Next-Generation Cryptographic Migration Framework for Real-Time Payment Processing Systems

Abstract

Contemporary real-time payment processing systems rely on classical asymmetric cryptographic primitives — RSA, Elliptic Curve Diffie-Hellman (ECDH), and ECDSA — that will become computationally vulnerable with the advent of cryptographically relevant quantum computers (CRQCs). This paper introduces NGCMF (Next-Generation Cryptographic Migration Framework), a comprehensive, seven-layer methodology engineered to guide payment processors, card networks, and financial institutions through a structured, auditable transition to NIST-standardised post-quantum cryptography (PQC). NGCMF spans the full cryptographic lifecycle: from automated cryptographic asset discovery and quantum risk classification, through hybrid classical/PQC architecture design and phased production rollout, to long-term cryptographic agility governance. The framework addresses the HARVEST NOW, DECRYPT LATER (HNDL) threat model — wherein adversaries archive encrypted transaction data today for future quantum decryption — as a primary migration driver, alongside conventional forward-secrecy and integrity requirements. We instantiate NGCMF across four real-world payment system archetypes: an ISO 8583 card network switch, an open-banking REST API hub, a CBDC settlement node, and a cross-border SWIFT MX messaging gateway. Performance evaluations demonstrate that ML-KEM-768 (FIPS 203) introduces TLS 1.3 handshake overhead of 1.4–2.3 ms, within real-time SLA tolerances, while ML-DSA (FIPS 204) requires HSM horizontal scaling for high-frequency signing workloads. Regulatory mapping confirms alignment with PCI DSS v4.0, ISO 27001:2022, EU DORA, and NIST SP 800-57 Part 1 Rev. 5. The NGCMF provides financial institutions with a practitioner-oriented, standards-grounded roadmap for achieving quantum-resilient payment infrastructure within a 12–18 month deployment horizon.