Thales’ MultiApp 5.2 Premium PQC Smartcard Marks a Significant Step Forward for the Quantum Smartcard Market

On October 7, Thales announced the certification of its quantum-ready smartcard, MultiApp 5.2 Premium PQC, in collaboration with the CEA-Leti IT Security Evaluation Facility and certified by the French Cybersecurity Agency, Agence nationale de la sécurité des systèmes d’information (ANSSI). MultiApp 5.2 Premium PQC integrates National Institute of Standards and Technology (NIST)-approved Post-Quantum Cryptography (PQC) in the form of a digital signature algorithm, ML-DSA-65 (Module Lattice based Digital Signature Algorithm), and is officially certified under the Common Criteria (CC) framework. Accredited with EAL6+2, this certification recognizes that Thales’ smartcard has met the extensive EAL6 security requirements and augmented these with two additional assurance requirements that address the particular security needs and demands faced by smartcards in their specific operational contexts. EAL6 demands product robustness against a very high level of security testing and verification, just shy of the most rigorous testing required in intensive military and government applications at EAL7, requiring products to undergo considerable design analysis and formal verification, as well as withstand a broad range of attack simulations through in-depth vulnerability analysis and penetration testing, including targeted attacks such as physical and side-channel attacks.

Thales’ latest announcement confirms its position as a frontrunner when it comes to the quantum transition. While Infineon’s PQC security controller achieved EAL6 status in January, achieving EAL6+2 certification establishes Thales as a leader within the burgeoning quantum-ready smartcard market, making it the first complete quantum-safe smartcard solution to obtain this augmented level of security certification. With that come the inevitable perks of first mover status, including cementing its reputation as a trusted brand when it comes to quantum innovation and deployment, which is particularly advantageous across the smartcard segments given the stringent standards that govern the typical smartcard verticals, including identity, connectivity, and payments. Beyond that, it gives Thales a headstart as the market continues to advance toward full, standardized quantum resilience.

Finalized standards from key international bodies such as the International Civil Aviation Organization (ICAO), ETSI, GSMA, The 3rd Generation Partnership Project (3GPP), and EMVCo are still in the pipeline, presently in the working group, drafting, or concept phase, depending on the relevant market segment. Real-world deployments of quantum-ready passports, payment cards, or Subscriber Identity Module (SIM) cards are presently stifled as a result. Yet, Thales’ recent advancements in achieving certification through a national body, ANSSI, demonstrates that, despite the criticality of international interoperability for solutions operating on a global scale, national and regional certifications present a significant avenue for building brand reputation in the meantime. Further, national and closed-loop use cases—such as national ID initiatives—are uninhibited by the same global interoperability requirements that solutions like passports or payment cards are beholden to. Consequently, Thales’ newest certification efforts are likely to drive interest in quantum resilience across national ID markets. Increasing efforts to bolster quantum resilience in smartcards on a national level is already apparent across other countries in Europe, most notably Germany where a technical foundation represented by Bundesdruckerei, Giesecke+Devrient (G+D), the Federal Office for Information Security (BSI), and Infineon recently announced a functional implementation of a hybridized national ID card, combining both classical and PQC within a proof of concept.

Technical incompatibles between PQC and smartcards, including key size and computational demands, as well as the practical and operational complexities involved with concurrently updating smartcards and the broad ecosystem supporting their operation, render the overall smartcard market a slower mover when it comes to the quantum transition. However, as exhibited by Thales’ latest announcement, movements are happening, so to stay at the forefront of innovation in this space, vendors should consider the following recommendations:

• Prioritize Engagement in Quantum-Orientated Smartcard Projects and Pilots: Engagement in pilots, projects, and initiatives is a vital way to bolster visibility in this space and tackle technical challenges on the frontlines of the smartcard quantum journey. Leading vendors like Thales are heavily involved in projects such as the PQC4eMRTD (Post-Quantum Cryptography for electronic Machine-Readable Travel Documents) initiative.
• Focus on End-to-End Solutions, Achieved Both In-House and Through Collaborative Partnerships: Given the various moving parts within the wider smartcard ecosystems, e.g., card interfaces, eGates, Point of Sale (POS) readers, and other connected devices, end-to-end solutions and collaboration between vendors across the entire value chain will be crucial to staying at the market edge. Vendors like Thales, IDEMIA, and G+D cater to each stage of the smartcard issuance and verification process; however, collaboration with vendors from hardware vendors, chipset manufacturers, Public Key Infrastructure (PKI) and digital trust providers, and smartcard manufacturers to fill potential functionality gaps is crucial for smaller vendors within the wider smartcard space.
• Build Expertise and Reputation Incrementally via Closed-Loop Use Cases: Difficulties in lifting and shifting entire ecosystems to PQC require vendors to treat the transition as a continual, incremental migration, rather than a “rip and replace” process. Given the reduced interoperability demands, building brand reputation and getting ahead in national markets will provide vendors with the requisite customer base to enter into the quantum-ready smartcard market once it matures. This includes applications such as national government-issued ID cards, but also other high-assurance use cases such as corporate IDs and physical access cards.
• Work Toward Future Alignment: While national and regional steps forward are crucial to accelerating market maturation, ensuring future alignment with regard to PQC standards within smartcards will be key to: 1) ensuring international interoperability for smartcards operating on a global scale, and 2) protecting existing business models for smartcard issuers and manufacturers. Divergence across smartcard segments, particularly if each kind of prospective quantum-safe smartcard requires a different quantum algorithm, has the potential to disrupt existing business models. Working closely with standardization bodies, both nationally and internationally, remains paramount.

Following Thales’ announcement and in light of the unique challenges faced by smartcard and other embedded systems when it comes to PQC, quantum rumblings are expected to continue across the smartcard market, especially as countries continue to map out their migratory timelines and the 2030 deprecation of RSA and ECC fast approaches. By prioritizing engagement, collaboration, incrementalism, and alignment, vendors will be best placed to capitalize on the shifting market dynamics borne out of the quantum transition.