Every tap, swipe, and transaction begins with a connection. That connection needs to be secure from the start. A point-of-sale (POS) terminal has one job: turn a card payment into an approved transaction. But getting that payment from the card reader to a Payment Facilitator (PayFac) like Stripe, Square, or Toast, or a backend processor like Fiserv, requires data to travel across store networks, cellular connections, and the public internet.
Because much of this infrastructure still relies on aging cryptography, like the Triple Data Encryption Standard (3DES) and RSA, the rapid advance of quantum computing raises urgent security questions. Most quantum security planning in finance focuses on the backend: data centers, interbank messaging, and customer databases. But one of the biggest vulnerabilities is much closer to the transaction itself: the card reader.
A single retailer or processor manages thousands of live endpoints across hundreds of locations, each actively encrypting cardholder data. The Financial Services Information Sharing and Analysis Center (FS-ISAC) already treats this physical payment infrastructure as a near-term quantum concern, urging the industry to address the exact vulnerabilities sitting in plain sight.
Where Payment Security Breaks Down
Unlike a heavily guarded data center, a payment terminal usually sits on a countertop, at a checkout lane, or in a delivery driver’s belt — in plain view and out of direct IT control. That exposure makes it critical to secure the network layer and the last mile connection to it.
Three places carry the risk:
- PIN Encryption in Transit: Largely reliant on 3DES-based Terminal PIN Keys, this symmetric algorithm is already considered weak against classical attacks, let alone quantum decryption.
- Remote Key Loading (RKL): Terminals use RSA-2048 certificates to establish a master key, which underwrites everything the terminal subsequently encrypts.
- The EMV Certificate Chain: The vital trust chain linking the card, issuer, and chip certificates is RSA-based from top to bottom. If RSA is broken, the entire chain becomes forgeable.
Quantum computing escalates these vulnerabilities from theoretical to urgent. None of these risks exist in isolation. Because a single Terminal PIN Key is frequently shared across a batch of devices, a compromised key doesn’t just expose one terminal, it exposes every terminal provisioned from it. A broken RKL certificate compromises every key it ever loaded, and a forged EMV certificate can pass as legitimate anywhere that chain is trusted.
Securing the Endpoint with ZeroTier Quantum
To address this, we built ZeroTier Quantum, the world’s first end-to-end quantum-secure networking platform. Designed to secure the network layer connecting terminals, store LANs, and processor gateways, it serves as a critical PQC defense layer without replacing existing point-to-point encryption (P2PE) or EMV protocols.
We aren’t starting from scratch. ZeroTier One already facilitates payment connectivity at scale, trusted by major POS providers across public transport, retail, and even hospitality. ZeroTier Quantum builds on this foundation, introducing a Post-Quantum Cryptography (PQC) SD-WAN that combines iron-clad connectivity with the high performance and flexibility required by large terminal fleets.
It embeds hybrid, FIPS 140-3 post-quantum cryptography directly into the transport layer through the ZeroTier Transport Protocol (ZTP). ZeroTier Quantum also uses NIST-approved post-quantum standards ML-KEM-1024 (FIPS 203) for key exchange and ML-DSA-87 (FIPS 204) for digital signatures. Unlike the RSA and 3DES that terminals rely on today, these algorithms are designed to resist attacks from quantum computers, which closes the HNDL window for payment traffic.
Additionally, every terminal gets its own PQC-backed cryptographic identity instead of a shared credential, which matters more here than almost anywhere else. A single retailer can run thousands of unattended devices, and each one needs to be provisioned, authenticated, and rotated without a technician standing in front of it.
Keys rotate continuously instead of sitting static for the life of the device, which extends perfect forward secrecy into the post-quantum era. Even if one session’s keys were somehow compromised, they can’t be used to decrypt sessions before or after.
And here’s the real kicker: The whole platform is software-defined, so you’re not locked into a specific router or gateway vendor’s own PQC upgrade cycle to get any of this running across your fleet. It also runs on the terminals and gateways you already have. There’s no rip-and-replace hardware refresh required, which makes it a cost-effective way to get post-quantum protection across thousands of devices.
Software-Defined Quantum Agility
Store networks need to keep POS traffic separate from the rest of the network while making it easy to bring thousands of unattended terminals online. And security can’t come at the cost of performance. No slowdowns, no checkout delays, no added complexity. ZeroTier Quantum delivers secure, high-performance connectivity across traditional checkout terminals, mobile POS apps, handheld devices, and digital wallet infrastructure.
But this isn’t just about existing infrastructure. POS systems have a tendency to stay in place for years, sometimes longer. Every new retail location, restaurant, bank branch, or hospitality property is an opportunity to build in security from day one.
To that end, and perhaps more importantly, it provides quantum agility, or the ability to update or switch the cryptographic algorithms a system uses as standards evolve or vulnerabilities emerge, without replacing the underlying hardware or rebuilding the system.
Physical payment infrastructure is notoriously difficult to update. While a data center can be patched overnight, hardware refreshes for thousands of distributed terminals can take years. A terminal heavily reliant on hardware-bound cryptography is fixed to the algorithms it shipped with. If standards change or an algorithm weakens, the only solution is replacing the physical device. ZeroTier Quantum keeps the cryptography in software instead, so new algorithms can be rolled out to every terminal remotely when standards change, with no new hardware. This capability is called quantum agility, and it’s native to ZeroTier Quantum and available just out of the box.
It also gives organizations a stronger compliance foundation. The Payment Card Industry Data Security Standard (PCI DSS) requires strong cryptography and network segmentation, while NIST FIPS post-quantum compliance provides concrete security benchmarks.
Quantum threats aren’t waiting for your next hardware refresh and neither should your payment infrastructure. ZeroTier already supports payment connectivity at scale. Now we’re bringing that experience into the post-quantum era, securing today’s terminals as well as tomorrow’s payment experiences.
Ready to bring quantum-secure networking to your payment device fleet? Contact sales to learn how ZeroTier’s PQC SD-WAN delivers the security, performance, and flexibility your payment infrastructure needs, whether you’re securing existing locations or building new payment environments from the ground up.
