SECURING DIGITAL PUBLIC INFRASTRUCTURE (UPI, AADHAAR, ONDC, E-RUPEE) AGAINST QUANTUM-AI ATTACKS: A LEGAL- TECHNICAL AUDIT

Abstract

India’s Digital Public Infrastructure— UPI, Aadhaar, ONDC and the e-Rupee — underpins financial inclusion and governance yet faces existential risk from the convergence of quantum computing and adversarial artificial intelligence. Existing cryptographic found ations (RSA, ECC) remain vulnerable to Shor’s and Grover’s algorithms while AI-driven model inversion, synthetic identity generation and data-poisoning attacks exploit authentication and ledger layers with unprecedented speed and scale. No integrated legal-technical framework currently evaluates these hybrid threats against India’s sovereign DPI stack or aligns remediation with the IT Act, DPDP Act and RBI guidelines. Through cryptographic threat modelling, adversarial AI simulation, doctrinal legal analysis and comparative benchmarking, this audit maps quantum-fragile primitives, quantifies AI-amplified attack surfaces and demonstrates systemic single points of failure in identity binding and payment integrity. Results establish that present security architectures cannot withstand near-term quantum-AI hybrids. The findings necessitate mandatory post-quantum migration, continuous AI-security audits and a statutory Quantum-AI Resilience Mandate to preserve national digital sovereignty and public trust.