The experiment sought to assess the integration of the new standardized PQC algorithms validated by the U.S. National Institute of Standards and Technology (NIST) in August 2024, within existing communication channels, without modifying critical systems such as applications, browsers, or identity and access management (IAM) systems. The project focused on regulatory file transfers sent by Allianz France through Banque de France’s OneGate platform, used by supervised entities for their weekly reporting obligations.
A hybrid approach to address emerging threats
A hybrid “tunneling” approach was implemented to ensure end-to-end protection of sensitive data against both present and future quantum threats, including “store now, decrypt later” attacks and identity impersonation. The project relied on the latest international standards and European cybersecurity recommendations, in line with ongoing standardization processes.
A turning point in the development of post-quantum cryptography for financial institutions
By demonstrating the feasibility of implementing PQC, the project provides a concrete pathway toward operational transition to post-quantum security within financial infrastructures. This initiative underscores the need to build crypto-agile architectures aligned with international standards, while preparing ambitious migration strategies across the ecosystem.
This achievement is part of Banque de France’s ongoing efforts since 2022, exemplified by the success in 2024 of a first PQC experiment conducted jointly with the Monetary Authority of Singapore (MAS), and by the publication that same year by OSMP – the Observatory for the Security of Payment Means – of a set of recommendations (available [here]).
Denis Beau, First Deputy Governor of Banque de France, stated: “The success of this experiment marks a new step in our roadmap to mitigate cyber risks and ensure the resilience of our financial system by promoting the adoption of post-quantum cryptography.”
The full report is available here.