Post-Quantum Cryptography and India’s Digital Public Infrastructure

Imagine going to bed one night and waking up the next morning to find that the cryptographic security of every Aadhaar verification, every UPI transaction, and every DigiLocker upload is now potentially breachable by machines that have not been built yet but are on their way. This is the challenge that is being posed to India’s Digital Public Infrastructure. The difference it makes to you is real-time. It is not some distant hypothetical. It is an attack on the very layer of cryptographic security which enables the operations of a billion net-consumers who depend on it for subsidies, banking, vaccination drives, land records, and identity.[1]

Some years back, at a data center in Delhi, overhearing engineers discuss crypto-agility around a system that performed millions of biometric authentications every day was humbling. Going through the process of authentication, RSA signatures, the certificates, the HSMs- when one of the engineers mused out loud about the implications of a quantum computer being built that could run Shor’s algorithm at scale, the room went silent. It is not the whitepapers on post-quantum cryptography that make us realize the looming threat. It is the very system that has enabled the financial inclusion of millions and made Aadhaar a cornerstone of India’s digital transformation that is now threatened by mathematics that quantum computers will break.