Preparing for the Quantum Computing Era: Why Change Services 10 Years Early with Quantum-Resistant Cryptography?

Toss Payments aimed to raise its security level without disrupting integrations with tens of thousands of merchants, so instead of pushing the change all at once, it carried out the transition in stages over 4 years.

The first step was adopting HTTP/3 in 2022. By applying the latest communication protocol, TLS 1.3 naturally followed along, raising both security and performance together without requiring any separate work from merchants.

The longest and most difficult task was removing vulnerable Cipher Suites. Some older merchant servers only supported vulnerable combinations, so rather than cutting these off all at once, Toss Payments provided individual guidance and technical support to each merchant 6 months to a year in advance before phasing them out.

During the same period, TLS 1.3 was also applied sequentially by endpoint, so that by 2025 all endpoints supported it. Older clients kept using TLS 1.2, while the latest environments automatically selected the more secure channel, minimizing the burden of the transition.

This experience became the basis for the decision to proactively adopt quantum-resistant cryptography (PQC). The conclusion was that even though quantum computers are not yet commercialized, preparation must happen in advance to block Harvest Now, Decrypt Later attacks, in which encrypted data is collected now and decrypted later.

Toss Payments began full-scale preparations starting 2025 and completed the rollout in April 2026. Merchants now automatically use a more strengthened secure communication channel without any separate settings or updates, and Toss Payments announced that on April 3, 2026, it applied NIST-standard PQC to its payment services for the first time in Korea's financial and IT industry.