PIB TrackerA bank signs up for the cryptography that quantum computers break
C-DAC and Bank of India will build a quantum ecosystem for banking - quantum-safe security, sandboxed proofs of concept and a talent pipeline - on the same day the FSDC reviewed the financial sector's cyber resilience strategy.
What happened
- C-DAC, an autonomous society under MeitY, and Bank of India signed an MoU on 22 October 2026 on quantum financial innovation and emerging technologies in banking.
- It frames joint research, development, pilot implementations, technology demonstrations and capacity building, combining C-DAC's HPC, AI, quantum, blockchain and cybersecurity work with the bank's nationwide, high-volume environment.
- The centrepiece is a Quantum Ecosystem for Financial Innovation, exploring quantum-inspired and quantum-safe technologies, with a prioritised portfolio of use cases, proofs of concept in secure sandboxes, feasibility assessment, benchmarking and adoption roadmaps.
- The MeitY Secretary called for a quantum-resilient financial ecosystem; C-DAC's Director General framed it as translating indigenous capability into banking solutions; the bank's Executive Director said quantum could reshape cybersecurity and complex financial decision-making.
- Beyond quantum the MoU covers blockchain and AI - intelligent document processing, fraud analysis, credit and financial analytics, secure and responsible AI, smart contracts, digital identity and secure data sharing - plus training in quantum computing, quantum security, AI and blockchain.
For Prelims
- Why quantum breaks banking cryptography: Shor's algorithm factors large integers and solves discrete logarithms efficiently on a quantum computer, which defeats RSA and elliptic-curve public-key cryptography - the basis of TLS, digital signatures and payment authentication. Grover's algorithm weakens symmetric keys but only by a square-root factor, so AES survives with longer keys.
- Post-quantum cryptography is classical mathematics believed hard for quantum computers - lattice-based, hash-based, code-based and multivariate schemes. NIST standardised the first set in 2024, including ML-KEM (Kyber) for key exchange and ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) for signatures.
- "Harvest now, decrypt later" is the operative risk: an adversary records encrypted traffic today and decrypts it when a capable machine exists, which is why migration begins before the threat matures. Crypto-agility - the ability to swap algorithms without rebuilding systems - is the design goal.
- Quantum key distribution is a different approach, using quantum states to detect eavesdropping on a key exchange; it needs special hardware and fibre, where post-quantum cryptography is a software migration. India's work runs through the National Quantum Mission (2023), a Rs 6,003.65 crore eight-year mission with four thematic hubs.
- C-DAC, founded in 1988 after supercomputer export restrictions, built the PARAM series and anchors the National Supercomputing Mission with IISc and MeitY; it also develops the Rudra servers and AUM processor line - which is what "indigenous" means in this release.
- The regulatory frame: the RBI issues the cyber security framework for banks and runs ReBIT for standards; the CERT-In directions of 2022 govern incident reporting; and the FSDC, chaired by the Finance Minister, is the apex body that coordinates financial sector stability across regulators.
- Tokenisation in the FSDC's sense is representing financial or real-world assets as digital tokens on a ledger - distinct from card tokenisation, the RBI measure replacing card numbers with device-specific tokens. Examiners conflate the two.
- Quantum-inspired algorithms run on classical hardware but borrow quantum formulations - used for portfolio optimisation, risk simulation and fraud detection; they are available now, which is why banks pair them with the longer-term quantum-safe migration.
For UPSC: The clearest Indian instance of post-quantum risk reaching a regulated industry, with a public sector bank as the test bed. Deploy it on quantum technology and the National Quantum Mission, on cyber security in finance, and on indigenous technology development.
What it is NOT: No timeline, no outlay, no named first use case and no indication of which systems would be migrated or in what order - the MoU describes a process for choosing, not a choice. Nothing on whether the work will follow the NIST post-quantum standards or a separate Indian standard, nothing on the RBI's position or supervisory expectations, and nothing on crypto-agility in the bank's existing core banking system, which is where the real cost sits. No mention of the National Quantum Mission, under which this work would naturally be funded.
For Mains
Syllabus: GS3.13 · GS3.18 · Linkage L2
Anchor
C-DAC and Bank of India have signed an MoU to build a Quantum Ecosystem for Financial Innovation, exploring quantum-safe and quantum-inspired technologies for banking through sandboxed proofs of concept, benchmarking and capacity building.
Substantiation (data)
The memorandum pairs C-DAC's high performance computing, AI, quantum, blockchain and cybersecurity capability with the bank's nationwide, high-volume environment, and extends beyond quantum to intelligent document processing, fraud analysis, credit analytics, secure and responsible AI, smart contracts, digital identity and secure data sharing, with training in quantum computing and quantum security. The MeitY Secretary framed the objective as a quantum-resilient financial ecosystem. The same day, the 30th FSDC meeting reviewed the financial sector's cyber resilience and took note of a Financial Sector Cyber Security Strategy, and discussed tokenisation of financial assets.
Position
Starting now is the whole point. The cryptography that protects banking today fails against a machine that does not yet exist, but traffic captured now can be decrypted when it does - so the migration has to begin years before the threat matures. A public sector bank with a large legacy estate is the right place to learn what that migration costs, and pairing it with a government computing institute keeps the capability domestic rather than bought in.
Counterpoint
There is no commitment here. A framework MoU with no timeline, no budget and no named system to migrate is a statement of intent, and the hard part of post-quantum work is not research but inventory: finding every place a bank uses public-key cryptography and making it swappable. The release also does not say whether the work will adopt the NIST standards already published, mentions neither the RBI's supervisory expectations nor the National Quantum Mission, and offers quantum-inspired optimisation - available today on classical hardware - alongside a long-term security migration as if they were one project.
Way forward
Publish a cryptographic inventory and a migration roadmap with dates, adopt the published post-quantum standards rather than inventing a parallel set, and have the RBI state a supervisory expectation so that migration is sector-wide rather than bank-by-bank. The proof of concept to watch is a quantum-safe key exchange in a live payment path.
Conclusion
The right risk, identified early, by the right pair of institutions. Everything now depends on whether an inventory and a date follow the memorandum.
Deploys into: Quantum technology and the National Quantum Mission · Cyber security in finance · Indigenous technology development · Emerging tech in banking
Ministry of Electronics & IT · 2026-10-23 · PRID 2327274 · PIB source ↗