Post-quantum cryptography for a ticketing platform

Context

Skedl is an event ticketing platform with integrated cashless payments, used by festival, concert and professional event organizers. Electronic ticketing relies on cryptographic signatures to guarantee ticket authenticity, and cashless relies on key exchanges to secure real-time payments. Both bricks historically depend on RSA and elliptic curves, algorithms whose lifespan is now limited by the gradual arrival of quantum computing. Two critical surfaces were identified as priorities: ticket signing and cashless transactions.

The challenge

Integrating post-quantum algorithms (CRYSTALS-Kyber for key exchange, CRYSTALS-Dilithium for signing) into a production platform is not trivial. These algorithms have very different performance and key size properties compared to RSA or elliptic curves. The challenge was twofold: preserve performance on the mobile payment terminals deployed at events, and guarantee compatibility with existing integrations during the transition.

Our solution

We designed a hybrid classical/post-quantum architecture allowing a progressive transition without service interruption. Each ticket is signed both with a classical algorithm and with Dilithium. The cashless key exchange uses Kyber, encapsulated in a layer allowing a switch to another algorithm if a new standard emerges. Sensitive keys are managed via an HSM to guarantee non-extraction.