# The Next-Generation Contactless Payments - Ecos
source: https://developer.mastercard.com/blog/next-generation-contactless-payments-ecos/index.md

Authors: Bob Reany. Summary On January 26th, we announced the availability of Enhanced Contactless or Ecos specifications for our industry partners. This is the initial step towards future-proofing contactless payments for the quantum era. Ecos is designed with state-of-the-art security and privacy standards and uses best-in-class cybersecurity principles and techniques. There is no immediate impact to existing contactless payments. Over time, issuers and acquirers will deploy Ecos, and it will be seamless to consumers and merchants.  First and foremost, what is Enhanced Contactless (Ecos)? Ecos is a huge step forward in driving advanced security and cryptography standards for contactless payments. Ecos acts like an invisible shield, better securing the way we pay tomorrow and beyond, making Mastercard the first payment network to bring quantum-era security and privacy to contactless payments. Ecos is designed to make contactless transactions resistant to attacks from both traditional and quantum computers. So, the data exchange between card or device and the merchant terminal is as fast as current technology, yet three million times harder to break. And it is engineered with state-of-art privacy standards, in line with the many privacy regulations and best practices, such as GDPR and PSD2. Over time, we envision that the in-store payment experience will become increasingly contactless-only. These new specifications will help ensure a consistent user experience regardless of form factor. What was the origin of Ecos? When did the team start the initial conversations? As many of us know, security upgrades happen continuously. For contactless specifically, we review cryptographic key lengths each year to ensure contactless payments are secure and fast. For a while now, there have been growing concerns around quantum computing threats. Ecos gives us a stronger base for our brand. It will also be the new "best in class" baseline as we continue to work on joint industry standards. Ecos is a culmination of at least 5 years of work by a dedicated team who are the absolute experts in this field. By acting now, we can secure transactions for decades to come, upgrade cardholders' privacy protection and reduce friction at checkout. Why are we introducing Ecos now? The journey in developing and launching new technology at this scale, is a long and complicated path. Releasing the specification is the first of many steps. The actual roll out takes years and legacy technology takes a long time to completely replace, like magnetic stripe (mag stripe). We are sharing the Ecos specifications with our industry partners so that they can integrate Ecos into their product roadmap and bring it to market. There's no immediate need for our stakeholders to implement Ecos now. To be clear, the current contactless technology is still good for the foreseeable future, we are just making it even better with Ecos! How will Ecos be activated and integrated by chip manufacturers, handset makers, issuers, acquirers, merchants etc? We are sharing the specifications with card and terminal manufacturers, who will integrate them as part of their roadmap and make new products available. Importantly, the new terminals and cards will support both the current and new technology, so there will be no disruption to the market. Here's a quick view on what the roll-out looks like: Merchants are activated through normal terminal updates or end-of-life terminal replacement. It's transparent for acquirers. Transactions are authorized and cleared as they are today. Issuers can include Ecos as part of their normal card re-issuance cycle and bundle it together with other updates they have planned. Wallet operators and phone manufacturers will be provided with a Software Development Kit (SDK) to support Ecos and bring it to market. Tell us something about Ecos that only security experts will understand. This is the stuff I love! It's technical but bear with me. For the non-expert I should first say that cryptography is just a math problem that uses an algorithm and a "key" to scramble information. Current cryptography methods relied on increasing key lengths to protect the data, as it is difficult to "guess" a longer key. Newer methods use more sophisticated approaches to develop keys (like a point on a graph). Contactless interactions use two types of cryptography -- symmetric and asymmetric. Symmetric cryptography is using the same key to both encrypt (lock) and decrypt (unlock). We've been using Triple DES (Data Encryption Standard), but with Ecos we are moving to AES (Advanced Encryption Standard) which is better, more efficient and quantum-resistant. Asymmetric cryptography takes two different keys -- one to lock and another to unlock. Historically, we have been using RSA. With Ecos we are moving to ECC (Elliptic Curve Cryptography) which is three million times harder to break than existing asymmetric cryptography. An easy way to think of this is like adding additional rows and columns to a Rubik's Cube, it becomes exponentially harder to solve or break, in this instance. We know face-to-face payments are forever changed. We see contactless as being the predominant way people will pay and interact. Ecos gives us the foundation to make sure that both our transactions and interactions continue to be simple, safe and secure, no matter how you pay (card, mobile, wearable) or where you are in the world.