early pilots are necessary to establish performance benchmarks and ensure a smooth transition.

The complacency of the industry must be challenged, as India's decentralized Aadhaar architecture, supporting numerous independent verifiers, adds complexity to the transition. While standardization and industry consensus are vital, India cannot afford the luxury of time. The transition must be incremental, with hybrid cryptography allowing legacy systems to operate while new algorithms are tested, certified, and deployed.

Performance optimization, including hardware acceleration, is necessary, along with the development of a robust testing ecosystem focused on scale.

India's journey to a quantum-secure Digital India will depend on the actions taken in the next three years. By adopting a hybrid deployment model, prioritizing critical systems, and establishing a comprehensive testing framework, the nation can safeguard its digital infrastructure against the impending quantum threat, ensuring the continued integrity of its digital public services.