Interbank messages move over leased lines, IPsec VPNs, and TLS, secured almost entirely by RSA and ECC. Long-lived certificates and PKI keys make this exactly the kind of target “harvest now, decrypt later” (HNDL) attacks were built for, and the same long-lived keys make it a prime target for “trust now, forge later” (TNFL) attacks too. HNDL means recording encrypted traffic today to decrypt once quantum computers can break it. TNFL is the identity version of that risk. Anything trusted today because of an RSA or ECC signature, from a bank’s certificate to a signed payment instruction, can be forged once those algorithms fall, letting an attacker impersonate a trusted institution or device.
The BIS, SWIFT, and central banks have already piloted post-quantum cryptography (PQC) on live transfers through Project Leap Phase 2, an initiative testing quantum-resistant digital signatures in existing payment systems. So, the real question isn’t whether payment networks need to prepare. It’s where to start hardening today.
Payment networks carry a specific version of the HNDL risk. Correspondent banking chains route a single transfer through multiple institutions, and each hop adds another connection secured under the same aging assumptions. Real-time gross settlement (RTGS) windows run on tight timing, so any fix has to work without slowing settlement down. And certificates in this space are often long-lived by design, which is exactly what makes captured traffic valuable to an attacker who can wait. None of that changes just because a pilot program is underway somewhere else in the stack.
Where the Exposure Sits
Payment security here breaks into two different problems. Message-layer signing is the public key infrastructure (PKI) and HSM infrastructure behind every payment instruction, and it’s exactly what Project Leap targets.
The connectivity layer sits underneath the leased lines, IPsec VPNs, and TLS sessions moving traffic between banks and RTGS systems. These are two different problems with two different owners, and fixing one doesn’t fix the other. A payment message can be perfectly signed with a fresh post-quantum certificate and still travel over a connection secured by RSA or ECC underneath, exposed the moment quantum decryption becomes viable.
Message-layer signing gets most of the attention because it’s what Project Leap and the standards bodies are testing publicly. The connectivity layer gets less attention because it’s assumed to be someone else’s problem, usually whoever manages the network, not whoever manages the PKI.
Where ZeroTier Quantum Fits
We built ZeroTier Quantum, the world’s first end-to-end post quantum networking platform, to secure the connectivity layer, and not just as a PKI replacement. We also built it to be something engineers anywhere can run. It’s managed through an intuitive web interface for day-to-day visibility, plus APIs and command-line tools, so provisioning and policy changes are something you automate, not something you file a ticket for.
ZeroTier Quantum embeds post-quantum cryptography (PQC) directly into the network layer through the ZeroTier Transport Protocol (ZTP). It uses NIST-standardized ML-KEM-1024 (FIPS 203) for quantum-resistant key exchange and ML-DSA-87 (FIPS 204) for quantum-resistant digital signatures and identity authentication. Both NIST algorithms align with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) requirements for national security level compliance.
Each connection starts with a four-message handshake based on the pqXX pattern from the PQNoise framework, so data flows after two round trips, and neither device’s identity crosses the wire in the clear. From there, every packet is encrypted with AES-256-GCM, and keys are derived with HMAC-SHA-512. Every algorithm in the suite is FIPS-approved.
For hybrid key exchange, ZeroTier Quantum pairs ML-KEM-1024 with classical P-384 elliptic-curve cryptography (ECC). On every connection, both algorithms contribute to the session key, so an attacker would need to break both to compromise the connection.
Additionally, there’s no cipher negotiation. The suite is fixed for each protocol version, so there’s no weaker option to downgrade a connection to. Cryptographic identities also replace shared credentials, giving organizations stronger authentication and the flexibility to adapt as PQC standards evolve. Each device’s identity is signed with both ML-DSA-87 and ECDSA P-384, and both signatures must verify. That closes off TNFL at the network layer: even an attacker who can break ECDSA can’t forge a device identity without also breaking ML-DSA-87.
ZeroTier Quantum encrypts every connection with post-quantum key exchange to defend against HNDL attacks. Project Leap is addressing that same exposure for signed payment messages, while ZeroTier Quantum closes it for the links that carry those messages between institutions.
Every session starts from fresh ephemeral keys, so long-term keys stolen later can’t decrypt recorded traffic. Sessions also rekey about once an hour of use, or every 805 million packets, whichever comes first, and the old keys are erased. No session key lives longer than two hours, well under the eight-hour maximum the NSA sets for top-secret use under its Commercial Solutions for Classified (CSfC) program. Rekeying happens in the background, without interrupting traffic.
And because the platform is software-defined rather than tied to specific hardware, your PQC timeline doesn’t depend on a hardware vendor’s release schedule.
Why It Fits Payment Networks
Speed is non-negotiable for RTGS and correspondent banking traffic. ZeroTier Quantum doesn’t add a chokepoint or extra latency to get there. Its peer-to-peer architecture connects nodes directly instead of backhauling traffic through a central gateway, so it can even improve performance compared with hub-and-spoke VPNs.
By default, devices don’t answer connection attempts from unknown hosts, so a scanner probing your settlement links gets no reply. It deploys as a software overlay on infrastructure you already run, so you’re not waiting on a PKI reissue cycle to start hardening your connections.
And crypto-agility, not a one-time migration, is the actual underlying ask here. Your infrastructure needs to adapt as standards keep evolving, independent of whatever timeline your certificate authorities are on. That gives you a concrete compliance story, backed by cryptography already doing the work instead of a roadmap promising it will. A highly regarded independent security firm audited the ZeroTier Transport Protocol in June 2026.
It also matters for how you sell this internally. Message-layer PQC migration touches your PKI team, your HSM vendor, and every counterparty you exchange signed messages with, so it moves at the pace of the slowest party in that chain.
Hardening the connectivity layer is a narrower change. It doesn’t touch your PKI or HSMs, and it doesn’t depend on every counterparty in a signing chain finishing its own migration. You can start with the links you control, such as connections between your own data centers, branches, and settlement systems, and extend to counterparties from there.
The connectivity layer is exposed right now, just as much as the message layer BIS and SWIFT are already piloting fixes for. You don’t need to wait on that timeline to start hardening your own connectivity layer. HNDL attacks don’t pause while standards bodies finish their pilots. And neither should you.
Contact sales to learn how ZeroTier’s PQC SD-WAN and next-generation VPN capabilities can bring the security, performance, and flexibility of quantum-secure, resilient networking to your payment network’s connectivity layer.
