India’s E-Rupee Leads the Secure Adoption of CBDCs

Central Bank Digital Currencies, or CBDCs, are gaining global traction as an alternative to distributed crypto currencies. By the end of 2024, 91% of surveyed central banks were actively exploring CBDCs, with many moving from research into pilot or launch phases.

Ruchin Kumar, vice president for South Asia at Futurex, offers his perspective on the growth and adoption of CBDCs. He also explains how hardware security modules or HSMs offer robust cryptographic encryption with the latest industry algorithms to secure CBDC payments.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

With more than 25 years of experience in IT security sales across APAC, Kumar is an adviser to RBI, India’s central bank and payments authority. He has led national mission-critical payments projects in India, including RTGS, CTS, UIDAI Aadhaar, GSTN, Project Insight, UPI, BBPS and CCTNS, transforming financial transactions and data security across government and corporate sectors.

Edited Excerpts Follow:

How are CBDCs being adopted globally and what trends are shaping their growth in India?

Cryptocurrencies such as stablecoins are decentralized, creating governance challenges. Central banks want to maintain control, and governments showed interest in CBDCs as they provide flexibility similar to cryptocurrencies that have centralized control. It can be governed by both the government and also central banks.

As many as 114 countries are running their own CBDC projects, some of which are in the early phases. The European Central Bank has a CBDC called the digital euro.

India has the e-rupee, which will eventually be used as a legal tender for domestic payments as well as for international transactions and cross-border payments.

Ever since RBI launched the e-rupee, or digital rupee, in December 2022, there has been between INR 400 to 500 crore – or $44 to $55 million – in circulation. Many Indian banks are participating in this pilot project.

What factors are critical for the mass adoption of CBDCs?

Building broad awareness of CBDCs as a secure method for financial transactions is essential. Government and RBI-led awareness campaigns highlighting their security capability can strengthen user confidence and drive higher adoption and transaction volumes.

People who have lost money due to QR code scams, fake calls, malicious links and other forms of payment fraud need to feel confident about using CBDCs.

IT security companies are also cooperating with RBI to provide data confidentiality, transaction confidentiality and transaction integrity. E-transactions will be secured by hashing, digital signing and [advanced] encryption standards such as AES-192. This can ensure that the transaction data is not tampered with or altered.

How are interoperability challenges among financial systems affecting CBDC implementation and how are they being addressed?

RBI has published certain standards and exposed [secure] APIs for banks [and ecosystem players] to connect to its central application.

With this, the communication is completely secure. Digital signing has been implemented to check non-repudiation. When an individual completes a transaction, responsibility cannot be denied as the actions are recorded and can be produced as evidence in a court of law.

What standards has RBI adopted to secure encryption keys to protect CBDCs from fraudulent transactions and illegal tampering?

Data confidentiality and integrity need keys, algorithms and math. Keys are critical in order to do the math. RBI ensured that the life cycle of keys required for encryption, decryption and digital signing are managed inside FIPS 140-3 Level 3-certified HSMs. This makes the hardware tamper-proof and resistive to physical and side-channel attacks. If the hardware senses some irregularity by way of voltage fluctuation or multiple login attempts, it just blows itself [shuts down]. These are very sensitive devices.

The entire life cycle of these keys – from generation to usage – until the keys expire is managed within the cryptographic hardware devices.

When were HSMs introduced in India, what was the first application, and how did usage increase in the banking and payments industries?

HSMs use advanced encryption techniques to secure transactions and keys. The HSM hardware [boxes] act as cryptographic co-processors and accelerate the encryption and decryption processes to minimize latency in financial transactions. Security processes should not delay a financial transaction by even a few seconds – they must be instantaneous or real-time. And security must keep up with transaction volume.

There are various kinds of HSMs. Some specialize in PIN authentication during ATM or POS transactions. An HSM module is used within the bank, ensuring that the PIN is not exposed to any application or software.

But HSMs are not new. We began using HSMs for digital signing in payment applications back in 2002, when real-time gross settlement, or RTGS, was introduced in India. RTGS is used for transferring large amounts digitally. HSMs secure payment transactions by digitally signing them for authenticity.

India’s IT Act 2000 includes detailed specifications for the use of HSMs as cryptographic coprocessors. And that’s what made HSMs popular. They were next used for the cheque truncation system in years 2005-2006.

In 2008-2009, the National Payments Corporation of India, or NPCI, assumed responsibility for managing the RBI’s core banking systems. India’s major payment processing platforms are now supported by NPCI’s IT systems and secured by HSMs.

Current encryption algorithms would not suffice once quantum computing becomes mainstream in a few years. Are HSMs post-quantum ready?

Quantum computers are not yet mainstream. There are manufacturers and algorithm developers, and we are collaborating with them.

NIST and Microsoft released PQC algorithms and we have been certified to use these. Our HSMs are already PQC-ready.