Banque de France and MAS exchange post-quantum encrypted email across continents
5 NOVEMBER 2024, PARIS AND SINGAPORE
The Banque de France and the Monetary Authority of Singapore announced that they completed a joint experiment in post-quantum cryptography, according to the Banque de France's press release. Post-quantum algorithms resist attack by future quantum computers. The two central banks exchanged digitally signed and encrypted emails protected by the CRYSTALS-Dilithium signature scheme and the CRYSTALS-Kyber key-encapsulation scheme, a method for agreeing on secret keys, using Microsoft Outlook with a post-quantum plugin. The messages crossed continents over standard internet infrastructure, not a dedicated network.
The Banque de France reports that the trial showed post-quantum email security is practical. It also draws a broader lesson: standardizing algorithms is not enough, because application protocols, public key infrastructure, digital certificates and secure email standards must also carry them. The release points to possible use in payment networks, and both institutions plan to extend experimentation to critical financial transactions, in particular cross-border payment network transactions. The Banque de France added that it had anticipated experiments of this kind with partners since 2022.
Finextra's report is consistent with the central bank account. It adds that the algorithms followed recommendations from France's ANSSI, the national cybersecurity agency, and NIST standards, and that the partners saw potential for integration into payment networks. This was a technical trial of email. It was not a test of a payment system and not a regulatory instrument, and it creates no obligation for any institution. The payment-network application remains a stated intention, not a result.
Why it matters. Central banks are testing post-quantum tools on live, cross-border communication, which suggests supervisors will treat this as a normal part of planning. The finding that certificates, protocols and email standards must change as well as the algorithms is a useful warning: organizations should expect migration to touch many systems, not one cryptographic library. Nothing here is mandatory, but the stated plan to move toward cross-border payment transactions indicates where pilots may head next.