MyDigital ID Prepares For Quantum Threats With Post-Quantum Cryptography

MyDigital ID is continuing to strengthen its cybersecurity foundations as the national digital identity platform becomes increasingly important across Malaysia's expanding digital ecosystem. With more government services and private-sector platforms integrating MyDigital ID — and some applications already using it as their primary authentication method — protecting the platform against both present and future cyber threats is becoming increasingly important.

One of the technologies now being prepared is Post-Quantum Cryptography, or PQC. The move is intended to ensure that MyDigital ID remains secure even as quantum computing develops to the point where conventional cryptographic techniques could eventually face new risks.

Preparing MyDigital ID For The Quantum Computing Era

Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi confirmed that preparations are underway for MyDigital ID to adopt Post-Quantum Cryptography as part of its longer-term security strategy.

Quantum computers remain an emerging technology, but sufficiently powerful systems could potentially challenge some of the cryptographic algorithms widely used today. That creates a need for critical digital infrastructure to begin preparing well before those systems become practical threats.

For a national identity platform such as MyDigital ID, waiting until quantum computers become widely available would be far too late. Cryptographic transitions across large digital systems can take years, especially when hundreds of applications and services depend on the same identity infrastructure.

Preparing for PQC now therefore gives the platform more time to adapt gradually.

What Is Post-Quantum Cryptography?

Post-Quantum Cryptography refers to cryptographic algorithms designed to remain secure against attacks using both conventional computers and future quantum computers.

Unlike quantum cryptography, PQC does not necessarily require specialised quantum hardware. Instead, it relies on new mathematical approaches that can be implemented using conventional computing systems.

The objective is to replace or supplement existing cryptographic methods that could eventually become vulnerable to sufficiently powerful quantum machines.

For users, the transition should ideally happen largely behind the scenes. People should still authenticate and access services normally while the security infrastructure underneath gradually moves towards newer algorithms.

Crypto-Agility Will Help MyDigital ID Adapt

Another important part of the strategy is crypto-agility.

According to Ahmad Zahid, MyDigital ID is preparing its systems so cryptographic algorithms can be changed in a structured and controlled manner as standards evolve.

This is particularly important because cybersecurity standards do not remain static.

An algorithm considered secure today may eventually be replaced because researchers discover weaknesses or because computing technology becomes powerful enough to challenge it. A crypto-agile system avoids building the entire platform around one cryptographic method that becomes extremely difficult to replace later.

Instead, security components can be updated as newer standards are adopted.

The Strategy Aligns With Malaysia's National Cryptography Policy

The move towards Post-Quantum Cryptography and crypto-agility is being developed in line with evolving international standards and Malaysia's National Cryptography Policy.

That alignment matters because digital identity infrastructure needs to remain interoperable with the wider technology ecosystem.

Authentication systems interact with mobile devices, government portals, financial services and other digital platforms. Cryptographic changes therefore need to follow established standards rather than being implemented independently.

A coordinated approach should also make it easier for connected services to migrate towards newer security technologies over time.

MyDigital ID Already Uses Multiple Layers Of Cryptographic Protection

Post-Quantum Cryptography will not be the first advanced security mechanism used within MyDigital ID.

The platform already relies on several layers of cryptographic and authentication controls to protect the confidentiality and integrity of users' digital identities.

This layered approach is important because no single security technology should be expected to defend against every possible attack.

Instead, several mechanisms work together so that compromising one layer does not automatically give an attacker complete access.

Multi-Factor Authentication Adds Another Verification Layer

One of the main protections highlighted by the government is multi-factor authentication, or MFA.

Rather than granting access based entirely on one credential, users must complete multiple layers of verification before being allowed into participating services.

MFA has become increasingly important across banking, enterprise systems and government platforms because passwords alone are vulnerable to phishing, credential reuse and other forms of compromise.

Using additional verification makes it considerably harder for an attacker to impersonate a legitimate user simply because one credential has been stolen.

For a national digital identity platform, this additional protection is particularly important.

Public Key Infrastructure Helps Verify Identity

MyDigital ID also uses Public Key Infrastructure, commonly known as PKI.

PKI plays an important role in verifying digital identities and securing transactions. It relies on cryptographic keys and digital certificates to help confirm that users and systems communicating with one another are legitimate.

Within a digital identity environment, this provides a mechanism for verifying identity while also helping protect information against unauthorised modification.

It can therefore reduce the risk of attackers impersonating legitimate users or tampering with data exchanged during digital transactions.

SHA-256 Is Also Part Of The Security Architecture

The platform also makes use of the SHA-256 hashing algorithm.

Hashing converts data into a fixed-length cryptographic representation rather than storing or processing the original information directly in certain scenarios.

Unlike conventional encryption, a properly implemented cryptographic hash is designed to be one-way. The original information cannot simply be recovered by reversing the hash.

This makes hashing useful for protecting sensitive information where systems need to verify data without keeping an easily readable version of it.

Together with encryption and other security controls, SHA-256 contributes to the platform's broader data-protection architecture.

Privacy By Design Is A Core Principle

MyDigital ID has also been developed according to a privacy by design approach.

Rather than adding privacy controls only after the platform has already been built, the principle aims to incorporate privacy protections directly into the architecture and operation of the system.

Sensitive information should therefore not simply be stored as easily readable plain text where it could become exposed during a breach.

Hashing, encryption and other cryptographic protections are used to reduce the risks surrounding confidential identity data.

For a national identity system, that design philosophy is essential because the platform deals with information that could potentially be abused for impersonation or identity theft.

