Naver Pay CISO Says Quantum-Resistant Encryption to Cover All Naver Services This Year

Naver Pay Rolls Out Quantum-Resistant Encryption Across Its Services

"About 80% of Naver Services Have Adopted It, With Mail and Blog to Follow"

Security Needs Intensify With Rollout of Face-Payment Terminals

"Biometric Data Can't Be Changed, So We Moved Early on the Latest Security Technology"

"About 80% of Naver services have adopted post-quantum cryptography," Lee Hyun-jin, chief information security officer at Naver Pay, told the Korea Economic Daily.

Naver Pay is sequentially expanding the PQC technology it first adopted on its own platform to Naver Mail, Blog and Cafe. Lee said quantum computing should be treated as an inevitable future and prepared for in advance.

Naver Pay has drawn attention as the first company in South Korea to introduce post-quantum cryptography, or PQC, across all of its services. PQC is encryption designed to be difficult to break even with quantum computers.

Quantum computers, which are expected to be introduced in earnest in the 2030s, can process calculations much faster than conventional computers by using quantum mechanics. That has fueled concern that encryption that is hard to crack today could eventually be broken.

From Naver Pay to Naver More Broadly

Naver Pay moved early on PQC to guard against "harvest now, decrypt later" attacks, in which hackers collect large amounts of encrypted data and decode them later with quantum computers.

"Decryption algorithms using quantum computers have already been mathematically validated," Lee said. He added that Naver Pay invested early so user information would remain protected even if current cryptographic systems are rendered ineffective.

Naver is also broadening the use of PQC. Naver Pay worked with affiliate Naver Cloud from the technology development stage.

Naver Cloud helped because it has infrastructure operating capabilities, including data centers, Lee said. He added that Naver's experience running large-scale IT services stably allowed it to apply PQC quickly.

Naver Pay adopted PQC algorithms standardized by the U.S. National Institute of Standards and Technology while also maintaining existing encryption methods. With few cases of PQC deployment in South Korea or overseas, the company said it took a cautious approach.

The system was designed so the existing encryption method could serve as a minimum safety net if unexpected problems emerged in the new framework, Lee said. The service transition has been completed without disruptions.

Starting With Face Payments, While Preparing for AI

Naver Pay accelerated its PQC rollout in the second half of last year as it pushed ahead with its N Pay Connect terminal business, which includes face-payment functions.

The terminals are installed at individual businesses such as cafes and restaurants, making them vulnerable not only to network hacking but also to physical tampering. Because they handle both biometric and payment data, security concerns were viewed internally as the biggest obstacle to introducing the terminals.

With security staff involved from the planning stage of N Pay Connect, Naver Pay applied PQC to all data transmission across its services. "Face data, unlike passwords, is biometric information that cannot be changed if leaked, and highly reliable recognition is critical," Lee said. "Our internal principle was to apply the latest security technology early, even in the initial stage of commercialization, if we could secure it."

Beyond quantum computing, Lee called artificial intelligence the top priority in corporate security because technological change is moving fastest in that area.

The company is focused on how to use AI safely and how to respond effectively to external threats that misuse AI, he said. It will continue introducing new security technologies, including AI-based autonomous penetration testing.

Park Si-on, Korea Economic Daily reporter ushire908@hankyung.com