In a position paper that EMVCo published on August 24, 2026, authors from its Security Working Group concluded that quantum computers pose no immediate threat to the RSA and elliptic-curve signatures used in EMV chips. EMVCo is the technical body that manages EMV, the specifications for chip payment cards and terminals.
The authors wrote that a cryptographically relevant quantum computer, or CRQC, may not be built for decades, if ever. A CRQC is a quantum computer able to break the public-key cryptography in use today.
The authors set no date for moving EMV chip cards to post-quantum cryptography, so card issuers, acquirers, and terminal makers have no migration deadline from the body that writes the chip specifications. Acquirers are the financial institutions that process card payments for merchants.
EMVCo, which is collectively owned by American Express, Discover, JCB, Mastercard, UnionPay, and Visa, does not mandate the use of its specifications, according to its website. More than 15.6 billion EMV chip cards were in global circulation at the end of 2025, EMVCo reported in its newsletter for the second quarter of 2026.
Online and offline cryptography
Michael Ward, who chairs the working group, described EMV’s online cryptography in a June 2025 EMVCo Q&A. In online authorization, which he said is used in most payment scenarios, the card computes a cryptogram based on either Triple DES or AES. A cryptogram is a short code, computed from the transaction details, that the card’s issuer checks before approving a payment. Ward said AES “is a quantum resistant symmetric cipher that has been included in EMV Specifications since 2010.”
In offline data authentication, a terminal checks a card’s digital signature without contacting the issuer. Contact and contactless cards use RSA for those signatures today, the authors wrote.
In Book C-8, a contactless kernel specification published in 2022, EMVCo added elliptic-curve cryptography for card authentication and a secure channel for privacy. A kernel is the software in a payment terminal that runs the card transaction.
Offline transactions make up less than 1% of transactions in most countries, according to the paper. The authors wrote that harvest-now, decrypt-later attacks do not apply to EMV chip transactions, since chip authentication needs no long-term confidentiality. In such an attack, an adversary records encrypted data now and decrypts it once a capable quantum computer exists. Chip cards can also authenticate offline in transactions that are authorized online, so the share of offline transactions does not measure every use of public-key cryptography in chip payments.
Nine warning milestones
In place of a migration date, the authors listed nine milestones meant to give at least 10 years of warning before a CRQC exists. They wrote that it takes at least 10 years to implement mitigations across EMV terminals.
In drawing up the list, the authors assumed superconducting transmon qubits. Transmons are the superconducting qubits that Google and IBM use.
The milestones include a fault-tolerant logical qubit lasting more than an hour, a fault-tolerant gate between two logical qubits, entanglement of 1,000 physical qubits, and a quantum computing industry earning more than $1 billion a year in net profit. A logical qubit is an error-corrected unit built from many physical qubits.
Another milestone is factoring a small number such as 21 with Shor’s algorithm without being given the period in advance. Shor’s algorithm factors numbers by finding a repeating value, called the period, in a related function. The authors called this milestone a possible exception to the 10-year warning.
How the authors built their timeline
The authors based their timeline on three public qubit counts. They took the 53 and 105 physical qubits of Google’s 2019 and 2024 processors, plus a 2029 figure of 200 qubits that they attributed to IBM’s roadmap. IBM gives that figure as 200 logical qubits for Starling, a fault-tolerant system it plans to deliver by 2029. A logical-qubit target cannot be placed on the same growth curve as physical-qubit counts, so the three figures do not form a trend.
From the three counts, the authors concluded that physical qubit numbers double every five years. At that rate, they wrote, reaching 900,000 physical qubits would take 12 doublings, or 60 years from 2029. They attributed the 900,000 figure to a 2025 preprint in which Google’s Craig Gidney estimated that fewer than a million noisy physical qubits could factor a 2048-bit RSA key in less than a week.
The authors set aside public claims of machines with more than 1,000 physical qubits, for which they said no performance evidence had been published. They cited an assessment by Germany’s Federal Office for Information Security, or BSI, that 2040 is a reasonable estimate for a CRQC. They concluded that large fault-tolerant CRQCs are at least two decades away.
Government dates and next steps
In a November 2024 draft of its transition plan, IR 8547, NIST proposed deprecating 112-bit RSA and elliptic-curve algorithms after 2030 and disallowing them after 2035 for U.S. federal systems. The authors cited the draft and attributed governments’ dates to their exposure to harvesting attacks. Governments and commercial firms accept different levels of residual risk, they wrote.
For internet traffic, the authors recommended hybrid key exchange with ML-KEM, formerly CRYSTALS-Kyber, adopted through routine patching. A hybrid exchange pairs ML-KEM, NIST’s standardized post-quantum method for agreeing on a secret key, with a classical method.
In the June 2025 Q&A, Ward said EMVCo did not expect quantum computing “to start posing a threat to the EMV infrastructure until at least 2040.” After a November 2025 technical meeting in Vienna, EMVCo wrote that it expected no practical threat to the EMV infrastructure “before 2040 – maybe never.”
EMVCo described the paper as the second of three that the working group is writing on quantum computing. The third is to set out EMVCo’s mitigation plan for offline transactions if the milestones indicate a threat, according to the paper.
Update, November 12, 2026: NIST published the final version of IR 8547 on October 27 and withdrew the draft. In the final report, NIST deprecates RSA and elliptic-curve algorithms at every approved key size after 2030.
