Daiwa Securities Group Announces Proof-of-Concept Results for Post-Quantum Cryptography (PQC) Technology in Online Services

Daiwa Securities Group Inc.

Daiwa Securities Co., Ltd.

Daiwa Institute of Research Ltd.

NEC Corporation

F5 Networks Japan G.K.

DigiCert Japan G.K.

Daiwa Securities Co., Ltd. (hereinafter "Daiwa Securities"), and Daiwa Institute of Research Ltd. (hereinafter "DIR"), both under the umbrella of Daiwa Securities Group Inc. (hereinafter "Daiwa Securities Group"), in collaboration with NEC Corporation (hereinafter "NEC"), F5 Networks Japan G.K. (hereinafter "F5 Networks"), and DigiCert Japan G.K. (hereinafter "DigiCert"), are pleased to announce the results of their proof-of-concept (hereinafter "PoC") for Post-Quantum Cryptography (PQC) [1] technology, in preparation for the quantum computing era.

This PoC aimed to enhance the security of internet communications in Daiwa Securities' online services and involved technical verification for the formal introduction of PQC.

With the advancement of quantum computer development, it has been pointed out that the security of conventional public-key cryptography may be compromised in the future. Recognizing the urgent need for early PQC adoption, especially for financial institutions handling sensitive customer information, Daiwa Securities and DIR, together with NEC, F5 Networks, and DigiCert, who possess specialized knowledge in PQC, conducted this PoC using online services as an initiative towards the practical implementation of PQC in the securities industry.

The results of this PoC, along with considerations on standardization trends and migration strategies, have been compiled into a white paper. The main points are as follows:

① PoC Results

It was revealed that while the increase in processing time associated with PQC key exchange in internet communications is limited, the increase in communication volume and packet count due to larger key sizes necessitates prior confirmation for communication environments where sufficient bandwidth is not secured.

② Standardization Trends It was organized that some cryptographic processing used in internet communications is still under standardization within the industry, requiring a phased migration based on future standardization trends.

③ PQC Migration Approach Given that multiple cryptographic algorithms are used in the system verified in this PoC, it was suggested that establishing a dedicated team to consider cryptographic migration and starting to create an inventory of cryptographic usage locations and algorithms would be effective for a comprehensive system-wide approach.

Based on the verification results, Daiwa Securities Group has formulated a policy for the formal introduction of PQC and will promote enhanced security and the construction of a safe system infrastructure with an eye toward the practical application of quantum computers.

[1] Post-Quantum Cryptography (PQC) refers to a general term for cryptography that is considered to maintain security even when quantum computers with sufficient computing power become practical.

Roles of Each Company

Daiwa Securities Group Inc.

Responsible for internal coordination and adjustments within the group, progress and risk management, and formulated a PQC introduction policy for Daiwa Securities Group's online services that balances security and convenience based on the verification results.

Daiwa Securities Co., Ltd.

Verified compatibility, processing performance, and operational impact when applying PQC to online services in this PoC activity, and will reflect the results in the system design and operational policy for actual operation.

Daiwa Institute of Research Ltd.

Leveraged its knowledge from previous PQC PoCs to consistently implement everything from building the verification environment to scenario creation, technical verification, and evaluation. Furthermore, it compiled the results into a white paper, contributing to knowledge sharing and deeper discussion within the financial industry.

NEC Corporation

Provided expert opinions on PQC for the PoC, contributing to the improvement of technical reliability. Also leveraged its research achievements and knowledge in quantum technology to review the white paper.

F5 Networks Japan G.K.

Provides PQC-compatible ADCs (Application Delivery Controllers), supporting the foundational technology for realizing next-generation network infrastructure.

DigiCert Japan G.K.

DigiCert Inc.

From its position as one of the world's leading Certificate Authorities participating in the creation of internet standards, provided insights into international standardization trends for PQC and expertise in PKI (Public Key Infrastructure) for the secure operation of public-key cryptography.

The detailed white paper can be found on the Daiwa Institute of Research website.

https://www.dir.co.jp/report/technology/security/20260331_025651.html

End