India · Post-Quantum Cryptography
Post-Quantum Cryptography in India
Post-quantum cryptography (PQC) in India is the coordinated national transition from classical encryption and signing (RSA, ECDH, ECC) to NIST-standardized quantum-resistant algorithms — primarily ML-KEM-768 (key exchange) and ML-DSA (signatures). Regulated finance is on the earliest adoption curve, driven by RBI Q-SAFE direction, NPCI payment-rail pilots, and India's Quantum Safe Ecosystem roadmap (2027–2033).
What is post-quantum cryptography in India?
Post-quantum cryptography in India means replacing or hybridizing classical cryptographic algorithms with algorithms that remain secure against both classical and quantum attacks. India's Department of Science and Technology (DST), under the National Quantum Mission, published the Quantum Safe Ecosystem in India report with phased milestones for critical information infrastructure (CII) and enterprises through 2033.
For banks, NBFCs, fintech platforms, and custody operators, PQC is not a single product purchase — it is a multi-year migration program: inventory where classical crypto lives (CBOM), prioritize systems by quantum and operational risk, stage hybrid pilots, and deploy production waves aligned with NPCI and RBI timelines.
What is India's national PQC roadmap?
India's Task Force on quantum-safe transition (chaired by C-DOT) set aggressive but phased deadlines: foundations by 2027 for CII (defense, power, telecom, banking), high-priority migration by 2028–2029, and full PQC adoption by 2029 for CII and 2033 for broader enterprises.
| Milestone | CII target | Enterprise target | Focus |
|---|---|---|---|
| Foundations | 2027 | 2028 | CBOM inventory, governance, hybrid pilots, procurement requirements |
| High-priority migration | 2028 | 2030 | Payment rails, HSM paths, externally exposed TLS |
| Full adoption | 2029 | 2033 | PQC-only trust chains, legacy algorithm sunset |
How does RBI Q-SAFE affect Indian banks?
RBI Q-SAFE (May 2026) directs regulated entities toward crypto agility, CBOM-based inventory, and phased migration planning — not an immediate rip-and-replace. Banks should treat 2026–2028 as the inventory and prioritization window before production cutovers accelerate on payment and custody systems.
Q-SAFE aligns with NPCI ML-KEM-768 TLS pilots, national PQC strategy timelines, and NIST FIPS 203/204 standards. See the dedicated RBI Q-SAFE & CBOM planning guide.
What NIST algorithms should India align to?
NIST finalized three core families in 2024: ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for general-purpose signatures, and SLH-DSA (FIPS 205) for hash-based signatures. For Indian payment TLS and API encryption, ML-KEM-768 is the default enterprise parameter set. Learn more in What is ML-KEM-768?
How does VajraShield support post-quantum cryptography in India?
VajraShield is post-quantum cryptography migration infrastructure for Indian banks and digital asset custody — hosted on IBM Cloud India with a sovereign on-prem path when keys must stay in-country. It is a migration platform, not a raw algorithm library.
| Stage | VajraShield capability | Outcome |
|---|---|---|
| Discover | Assisted CBOM + readiness assessment | Crypto inventory and migration prioritization |
| Protect | Live PQC API sandbox (ML-KEM-768 / ML-DSA) | Staging validation on native Rust core |
| Deploy | Vajra Box on-prem appliance | Same stack on customer rack for data sovereignty |
Developers can try encrypt and sign in the free developer sandbox. Security teams can start CBOM inventory via Vajra Recon or the 12-question readiness check.
What should Indian teams do in 2026?
Treat 2026 as the planning year: complete CBOM coverage for top critical systems, run one hybrid ML-KEM-768 staging pilot, evaluate HSM/KMS vendor PQC roadmaps, and brief the risk committee with a 2028 production wave proposal. See the full PQC migration roadmap for India (2026–2033).
Frequently asked questions
Is post-quantum cryptography the same as quantum cryptography?
No. Quantum cryptography (e.g. QKD) uses quantum physics for key distribution. Post-quantum cryptography uses classical computers with new mathematical algorithms (lattice-based, hash-based) that resist quantum attacks. India's roadmap centers on PQC algorithm migration, not QKD deployment at scale.
Does AWS or GCP India region solve PQC sovereignty for Indian banks?
Hyperscaler KMS in US-aligned regions does not solve data-sovereignty requirements for Indian policy. Banks that cannot export keys need an India-hosted or on-prem path. VajraShield runs on IBM Cloud India and offers Vajra Box for rack deployment.
How is VajraShield different from VajraQ or raw PQC libraries?
Raw libraries (liboqs, etc.) provide algorithms only — no CBOM, custody workflows, or bank GTM. VajraShield is a migration platform: inventory crypto, try APIs in sandbox, deploy on-prem. VajraQ is a separate product; VajraShield focuses on regulated finance migration on IBM Cloud India.