G+D advances post-quantum identity cards through EU research project

Post-quantum migration appears to be moving from laboratory research toward commercial identity products, as governments prepare national identity infrastructure for the quantum era.

The latest example comes from Giesecke+Devrient (G+D) which plans to integrate prototype post-quantum cryptography protocols and security mechanisms into its Java Card operating system for identity cards as part of the European uPQComing research project.

The work will be part of the European research project uPQComing, which aims to prepare critical digital infrastructure for the migration to post-quantum cryptography (PQC). The project reflects a broader European effort to ensure today’s digital identity credentials remain secure against future quantum computers capable of breaking widely used public-key cryptography.

“With uPQComing, we are taking the next step, working together with our partners to develop the foundations for the next generation of quantum-safe identities,” says Gabriel von Mitschke-Collande, group chief digital officer at G+D.

G+D’s contribution can be seen as the next step to the 2025 German national ID card proof of concept developed with Bundesdruckerei, the German Federal Office for Information Security (BSI) and Infineon.

The work showed that an ID chip could perform both established and quantum-resistant cryptographic operations despite its limited computing and memory resources.

PQC places substantially more demands on an identity card chip than established public-key mechanisms. Depending on the algorithm, public keys, signatures, and exchanged cryptographic messages can be larger in size.

“The quantum era is fundamentally changing the requirements for digital security,” says Mitschke-Collande.

These requirements are important for contactless identity cards as the secure element often has limited power through the reader’s radio-frequency field and must complete authentication within the time a person expects to hold the card near a terminal.

G+D’s work focuses on secure elements used in identity cards, where cryptographic operations must be performed with limited memory and processing capacity.

The migration extends beyond the card itself. Readers, identity systems and backend infrastructure must also support new algorithms, larger cryptographic objects and updated authentication protocols.

G+D says the uPQComing prototypes will be evaluated for security, efficiency and interoperability.

The company also plans to study hybrid designs that combine conventional and post-quantum cryptography. Hybrid operation can also reduce the risk of depending entirely on a comparatively new post-quantum algorithm.

The EU implementation roadmap calls for member states to start moving toward post-quantum cryptography by the end of 2026.

Other developers are also addressing similar constraints. Toppan recently introduced a contact and contactless Java Card that supports the NIST-standardized ML-KEM and ML-DSA algorithms, as well as RSA and elliptic-curve cryptography.

Article Topics

digital ID  |  Giesecke & Devrient (G+D)  |  identity document  |  post-quantum cryptography  |  research and development