A Framework for Migrating Real-Time Payment Gateways to Post-Quantum Cryptography

Abstract

The imminent arrival of cryptographically relevant quantum computers poses an existential threat to the RSA, ECC, and ECDH primitives that underpin virtually every real-time payment gateway in operation today. This paper presents PQPG-MF, a structured six-phase migration framework designed to guide financial institutions and payment service providers through a comprehensive, risk-managed transition to NIST-standardised post-quantum cryptography (PQC) algorithms — specifically ML-KEM, ML-DSA, and SLH-DSA. The framework integrates hybrid classical/post-quantum cryptography during the transitional period, cryptographic agility engineering, hardware security module (HSM) compatibility planning, and regulatory compliance alignment covering PCI DSS v4.0 and ISO 27001:2022. We evaluate the framework against three reference architectures — a high-throughput card network gateway, an open-banking API hub, and a central bank digital currency (CBDC) node — demonstrating feasibility across diverse latency, throughput, and compliance constraints. Performance benchmarks reveal that ML-KEM-768 introduces handshake overhead of 1.4–2.1 ms over baseline TLS 1.3 in production-grade deployments, within the tolerance of real-time payment SLAs. Our threat modelling analysis using the HARVEST NOW, DECRYPT LATER attack vector underscores the urgency of migration even before large-scale quantum computers are available. The PQPG-MF framework provides actionable guidance supported by tooling recommendations, governance considerations, and a phased roadmap adaptable to institutions of varying scale.