The Goal Is To Reduce Fraud And Identity Theft

The combination of MFA, PKI, hashing, encryption and eventually Post-Quantum Cryptography is intended to reduce several major cybersecurity risks.

These include:

No digital platform can realistically claim that cyber risk has been completely eliminated.

The more practical objective is to create multiple layers of protection so attacks become progressively more difficult and compromises can be contained before they cause greater damage.

Why Future-Proofing Matters For A National Digital Identity

The importance of long-term security becomes clearer when looking at how rapidly MyDigital ID is expanding.

A digital identity system that only supports a handful of government portals can be upgraded relatively easily.

A platform integrated across hundreds of services is much more complicated.

Any major cryptographic transition has to consider compatibility with every connected application, authentication process and device.

Beginning the transition towards quantum-resistant security early gives MyDigital ID more time to introduce changes without disrupting users.

MyDigital ID Now Has 14.2 Million Registered Users

The scale of the platform has already become substantial.

As of 7 October 2026, MyDigital ID had reached approximately 14.2 million registered users.

That represents a significant portion of Malaysia's population and demonstrates how quickly the national digital identity initiative has expanded.

As adoption grows, the consequences of any security weakness would also become much larger.

Protecting MyDigital ID is therefore no longer simply about securing another government application. It is becoming part of the security foundation supporting Malaysia's wider digital economy.

More Than 82 Million Logins Have Been Recorded

Since 2024, MyDigital ID has processed approximately 82.75 million login transactions.

Daily usage has now exceeded 200,000 transactions, showing that people are increasingly using the platform regularly rather than simply registering for an account and leaving it unused.

That growth also means authentication infrastructure needs to remain highly available.

Security measures must protect users without creating excessive delays or making the login process too complicated.

Finding that balance between strong security and convenience is one of the biggest challenges faced by digital identity platforms worldwide.

More Than 200 Applications And Services Are Supported

MyDigital ID now supports more than 200 applications and digital services across both the public and private sectors.

This expanding ecosystem makes the platform increasingly useful because one trusted identity can potentially provide access to many different services.

But it also means the security architecture needs to scale across organisations with very different technical environments.

A government portal, financial service and commercial application may all have different infrastructure, yet each needs to integrate safely with the same digital identity system.

Standardisation therefore becomes critical.

A Compromise Could Have Wider Consequences As Adoption Grows

The more services depend on one identity platform, the more valuable that platform becomes to attackers.

A compromised account could potentially provide access to several connected services rather than only one application.

That makes protections such as MFA especially important.

It also explains why the government is looking further ahead towards quantum-resistant technologies rather than focusing only on today's threats.

A national digital identity system is expected to operate for many years. Its security architecture therefore needs to anticipate technologies that may become relevant long before the platform itself reaches the end of its life.

Quantum Security Is A Long-Term Transition

Moving towards Post-Quantum Cryptography will not happen overnight.

Cryptographic algorithms are deeply embedded into operating systems, applications, security hardware, certificates and communication protocols.

Replacing them across a national identity ecosystem requires careful testing.

Systems need to ensure that new cryptographic methods work reliably across existing applications without causing authentication failures or compatibility problems.

This is where crypto-agility becomes particularly valuable.

Instead of performing one enormous migration, components can potentially be upgraded gradually as standards mature.

Security Needs To Evolve Continuously

The broader lesson is that digital identity security cannot be treated as something completed once the system launches.

Threats evolve constantly.

Attackers develop new techniques, cryptographic standards change and new technologies such as quantum computing introduce risks that may not have existed when the original system was designed.

Security therefore needs to become an ongoing process rather than a one-time project.

MyDigital ID's preparations for PQC indicate that the government is beginning to look beyond immediate threats and consider how the platform will remain secure several years into the future.

Public Confidence Will Be Essential

Technology alone will not determine the success of MyDigital ID.

Public confidence is equally important.

People need to trust that using a national digital identity platform will not unnecessarily expose their personal information or make identity theft easier.

Every additional security layer contributes towards that confidence, but transparency also matters.

Explaining how the platform protects identity information, how authentication works and how security standards evolve can help users understand why the system is being expanded.

Digital Identity Is Becoming Part Of Malaysia's Digital Infrastructure

As MyDigital ID expands across more government and private services, it increasingly resembles national digital infrastructure rather than just another authentication application.

The platform could eventually become one of the common ways Malaysians prove their identity online.

That creates opportunities for more convenient digital services, but it also means reliability and security become essential.

A widespread identity platform needs to be available when people need it while simultaneously protecting millions of accounts from fraud and cyberattacks.

Preparing for emerging threats such as quantum computing is therefore a logical part of that responsibility.

Final Thoughts

MyDigital ID's preparations to adopt Post-Quantum Cryptography show that Malaysia is beginning to think about digital identity security beyond the threats we face today. Quantum computers capable of breaking widely used cryptography may not yet be a practical everyday threat, but infrastructure as important as a national digital identity system needs to be designed with a much longer timeline in mind.

The introduction of crypto-agility should allow MyDigital ID to transition towards new cryptographic algorithms more systematically as international standards evolve. Meanwhile, existing protections including multi-factor authentication, Public Key Infrastructure, SHA-256 hashing and encryption continue to provide several layers of security around citizens' digital identities.

With 14.2 million registered users, 82.75 million login transactions since 2024, more than 200,000 daily transactions, and integration across over 200 applications and digital services, MyDigital ID is becoming an increasingly important part of Malaysia's digital ecosystem.

As that role grows, future-proofing its security is no longer optional. Preparing for quantum-era threats before they become an immediate problem is exactly the kind of long-term planning a national digital identity platform should be undertaking.